[RESOLVED] Explorer.exe running at %50

Printable View

October 12th, 2010, 06:23 PM
704_Skate

[RESOLVED] Explorer.exe running at %50

OK so, I have probably x'd out of making this thread 3 times already, due to the fact I "though"I resolved it myself. hehe, I'll stop trying now(:

Anyways, something is keeping my system running at %50. Did a full Mbam scan (updated before I started) and it came up with a virus. I removed it, restarted... computer looked fine. Up until I started my browser or another program, maybe? Anyways, problem still persist. Keeps explorer.exe running at %50, and heating up my computer along the way. :(

Here's an SS of the virus.

http://i53.tinypic.com/344qyya.jpg

From what I remember, I think I was suppose to be downloading DIVx, and not xVID. Agh, stupid me.

Anyways, I found it was actually a program that I could uninstall. But I'm not that gullible, I know it won't just take the virus off like that. I uninstalled it.. funny enough, it stopped. Explorer was back to normal... so time for a reboot.

Rebooted.. problem persist. As you can tell, I was thinking this was DIVx not xVID. So I'm guessing it runs when I open Firefox...

All in all, I've removed the fake program, and deleted one virus. Ran a full mbam scan, and half of a super ainti-spyware scan, and a avast to no avail.
October 12th, 2010, 08:34 PM
Broni

Please, read here: http://discussions.virtualdr.com/sho...d.php?t=167915, and post required logs.
October 13th, 2010, 08:48 AM
704_Skate

Logs:

mbam;

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4800

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18904

10/12/2010 9:51:44 PM
mbam-log-2010-10-12 (21-51-44).txt

Scan type: Quick scan
Objects scanned: 166037
Time elapsed: 10 minute(s), 51 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
October 13th, 2010, 08:49 AM
704_Skate

gmer:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-10-13 08:45:30
Windows 6.0.6002 Service Pack 2
Running: m9kx36bk.exe; Driver: C:\Users\User\AppData\Local\Temp\pxldrpow.sys

---- System - GMER 1.0.15 ----

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0x8D47FBAE]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateSection [0x8D47F9D2]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwLoadDriver [0x8D47FB0C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject

---- Kernel code sections - GMER 1.0.15 ----

PAGE ntkrnlpa.exe!ZwLoadDriver 81B9FDF0 7 Bytes JMP 8D47FB10 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntkrnlpa.exe!ObMakeTemporaryObject 81C0B28F 5 Bytes JMP 8D47B5D4 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntkrnlpa.exe!ObInsertObject 81C64038 5 Bytes JMP 8D47CFFA \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntkrnlpa.exe!NtCreateSection 81C658C3 7 Bytes JMP 8D47F9D6 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntkrnlpa.exe!ZwCreateProcessEx 81CC5892 7 Bytes JMP 8D47FBB2 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1584] kernel32.dll!SetUnhandledExceptionFilter 767EA84F 4 Bytes [C2, 04, 00, 90] {RET 0x4; NOP }

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\system32\services.exe[644] @ C:\Windows\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00060002
IAT C:\Windows\system32\services.exe[644] @ C:\Windows\system32\services.exe [KERNEL32.dll!CreateProcessW] 00060000

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 eabfiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Development Company, L.P.)
AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x42 0x18 0x5A 0x48 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x42 0x18 0x5A 0x48 ...

---- EOF - GMER 1.0.15 ----
October 13th, 2010, 08:50 AM
704_Skate

DDS;

DDS (Ver_10-10-10.03) - NTFSx86
Run by User at 8:45:53.34 on Wed 10/13/2010
Internet Explorer: 8.0.6001.18904 BrowserJavaVersion: 1.6.0_18
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2037.643 [GMT -4:00]

AV: avast! antivirus 4.8.1368 [VPS 100219-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: avast! antivirus 4.8.1368 [VPS 100219-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\igfxpers.exe
C:\WINDOWS\PixArt\Pac207\Monitor.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ModLEDKey.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\WINDOWS\CNYHKey.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\svchost.exe -k apphost
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k iissvcs
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\uTorrent\uTorrent.exe
c:\windows\system32\inetsrv\w3wp.exe
C:\Users\User\Desktop\dds.scr
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uLocal Page = c:\program files\hewlett-packard\hp quick launch buttons\Blank.htm
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=PRESARIO&pf=laptop
mLocal Page = c:\program files\hewlett-packard\hp quick launch buttons\Blank.htm
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = 216.22.2.218:80
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [hpWirelessAssistant] "c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe"
mRun: [WAWifiMessage] "c:\program files\hewlett-packard\hp wireless assistant\WiFiMsg.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [PAC207_Monitor] c:\windows\pixart\pac207\Monitor.exe
mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
mRun: [CHotkey] mHotkey.exe
mRun: [ledpointer] CNYHKey.exe
mRun: [LchDrv] LchDrvKey.exe
mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: igfxcui - igfxdev.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
mASetup: {621FCD24-4498-4324-A81E-07D331376EDF} - c:\program files\pixiepack codec pack\InstallerHelper.exe

================= FIREFOX ===================

FF - ProfilePath - c:\users\user\appdata\roaming\mozilla\firefox\profiles\bv5h7rsw.speed\
FF - prefs.js: browser.startup.homepage - hxxp://www.weather.com/weather/local/28273?lswe=28273&lwsa=WeatherLocalUndeclared&from=searchbox_localwx
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPSFDMGR.dll
FF - plugin: c:\programdata\nexonus\ngm\npNxGameUS.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - falsec:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

============= SERVICES / DRIVERS ===============

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2009-10-12 165584]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-3-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-3-23 72944]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-10-12 17744]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2009-10-12 50768]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-19 40384]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-19 40384]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-19 40384]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2010-2-19 21504]
S3 LTXMD_VAC;Litex Media Virtual Audio Cable (WDM);c:\windows\system32\drivers\lmvac.sys [2008-12-18 18912]
S3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2009-5-27 29262680]
S3 PAC207;PC Camer@;c:\windows\system32\drivers\PFC027.SYS [2008-2-13 618112]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-3-23 7408]
S3 WMSvc;Web Management Service;c:\windows\system32\inetsrv\WMSvc.exe [2010-2-19 11264]
S4 gupdate;Google Update Service (gupdate); [x]

=============== Created Last 30 ================

2010-10-08 15:59:21 -------- d-----w- c:\program files\KeyTweak
2010-10-07 19:29:02 40960 ----a-r- c:\users\user\appdata\roaming\microsoft\installer\{9559f7ca-5e34-4237-a2d9-d856464ad727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe
2010-10-07 19:29:02 40960 ----a-r- c:\users\user\appdata\roaming\microsoft\installer\{9559f7ca-5e34-4237-a2d9-d856464ad727}\ARPPRODUCTICON.exe
2010-10-07 19:28:56 -------- d-----w- c:\program files\Project64 1.6
2010-10-06 20:27:05 5576704 ----a-w- c:\windows\CNYHKey.exe
2010-10-06 20:27:05 53248 ----a-w- c:\windows\ModLEDKey.exe
2010-10-06 20:27:05 49152 ----a-w- c:\windows\CNYUSB.dll
2010-10-06 20:27:05 36864 ----a-w- c:\windows\LchDrvKey.exe
2010-10-03 23:34:50 -------- d-----w- c:\program files\Xvid
2010-09-19 13:43:37 38848 ----a-w- c:\windows\avastSS.scr
2010-09-19 13:42:34 -------- d-----w- c:\progra~2\Alwil Software
2010-09-16 14:33:55 67072 ----a-w- c:\windows\system32\asycfilt.dll
2010-09-16 14:32:59 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-09-16 14:32:59 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-09-16 14:32:35 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-09-16 14:32:34 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-09-16 14:20:45 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-16 14:20:33 738816 ----a-w- c:\windows\system32\inetcomm.dll
2010-09-16 14:20:32 1616384 ----a-w- c:\program files\windows mail\msoe.dll

==================== Find3M ====================

2010-08-10 09:15:58 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-08-10 09:15:58 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-07-27 22:44:10 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-07-27 22:44:10 107808 ----a-w- c:\windows\system32\dns-sd.exe

============= FINISH: 8:46:47.90 ===============
October 13th, 2010, 08:50 AM
704_Skate

DDS Attach;

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-10-10.03)

Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 10/5/2007 7:07:17 PM
System Uptime: 10/13/2010 7:53:37 AM (1 hours ago)

Motherboard: Hewlett-Packard | | 30D9
Processor: Intel(R) Pentium(R) Dual CPU T2310 @ 1.46GHz | CPU | 1467/533mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 104 GiB total, 18.856 GiB free.
D: is FIXED (NTFS) - 8 GiB total, 1.496 GiB free.
E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1208: 10/10/2010 12:24:56 PM - Scheduled Checkpoint
RP1209: 10/11/2010 9:36:29 AM - Scheduled Checkpoint
RP1210: 10/12/2010 7:33:24 PM - Scheduled Checkpoint

==== Installed Programs ======================

µTorrent
7-Zip 4.57
Add or Remove Adobe Creative Suite 3 Master Collection
Adobe Acrobat 8 Professional
Adobe Acrobat 8.1.5 - CPSID_49013
Adobe Acrobat 8.1.5 Professional
Adobe After Effects CS3
Adobe After Effects CS3 Presets
Adobe After Effects CS3 Third Party Content
Adobe AIR
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe BridgeTalk Plugin CS3
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Contribute CS3
Adobe Creative Suite 3 Master Collection
Adobe Default Language CS3
Adobe Device Central CS3
Adobe Dreamweaver CS3
Adobe Encore CS3
Adobe Encore CS3 Codecs
Adobe ExtendScript Toolkit 2
Adobe Extension Manager CS3
Adobe Fireworks CS3
Adobe Flash CS3
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Flash Video Encoder
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Illustrator CS3
Adobe InDesign CS3
Adobe InDesign CS3 Icon Handler
Adobe Linguistics CS3
Adobe MotionPicture Color Files
Adobe PDF Library Files
Adobe Photoshop CS3
Adobe Photoshop Lightroom 2
Adobe Premiere Pro CS3
Adobe Premiere Pro CS3 Functional Content
Adobe Premiere Pro CS3 Third Party Content
Adobe Reader 8.1.5
Adobe Setup
Adobe SING CS3
Adobe Soundbooth CS3
Adobe Soundbooth CS3 Codecs
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe Version Cue CS3 Server {ko_KR}
Adobe Video Profiles
Adobe WAS CS3
Adobe WinSoft Linguistics Plugin
Adobe XMP DVA Panels CS3
Adobe XMP Panels CS3
AHV content for Acrobat and Flash
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Ask Toolbar
avast! Free Antivirus
Avery Wizard 3.1
AviSynth 2.5
Bonjour
Capture NX 2
CCleaner
Conexant HD Audio
ConvertHelper 2.2
Cycore FX 1.0.1 for After Effects
DivX Plus Web Player
EPSON Stylus NX400 Series Printer Uninstall
ESU for Microsoft Vista
ffdshow [rev 2033] [2008-07-05]
File Uploader
GDR 4053 for SQL Server Database Services 2005 ENU (KB970892)
Google Update Helper
HDAUDIO Soft Data Fax Modem with SmartCP
Hewlett-Packard Active Check for Health Check
Hewlett-Packard Asset Agent for Health Check
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Active Support Library 32 bit components
HP Customer Experience Enhancements
HP Doc Viewer
HP DVD Play 3.2
HP Easy Setup - Frontend
HP Help and Support
HP Quick Launch Buttons 6.20 G2
HP Total Care Advisor
HP Update
HP User Guides 0078
HP Wireless Assistant
HPNetworkAssistant
Intel(R) Graphics Media Accelerator Driver
Intel® Matrix Storage Manager
iPhoneBrowser
iTunes
Java Auto Updater
Java(TM) 6 Update 18
KB408682
KeyTweak - Keyboard Remapper (remove only)
LightScribe 1.6.43.1
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Expression Web
Microsoft Expression Web MUI (English)
Microsoft Expression Web Service Pack 1 (SP1)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook Connector
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office SharePoint Designer 2007 Service Pack 2 (SP2)
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (SONY_MEDIAMGR2)
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
Miro
Mobile Mouse Server
Mozilla Firefox (3.6.10)
MSCU for Microsoft Vista
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
MyDefrag v4.2.7
NetWaiting
Nikon Message Center
Nikon Transfer
Opanda IExif 2.3
PDF Settings
Photomatix Pro version 2.5
Picture Control Utility
PixiePack Codec Pack
Project64 1.6
QuickTime
Realtek 8139 and 8139C+ Ethernet Network Card Driver for Windows Vista
Realtek USB 2.0 Card Reader
Registry First Aid
Rhapsody Player Engine
Roxio Activation Module
Roxio Creator Audio
Roxio Creator Basic v9
Roxio Creator Copy
Roxio Creator Data
Roxio Creator EasyArchive
Roxio Creator Tools
Roxio Express Labeler 3
Roxio MyDVD Basic v9
Safari
Security Update for 2007 Microsoft Office System (KB951550)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for 2007 Microsoft Office System (KB982312)
Security Update for 2007 Microsoft Office System (KB982331)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office Excel 2007 (KB982308)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office Outlook 2007 (KB972363)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office Publisher 2007 (KB982124)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
SpeedFan (remove only)
Spelling Dictionaries Support For Adobe Reader 8
SUPERAntiSpyware Free Edition
SupportSoft Assisted Service
Touch Pad Driver
Trapcode Form
Trapcode Particular v2
U3Launcher
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB957244)
Update for Microsoft Office Access 2007 Help (KB957241)
Update for Microsoft Office InfoPath 2007 Help (KB957243)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB957245)
Update for Microsoft Office Outlook 2007 Help (KB957246)
Update for Microsoft Office Publisher 2007 Help (KB957249)
Update for Microsoft Office Word 2007 (KB974561)
Update for Microsoft Script Editor Help (KB957253)
Update for Outlook 2007 Junk Email Filter (kb981433)
USB 2.4G Wireless Keyboard Driver
VC80CRTRedist - 8.0.50727.4053
Videora iPod touch Converter 5.03
Windows Installer Clean Up
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Media Player Firefox Plugin
WinSCP 4.2.8

==== Event Viewer Messages From Past Week ========

10/9/2010 7:36:25 PM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
10/8/2010 11:11:33 AM, Error: EventLog [6008] - The previous system shutdown at 11:08:45 AM on 10/8/2010 was unexpected.
10/6/2010 7:59:05 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the LightScribeService Direct Disc Labeling Service service to connect.
10/13/2010 7:54:54 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: mvfvu sptd uvhskrj
10/13/2010 7:54:54 AM, Error: Service Control Manager [7001] - The Internet Connection Sharing (ICS) service depends on the Remote Access Connection Manager service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
10/13/2010 7:53:38 AM, Error: sptd [4] - Driver detected an internal error in its data structures for .
10/11/2010 8:48:20 AM, Error: iaStor [9] - The device, \Device\Ide\iaStor0, did not respond within the timeout period.

==== End Of File ===========================
October 13th, 2010, 08:09 PM
Broni
Download MBRCheck to your desktop

Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
It will show a black screen with some data on it.
Enter N to exit.
A report called MBRcheckxxxx.txt will be on your desktop
Open this report and post its content in your next reply.

================================================================

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  NOTE1. If Combofix asks you to install Recovery Console, please allow it.
  NOTE 2. If Combofix asks you to update the program, always do so.
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt"
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
October 13th, 2010, 09:05 PM
704_Skate

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: Hewlett-Packard
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: Presario C700 Notebook PC
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 157):
0x81A4A000 \SystemRoot\system32\ntkrnlpa.exe
0x81A17000 \SystemRoot\system32\hal.dll
0x80407000 \SystemRoot\system32\kdcom.dll
0x8040E000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8047E000 \SystemRoot\system32\PSHED.dll
0x8048F000 \SystemRoot\system32\BOOTVID.dll
0x80497000 \SystemRoot\system32\CLFS.SYS
0x804D8000 \SystemRoot\system32\CI.dll
0x80606000 \SystemRoot\system32\drivers\Wdf01000.sys
0x80682000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8068F000 \SystemRoot\system32\drivers\acpi.sys
0x806D5000 \SystemRoot\system32\drivers\WMILIB.SYS
0x805B8000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
0x807DE000 \SystemRoot\system32\drivers\msisadrv.sys
0x87A01000 \SystemRoot\system32\drivers\pci.sys
0x87A28000 \SystemRoot\System32\drivers\partmgr.sys
0x87A37000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x87A3A000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x87A44000 \SystemRoot\system32\drivers\volmgr.sys
0x87A53000 \SystemRoot\System32\drivers\volmgrx.sys
0x87A9D000 \SystemRoot\system32\DRIVERS\pciide.sys
0x87AA4000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x87AB2000 \SystemRoot\System32\drivers\mountmgr.sys
0x87AC2000 \SystemRoot\system32\drivers\iaStor.sys
0x87B89000 \SystemRoot\system32\drivers\atapi.sys
0x87B91000 \SystemRoot\system32\drivers\ataport.SYS
0x87BAF000 \SystemRoot\system32\drivers\fltmgr.sys
0x87BE1000 \SystemRoot\system32\drivers\fileinfo.sys
0x87BF1000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x87C0F000 \SystemRoot\System32\Drivers\ksecdd.sys
0x87C80000 \SystemRoot\system32\drivers\ndis.sys
0x87D8B000 \SystemRoot\system32\drivers\msrpc.sys
0x87DB6000 \SystemRoot\system32\drivers\NETIO.SYS
0x87E02000 \SystemRoot\System32\drivers\tcpip.sys
0x87EEC000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8800E000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8811E000 \SystemRoot\system32\drivers\volsnap.sys
0x88157000 \SystemRoot\System32\Drivers\spldr.sys
0x8815F000 \SystemRoot\system32\speedfan.sys
0x88161000 \SystemRoot\System32\Drivers\mup.sys
0x88170000 \SystemRoot\system32\giveio.sys
0x88171000 \SystemRoot\System32\drivers\ecache.sys
0x88198000 \SystemRoot\system32\drivers\disk.sys
0x881A9000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x881CA000 \SystemRoot\system32\drivers\crcdisk.sys
0x881E0000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x881EB000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x87FCE000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x881F4000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x881F8000 \SystemRoot\system32\DRIVERS\cpqbttn.sys
0x87FDD000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x88000000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x87FED000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8C606000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x8CC53000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8CCF4000 \SystemRoot\System32\drivers\watchdog.sys
0x8CD00000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x806DE000 \SystemRoot\system32\DRIVERS\bcmwl6.sys
0x8CD8D000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8CD98000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8CDD6000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8CDE5000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys
0x80764000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x87DF1000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x80777000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0x87C00000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x807A0000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8CE02000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8CE31000 \SystemRoot\system32\DRIVERS\storport.sys
0x8CE72000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8CE7D000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8CE94000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8CE9F000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8CEC2000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8CED1000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8CEE5000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8CEFA000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8CF0A000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8CF0C000 \SystemRoot\system32\DRIVERS\ks.sys
0x8CF36000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8CF40000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8CF4D000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x8CF56000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8CF8B000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8CF9C000 \SystemRoot\system32\drivers\CHDRT32.sys
0x8CFCF000 \SystemRoot\system32\drivers\portcls.sys
0x807B8000 \SystemRoot\system32\drivers\drmk.sys
0x8D206000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
0x8D243000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
0x8D346000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0x807E6000 \SystemRoot\system32\drivers\modem.sys
0x805DE000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x8D3FB000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8CDF6000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x87FF6000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x807F3000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x88007000 \SystemRoot\System32\Drivers\Null.SYS
0x805F5000 \SystemRoot\System32\Drivers\Beep.SYS
0x8D80A000 \SystemRoot\System32\drivers\vga.sys
0x8D816000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8D837000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8D83F000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8D847000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8D852000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8D860000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8D869000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8D87F000 \SystemRoot\System32\Drivers\aswTdi.SYS
0x8D889000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8D8BB000 \SystemRoot\system32\DRIVERS\smb.sys
0x8D8CF000 \SystemRoot\system32\drivers\afd.sys
0x8D917000 \SystemRoot\System32\Drivers\aswRdr.SYS
0x8D91C000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8D932000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8D940000 \SystemRoot\system32\DRIVERS\eabfiltr.sys
0x8D942000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8D955000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
0x8D97A000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0x8D980000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8D9BC000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8D9C6000 \SystemRoot\System32\Drivers\dfsc.sys
0x8DC07000 \SystemRoot\System32\Drivers\aswSP.SYS
0x8DC2E000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8DC3B000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x95600000 \SystemRoot\System32\win32k.sys
0x8DD02000 \SystemRoot\System32\drivers\Dxapi.sys
0x8DD0C000 \SystemRoot\system32\DRIVERS\monitor.sys
0x95820000 \SystemRoot\System32\TSDDD.dll
0x95840000 \SystemRoot\System32\cdd.dll
0x95850000 \SystemRoot\System32\ATMFD.DLL
0x8DD1B000 \SystemRoot\system32\drivers\luafv.sys
0x8DD36000 \??\C:\Windows\system32\drivers\aswMonFlt.sys
0x8DD6D000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0x8DD78000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x8DD88000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x8DDB2000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x8DDBC000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x87F07000 \SystemRoot\system32\drivers\spsys.sys
0xAF00B000 \SystemRoot\system32\drivers\HTTP.sys
0xAF078000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xAF095000 \SystemRoot\system32\DRIVERS\bowser.sys
0xAF0AE000 \SystemRoot\System32\drivers\mpsdrv.sys
0xAF0C3000 \SystemRoot\system32\drivers\mrxdav.sys
0xAF0E4000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xAF103000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xAF13C000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xAF154000 \SystemRoot\System32\DRIVERS\srv2.sys
0xAF17B000 \SystemRoot\System32\DRIVERS\srv.sys
0xAF1C9000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xB2208000 \SystemRoot\system32\drivers\peauth.sys
0xB22E6000 \SystemRoot\System32\Drivers\secdrv.SYS
0xB22F0000 \SystemRoot\System32\drivers\tcpipreg.sys
0xB22FC000 \SystemRoot\system32\DRIVERS\xaudio.sys
0xB2304000 \SystemRoot\system32\drivers\tdtcp.sys
0xB230F000 \SystemRoot\System32\DRIVERS\tssecsrv.sys
0xB231B000 \SystemRoot\System32\Drivers\RDPWD.SYS
0xB234E000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x777A0000 \WINDOWS\System32\ntdll.dll

Processes (total 59):
0 System Idle Process
4 System
412 C:\WINDOWS\System32\smss.exe
484 csrss.exe
528 C:\WINDOWS\System32\wininit.exe
540 csrss.exe
604 C:\WINDOWS\System32\services.exe
612 C:\WINDOWS\System32\lsass.exe
620 C:\WINDOWS\System32\lsm.exe
676 C:\WINDOWS\System32\winlogon.exe
816 C:\WINDOWS\System32\svchost.exe
888 C:\WINDOWS\System32\svchost.exe
924 C:\WINDOWS\System32\svchost.exe
1024 C:\WINDOWS\System32\svchost.exe
1056 C:\WINDOWS\System32\svchost.exe
1072 C:\WINDOWS\System32\svchost.exe
1196 C:\WINDOWS\System32\audiodg.exe
1224 C:\WINDOWS\System32\svchost.exe
1240 C:\WINDOWS\System32\SLsvc.exe
1320 C:\WINDOWS\System32\svchost.exe
1392 C:\WINDOWS\System32\svchost.exe
1592 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
1696 C:\WINDOWS\explorer.exe
124 C:\WINDOWS\System32\spoolsv.exe
264 C:\WINDOWS\System32\taskeng.exe
288 C:\WINDOWS\System32\svchost.exe
428 C:\WINDOWS\System32\taskeng.exe
524 C:\WINDOWS\ModLEDKey.exe
1668 C:\Program Files\Apoint2K\Apoint.exe
1716 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
1752 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
1744 C:\WINDOWS\System32\igfxtray.exe
1776 C:\Program Files\Apoint2K\ApMsgFwd.exe
1788 C:\WINDOWS\System32\igfxpers.exe
1628 C:\WINDOWS\PixArt\Pac207\Monitor.exe
1648 C:\Program Files\Alwil Software\Avast5\AvastUI.exe
968 C:\WINDOWS\System32\igfxsrvc.exe
1712 C:\WINDOWS\CNYHKey.exe
2216 C:\WINDOWS\System32\svchost.exe
2228 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
2244 C:\Program Files\Bonjour\mDNSResponder.exe
2280 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
2468 C:\Program Files\Apoint2K\ApntEx.exe
2608 C:\WINDOWS\System32\svchost.exe
2624 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
2640 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
2664 C:\WINDOWS\System32\svchost.exe
2740 C:\WINDOWS\System32\svchost.exe
2764 C:\WINDOWS\System32\svchost.exe
2956 C:\WINDOWS\System32\drivers\XAudio.exe
3008 C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
3088 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
3400 WmiPrvSE.exe
3636 C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
2896 C:\WINDOWS\System32\taskmgr.exe
3532 C:\Program Files\Mozilla Firefox\firefox.exe
3332 C:\Program Files\Mozilla Firefox\plugin-container.exe
3812 C:\Users\User\Desktop\MBRCheck.exe
1376 C:\WINDOWS\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000019`e26b9800 (NTFS)

PhysicalDrive0 Model Number: HitachiHTS541612J9SA00, Rev: SBDOC7BP

Size Device Name MBR Status
--------------------------------------------
111 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: D94F393960D1CD66C2071F2D7260A5196DF105AC

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!
October 13th, 2010, 09:08 PM
704_Skate

Oh, didn't see Combo Fix, will do it right now..
October 13th, 2010, 09:16 PM
Broni

OK :)
October 13th, 2010, 09:41 PM
704_Skate

Anddd Combix.

ComboFix 10-10-12.03 - User 10/13/2010 21:20:52.7.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2037.1104 [GMT -4:00]
Running from: c:\users\User\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100219-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: avast! antivirus 4.8.1368 [VPS 100219-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\User\FAVORI~1\bookmarks.html
c:\users\User\Favorites\bookmarks.html

.
((((((((((((((((((((((((( Files Created from 2010-09-14 to 2010-10-14 )))))))))))))))))))))))))))))))
.

2010-10-14 01:32 . 2010-10-14 01:33 -------- d-----w- c:\users\User\AppData\Local\temp
2010-10-14 01:32 . 2010-10-14 01:32 -------- d-----w- c:\users\Mcx2\AppData\Local\temp
2010-10-14 01:32 . 2010-10-14 01:32 -------- d-----w- c:\users\Mcx1\AppData\Local\temp
2010-10-14 01:32 . 2010-10-14 01:32 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-08 15:59 . 2010-10-08 15:59 -------- d-----w- c:\program files\KeyTweak
2010-10-07 19:29 . 2010-10-07 19:29 40960 ----a-r- c:\users\User\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe
2010-10-07 19:29 . 2010-10-07 19:29 40960 ----a-r- c:\users\User\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\ARPPRODUCTICON.exe
2010-10-07 19:28 . 2010-10-07 19:31 -------- d-----w- c:\program files\Project64 1.6
2010-10-06 20:27 . 2009-03-05 15:35 49152 ----a-w- c:\windows\CNYUSB.dll
2010-10-06 20:27 . 2009-03-03 23:27 5576704 ----a-w- c:\windows\CNYHKey.exe
2010-10-06 20:27 . 2007-03-28 21:55 36864 ----a-w- c:\windows\LchDrvKey.exe
2010-10-06 20:27 . 2007-01-08 18:51 53248 ----a-w- c:\windows\ModLEDKey.exe
2010-10-04 20:26 . 2010-10-04 20:20 3670016 ----a-w- c:\users\Mcx2\ntuser.tmp
2010-10-04 20:26 . 2010-10-04 20:20 3932160 ----a-w- c:\users\Mcx1\ntuser.tmp
2010-10-04 20:26 . 2010-10-03 23:49 262144 ----a-w- c:\windows\system32\config\systemprofile\ntuser.tmp
2010-10-03 23:34 . 2010-10-12 21:44 -------- d-----w- c:\program files\Xvid
2010-09-19 13:43 . 2010-09-07 15:12 38848 ----a-w- c:\windows\avastSS.scr
2010-09-19 13:42 . 2010-09-19 13:42 -------- d-----w- c:\programdata\Alwil Software
2010-09-16 14:33 . 2010-04-05 17:01 67072 ----a-w- c:\windows\system32\asycfilt.dll
2010-09-16 14:32 . 2010-04-16 16:43 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-09-16 14:32 . 2010-04-16 14:39 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-09-16 14:32 . 2010-05-26 14:47 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-09-16 14:32 . 2010-05-26 17:06 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-09-16 14:20 . 2010-04-23 14:13 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-16 14:20 . 2010-01-29 15:40 738816 ----a-w- c:\windows\system32\inetcomm.dll
2010-09-16 14:20 . 2010-01-29 15:40 1616384 ----a-w- c:\program files\Windows Mail\msoe.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-05-26 19:23 1385864 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2006-11-07 159744]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 141848]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 133656]
"PAC207_Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]
"ledpointer"="CNYHKey.exe" [2009-03-03 5576704]
"LchDrv"="LchDrvKey.exe" [2007-03-28 36864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^LaunchU3.exe.lnk]
backup=c:\windows\pss\LaunchU3.exe.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
backup=c:\windows\pss\QuickBooks Update Agent.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Nikon Monitor.lnk]
backup=c:\windows\pss\Nikon Monitor.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ClickPotatoLiteSA

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2008-10-15 02:38 623992 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 06:04 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0EYTHM]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 16:44 31072 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-01-02 22:06 166424 ----a-w- c:\windows\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2007-03-12 18:54 50696 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-02-17 06:11 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2009-06-05 00:03 186904 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-09-01 12:32 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 21:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nikon Transfer Monitor]
2009-05-29 21:58 479232 ----a-w- c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
2007-06-11 15:57 184320 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
2007-03-29 00:45 176128 ----a-w- c:\program files\HP\QuickPlay\QPService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-08-10 09:15 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\r***ent]
2009-10-21 17:58 916304 ----a-w- c:\program files\RFA\r***ent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RunSpySweeperScheduleAtStartup]
2007-03-23 21:23 86016 ----a-w- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-04-11 04:28 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-11 20:21 246504 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2009-03-23 18:07 1830128 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 04:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R0 mvfvu;mvfvu;c:\windows\System32\drivers\jujfyfj.sys [x]
R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2008-11-30 717296]
R0 uvhskrj;uvhskrj;c:\windows\System32\drivers\tech.sys [x]
R3 LTXMD_VAC;Litex Media Virtual Audio Cable (WDM);c:\windows\system32\drivers\lmvac.sys [2008-07-01 18912]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys [x]
R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\9240.tmp [x]
R3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-05-27 29262680]
R3 PAC207;PC Camer@;c:\windows\system32\DRIVERS\PFC027.SYS [2008-02-13 618112]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]
R3 WMSvc;Web Management Service;c:\windows\system32\inetsrv\wmsvc.exe [2008-01-19 11264]
R4 gupdate;Google Update Service (gupdate); [x]
S1 aswSP;aswSP; [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-03-23 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-03-23 72944]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-04-19 20:23 452136 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
2007-09-19 15:32 7680 ----a-w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder

2010-09-17 c:\windows\Tasks\HPCeeScheduleForUser.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2007-07-02 21:23]
.
.
------- Supplementary Scan -------
.
uLocal Page = c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Blank.htm
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=PRESARIO&pf=laptop
mLocal Page = c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Blank.htm
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = 216.22.2.218:80
FF - ProfilePath - c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\bv5h7rsw.SPEED\
FF - prefs.js: browser.startup.homepage - hxxp://www.weather.com/weather/local/28273?lswe=28273&lwsa=WeatherLocalUndeclared&from=searchbox_localwx
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSFDMGR.dll
FF - plugin: c:\programdata\NexonUS\NGM\npNxGameUS.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - falsec:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-CHotkey - mHotkey.exe

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\9240.tmp"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-10-13 21:38:29
ComboFix-quarantined-files.txt 2010-10-14 01:38

Pre-Run: 31,919,661,056 bytes free
Post-Run: 31,484,055,552 bytes free

- - End Of File - - 3B496AA92AD95AB064037B9A633C04C7
October 13th, 2010, 09:46 PM
Broni
Let's deal first with apparently infected MBR.

Please download NTBR by noahdfear and save it to your Desktop.
File size: 2.44 MB (2,565,432 bytes)
- Place a blank CD in your CD drive.
- Double click on NTBR_CD.exe file and a folder of the same name will appear.
- Open the folder and double click on BurnItCD.cmd file. If your CD drive will open, simply close it back.
- Follow the prompts to burn the CD.
- Now you will need to set the CD-Rom as first boot device if it isn't already (if you don't know how to do it, see HERE)
- If you have any questions about this step, ask before you proceed. If you enter the BIOS and are unsure if you have carried out the step correctly, there should be an option to exit without keeping changes, so you won't do any harm.
- Insert the newly created CD into your infected PC and reboot your computer.
- Once you have rebooted please press Enter when prompted to continue booting from CD - you have a whole 15 seconds to do this!
- Read the warning and then continue as prompted.
- You first need to select your keyboard layout - press Enter for English.
- Next you want to select the appropriate tool. Enter 1 to choose 1. MBRWORK
- On the following screen enter 5 to select Install Standard MBR code.
- Enter 1 to overwrite the infected MBR Code with the Standard MBR code.
- When asked to confirm please do so.
- Afterwards, please enter E to leave MBRWORK, then 6 to leave the bootable CD.
- Eject the disc and then press ctrl+alt+del to reboot the PC.
Once rebooted, run MBRCheck again and post its log.
October 13th, 2010, 10:13 PM
704_Skate

(:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: Hewlett-Packard
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: Presario C700 Notebook PC
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 157):
0x81A02000 \SystemRoot\system32\ntkrnlpa.exe
0x81DBB000 \SystemRoot\system32\hal.dll
0x80402000 \SystemRoot\system32\kdcom.dll
0x80409000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x80479000 \SystemRoot\system32\PSHED.dll
0x8048A000 \SystemRoot\system32\BOOTVID.dll
0x80492000 \SystemRoot\system32\CLFS.SYS
0x804D3000 \SystemRoot\system32\CI.dll
0x80607000 \SystemRoot\system32\drivers\Wdf01000.sys
0x80683000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80690000 \SystemRoot\system32\drivers\acpi.sys
0x806D6000 \SystemRoot\system32\drivers\WMILIB.SYS
0x805B3000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
0x807DF000 \SystemRoot\system32\drivers\msisadrv.sys
0x805D9000 \SystemRoot\system32\drivers\pci.sys
0x807E7000 \SystemRoot\System32\drivers\partmgr.sys
0x807F6000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x87A05000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x87A0F000 \SystemRoot\system32\drivers\volmgr.sys
0x87A1E000 \SystemRoot\System32\drivers\volmgrx.sys
0x87A68000 \SystemRoot\system32\DRIVERS\pciide.sys
0x87A6F000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x87A7D000 \SystemRoot\System32\drivers\mountmgr.sys
0x87A8D000 \SystemRoot\system32\drivers\iaStor.sys
0x87B54000 \SystemRoot\system32\drivers\atapi.sys
0x87B5C000 \SystemRoot\system32\drivers\ataport.SYS
0x87B7A000 \SystemRoot\system32\drivers\fltmgr.sys
0x87BAC000 \SystemRoot\system32\drivers\fileinfo.sys
0x87BBC000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x87C04000 \SystemRoot\System32\Drivers\ksecdd.sys
0x87C75000 \SystemRoot\system32\drivers\ndis.sys
0x87D80000 \SystemRoot\system32\drivers\msrpc.sys
0x87DAB000 \SystemRoot\system32\drivers\NETIO.SYS
0x87E0C000 \SystemRoot\System32\drivers\tcpip.sys
0x87EF6000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x88002000 \SystemRoot\System32\Drivers\Ntfs.sys
0x88112000 \SystemRoot\system32\drivers\volsnap.sys
0x8814B000 \SystemRoot\System32\Drivers\spldr.sys
0x88153000 \SystemRoot\system32\speedfan.sys
0x88155000 \SystemRoot\System32\Drivers\mup.sys
0x88164000 \SystemRoot\system32\giveio.sys
0x88165000 \SystemRoot\System32\drivers\ecache.sys
0x8818C000 \SystemRoot\system32\drivers\disk.sys
0x8819D000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x881BE000 \SystemRoot\system32\drivers\crcdisk.sys
0x881D4000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x881DF000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x881E8000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x881F7000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x881FB000 \SystemRoot\system32\DRIVERS\cpqbttn.sys
0x87FD8000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x87FE8000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x87FEF000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8C00F000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x8C65C000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8C6FD000 \SystemRoot\System32\drivers\watchdog.sys
0x8C709000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x806DF000 \SystemRoot\system32\DRIVERS\bcmwl6.sys
0x8C796000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8C7A1000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8C7DF000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8C7EE000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys
0x87DE6000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8C000000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x87BC5000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0x87E00000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x80765000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8077D000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8C802000 \SystemRoot\system32\DRIVERS\storport.sys
0x8C843000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8C84E000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8C865000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8C870000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8C893000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8C8A2000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8C8B6000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8C8CB000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8C8DB000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8C8DD000 \SystemRoot\system32\DRIVERS\ks.sys
0x8C907000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8C911000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8C91E000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x8C927000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8C95C000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8C96D000 \SystemRoot\system32\drivers\CHDRT32.sys
0x8C9A0000 \SystemRoot\system32\drivers\portcls.sys
0x8C9CD000 \SystemRoot\system32\drivers\drmk.sys
0x8CC0B000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
0x8CC48000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
0x8CD4B000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0x8C9F2000 \SystemRoot\system32\drivers\modem.sys
0x807AC000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x8CC00000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8CC02000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x87FF8000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x87BEE000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x87DF9000 \SystemRoot\System32\Drivers\Null.SYS
0x87BF7000 \SystemRoot\System32\Drivers\Beep.SYS
0x807C3000 \SystemRoot\System32\drivers\vga.sys
0x8D001000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8D022000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8D02A000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8D032000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8D03D000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8D04B000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8D054000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8D06A000 \SystemRoot\System32\Drivers\aswTdi.SYS
0x8D074000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8D0A6000 \SystemRoot\system32\DRIVERS\smb.sys
0x8D0BA000 \SystemRoot\system32\drivers\afd.sys
0x8D102000 \SystemRoot\System32\Drivers\aswRdr.SYS
0x8D107000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8D11D000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8D12B000 \SystemRoot\system32\DRIVERS\eabfiltr.sys
0x8D12D000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8D140000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
0x8D165000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0x8D16B000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8D1A7000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8D1B1000 \SystemRoot\System32\Drivers\dfsc.sys
0x8D1C8000 \SystemRoot\System32\Drivers\aswSP.SYS
0x8D1EF000 \SystemRoot\System32\Drivers\crashdmp.sys
0x87F11000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x944E0000 \SystemRoot\System32\win32k.sys
0x881C7000 \SystemRoot\System32\drivers\Dxapi.sys
0x807CF000 \SystemRoot\system32\DRIVERS\monitor.sys
0x94700000 \SystemRoot\System32\TSDDD.dll
0x94720000 \SystemRoot\System32\cdd.dll
0x94730000 \SystemRoot\System32\ATMFD.DLL
0xA8C0E000 \SystemRoot\system32\drivers\luafv.sys
0xA8C29000 \??\C:\Windows\system32\drivers\aswMonFlt.sys
0xA8C60000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0xA8C6B000 \SystemRoot\system32\drivers\spsys.sys
0xA8D1B000 \SystemRoot\system32\DRIVERS\lltdio.sys
0xA8D2B000 \SystemRoot\system32\DRIVERS\nwifi.sys
0xA8D55000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA8D5F000 \SystemRoot\system32\DRIVERS\rspndr.sys
0xA8D72000 \SystemRoot\system32\drivers\HTTP.sys
0xA8DDF000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xAEC00000 \SystemRoot\system32\DRIVERS\bowser.sys
0xAEC19000 \SystemRoot\System32\drivers\mpsdrv.sys
0xAEC2E000 \SystemRoot\system32\drivers\mrxdav.sys
0xAEC4F000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xAEC6E000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xAECA7000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xAECBF000 \SystemRoot\System32\DRIVERS\srv2.sys
0xAECE6000 \SystemRoot\System32\DRIVERS\srv.sys
0xAED34000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xB240D000 \SystemRoot\system32\drivers\peauth.sys
0xB24EB000 \SystemRoot\System32\Drivers\secdrv.SYS
0xB24F5000 \SystemRoot\System32\drivers\tcpipreg.sys
0xB2501000 \SystemRoot\system32\DRIVERS\xaudio.sys
0xB2509000 \SystemRoot\system32\drivers\tdtcp.sys
0xB2514000 \SystemRoot\System32\DRIVERS\tssecsrv.sys
0xB2520000 \SystemRoot\System32\Drivers\RDPWD.SYS
0xB2553000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x76F80000 \WINDOWS\System32\ntdll.dll

Processes (total 56):
0 System Idle Process
4 System
412 C:\WINDOWS\System32\smss.exe
544 csrss.exe
588 C:\WINDOWS\System32\wininit.exe
600 csrss.exe
644 C:\WINDOWS\System32\services.exe
652 C:\WINDOWS\System32\lsass.exe
660 C:\WINDOWS\System32\lsm.exe
736 C:\WINDOWS\System32\winlogon.exe
848 C:\WINDOWS\System32\svchost.exe
920 C:\WINDOWS\System32\svchost.exe
960 C:\WINDOWS\System32\svchost.exe
1068 C:\WINDOWS\System32\svchost.exe
1108 C:\WINDOWS\System32\svchost.exe
1128 C:\WINDOWS\System32\svchost.exe
1232 C:\WINDOWS\System32\audiodg.exe
1248 C:\WINDOWS\System32\svchost.exe
1268 C:\WINDOWS\System32\SLsvc.exe
1304 C:\WINDOWS\System32\svchost.exe
1436 C:\WINDOWS\System32\svchost.exe
1604 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
1748 C:\WINDOWS\explorer.exe
288 C:\WINDOWS\System32\spoolsv.exe
320 C:\WINDOWS\System32\svchost.exe
324 C:\WINDOWS\System32\taskeng.exe
748 C:\Program Files\Apoint2K\Apoint.exe
1024 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
832 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
1348 C:\WINDOWS\System32\igfxtray.exe
1400 C:\WINDOWS\System32\igfxpers.exe
724 C:\WINDOWS\System32\igfxsrvc.exe
1716 C:\WINDOWS\ModLEDKey.exe
1784 C:\Program Files\Apoint2K\ApMsgFwd.exe
844 C:\WINDOWS\PixArt\Pac207\Monitor.exe
1928 C:\Program Files\Alwil Software\Avast5\AvastUI.exe
1216 C:\WINDOWS\CNYHKey.exe
2212 C:\WINDOWS\System32\svchost.exe
2240 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
2256 C:\Program Files\Bonjour\mDNSResponder.exe
2300 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
2548 C:\Program Files\Apoint2K\ApntEx.exe
2572 C:\WINDOWS\System32\svchost.exe
2588 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
2620 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
2660 C:\WINDOWS\System32\svchost.exe
2788 C:\WINDOWS\System32\svchost.exe
2800 C:\WINDOWS\System32\svchost.exe
2832 C:\WINDOWS\System32\drivers\XAudio.exe
2916 C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
2984 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
3360 WmiPrvSE.exe
3512 C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
4076 C:\WINDOWS\System32\taskeng.exe
1312 C:\Users\User\Desktop\MBRCheck.exe
2780 C:\WINDOWS\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000019`e26b9800 (NTFS)

PhysicalDrive0 Model Number: HitachiHTS541612J9SA00, Rev: SBDOC7BP

Size Device Name MBR Status
--------------------------------------------
111 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A

Done!
October 13th, 2010, 10:28 PM
Broni
Looks good :)

Uninstall Ask Toolbar, known adware.

1. Please open Notepad
- Click Start , then Run
- Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

File:: c:\windows\System32\drivers\jujfyfj.sys c:\windows\System32\drivers\tech.sys DDS:: uInternet Settings,ProxyServer = 216.22.2.218:80 Driver:: mvfvu uvhskrj MEMSWEEP2 Registry:: [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=-

3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

https://discussions.virtualdr.com/im.../2016/03/2.gif

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
- Combofix.txt
October 14th, 2010, 08:43 AM
704_Skate

ComboFix 10-10-12.03 - User 10/14/2010 8:11.8.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2037.1125 [GMT -4:00]
Running from: c:\users\User\Desktop\ComboFix.exe
Command switches used :: c:\users\User\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100219-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: avast! antivirus 4.8.1368 [VPS 100219-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\windows\System32\drivers\jujfyfj.sys"
"c:\windows\System32\drivers\tech.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MEMSWEEP2
-------\Service_MEMSWEEP2
-------\Service_mvfvu
-------\Service_uvhskrj

((((((((((((((((((((((((( Files Created from 2010-09-14 to 2010-10-14 )))))))))))))))))))))))))))))))
.

2010-10-14 12:25 . 2010-10-14 12:28 -------- d-----w- c:\users\User\AppData\Local\temp
2010-10-14 12:25 . 2010-10-14 12:25 -------- d-----w- c:\users\Mcx2\AppData\Local\temp
2010-10-14 12:25 . 2010-10-14 12:25 -------- d-----w- c:\users\Mcx1\AppData\Local\temp
2010-10-14 12:25 . 2010-10-14 12:25 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-08 15:59 . 2010-10-08 15:59 -------- d-----w- c:\program files\KeyTweak
2010-10-07 19:29 . 2010-10-07 19:29 40960 ----a-r- c:\users\User\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe
2010-10-07 19:29 . 2010-10-07 19:29 40960 ----a-r- c:\users\User\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\ARPPRODUCTICON.exe
2010-10-07 19:28 . 2010-10-07 19:31 -------- d-----w- c:\program files\Project64 1.6
2010-10-06 20:27 . 2009-03-05 15:35 49152 ----a-w- c:\windows\CNYUSB.dll
2010-10-06 20:27 . 2009-03-03 23:27 5576704 ----a-w- c:\windows\CNYHKey.exe
2010-10-06 20:27 . 2007-03-28 21:55 36864 ----a-w- c:\windows\LchDrvKey.exe
2010-10-06 20:27 . 2007-01-08 18:51 53248 ----a-w- c:\windows\ModLEDKey.exe
2010-10-04 20:26 . 2010-10-04 20:20 3670016 ----a-w- c:\users\Mcx2\ntuser.tmp
2010-10-04 20:26 . 2010-10-04 20:20 3932160 ----a-w- c:\users\Mcx1\ntuser.tmp
2010-10-04 20:26 . 2010-10-03 23:49 262144 ----a-w- c:\windows\system32\config\systemprofile\ntuser.tmp
2010-10-03 23:34 . 2010-10-12 21:44 -------- d-----w- c:\program files\Xvid
2010-09-19 13:43 . 2010-09-07 15:12 38848 ----a-w- c:\windows\avastSS.scr
2010-09-19 13:42 . 2010-09-19 13:42 -------- d-----w- c:\programdata\Alwil Software
2010-09-16 14:33 . 2010-04-05 17:01 67072 ----a-w- c:\windows\system32\asycfilt.dll
2010-09-16 14:32 . 2010-04-16 16:43 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-09-16 14:32 . 2010-04-16 14:39 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-09-16 14:32 . 2010-05-26 14:47 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-09-16 14:32 . 2010-05-26 17:06 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-09-16 14:20 . 2010-04-23 14:13 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-16 14:20 . 2010-01-29 15:40 738816 ----a-w- c:\windows\system32\inetcomm.dll
2010-09-16 14:20 . 2010-01-29 15:40 1616384 ----a-w- c:\program files\Windows Mail\msoe.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-05-26 19:23 1385864 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2006-11-07 159744]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 141848]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 133656]
"PAC207_Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]
"ledpointer"="CNYHKey.exe" [2009-03-03 5576704]
"LchDrv"="LchDrvKey.exe" [2007-03-28 36864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^LaunchU3.exe.lnk]
backup=c:\windows\pss\LaunchU3.exe.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
backup=c:\windows\pss\QuickBooks Update Agent.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Nikon Monitor.lnk]
backup=c:\windows\pss\Nikon Monitor.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2008-10-15 02:38 623992 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 06:04 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0EYTHM]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 16:44 31072 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-01-02 22:06 166424 ----a-w- c:\windows\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2007-03-12 18:54 50696 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-02-17 06:11 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2009-06-05 00:03 186904 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-09-01 12:32 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 21:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nikon Transfer Monitor]
2009-05-29 21:58 479232 ----a-w- c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
2007-06-11 15:57 184320 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
2007-03-29 00:45 176128 ----a-w- c:\program files\HP\QuickPlay\QPService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-08-10 09:15 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\r***ent]
2009-10-21 17:58 916304 ----a-w- c:\program files\RFA\r***ent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RunSpySweeperScheduleAtStartup]
2007-03-23 21:23 86016 ----a-w- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-04-11 04:28 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-11 20:21 246504 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2009-03-23 18:07 1830128 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 04:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2008-11-30 717296]
R3 LTXMD_VAC;Litex Media Virtual Audio Cable (WDM);c:\windows\system32\drivers\lmvac.sys [2008-07-01 18912]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys [x]
R3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-05-27 29262680]
R3 PAC207;PC Camer@;c:\windows\system32\DRIVERS\PFC027.SYS [2008-02-13 618112]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]
R3 WMSvc;Web Management Service;c:\windows\system32\inetsrv\wmsvc.exe [2008-01-19 11264]
R4 gupdate;Google Update Service (gupdate); [x]
S1 aswSP;aswSP; [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-03-23 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-03-23 72944]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-04-19 20:23 452136 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
2007-09-19 15:32 7680 ----a-w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder

2010-09-17 c:\windows\Tasks\HPCeeScheduleForUser.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2007-07-02 21:23]
.
.
------- Supplementary Scan -------
.
uLocal Page = c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Blank.htm
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=PRESARIO&pf=laptop
mLocal Page = c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Blank.htm
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\bv5h7rsw.SPEED\
FF - prefs.js: browser.startup.homepage - hxxp://www.weather.com/weather/local/28273?lswe=28273&lwsa=WeatherLocalUndeclared&from=searchbox_localwx
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSFDMGR.dll
FF - plugin: c:\programdata\NexonUS\NGM\npNxGameUS.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - falsec:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(2912)
c:\program files\WinSCP\DragExt.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\ModLEDKey.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\windows\system32\conime.exe
c:\program files\Apoint2K\ApMsgFwd.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\CNYHKey.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\program files\Apoint2K\Apntex.exe
.
**************************************************************************
.
Completion time: 2010-10-14 08:38:22 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-14 12:38
ComboFix2.txt 2010-10-14 01:38

Pre-Run: 30,912,671,744 bytes free
Post-Run: 30,660,624,384 bytes free

- - End Of File - - CDB345DB2565E8639DD6F7C592F35A47
October 14th, 2010, 02:08 PM
704_Skate

By the way, explorer is still running at %50.!
October 14th, 2010, 08:24 PM
Broni

Please, read my instructions more carefully.

You didn't:

Quote:

Uninstall Ask Toolbar, known adware.
October 14th, 2010, 08:35 PM
704_Skate

I uninstalled this before I did the Combo Fix. I noticed it never told me it was completed. Hmm. I just double checked now to make sure I did, and it's not there. So, what should I do? (note that I don't recall restarting computer after I uninstalled, although I don't know if that would make a difference)
October 15th, 2010, 01:05 AM
Broni
We'll remove Ask Toolbar leftovers in out next step.

Download Process Explorer: http://technet.microsoft.com/en-us/s.../bb896653.aspx
Unzip ProcessExplorer.zip, and double click on procexp.exe to run the program.
Click on View > Select Colunms.
In addition to already pre-selected options, make sure, the Command Line is selected, and press OK.
Go File>Save As, and save the report as Procexp.txt.
Attach the file to your next reply.

===============================================================

Download OTL to your Desktop.
- Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
- Under the Custom Scan box paste this in:
netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop
- Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
October 15th, 2010, 08:55 AM
704_Skate

Process Explorer:

Process PID CPU Private Bytes Working Set Description Company Name Command Line
System Idle Process 0 99.92 0 K 24 K
Interrupts n/a 0 K 0 K Hardware Interrupts
DPCs n/a 0 K 0 K Deferred Procedure Calls
System 4 0 K 3,784 K
smss.exe 424 292 K 732 K Windows Session Manager Microsoft Corporation \SystemRoot\System32\smss.exe
csrss.exe 544 1,728 K 5,112 K Client Server Runtime Process Microsoft Corporation C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
wininit.exe 588 1,348 K 4,064 K Windows Start-Up Application Microsoft Corporation wininit.exe
services.exe 644 2,452 K 6,488 K Services and Controller app Microsoft Corporation C:\Windows\system32\services.exe
svchost.exe 860 2,504 K 5,732 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k DcomLaunch
igfxsrvc.exe 2996 1,732 K 4,576 K igfxsrvc Module Intel Corporation C:\Windows\system32\igfxsrvc.exe -Embedding
WmiPrvSE.exe 3208 3,012 K 5,916 K WMI Provider Host Microsoft Corporation C:\Windows\system32\wbem\wmiprvse.exe
HpqToaster.exe 3360 1,724 K 5,580 K HpqToaster Module "C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe" -Embedding
svchost.exe 936 3,084 K 6,204 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k rpcss
svchost.exe 980 72,112 K 43,084 K Host Process for Windows Services Microsoft Corporation C:\Windows\System32\svchost.exe -k secsvcs
svchost.exe 1080 10,260 K 12,300 K Host Process for Windows Services Microsoft Corporation C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
audiodg.exe 1252 1,000 K 3,376 K Windows Audio Device Graph Isolation Microsoft Corporation C:\Windows\system32\AUDIODG.EXE 0x2e8
svchost.exe 1120 10,996 K 15,532 K Host Process for Windows Services Microsoft Corporation C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
svchost.exe 1136 17,900 K 24,700 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k netsvcs
taskeng.exe 2020 9,244 K 9,976 K Task Scheduler Engine Microsoft Corporation taskeng.exe {8D2E1076-FE0E-4E14-8779-5B8E2AEC4CB8}
ModLEDKey.exe 516 592 K 2,044 K AccessL Chicony C:\Windows\ModLEDKey.exe
taskeng.exe 3840 1,980 K 5,840 K Task Scheduler Engine Microsoft Corporation taskeng.exe {C0A63FE3-3CD0-468E-B099-37B0E265BA23}
svchost.exe 1268 1,848 K 4,576 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k GPSvcGroup
SLsvc.exe 1284 6,048 K 11,496 K Microsoft Software Licensing Service Microsoft Corporation C:\Windows\system32\SLsvc.exe
svchost.exe 1320 6,568 K 11,688 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k LocalService
svchost.exe 1452 14,808 K 15,024 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k NetworkService
AvastSvc.exe 1608 16,384 K 30,412 K avast! Service AVAST Software "C:\Program Files\Alwil Software\Avast5\AvastSvc.exe"
spoolsv.exe 2012 5,780 K 10,500 K Spooler SubSystem App Microsoft Corporation C:\Windows\System32\spoolsv.exe
svchost.exe 208 13,432 K 17,388 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
svchost.exe 368 5,336 K 9,252 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k apphost
AppleMobileDeviceService.exe 1888 2,180 K 3,684 K Apple Mobile Device Service Apple Inc. "C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
mDNSResponder.exe 1440 1,680 K 4,928 K Bonjour Service Apple Inc. "C:\Program Files\Bonjour\mDNSResponder.exe"
LSSrvc.exe 1696 1,024 K 3,372 K Hewlett-Packard Company "C:\Program Files\Common Files\LightScribe\LSSrvc.exe"
svchost.exe 2088 2,168 K 5,364 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
sqlbrowser.exe 2132 1,036 K 3,356 K SQL Browser Service EXE Microsoft Corporation "c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe"
sqlwriter.exe 2152 3,608 K 7,188 K SQL Server VSS Writer Microsoft Corporation "c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
svchost.exe 2220 3,464 K 6,356 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k imgsvc
svchost.exe 2284 4,396 K 8,120 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k iissvcs
svchost.exe 2324 552 K 1,980 K Host Process for Windows Services Microsoft Corporation C:\Windows\System32\svchost.exe -k WerSvcGroup
XAudio.exe 2344 764 K 2,388 K Modem Audio Service Conexant Systems, Inc. C:\Windows\system32\DRIVERS\xaudio.exe
hpqwmiex.exe 2372 2,524 K 4,948 K hpqwmiex Module Hewlett-Packard Development Company, L.P. "C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe"
IAANTmon.exe 2388 2,948 K 5,824 K RAID Monitor Intel Corporation "C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe"
lsass.exe 672 3,000 K 1,412 K Local Security Authority Process Microsoft Corporation C:\Windows\system32\lsass.exe
lsm.exe 680 2,288 K 5,124 K Local Session Manager Service Microsoft Corporation C:\Windows\system32\lsm.exe
csrss.exe 600 14,604 K 11,376 K Client Server Runtime Process Microsoft Corporation C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
winlogon.exe 708 2,116 K 5,712 K Windows Logon Application Microsoft Corporation winlogon.exe
explorer.exe 1748 25,484 K 33,988 K Windows Explorer Microsoft Corporation C:\Windows\Explorer.EXE
Apoint.exe 1232 2,156 K 5,804 K Alps Pointing-device Driver Alps Electric Co., Ltd. "C:\Program Files\Apoint2K\Apoint.exe"
ApMsgFwd.exe 2728 688 K 2,296 K ApMsgFwd Alps Electric Co., Ltd. "C:\Program Files\Apoint2K\ApMsgFwd.exe" -s{05FA8492-C047-4207-BE65-780D8591C113}
HPWAMain.exe 2096 2,484 K 5,352 K HPWAMain Module Hewlett-Packard Development Company, L.P. "C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe"
WiFiMsg.exe 2836 1,672 K 4,520 K Module to process WiFi messages. Hewlett-Packard Development Company, L.P. "C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe"
igfxtray.exe 2896 1,220 K 4,288 K igfxTray Module Intel Corporation "C:\WINDOWS\System32\igfxtray.exe"
igfxpers.exe 2904 956 K 3,704 K persistence Module Intel Corporation "C:\WINDOWS\System32\igfxpers.exe"
Monitor.exe 2940 1,340 K 4,460 K Registry Monitor PixArt Imaging Incorporation "C:\WINDOWS\PixArt\Pac207\Monitor.exe"
AvastUI.exe 2948 5,168 K 5,200 K avast! Antivirus AVAST Software "C:\Program Files\Alwil Software\Avast5\AvastUI.exe" /nogui
CNYHKey.exe 3096 8,152 K 15,828 K Chicony Keyboard Driver Chicony "C:\WINDOWS\CNYHKey.exe"
procexp.exe 2120 0.77 15,904 K 24,960 K Sysinternals Process Explorer Sysinternals - www.sysinternals.com "C:\Users\User\Desktop\procexp.exe"
firefox.exe 308 90,552 K 103,128 K Firefox Mozilla Corporation "C:\Program Files\Mozilla Firefox\firefox.exe"
plugin-container.exe 3204 18,084 K 20,716 K Plugin Container for Firefox Mozilla Corporation "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel=308.4bae740.515111831 "C:\Windows\system32\Macromed\Flash\NPSWF32.dll" 308 plugin \\.\pipe\gecko-crash-server-pipe.308
ApntEx.exe 2776 1,280 K 3,404 K Alps Pointing-device Driver for Windows NT/2000/XP/Vista Alps Electric Co., Ltd. "Apntex.exe"
October 15th, 2010, 08:57 AM
704_Skate

OTL part 1:

OTL logfile created on: 10/15/2010 8:29:09 AM - Run 1
OTL by OldTimer - Version 3.2.15.2 Folder = C:\Users\User\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 56.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): ?:\pagefile.sys

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 103.54 Gb Total Space | 24.77 Gb Free Space | 23.92% Space Free | Partition Type: NTFS
Drive D: | 8.25 Gb Total Space | 1.50 Gb Free Space | 18.13% Space Free | Partition Type: NTFS

Computer Name: ASK | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days

========== Processes (SafeList) ==========

PRC - [2010/10/15 08:27:58 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe
PRC - [2010/09/07 11:12:02 | 002,838,912 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/09/07 11:11:59 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010/08/13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2009/06/04 20:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2009/04/11 00:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2009/03/03 19:27:02 | 005,576,704 | ---- | M] (Chicony) -- C:\WINDOWS\CNYHKey.exe
PRC - [2007/12/10 19:55:26 | 000,323,584 | ---- | M] (PixArt Imaging Incorporation) -- C:\WINDOWS\PixArt\Pac207\Monitor.exe
PRC - [2007/01/08 14:51:56 | 000,053,248 | ---- | M] (Chicony) -- C:\WINDOWS\ModLEDKey.exe

========== Modules (SafeList) ==========

MOD - [2010/10/15 08:27:58 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe
MOD - [2009/04/11 00:21:40 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll
MOD - [2008/01/19 00:33:02 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (gupdate) Google Update Service (gupdate)
SRV - [2010/09/07 11:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/09/07 11:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/09/07 11:11:59 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/08/13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/04/21 13:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010/04/21 13:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2009/09/24 21:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\FntCache.dll -- (FontCache)
SRV - [2009/06/04 20:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2009/04/11 00:28:18 | 000,052,224 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2008/11/30 16:43:06 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008/01/19 00:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008/01/19 00:33:42 | 000,011,264 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\inetsrv\WMSvc.exe -- (WMSvc)
SRV - [2007/03/20 17:41:24 | 000,153,792 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe -- (Adobe Version Cue CS3)
SRV - [2007/03/05 13:30:06 | 000,110,592 | ---- | M] (Hewlett-Packard Development Company, L.P.) [On_Demand | Stopped] -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe -- (Com4Qlb)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ManyCam.sys -- (ManyCam)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\EagleNT.sys -- (EagleNT)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\User\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2010/09/07 10:52:25 | 000,046,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010/09/07 10:52:03 | 000,165,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2010/09/07 10:47:46 | 000,023,376 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010/09/07 10:47:30 | 000,050,768 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2010/09/07 10:47:07 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/02/13 16:38:53 | 000,304,920 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\iaStor.sys -- (iaStor)
DRV - [2009/04/10 22:42:56 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2009/03/23 14:07:28 | 000,007,408 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)
DRV - [2009/03/23 14:07:26 | 000,072,944 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2009/03/23 14:07:26 | 000,009,968 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2008/11/30 14:30:49 | 000,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Stopped] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2008/07/01 00:16:26 | 000,018,912 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\lmvac.sys -- (LTXMD_VAC) Litex Media Virtual Audio Cable (WDM)
DRV - [2008/03/04 02:32:00 | 000,188,416 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)
DRV - [2008/02/13 17:17:26 | 000,618,112 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\PFC027.SYS -- (PAC207)
DRV - [2008/01/18 22:53:40 | 000,007,680 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\umpass.sys -- (UMPass)
DRV - [2008/01/02 17:48:28 | 002,016,256 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\igdkmd32.sys -- (igfx)
DRV - [2008/01/02 17:48:28 | 002,016,256 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\igdkmd32.sys -- (ialm)
DRV - [2007/12/11 10:52:12 | 000,026,784 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\tbhsd.sys -- (tbhsd)
DRV - [2007/05/11 23:09:50 | 000,043,520 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RTSTOR.sys -- (RTSTOR)
DRV - [2007/05/04 10:11:32 | 002,219,520 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel(R)
DRV - [2007/04/30 15:59:30 | 000,160,768 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\CHDART.sys -- (HdAudAddService)
DRV - [2007/04/25 22:19:26 | 000,984,064 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\HSX_DPV.sys -- (HSF_DPV)
DRV - [2007/04/25 22:18:04 | 000,208,384 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\HSXHWAZL.sys -- (HSXHWAZL)
DRV - [2007/04/25 22:17:54 | 000,660,480 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\HSX_CNXT.sys -- (winachsf)
DRV - [2007/04/23 17:51:08 | 000,050,176 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2007/01/29 18:23:30 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/01/03 11:43:12 | 000,534,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\BCMWL6.SYS -- (BCM43XX)
DRV - [2007/01/03 11:43:12 | 000,534,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\BCMWL6.SYS -- (BCM43XV)
DRV - [2006/11/30 14:24:58 | 000,008,192 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\eabfiltr.sys -- (eabfiltr)
DRV - [2006/11/17 08:19:30 | 000,143,872 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2006/11/02 05:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 05:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 05:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 05:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 05:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 05:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2006/11/02 05:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 05:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 05:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 05:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 05:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 05:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 05:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2006/11/02 05:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 05:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 05:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 05:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2006/11/02 05:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 05:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 05:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 05:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 05:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2006/11/02 05:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 05:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 05:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 05:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 05:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 05:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 05:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 05:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 05:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 05:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 05:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2006/11/02 05:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2006/11/02 05:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2006/11/02 04:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 04:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 04:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 04:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 04:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 04:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 03:41:49 | 000,200,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\VSTAZL3.SYS -- (HSFHWAZL)
DRV - [2006/11/02 03:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 03:30:54 | 001,781,760 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2006/11/02 03:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2006/09/24 09:28:46 | 000,005,248 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Boot | Running] -- C:\Windows\system32\speedfan.sys -- (speedfan)
DRV - [2006/06/28 13:54:00 | 000,009,472 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\CPQBttn.sys -- (HBtnKey)
DRV - [2004/04/26 23:31:04 | 000,474,304 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\lvcd.sys -- (QCDonner) Logitech QuickCam Express(PID_0840)
DRV - [1996/04/03 15:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\system32\giveio.sys -- (giveio)

========== Standard Registry (SafeList) ==========
October 15th, 2010, 08:59 AM
704_Skate

OTL part 2:

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [Binary data over 100 bytes]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...ARIO&pf=laptop

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 13 3F 49 86 EB B1 CA 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/19 23:55:47 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/10/04 09:35:05 | 000,000,000 | ---D | M]

[2009/06/15 08:59:50 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\mozilla\Extensions
[2009/06/15 08:59:50 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\mozilla\Extensions\[email protected]
[2010/10/15 08:19:09 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\bv5h7rsw.SPEED\extensions
[2010/04/27 08:14:16 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\bv5h7rsw.SPEED\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/09/11 09:27:28 | 000,000,000 | ---D | M] (WOT) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\bv5h7rsw.SPEED\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010/09/11 09:27:27 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\bv5h7rsw.SPEED\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/10/14 18:08:42 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2007/12/04 21:05:02 | 000,086,016 | ---- | M] (SpiralFrog Inc.) -- C:\Program Files\Mozilla Firefox\plugins\NPSFDMGR.dll

O1 HOSTS File: ([2010/10/14 08:27:57 | 000,000,027 | ---- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [LchDrv] C:\Windows\LchDrvKey.exe ()
O4 - HKLM..\Run: [ledpointer] C:\Windows\CNYHKey.exe (Chicony)
O4 - HKLM..\Run: [PAC207_Monitor] C:\WINDOWS\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation)
O4 - HKLM..\RunOnce: [Launcher] C:\WINDOWS\SMINST\Launcher.exe (soft thinks)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/07/02 15:22:45 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2005/09/11 11:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: VIDC.I420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 90 Days ==========

[2010/10/15 08:28:00 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe
[2010/10/14 21:00:14 | 000,000,000 | ---D | C] -- C:\Users\User\Desktop\[Shinsen-Subs_Rumbel_sMi_HorribleSubs]_Gintama_1-201+OVAs_(480p_XviD+H264)
[2010/10/14 08:38:24 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010/10/14 08:38:24 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\temp
[2010/10/14 08:28:07 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2010/10/14 08:09:09 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010/10/13 21:52:05 | 000,000,000 | ---D | C] -- C:\Users\User\Desktop\NTBR_CD
[2010/10/13 21:16:47 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2010/10/13 21:16:46 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2010/10/13 21:16:46 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2010/10/13 21:12:38 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/10/12 15:39:41 | 003,887,480 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\Users\User\Desktop\procexp.exe
[2010/10/09 11:41:35 | 000,000,000 | ---D | C] -- C:\Users\User\Desktop\Icons
[2010/10/09 11:31:33 | 000,000,000 | ---D | C] -- C:\Users\User\Desktop\NIntendo 64 ROMs
[2010/10/08 11:59:21 | 000,000,000 | ---D | C] -- C:\Program Files\KeyTweak
[2010/10/07 21:21:56 | 000,000,000 | R--D | C] -- C:\Users\User\Desktop\Gintama 1-90 engsub
[2010/10/07 15:28:56 | 000,000,000 | ---D | C] -- C:\Program Files\Project64 1.6
[2010/10/06 16:27:05 | 005,576,704 | ---- | C] (Chicony) -- C:\Windows\CNYHKey.exe
[2010/10/06 16:27:05 | 000,053,248 | ---- | C] (Chicony) -- C:\Windows\ModLEDKey.exe
[2010/10/03 19:34:50 | 000,000,000 | ---D | C] -- C:\Program Files\Xvid
[2010/09/19 09:43:37 | 000,038,848 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2010/09/19 09:42:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Alwil Software
[2010/09/16 13:16:53 | 000,000,000 | ---D | C] -- C:\Users\User\Desktop\Documents
[2010/09/16 13:16:39 | 000,000,000 | ---D | C] -- C:\Users\User\Desktop\Videos
[2010/09/16 13:16:33 | 000,000,000 | ---D | C] -- C:\Users\User\Desktop\Photos
[2010/09/16 12:45:27 | 000,000,000 | ---D | C] -- C:\Users\User\Documents\BOA
[2010/09/12 12:12:19 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\AirMouse
[2010/09/12 12:11:54 | 000,000,000 | ---D | C] -- C:\Program Files\Air Mouse
[2010/09/12 11:34:01 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2010/08/26 13:30:36 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\ManyCam
[2010/08/26 13:30:20 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
[2010/08/26 09:18:30 | 000,000,000 | ---D | C] -- C:\Users\User\Documents\Documents\microsoft
[2010/08/24 22:05:56 | 000,000,000 | ---D | C] -- C:\Program Files\WinSCP
[2010/08/16 15:47:30 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Roaming\GameTuts
[2010/08/16 15:47:30 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\GameTuts
[2010/08/11 12:52:48 | 000,000,000 | ---D | C] -- C:\Users\User\Documents\Recorded TV
[2010/07/27 12:26:48 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\ElevatedDiagnostics
[2010/07/27 12:24:57 | 000,000,000 | ---D | C] -- C:\Windows\System32\WindowsPowerShell
[2010/07/27 12:22:12 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft ATS
[2010/07/26 16:48:26 | 000,000,000 | R--D | C] -- C:\Users\User\Documents\Documents
[2010/07/26 11:37:56 | 000,000,000 | ---D | C] -- C:\Users\User\Tracing
[2010/07/17 16:32:43 | 000,000,000 | ---D | C] -- C:\Program Files\LimeWire
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/10/15 08:27:58 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe
[2010/10/15 08:24:07 | 000,066,048 | ---- | M] () -- C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/15 07:58:04 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/10/15 07:58:04 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/10/15 07:57:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/10/15 07:57:40 | 000,043,008 | ---- | M] () -- C:\Windows\System32\umstartup.etl
[2010/10/15 07:57:39 | 2137,022,464 | -HS- | M] () -- C:\hiberfil.sys
[2010/10/14 22:00:20 | 000,055,296 | ---- | M] () -- C:\Windows\System32\umstartup000.etl
[2010/10/14 17:59:04 | 000,002,231 | ---- | M] () -- C:\Users\User\Desktop\iTunes.lnk
[2010/10/14 15:49:39 | 000,002,281 | ---- | M] () -- C:\Users\User\Desktop\Safari.lnk
[2010/10/14 08:27:57 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010/10/13 21:51:36 | 002,565,432 | ---- | M] () -- C:\Users\User\Desktop\NTBR_CD.exe
[2010/10/13 21:07:26 | 003,878,092 | R--- | M] () -- C:\Users\User\Desktop\ComboFix.exe
[2010/10/13 21:03:22 | 000,080,384 | ---- | M] () -- C:\Users\User\Desktop\MBRCheck.exe
[2010/10/13 18:19:13 | 000,002,513 | ---- | M] () -- C:\Users\User\Desktop\Air Mouse.lnk
[2010/10/13 11:36:06 | 000,002,469 | ---- | M] () -- C:\Users\User\Desktop\iPhoneBrowser.lnk
[2010/10/13 08:45:41 | 000,544,768 | ---- | M] () -- C:\Users\User\Desktop\dds.scr
[2010/10/12 22:04:05 | 000,293,376 | ---- | M] () -- C:\Users\User\Desktop\m9kx36bk.exe
[2010/10/12 19:57:19 | 000,717,342 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/10/12 19:57:19 | 000,146,218 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/10/12 18:57:28 | 000,000,776 | ---- | M] () -- C:\Users\User\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2010/10/12 18:57:28 | 000,000,752 | ---- | M] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2010/10/09 15:16:01 | 000,000,172 | ---- | M] () -- C:\Users\User\Desktop\Poop.lnk
[2010/10/09 11:43:57 | 000,001,880 | ---- | M] () -- C:\Users\User\Desktop\Photoshop.lnk
[2010/10/08 15:06:19 | 000,002,627 | ---- | M] () -- C:\Users\User\Desktop\MS Word.lnk
[2010/10/08 11:59:08 | 000,287,220 | ---- | M] () -- C:\Users\User\Desktop\KeyTweak_install.exe
[2010/10/08 09:18:01 | 006,191,104 | ---- | M] () -- C:\Users\User\Desktop\Gintama - ED1 - 01 - Fuusen Gum.mp3
[2010/10/07 15:36:52 | 030,036,333 | ---- | M] () -- C:\Users\User\Desktop\Perfect Dark.zip
[2010/10/06 23:25:00 | 000,008,804 | ---- | M] () -- C:\Users\User\Desktop\SPgQEpbI.mp3
[2010/09/28 21:34:01 | 000,076,278 | ---- | M] () -- C:\Users\User\Desktop\353094.mp3
[2010/09/19 09:56:10 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2010/09/19 09:45:09 | 000,001,840 | ---- | M] () -- C:\Users\User\Desktop\avast! Free Antivirus.lnk
[2010/09/18 18:39:05 | 000,000,020 | -H-- | M] () -- C:\ProgramData\PKP_DLdu.DAT
[2010/09/16 21:52:13 | 000,000,318 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForUser.job
[2010/09/16 11:32:05 | 001,791,472 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/09/07 11:12:17 | 000,038,848 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2010/09/07 11:11:54 | 000,167,592 | ---- | M] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2010/09/07 10:52:25 | 000,046,672 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2010/09/07 10:52:03 | 000,165,584 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2010/09/07 10:47:46 | 000,023,376 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys
[2010/09/07 10:47:30 | 000,050,768 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2010/09/07 10:47:07 | 000,017,744 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2010/08/29 16:51:31 | 000,000,600 | ---- | M] () -- C:\Users\User\AppData\Roaming\winscp.rnd
[2010/08/24 22:05:58 | 000,001,586 | ---- | M] () -- C:\Users\User\Desktop\WinSCP.lnk
[2010/07/27 12:22:45 | 003,473,408 | ---- | M] () -- C:\Windows\ocsetup_install_MicrosoftWindowsPowerShell.etl
[2010/07/27 12:22:45 | 000,196,608 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.perf
[2010/07/27 12:22:45 | 000,065,536 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.dpx
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]
October 15th, 2010, 09:01 AM
704_Skate

OTL part 3:

========== Files Created - No Company Name ==========

[2010/10/13 21:51:34 | 002,565,432 | ---- | C] () -- C:\Users\User\Desktop\NTBR_CD.exe
[2010/10/13 21:16:46 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010/10/13 21:16:46 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010/10/13 21:16:46 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010/10/13 21:07:23 | 003,878,092 | R--- | C] () -- C:\Users\User\Desktop\ComboFix.exe
[2010/10/13 21:03:28 | 000,080,384 | ---- | C] () -- C:\Users\User\Desktop\MBRCheck.exe
[2010/10/13 08:45:41 | 000,544,768 | ---- | C] () -- C:\Users\User\Desktop\dds.scr
[2010/10/12 22:04:07 | 000,293,376 | ---- | C] () -- C:\Users\User\Desktop\m9kx36bk.exe
[2010/10/12 18:57:28 | 000,000,752 | ---- | C] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2010/10/09 11:42:48 | 000,002,231 | ---- | C] () -- C:\Users\User\Desktop\iTunes.lnk
[2010/10/09 11:41:27 | 000,001,880 | ---- | C] () -- C:\Users\User\Desktop\Photoshop.lnk
[2010/10/08 11:59:10 | 000,287,220 | ---- | C] () -- C:\Users\User\Desktop\KeyTweak_install.exe
[2010/10/08 09:17:45 | 006,191,104 | ---- | C] () -- C:\Users\User\Desktop\Gintama - ED1 - 01 - Fuusen Gum.mp3
[2010/10/07 15:35:22 | 030,036,333 | ---- | C] () -- C:\Users\User\Desktop\Perfect Dark.zip
[2010/10/06 23:25:00 | 000,008,804 | ---- | C] () -- C:\Users\User\Desktop\SPgQEpbI.mp3
[2010/10/06 16:27:05 | 000,201,076 | ---- | C] () -- C:\Windows\comwarn.bmp
[2010/10/06 16:27:05 | 000,049,152 | ---- | C] () -- C:\Windows\CNYUSB.dll
[2010/10/06 16:27:05 | 000,036,864 | ---- | C] () -- C:\Windows\LchDrvKey.exe
[2010/10/06 16:27:05 | 000,003,088 | ---- | C] () -- C:\Windows\MODLED.xml
[2010/10/06 16:27:05 | 000,000,360 | ---- | C] () -- C:\Windows\CNYHKey.ini
[2010/09/28 21:34:05 | 000,076,278 | ---- | C] () -- C:\Users\User\Desktop\353094.mp3
[2010/09/19 09:45:09 | 000,001,840 | ---- | C] () -- C:\Users\User\Desktop\avast! Free Antivirus.lnk
[2010/09/12 12:11:55 | 000,002,513 | ---- | C] () -- C:\Users\User\Desktop\Air Mouse.lnk
[2010/08/24 22:06:01 | 000,000,600 | ---- | C] () -- C:\Users\User\AppData\Roaming\winscp.rnd
[2010/08/24 22:05:58 | 000,001,586 | ---- | C] () -- C:\Users\User\Desktop\WinSCP.lnk
[2010/07/27 12:22:14 | 003,473,408 | ---- | C] () -- C:\Windows\ocsetup_install_MicrosoftWindowsPowerShell.etl
[2010/07/27 12:22:14 | 000,196,608 | ---- | C] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.perf
[2010/07/27 12:22:14 | 000,065,536 | ---- | C] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.dpx
[2010/04/13 12:30:44 | 000,000,295 | ---- | C] () -- C:\ProgramData\Setting.dat
[2010/04/13 12:30:44 | 000,000,022 | ---- | C] () -- C:\Users\User\AppData\Roaming\UserFlag.ini
[2010/03/27 21:41:57 | 000,000,000 | ---- | C] () -- C:\ProgramData\laserjet
[2010/02/22 18:42:48 | 000,015,100 | ---- | C] () -- C:\Users\User\AppData\Roaming\UserTile.png
[2010/02/19 16:21:52 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010/01/19 14:30:38 | 000,073,728 | ---- | C] () -- C:\Windows\System32\VistaInfo32.dll
[2009/08/01 12:25:48 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll
[2009/08/01 12:25:48 | 000,153,088 | ---- | C] () -- C:\Windows\System32\UNRAR3.dll
[2009/08/01 12:25:48 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll
[2009/08/01 12:25:48 | 000,075,264 | ---- | C] () -- C:\Windows\System32\unacev2.dll
[2009/04/07 20:43:36 | 000,000,268 | RH-- | C] () -- C:\ProgramData\vhosts
[2009/04/07 20:43:36 | 000,000,268 | RH-- | C] () -- C:\Users\User\AppData\Roaming\laserjet
[2009/04/07 20:43:36 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLck.DAT
[2009/04/07 20:43:34 | 000,000,000 | ---- | C] () -- C:\Users\User\AppData\Roaming\libiconv
[2009/04/07 19:57:49 | 000,000,000 | -H-- | C] () -- C:\ProgramData\PKP_DLbx.DAT
[2009/03/12 19:36:34 | 000,782,336 | ---- | C] () -- C:\Windows\System32\IlmImf.dll
[2009/03/12 19:36:34 | 000,353,280 | ---- | C] () -- C:\Windows\System32\pmtf2.dll
[2009/03/12 19:36:34 | 000,205,824 | ---- | C] () -- C:\Windows\System32\pmtf1.dll
[2009/03/12 19:36:34 | 000,204,288 | ---- | C] () -- C:\Windows\System32\pmtf3.dll
[2009/03/12 19:36:34 | 000,053,248 | ---- | C] () -- C:\Windows\System32\pmexr.dll
[2009/03/12 19:36:34 | 000,011,776 | ---- | C] () -- C:\Windows\System32\pmbm.dll
[2009/03/12 19:36:33 | 000,446,464 | ---- | C] () -- C:\Windows\System32\Photomatix_jpg.dll
[2009/03/12 19:36:33 | 000,266,240 | ---- | C] () -- C:\Windows\System32\Photomatix25Lib.dll
[2009/03/12 19:36:33 | 000,249,856 | ---- | C] () -- C:\Windows\System32\Photomatix25Lib2.dll
[2009/03/12 19:36:33 | 000,167,936 | ---- | C] () -- C:\Windows\System32\Photomatix25Lib3.dll
[2009/02/28 14:49:19 | 000,000,216 | ---- | C] () -- C:\Windows\ViewNX.INI
[2009/02/28 14:42:57 | 000,000,000 | -H-- | C] () -- C:\ProgramData\PKP_DLdw.DAT
[2009/02/28 14:42:57 | 000,000,000 | ---- | C] () -- C:\Users\User\AppData\Roaming\Rock Kit
[2009/02/28 14:40:47 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Sample Delay
[2009/02/28 14:40:47 | 000,000,268 | RH-- | C] () -- C:\Users\User\AppData\Roaming\Robot
[2009/02/28 14:40:47 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdu.DAT
[2009/02/28 14:40:47 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Screen Savers
[2009/02/13 23:38:39 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2009/02/13 23:35:25 | 000,000,044 | ---- | C] () -- C:\Windows\EPSNX400.ini
[2008/11/16 20:04:55 | 000,049,959 | ---- | C] () -- C:\Windows\php.ini
[2008/08/10 10:26:44 | 000,000,324 | ---- | C] () -- C:\Windows\game.ini
[2008/05/03 11:15:25 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2008/01/13 13:41:37 | 000,000,092 | ---- | C] () -- C:\Users\User\AppData\Local\fusioncache.dat
[2008/01/02 17:57:36 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1409.dll
[2008/01/02 17:47:22 | 001,953,696 | ---- | C] () -- C:\Windows\System32\igklg400.dll
[2008/01/02 17:47:22 | 001,533,360 | ---- | C] () -- C:\Windows\System32\igklg450.dll
[2008/01/02 17:47:22 | 000,104,636 | ---- | C] () -- C:\Windows\System32\igmedcompkrn.dll
[2007/12/29 22:47:52 | 002,463,976 | ---- | C] () -- C:\Windows\System32\NPSWF32.dll
[2007/12/03 21:02:27 | 000,002,106 | ---- | C] () -- C:\Users\User\AppData\Roaming\wklnhst.dat
[2007/12/03 17:11:30 | 000,066,048 | ---- | C] () -- C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/12/02 21:03:39 | 000,000,000 | ---- | C] () -- C:\Users\User\AppData\Local\QSwitch.txt
[2007/12/02 21:03:39 | 000,000,000 | ---- | C] () -- C:\Users\User\AppData\Local\DSwitch.txt
[2007/12/02 21:03:39 | 000,000,000 | ---- | C] () -- C:\Users\User\AppData\Local\AtStart.txt
[2007/10/25 23:02:54 | 000,000,566 | ---- | C] () -- C:\Windows\System32\SP207.INI
[2007/08/23 20:30:00 | 000,007,680 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2007/07/02 15:08:26 | 000,001,321 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2007/06/27 16:13:51 | 000,512,000 | ---- | C] () -- C:\Windows\System32\RegisterDialog.dll
[2007/05/31 07:14:00 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1283.dll
[2007/05/31 06:49:06 | 000,910,464 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll
[2007/02/27 16:43:02 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2006/12/14 02:01:36 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006/12/14 02:01:36 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2005/02/28 14:33:00 | 000,343,040 | R--- | C] () -- C:\Windows\System32\lffpx7.dll
[2005/02/28 14:33:00 | 000,116,736 | R--- | C] () -- C:\Windows\System32\lfkodak.dll
[2004/03/26 09:56:40 | 000,017,191 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2004/01/08 10:30:22 | 000,011,170 | ---- | C] () -- C:\Windows\System32\PA207USD.DLL
[2003/09/23 08:14:42 | 001,099,264 | ---- | C] () -- C:\Windows\System32\cygxml2-2.dll
[2003/08/10 10:59:20 | 000,980,992 | ---- | C] () -- C:\Windows\System32\cygiconv-2.dll
[2003/08/08 20:28:16 | 000,061,440 | ---- | C] () -- C:\Windows\System32\cygz.dll
[1996/04/03 15:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys

========== LOP Check ==========

[2010/03/25 15:00:54 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\acccore
[2010/04/13 12:32:23 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\AutoHideIP
[2008/12/19 09:57:36 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\BonkEnc
[2008/10/20 13:39:22 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\cmw
[2009/10/01 11:59:59 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2008/01/01 18:25:12 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\COWON
[2008/11/30 14:30:00 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\DAEMON Tools
[2009/03/09 09:16:25 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\ExpressDigital
[2010/08/16 15:47:30 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\GameTuts
[2009/07/09 18:04:15 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\gtk-2.0
[2009/04/10 10:47:04 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\IrfanView
[2010/06/24 14:46:22 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\iTunes Agent
[2009/02/13 23:43:18 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Leadertech
[2010/08/26 14:06:31 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\ManyCam
[2009/09/04 08:57:46 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\MSNInstaller
[2009/04/07 20:43:41 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Nikon
[2009/07/09 18:02:16 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Participatory Culture Foundation
[2010/10/04 13:39:46 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\PCF-VLC
[2010/02/22 18:42:47 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\PeerNetworking
[2008/10/28 21:25:15 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Publish Providers
[2010/01/11 22:20:36 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Red Kawa
[2008/02/16 12:43:01 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\RTPlayer
[2010/06/08 22:36:36 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\SorensonMedia
[2007/12/03 21:02:31 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Template
[2010/10/14 21:57:57 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\uTorrent
[2010/10/14 22:00:11 | 000,032,606 | ---- | M] () -- C:\WINDOWS\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2007/07/02 15:22:45 | 000,000,074 | ---- | M] () -- C:\autoexec.bat
[2009/04/11 00:36:38 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2010/10/14 08:38:22 | 000,016,029 | ---- | M] () -- C:\ComboFix.txt
[2006/09/18 17:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2010/10/15 07:57:39 | 2137,022,464 | -HS- | M] () -- C:\hiberfil.sys
[2008/02/17 11:45:21 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/03/25 15:00:47 | 000,001,063 | -H-- | M] () -- C:\IPH.PH
[2008/02/17 11:45:21 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2010/10/15 07:57:36 | 2450,817,024 | -HS- | M] () -- C:\pagefile.sys
[2008/08/05 21:29:17 | 000,000,000 | -H-- | M] () -- C:\ProgramData.LOG1
[2008/08/05 21:29:17 | 000,000,000 | -H-- | M] () -- C:\ProgramData.LOG2

< %systemroot%\Fonts\*.com >
[2006/11/02 08:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 08:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 08:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2010/02/19 16:40:43 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 17:37:34 | 000,000,065 | -H-- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/11/02 08:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 22:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/09/07 11:12:17 | 000,038,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2010/02/19 13:36:29 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 06:34:05 | 000,008,192 | ---- | M] () -- C:\WINDOWS\System32\config\COMPONENTS.SAV
[2006/11/02 06:34:05 | 000,020,480 | ---- | M] () -- C:\WINDOWS\System32\config\DEFAULT.SAV
[2006/11/02 06:34:05 | 000,008,192 | ---- | M] () -- C:\WINDOWS\System32\config\SECURITY.SAV
[2006/11/02 06:34:08 | 010,133,504 | ---- | M] () -- C:\WINDOWS\System32\config\SOFTWARE.SAV
[2006/11/02 06:34:08 | 001,826,816 | ---- | M] () -- C:\WINDOWS\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/02/20 01:12:06 | 000,000,286 | -HS- | M] () -- C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/10/13 21:07:26 | 003,878,092 | R--- | M] () -- C:\Users\User\Desktop\ComboFix.exe
[2010/10/08 11:59:08 | 000,287,220 | ---- | M] () -- C:\Users\User\Desktop\KeyTweak_install.exe
[2010/10/12 22:04:05 | 000,293,376 | ---- | M] () -- C:\Users\User\Desktop\m9kx36bk.exe
[2010/10/13 21:03:22 | 000,080,384 | ---- | M] () -- C:\Users\User\Desktop\MBRCheck.exe
[2010/05/20 20:36:06 | 016,726,528 | ---- | M] (GameTuts) -- C:\Users\User\Desktop\Modio.exe
[2010/10/13 21:51:36 | 002,565,432 | ---- | M] () -- C:\Users\User\Desktop\NTBR_CD.exe
[2010/10/15 08:27:58 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe
[2010/06/07 16:16:56 | 003,887,480 | ---- | M] (Sysinternals - www.sysinternals.com) -- C:\Users\User\Desktop\procexp.exe
[2010/04/23 08:56:39 | 005,348,430 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Users\User\Desktop\SASDEFINITIONS.EXE
October 15th, 2010, 09:02 AM
704_Skate

OTL part 4(end):

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2009/09/03 13:30:06 | 000,000,086 | -HS- | M] () -- C:\Users\User\Favorites\desktop (2).ini
[2010/02/17 23:53:25 | 000,000,100 | -HS- | M] () -- C:\Users\User\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2009/04/08 10:27:21 | 000,001,321 | ---- | M] () -- C:\ProgramData\hpzinstall.log
[2010/03/27 21:41:57 | 000,000,000 | ---- | M] () -- C:\ProgramData\laserjet
[2009/02/28 14:40:47 | 000,000,268 | RH-- | M] () -- C:\ProgramData\Sample Delay
[2009/02/28 14:40:47 | 000,000,012 | RH-- | M] () -- C:\ProgramData\Screen Savers
[2009/04/07 20:43:36 | 000,000,268 | RH-- | M] () -- C:\ProgramData\vhosts

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-09-16 14:44:18

========== Alternate Data Streams ==========

@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:CB0AACC9
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:888AFB86

< End of report >
October 15th, 2010, 09:05 AM
704_Skate

OTL Extras:

OTL Extras logfile created on: 10/15/2010 8:29:09 AM - Run 1
OTL by OldTimer - Version 3.2.15.2 Folder = C:\Users\User\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 56.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): ?:\pagefile.sys

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 103.54 Gb Total Space | 24.77 Gb Free Space | 23.92% Space Free | Partition Type: NTFS
Drive D: | 8.25 Gb Total Space | 1.50 Gb Free Space | 18.13% Space Free | Partition Type: NTFS

Computer Name: ASK | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink -- (EarthLink, Inc.)
"C:\Nexon\Combat Arms\CombatArms.exe" = C:\Nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe -- File not found
"C:\Nexon\Combat Arms\Engine.exe" = C:\Nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe -- File not found

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{09AD658A-83CC-4B61-8E07-6A9E1EE3BDE6}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{1FD870D9-2C80-4363-8814-30DA70F1B3DC}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2B2A737D-3BCF-464D-8F0D-5898AF3FE4A1}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2CF66F5C-8388-4A06-8E79-D6BC319E108E}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{2F4AAD21-C776-4D05-AAAA-37C4650B02D4}" = lport=2869 | protocol=6 | dir=in | app=system |
"{2FD77A1E-DAC3-49E3-BDCB-FFBE55F7561A}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{30ED67D9-D0B7-4282-995B-E4EC72C0E440}" = lport=3390 | protocol=6 | dir=in | app=system |
"{3362B0F7-BE57-4BAF-B63F-3781562DAA2C}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{40CCB0FB-5E92-4A8D-937E-E09B27D976D7}" = rport=10244 | protocol=6 | dir=out | app=system |
"{45E9BE7B-4E2C-4E49-97C9-55DB3D7291CA}" = lport=50900 | protocol=6 | dir=in | name=adobe version cue cs3 server |
"{477D9C4D-5D20-4877-A051-96717F7BA716}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{4CBAD709-0F36-42FC-ACD6-4BA4BEF575A1}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4E813718-D591-42F2-9F1F-1DE47D05E910}" = rport=10244 | protocol=6 | dir=out | app=system |
"{528FEBE0-B702-4617-BC21-D71FCEB4A96F}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6583E76B-FDF3-4768-87EE-C602628B75BB}" = lport=10244 | protocol=6 | dir=in | app=system |
"{704DDA08-0640-49AD-81E8-9C4DAA88FABC}" = lport=50901 | protocol=6 | dir=in | name=adobe version cue cs3 server |
"{7364F133-4956-48F4-BFB8-79FE9BAA1BFF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{92A1EDD0-6021-4C66-813D-58230EB173BB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A871EDFF-D9E4-4078-891E-5BDD1ACD9B00}" = lport=3704 | protocol=6 | dir=in | name=adobe version cue cs3 server |
"{AB3983C5-C8BD-44D2-BA02-6D1C785DA005}" = lport=10244 | protocol=6 | dir=in | app=system |
"{AE529A42-4A1A-40E8-9AE7-520C1AD5EFE7}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B3B58F1D-267E-4824-87F4-EC924CA17895}" = lport=3390 | protocol=6 | dir=in | app=system |
"{B85AC426-EC27-41FB-9FEF-78ECBCA3A152}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{DFE7A25A-FEDF-4DA0-BE00-7B60337EB184}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E0302C97-F86B-4787-990A-33E2A761AA1E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{EA182DCC-8498-4123-A86F-CBF99B2BBBF2}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{ECC74572-1E19-41B4-87ED-EF15F98057F8}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{EE7DB200-56A7-41D8-A25E-34F63E101F09}" = lport=3703 | protocol=6 | dir=in | name=adobe version cue cs3 server |
"{FCD34262-28BB-426C-A4F4-6AFC97A38598}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========
October 15th, 2010, 09:06 AM
704_Skate

OTL Extras 2:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{09072B94-762C-4E72-96C4-F757FD5053C5}" = protocol=6 | dir=in | app=c:\users\user\appdata\local\google\google talk plugin\googletalkplugin.dll |
"{09AD28E0-9AC1-4020-8926-CD3EBB9BCB7C}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{0E5D8F82-F20F-49A4-859D-B2D7A71F2897}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{0F00C2CC-DFA7-47E1-9900-9FF419974DA8}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{1007139C-9EE4-40B2-9295-F6A858488E8C}" = protocol=6 | dir=in | app=c:\program files\common files\adobe\adobe version cue cs3\server\bin\versioncuecs3.exe |
"{16DE3AAB-B77D-41B5-8B23-06C711ACBC62}" = protocol=6 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe |
"{1A0A9032-E4F6-48A6-A875-22D775C2603D}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{205F9FBE-A091-4BB8-B5C4-DE40A44ECC94}" = protocol=17 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe |
"{28BD40BA-5260-4339-B6B4-67880C1781F0}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{29832D12-7090-40CD-BDA4-AE7557BF045F}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |
"{2AB45576-535C-4805-BC9B-4468B5C1A883}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{2B63DD9B-A0DC-461C-8A6E-E74F1F57E09E}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{2C360A00-9E4F-49D8-ACC4-BD3DF7CC069C}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{2E240EF2-D0D2-49C7-9A52-D30081814F82}" = protocol=6 | dir=in | app=c:\nexon\combat arms\nmservice.exe |
"{2FB92F16-6B64-43BA-8134-391CF453F0BC}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |
"{37933574-D742-4D03-9B00-8741B181DC7F}" = protocol=6 | dir=in | app=c:\users\user\appdata\local\google\google talk plugin\googletalkplugin.dll |
"{40680330-5DA7-458F-8365-286EC5F29468}" = protocol=17 | dir=in | app=c:\users\user\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{40FF2285-BE74-49BC-A99B-A0BA4F0643E2}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{46064507-A06B-4E64-AA55-DE11C66EC63C}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{48C8C6DC-5227-4F54-8401-93517FA93393}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{4E04E64F-AE13-4867-A79F-8A6F241DDD36}" = protocol=6 | dir=in | app=c:\users\user\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{517473D1-9075-43C8-82A9-D6F6D091AAEE}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{51B060D6-D32E-4BBE-99E2-4B959CFE916D}" = protocol=6 | dir=in | app=c:\program files\aim\aim.exe |
"{52511075-CEE2-4479-A586-13872E8646D0}" = protocol=17 | dir=in | app=c:\nexon\combat arms\nmservice.exe |
"{549B6B35-6936-4226-B668-E7BF8E56239F}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{57DC2668-6225-473A-A5A2-0A839F0A0CA7}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |
"{5EF191FC-52BF-4347-8187-BB36B6EB393F}" = dir=in | app=c:\program files\hp\quickplay\qpservice.exe |
"{68A51392-8536-4938-907B-45130DCA4EC6}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{6C068F26-2A0B-4DEB-853F-FBD924AD2671}" = protocol=6 | dir=in | app=c:\users\user\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{6E10C5AC-C0D6-4096-A54B-CD9419B67CEA}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{71BDE264-EA75-460F-AE13-FD66E44AD65E}" = dir=in | app=c:\program files\avg\avg8\avgupd.exe |
"{82110467-1618-4FE8-8E7F-25E84678EB47}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{8BA44A3A-E0EE-48D0-ACEC-5CEF889853A9}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{9071F170-C21F-4773-8E8F-117D16F5FF0D}" = protocol=17 | dir=in | app=c:\users\user\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{93364FFB-2E27-43FB-BDDC-F30192121245}" = protocol=17 | dir=in | app=c:\program files\common files\adobe\adobe version cue cs3\server\bin\versioncuecs3.exe |
"{99535E70-1306-4163-95EC-9A23E1E4F839}" = protocol=17 | dir=in | app=c:\users\user\appdata\local\google\google talk plugin\googletalkplugin.dll |
"{997E7CDE-441F-4622-8BE7-F2B7455CD01D}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{A3485055-2356-40A6-B4A2-E76962C46945}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{B05D60CC-C860-4710-BA83-42E1A692950F}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{B6973CB4-EB1C-41EF-BE68-5248A3990119}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{B6988973-878F-40FA-AB73-1DD41FC82701}" = protocol=17 | dir=in | app=c:\program files\aim\aim.exe |
"{BDC87F2F-64C4-492B-B680-D4CFD47CAF97}" = protocol=17 | dir=in | app=c:\program files\rapidsolution\tunebite\tunebitehelper.exe |
"{C372D478-5C60-4B05-B719-8BFF44AB655B}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{C83B7026-7510-499C-B9A5-BE3CA50E77C4}" = dir=in | app=c:\program files\hp\quickplay\qp.exe |
"{CAF9D0E6-3088-49FB-9FC7-007986BDB957}" = protocol=6 | dir=in | app=c:\program files\aim6\aim6.exe |
"{D182EE80-8DFD-4E44-B52D-76791242342E}" = protocol=17 | dir=in | app=c:\users\user\appdata\local\google\google talk plugin\googletalkplugin.dll |
"{D63869C1-6E98-4D09-B08C-58999479CAED}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{D6AE63DE-5E50-4E8B-B00B-3C04D7B971EB}" = protocol=17 | dir=in | app=c:\program files\aim6\aim6.exe |
"{DAD74EFE-EF86-477C-A6AF-D21377A4A757}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |
"{DAF9D2F1-DAD7-461B-95C0-38A092F5E668}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{E035354A-40D0-45A1-AA59-6690996273F0}" = dir=in | app=c:\program files\avg\avg8\avgemc.exe |
"{E5855797-0560-4E2E-B5CC-2AF235443353}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{E61C9BA9-8EE1-4985-9A83-10052E75B6F6}" = dir=in | app=c:\program files\avg\avg8\avgnsx.exe |
"{F3B4F889-CD88-4CBF-81C1-37D525E21CE5}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{F543A254-FAF0-4E52-95BF-807BB9572A5A}" = protocol=6 | dir=in | app=c:\program files\rapidsolution\tunebite\tunebitehelper.exe |
"{F5702B88-6A9A-437E-9A23-D78AF6FFCC60}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{FF2A7C84-E427-4623-813D-FFB61AF82C11}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"TCP Query User{15120C0C-A4DE-40A8-86CE-2A6F4AF54B4D}C:\program files\sorenson media\sorenson squeeze 6\squeeze.exe" = protocol=6 | dir=in | app=c:\program files\sorenson media\sorenson squeeze 6\squeeze.exe |
"TCP Query User{1B12D837-0253-4350-9A07-9B96764D94ED}C:\program files\realvnc\vnc4\winvnc4.exe" = protocol=6 | dir=in | app=c:\program files\realvnc\vnc4\winvnc4.exe |
"TCP Query User{2DB693D5-84EF-403F-AE5B-CC6F265CE54C}C:\program files\air mouse\air mouse\air mouse.exe" = protocol=6 | dir=in | app=c:\program files\air mouse\air mouse\air mouse.exe |
"TCP Query User{3067112C-BCFB-41CD-AACF-DFD4E4FCDA85}C:\program files\aim6\aim6.exe" = protocol=6 | dir=in | app=c:\program files\aim6\aim6.exe |
"TCP Query User{36C7C665-5E58-4B4C-A741-CAB58C502ADF}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{3AE89D9D-C5D9-44F8-8B45-B80E36F38F1A}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{4A297E0B-47BC-41E3-91B6-32A5FDD7784E}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{54CABC1A-1A9E-4721-9982-121E185089C4}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{654B1F41-3F46-41B5-9A2C-0CE785716E08}C:\program files\adobe\adobe after effects cs3\support files\afterfx.exe" = protocol=6 | dir=in | app=c:\program files\adobe\adobe after effects cs3\support files\afterfx.exe |
"TCP Query User{6E802CEC-19BF-402C-A7A9-4F8B56F4D58E}C:\program files\secondlife\slvoice.exe" = protocol=6 | dir=in | app=c:\program files\secondlife\slvoice.exe |
"TCP Query User{80E4F7EC-AC3E-4A0A-A506-D600719646C3}C:\program files\air mouse\air mouse\air mouse.exe" = protocol=6 | dir=in | app=c:\program files\air mouse\air mouse\air mouse.exe |
"TCP Query User{97697C45-D0D1-450B-8DF4-13B6163348AA}C:\users\user\desktop\left.4.dead.full-rip.skullptura\left.4.dead.full-rip.skullptura\left 4 dead\left4dead.exe" = protocol=6 | dir=in | app=c:\users\user\desktop\left.4.dead.full-rip.skullptura\left.4.dead.full-rip.skullptura\left 4 dead\left4dead.exe |
"TCP Query User{A2A4D01D-B2BC-4E43-B621-68F7F5DA4C7C}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{B31EB147-9B84-463F-822F-47CF297400FE}C:\program files\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"TCP Query User{DB52CC70-4FB4-4BB1-9E55-D8709D99A726}C:\users\user\desktop\left.4.dead.full-rip.skullptura\left.4.dead.full-rip.skullptura\left 4 dead\left4dead.exe" = protocol=6 | dir=in | app=c:\users\user\desktop\left.4.dead.full-rip.skullptura\left.4.dead.full-rip.skullptura\left 4 dead\left4dead.exe |
"TCP Query User{E4B5E232-F067-4E13-A925-34E6E101F512}C:\program files\participatory culture foundation\miro\miro_downloader.exe" = protocol=6 | dir=in | app=c:\program files\participatory culture foundation\miro\miro_downloader.exe |
"TCP Query User{F502C336-3784-4898-8771-504249ABA0BE}C:\program files\quicktime\quicktimeplayer.exe" = protocol=6 | dir=in | app=c:\program files\quicktime\quicktimeplayer.exe |
"TCP Query User{F82EF6D2-53AA-4F10-8C21-64C747EB1F20}C:\program files\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"UDP Query User{08055B90-EFCF-43A7-8F06-C315744E529F}C:\program files\air mouse\air mouse\air mouse.exe" = protocol=17 | dir=in | app=c:\program files\air mouse\air mouse\air mouse.exe |
"UDP Query User{0B09AD00-EDC8-4C80-8A3C-CF01D4A36D95}C:\program files\quicktime\quicktimeplayer.exe" = protocol=17 | dir=in | app=c:\program files\quicktime\quicktimeplayer.exe |
"UDP Query User{281FA310-3936-431C-BC33-D453A1886A28}C:\program files\air mouse\air mouse\air mouse.exe" = protocol=17 | dir=in | app=c:\program files\air mouse\air mouse\air mouse.exe |
"UDP Query User{2985F139-50BC-4546-AD49-AF7E9E2AA14D}C:\program files\aim6\aim6.exe" = protocol=17 | dir=in | app=c:\program files\aim6\aim6.exe |
"UDP Query User{51D011FD-57EE-4434-832F-FBB86C428091}C:\program files\secondlife\slvoice.exe" = protocol=17 | dir=in | app=c:\program files\secondlife\slvoice.exe |
"UDP Query User{572F2711-55F1-4CAB-A7FD-FFB2044093E2}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{65D7BD17-6431-4B85-A572-F334EC552893}C:\program files\realvnc\vnc4\winvnc4.exe" = protocol=17 | dir=in | app=c:\program files\realvnc\vnc4\winvnc4.exe |
"UDP Query User{68379C51-656A-4008-A96C-718431FCF9E9}C:\program files\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"UDP Query User{78834F5B-A204-414C-879B-BFC70AB66010}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{85046B0D-4ED2-415C-9E96-BA609DB1C41D}C:\program files\itunes\itunes.exe" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"UDP Query User{879E1935-A25F-448B-B3A2-26FE6B31A1D5}C:\program files\participatory culture foundation\miro\miro_downloader.exe" = protocol=17 | dir=in | app=c:\program files\participatory culture foundation\miro\miro_downloader.exe |
"UDP Query User{A830088C-7BDE-40C4-B95F-2BA0FCAA2723}C:\users\user\desktop\left.4.dead.full-rip.skullptura\left.4.dead.full-rip.skullptura\left 4 dead\left4dead.exe" = protocol=17 | dir=in | app=c:\users\user\desktop\left.4.dead.full-rip.skullptura\left.4.dead.full-rip.skullptura\left 4 dead\left4dead.exe |
"UDP Query User{AE7A67B9-2047-4FCB-AFF6-054B82386AAD}C:\users\user\desktop\left.4.dead.full-rip.skullptura\left.4.dead.full-rip.skullptura\left 4 dead\left4dead.exe" = protocol=17 | dir=in | app=c:\users\user\desktop\left.4.dead.full-rip.skullptura\left.4.dead.full-rip.skullptura\left 4 dead\left4dead.exe |
"UDP Query User{B13D255A-E28E-4331-BE92-2E936881CF3E}C:\program files\sorenson media\sorenson squeeze 6\squeeze.exe" = protocol=17 | dir=in | app=c:\program files\sorenson media\sorenson squeeze 6\squeeze.exe |
"UDP Query User{BC0FF2FA-0AFC-4937-9C56-DBBDC28F8BB3}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{BD5A4C52-79BB-408D-B7A4-185D17AB6751}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"UDP Query User{CD099112-E11D-4F18-945C-A752C6F2840C}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"UDP Query User{D409446A-2E9D-43F7-BCF0-BC5B911B22F2}C:\program files\adobe\adobe after effects cs3\support files\afterfx.exe" = protocol=17 | dir=in | app=c:\program files\adobe\adobe after effects cs3\support files\afterfx.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{004685F7-9FB6-4789-812F-59ABB34A55AF}" = Adobe Setup
"{0046FA01-C5B9-4985-BACB-398DC480FC05}" = Adobe Photoshop CS3
"{0224CACC-994D-45F8-B973-D65056EA9C2F}" = Adobe XMP DVA Panels CS3
"{0327FA9D-975C-448C-A086-577D57BB25B8}" = Adobe Soundbooth CS3 Codecs
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}" = Roxio Creator EasyArchive
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{193EAFD0-1BAF-4FB4-B18F-79D5D6A4B285}" = Adobe After Effects CS3 Presets
"{1D58229F-C505-45CA-8223-F35F3A34B963}" = Adobe Version Cue CS3 Server {ko_KR}
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{228C6B46-64E2-404E-898A-EF0830603EF4}" = HPNetworkAssistant
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{237CD223-1B9D-47E8-A76C-E478B83CCEA2}" = File Uploader
"{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2
"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check for Health Check
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18
"{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1" = ConvertHelper 2.2
"{290B83AA-093A-45BF-A917-D1C4A1E8D917}" = HP Active Support Library
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (SONY_MEDIAMGR2)
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{2EFFFC71-1E66-454E-A6E6-CEEC800B96D2}" = Adobe Flash Video Encoder
"{33C65B6A-5D73-4E3E-A1F9-127C27BD3F72}" = Roxio MyDVD Basic v9
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.20 G2
"{350FB27C-CF62-4EF3-AF9D-70FF313FE221}" = iTunes
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Roxio Activation Module
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{40F7AED3-0C7D-4582-99F6-484A515C73F2}" = HP Easy Setup - Frontend
"{4458C442-7376-4CF9-AF58-E8CEA6722363}" = Adobe Setup
"{449801F1-65B0-46F5-B4C5-1EF464EF7214}" = Mobile Mouse Server
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP DVD Play 3.2
"{485ACF57-F364-440A-8496-E1E81C8FA1AA}" = Adobe Premiere Pro CS3 Third Party Content
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50F102CA-4BE2-41A9-9810-5BB05EB91B9A}" = Adobe Premiere Pro CS3 Functional Content
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{531BC138-F1F7-496B-879C-F039ECEF438D}" = Adobe Photoshop Lightroom 2
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{54B2EAD9-A110-43F7-B010-2859A1BD2AFE}" = Adobe Encore CS3
"{54F7A791-38DE-4439-AB3F-B3F7DDA89C75}" = ESU for Microsoft Vista
"{56B4002F-671C-49F4-984C-C760FE3806B5}" = Microsoft SQL Server VSS Writer
"{584B0895-8EF3-4175-8E80-1B68BFA04636}" = HP Help and Support
"{58DCEEE5-532E-44F4-B1D7-A146EF9E9FDA}" = Adobe Premiere Pro CS3
"{5A3F6A80-7913-475E-8B96-477A952CFA43}" = SupportSoft Assisted Service
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{621FCD24-4498-4324-A81E-07D331376EDF}" = PixiePack Codec Pack
"{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check
"{66C1DD9B-02D8-4A31-B54C-FE8DC76F25D4}" = HP User Guides 0078
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6B52140A-F189-4945-BFFC-DB3F00B8C589}" = Adobe Flash CS3
"{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files
"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash
"{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7ACFB90E-8FD0-4397-AD3A-5195412623A3}" = Adobe Help Viewer CS3
"{7C10F5C7-F00F-4BD3-A110-C7D240D2DD25}" = Adobe Dreamweaver CS3
"{7DFC1012-D346-46CE-B03E-FF79125AE029}" = Adobe Fireworks CS3
"{7ECEF10B-F1C2-4FD5-861F-A3FCB4653304}" = Adobe After Effects CS3 Third Party Content
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{845A8DB9-8802-4FD3-9FE3-938A6C46A2EC}" = Adobe Video Profiles
"{8718DC03-D066-4957-94E5-50C3C5042E8E}" = Adobe Creative Suite 3
October 15th, 2010, 09:07 AM
704_Skate

OTL Extras3(final):

Master Collection
"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}_WebDesigner_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}_WebDesigner_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}_WebDesigner_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0026-0000-0000-0000000FF1CE}" = Microsoft Expression Web
"{90120000-0026-0000-0000-0000000FF1CE}_WebDesigner_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0026-0000-0000-0000000FF1CE}_WebDesigner_{9037FDA8-8383-4B6F-859D-D49C3C625225}" = Microsoft Expression Web Service Pack 1 (SP1)
"{90120000-0026-0409-0000-0000000FF1CE}" = Microsoft Expression Web MUI (English)
"{90120000-0026-0409-0000-0000000FF1CE}_WebDesigner_{E1044ED2-E4AD-4B39-B500-31109750F6B4}" = Microsoft Office SharePoint Designer 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}_WebDesigner_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}_WebDesigner_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Touch Pad Driver
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A6B23EFA-6590-482C-A11F-5ACE1B91F5B9}" = Adobe Soundbooth CS3
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB40272D-92AB-4F30-B36B-22EDE16F8FE5}" = HP Update
"{AB5E289E-76BF-4251-9F3F-9B763F681AE0}" = HP Customer Experience Enhancements
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-1033-0000-7760-000000000003}" = Adobe Acrobat 8 Professional
"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.5
"{AC76BA86-7AD7-1033-7B44-A81300000003}_814" = KB408682
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{AE46ABD3-D625-467F-B5A7-8D3FFF077F0D}" = Realtek 8139 and 8139C+ Ethernet Network Card Driver for Windows Vista
"{AFAC914D-9E83-4A89-8ABE-427521C82CCF}" = Safari
"{B338EA45-9F18-4FE4-A079-89668D1F6519}" = USB 2.4G Wireless Keyboard Driver
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup
"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}" = Adobe BridgeTalk Plugin CS3
"{B8B7A4D8-80E1-4DAE-BD33-7FD535BA3931}" = Adobe Encore CS3 Codecs
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BD68F46D-8A82-4664-8E68-F87C55BDEFD4}" = Microsoft SQL Server Native Client
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{C1FCDCA1-2759-4E5E-84EE-3A665BB2F513}" = iPhoneBrowser
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Basic v9
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CB3F8375-B600-4B9F-83C9-238ED1E583FD}" = Adobe InDesign CS3
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{D32067CD-7409-4792-BFA0-1469BCD8F0C8}" = HP Wireless Assistant
"{D5A31AB1-345D-47C7-A87B-036A669F6DF1}" = Adobe XMP Panels CS3
"{D8E363A7-88B7-446D-B2C0-E26CE4DC8E54}" = U3Launcher
"{D9B4D7EE-481C-4C36-86AB-A8F7417725FF}" = LightScribe 1.6.43.1
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer
"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler
"{EB0202F7-016A-410C-ADE4-40F848CCC661}" = Adobe After Effects CS3
"{EB7A2041-6A16-4BAC-8079-43B985673C2C}" = Avery Wizard 3.1
"{EB900AF8-CC61-4E15-871B-98D1EA3E8025}" = QuickTime
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F08E8D2E-F132-4742-9C87-D5FF223A016A}" = Adobe Illustrator CS3
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F6B29003-A078-4491-AFBE-62EFB6CFFE19}" = HP Total Care Advisor
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F7F3B252-E772-48AA-93EB-7964BC326067}" = MSCU for Microsoft Vista
"{FAB0C302-CB18-4A7A-BA03-C3DC23101A68}" = HP Active Support Library 32 bit components
"{FC9E08AA-CD59-4C59-BEF9-87E05B9E37D7}" = Adobe Contribute CS3
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"7-Zip" = 7-Zip 4.57
"Adobe Acrobat 8 Professional" = Adobe Acrobat 8.1.5 Professional
"Adobe Acrobat 8 Professional_815" = Adobe Acrobat 8.1.5 - CPSID_49013
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe_3675c95c239b992d5d0ee8fce969b9e" = Adobe After Effects CS3 Third Party Content
"Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
"Adobe_4dcfd9b7e901b57f81f667144603236" = Add or Remove Adobe Creative Suite 3 Master Collection
"Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
"avast5" = avast! Free Antivirus
"AviSynth" = AviSynth 2.5
"Capture NX 2" = Capture NX 2
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_5045_SprtHDzm" = HDAUDIO Soft Data Fax Modem with SmartCP
"Cycore FX 1.0.1 for After Effects" = Cycore FX 1.0.1 for After Effects
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EPSON Stylus NX400 Series" = EPSON Stylus NX400 Series Printer Uninstall
"ffdshow_is1" = ffdshow [rev 2033] [2008-07-05]
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"InstallShield_{EB7A2041-6A16-4BAC-8079-43B985673C2C}" = Avery Wizard 3.1
"KeyTweak" = KeyTweak - Keyboard Remapper (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Miro" = Miro
"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)
"MyDefrag v4.2.7_is1" = MyDefrag v4.2.7
"Opanda IExif_is1" = Opanda IExif 2.3
"Photomatix Pro_is1" = Photomatix Pro version 2.5
"Registry First Aid_is1" = Registry First Aid
"SpeedFan" = SpeedFan (remove only)
"Trapcode Form" = Trapcode Form
"Trapcode Particular v2" = Trapcode Particular v2
"uTorrent" = µTorrent
"Videora iPod touch Converter" = Videora iPod touch Converter 5.03
"WebDesigner" = Microsoft Expression Web
"WinLiveSuite_Wave3" = Windows Live Essentials
"winscp3_is1" = WinSCP 4.2.8

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 2/1/2010 4:31:54 PM | Computer Name = ASK | Source = avast! | ID = 33554522
Description =

Error - 2/1/2010 4:31:54 PM | Computer Name = ASK | Source = avast! | ID = 33554522
Description =

Error - 2/1/2010 4:32:14 PM | Computer Name = ASK | Source = avast! | ID = 33554522
Description =

Error - 2/1/2010 4:32:45 PM | Computer Name = ASK | Source = avast! | ID = 33554522
Description =

Error - 2/1/2010 4:32:45 PM | Computer Name = ASK | Source = avast! | ID = 33554522
Description =

Error - 2/1/2010 4:32:46 PM | Computer Name = ASK | Source = avast! | ID = 33554522
Description =

Error - 2/1/2010 8:24:18 PM | Computer Name = ASK | Source = avast! | ID = 33554522
Description =

Error - 2/1/2010 8:24:18 PM | Computer Name = ASK | Source = avast! | ID = 33554522
Description =

Error - 2/1/2010 8:24:21 PM | Computer Name = ASK | Source = avast! | ID = 33554522
Description =

Error - 8/27/2010 1:38:03 PM | Computer Name = ASK | Source = avast! | ID = 33554522
Description =

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >
October 15th, 2010, 12:26 PM
Broni
Your CPU usage looks perfect.
System Idle Process (CPU NOT used) is listed at 99.92%, so I'm not sure, where you see explorer using 50%....hmmmmm.

================================================================

Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder
- Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
- Accept any prompts.
==============================================================

Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  Code:
  
  :OTL SRV - File not found [Disabled | Stopped] -- -- (gupdate) Google Update Service (gupdate) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\EagleNT.sys -- (EagleNT) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found [1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ] @Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:CB0AACC9 @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:888AFB86 :Services :Reg :Files C:\Program Files\Ask.com :Commands [purity] [emptytemp] [emptyflash] [Reboot]
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- You will get a log that shows the results of the fix. Please post it.
================================================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.
- Double-click SecurityCheck.exe
- Follow the onscreen instructions inside of the black box.
- A Notepad document should open automatically called checkup.txt; please post the contents of that document.
2. Download Temp File Cleaner (TFC)
- Double click on TFC.exe to run the program.
- Click on Start button to begin cleaning process.
- TFC will close all running programs, and it may ask you to restart computer.
3. Please run a free online scan with the ESET Online Scanner
- Disable your antivirus program
- Tick the box next to YES, I accept the Terms of Use
- Click Start
- IMPORTANT! UN-check Remove found threats
- Accept any security warnings from your browser.
- Check Scan archives
- Click Start
- ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
- When the scan completes, push List of found threats
- Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
- NOTE. If Eset won't find any threats, it won't produce any log.
October 15th, 2010, 12:56 PM
704_Skate

Yeah, forgot to mention that it's really random. It won't run the whole time at %50, certain things trigger it, for instance, the last few times it's happened, it's been Windows Media player starting it. I can close WMP and explorer will still be running at %50 until I either restart explorer.exe or restart my computer. Next time it happens, I'll get a log from that Process program.!

But I will get on all these scans asap. Thank you for your time (:
October 15th, 2010, 12:58 PM
Broni

If you can catch explorer using a lot of CPU, use Process Explorer to catch the moment and post the log.
October 15th, 2010, 01:34 PM
704_Skate

I'll have the online scan in a bit. For now, here's the OTL:

All processes killed
========== OTL ==========
Error: No service named gupdate) Google Update Service (gupdate was found to stop!
Service\Driver key gupdate) Google Update Service (gupdate not found.
Service EagleNT stopped successfully!
Service EagleNT deleted successfully!
File C:\Windows\System32\drivers\EagleNT.sys not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
C:\Program Files\Ask.com\GenericAskToolbar.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\Windows\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
C:\Windows\System32\drivers\SETBF9A.tmp deleted successfully.
ADS C:\ProgramData\TEMP:CB0AACC9 deleted successfully.
ADS C:\ProgramData\TEMP:888AFB86 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Program Files\Ask.com folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 41044 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Mcx1
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Mcx2
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 81920 bytes
->Java cache emptied: 4292918 bytes
->FireFox cache emptied: 115637475 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 51275 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 302 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 115.00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Mcx1

User: Mcx2

User: Public

User: User
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.15.2 log created on 10152010_131136

Files\Folders moved on Reboot...
File\Folder C:\Windows\temp\_avast5_\Webshlock.txt not found!

Registry entries deleted on Reboot...
October 15th, 2010, 01:36 PM
704_Skate

And the SecurityCheck

Results of screen317's Security Check version 0.99.5
Windows Vista Service Pack 2 (UAC is disabled!)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Free Antivirus
Adobe After Effects CS3 Presets
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 22
Out of date Java installed!
Adobe Flash Player 10.1.85.3
Adobe Reader 8.1.5
Out of date Adobe Reader installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Alwil Software Avast5 AvastSvc.exe
Alwil Software Avast5 AvastUI.exe
````````````````````````````````
DNS Vulnerability Check:
Unknown. This method cannot test your vulnerability to DNS cache poisoning. (Wireless connection?)

``````````End of Log````````````
October 15th, 2010, 01:46 PM
Broni

Update Adobe Reader

You can download it from http://www.adobe.com/products/acrobat/readstep2.html
After installing the latest Adobe Reader, uninstall all previous versions.
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or other garbage.
On this page:

https://discussions.virtualdr.com/im.../2011/05/2.png

make sure, you have both boxes UN-checked AND (important!) click on Decline button
October 16th, 2010, 08:29 PM
704_Skate

OK, I never ended up finishing the full scan from that website, it was on 3 hours and just half way. I needed my internet at the time, but nothing came up in those 3 hours.

I updated my flash.

Since yesterday, I haven't noticed explorer running up again. It's seem to be fine for the time being. Although, I won't let my guard down just yet.

Also, I'm behind on windows updates, would that matter anyhow?
October 16th, 2010, 11:32 PM
Broni

I'll post last steps instructions as soon, as I see Eset scan results.
October 17th, 2010, 02:11 PM
704_Skate

Ok, I finished the Eset scan. It didn't give me a log as it didn't catch any viruses.
October 17th, 2010, 02:16 PM
Broni
Your computer is clean https://discussions.virtualdr.com/

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following:
Code:

:OTL :Commands [purity] [emptytemp] [EMPTYFLASH] [CLEARALLRESTOREPOINTS] [Reboot]
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Post resulting log.
2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:
- Double-click OTL.exe to start the program.
- Close all other programs apart from OTL as this step will require a reboot
- On the OTL main screen, press the CLEANUP button
- Say Yes to the prompt and then allow the program to reboot your computer.
If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. Run defrag at your convenience.

11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

12. Please, let me know, how is your computer doing.
October 18th, 2010, 10:26 AM
704_Skate

Log for step 1:(will post back after OTL cleanup since it will reboot)

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Mcx1
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Mcx2
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 68919 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 48997114 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 1166 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 47.00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Mcx1

User: Mcx2

User: Public

User: User
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.15.2 log created on 10182010_101152

Files\Folders moved on Reboot...
File\Folder C:\Windows\temp\_avast5_\Webshlock.txt not found!

Registry entries deleted on Reboot...
October 18th, 2010, 10:57 AM
704_Skate

Ok, well everything seems good. Haven't had any problems or anything. I will run threw everything else on this list throughout the day!

THANK you so much for your help(:
October 18th, 2010, 04:38 PM
Broni

Way to go!! https://discussions.virtualdr.com/
Good luck and stay safe :)

All times are GMT -4. The time now is 02:11 AM.