AV Security Suite

Help AV Security Suite does not even let me open OTL.exe telling me "Application cannot be executed. The file otl.exe is effected. Do you want to activate your antivirus software now?" I tried opening the tast manager but it close that too. What can I do?

Hi, Welcome to GeekPolice.net!

Please download OTL to your Desktop. (If you already have it downloaded, then just follow the instructions below).

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• Under the Custom Scan box paste this in
  
  %systemroot%\*. /mp /s
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\system32\*.exe /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %systemroot%\System32\config\*.sav
  %systemroot%\system32\*.sys
  %systemroot%\system32\drivers\*.dll
  %systemroot%\system32\drivers\*.ini
  %systemroot%\system32\drivers\*.exe
  %SYSTEMDRIVE%\*.*
  %PROGRAMFILES%\*.
  %appdata%\*.*
  netsvcs
  msconfig
  safebootminimal
  safebootnetwork
  activex
  drivers32
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  ahcix86.sys
  KR10N.sys
  disk.sys
  nvstor32.sys
  ahcix86s.sys
  nvrd32.sys
  symmpi.sys
  adp3132.sys
  mv61xx.sys
  usbstor.sys
  /md5stop
  CREATERESTOREPOINT
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) and paste (Edit->Paste) the contents of these files, one at a time

Note: in the event that OTL fails to run, please use alternate download links to try again:

http://oldtimer.geekstogo.com/OTL.com
http://oldtimer.geekstogo.com/OTL.scr

I tried running all three different OTL and there were are closed the sameway.

Hi,

Please run these until it works:

1. http://www.xdelbox.com/down/SuperRKill.exe

2. http://www.xdelbox.com/down/SuperRKill.com

3. http://www.xdelbox.com/down/SuperRKill.pif

4. http://www.xdelbox.com/down/SuperRKill.scr

=========

After it has worked, please try OTL.

OTL logfile created on: 7/6/2010 9:39:43 AM - Run 1
OTL by OldTimer - Version 3.2.7.1 Folder = C:\Documents and Settings\Jinn\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 544.00 Mb Available Physical Memory | 53.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 73.00 Gb Total Space | 8.72 Gb Free Space | 11.94% Space Free | Partition Type: NTFS
Drive D: | 3.68 Gb Total Space | 1.78 Gb Free Space | 48.36% Space Free | Partition Type: FAT32
Drive E: | 480.69 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
Drive G: | 145.16 Gb Total Space | 21.85 Gb Free Space | 15.05% Space Free | Partition Type: NTFS
Drive H: | 3.87 Gb Total Space | 0.61 Gb Free Space | 15.75% Space Free | Partition Type: FAT32
Drive I: | 4.18 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive J: | 527.28 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: YOUR-E1CC41FE2B
Current User Name: Jinn
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/07/06 08:45:02 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jinn\Desktop\OTL (1).scr
PRC - [2010/06/26 23:42:00 | 000,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/04/20 09:17:40 | 000,267,432 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2010/03/02 10:28:31 | 000,282,792 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010/02/24 09:28:09 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2010/01/14 21:11:00 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009/10/08 11:31:44 | 000,112,592 | ---- | M] (Threat Expert Ltd.) -- C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
PRC - [2009/06/19 12:30:14 | 000,467,240 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Pure Networks\Network Magic\nmapp.exe
PRC - [2009/05/27 03:27:04 | 029,262,680 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
PRC - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2008/12/12 18:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
PRC - [2008/12/12 18:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
PRC - [2008/11/24 22:31:08 | 000,239,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
PRC - [2008/09/30 13:48:28 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
PRC - [2008/07/17 05:20:34 | 000,490,952 | ---- | M] (DT Soft Ltd) -- C:\Program Files\DAEMON Tools Lite\daemon.exe
PRC - [2008/07/14 11:48:13 | 000,611,664 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
PRC - [2008/07/13 18:37:05 | 000,172,032 | ---- | M] (New Boundary Technologies, Inc.) -- C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
PRC - [2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/05/28 09:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) -- C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
PRC - [2004/04/07 12:07:32 | 001,135,728 | ---- | M] (America Online, Inc.) -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe


========== Modules (SafeList) ==========

MOD - [2010/07/06 08:45:02 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jinn\Desktop\OTL (1).scr
MOD - [2008/04/13 17:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
MOD - [2008/01/08 14:01:16 | 000,504,916 | ---- | M] (Stardock Corporation) -- C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll
MOD - [2007/07/11 14:06:58 | 000,028,740 | ---- | M] (Stardock.Net, Inc) -- C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/04/20 09:17:40 | 000,267,432 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010/02/24 09:28:09 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2009/10/29 02:02:00 | 003,407,292 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\WINDOWS\System32\GameMon.des -- (npggsvc)
SRV - [2009/10/08 11:31:44 | 000,112,592 | ---- | M] (Threat Expert Ltd.) [Auto | Running] -- C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe -- (Browser Defender Update Service)
SRV - [2009/08/05 22:48:42 | 000,704,864 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2009/05/27 03:27:04 | 029,262,680 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ)
SRV - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2008/12/12 18:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)
SRV - [2008/11/24 22:31:12 | 000,087,904 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
SRV - [2008/11/24 22:31:08 | 000,239,968 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser)
SRV - [2008/11/24 22:31:08 | 000,045,408 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper)
SRV - [2008/11/19 10:47:24 | 000,109,056 | ---- | M] (ArcSoft Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2008/09/30 13:48:28 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2008/07/14 11:48:13 | 000,611,664 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe -- (aawservice)
SRV - [2008/07/13 18:37:05 | 000,172,032 | ---- | M] (New Boundary Technologies, Inc.) [Auto | Running] -- C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS -- (PrismXL)
SRV - [2007/05/28 09:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2007/03/28 18:41:56 | 000,206,552 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe -- (SNDSrvc)
SRV - [2007/01/04 14:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) [Auto | Stopped] -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service)
SRV - [2004/04/07 12:07:32 | 001,135,728 | ---- | M] (America Online, Inc.) [Auto | Running] -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe -- (AOL ACS)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\sunkfiltp.sys -- (Sunkfiltp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\softnyx\GunboundWC\GameGuard\dump_wmimmc.sys -- (dump_wmimmc)
DRV - [2010/03/01 09:05:24 | 000,124,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2010/02/16 13:24:01 | 000,060,936 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009/09/23 16:10:06 | 000,207,280 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\PCTCore.sys -- (PCTCore)
DRV - [2009/08/05 22:48:42 | 000,054,752 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr)
DRV - [2009/07/16 03:06:33 | 000,229,224 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\VMM.sys -- (vmm)
DRV - [2009/05/11 11:49:19 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009/05/11 09:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/04/19 16:45:19 | 000,002,368 | ---- | M] (AntiCracking) [Kernel | Auto | Running] -- C:\WINDOWS\system32\STEC3.sys -- (STEC3)
DRV - [2009/04/06 13:19:46 | 000,023,064 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ScreamingBAudio.sys -- (SCREAMINGBDRIVER)
DRV - [2009/02/08 19:19:58 | 000,324,096 | ---- | M] (ShiningMorning Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mcdevice.sys -- (mcdevice)
DRV - [2008/12/12 18:05:20 | 000,025,264 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\purendis.sys -- (purendis)
DRV - [2008/12/12 18:05:18 | 000,023,984 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\pnarp.sys -- (pnarp)
DRV - [2008/09/08 13:04:46 | 000,093,232 | ---- | M] (PACE Anti-Piracy, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\TPkd.sys -- (TPkd)
DRV - [2008/07/18 16:35:09 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2008/04/29 11:20:00 | 000,015,648 | ---- | M] (Lavasoft AB) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NSDriver.sys -- (Ad-Watch Connect Filter)
DRV - [2008/04/13 12:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/04/13 11:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/13 11:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2008/02/05 01:50:44 | 000,059,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VMNetSrv.sys -- (VPCNetS2)
DRV - [2007/04/19 12:26:00 | 003,988,384 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2007/04/10 14:46:53 | 001,966,312 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VX1000.sys -- (VX1000)
DRV - [2007/03/28 18:41:26 | 000,266,552 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)
DRV - [2007/03/28 18:41:24 | 000,018,904 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)
DRV - [2007/03/28 18:41:20 | 000,037,016 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\SYMIDS.SYS -- (SYMIDS)
DRV - [2007/03/28 18:41:18 | 000,047,192 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\SYMNDIS.SYS -- (SYMNDIS)
DRV - [2007/03/28 18:41:14 | 000,171,928 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\SYMFW.SYS -- (SYMFW)
DRV - [2007/03/28 18:41:12 | 000,011,480 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\SYMDNS.SYS -- (SYMDNS)
DRV - [2006/09/15 22:52:12 | 000,124,016 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Symantec\SYMEVENT.SYS -- (SymEvent)
DRV - [2005/01/01 02:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\npptNT2.sys -- (NPPTNT2)
DRV - [2004/10/27 14:57:38 | 002,284,864 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2004/10/20 11:39:32 | 000,040,724 | ---- | M] (Alcor Micro Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Sunkfilt.sys -- (SunkFilt)
DRV - [2004/10/18 14:05:12 | 000,042,968 | ---- | M] (Alcor Micro Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Sunkfilt39.sys -- (SunkFilt39)
DRV - [2004/08/04 12:00:00 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\fsvga.sys -- (FsVga)
DRV - [2004/06/17 15:56:22 | 000,220,032 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2004/06/17 15:55:38 | 000,685,056 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2004/06/17 15:55:04 | 001,041,536 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2003/01/10 16:13:04 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2001/08/17 21:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/17 21:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/17 21:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/17 21:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/17 21:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/17 20:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/17 20:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/17 20:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/17 20:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/17 20:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/17 20:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/17 20:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/17 20:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/17 20:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 20:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)
DRV - [2001/08/17 13:49:32 | 000,019,968 | ---- | M] (Macronix International Co., Ltd. ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mxnic.sys -- (mxnic)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5577

========== FireFox ==========

FF - prefs.js..browser.search.defaultthis.engineName: "Evony Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2269219&SearchSource=3&q={searchTerms}"
FF - prefs.js..extensions.enabledItems: {94000a61-af9a-4247-8db6-a949fadb0354}:2.5.6.0
FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: mozilla_cc@internetdownloadmanager.com:6.9.1
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:7
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 4
FF - prefs.js..extensions.enabledItems: 9
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: {85E85FF9-E50C-42DE-8A3D-61485FD6C8DB}:1.4
FF - prefs.js..network.proxy.type: 2

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/06/26 23:42:08 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/04 06:49:57 | 000,000,000 | ---D | M]

[2008/07/16 16:13:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jinn\Application Data\Mozilla\Extensions
[2010/07/04 00:01:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jinn\Application Data\Mozilla\Firefox\Profiles\febeprof.Jinn\extensions
[2010/05/10 00:46:02 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Jinn\Application Data\Mozilla\Firefox\Profiles\febeprof.Jinn\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/05/09 16:11:15 | 000,000,000 | ---D | M] (FEBE) -- C:\Documents and Settings\Jinn\Application Data\Mozilla\Firefox\Profiles\febeprof.Jinn\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2010/05/09 16:11:13 | 000,000,000 | ---D | M] (myBabylon English Toolbar) -- C:\Documents and Settings\Jinn\Application Data\Mozilla\Firefox\Profiles\febeprof.Jinn\extensions\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}
[2010/05/09 16:11:10 | 000,000,000 | ---D | M] (Easy Youtube Video Downloader) -- C:\Documents and Settings\Jinn\Application Data\Mozilla\Firefox\Profiles\febeprof.Jinn\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}
[2010/05/09 16:11:17 | 000,000,000 | ---D | M] (MP3 es Toolbar) -- C:\Documents and Settings\Jinn\Application Data\Mozilla\Firefox\Profiles\febeprof.Jinn\extensions\{f6f53201-ac60-4790-b385-405df25c4335}
[2010/05/09 16:11:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jinn\Application Data\Mozilla\Firefox\Profiles\febeprof.Jinn\extensions\toolbar@ask.com
[2010/05/09 15:57:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jinn\Application Data\Mozilla\Firefox\Profiles\kfufytkp.default\extensions
[2010/05/03 13:50:10 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Jinn\Application Data\Mozilla\Firefox\Profiles\kfufytkp.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/05/09 15:57:26 | 000,000,000 | ---D | M] (FEBE) -- C:\Documents and Settings\Jinn\Application Data\Mozilla\Firefox\Profiles\kfufytkp.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2010/05/03 13:49:37 | 000,000,000 | ---D | M] (Evony Toolbar) -- C:\Documents and Settings\Jinn\Application Data\Mozilla\Firefox\Profiles\kfufytkp.default\extensions\{94000a61-af9a-4247-8db6-a949fadb0354}
[2010/05/03 13:49:58 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Documents and Settings\Jinn\Application Data\Mozilla\Firefox\Profiles\kfufytkp.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2009/11/14 20:51:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Jinn\Application Data\Mozilla\Firefox\Profiles\kfufytkp.default\extensions\firefox@tvunetworks.com
[2009/09/01 12:34:22 | 000,000,872 | ---- | M] () -- C:\Documents and Settings\Jinn\Application Data\Mozilla\Firefox\Profiles\kfufytkp.default\searchplugins\conduit.xml
[2010/07/04 00:01:30 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009/02/25 00:48:43 | 000,000,000 | ---D | M] (VideoGet FireFox extension) -- C:\Program Files\Mozilla Firefox\extensions\{85E85FF9-E50C-42DE-8A3D-61485FD6C8DB}
[2008/11/18 06:04:58 | 000,189,952 | ---- | M] ((주) 그래텍) -- C:\Program Files\Mozilla Firefox\plugins\NPGomtvx_nie.dll
[2007/04/16 10:07:12 | 000,180,293 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: ([2009/10/17 12:16:44 | 000,000,021 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (UrlHelper Class) - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\Program Files\iMesh Applications\iMesh MediaBar\iMeshIEHelper.dll ()
O2 - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [fssui] C:\Program Files\Windows Live\Family Safety\fsui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ikwwblhv] C:\Documents and Settings\Jinn\Local Settings\Application Data\dqcjiewen\efnaiwktssd.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [nmapp] C:\Program Files\Pure Networks\Network Magic\nmapp.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [VX1000] C:\WINDOWS\vVX1000.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Winwall] C:\Program Files\Winwall\Loader.exe File not found
O4 - HKCU..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe (Alcohol Soft Development Team)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
O4 - HKCU..\Run: [ikwwblhv] C:\Documents and Settings\Jinn\Local Settings\Application Data\dqcjiewen\efnaiwktssd.exe ()
O4 - HKCU..\Run: [Octoshape Streaming Services] C:\Documents and Settings\Jinn\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe (Octoshape ApS)
O4 - HKCU..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Add to VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\Program Files\Nuclear Coffee\VideoGet\Plugins\VideoGet_IE.dll (Nuclear Coffee Software)
O9 - Extra 'Tools' menuitem : Add to &VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\Program Files\Nuclear Coffee\VideoGet\Plugins\VideoGet_IE.dll (Nuclear Coffee Software)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Owner\Start Menu\Programs\IMVU\Run IMVU.lnk ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1216001525484 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8EEB54D5-CC70-40E4-B015-AC478C02ECC8} http://playple.com/viewer/cab/SLViewer.cab (SLViewer Control)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.94.156.1 68.94.157.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\WBSrv: DllName - C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll - C:\Program Files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll (Stardock Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Jinn\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Jinn\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/26 11:04:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2003/08/09 00:24:26 | 000,000,045 | -HS- | M] () - D:\Autorun.inf -- [ FAT32 ]
O32 - AutoRun File - [2003/05/18 11:54:20 | 000,061,440 | R--- | M] () - E:\autoplay.exe -- [ CDFS ]
O32 - AutoRun File - [2003/02/12 00:01:48 | 000,000,050 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2004/01/26 02:28:24 | 000,000,000 | ---- | M] () - G:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2001/07/27 14:07:38 | 000,000,000 | -HS- | M] () - H:\AUTOEXEC.BAT -- [ FAT32 ]
O32 - AutoRun File - [2002/09/10 11:02:32 | 000,000,045 | -HS- | M] () - H:\Autorun.inf -- [ FAT32 ]
O32 - AutoRun File - [2005/11/21 10:26:21 | 000,000,057 | R--- | M] () - I:\autorun.inf -- [ UDF ]
O32 - AutoRun File - [2003/08/18 09:32:35 | 000,000,053 | R--- | M] () - J:\Autorun.inf -- [ CDFS ]
O33 - MountPoints2\{2852cc0a-5db0-11dd-9c17-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{2852cc0a-5db0-11dd-9c17-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{2852cc0a-5db0-11dd-9c17-00038a000015}\Shell\AutoRun\command - "" = J:\.\CRESUST.EXE -- [2003/08/26 09:26:00 | 000,540,672 | R--- | M] ()
O33 - MountPoints2\{b6a084ce-bf0c-11dd-9ccc-00038a000015}\Shell\AutoRun\command - "" = K:\rcaeasyrip_setup.exe -- File not found
O33 - MountPoints2\{b6a084ce-bf0c-11dd-9ccc-00038a000015}\Shell\install\command - "" = K:\rcaeasyrip_setup.exe -- File not found
O33 - MountPoints2\{b6a084ce-bf0c-11dd-9ccc-00038a000015}\Shell\usermanualEnglish\command - "" = K:\rcaeasyrip_setup.exe -- File not found
O33 - MountPoints2\{b6a084ce-bf0c-11dd-9ccc-00038a000015}\Shell\usermanualFrench\command - "" = K:\rcaeasyrip_setup.exe -- File not found
O33 - MountPoints2\{b6a084ce-bf0c-11dd-9ccc-00038a000015}\Shell\usermanualSpanish\command - "" = K:\rcaeasyrip_setup.exe -- File not found
O33 - MountPoints2\{b6a50522-5522-11dd-956f-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{b6a50522-5522-11dd-956f-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b6a50522-5522-11dd-956f-00038a000015}\Shell\AutoRun\command - "" = I:\OblivionLauncher.exe -- [2006/02/27 07:15:50 | 001,662,976 | R--- | M] (Bethesda Softworks)
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\Info.exe -- [2002/09/10 05:54:58 | 000,040,960 | -HS- | M] (XSS)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found


SafeBootMin: aawservice - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SafeBootMin: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: aawservice - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SafeBootNet: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {05466845-FF44-4671-92C1-A5FD0F9EEE1C} - Microsoft Reader
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {D85BDA1A-983E-3C61-8F03-E5F9C394075C} - .NET Framework
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.divxa32 - C:\WINDOWS\System32\msaud32_divx.acm (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.ffds - C:\Program Files\Combined Community Codec Pack\Filters\FFDShow\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.VP60 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17465059307421696)

========== Files/Folders - Created Within 30 Days ==========

[2010/07/06 09:32:27 | 000,078,848 | ---- | C] (XDelBox.com) -- C:\Documents and Settings\Jinn\Desktop\SuperRKill.exe
[2010/07/06 08:44:46 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Jinn\Desktop\OTL (1).scr
[2010/07/06 08:40:52 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Jinn\Desktop\OTL.com
[2010/07/06 00:45:08 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Jinn\Desktop\OTL.exe
[2010/07/05 23:55:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jinn\Local Settings\Application Data\dqcjiewen
[2010/07/03 16:00:47 | 000,000,000 | ---D | C] -- C:\Program Files\OpenPandora
[2010/07/01 09:58:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Jinn\Local Settings\Application Data\Basketball
[2010/06/20 18:51:08 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DivX Shared
[2010/06/20 18:48:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\DivX
[2010/06/19 20:36:59 | 000,139,264 | ---- | C] (Blizzard Entertainment) -- C:\WINDOWS\War3Unin.exe
[2010/06/10 06:33:17 | 000,743,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/07/06 09:43:02 | 000,000,974 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-855283335-3023275888-2970118667-1007UA.job
[2010/07/06 09:33:24 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{DF8FCBF6-0405-4831-B39A-A74E0EECCFAD}.job
[2010/07/06 09:29:18 | 000,078,848 | ---- | M] (XDelBox.com) -- C:\Documents and Settings\Jinn\Desktop\SuperRKill.exe
[2010/07/06 09:14:23 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/07/06 09:14:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/07/06 09:14:12 | 1071,435,776 | -HS- | M] () -- C:\hiberfil.sys
[2010/07/06 08:45:02 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jinn\Desktop\OTL (1).scr
[2010/07/06 08:36:50 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jinn\Desktop\OTL.com
[2010/07/06 00:56:45 | 013,369,344 | -H-- | M] () -- C:\Documents and Settings\Jinn\NTUSER.DAT
[2010/07/06 00:56:22 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Jinn\ntuser.ini
[2010/07/06 00:43:08 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Jinn\Desktop\OTL.exe
[2010/07/05 23:00:30 | 002,644,752 | -H-- | M] () -- C:\Documents and Settings\Jinn\Local Settings\Application Data\IconCache.db
[2010/07/05 10:43:03 | 000,000,922 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-855283335-3023275888-2970118667-1007Core.job
[2010/07/04 21:22:54 | 000,000,023 | ---- | M] () -- C:\WINDOWS\BlendSettings.ini
[2010/07/03 23:41:05 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/07/03 16:00:49 | 000,001,596 | ---- | M] () -- C:\Documents and Settings\Jinn\Desktop\OpenPandora.lnk
[2010/07/01 16:22:42 | 000,064,000 | ---- | M] () -- C:\Documents and Settings\Jinn\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/01 09:03:05 | 000,000,610 | ---- | M] () -- C:\Documents and Settings\Jinn\Application Data\Microsoft\Internet Explorer\Quick Launch\Opera.lnk
[2010/06/29 07:58:14 | 265,638,312 | ---- | M] () -- C:\Documents and Settings\Jinn\Desktop\[UFW]_Kanojo_x_Kanojo_x_Kanojo_-_01_[XviD][3ACF747E].avi
[2010/06/25 21:17:07 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/06/24 12:59:37 | 000,047,126 | ---- | M] () -- C:\Documents and Settings\Jinn\My Documents\Playlist.asx
[2010/06/24 00:20:20 | 000,574,904 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/24 00:20:20 | 000,493,496 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/06/24 00:20:20 | 000,091,116 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/06/21 19:07:05 | 000,076,836 | ---- | M] () -- C:\WINDOWS\War3Unin.dat
[2010/06/21 19:03:53 | 000,002,829 | ---- | M] () -- C:\WINDOWS\War3Unin.pif
[2010/06/21 19:03:52 | 000,139,264 | ---- | M] (Blizzard Entertainment) -- C:\WINDOWS\War3Unin.exe
[2010/06/10 18:32:55 | 000,297,256 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/10 17:51:56 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/06/07 22:10:12 | 000,000,763 | ---- | M] () -- C:\WINDOWS\win.ini
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/03 16:00:49 | 000,001,596 | ---- | C] () -- C:\Documents and Settings\Jinn\Desktop\OpenPandora.lnk
[2010/06/29 07:48:56 | 265,638,312 | ---- | C] () -- C:\Documents and Settings\Jinn\Desktop\[UFW]_Kanojo_x_Kanojo_x_Kanojo_-_01_[XviD][3ACF747E].avi
[2010/06/19 20:37:01 | 000,076,836 | ---- | C] () -- C:\WINDOWS\War3Unin.dat
[2010/06/19 20:36:59 | 000,002,829 | ---- | C] () -- C:\WINDOWS\War3Unin.pif
[2009/11/19 00:22:04 | 000,000,114 | ---- | C] () -- C:\WINDOWS\cc.ini
[2009/10/16 22:51:48 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll
[2009/10/06 11:37:32 | 000,000,145 | ---- | C] () -- C:\WINDOWS\listen1.ini
[2009/09/22 11:05:24 | 000,000,170 | ---- | C] () -- C:\WINDOWS\settings.ini
[2009/09/22 11:05:23 | 000,009,279 | ---- | C] () -- C:\WINDOWS\AmvTransform.ini
[2009/09/22 11:05:23 | 000,008,157 | ---- | C] () -- C:\WINDOWS\AmvPlayer.ini
[2009/09/22 11:05:23 | 000,007,454 | ---- | C] () -- C:\WINDOWS\Disktool.INI
[2009/09/22 11:05:23 | 000,003,677 | ---- | C] () -- C:\WINDOWS\SoundCon.INI
[2009/09/22 11:05:22 | 000,008,913 | ---- | C] () -- C:\WINDOWS\fwupgrade.ini
[2009/09/12 22:05:09 | 000,000,057 | ---- | C] () -- C:\WINDOWS\sierra.ini
[2009/07/01 17:44:12 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2009/07/01 17:44:11 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2009/07/01 17:44:11 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2009/05/20 10:51:46 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\asr32311.dll
[2009/05/20 10:31:47 | 000,081,920 | ---- | C] () -- C:\WINDOWS\asr32311.dll
[2009/05/20 10:31:47 | 000,000,070 | ---- | C] () -- C:\WINDOWS\HGSpeech.ini
[2009/05/20 10:31:35 | 000,096,256 | ---- | C] () -- C:\WINDOWS\System32\Smackw32.dll
[2009/04/22 00:19:06 | 000,172,173 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
[2009/02/14 13:59:13 | 000,000,120 | ---- | C] () -- C:\WINDOWS\CIS_Setup_3.8.64263.468_XP_Vista_x32.INI
[2009/01/22 18:44:17 | 001,051,136 | ---- | C] () -- C:\WINDOWS\System32\drivers\CAMTHWDM.sys
[2009/01/20 16:41:01 | 000,015,498 | ---- | C] () -- C:\WINDOWS\VX1000.ini
[2009/01/14 16:21:11 | 000,000,145 | ---- | C] () -- C:\WINDOWS\game.INI
[2008/12/28 15:02:20 | 000,000,106 | ---- | C] () -- C:\WINDOWS\PhEdit.INI
[2008/12/28 14:58:25 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2008/12/13 16:12:27 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2008/12/06 23:09:34 | 000,000,031 | ---- | C] () -- C:\WINDOWS\msgtn.ini
[2008/12/04 02:44:49 | 000,000,204 | ---- | C] () -- C:\WINDOWS\struct~.ini
[2008/11/19 09:24:27 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008/11/16 22:48:14 | 000,004,767 | ---- | C] () -- C:\WINDOWS\Irremote.ini
[2008/09/15 17:14:24 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008/09/15 17:12:02 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2008/08/20 03:01:43 | 000,000,023 | ---- | C] () -- C:\WINDOWS\BlendSettings.ini
[2008/08/17 16:59:00 | 001,019,904 | R--- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2008/08/17 16:58:57 | 001,703,936 | R--- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2008/08/17 16:58:41 | 000,466,944 | R--- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008/08/17 16:58:39 | 001,474,560 | R--- | C] () -- C:\WINDOWS\System32\nview.dll
[2008/08/17 16:57:35 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2008/08/17 16:56:22 | 000,212,992 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2008/08/17 16:56:20 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2008/07/19 21:13:32 | 000,008,704 | ---- | C] () -- C:\WINDOWS\System32\CNMVS7J.DLL
[2008/07/18 16:35:08 | 000,717,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2008/07/15 18:59:32 | 000,000,037 | ---- | C] () -- C:\WINDOWS\ACTIVEJP.INI
[2008/07/13 18:49:32 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2008/07/13 18:28:16 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
[2006/09/13 04:06:10 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\gtapi.dll
[2004/09/16 13:26:40 | 000,012,634 | ---- | C] () -- C:\WINDOWS\System32\drivers\ADFUUD.SYS
[2004/09/16 13:26:40 | 000,012,634 | ---- | C] () -- C:\WINDOWS\ADFUUD.SYS
[2004/08/27 03:50:59 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004/08/26 09:12:43 | 000,001,314 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2004/08/26 09:12:43 | 000,000,487 | ---- | C] () -- C:\WINDOWS\System32\emver.ini

========== Custom Scans ==========


< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[6 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\*.exe /lockedfiles >
[6 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2008/07/18 16:35:09 | 000,717,296 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd.sys

< %systemroot%\System32\config\*.sav >
[2004/08/26 03:53:19 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2004/08/26 03:53:18 | 000,634,880 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2004/08/26 03:53:18 | 000,864,256 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.sys >
[2004/08/04 12:00:00 | 000,009,029 | ---- | M] () -- C:\WINDOWS\system32\ansi.sys
[2004/08/04 12:00:00 | 000,027,097 | ---- | M] () -- C:\WINDOWS\system32\country.sys
[2004/08/04 12:00:00 | 000,004,768 | ---- | M] () -- C:\WINDOWS\system32\himem.sys
[2004/08/04 12:00:00 | 000,042,809 | ---- | M] () -- C:\WINDOWS\system32\key01.sys
[2004/08/04 12:00:00 | 000,042,537 | ---- | M] () -- C:\WINDOWS\system32\keyboard.sys
[2005/01/01 02:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) -- C:\WINDOWS\system32\npptNT2.sys
[2004/08/04 12:00:00 | 000,027,866 | ---- | M] () -- C:\WINDOWS\system32\ntdos.sys
[2004/08/04 12:00:00 | 000,029,146 | ---- | M] () -- C:\WINDOWS\system32\ntdos404.sys
[2004/08/04 12:00:00 | 000,029,370 | ---- | M] () -- C:\WINDOWS\system32\ntdos411.sys
[2004/08/04 12:00:00 | 000,029,274 | ---- | M] () -- C:\WINDOWS\system32\ntdos412.sys
[2004/08/04 12:00:00 | 000,029,146 | ---- | M] () -- C:\WINDOWS\system32\ntdos804.sys
[2004/08/04 12:00:00 | 000,033,840 | ---- | M] () -- C:\WINDOWS\system32\ntio.sys
[2004/08/04 12:00:00 | 000,034,560 | ---- | M] () -- C:\WINDOWS\system32\ntio404.sys
[2004/08/04 12:00:00 | 000,035,648 | ---- | M] () -- C:\WINDOWS\system32\ntio411.sys
[2004/08/04 12:00:00 | 000,035,424 | ---- | M] () -- C:\WINDOWS\system32\ntio412.sys
[2004/08/04 12:00:00 | 000,034,560 | ---- | M] () -- C:\WINDOWS\system32\ntio804.sys
[2005/03/07 20:44:16 | 000,045,056 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) -- C:\WINDOWS\system32\PhDi2.sys
[2009/04/19 16:45:19 | 000,002,368 | ---- | M] (AntiCracking) -- C:\WINDOWS\system32\STEC3.sys
[2008/04/13 11:44:59 | 000,017,664 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\watchdog.sys
[2010/05/01 22:22:50 | 001,851,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\win32k.sys
[6 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\drivers\*.dll >
[2008/04/13 17:11:48 | 000,004,255 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv01nt5.dll
[2008/04/13 17:11:48 | 000,003,967 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv02nt5.dll
[2008/04/13 17:11:48 | 000,003,615 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv05nt5.dll
[2008/04/13 17:11:48 | 000,003,647 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv07nt5.dll
[2008/04/13 17:11:48 | 000,003,135 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv08nt5.dll
[2008/04/13 17:11:48 | 000,003,711 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv09nt5.dll
[2008/04/13 17:11:48 | 000,003,775 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv11nt5.dll
[2008/04/13 17:11:50 | 000,021,183 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv01nt5.dll
[2008/04/13 17:11:50 | 000,011,359 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv02nt5.dll
[2008/04/13 17:11:50 | 000,025,471 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv04nt5.dll
[2008/04/13 17:11:50 | 000,014,143 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv06nt5.dll
[2008/04/13 17:11:50 | 000,017,279 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv10nt5.dll
[2008/04/13 17:11:50 | 000,015,423 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\ch7xxnt5.dll
[2008/04/13 17:12:05 | 000,003,901 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\siint5.dll
[2008/04/13 17:12:08 | 000,011,325 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\vchnt5.dll

< %systemroot%\system32\drivers\*.ini >

< %systemroot%\system32\drivers\*.exe >

< %SYSTEMDRIVE%\*.* >
[2008/10/02 13:40:11 | 000,000,000 | ---- | M] () -- C:\AILog.txt
[2008/07/13 18:49:35 | 000,000,349 | ---- | M] () -- C:\aresult.txt
[2004/08/26 11:04:39 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2008/07/13 19:06:37 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2004/08/26 11:04:39 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2009/01/27 22:15:12 | 000,000,000 | ---- | M] () -- C:\fftoutput.txt
[2010/07/06 09:14:12 | 1071,435,776 | -HS- | M] () -- C:\hiberfil.sys
[2009/11/21 15:45:18 | 000,230,424 | ---- | M] () -- C:\img2-001.raw
[2009/06/18 20:39:01 | 000,230,424 | ---- | M] () -- C:\img2-002.raw
[2004/08/26 11:04:39 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009/06/13 13:08:29 | 000,001,946 | -H-- | M] () -- C:\IPH.PH
[2010/06/07 08:59:13 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt
[2004/08/26 11:04:39 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2004/08/04 12:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/07/14 11:03:06 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/07/06 09:14:10 | 805,306,368 | -HS- | M] () -- C:\pagefile.sys
[2008/08/17 18:52:53 | 004,842,629 | ---- | M] () -- C:\quiksave.ess
[2008/10/10 09:46:52 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
[2008/10/02 09:26:23 | 000,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
[2008/10/02 19:17:52 | 000,000,268 | -H-- | M] () -- C:\sqmdata02.sqm
[2008/10/03 08:43:22 | 000,000,268 | -H-- | M] () -- C:\sqmdata03.sqm
[2008/10/03 20:39:52 | 000,000,268 | -H-- | M] () -- C:\sqmdata04.sqm
[2008/10/04 10:14:38 | 000,000,268 | -H-- | M] () -- C:\sqmdata05.sqm
[2008/10/04 15:24:49 | 000,000,268 | -H-- | M] () -- C:\sqmdata06.sqm
[2008/10/04 21:15:35 | 000,000,268 | -H-- | M] () -- C:\sqmdata07.sqm
[2008/10/05 09:28:37 | 000,000,268 | -H-- | M] () -- C:\sqmdata08.sqm
[2008/10/05 14:47:10 | 000,000,268 | -H-- | M] () -- C:\sqmdata09.sqm
[2008/10/05 20:49:39 | 000,000,268 | -H-- | M] () -- C:\sqmdata10.sqm
[2008/10/06 09:41:43 | 000,000,268 | -H-- | M] () -- C:\sqmdata11.sqm
[2008/10/06 20:14:03 | 000,000,268 | -H-- | M] () -- C:\sqmdata12.sqm
[2008/10/06 21:49:42 | 000,000,268 | -H-- | M] () -- C:\sqmdata13.sqm
[2008/10/07 09:49:08 | 000,000,268 | -H-- | M] () -- C:\sqmdata14.sqm
[2008/10/07 21:19:00 | 000,000,268 | -H-- | M] () -- C:\sqmdata15.sqm
[2008/10/08 16:21:08 | 000,000,268 | -H-- | M] () -- C:\sqmdata16.sqm
[2008/10/08 21:06:37 | 000,000,268 | -H-- | M] () -- C:\sqmdata17.sqm
[2008/10/09 10:17:53 | 000,000,268 | -H-- | M] () -- C:\sqmdata18.sqm
[2008/10/09 21:43:44 | 000,000,268 | -H-- | M] () -- C:\sqmdata19.sqm
[2008/10/10 09:46:51 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
[2008/10/02 09:26:22 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
[2008/10/02 19:17:52 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt02.sqm
[2008/10/03 08:43:21 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt03.sqm
[2008/10/03 20:39:51 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt04.sqm
[2008/10/04 10:14:37 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt05.sqm
[2008/10/04 15:24:49 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt06.sqm
[2008/10/04 21:15:35 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt07.sqm
[2008/10/05 09:28:37 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt08.sqm
[2008/10/05 14:47:09 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt09.sqm
[2008/10/05 20:49:38 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt10.sqm
[2008/10/06 09:41:43 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt11.sqm
[2008/10/06 20:14:03 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt12.sqm
[2008/10/06 21:49:42 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt13.sqm
[2008/10/07 09:49:08 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt14.sqm
[2008/10/07 21:18:59 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt15.sqm
[2008/10/08 16:21:08 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt16.sqm
[2008/10/08 21:06:37 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt17.sqm
[2008/10/09 10:17:53 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt18.sqm
[2008/10/09 21:43:44 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt19.sqm
[2010/07/06 09:33:59 | 000,000,319 | ---- | M] () -- C:\SuperRKill.log
[2008/12/27 10:31:29 | 000,000,000 | ---- | M] () -- C:\testwma.raw
[2008/09/17 17:02:39 | 000,000,150 | ---- | M] () -- C:\YServer.txt

< %PROGRAMFILES%\*. >
[2010/02/25 16:20:42 | 000,000,000 | ---D | M] -- C:\Program Files\7-Zip
[2010/04/06 08:42:24 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2008/11/17 21:21:13 | 000,000,000 | ---D | M] -- C:\Program Files\Ahead
[2009/08/20 16:56:25 | 000,000,000 | ---D | M] -- C:\Program Files\Alarm Clock
[2009/03/23 18:01:30 | 000,000,000 | ---D | M] -- C:\Program Files\Alcohol Soft
[2008/07/23 19:56:35 | 000,000,000 | ---D | M] -- C:\Program Files\Alwil Software
[2008/07/13 18:49:03 | 000,000,000 | ---D | M] -- C:\Program Files\America Online 9.0
[2009/05/14 22:02:29 | 000,000,000 | ---D | M] -- C:\Program Files\Antares Audio Technologies
[2008/07/13 18:48:59 | 000,000,000 | ---D | M] -- C:\Program Files\AOL Companion
[2009/05/15 19:01:21 | 000,000,000 | ---D | M] -- C:\Program Files\AOL Toolbar
[2009/12/14 16:45:25 | 000,000,000 | ---D | M] -- C:\Program Files\Apple Software Update
[2009/02/16 20:16:49 | 000,000,000 | ---D | M] -- C:\Program Files\ArcSoft
[2009/04/28 22:13:49 | 000,000,000 | ---D | M] -- C:\Program Files\Avira
[2009/06/04 10:08:21 | 000,000,000 | ---D | M] -- C:\Program Files\Babylon
[2009/05/19 15:30:36 | 000,000,000 | ---D | M] -- C:\Program Files\Bethesda Softworks
[2010/02/07 12:08:08 | 000,000,000 | ---D | M] -- C:\Program Files\BigFix
[2010/04/07 15:51:47 | 000,000,000 | ---D | M] -- C:\Program Files\BlackIsle
[2009/12/14 16:48:44 | 000,000,000 | ---D | M] -- C:\Program Files\Bonjour
[2008/12/14 04:04:36 | 000,000,000 | ---D | M] -- C:\Program Files\Brass Restoration English
[2009/01/22 02:27:06 | 000,000,000 | ---D | M] -- C:\Program Files\BroodWar_Ai_Project
[2008/07/19 21:07:51 | 000,000,000 | ---D | M] -- C:\Program Files\Canon
[2008/07/13 20:28:48 | 000,000,000 | ---D | M] -- C:\Program Files\CDisplay
[2008/07/14 12:43:03 | 000,000,000 | ---D | M] -- C:\Program Files\Combined Community Codec Pack
[2010/06/20 18:51:08 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2004/08/26 11:01:27 | 000,000,000 | ---D | M] -- C:\Program Files\ComPlus Applications
[2009/03/23 18:02:00 | 000,000,000 | ---D | M] -- C:\Program Files\Conduit
[2008/07/13 18:31:13 | 000,000,000 | ---D | M] -- C:\Program Files\CONEXANT
[2008/07/13 18:50:00 | 000,000,000 | ---D | M] -- C:\Program Files\CyberLink
[2008/07/18 16:40:52 | 000,000,000 | ---D | M] -- C:\Program Files\DAEMON Tools Lite
[2008/07/18 16:40:52 | 000,000,000 | ---D | M] -- C:\Program Files\DAEMON Tools Toolbar
[2008/07/14 11:55:15 | 000,000,000 | ---D | M] -- C:\Program Files\DAMN NFO Viewer
[2009/10/19 19:11:44 | 000,000,000 | ---D | M] -- C:\Program Files\DeFFNetIzer
[2009/06/03 18:53:05 | 000,000,000 | ---D | M] -- C:\Program Files\DIFX
[2008/07/13 18:54:34 | 000,000,000 | ---D | M] -- C:\Program Files\Digital Media Reader
[2010/06/20 18:52:57 | 000,000,000 | ---D | M] -- C:\Program Files\DivX
[2009/08/10 20:55:43 | 000,000,000 | ---D | M] -- C:\Program Files\DOSBox-0.73
[2009/07/18 12:05:51 | 000,000,000 | ---D | M] -- C:\Program Files\EF CheckSum Manager
[2008/12/07 17:30:12 | 000,000,000 | ---D | M] -- C:\Program Files\Enterbrain
[2008/12/18 16:27:23 | 000,000,000 | ---D | M] -- C:\Program Files\EV Nova
[2008/07/14 21:45:35 | 000,000,000 | ---D | M] -- C:\Program Files\FastStone Image Viewer
[2008/07/24 19:54:57 | 000,000,000 | ---D | M] -- C:\Program Files\FLV Player
[2010/05/03 16:46:09 | 000,000,000 | ---D | M] -- C:\Program Files\foobar2000
[2010/05/04 22:06:26 | 000,000,000 | ---D | M] -- C:\Program Files\GameSpy Arcade
[2008/07/16 22:50:29 | 000,000,000 | ---D | M] -- C:\Program Files\Google
[2009/06/17 00:03:02 | 000,000,000 | ---D | M] -- C:\Program Files\GRETECH
[2010/01/10 15:29:51 | 000,000,000 | ---D | M] -- C:\Program Files\Hasbro
[2008/08/14 01:42:32 | 000,000,000 | ---D | M] -- C:\Program Files\ICCup
[2009/07/30 15:07:56 | 000,000,000 | ---D | M] -- C:\Program Files\ICE Book Reader Professional
[2009/08/14 04:07:43 | 000,000,000 | ---D | M] -- C:\Program Files\iEvony
[2008/11/30 14:46:32 | 000,000,000 | ---D | M] -- C:\Program Files\Illustrate
[2008/11/30 11:49:00 | 000,000,000 | ---D | M] -- C:\Program Files\iMesh Applications
[2010/06/16 20:36:49 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2008/07/13 18:43:56 | 000,000,000 | ---D | M] -- C:\Program Files\Intel
[2010/05/27 15:35:16 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Download Manager
[2010/06/10 17:44:26 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2009/12/14 16:50:40 | 000,000,000 | ---D | M] -- C:\Program Files\iPod
[2009/12/14 16:53:15 | 000,000,000 | ---D | M] -- C:\Program Files\iTunes
[2010/01/30 12:30:44 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2008/12/16 21:42:47 | 000,000,000 | ---D | M] -- C:\Program Files\JAVSEditor
[2009/08/31 20:25:08 | 000,000,000 | ---D | M] -- C:\Program Files\Jnes 0.6
[2008/07/14 11:47:15 | 000,000,000 | ---D | M] -- C:\Program Files\Lavasoft
[2008/07/13 18:48:54 | 000,000,000 | ---D | M] -- C:\Program Files\Learn2.com
[2009/07/14 21:47:00 | 000,000,000 | ---D | M] -- C:\Program Files\LiveUpdate
[2009/06/04 10:19:55 | 000,000,000 | ---D | M] -- C:\Program Files\LSES7
[2009/05/20 08:51:03 | 000,000,000 | ---D | M] -- C:\Program Files\Macromedia
[2010/06/07 08:59:11 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2008/08/15 02:26:29 | 000,000,000 | ---D | M] -- C:\Program Files\Messenger
[2009/02/20 19:44:43 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft
[2008/09/02 01:45:00 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2004/08/26 11:04:52 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
[2009/06/26 17:31:29 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Games for Windows - LIVE
[2008/07/13 18:54:11 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Money 2005
[2009/02/04 19:15:45 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
[2009/10/15 19:55:18 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office Outlook Connector
[2008/07/16 14:56:23 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Reader
[2010/06/04 06:52:37 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Silverlight
[2009/10/15 11:40:47 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft SQL Server
[2008/10/10 20:00:37 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft SQL Server Compact Edition
[2008/12/21 16:29:08 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Sync Framework
[2008/07/18 16:50:29 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Virtual PC
[2009/02/04 19:15:30 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Visual Studio
[2009/10/13 03:17:21 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Works
[2009/06/24 20:31:56 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft WSE
[2009/02/04 20:40:27 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft.NET
[2010/04/18 20:11:46 | 000,000,000 | ---D | M] -- C:\Program Files\Morrowind Enchanted Editor
[2010/03/11 02:27:57 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2010/07/06 09:37:54 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2009/09/22 10:53:45 | 000,000,000 | ---D | M] -- C:\Program Files\MP3
[2009/09/22 11:06:30 | 000,000,000 | ---D | M] -- C:\Program Files\MP3 Player Utilities 3.68
[2009/10/01 23:01:47 | 000,000,000 | ---D | M] -- C:\Program Files\MPC HomeCinema
[2009/03/23 02:31:15 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
[2009/02/04 17:51:08 | 000,000,000 | ---D | M] -- C:\Program Files\MSECache
[2004/08/26 11:00:08 | 000,000,000 | ---D | M] -- C:\Program Files\MSN
[2008/07/13 18:54:13 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Encarta Plus
[2004/08/26 11:00:22 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone
[2008/07/14 11:30:42 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 4.0
[2009/02/04 20:30:10 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 6.0
[2010/05/30 15:38:09 | 000,000,000 | ---D | M] -- C:\Program Files\MWscriptExtender
[2008/11/16 22:45:38 | 000,000,000 | ---D | M] -- C:\Program Files\Nero
[2008/11/08 11:53:08 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
[2009/02/25 00:48:32 | 000,000,000 | ---D | M] -- C:\Program Files\Nuclear Coffee
[2004/08/26 11:02:22 | 000,000,000 | ---D | M] -- C:\Program Files\Online Services
[2010/07/03 16:01:06 | 000,000,000 | ---D | M] -- C:\Program Files\OpenPandora
[2010/07/01 09:03:02 | 000,000,000 | ---D | M] -- C:\Program Files\Opera
[2010/05/12 21:42:03 | 000,000,000 | ---D | M] -- C:\Program Files\Outlook Express
[2009/06/23 12:24:14 | 000,000,000 | ---D | M] -- C:\Program Files\Participatory Culture Foundation
[2010/02/07 12:16:26 | 000,000,000 | ---D | M] -- C:\Program Files\Pcsx2
[2009/02/21 20:37:12 | 000,000,000 | ---D | M] -- C:\Program Files\Photo Collage Maker
[2010/04/26 11:38:12 | 000,000,000 | ---D | M] -- C:\Program Files\Project64 1.6
[2009/06/19 12:26:12 | 000,000,000 | ---D | M] -- C:\Program Files\Pure Networks
[2009/08/10 17:26:41 | 000,000,000 | ---D | M] -- C:\Program Files\RADVideo
[2010/03/29 10:05:30 | 000,000,000 | ---D | M] -- C:\Program Files\Rainlendar2
[2010/04/27 22:28:29 | 000,000,000 | ---D | M] -- C:\Program Files\Real Alternative
[2009/03/23 02:30:56 | 000,000,000 | ---D | M] -- C:\Program Files\Reference Assemblies
[2009/05/20 08:51:00 | 000,000,000 | ---D | M] -- C:\Program Files\Screaming Bee
[2009/10/25 17:57:21 | 000,000,000 | ---D | M] -- C:\Program Files\SCSI
[2009/02/17 18:46:52 | 000,000,000 | ---D | M] -- C:\Program Files\ShiningMorning
[2010/02/25 17:51:17 | 000,000,000 | ---D | M] -- C:\Program Files\Sierra
[2009/11/15 21:29:10 | 000,000,000 | ---D | M] -- C:\Program Files\softnyx
[2010/03/13 19:51:08 | 000,000,000 | ---D | M] -- C:\Program Files\SopCast
[2009/10/16 23:41:57 | 000,000,000 | ---D | M] -- C:\Program Files\Spyware Doctor
[2008/07/18 20:33:00 | 000,000,000 | ---D | M] -- C:\Program Files\Stardock
[2010/03/27 22:18:59 | 000,000,000 | ---D | M] -- C:\Program Files\StepMania
[2010/04/23 10:19:50 | 000,000,000 | ---D | M] -- C:\Program Files\Symantec
[2008/07/13 19:24:58 | 000,000,000 | ---D | M] -- C:\Program Files\SymNetDrv
[2009/11/22 15:56:08 | 000,000,000 | ---D | M] -- C:\Program Files\SystemRequirementsLab
[2009/06/04 10:17:57 | 000,000,000 | ---D | M] -- C:\Program Files\Traduce Gratis
[2004/08/26 11:09:37 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
[2010/02/16 10:42:45 | 000,000,000 | ---D | M] -- C:\Program Files\uTorrent
[2009/05/08 20:33:14 | 000,000,000 | ---D | M] -- C:\Program Files\uusee
[2008/12/29 21:59:34 | 000,000,000 | ---D | M] -- C:\Program Files\Veoh Networks
[2008/07/17 01:43:45 | 000,000,000 | ---D | M] -- C:\Program Files\VideoLAN
[2009/03/06 19:39:37 | 000,000,000 | ---D | M] -- C:\Program Files\Viewpoint
[2010/03/27 22:17:17 | 000,000,000 | ---D | M] -- C:\Program Files\Warcraft III
[2009/06/19 12:23:13 | 000,000,000 | ---D | M] -- C:\Program Files\WebEx
[2009/10/15 19:46:06 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live
[2008/12/28 23:14:41 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live Safety Center
[2008/12/21 16:21:59 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live SkyDrive
[2009/09/25 03:35:17 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Connect 2
[2009/01/24 23:38:01 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2008/07/14 11:05:21 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2008/11/16 22:42:09 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Sidebar
[2004/08/26 11:02:28 | 000,000,000 | -H-D | M] -- C:\Program Files\WindowsUpdate
[2008/07/16 23:21:59 | 000,000,000 | ---D | M] -- C:\Program Files\WinRAR
[2009/06/04 22:19:27 | 000,000,000 | ---D | M] -- C:\Program Files\Winwall
[2004/08/26 11:04:52 | 000,000,000 | ---D | M] -- C:\Program Files\xerox
[2008/12/01 02:04:39 | 000,000,000 | ---D | M] -- C:\Program Files\Xilisoft
[2008/12/16 21:48:23 | 000,000,000 | ---D | M] -- C:\Program Files\XYLIO
[2010/04/26 11:30:26 | 000,000,000 | ---D | M] -- C:\Program Files\Yahoo!

< %appdata%\*.* >
[2004/08/26 03:54:35 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\Jinn\Application Data\desktop.ini
[2008/12/12 18:06:59 | 000,000,026 | ---- | M] () -- C:\Documents and Settings\Jinn\Application Data\EV Nova License.lcs
[2010/01/24 21:41:51 | 000,000,140 | ---- | M] () -- C:\Documents and Settings\Jinn\Application Data\EV Nova Prefs.prf
[2008/12/02 02:13:04 | 000,001,145 | ---- | M] () -- C:\Documents and Settings\Jinn\Application Data\MPQEditor.ini


< MD5 for: AGP440.SYS >
[2004/08/04 12:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/07/14 10:59:26 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004/08/04 12:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:AGP440.sys
[2008/07/14 10:59:26 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 11:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 11:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/04 06:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/04 12:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/07/14 10:59:26 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004/08/04 12:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:atapi.sys
[2008/07/14 10:59:26 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 11:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 11:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/04 05:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys
[2004/08/03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\atapi.sys

< MD5 for: DISK.SYS >
[2004/08/04 12:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:disk.sys
[2008/07/14 10:59:26 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:disk.sys
[2004/08/04 12:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:disk.sys
[2008/07/14 10:59:26 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:disk.sys
[2004/08/04 12:00:00 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\WINDOWS\$NtServicePackUninstall$\disk.sys
[2008/04/13 11:40:47 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\ServicePackFiles\i386\disk.sys
[2008/04/13 11:40:47 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\system32\drivers\disk.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 17:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 17:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
[2004/08/04 12:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/13 17:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 17:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2004/08/04 12:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 12:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 17:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 17:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: USBSTOR.SYS >
[2004/08/04 12:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:usbstor.sys
[2008/07/14 10:59:26 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:usbstor.sys
[2004/08/04 12:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:usbstor.sys
[2008/07/14 10:59:26 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:usbstor.sys
[2008/04/13 11:45:38 | 000,026,368 | ---- | M] (Microsoft Corporation) MD5=A32426D9B14A089EAA1D922E0C5801A9 -- C:\WINDOWS\ServicePackFiles\i386\usbstor.sys
[2008/04/13 11:45:38 | 000,026,368 | ---- | M] (Microsoft Corporation) MD5=A32426D9B14A089EAA1D922E0C5801A9 -- C:\WINDOWS\system32\dllcache\usbstor.sys
[2008/04/13 11:45:38 | 000,026,368 | ---- | M] (Microsoft Corporation) MD5=A32426D9B14A089EAA1D922E0C5801A9 -- C:\WINDOWS\system32\drivers\USBSTOR.SYS

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-06-24 07:21:57

========== Alternate Data Streams ==========

@Alternate Data Stream - 147 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 1434 bytes -> C:\Documents and Settings\All Users\Application Data\Microsoft:jQbb5o9tZOL43hbthyib1IjjD2Z
@Alternate Data Stream - 128 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C39E55C5
@Alternate Data Stream - 1276 bytes -> C:\Documents and Settings\All Users\Application Data\Microsoft:e2Xq2f4UZLYUtvZcOPuVHQexXaF
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F1DEA771
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
< End of report >

OTL Extras logfile created on: 7/6/2010 9:39:43 AM - Run 1
OTL by OldTimer - Version 3.2.7.1 Folder = C:\Documents and Settings\Jinn\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 544.00 Mb Available Physical Memory | 53.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 73.00 Gb Total Space | 8.72 Gb Free Space | 11.94% Space Free | Partition Type: NTFS
Drive D: | 3.68 Gb Total Space | 1.78 Gb Free Space | 48.36% Space Free | Partition Type: FAT32
Drive E: | 480.69 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
Drive G: | 145.16 Gb Total Space | 21.85 Gb Free Space | 15.05% Space Free | Partition Type: NTFS
Drive H: | 3.87 Gb Total Space | 0.61 Gb Free Space | 15.75% Space Free | Partition Type: FAT32
Drive I: | 4.18 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive J: | 527.28 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: YOUR-E1CC41FE2B
Current User Name: Jinn
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Opera\opera.exe" (Opera Software)
https [open] -- "C:\Program Files\Opera\opera.exe" (Opera Software)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Browse with FastStone] -- "C:\Program Files\FastStone Image Viewer\FSViewer.exe" "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"67:UDP" = 67:UDP:*:Enabled:DHCP Discovery Service

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- (America Online, Inc)
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- (America Online, Inc.)
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL -- (America Online, Inc.)
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- (America Online, Inc)
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- (America Online, Inc.)
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL -- (America Online, Inc.)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\DAUM\PotPlayer\daumvsvr.exe" = C:\Program Files\DAUM\PotPlayer\daumvsvr.exe:*:Enabled:DaumCP VoD Server -- File not found
"C:\Program Files\DAUM\PotPlayer\PotPlayer.exe" = C:\Program Files\DAUM\PotPlayer\PotPlayer.exe:*:Enabled:?? ????? -- File not found
"C:\Program Files\DAUM\PotPlayer\PotPlayerMini.exe" = C:\Program Files\DAUM\PotPlayer\PotPlayerMini.exe:*:Enabled:?? ????? -- File not found
"G:\Program Files\mIRC\mirc.exe" = G:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC -- (mIRC Co. Ltd.)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- File not found
"C:\Program Files\Yahoo!\Messenger\YServer.exe" = C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server -- File not found
"C:\Program Files\uusee\UUSeePlayer.exe" = C:\Program Files\uusee\UUSeePlayer.exe:*:Enabled:UUPlayer -- File not found
"C:\Program Files\Microsoft LifeCam\LifeExp.exe" = C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe -- File not found
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader -- File not found
"C:\Program Files\AIM6\aim6.exe" = C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM -- File not found
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Program Files\Steam\Steam.exe" = C:\Program Files\Steam\Steam.exe:*:Enabled:Steam -- File not found
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)
"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager -- File not found
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"G:\Documents and Settings\Owner\My Documents\New Folder (2)\Age Of Empires 2 & The Conquerors Expansion - Full Game - [HUSSEY]\age2_x1.exe" = G:\Documents and Settings\Owner\My Documents\New Folder (2)\Age Of Empires 2 & The Conquerors Expansion - Full Game - [HUSSEY]\age2_x1.exe:*:Enabled:Age of Empires II Expansion -- (Microsoft Corporation)
"G:\Program Files\Rise of Nations\thrones.exe" = G:\Program Files\Rise of Nations\thrones.exe:*:Enabled:Rise of Nations -- File not found
"G:\Program Files\Warcraft III\Warcraft III.exe" = G:\Program Files\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III -- (Blizzard Entertainment)
"G:\Program Files\Warcraft III\War3.exe" = G:\Program Files\Warcraft III\War3.exe:*:Enabled:Warcraft III -- (Blizzard Entertainment)
"C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe" = C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:LocalSubNet:Enabled:Pure Networks Platform Service -- (Cisco Systems, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}" = Google Gmail Notifier
"{02627ee5-eaca-4742-a9cc-e687631773e4}" = Nero ShowTime
"{05B49229-22A2-4F88-842A-BBC2EBE1CCF6}" = Microsoft Games for Windows - LIVE Redistributable
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{086a7d8c-0a38-4c7f-819a-620275550d5c}" = Nero BurningROM
"{139E303E-1050-497F-98B1-9AE87B15C463}" = Windows Live Family Safety
"{14C87AA7-08E6-419F-A165-998EBE5023D7}" = Oblivion - Knights of the Nine
"{16D919E6-F019-4E15-BFBE-4A85EF19DA57}" = Oblivion - Spell Tomes
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1c00c7c5-e615-4139-b817-7f4003de68c0}" = Nero PhotoSnap Help
"{1D2C96C3-A3F3-49E7-B839-95279DED837F}" = Opera 10.60
"{1E99F5D7-4262-4C7C-9135-F066E7485811}" = System Requirements Lab
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20400dbd-e6db-45b8-9b6b-1dd7033818ec}" = Nero InfoTool
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2348b586-c9ae-46ce-936c-a68e9426e214}" = Nero StartSmart Help
"{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1" = Media Player Classic - Home Cinema v. 1.3.1249.0
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18
"{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}" = Microsoft SQL Server 2005 Tools Express Edition
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{2D33B338-EA1B-34EA-BD7F-BBD59487E03A}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - JPN
"{2F2E3D62-8B8C-448F-8900-451325E50948}" = Oblivion - Wizard's Tower
"{33cf58f5-48d8-4575-83d6-96f574e4d83a}" = Nero DriveSpeed
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{359cfc0a-beb1-440d-95ba-cf63a86da34f}" = Nero Recode
"{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion
"{368ba326-73ad-4351-84ed-3c0a7a52cc53}" = Nero Rescue Agent
"{394BE3D9-7F57-4638-A8D1-1D88671913B7}" = Microsoft AppLocale
"{3ABEBD00-299D-4DCA-967F-B912163AB5EA}" = Oblivion - Horse Armor Pack
"{3B1A4366-8DFA-4582-91F6-27F7A4714FCC}" = Pure Networks Platform
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works
"{43e39830-1826-415d-8bae-86845787b54b}" = Nero Vision
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{4D243BA7-9AC4-46D1-90E5-EEB88974F501}" = Microsoft Games for Windows - LIVE
"{520F4B09-3A51-47A2-82B0-9FF1DC2D20FA}" = Oblivion - Vile Lair
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}" = Macromedia Extension Manager
"{56B4002F-671C-49F4-984C-C760FE3806B5}" = Microsoft SQL Server VSS Writer
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{595a3116-40bb-4e0f-a2e8-d7951da56270}" = NeroExpress
"{5d9be3c1-8ba4-4e7e-82fd-9f74fa6815d1}" = Nero Vision
"{5e08ecd1-c98e-4711-bf65-8fd736b3f969}" = Nero RescueAgent Help
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{60c731fb-c951-41ce-ad41-8e54c8594609}" = Nero Disc Copy Gadget Help
"{62ac81f6-bdd3-4110-9d36-3e9eaab40999}" = Nero CoverDesigner
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{66F49D6A-E999-4DB0-ADB6-EE546806E340}" = Antares Auto-Tune Evo VST
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7148F0A8-6813-11D6-A77B-00B0D0142000}" = Java 2 Runtime Environment, SE v1.4.2
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76EFFC7C-17A6-479D-9E47-8E658C1695AE}" = Windows Backup Utility
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7748ac8c-18e3-43bb-959b-088faea16fb2}" = Nero StartSmart
"{7784A172-61F1-445E-8368-601607E0DD22}" = MP3 Player Utilities 3.68
"{77e33d87-255e-413e-9c8d-eed2a7f9bebf}" = Nero Live Help
"{7829db6f-a066-4e40-8912-cb07887c20bb}" = Nero BurnRights
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{7C32C567-DC0F-4C80-B06C-7873850A2E06}" = The Sims Unleashed
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{81EED1A1-AE78-4B11-BE47-C6AE9F5E87F1}" = Digital Media Reader
"{82F9E7F2-58A5-44AE-9320-73209521B39D}" = Knights of The Old Republic 1M Edition
"{83202942-84b3-4c50-8622-b8c0aa2d2885}" = Nero Express
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{85309D89-7BE9-4094-BB17-24999C6118FC}" = ArcSoft PhotoStudio 5.5
"{869200db-287a-4dc0-b02b-2b6787fbcd4c}" = Nero DiscSpeed
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics 2 Driver
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007
"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0014-0000-0000-0000000FF1CE}_PROR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{91175441-4E5D-4e13-B116-828FD352CDB2}" = Canon MP170
"{92B94569-6683-4617-8C54-EB27A1B51B30}" = GTAIII
"{932245FB-2F3B-3E2E-B8AB-BDE96E434F21}" = Microsoft .NET Framework 3.5 Language Pack SP1 - jpn
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{98a67610-a3b5-4098-a423-3708040026d3}" = "Nero SoundTrax Help
"{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9e82b934-9a25-445b-b8df-8012808074ac}" = Nero PhotoSnap
"{9F8A5A73-88D8-4ACE-A964-14C6273F07F1}" = Cisco Network Magic
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{a209525b-3377-43f4-b886-32f6b6e7356f}" = Nero WaveEditor
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.3
"{AD483998-2E9A-4405-83FF-6E503AF49CBB}" = Microsoft Virtual PC 2007 SP1
"{ad6bc5cc-2ef0-49c4-b33d-cdc8b2c4dc80}" = Nero Recode Help
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{b1adf008-e898-4fe2-8a1f-690d9a06acaf}" = DolbyFiles
"{b2ec4a38-b545-4a00-8214-13fe0e915e6d}" = Advertising Center
"{B42F73D4-AFDA-4761-B3F4-23A872D11339}" = Morrowind
"{B6F7DBE7-2FE2-458F-A738-B10832746036}" = Microsoft Reader
"{b78120a0-cf84-4366-a393-4d0a59bc546c}" = Menu Templates - Starter Kit
"{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}" = Nero ControlCenter
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BD68F46D-8A82-4664-8E68-F87C55BDEFD4}" = Microsoft SQL Server Native Client
"{BEF3EFE7-5159-436D-9BF0-CCC633179EB4}" = EVGA Display Driver
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C34FAEF3-4241-4C4E-9CFF-7BBD8BCEABE7}" = WebEx Support Manager for Internet Explorer
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{c5a7cb6c-e76d-408f-ba0e-85605420fe9d}" = SoundTrax
"{CA0A1E54-CE0F-4366-B09C-A87B61DC5633}" = Symantec Network Drivers Update
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{cc019e3f-59d2-4486-8d4b-878105b62a71}" = Nero DiscSpeed
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{ce96f5a5-584d-4f8f-aa3e-9baed413db72}" = Nero CoverDesigner Help
"{d025a639-b9c9-417d-8531-208859000af8}" = NeroBurningROM
"{D0C04904-ED13-4DB3-ACCA-A41079EBA23C}" = Opera 9.60
"{d3def316-738b-453b-968f-e4d9022a2b9d}" = Nero 9 Trial
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{D85BDA1A-983E-3C61-8F03-E5F9C394075C}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - JPN
"{d9dcf92e-72eb-412d-ac71-3b01276e5f8b}" = Nero ShowTime
"{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb" = Microsoft Windows Application Compatibility Database
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{df6a95f5-adc1-406a-bdc6-2aa7cc0182aa}" = Nero Live
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{e498385e-1c51-459a-b45f-1721e37aa1a0}" = Movie Templates - Starter Kit
"{e5c7d048-f9b4-4219-b323-8bdb01a2563d}" = Nero DriveSpeed
"{e8631efb-6b9a-426c-b1ce-e7173ca26bf8}" = Nero WaveEditor Help
"{e8a80433-302b-4ff1-815d-fcc8eac482ff}" = Nero Installer
"{EC425CFC-EE78-4A91-AA25-3BFA65B75364}" = Oblivion - Orrery
"{EF295F5C-7B57-47AA-8889-6B3E8E214E89}" = Oblivion - Mehrunes Razor
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{f1861f30-3419-44db-b2a1-c274825698b3}" = Nero Disc Copy Gadget
"{f4041dce-3fe1-4e18-8a9e-9de65231ee36}" = Nero ControlCenter
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{f6bdd7c5-89ed-4569-9318-469aa9732572}" = Nero BurnRights
"{F78E0DB8-D00C-4E0B-B2D4-0DDBA9FAAA49}_is1" = DeFFNetIzer 2455070.5
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{fbcdfd61-7dcf-4e71-9226-873ba0053139}" = Nero InfoTool
"{FF70923C-8A51-47F4-A7E9-893C6D54EB68}" = TES Construction Set
"{FFFFFD17-B460-41EB-93F1-C48ABAD63828}" = Oblivion - Thieves Den
"7-Zip" = 7-Zip 4.62
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"America Online us" = America Online (Choose which version to remove)
"AOL Connectivity Services" = AOL Connectivity Services
"AOL Spyware Protection" = AOL Spyware Protection
"AOL Toolbar" = AOL Toolbar
"AOL YGP Screensaver" = AOL You've Got Pictures Screensaver
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Brass Restoration English_is1" = Brass Restoration English v1.0
"Brave Soul" = Brave Soul
"Browser Defender_is1" = Browser Defender 2.0.6.10
"CDisplay_is1" = CDisplay 1.8
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200014F1" = SoftV92 Data Fax Modem with SmartCP
"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2008-01-24
"Cross Channel" = Cross Channel
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"dBpoweramp DSP Effects" = dBpoweramp DSP Effects
"dBpoweramp WavPack Codec" = dBpoweramp WavPack Codec
"DeFFNetIzer_is1" = DeFFNetIzer 2454674.875
"Digital Editions" = Adobe Digital Editions
"DivX Setup.divx.com" = DivX Setup
"Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint
"EV Nova" = EV Nova (remove only)
"Fallout" = Fallout
"Fallout Mod Manager_is1" = Fallout Mod Manager 0.9.15
"Fallout2" = Fallout2
"FastStone Image Viewer" = FastStone Image Viewer 3.5
"Fate-stay night English" = Fate/stay night English v3.2
"FLV Player" = FLV Player 2.0, build 24
"foobar2000" = foobar2000 v1.0.3
"GameSpy Arcade" = GameSpy Arcade
"GOM Player" = GOM Player
"GTK 2.0" = GTK+ Runtime 2.14.6 rev a (remove only)
"Half-Life" = Half-Life
"HijackThis" = HijackThis 2.0.2
"ICE Book Reader Professional_is1" = ICE Book Reader Professional v8.10.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"iMesh" = iMesh
"iMesh MediaBar" = MediaBar 2.0
"InstallShield_{81EED1A1-AE78-4B11-BE47-C6AE9F5E87F1}" = Digital Media Reader
"JAVSEditor" = JAVSEditor
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - jpn" = Microsoft .NET Framework 3.5 Language Pack SP1 - 日本語
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Money2005b" = Microsoft Money 2005
"Monopoly by Parker Brothers" = Monopoly by Parker Brothers
"Morrowind script Extender_is1" = Morrowind script Extender 0.9.4.1
"Mozilla Firefox (3.5.10)" = Mozilla Firefox (3.5.10)
"MP Navigator 2.0" = Canon MP Navigator 2.0
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NeroMultiInstaller!UninstallKey" = Nero Suite
"Network MagicUninstall" = Network Magic
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Oblivion mod manager_is1" = Oblivion mod manager 1.1.12
"OpenPandora" = OpenPandora 0.7.0.6
"Opera" = Opera
"Operation Optimization_is1" = Operation Optimization v1.1.1
"Port Magic" = Pure Networks Port Magic
"PROR" = Microsoft Office Professional 2007 Trial
"PROSet" = Intel(R) PRO Network Adapters and Drivers
"RADVideo" = RAD Video Tools
"Rainlendar2" = Rainlendar2 (remove only)
"RealAlt_is1" = Real Alternative 2.0.2
"RiseOfNations 1.0" = Microsoft Rise Of Nations
"RPG Maker VX RTP_is1" = RPG Maker VX RTP
"RPG Maker VX_is1" = RPG Maker VX
"Scourge of the Lich Father" = Scourge of the Lich Father 1.2
"Scourge of the Lich Father - Act I" = Scourge of the Lich Father - Act I 1.3
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"SopCast" = SopCast 3.2.8
"Spyware Doctor" = Spyware Doctor 7.0
"StreetPlugin" = Learn2 Player (Uninstall Only)
"SystemRequirementsLab" = System Requirements Lab
"The Longest Journey" = The Longest Journey
"tv_enua" = Lernout & Hauspie TruVoice American English TTS Engine
"Unofficial Oblivion Patch_is1" = Unofficial Oblivion Patch v3.2.0
"USB MP3 Player WIN98 Drivers" = USB MP3 Player WIN98 Drivers
"Video Converter 3" = Video Converter 3
"VideoGet_is1" = VideoGet
"ViewpointMediaPlayer" = Viewpoint Media Player
"VLC media player" = VLC media player 1.0.1
"WindowBlinds" = WindowBlinds
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"Winwall_is1" = Winwall v2.1
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"yTimer_is1" = yTimer

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Basketball" = Basketball
"Google Chrome" = Google Chrome
"Move Media Player" = Move Media Player
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player
"Octoshape Streaming Services" = Octoshape Streaming Services
"uTorrent" = µTorrent
"Warcraft III" = Warcraft III: All Products

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/27/2010 1:28:07 PM | Computer Name = YOUR-E1CC41FE2B | Source = Application Error | ID = 1000
Description = Faulting application taskmgr.exe, version 5.1.2600.5512, faulting
module wblind.dll, version 6.0.0.2, fault address 0x00006dc7.

Error - 6/29/2010 10:49:50 AM | Computer Name = YOUR-E1CC41FE2B | Source = Application Error | ID = 1000
Description = Faulting application gom.exe, version 2.1.14.4525, faulting module
msvcr71.dll, version 7.10.6030.0, fault address 0x00002665.

Error - 7/4/2010 10:27:32 PM | Computer Name = YOUR-E1CC41FE2B | Source = Application Error | ID = 1000
Description = Faulting application oblivion.exe, version 1.2.0.416, faulting module
oblivion.exe, version 1.2.0.416, fault address 0x000cee0b.

Error - 7/5/2010 11:23:18 AM | Computer Name = YOUR-E1CC41FE2B | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from:
with error: This operation returned because the timeout period expired.

Error - 7/5/2010 11:24:42 AM | Computer Name = YOUR-E1CC41FE2B | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from:
with error: This operation returned because the timeout period expired.

Error - 7/5/2010 11:24:45 AM | Computer Name = YOUR-E1CC41FE2B | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from:
with error: This network connection does not exist.

Error - 7/5/2010 7:21:30 PM | Computer Name = YOUR-E1CC41FE2B | Source = Application Error | ID = 1000
Description = Faulting application oblivion.exe, version 1.2.0.416, faulting module
oblivion.exe, version 1.2.0.416, fault address 0x001ea353.

Error - 7/5/2010 8:19:06 PM | Computer Name = YOUR-E1CC41FE2B | Source = Application Error | ID = 1000
Description = Faulting application oblivion.exe, version 1.2.0.416, faulting module
oblivion.exe, version 1.2.0.416, fault address 0x000cee0b.

Error - 7/6/2010 12:32:00 PM | Computer Name = YOUR-E1CC41FE2B | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 80110472 from line 44 of d:\comxp_sp3\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 7/6/2010 12:32:00 PM | Computer Name = YOUR-E1CC41FE2B | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
CoCreateInstance. hr = 0x80040206.

[ OSession Events ]
Error - 4/26/2010 2:40:13 PM | Computer Name = YOUR-E1CC41FE2B | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6524.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 7
seconds with 0 seconds of active time. This session ended with a crash.

Error - 4/26/2010 2:40:35 PM | Computer Name = YOUR-E1CC41FE2B | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session
lasted 5 seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 7/6/2010 2:05:15 AM | Computer Name = YOUR-E1CC41FE2B | Source = Service Control Manager | ID = 7031
Description = The Apple Mobile Device service terminated unexpectedly. It has done
this 4 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 7/6/2010 2:06:39 AM | Computer Name = YOUR-E1CC41FE2B | Source = Service Control Manager | ID = 7031
Description = The Apple Mobile Device service terminated unexpectedly. It has done
this 5 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 7/6/2010 3:48:44 AM | Computer Name = YOUR-E1CC41FE2B | Source = DCOM | ID = 10010
Description = The server {B1DBD568-80B2-43FA-AE07-76FB23AA4650} did not register
with DCOM within the required timeout.

Error - 7/6/2010 3:55:54 AM | Computer Name = YOUR-E1CC41FE2B | Source = DCOM | ID = 10010
Description = The server {B1DBD568-80B2-43FA-AE07-76FB23AA4650} did not register
with DCOM within the required timeout.

Error - 7/6/2010 12:27:36 PM | Computer Name = YOUR-E1CC41FE2B | Source = DCOM | ID = 10010
Description = The server {B1DBD568-80B2-43FA-AE07-76FB23AA4650} did not register
with DCOM within the required timeout.

Error - 7/6/2010 12:32:00 PM | Computer Name = YOUR-E1CC41FE2B | Source = Service Control Manager | ID = 7034
Description = The SQL Server VSS Writer service terminated unexpectedly. It has
done this 1 time(s).

Error - 7/6/2010 12:33:06 PM | Computer Name = YOUR-E1CC41FE2B | Source = Service Control Manager | ID = 7034
Description = The Bonjour Service service terminated unexpectedly. It has done
this 1 time(s).

Error - 7/6/2010 12:33:08 PM | Computer Name = YOUR-E1CC41FE2B | Source = Service Control Manager | ID = 7031
Description = The Apple Mobile Device service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 7/6/2010 12:33:11 PM | Computer Name = YOUR-E1CC41FE2B | Source = Service Control Manager | ID = 7034
Description = The iPod Service service terminated unexpectedly. It has done this
1 time(s).

Error - 7/6/2010 12:33:29 PM | Computer Name = YOUR-E1CC41FE2B | Source = Service Control Manager | ID = 7034
Description = The Viewpoint Manager Service service terminated unexpectedly. It
has done this 1 time(s).


< End of report >

Hi,

Please run OTL.exe.

• Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :OTL
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5577
  O4 - HKLM..\Run: [ikwwblhv] C:\Documents and Settings\Jinn\Local Settings\Application Data\dqcjiewen\efnaiwktssd.exe ()
  O4 - HKCU..\Run: [ikwwblhv] C:\Documents and Settings\Jinn\Local Settings\Application Data\dqcjiewen\efnaiwktssd.exe ()
  
  :Files
  C:\Documents and Settings\Jinn\Local Settings\Application Data\dqcjiewen
  
  :commands
  [emptytemp]
  [resethosts]
  [reboot]
  
  
  
• Return to OTL.exe, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.
  
  
• Click the red Run Fix button.
  
• A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTL.exe
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

If this fix becomes unresponsive, please move on to ComboFix.

=========

Please download ComboFix from BleepingComputer.com

Alternate link: GeeksToGo.com

Alternate link: Forospyware.com

Rename ComboFix.exe to commy.exe before you save it to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here
  
• Click Start>Run then copy paste the following command into the Run box & click OK "%userprofile%\desktop\commy.exe" /stepdel
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console

Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

• Click on Yes, to continue scanning for malware.
  
• When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply.
  

Thanks everything seems to be back to normal.

Hi,

I am glad your issue seems to be fixed, but we are not quite done yet as there are still many things that need to be repaired.

Please run ComboFix as I need that log to confirm if items remain before I give you the final check.

ComboFix 10-07-06.05 - Jinn 07/07/2010 16:17:18.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.609 [GMT -7:00]
Running from: c:\documents and settings\Jinn\desktop\commy.exe
Command switches used :: /stepdel
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Macromedia\SwUpdate
c:\documents and settings\All Users\Application Data\Macromedia\SwUpdate\B32.dtd
c:\documents and settings\All Users\Application Data\Macromedia\SwUpdate\B64.dtd
c:\documents and settings\All Users\Application Data\Macromedia\SwUpdate\Flags.dtd
c:\documents and settings\All Users\Application Data\Macromedia\SwUpdate\Local.dtd
c:\documents and settings\All Users\Application Data\Macromedia\SwUpdate\swupdate.dll
c:\documents and settings\All Users\Application Data\Macromedia\SwUpdate\Ui.dtd
c:\windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb
c:\windows\struct~.ini
c:\windows\system32\STEC3.sys
D:\Autorun.inf
H:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_STEC3
-------\Service_STEC3


((((((((((((((((((((((((( Files Created from 2010-06-07 to 2010-07-07 )))))))))))))))))))))))))))))))
.

2010-07-06 17:37 . 2010-07-06 17:37 -------- d-----w- C:\_OTL
2010-07-03 23:00 . 2010-07-03 23:01 -------- d-----w- c:\program files\OpenPandora
2010-07-01 16:58 . 2010-07-01 16:58 -------- d-----w- c:\documents and settings\Jinn\Local Settings\Application Data\Basketball
2010-06-21 01:51 . 2010-06-21 01:51 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-06-21 01:48 . 2010-06-21 01:53 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX
2010-06-20 03:37 . 2010-06-22 02:07 76836 ----a-w- c:\windows\War3Unin.dat
2010-06-20 03:36 . 2010-06-22 02:03 2829 ----a-w- c:\windows\War3Unin.pif
2010-06-20 03:36 . 2010-06-22 02:03 139264 ----a-w- c:\windows\War3Unin.exe
2010-06-10 13:33 . 2010-05-06 10:41 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-07 23:27 . 2008-11-30 21:21 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-07-07 22:08 . 2008-07-15 07:31 -------- d-----w- c:\documents and settings\Jinn\Application Data\foobar2000
2010-07-01 16:03 . 2008-07-14 02:20 -------- d-----w- c:\program files\Opera
2010-06-23 02:20 . 2008-10-08 06:28 -------- d-----w- c:\documents and settings\Jinn\Application Data\DivX
2010-06-21 01:52 . 2008-10-05 21:20 -------- d-----w- c:\program files\DivX
2010-06-17 03:36 . 2008-07-14 01:43 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-11 00:49 . 2009-02-05 02:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-06-07 15:59 . 2009-10-17 19:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-06-04 13:52 . 2008-12-21 23:39 -------- d-----w- c:\program files\Microsoft Silverlight
2010-05-30 22:38 . 2010-05-30 22:38 -------- d-----w- c:\program files\MWscriptExtender
2010-05-27 22:35 . 2010-03-28 01:41 -------- d-----w- c:\program files\Internet Download Manager
2010-05-27 16:06 . 2010-03-28 01:41 -------- d-----w- c:\documents and settings\Jinn\Application Data\DMCache
2010-05-16 05:19 . 2008-07-15 20:33 -------- d-----w- c:\documents and settings\Jinn\Application Data\uTorrent
2010-05-10 19:43 . 2008-08-08 02:00 -------- d-----w- c:\documents and settings\Jinn\Application Data\Canon
2010-05-10 13:54 . 2009-08-07 00:22 -------- d-----w- c:\documents and settings\Jinn\Application Data\vlc
2010-05-06 10:41 . 2004-08-26 16:12 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 05:22 . 2004-08-26 16:12 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-04-30 23:05 . 2008-07-24 04:56 68008 ---ha-w- c:\windows\system32\mlfcache.dat
2010-04-29 22:39 . 2009-10-17 19:49 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 22:39 . 2009-10-17 19:49 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-27 18:40 . 2008-10-05 21:21 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys
2010-04-27 18:40 . 2008-10-05 21:21 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys
2010-04-27 18:40 . 2008-10-05 21:21 45648 ------w- c:\windows\system32\drivers\PxHelp20.sys
2010-04-27 18:40 . 2008-10-05 21:21 133616 ------w- c:\windows\system32\pxafs.dll
2010-04-27 18:40 . 2008-10-05 21:21 126448 ------w- c:\windows\system32\pxinsi64.exe
2010-04-27 18:40 . 2008-10-05 21:21 123888 ------w- c:\windows\system32\pxcpyi64.exe
2010-04-20 05:30 . 2004-08-26 16:11 285696 ----a-w- c:\windows\system32\atmfd.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{474597C5-AB09-49d6-A4D5-2E8D7341384E}]
2008-09-02 14:04 398768 ----a-w- c:\program files\iMesh Applications\iMesh MediaBar\iMeshIEHelper.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-17 490952]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 52\axcmd.exe" [2009-03-17 203416]
"Google Update"="c:\documents and settings\Jinn\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-03 133104]
"Octoshape Streaming Services"="c:\documents and settings\Jinn\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" [2009-01-08 70936]
"Rainlendar2"="c:\program files\Rainlendar2\Rainlendar2.exe" [2009-08-22 5148672]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-19 7700480]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2009-08-06 647520]
"VX1000"="c:\windows\vVX1000.exe" [2007-04-10 709992]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-13 642856]
"nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2009-06-19 467240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-13 141600]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"nwiz"="nwiz.exe" [2007-04-19 1626112]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2008-07-19 03:34 210168 ----a-w- c:\program files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"g:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"g:\\Documents and Settings\\Owner\\My Documents\\New Folder (2)\\Age Of Empires 2 & The Conquerors Expansion - Full Game - [HUSSEY]\\age2_x1.exe"=
"g:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"g:\\Program Files\\Warcraft III\\War3.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [10/16/2009 10:43 PM 207280]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [4/28/2009 10:14 PM 135336]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [10/16/2009 10:51 PM 112592]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [3/6/2009 7:39 PM 24652]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [11/22/2008 1:53 PM 23064]
S3 dump_wmimmc;dump_wmimmc;\??\c:\program files\softnyx\GunboundWC\GameGuard\dump_wmimmc.sys --> c:\program files\softnyx\GunboundWC\GameGuard\dump_wmimmc.sys [?]
S3 mcdevice;mcdevice;c:\windows\system32\drivers\mcdevice.sys [2/17/2009 6:47 PM 324096]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [7/18/2008 4:35 PM 717296]
.
Contents of the 'Scheduled Tasks' folder

2010-07-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 20:34]

2010-07-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-855283335-3023275888-2970118667-1007Core.job
- c:\documents and settings\Jinn\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 20:09]

2010-07-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-855283335-3023275888-2970118667-1007UA.job
- c:\documents and settings\Jinn\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 20:09]

2010-07-07 c:\windows\Tasks\User_Feed_Synchronization-{DF8FCBF6-0405-4831-B39A-A74E0EECCFAD}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 11:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.rr.com/
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
uInternet Settings,ProxyOverride =
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: ʹÓÃUUSee¼ÓËÙ²¥·Å - c:\program files\uusee\geturltoplay.htm
IE: ʹÓÃUUSeeÏÂÔØ - c:\program files\uusee\geturltodown.htm
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Owner\Start Menu\Programs\IMVU\Run IMVU.lnk
DPF: {8EEB54D5-CC70-40E4-B015-AC478C02ECC8} - hxxp://playple.com/viewer/cab/SLViewer.cab
FF - ProfilePath - c:\documents and settings\Jinn\Application Data\Mozilla\Firefox\Profiles\febeprof.Jinn\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2442061&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2442061&SearchSource=13
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2442061&q=
FF - component: c:\documents and settings\Jinn\Application Data\Mozilla\Firefox\Profiles\febeprof.Jinn\extensions\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Jinn\Application Data\Mozilla\Firefox\Profiles\febeprof.Jinn\extensions\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}\components\RadioWMPCore.dll
FF - component: c:\documents and settings\Jinn\Application Data\Mozilla\Firefox\Profiles\febeprof.Jinn\extensions\{f6f53201-ac60-4790-b385-405df25c4335}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Jinn\Application Data\Mozilla\Firefox\Profiles\febeprof.Jinn\extensions\{f6f53201-ac60-4790-b385-405df25c4335}\components\RadioWMPCore.dll
FF - plugin: c:\documents and settings\Jinn\Application Data\Move Networks\plugins\npqmp071503000010.dll
FF - plugin: c:\documents and settings\Jinn\Application Data\Mozilla\plugins\npoctoshape.dll
FF - plugin: c:\documents and settings\Jinn\Local Settings\Application Data\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\documents and settings\Owner\Application Data\Move Networks\plugins\npqmp071500000347.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPGomtvx_nie.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Opera\program\plugins\nppl3260.dll
FF - plugin: c:\program files\Opera\program\plugins\nprpjplug.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - falsec:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{2C84C589-6EF0-4670-8E67-D2B37567DDFF} - (no file)
HKLM-Run-Winwall - c:\program files\Winwall\Loader.exe
AddRemove-Fallout Mod Manager_is1 - g:\games\Fallout 3\fomm\uninstall\unins000.exe
AddRemove-HijackThis - c:\documents and settings\Jinn\Desktop\HijackThis.exe
AddRemove-The Longest Journey - c:\windows\uninst.exe
AddRemove-yTimer_is1 - c:\documents and settings\Jinn\My Documents\yTimer\unins000.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe
AddRemove-Octoshape add-in for Adobe Flash Player - c:\documents and settings\Jinn\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-07 16:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\documents and settings\Jinn\Application Data\Mozilla\Firefox\Profiles\febeprof.Jinn\pluginreg.dat.bak 11723 bytes
c:\documents and settings\Jinn\Application Data\Mozilla\Firefox\Profiles\febeprof.Jinn\prefs.js.BAK 32274 bytes
c:\documents and settings\Jinn\Application Data\Mozilla\Firefox\Profiles\febeprof.Jinn\user.js.BAK 68 bytes

scan completed successfully
hidden files: 3

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-855283335-3023275888-2970118667-1007\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:c9,2e,e5,42,28,a0,a3,5a,3b,ed,43,e3,92,7d,8b,92,95,e3,c9,0b,c1,af,2a,
ca,d7,96,ea,86,f0,26,74,cf,58,c5,aa,8b,80,96,85,67,5a,99,3a,3d,f6,69,f8,e1,\
"??"=hex:79,a0,a2,e6,2b,5a,42,dd,09,bf,5c,f7,bb,e4,7c,27

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):f5,d8,b3,2a,bd,13,32,ec,a0,64,45,3b,42,4e,e1,1d,03,61,4c,a9,6b,
83,ec,76,6e,14,8d,ad,4c,5f,48,cf,65,6a,c3,e6,99,11,ad,11,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{badb92d3-93db-45f0-b048-4a0c29f314c5}]
@Denied: (Full) (Everyone)
"Model"=dword:00000079
"Therad"=dword:00000024
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,ab,9e,50,1b,eb,77,d1,ab,df,61,9e,85,e7,1f,1b,8d,83,e0,8b,c5,07,bb,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(844)
c:\program files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll

- - - - - - - > 'explorer.exe'(1608)
c:\windows\system32\WININET.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Stardock\Object Desktop\WindowBlinds\tray.dll
c:\program files\Microsoft Virtual PC\VPCShExH.DLL
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-07-07 16:47:20 - machine was rebooted
ComboFix-quarantined-files.txt 2010-07-07 23:47

Pre-Run: 20,725,542,912 bytes free
Post-Run: 21,091,471,360 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 4ED8C24D68C9F136CD96D56FEE44B829

Hi,

Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan

• Tick the box next to YES, I accept the Terms of Use
  
• Click Start
  
• When asked, allow the ActiveX control to install
  
• Click Start
  
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  
• Click Scan (This scan can take several hours, so please be patient)
  
• Once the scan is completed, you may close the window
  
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  
• Copy and paste that log as a reply to this topic
  

=========

You have or had what has been identified as a flash drive infection.

Please download Flash_Disinfector from HERE

• First, download it to your desktop.
  
• Now double click it to run it and will tell it you what to do when you open it.
  
• It will temporarily kill explorer.exe and your desktop will go blank.
  
• Let Flash_Disinfector do it's job and it will restart explorer.exe for you.
  
• It will make a dummy autorun.inf in the root of every drive.
  
• You can now delete Flash_Disinfector.exe.
  

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=ff18b888d126dd469403ea50e26d5fbb
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-07-08 04:00:30
# local_time=2010-07-07 09:00:30 (-0800, Pacific Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=768 16777215 100 0 60757806 60757806 0 0
# compatibility_mode=1797 16775125 100 100 149723 45128324 142797 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=361899
# found=8
# cleaned=8
# scan_time=14034
C:\Documents and Settings\Jinn\Desktop\Short Cuts\Chaoslauncher\wmode.bwl probably a variant of Win32/Agent trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Owner\My Documents\Downloads\MyFunCardsSetup2.3.50.57.SA.HP.ZUfox000.exe a variant of Win32/Toolbar.MyWebSearch.L application (deleted - quarantined) 00000000000000000000000000000000 C
C:\Program Files\Windows Live\Messenger\msimg32.dll Win32/Toolbar.MyWebSearch application (cleaned by deleting (after the next restart) - quarantined) 00000000000000000000000000000000 C
C:\Program Files\Windows Live\Messenger\riched20.dll Win32/Toolbar.MyWebSearch application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\swupdate.dll.vir Win32/Chksyn.AB trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\_OTL\MovedFiles\07062010_103719\C_Documents and Settings\Jinn\Local Settings\Application Data\dqcjiewen\efnaiwktssd.exe Win32/Adware.SpywareProtect2009 application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
G:\Documents and Settings\Owner\Application Data\Opera\Opera\profile\cache4\opr0Z9UD.html HTML/Iframe.B.Gen virus (deleted - quarantined) 00000000000000000000000000000000 C
G:\Program Files\Starcraft\Plugins\wmode.bwl probably a variant of Win32/Agent trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

That should do it right?

Hi,

Your computer is now clean. Now, time to remove the tools used, and update your computer to prevent vulnerability.

Updating System Restore
Now to get you off to a good start we will clean your restore points so that all the bad stuff is gone for good. Then if you need to restore at some stage you will be clean. There are several ways to reset your restore points, but this is my method:

• Select Start > All Programs > Accessories > System tools > System Restore.
  
• On the dialogue box that appears select Create a Restore Point
  
• Click NEXT
  
• Enter a name e.g. Clean
  
• Click CREATE.

You now have a clean restore point.

To get rid of the bad ones:

• Select Start > All Programs > Accessories > System tools > Disk Cleanup.
  
• In the Drop down box that appears select your main drive e.g. C
  
• Click OK
  
• The System will do a calculation of temporary/old files, and then display a dialogue box.
  
• Select the More Options Tab.
  
• At the bottom will be a System Restore box with a CLEANUP button click this
  
• Accept the Warning and select OK again, the program will close and you are done.

=======

Removing the tools
Now, to remove all of the tools we used and the files and folders they created, please do the following:

Download OTC.exe by OldTimer:

• Save it to your Desktop.
  
• Double click OTC.exe.
  
• Click the CleanUp! button.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes.
  Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

=======

Update Programs
Please download the newest version of Adobe Acrobat Reader from Adobe.com

Before installing: it is important to remove older versions of Acrobat Reader since it does not do so automatically and old versions still leave you vulnerable.
Go to the Control Panel and enter Add or Remove Programs.
Search in the list for all previous installed versions of Adobe Acrobat Reader. Uninstall/Remove each of them.

Once old versions are gone, please install the newest version.



Please download the newest version of Java from Java.com.

Before installing: it is important to remove older versions of Java since it does not do so automatically and old versions still leave you vulnerable.
Go to the Control Panel and enter Add or Remove Programs.
Search in the list for all previous installed versions of Java (J2SE Runtime Environment). Please uninstall/remove each of them.

Once old versions are gone, please install the newest version.

======

Here are some prevention tips I have provided:

1. Don't download files from untrusted websites or websites that seem suspious.

2. Don't use torrents they are a good way to get lots of malware.

3. Don't download and use cracks/warez/keygens they are illegal and are another good way to contract malware.

4. Disable autorun XP or Vista/7

5. Always make sure you have the latest Windows updates. windowsupdate.microsoft.com

6. Don't ever click on the links inside of a popup.

7. Make sure you know what you install you can make sure it is not know for being a virus by just simply searching about it on google.

8. Use a Site Advisor so you don't go to sites that will infect you. Mcafee Siteadvisor

9. Also there are many holes and flaws in Internet Explorer I recommend using Firefox 3 to keep you more safe.

10. Always keep your Java and Adobe updated.

11. Don't fall for the Scareware. What is Scareware? it is a website made to download a rogue Antivirus on your system that will scare you into buying their fake software due to false detections.

12. Always have a Firewall and a Antivirus.

Thanks for choosing GeekPolice, see this page if you would like to leave feedback or contribute to our site. Do you have any more questions?

For more information please visit Here