virus and shutdown?

hi please can you help, my pc has been having problems shutting down/starting up, and sometimes in this process i recieve a memory error. i think its a virus. log file here, thanks in advance x


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:09:41, on 02/08/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18928)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Program Files\WTouch\WTouchUser.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\WTablet\Pen_TabletUser.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\Common Files\AOL\1206467242\ee\aolsoftware.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\AOL 9.0 VRa\waol.exe
C:\Program Files\AOL 9.0 VRa\shellmon.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Common Files\AOL\Topspeed\3.0\aoltpsd3.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZone.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll
O2 - BHO: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZone.dll
O2 - BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Nero Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZone.dll
O3 - Toolbar: ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1206467242\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix:
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - https://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: @C:\Program Files\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files\Nero\Update\NASvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Windows\system32\Pen_Tablet.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe
O23 - Service: WTouch Service (WTouchService) - Wacom Technology, Corp. - C:\Program Files\WTouch\WTouchService.exe

--
End of file - 9707 bytes

Hello.

Download OTL by OldTimer to your Desktop.

• Close all windows and double click OTL.exe
  
• Click Run Scan and let the program run uninterrupted
  
• It will produce two logs for you, one will pop up - OTL.txt, the other will be saved on your Desktop - Extras.txt. Post both logs in this thread.
  
• You may need to use two posts to get it all.
  

right done that 1st one is OTL.txt

OTL logfile created on: 02/08/2010 22:33:08 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = M:\
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 63.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 325.13 Gb Total Space | 56.37 Gb Free Space | 17.34% Space Free | Partition Type: NTFS
Drive D: | 10.22 Gb Total Space | 1.05 Gb Free Space | 10.26% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
Drive F: | 7.63 Gb Total Space | 7.46 Gb Free Space | 97.80% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive L: | 232.83 Gb Total Space | 21.46 Gb Free Space | 9.22% Space Free | Partition Type: FAT32
Drive M: | 931.51 Gb Total Space | 576.20 Gb Free Space | 61.86% Space Free | Partition Type: NTFS

Computer Name: STRIDER-PC
Current User Name: strider
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/08/02 22:32:23 | 000,574,976 | ---- | M] (OldTimer Tools) -- M:\OTL.exe
PRC - [2010/06/23 13:52:56 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) -- C:\Windows\System32\ZoneLabs\vsmon.exe
PRC - [2010/06/23 13:51:30 | 001,043,968 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2010/05/26 14:35:18 | 000,493,032 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe
PRC - [2010/05/26 14:35:14 | 000,730,600 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
PRC - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Update\NASvc.exe
PRC - [2009/08/18 11:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2009/08/18 11:29:22 | 000,183,152 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2009/07/15 17:13:06 | 003,662,632 | ---- | M] (Wacom Technology, Corp.) -- C:\Program Files\WTouch\WTouchUser.exe
PRC - [2009/07/15 17:13:04 | 000,393,512 | ---- | M] (Wacom Technology, Corp.) -- C:\Windows\System32\WTablet\Pen_TabletUser.exe
PRC - [2009/07/15 17:13:04 | 000,112,936 | ---- | M] (Wacom Technology, Corp.) -- C:\Program Files\WTouch\WTouchService.exe
PRC - [2009/07/15 17:13:02 | 004,408,616 | ---- | M] (Wacom Technology, Corp.) -- C:\Windows\System32\Pen_Tablet.exe
PRC - [2009/04/11 07:28:15 | 000,244,224 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wisptis.exe
PRC - [2009/04/11 07:28:06 | 000,304,128 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
PRC - [2009/04/11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/01/19 08:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2008/01/19 08:33:12 | 000,198,656 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
PRC - [2007/06/05 14:20:32 | 000,177,704 | ---- | M] () -- C:\Windows\System32\PSIService.exe
PRC - [2006/11/14 15:01:21 | 000,050,736 | ---- | M] (America Online, Inc.) -- C:\Program Files\Common Files\AOL\1206467242\ee\aolsoftware.exe
PRC - [2006/11/02 13:35:35 | 000,176,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wpcumi.exe
PRC - [2006/10/23 13:50:35 | 000,046,640 | R--- | M] (AOL LLC) -- C:\Program Files\Common Files\AOL\acs\AOLacsd.exe


========== Modules (SafeList) ==========

MOD - [2010/08/02 22:32:23 | 000,574,976 | ---- | M] (OldTimer Tools) -- M:\OTL.exe
MOD - [2010/05/26 14:35:24 | 000,640,488 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
MOD - [2010/05/12 23:52:20 | 000,632,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d08d7da0442a985d\msvcr80.dll
MOD - [2010/05/12 23:52:20 | 000,554,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d08d7da0442a985d\msvcp80.dll
MOD - [2009/04/11 07:28:24 | 000,380,416 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll
MOD - [2009/04/11 07:21:38 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll
MOD - [2008/01/19 08:33:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - [2010/06/29 11:53:44 | 002,561,624 | ---- | M] () [Auto | Running] -- c:\Program Files\Common Files\Akamai\rswin_3725.dll -- (Akamai)
SRV - [2010/06/23 13:52:56 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\Windows\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2010/05/26 14:35:18 | 000,493,032 | ---- | M] (Check Point Software Technologies) [Auto | Running] -- C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe -- (IswSvc)
SRV - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010/03/18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009/09/25 02:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009/08/18 11:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009/07/15 17:13:04 | 000,112,936 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Program Files\WTouch\WTouchService.exe -- (WTouchService)
SRV - [2009/07/15 17:13:02 | 004,408,616 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Windows\System32\Pen_Tablet.exe -- (TabletServicePen)
SRV - [2008/09/11 20:11:11 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008/01/19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/06/05 14:20:32 | 000,177,704 | ---- | M] () [Auto | Running] -- C:\Windows\System32\PSIService.exe -- (ProtexisLicensing)
SRV - [2006/10/23 13:50:35 | 000,046,640 | R--- | M] (AOL LLC) [Auto | Running] -- C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe -- (AOL ACS)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vsdatant.win7.sys -- (vsdatant7)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\UIUSYS.SYS -- (UIUSys)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2010/07/14 01:35:31 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/05/26 14:35:10 | 000,026,352 | ---- | M] (Check Point Software Technologies) [Kernel | Auto | Running] -- C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys -- (ISWKL)
DRV - [2010/05/15 16:30:46 | 000,457,304 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\Windows\System32\drivers\vsdatant.sys -- (Vsdatant)
DRV - [2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2010/04/19 18:21:44 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV)
DRV - [2010/04/19 18:21:44 | 000,012,872 | ---- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)
DRV - [2009/05/20 23:14:32 | 000,013,224 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WacomVTHid.sys -- (WacomVTHid)
DRV - [2009/05/20 20:54:06 | 000,013,736 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wacomvhid.sys -- (wacomvhid)
DRV - [2009/04/11 05:42:54 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2009/01/30 22:29:50 | 000,015,656 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\wacmoumonitor.sys -- (wacmoumonitor)
DRV - [2008/01/19 06:53:31 | 000,045,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\61883.sys -- (61883)
DRV - [2008/01/19 06:53:31 | 000,040,448 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\avc.sys -- (Avc)
DRV - [2008/01/19 06:53:28 | 000,052,608 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\msdv.sys -- (MSDV)
DRV - [2008/01/15 19:19:04 | 002,047,576 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007/10/26 12:51:22 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\nvstor32.sys -- (nvstor32)
DRV - [2007/09/13 02:35:54 | 000,025,760 | ---- | M] (PC-Doctor, Inc.) [Kernel | On_Demand | Stopped] -- C:\Program Files\PC-Doctor 5 for Windows\pcd5srvc.pkms -- (PCD5SRVC{BD6912E3-AC9D80E8-05040000})
DRV - [2007/09/10 21:17:40 | 001,035,168 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2007/07/07 02:45:00 | 007,568,832 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007/02/16 20:12:36 | 000,011,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wacommousefilter.sys -- (wacommousefilter)
DRV - [2007/02/16 01:11:28 | 000,011,440 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WacomVKHid.sys -- (WacomVKHid)
DRV - [2006/11/02 10:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 10:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 10:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 10:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 10:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2006/11/02 10:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 10:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 10:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 10:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 10:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 10:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 10:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2006/11/02 10:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 10:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 10:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2006/11/02 10:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 10:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 10:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 10:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 10:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2006/11/02 10:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 10:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 10:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 10:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 10:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 10:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 10:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 10:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 10:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 10:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 10:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2006/11/02 10:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2006/11/02 10:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2006/11/02 09:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 09:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 09:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 09:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 09:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 09:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 08:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 08:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2006/11/01 21:18:15 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2006/05/08 18:24:24 | 000,391,688 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbVM305.sys -- (ZSMC0305)
DRV - [2005/12/12 18:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\PS2.sys -- (Ps2)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZone.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 10 FB 94 E7 76 2F CB 01 [binary data]
IE - HKCU\..\URLSearchHook: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZone.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010/05/13 00:03:21 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2010/07/30 23:13:04 | 000,000,000 | ---D | M]


O1 HOSTS File: ([2010/05/13 01:15:30 | 000,000,797 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O2 - BHO: (ZoneAlarm Toolbar) - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZone.dll (Conduit Ltd.)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O2 - BHO: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
O2 - BHO: (Search Assistant) - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll (MTWB)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O3 - HKLM\..\Toolbar: (ZoneAlarm Toolbar) - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZone.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Toolbar) - {66F2E20D-0DA8-4C11-A9C8-DD8477B88ACD} - C:\Program Files\ZoneAlarm\tbZone.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\AOL\1206467242\ee\aolsoftware.exe (America Online, Inc.)
O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} http://www.ipix.com/viewers/ipixx.cab (iPIX ActiveX Control)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} https://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Users\strider\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\strider\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/11/30 18:04:19 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{29c9826e-9987-11de-8d4b-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{29c9826e-9987-11de-8d4b-00038a000015}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found
O33 - MountPoints2\{f83cc45f-4550-11df-8795-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{f83cc45f-4550-11df-8795-00038a000015}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -- File not found
O33 - MountPoints2\J\Shell - "" = Autorun
O33 - MountPoints2\J\Shell\Open\command - "" = ._autorun.inf -- [2009/09/20 12:18:05 | 000,000,082 | -HS- | M] ()
O33 - MountPoints2\K\Shell - "" = Autorun
O33 - MountPoints2\K\Shell\Open\command - "" = ._autorun.inf -- [2009/09/20 12:18:05 | 000,000,082 | -HS- | M] ()
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/08/01 17:14:52 | 000,000,000 | ---D | C] -- C:\Users\strider\Documents\DSC02113
[2010/07/31 17:21:40 | 000,000,000 | ---D | C] -- C:\Users\strider\Documents\DSC02056
[2010/07/30 22:50:11 | 000,000,000 | ---D | C] -- C:\Users\strider\Documents\ForceField Shared Files
[2010/07/30 22:50:09 | 000,000,000 | ---D | C] -- C:\Users\strider\AppData\Roaming\CheckPoint
[2010/07/30 22:49:35 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit
[2010/07/30 22:49:33 | 000,000,000 | ---D | C] -- C:\Program Files\ZoneAlarm
[2010/07/30 22:49:23 | 000,000,000 | ---D | C] -- C:\Program Files\CheckPoint
[2010/07/30 22:49:15 | 000,058,368 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\vsregexp.dll
[2010/07/30 22:49:00 | 000,221,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\netio.sys
[2010/07/30 22:48:40 | 000,103,936 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\zlcommdb.dll
[2010/07/30 22:48:39 | 000,069,120 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\zlcomm.dll
[2010/07/30 22:48:34 | 000,043,008 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\vswmi.dll
[2010/07/30 22:48:29 | 001,238,528 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\zpeng25.dll
[2010/07/30 22:48:29 | 000,110,080 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\vsxml.dll
[2010/07/30 22:48:27 | 000,302,592 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\vspubapi.dll
[2010/07/30 22:48:26 | 000,108,032 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\vsmonapi.dll
[2010/07/30 22:48:25 | 000,112,128 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\vsdata.dll
[2010/07/30 22:48:22 | 000,457,304 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\drivers\vsdatant.sys
[2010/07/30 22:48:22 | 000,000,000 | ---D | C] -- C:\Windows\System32\ZoneLabs
[2010/07/30 22:48:21 | 000,000,000 | ---D | C] -- C:\Program Files\Zone Labs
[2010/07/30 22:47:56 | 000,000,000 | ---D | C] -- C:\Windows\Internet Logs
[2010/07/30 22:47:56 | 000,000,000 | ---D | C] -- C:\ProgramData\CheckPoint
[2010/07/30 22:47:55 | 000,713,728 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\vsutil.dll
[2010/07/30 22:47:55 | 000,228,864 | ---- | C] (Check Point Software Technologies LTD) -- C:\Windows\System32\vsinit.dll
[2010/07/28 16:58:55 | 000,000,000 | ---D | C] -- C:\Users\strider\Documents\MissingM
[2010/07/28 13:07:09 | 000,000,000 | ---D | C] -- C:\Users\strider\Documents\CharityAuctionLetter
[2010/07/24 21:59:24 | 000,000,000 | ---D | C] -- C:\Users\strider\AppData\Roaming\Nero
[2010/07/24 21:57:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Nero
[2010/07/24 21:57:44 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Nero
[2010/07/24 21:57:15 | 000,000,000 | ---D | C] -- C:\Program Files\Nero
[2010/07/24 21:26:32 | 000,000,000 | ---D | C] -- C:\Users\strider\AppData\Local\AskToolbar
[2010/07/24 21:09:31 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
[2010/07/24 16:09:17 | 000,000,000 | ---D | C] -- C:\Users\strider\Documents\Any Video Converter
[2010/07/24 16:09:11 | 000,000,000 | ---D | C] -- C:\Users\strider\AppData\Roaming\AnvSoft
[2010/07/24 16:09:09 | 000,000,000 | ---D | C] -- C:\Program Files\AnvSoft
[2010/07/24 15:40:35 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrent
[2010/07/24 15:39:51 | 000,000,000 | ---D | C] -- C:\Users\strider\AppData\Roaming\uTorrent
[2010/07/18 09:05:59 | 000,000,000 | ---D | C] -- C:\Users\strider\Documents\xix
[2010/07/06 10:31:13 | 000,000,000 | ---D | C] -- C:\Users\strider\Documents\duringthediet
[4 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/08/02 22:34:10 | 004,718,592 | -HS- | M] () -- C:\Users\strider\ntuser.dat
[2010/08/02 22:29:59 | 000,000,418 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{536220E9-C4F9-4DAC-9509-9B60EC2758BC}.job
[2010/08/02 22:27:14 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/08/02 22:27:14 | 000,000,416 | ---- | M] () -- C:\Windows\tasks\PCConfidential.job
[2010/08/02 22:27:14 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/08/02 22:27:08 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/08/02 22:27:08 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/08/02 22:27:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/08/02 22:25:35 | 000,524,288 | -HS- | M] () -- C:\Users\strider\ntuser.dat{7ae5f341-9af4-11df-94d5-00038a000015}.TMContainer00000000000000000001.regtrans-ms
[2010/08/02 22:25:35 | 000,065,536 | -HS- | M] () -- C:\Users\strider\ntuser.dat{7ae5f341-9af4-11df-94d5-00038a000015}.TM.blf
[2010/08/02 22:25:13 | 002,636,885 | -H-- | M] () -- C:\Users\strider\AppData\Local\IconCache.db
[2010/08/02 21:59:00 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/08/02 18:00:00 | 000,000,446 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Registration.job
[2010/08/02 13:00:54 | 181,398,722 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010/08/01 17:14:52 | 005,507,144 | ---- | M] () -- C:\Users\strider\Documents\DSC02113.zip
[2010/07/31 17:25:47 | 002,362,591 | ---- | M] () -- C:\Users\strider\Documents\DSC02054.jpg
[2010/07/31 17:21:40 | 006,423,474 | ---- | M] () -- C:\Users\strider\Documents\DSC02056.zip
[2010/07/31 00:33:02 | 000,000,420 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Update Version2.job
[2010/07/30 22:50:44 | 000,421,442 | -H-- | M] () -- C:\Windows\System32\drivers\vsconfig.xml
[2010/07/30 22:49:18 | 000,000,873 | ---- | M] () -- C:\Users\strider\Desktop\ZoneAlarm Security.lnk
[2010/07/30 22:43:47 | 000,007,191 | ---- | M] () -- C:\ProgramData\N360BUOptions.ini
[2010/07/30 04:32:51 | 000,524,288 | -HS- | M] () -- C:\Users\strider\ntuser.dat{7ae5f341-9af4-11df-94d5-00038a000015}.TMContainer00000000000000000002.regtrans-ms
[2010/07/30 00:33:02 | 000,059,392 | ---- | M] () -- C:\Users\strider\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/29 11:00:46 | 000,001,973 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2010/07/28 16:58:55 | 000,212,586 | ---- | M] () -- C:\Users\strider\Documents\MissingM.zip
[2010/07/28 13:07:09 | 000,006,759 | ---- | M] () -- C:\Users\strider\Documents\CharityAuctionLetter.zip
[2010/07/28 04:41:31 | 000,524,288 | -HS- | M] () -- C:\Users\strider\ntuser.dat{5d7f84b4-ba08-11de-8cb3-00038a000015}.TMContainer00000000000000000001.regtrans-ms
[2010/07/28 04:41:31 | 000,065,536 | -HS- | M] () -- C:\Users\strider\ntuser.dat{5d7f84b4-ba08-11de-8cb3-00038a000015}.TM.blf
[2010/07/24 21:58:02 | 000,002,130 | ---- | M] () -- C:\Users\Public\Desktop\Nero BurnLite 10.lnk
[2010/07/24 16:09:13 | 000,000,941 | ---- | M] () -- C:\Users\strider\Desktop\Any Video Converter.lnk
[2010/07/24 15:40:36 | 000,000,754 | ---- | M] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2010/07/24 09:48:35 | 000,703,388 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/07/24 09:48:35 | 000,608,760 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/07/24 09:48:35 | 000,108,268 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/07/18 09:05:59 | 000,445,903 | ---- | M] () -- C:\Users\strider\Documents\xix.zip
[2010/07/13 01:58:20 | 000,015,756 | ---- | M] () -- C:\Users\strider\AppData\Roaming\wklnhst.dat
[2010/07/10 19:26:40 | 000,001,010 | ---- | M] () -- C:\Users\strider\Desktop\Adobe Photoshop CS3.lnk
[2010/07/10 12:54:10 | 000,002,627 | ---- | M] () -- C:\Users\strider\Desktop\Microsoft Office Word 2007.lnk
[2010/07/09 10:23:01 | 000,000,807 | ---- | M] () -- C:\Users\strider\Desktop\GameSpy Arcade.lnk
[2010/07/06 23:38:51 | 000,039,016 | ---- | M] () -- C:\Users\strider\Documents\diego.jpg
[2010/07/06 10:31:13 | 003,782,513 | ---- | M] () -- C:\Users\strider\Documents\duringthediet.zip
[2010/07/05 23:49:51 | 000,005,068 | ---- | M] () -- C:\Users\strider\Documents\cc_20100705_234944.reg
[4 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/08/01 17:13:58 | 005,507,144 | ---- | C] () -- C:\Users\strider\Documents\DSC02113.zip
[2010/07/31 17:25:24 | 002,362,591 | ---- | C] () -- C:\Users\strider\Documents\DSC02054.jpg
[2010/07/31 17:20:37 | 006,423,474 | ---- | C] () -- C:\Users\strider\Documents\DSC02056.zip
[2010/07/30 22:49:18 | 000,000,873 | ---- | C] () -- C:\Users\strider\Desktop\ZoneAlarm Security.lnk
[2010/07/30 22:48:22 | 000,421,442 | -H-- | C] () -- C:\Windows\System32\drivers\vsconfig.xml
[2010/07/30 22:43:47 | 000,007,191 | ---- | C] () -- C:\ProgramData\N360BUOptions.ini
[2010/07/29 10:35:00 | 000,524,288 | -HS- | C] () -- C:\Users\strider\ntuser.dat{7ae5f341-9af4-11df-94d5-00038a000015}.TMContainer00000000000000000002.regtrans-ms
[2010/07/29 10:35:00 | 000,524,288 | -HS- | C] () -- C:\Users\strider\ntuser.dat{7ae5f341-9af4-11df-94d5-00038a000015}.TMContainer00000000000000000001.regtrans-ms
[2010/07/29 10:35:00 | 000,065,536 | -HS- | C] () -- C:\Users\strider\ntuser.dat{7ae5f341-9af4-11df-94d5-00038a000015}.TM.blf
[2010/07/28 16:58:52 | 000,212,586 | ---- | C] () -- C:\Users\strider\Documents\MissingM.zip
[2010/07/28 13:07:08 | 000,006,759 | ---- | C] () -- C:\Users\strider\Documents\CharityAuctionLetter.zip
[2010/07/24 21:58:02 | 000,002,130 | ---- | C] () -- C:\Users\Public\Desktop\Nero BurnLite 10.lnk
[2010/07/24 16:09:13 | 000,000,941 | ---- | C] () -- C:\Users\strider\Desktop\Any Video Converter.lnk
[2010/07/24 15:40:36 | 000,000,754 | ---- | C] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2010/07/18 09:05:54 | 000,445,903 | ---- | C] () -- C:\Users\strider\Documents\xix.zip
[2010/07/14 01:31:53 | 181,398,722 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010/07/10 19:26:40 | 000,001,010 | ---- | C] () -- C:\Users\strider\Desktop\Adobe Photoshop CS3.lnk
[2010/07/06 23:38:50 | 000,039,016 | ---- | C] () -- C:\Users\strider\Documents\diego.jpg
[2010/07/06 10:30:41 | 003,782,513 | ---- | C] () -- C:\Users\strider\Documents\duringthediet.zip
[2010/07/05 23:49:46 | 000,005,068 | ---- | C] () -- C:\Users\strider\Documents\cc_20100705_234944.reg
[2010/05/17 14:03:21 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
[2010/05/17 14:03:21 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
[2010/05/17 14:03:21 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
[2010/05/17 13:44:13 | 000,000,218 | ---- | C] () -- C:\Windows\SIERRA.INI
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/08/01 01:09:06 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/04/11 00:29:53 | 000,008,574 | ---- | C] () -- C:\Windows\trans.ini
[2009/04/11 00:29:53 | 000,000,065 | ---- | C] () -- C:\Windows\MALTI.INI
[2009/04/02 15:21:50 | 000,084,480 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009/02/12 04:04:24 | 000,000,118 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2008/12/07 14:08:04 | 000,130,048 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2008/09/12 16:21:02 | 000,000,547 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll.manifest
[2008/08/02 16:38:38 | 002,463,976 | ---- | C] () -- C:\Windows\System32\NPSWF32.dll
[2008/04/27 10:33:36 | 000,765,952 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2008/03/28 15:45:23 | 000,000,168 | RHS- | C] () -- C:\Windows\System32\7D9B0BEDEE.sys
[2008/03/28 15:38:54 | 000,002,516 | -HS- | C] () -- C:\Windows\System32\KGyGaAvL.sys
[2008/03/25 18:38:09 | 000,000,010 | ---- | C] () -- C:\Windows\msoffice.ini
[2007/11/30 17:41:28 | 000,327,680 | ---- | C] () -- C:\Windows\System32\pythoncom25.dll
[2007/11/30 17:41:28 | 000,102,400 | ---- | C] () -- C:\Windows\System32\pywintypes25.dll
[2007/09/04 12:56:10 | 000,164,352 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2007/02/05 20:05:26 | 000,000,038 | ---- | C] () -- C:\Windows\AviSplitter.INI
[2006/11/02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
< End of report >

2nd here extras.txt

OTL Extras logfile created on: 02/08/2010 22:33:08 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = M:\
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 63.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 325.13 Gb Total Space | 56.37 Gb Free Space | 17.34% Space Free | Partition Type: NTFS
Drive D: | 10.22 Gb Total Space | 1.05 Gb Free Space | 10.26% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
Drive F: | 7.63 Gb Total Space | 7.46 Gb Free Space | 97.80% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive L: | 232.83 Gb Total Space | 21.46 Gb Free Space | 9.22% Space Free | Partition Type: FAT32
Drive M: | 931.51 Gb Total Space | 576.20 Gb Free Space | 61.86% Space Free | Partition Type: NTFS

Computer Name: STRIDER-PC
Current User Name: strider
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.pif [@ = piffile] -- "%1" %*"
.scr [@ = Reg Error: Key error.] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*"
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- Reg Error: Key error.
scrfile [install] -- Reg Error: Key error.
scrfile [open] -- Reg Error: Key error.
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [JESSOPS] -- "C:\Program Files\jessops\JESSOPS\JESSOPS.exe" "%1" ()
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0414E89A-7F9B-4871-BF1F-C2D5159EB79D}" = lport=554 | protocol=6 | dir=in | app=c:\windows\ehome\ehshell.exe |
"{096D837F-5D41-4D42-B296-031324C2AC6E}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{09F0A04A-B481-46E8-BF5F-14707E5C51A7}" = rport=10244 | protocol=6 | dir=out | app=system |
"{0A5DB26B-EC10-46EA-A2A3-47A57EA2F37C}" = lport=2869 | protocol=6 | dir=in | app=system |
"{0AE80A10-EF15-48D4-9A93-1FE3DF66F0A3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{11001085-7D78-45D5-8589-45CF10F79718}" = lport=137 | protocol=17 | dir=in | app=system |
"{181E5231-555C-4445-9A83-9E4009534F66}" = lport=49161 | protocol=6 | dir=in | name=akamai netsession interface |
"{1E6E2770-9D88-4EA8-83F9-CB896C6461F7}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{1F7E3FF1-69E2-4117-91FA-63D0D7EF99B3}" = lport=2178 | protocol=6 | dir=in | app=system |
"{205C94DB-3EA4-486F-9BF0-7E4F12F1F47D}" = lport=10244 | protocol=6 | dir=in | app=system |
"{24F0EEBE-5A11-41E4-909C-10B210499AA0}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{2644CA6D-41A4-46A3-AE3B-90BB52652EB4}" = rport=5357 | protocol=6 | dir=out | app=system |
"{2B94B458-978A-452D-A3CA-8A0053936CCD}" = rport=138 | protocol=17 | dir=out | app=system |
"{420A1950-F70E-4D33-9531-B106831DAB45}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{485061B5-E5ED-43AB-AA0B-5A87D3296DAE}" = lport=135 | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{48A3F9D3-4B28-4830-9400-CF7DE6E574BF}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{49776945-7159-4598-8D9C-7FA06E782D2B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{4ABDB450-A0E4-4148-9E26-11BC766DFDD7}" = rport=445 | protocol=6 | dir=out | app=system |
"{4E5F94F1-70E4-425A-9D12-0FCFB265F6DC}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{55CF012F-6A5F-433C-8816-D18D85BE2B36}" = lport=445 | protocol=6 | dir=in | app=system |
"{56E6A6D1-44BB-4077-9A6C-66D126FBCA02}" = lport=445 | protocol=6 | dir=in | app=system |
"{5937CE60-2EB1-4C07-9F00-B6AAA6A7EEAE}" = lport=7777 | protocol=17 | dir=in | app=c:\windows\ehome\ehshell.exe |
"{5A15FFFA-4BC0-4E58-9859-EAAECDD2EC06}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{61878931-21B2-40FB-99A2-996B12E50907}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\netproj.exe |
"{61F8F5DE-D640-40A4-A5B1-8E1D3E5EF3BA}" = lport=rpc | protocol=6 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe |
"{623449D1-CDC3-4940-9311-EB5A241AF2F3}" = rport=3702 | protocol=17 | dir=out | svc=bits | app=c:\windows\system32\svchost.exe |
"{68DE8C64-C792-4B61-8B32-0B03F7848C82}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7085490B-035E-4737-86D4-BEA2873F47A8}" = lport=3390 | protocol=6 | dir=in | app=system |
"{7B04C8E2-4B1C-4B3D-ACEC-A0A508F5AF0B}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7ECC8088-C3DE-4725-B955-C39D89929669}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{7F2E0AA7-50BB-4F29-A41D-68B4E045E131}" = lport=49160 | protocol=6 | dir=in | name=akamai netsession interface |
"{803022E4-D4AC-4937-B482-415870613462}" = lport=3702 | protocol=17 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe |
"{84516D8B-058B-444E-8400-ABFB627DF824}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\netproj.exe |
"{8AECEF55-1125-4B82-B5B3-2D9D12EC8F77}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{8C8829E4-42B4-484D-808E-E09DD8418818}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{8E208834-59D1-419C-9F5C-CFE5BDDB1CEA}" = lport=2869 | protocol=6 | dir=in | app=system |
"{95B6F738-5E41-4ECC-828D-6A7FE1EA22BC}" = lport=10243 | protocol=6 | dir=in | app=system |
"{9D7EF6B1-FE31-4AC8-AA90-03F81E3E7AA9}" = lport=138 | protocol=17 | dir=in | app=system |
"{A31138C1-8914-4304-961A-81AC08BEE0BD}" = rport=139 | protocol=6 | dir=out | app=system |
"{A4DB7842-ECB7-4CF3-8FBC-6AB588CD0556}" = rport=5358 | protocol=6 | dir=out | app=system |
"{A7898F02-6C4D-4C12-A438-FDCBC0412851}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AA35B20B-6457-4719-BE76-D17DC61D30C2}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{AF0BD338-B4F3-4E89-8819-1286468D33D9}" = lport=2869 | protocol=6 | dir=in | app=system |
"{B756002C-D299-4D6D-86A1-CA4382986BDA}" = lport=5357 | protocol=6 | dir=in | app=system |
"{B7BD04F9-A0ED-4561-9D70-C3E49325C21A}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{B8422BB3-0559-42C8-95CF-5FA583082C4D}" = rport=2178 | protocol=6 | dir=out | app=system |
"{BCF2B04F-2E11-4F53-BCB2-41C72F59C7B0}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{C4CD8B2F-CB6C-45E6-8CC1-A628FD691456}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{DFB3BD0B-2537-4F98-BDD2-16A90C26DE37}" = rport=10243 | protocol=6 | dir=out | app=system |
"{E11151AF-B2E2-4C50-BBFB-B8CB521A4D0A}" = lport=5358 | protocol=6 | dir=in | app=system |
"{E4BDAA02-0117-4245-9754-430DF9E1EB62}" = lport=139 | protocol=6 | dir=in | app=system |
"{E722148E-D881-4AFF-93D9-6743F5046AF2}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{E75F9CB0-0909-4804-ADA7-AA0982767EDA}" = rport=137 | protocol=17 | dir=out | app=system |
"{EA1B8AEB-7C4E-442C-A01B-760B8ED15255}" = lport=rpc | protocol=6 | dir=in | svc=ktmrm | app=c:\windows\system32\svchost.exe |
"{F99096D4-FEAE-429F-BF1E-6027E4797077}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00EE9922-EBB1-4A4F-8B17-A83232762AB3}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{01289C36-383D-4992-8223-B66576142477}" = protocol=6 | dir=in | app=c:\program files\aol\rc\regclient.exe |
"{02F9E84B-706B-46C5-8AE6-46AC9CD8A1AD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{0342D326-BF22-48AE-8F7E-CDE6718BA1AE}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{04887308-93BA-483B-8E00-C4A8D8276B71}" = protocol=6 | dir=out | app=system |
"{053030C7-7545-4753-BC42-1EFE58970C87}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{08E838A3-7D0B-49F9-A092-55C8EE55550D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{0A5A9611-A1E7-477C-ACD9-C75B21F46A81}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{0DBEB893-3B39-4660-8BE3-90819FC33321}" = protocol=6 | dir=in | app=c:\program files\ubisoft\the settlers - rise of an empire\base\bin\settlers6.exe |
"{12ECDE92-C5B1-45B8-AB74-C2DDC1E86142}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{1AD3D2E3-D1FF-4DCF-A6BE-849E543E189F}" = protocol=17 | dir=in | app=c:\program files\aol\rc\regclient.exe |
"{1C517549-C5E1-49D5-AE46-41C6CB50BE3C}" = protocol=6 | dir=in | app=c:\program files\common files\aol\1206383999\ee\aolsoftware.exe |
"{239B8DAF-DA77-439E-9702-1AB69ABA3F2A}" = protocol=6 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{2482AB88-3420-4F01-B2A1-0F726F8D8464}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{25A59A49-D71E-4094-A43A-7671A8463375}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{2698CA49-2E47-41E2-A9E5-8AE78A179AF7}" = protocol=6 | dir=out | app=c:\windows\system32\wudfhost.exe |
"{27E9991E-63BC-4424-9123-F08B4A054785}" = protocol=17 | dir=in | app=c:\program files\common files\aol\1206467242\ee\aolsoftware.exe |
"{2C294161-2BCE-459E-B595-513BE38A5F58}" = protocol=6 | dir=in | app=c:\program files\aol 9.0 vrc\aol.exe |
"{2DB1110B-43D3-499F-BE48-843991431D6F}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{2F376F5C-D18A-41B2-81AE-D602D6428390}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{30AD3B49-DD2A-435D-BC7F-3B0F2C7441D8}" = protocol=6 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe |
"{30D6168D-95D4-4075-9C28-F44C23891601}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{366AAA53-23E4-458D-84C1-663288F56360}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{373CC7D9-231F-4D46-92E0-77EC7AFF36EB}" = protocol=17 | dir=in | app=c:\program files\ubisoft\the settlers - rise of an empire\base\bin\settlers6.exe |
"{3BEF3206-96FD-4885-AAA6-C123D4C0A561}" = protocol=6 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{3C7C1E96-5805-479D-8155-43A7B53423B3}" = protocol=6 | dir=in | app=c:\windows\system32\msdtc.exe |
"{3D48D806-4B80-48C3-B070-2A25709C40C6}" = protocol=6 | dir=in | app=c:\program files\common files\aol\1206467242\ee\aolsoftware.exe |
"{42F31B32-5D6F-4041-AAB4-913C8D0EBB9B}" = protocol=17 | dir=in | app=c:\program files\aol 9.0 vrb\waol.exe |
"{488D48F3-01FC-4F1C-A532-640668079702}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |
"{4A2822F0-1FA7-4E4A-9D2E-8EBC290E441F}" = protocol=17 | dir=in | app=c:\program files\aol 9.0 vre\waol.exe |
"{56819D0D-72A6-4277-B7A8-220BC12C53BB}" = protocol=6 | dir=in | app=c:\program files\aol 9.0 vrc\waol.exe |
"{5A810F99-59FE-41DE-8D18-AB444CC1DC8E}" = protocol=17 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{5AB1B22C-24A1-4B1A-99F8-624EFD0673AD}" = protocol=17 | dir=out | app=c:\windows\ehome\ehshell.exe |
"{612FA4F4-23C5-4CE6-B2B0-272C5362B110}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{6220261A-6781-4F03-8703-ADA12B8CFB74}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{62A09FA2-10DC-45C3-8EE8-0472489C1C92}" = protocol=6 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{685AF5F6-0DA5-4AEB-96EF-F00BE028DD6A}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{6CB185F4-BC12-41FF-8028-086A6A390A03}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6DFD01DB-F0BA-492B-8FCA-070871FFC55F}" = protocol=6 | dir=in | app=c:\program files\aol 9.0 vrb\waol.exe |
"{7668C789-7D4D-46F9-A41C-3C9E099A5287}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{779551E2-FD1E-48E4-B3B3-76A7E3D61DE2}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{80C390BC-F44F-479D-BF41-E2BD33CEBDF0}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{814EB14C-7903-4031-B896-1B9C57A07854}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
"{82AABFE6-5888-4DBB-9A42-766608D79987}" = protocol=17 | dir=in | app=c:\program files\aol\rc\regclient.exe |
"{86C561AA-C9A1-4A7E-8A86-DE40E64EF214}" = protocol=6 | dir=out | app=c:\windows\ehome\mcx2prov.exe |
"{89F12149-E231-408C-ABAF-04E591E8E6C4}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{8ACAD03C-8365-4ACF-96A7-3D551C36D420}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{8B2827FC-2886-43D0-B121-AC8428D5391E}" = protocol=6 | dir=in | app=c:\windows\system32\plasrv.exe |
"{8BA873F5-3563-4D70-84B8-EBBFB91D4254}" = protocol=6 | dir=out | svc=mcx2svc | app=c:\windows\system32\svchost.exe |
"{95978A86-E92D-4749-A26B-331140BDB292}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{95CE8B4C-C58C-4142-97BB-11DFCC4BEAFA}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{9A33EC8B-7A9E-4B33-B99B-B312C3668C31}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{9EE28CB6-79A2-46B9-9ACD-4F1C17DF361F}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{A7680A98-EA55-4BD2-ABDE-44F6454F8A3E}" = protocol=17 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{A81D2BB8-5607-46DF-9CA4-4450A3B8609E}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A934363B-2C1C-4F53-A749-67D47FF3383B}" = protocol=6 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe |
"{AD74080E-A582-4233-B5FC-C4DFD348013B}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{B0F353DC-8075-484B-96D6-8F9BADAD7E9F}" = protocol=6 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{BFCA204F-D919-4CB5-9A98-D41F499B7461}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C274A229-2C26-4C61-9170-52448FA9C135}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{C33EFCD6-CDC2-463C-860A-97AACBE92231}" = protocol=17 | dir=in | app=c:\program files\common files\aol\1206383999\ee\aolsoftware.exe |
"{C45F535B-2FBA-47C5-841B-C8B2D05AA988}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{C84ED3AF-AE4D-49AF-8845-83C99F1BAEBD}" = protocol=17 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe |
"{CA3DA567-AA55-48E6-B4C9-373EE2CC30AD}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{CE4C8266-F333-48F3-B030-8E1E22CCA812}" = protocol=6 | dir=out | svc=msiscsi | app=c:\windows\system32\svchost.exe |
"{CEB0752B-69F8-49B3-B3CB-2E9E519DD4B4}" = protocol=17 | dir=in | app=c:\program files\aol 9.0 vrc\aol.exe |
"{CF55993A-4F59-4E35-8F41-2019A46A27CB}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{D182DD85-845F-4E78-B719-FA9AC42CC5D0}" = protocol=6 | dir=out | app=c:\windows\system32\msdtc.exe |
"{D2C4E817-DB93-43D3-A7E5-32087608BDF8}" = protocol=17 | dir=in | app=c:\program files\aol 9.0 vrc\waol.exe |
"{D3166A29-98DF-4B72-9ED8-AE0C5D56E298}" = protocol=6 | dir=in | app=c:\program files\aol 9.0 vra\waol.exe |
"{D416BB2E-C5B6-4A83-BC75-35E05F63E69A}" = protocol=6 | dir=out | app=c:\windows\system32\netproj.exe |
"{D4655C56-DEC3-4575-9B22-7E4D2BE63F08}" = protocol=17 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{D9BCAC0F-5940-40D7-B150-CD2788A33BD1}" = protocol=17 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe |
"{DA78588E-1349-4935-B2A9-1993502C3DC5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{DF70D13C-20A8-4D02-A1B6-127DE70F1071}" = protocol=6 | dir=in | app=c:\windows\system32\netproj.exe |
"{DF80E264-FE52-4A7C-BFA1-411C65AED17F}" = protocol=6 | dir=out | app=system |
"{EBB931D0-A564-44E6-AF24-3F9083651C09}" = protocol=17 | dir=in | app=c:\program files\aol 9.0 vra\waol.exe |
"{ECAF4E54-5806-4993-A243-A4849E85AAF7}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{EDA78F39-5925-4233-A06F-54DC742A8368}" = protocol=6 | dir=out | app=c:\windows\ehome\ehshell.exe |
"{EE6FEF11-D437-4A8E-B5DB-6210A3C4872E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{F0926022-20FB-4D26-9F1C-107DED612739}" = protocol=6 | dir=in | svc=msiscsi | app=c:\windows\system32\svchost.exe |
"{F349A269-69C8-486B-B0E7-9984AB893005}" = protocol=6 | dir=in | app=c:\program files\aol\rc\regclient.exe |
"{F36D0D2A-8C7F-45CC-AA93-04C8DC363C2B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F38AFD92-37D7-441F-8905-E990D0DB2E36}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{F494F27A-4E84-4BB1-906B-09D31DDCCF0D}" = protocol=17 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{FDE036DC-839E-4CF6-A941-15524660F666}" = protocol=6 | dir=in | app=c:\program files\aol 9.0 vre\waol.exe |
"TCP Query User{8877DC2B-23C2-47D7-9A91-5CDD9F27F885}C:\program files\firefly studios\stronghold legends\strongholdlegends.exe" = protocol=6 | dir=in | app=c:\program files\firefly studios\stronghold legends\strongholdlegends.exe |
"TCP Query User{D5BEE606-5F63-4DDF-9263-3CFBB8E41A16}C:\sierra\empire earth\empire earth.exe" = protocol=6 | dir=in | app=c:\sierra\empire earth\empire earth.exe |
"TCP Query User{E865E2C3-6129-448A-81B1-BB37EFBF4B5D}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{04E12D7D-564B-4EAF-8FF3-12FA173A68CE}C:\sierra\empire earth\empire earth.exe" = protocol=17 | dir=in | app=c:\sierra\empire earth\empire earth.exe |
"UDP Query User{3DC72D31-5953-40B3-B674-48BFF1A9B007}C:\program files\firefly studios\stronghold legends\strongholdlegends.exe" = protocol=17 | dir=in | app=c:\program files\firefly studios\stronghold legends\strongholdlegends.exe |
"UDP Query User{536D8344-CA8A-4662-A51D-1C9C21C16A54}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0046FA01-C5B9-4985-BACB-398DC480FC05}" = Adobe Photoshop CS3
"{0224CACC-994D-45F8-B973-D65056EA9C2F}" = Adobe XMP DVA Panels CS3
"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0A2C5854-557E-48C8-835A-3B9F074BDCAA}" = Python 2.5
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{11B83AD3-7A46-4C2E-A568-9505981D4C6F}" = HP Update
"{11BB336F-0E58-4977-B866-F24FA334616B}" = HP Active Support Library
"{12A76360-388E-4B27-ABEB-D5FC5378DD2A}" = HPPhotoSmartPhotobookWebPack1
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{185D0A67-E066-44AE-926D-F6305813301C}" = Adobe After Effects CS3 Presets
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{2447500B-22D7-47BD-9B13-1A927F43A267}" = Empire Earth
"{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2
"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check
"{288DB08D-0708-4A94-B055-55B99E39EB62}" = Adobe Creative Suite 5 Master Collection
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2
"{4CACFCD9-F71B-413A-8DF5-1A6419D5CDC6}" = Cards_Calendar_OrderGift_DoMorePlugout
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}" = HP Picasso Media Center Add-In
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files
"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash
"{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{6E9EF98E-259E-416D-B5F8-0ABDB99942CE}" = Adobe Flash Player 10 ActiveX
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7162AC2C-733F-4127-ACAD-C5F0F27D123D}" = Adobe Creative Suite 3 Master Collection
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7ACFB90E-8FD0-4397-AD3A-5195412623A3}" = Adobe Help Viewer CS3
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{842BEE12-CCCB-43F4-ABAF-CBA6DFE2583D}" = Nero BurnLite 10
"{845A8DB9-8802-4FD3-9FE3-938A6C46A2EC}" = Adobe Video Profiles
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C3727F2-8E37-49E4-820C-03B1677F53B6}" = Stronghold Crusader
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9885A11E-60E4-417C-B58B-8B31B21C0B8A}" = HP Easy Setup - Frontend
"{9BA4F9C5-7CB4-492C-9B97-89E36AFA0AB9}" = Adobe Setup
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{9DBA770F-BF73-4D39-B1DF-6035D95268FC}" = HP Customer Feedback
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB627AF2-9C7E-4DBD-816B-3B2646B81E89}" = Nero BurnLite 10
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.3
"{AFAD41A9-9687-48A3-848F-693C11451433}" = HP Customer Experience Enhancements
"{B1C2398C-6FAB-46D1-806C-5942F0829994}" = ParetoLogic Data Recovery
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup
"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3
"{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}" = Adobe BridgeTalk Plugin CS3
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5
"{BC41C09D-FAA9-4346-9FE6-1E0017BC551A}" = Adobe Flash Player 10 Plugin
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CB84F0F2-927B-458D-9DC5-87832E3DC653}" = GearDrvs
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D3F80A98-05AB-4D8C-9272-766CCFA6A48D}" = THE SETTLERS - Rise of an Empire
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}" = LiveUpdate Notice (Symantec Corporation)
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E6CFBFB5-9232-410C-B353-AF6E614B2681}" = LightScribe System Software 1.10.16.1
"{E8C2622C-9FF1-4F60-8008-A0208154F9F3}" = muvee autoProducer 6.1
"{e96b3d28-47d6-43cc-98fd-7069eeab6b11}" = HP Total Care Advisor
"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler
"{ED3F469E-D9EC-4DF1-968F-5812CE2F30F8}" = HP Driver Diagnostics
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}" = Vista Codec Package
"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
"Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
"Adobe_8bb24e071e5922899698c2105557bd2" = Add or Remove Adobe Creative Suite 3 Master Collection
"Akamai" = Akamai NetSession Interface
"Any Video Converter_is1" = Any Video Converter 3.0.6
"AOL Regclient" = AOL Registration
"AOL Uninstaller" = AOL Uninstaller (Choose which Products to Remove)
"BlueVoda_Website_Builder_1.0" = BlueVoda Website Builder 10.2
"CCleaner" = CCleaner
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Cossacks II" = Cossacks II
"Defraggler" = Defraggler
"EuroTalk Talk Now Plus!" = EuroTalk Talk Now Plus!
"GameSpy Arcade" = GameSpy Arcade
"Google Chrome" = Google Chrome
"HijackThis" = HijackThis 2.0.2
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Photosmart Essential" = HP Photosmart Essential 2.5
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"JESSOPS" = JESSOPS
"Linguata Maltese" = Linguata Maltese 2.4
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"MLS for MsWord v4.0b" = MLS for MsWord v4.0b
"Neat Image_is1" = Neat Image v6 Demo (with plug-in)
"NVIDIA Drivers" = NVIDIA Drivers
"OsdMaestro" = HP On-Screen Cap/Num/Scroll Lock Indicator
"PC-Doctor 5 for Windows" = Hardware Diagnostic Tools
"Pen Tablet Driver" = Bamboo
"Photo Viewer" = Photo Viewer 2.3
"PhotomatixPro3_is1" = Photomatix Pro version 3.1.2
"Shockwave" = Shockwave
"TalkMore Update_is1" = TalkMore Update 1.0
"TBSB07183.TBSB07183Toolbar" = Fast Browser Search (My Tattoons)
"uTorrent" = µTorrent
"ViewpointMediaPlayer" = Viewpoint Media Player
"WildTangent hp Master Uninstall" = My HP Games
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"ZoneAlarm" = ZoneAlarm
"ZoneAlarm Toolbar" = ZoneAlarm Toolbar

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 01/08/2010 21:36:15 | Computer Name = strider-PC | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe_WinDefend, version 6.0.6001.18000,
time stamp 0x47918b89, faulting module ntdll.dll, version 6.0.6002.18005, time
stamp 0x49e03821, exception code 0xc0000374, fault offset 0x000afaf8, process id
0x3ac, application start time 0x01cb314cdef5ee37.

Error - 02/08/2010 10:04:34 | Computer Name = strider-PC | Source = ESENT | ID = 452
Description = Windows (3284) Windows: Database C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb
requires logfiles 12097-12098 in order to recover successfully. Recovery could
only locate logfiles starting at 12098.

Error - 02/08/2010 10:04:34 | Computer Name = strider-PC | Source = ESENT | ID = 454
Description = Windows (3284) Windows: Database recovery/restore failed with unexpected
error -543.

Error - 02/08/2010 10:04:35 | Computer Name = strider-PC | Source = Windows Search Service | ID = 9000
Description =

Error - 02/08/2010 10:04:35 | Computer Name = strider-PC | Source = Windows Search Service | ID = 7040
Description =

Error - 02/08/2010 10:04:35 | Computer Name = strider-PC | Source = Windows Search Service | ID = 9002
Description =

Error - 02/08/2010 10:04:35 | Computer Name = strider-PC | Source = Windows Search Service | ID = 3029
Description =

Error - 02/08/2010 10:04:35 | Computer Name = strider-PC | Source = Windows Search Service | ID = 3029
Description =

Error - 02/08/2010 10:04:35 | Computer Name = strider-PC | Source = Windows Search Service | ID = 3028
Description =

Error - 02/08/2010 10:04:35 | Computer Name = strider-PC | Source = Windows Search Service | ID = 3058
Description =

[ Media Center Events ]
Error - 26/05/2008 19:12:06 | Computer Name = strider-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 27/05/2008 14:12:26 | Computer Name = strider-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

[ OSession Events ]
Error - 16/09/2008 18:30:58 | Computer Name = strider-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6308.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 3615
seconds with 0 seconds of active time. This session ended with a crash.

Error - 16/09/2008 18:31:04 | Computer Name = strider-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6308.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 3599
seconds with 0 seconds of active time. This session ended with a crash.

Error - 17/09/2009 14:30:59 | Computer Name = strider-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3843
seconds with 60 seconds of active time. This session ended with a crash.

Error - 17/09/2009 14:31:07 | Computer Name = strider-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3706
seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 01/08/2010 21:36:43 | Computer Name = strider-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 02/08/2010 08:01:09 | Computer Name = strider-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 10:33:53 on 02/08/2010 was unexpected.

Error - 02/08/2010 08:39:15 | Computer Name = strider-PC | Source = DCOM | ID = 10010
Description =

Error - 02/08/2010 10:04:15 | Computer Name = strider-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 14:55:09 on 02/08/2010 was unexpected.

Error - 02/08/2010 10:05:19 | Computer Name = strider-PC | Source = Service Control Manager | ID = 7024
Description =

Error - 02/08/2010 10:05:55 | Computer Name = strider-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 02/08/2010 10:05:56 | Computer Name = strider-PC | Source = DCOM | ID = 10005
Description =

Error - 02/08/2010 10:05:56 | Computer Name = strider-PC | Source = Service Control Manager | ID = 7009
Description =

Error - 02/08/2010 10:05:56 | Computer Name = strider-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 02/08/2010 10:06:35 | Computer Name = strider-PC | Source = Service Control Manager | ID = 7032
Description =


< End of report >

• Download combofix from here
  Link 1
  

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to svchost as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

• See HERE for how to disable your AV.
  
• Double click on svchost.exe.
  
• Follow the prompts. NOTE:
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouse click combofix's window whilst it's running. That may cause it to stall.
  

here it is


ComboFix 10-08-02.01 - strider 02/08/2010 23:22:03.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.1918.1108 [GMT 1:00]
Running from: C:\Users\strider\Desktop\ComboFix.exe
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Fast Browser Search
C:\Program Files\Fast Browser Search\IE\1.bat
C:\Program Files\Fast Browser Search\IE\about.html
C:\Program Files\Fast Browser Search\IE\affid.dat
C:\Program Files\Fast Browser Search\IE\basis.xml
C:\Program Files\Fast Browser Search\IE\basis_br.xml
C:\Program Files\Fast Browser Search\IE\basis_de.xml
C:\Program Files\Fast Browser Search\IE\basis_en.xml
C:\Program Files\Fast Browser Search\IE\basis_es.xml
C:\Program Files\Fast Browser Search\IE\basis_fr.xml
C:\Program Files\Fast Browser Search\IE\basis_it.xml
C:\Program Files\Fast Browser Search\IE\basis_nr.xml
C:\Program Files\Fast Browser Search\IE\basis_pt.xml
C:\Program Files\Fast Browser Search\IE\basis_ru.xml
C:\Program Files\Fast Browser Search\IE\basis_tr.xml
C:\Program Files\Fast Browser Search\IE\BHO.dll
C:\Program Files\Fast Browser Search\IE\ClearRecycleBin.exe
C:\Program Files\Fast Browser Search\IE\error.html
C:\Program Files\Fast Browser Search\IE\fbsProtection.xml
C:\Program Files\Fast Browser Search\IE\FbsSearchProvider.xml
C:\Program Files\Fast Browser Search\IE\FbsSearchProviderIE8.exe
C:\Program Files\Fast Browser Search\IE\fbstoolbar.jar
C:\Program Files\Fast Browser Search\IE\fbstoolbar.manifest
C:\Program Files\Fast Browser Search\IE\icons.bmp
C:\Program Files\Fast Browser Search\IE\ie3sh.exe
C:\Program Files\Fast Browser Search\IE\info.txt
C:\Program Files\Fast Browser Search\IE\local.xml
C:\Program Files\Fast Browser Search\IE\logobg.bmp
C:\Program Files\Fast Browser Search\IE\MTWB3SH.dll
C:\Program Files\Fast Browser Search\IE\MTWBtoolbar.html
C:\Program Files\Fast Browser Search\IE\search.bmp
C:\Program Files\Fast Browser Search\IE\search_br.bmp
C:\Program Files\Fast Browser Search\IE\search_de.bmp
C:\Program Files\Fast Browser Search\IE\search_es.bmp
C:\Program Files\Fast Browser Search\IE\search_fr.bmp
C:\Program Files\Fast Browser Search\IE\search_it.bmp
C:\Program Files\Fast Browser Search\IE\search_pt.bmp
C:\Program Files\Fast Browser Search\IE\search_ru.bmp
C:\Program Files\Fast Browser Search\IE\SearchAssistant.dll
C:\Program Files\Fast Browser Search\IE\SearchGuardPlus.exe
C:\Program Files\Fast Browser Search\IE\SearchGuardPlus.ico
C:\Program Files\Fast Browser Search\IE\SGPU.ico
C:\Program Files\Fast Browser Search\IE\sgpUpdater.exe
C:\Program Files\Fast Browser Search\IE\sgpUpdater.xml
C:\Program Files\Fast Browser Search\IE\SGPUpdaterS.exe
C:\Program Files\Fast Browser Search\IE\tbs_include_script_003175.js
C:\Program Files\Fast Browser Search\IE\tbs_include_script_005064.js
C:\Program Files\Fast Browser Search\IE\tbs_include_script_012817.js
C:\Program Files\Fast Browser Search\IE\Toolbar Help.htm
C:\Program Files\Fast Browser Search\IE\uninstall.exe
C:\Program Files\Fast Browser Search\IE\uninstalSGP.exe
C:\Program Files\Fast Browser Search\IE\uninstalSGPU.exe
C:\Program Files\Fast Browser Search\IE\update.exe
C:\Program Files\Fast Browser Search\IE\version.txt
C:\Program Files\SGPSA
C:\Program Files\SGPSA\BHO.dll
C:\Program Files\SGPSA\ie3sh.exe
C:\Program Files\SGPSA\mtWB3sh.dll
C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat
C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat
C:\Windows\Downloaded Program Files\popcaploader.inf
C:\Windows\system32\%appdata%
L:\dds.pif

----- BITS: Possible infected sites -----

hxxp://install10.nero.com
.
((((((((((((((((((((((((( Files Created from 2010-07-02 to 2010-08-02 )))))))))))))))))))))))))))))))
.

2010-08-02 22:32:01 . 2010-08-02 22:32:01 -------- d-----w- C:\Users\Default\AppData\Local\temp
2010-07-30 21:50:09 . 2010-07-30 21:50:09 -------- d-----w- C:\Users\strider\AppData\Roaming\CheckPoint
2010-07-30 21:49:35 . 2010-07-30 21:49:35 -------- d-----w- C:\Program Files\Conduit
2010-07-30 21:49:33 . 2010-07-30 21:49:35 -------- d-----w- C:\Program Files\ZoneAlarm
2010-07-30 21:49:23 . 2010-07-30 21:49:23 -------- d-----w- C:\Program Files\CheckPoint
2010-07-30 21:49:00 . 2010-04-05 20:00:48 910208 ----a-w- C:\Windows\system32\drivers\tcpip.sys
2010-07-30 21:49:00 . 2010-04-05 20:00:40 221568 ----a-w- C:\Windows\system32\drivers\netio.sys
2010-07-30 21:49:00 . 2010-04-05 15:14:52 31232 ----a-w- C:\Windows\system32\drivers\tcpipreg.sys
2010-07-30 21:48:40 . 2010-06-23 12:51:20 103936 ----a-w- C:\Windows\system32\zlcommdb.dll
2010-07-30 21:48:39 . 2010-06-23 12:51:20 69120 ----a-w- C:\Windows\system32\zlcomm.dll
2010-07-30 21:48:29 . 2010-06-23 12:51:22 1238528 ----a-w- C:\Windows\system32\zpeng25.dll
2010-07-30 21:48:22 . 2010-07-30 21:50:06 -------- d-----w- C:\Windows\system32\ZoneLabs
2010-07-30 21:48:22 . 2010-05-15 15:30:46 457304 ----a-w- C:\Windows\system32\drivers\vsdatant.sys
2010-07-30 21:48:21 . 2010-07-30 21:48:21 -------- d-----w- C:\Program Files\Zone Labs
2010-07-30 21:47:56 . 2010-08-02 22:38:42 -------- d-----w- C:\Windows\Internet Logs
2010-07-30 21:47:56 . 2010-07-30 21:47:56 -------- d-----w- C:\ProgramData\CheckPoint
2010-07-24 20:59:24 . 2010-07-24 20:59:24 -------- d-----w- C:\Users\strider\AppData\Roaming\Nero
2010-07-24 20:57:55 . 2010-07-24 20:58:18 -------- d-----w- C:\ProgramData\Nero
2010-07-24 20:57:44 . 2010-07-24 20:57:45 -------- d-----w- C:\Program Files\Common Files\Nero
2010-07-24 20:57:15 . 2010-07-24 20:58:17 -------- d-----w- C:\Program Files\Nero
2010-07-24 20:26:32 . 2010-07-24 20:26:32 -------- d-----w- C:\Users\strider\AppData\Local\AskToolbar
2010-07-24 20:09:31 . 2010-07-24 20:09:53 -------- d-----w- C:\Program Files\Ask.com
2010-07-24 15:09:11 . 2010-07-24 15:09:11 -------- d-----w- C:\Users\strider\AppData\Roaming\AnvSoft
2010-07-24 15:09:09 . 2010-07-24 15:09:09 -------- d-----w- C:\Program Files\AnvSoft
2010-07-24 14:40:35 . 2010-07-24 14:40:35 -------- d-----w- C:\Program Files\uTorrent
2010-07-24 14:39:51 . 2010-08-02 16:29:36 -------- d-----w- C:\Users\strider\AppData\Roaming\uTorrent

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-02 22:36:41 . 2010-05-12 01:51:53 -------- d-----w- C:\Program Files\Common Files\Akamai
2010-08-02 22:36:09 . 2010-02-01 20:55:48 -------- d-----w- C:\Users\strider\AppData\Roaming\WTablet
2010-08-02 16:29:34 . 2008-08-02 15:57:18 -------- d-----w- C:\ProgramData\FLEXnet
2010-07-31 01:33:35 . 2009-01-07 03:08:18 -------- d-----w- C:\Program Files\SUPERAntiSpyware
2010-07-30 21:53:59 . 2008-10-03 01:32:15 -------- d-----w- C:\ProgramData\Symantec
2010-07-30 21:53:59 . 2007-11-30 17:16:15 -------- d-----w- C:\Program Files\Common Files\Symantec Shared
2010-07-30 21:50:44 . 2010-07-30 21:48:22 421442 ---ha-w- C:\Windows\system32\drivers\vsconfig.xml
2010-07-30 21:46:57 . 2008-03-24 17:57:31 -------- d-----w- C:\Program Files\Norton 360
2010-07-14 02:03:50 . 2006-11-02 11:18:33 -------- d-----w- C:\Program Files\Windows Mail
2010-07-13 00:58:20 . 2008-03-25 01:29:20 15756 ----a-w- C:\Users\strider\AppData\Roaming\wklnhst.dat
2010-07-09 09:23:05 . 2009-10-20 21:10:21 -------- d-----w- C:\Program Files\GameSpy Arcade
2010-07-09 09:17:38 . 2009-10-20 21:04:47 -------- d-----w- C:\Program Files\Firefly Studios
2010-07-09 09:17:38 . 2007-11-30 16:54:07 -------- d--h--w- C:\Program Files\InstallShield Installation Information
2010-06-30 21:49:22 . 2010-06-30 21:49:20 -------- d-----w- C:\Program Files\Defraggler
2010-06-30 21:48:08 . 2010-04-13 21:33:45 -------- d-----w- C:\Program Files\CCleaner
2010-06-25 02:02:04 . 2008-03-24 17:31:04 -------- d-----w- C:\Program Files\Microsoft.NET
2010-06-23 11:18:10 . 2010-06-23 11:18:10 501936 ----a-w- C:\ProgramData\Google\Google Toolbar\Update\gtb7F9F.tmp.exe
2010-06-16 00:42:14 . 2010-05-17 13:03:21 21840 ----atw- C:\Windows\system32\SIntfNT.dll
2010-06-16 00:42:14 . 2010-05-17 13:03:21 17212 ----atw- C:\Windows\system32\SIntf32.dll
2010-06-16 00:42:14 . 2010-05-17 13:03:21 12067 ----atw- C:\Windows\system32\SIntf16.dll
2010-06-12 02:10:23 . 2008-03-24 17:29:29 -------- d-----w- C:\ProgramData\Microsoft Help
2010-06-05 07:47:30 . 2010-01-28 14:22:36 -------- d-----w- C:\Program Files\Microsoft Silverlight
2010-05-26 17:06:41 . 2010-06-11 03:25:32 34304 ----a-w- C:\Windows\system32\atmlib.dll
2010-05-26 14:47:41 . 2010-06-11 03:25:32 289792 ----a-w- C:\Windows\system32\atmfd.dll
2010-05-21 13:14:28 . 2009-10-03 01:14:30 221568 ------w- C:\Windows\system32\MpSigStub.exe
2010-05-17 23:55:30 . 2008-03-24 17:25:34 77704 ----a-w- C:\Users\strider\AppData\Local\GDIPFONTCACHEV1.DAT
2010-05-12 22:58:51 . 2010-05-12 22:58:51 10134 ----a-r- C:\Users\strider\AppData\Roaming\Microsoft\Installer\{024521CF-C07E-4F8E-8481-0D75695E03AF}\ARPPRODUCTICON.exe
2010-05-12 22:55:44 . 2010-06-02 23:39:20 38784 ----a-w- C:\Users\strider\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-05-12 22:55:44 . 2010-05-12 22:56:08 38784 ----a-w- C:\Users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-05-12 22:34:53 . 2010-05-12 01:52:17 1228416 ----a-w- C:\Users\strider\MasterCollection_CS5_LS1.exe
2008-07-11 20:31:31 . 2008-03-28 14:45:23 168 --sha-r- C:\Windows\System32\7D9B0BEDEE.sys
2008-07-11 20:31:52 . 2008-03-28 14:38:54 2516 --sha-w- C:\Windows\System32\KGyGaAvL.sys
2007-11-30 16:21:14 . 2007-11-30 16:15:37 8192 --sha-w- C:\Windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}"= "C:\Program Files\ZoneAlarm\tbZone.dll" [2010-05-09 10:50:18 2517088]

[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]
2010-05-09 10:50:18 2517088 ----a-w- C:\Program Files\ZoneAlarm\tbZone.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-05-21 11:17:46 1233288 ----a-w- C:\Program Files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "C:\Program Files\Ask.com\GenericAskToolbar.dll" [2010-05-21 11:17:46 1233288]
"{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}"= "C:\Program Files\ZoneAlarm\tbZone.dll" [2010-05-09 10:50:18 2517088]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "C:\Program Files\Ask.com\GenericAskToolbar.dll" [2010-05-21 11:17:46 1233288]
"{66F2E20D-0DA8-4C11-A9C8-DD8477B88ACD}"= "C:\Program Files\ZoneAlarm\tbZone.dll" [2010-05-09 10:50:18 2517088]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2009-04-11 06:28:03 1233920]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-14 22:57:46 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-19 07:38:38 1008184]
"WPCUMI"="C:\Windows\system32\WpcUmi.exe" [2006-11-02 12:35:35 176128]
"HostManager"="C:\Program Files\Common Files\AOL\1206467242\ee\AOLSoftware.exe" [2006-11-14 14:01:21 50736]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-07-07 01:45:00 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-07-07 01:45:00 8466432]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-07-07 01:45:00 81920]
"Malwarebytes Anti-Malware (reboot)"="C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 14:39:32 1090952]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2010-06-23 12:51:30 1043968]
"ISW"="C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" [2010-05-26 13:35:14 730600]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 09:13:36 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2010-04-19 17:21:44 548352 ----a-w- C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Users^strider^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=C:\Users\strider\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=C:\Windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-03-06 02:44:40 500208 ------w- C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 03:57:06 406992 ----a-w- C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
2009-02-25 15:48:44 2356088 ----a-w- C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDog305]
2005-08-05 22:15:04 61440 ----a-w- C:\Windows\VM305_STI.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-19 07:33:09 125952 ----a-w- C:\Windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-09 00:24:20 54840 ----a-w- c:\Program Files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2007-04-18 15:01:34 65536 ----a-w- c:\hp\support\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2006-12-08 16:16:56 65536 ----a-w- C:\hp\KBD\KbdStub.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2010-04-29 14:39:32 1090952 ----a-w- C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OsdMaestro]
2007-02-15 11:59:00 118784 ----a-w- C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-01-05 16:18:48 413696 ----a-w- C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2008-01-15 10:26:18 4874240 ----a-w- C:\Windows\RtHDVCpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateReg]
2007-04-07 10:56:47 54936 ----a-w- C:\Windows\System32\jureg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2010-07-31 01:33:35 2403568 ----a-w- C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-06-14 22:57:46 39408 ----a-w- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
2010-02-19 12:37:14 517096 ----a-w- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):74,80,56,0e,4c,44,ca,01

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 12:16:28 130384]
R2 gupdate;Google Update Service (gupdate);C:\Program Files\Google\Update\GoogleUpdate.exe [2009-10-29 13:33:40 133104]
R3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\system32\drivers\mbamswissarmy.sys [2010-04-29 14:39:38 38224]
R3 PCD5SRVC{BD6912E3-AC9D80E8-05040000};PCD5SRVC{BD6912E3-AC9D80E8-05040000} - PCDR Kernel Mode Service Helper Driver;C:\PROGRA~1\PC-DOC~1\PCD5SRVC.pkms [2007-09-13 01:35:54 25760]
R3 SASENUM;SASENUM;C:\Program Files\SUPERAntiSpyware\SASENUM.SYS [2010-04-19 17:21:44 12872]
R3 SwitchBoard;SwitchBoard;C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 12:37:14 517096]
R3 vsdatant7;vsdatant7;C:\Windows\system32\drivers\vsdatant.win7.sys [x]
R3 wacmoumonitor;Wacom Mode Helper;C:\Windows\system32\DRIVERS\wacmoumonitor.sys [2009-01-30 21:29:50 15656]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 12:16:28 753504]
R3 ZSMC0305;A4 TECH PC Camera V;C:\Windows\system32\Drivers\usbVM305.sys [2006-05-08 17:24:24 391688]
S1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [2010-04-19 17:21:44 12872]
S1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys [2010-07-14 00:35:31 67656]
S2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe [2008-01-19 07:33:32 21504]
S2 ISWKL;ZoneAlarm Toolbar ISWKL;C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [2010-05-26 13:35:10 26352]
S2 IswSvc;ZoneAlarm Toolbar IswSvc;C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [2010-05-26 13:35:18 493032]
S2 NAUpdate;Nero Update;C:\Program Files\Nero\Update\NASvc.exe [2010-05-04 11:07:22 503080]
S2 TabletServicePen;TabletServicePen;C:\Windows\system32\Pen_Tablet.exe [2009-07-15 16:13:02 4408616]
S2 WTouchService;WTouch Service;C:\Program Files\WTouch\WTouchService.exe [2009-07-15 16:13:04 112936]
S3 WacomVTHid;Virtual Touch Driver;C:\Windows\system32\DRIVERS\WacomVTHid.sys [2009-05-20 22:14:32 13224]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder

2010-08-02 C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2009-10-29 13:33:51 . 2009-10-29 13:33:40]

2010-08-02 C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2009-10-29 13:33:51 . 2009-10-29 13:33:40]

2010-08-02 C:\Windows\Tasks\ParetoLogic Registration.job
- C:\Program Files\Common Files\ParetoLogic\UUS2\UUS.dll [2008-02-22 12:25:18 . 2008-02-22 12:25:18]

2010-07-30 C:\Windows\Tasks\ParetoLogic Update Version2.job
- C:\Program Files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2008-02-22 12:25:28 . 2008-02-22 12:25:28]

2010-08-02 C:\Windows\Tasks\User_Feed_Synchronization-{536220E9-C4F9-4DAC-9509-9B60EC2758BC}.job
- C:\Windows\system32\msfeedssync.exe [2010-06-11 03:25:34 . 2010-05-04 04:30:19]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
LSP: C:\Windows\system32\wpclsp.dll
.
.
------- File Associations -------
.
inifile=%SystemRoot%\System32\NOTEPAD.EXE %1"
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-AdobeBridge - (no file)
MSConfigStartUp-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
MSConfigStartUp-iTunesHelper - C:\Program Files\iTunes\iTunesHelper.exe
MSConfigStartUp-osCheck - C:\Program Files\Norton 360\osCheck.exe
AddRemove-Neat Image_is1 - J:\Neat Image\unins000.exe

Hello.
The last bit of the log was cut off, please post the last little bit.

thats all ther was? do i need to run it again?

Hello.

I see that you are running Limewire.
P2P(Peer to peer) applications are designed to help you easily share and distribute files between you and a group of people. But they can also be used to distribute malware, and thus are not considered safe.
The removal of these programs is optional, but highly recommended.

• Click Start >> Control Panel.
  
• Under the Programs click Uninstall a Program
  
• Highlight the following:
  
  µTorrent
  Adobe Reader 8.1.3
  Ask Toolbar
  Fast Browser Search (My Tattoons)
  Viewpoint Media Player
  ZoneAlarm Toolbar
  
  
• Click on the Uninstall/Change button at the top.
  

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

ok i have removed (via uninstall program) some of them. it wont remove ask toolbar ( its not even coming up in the remove programs list) and fast browser tatoons i clicked to remove but it does nothing, does not uninstall it. i wasnt aware i was running limewire and certainly dont want to be. is there another way to get rid of these two stubborn ones before i run the malware scan? youre helping so much, thnk s

Hello.

1. Please download AskRemover from here
   
2. Extract the zip file to your Desktop, then run AskRemover.bat
   
3. Allow it to run, and select yes to the registry merge warning.
   
4. Copy and paste the resulting log in your next post.
   

Ask Remover Version 1.1 - Written by Belahzur

The current time and date is 22:11:23.48 04/08/2010

Microsoft Windows [Version 6.0.6002]


==== STARTING CHECK ====
C:\Program Files\Ask.com has been found!

==== Starting removal of Ask ====
C:\Program Files\Ask.com Deleted.

Applying removal of Ask Toolbar registry keys.

==== REGISTRY DUMP ====

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Start Page REG_SZ http://go.microsoft.com/fwlink/?LinkId=69157


HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Search Bar REG_SZ Preserve






HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
Default_Search_URL REG_SZ http://go.microsoft.com/fwlink/?LinkId=54896


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
Default_Page_URL REG_SZ http://go.microsoft.com/fwlink/?LinkId=69157


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
Start Page REG_SZ http://go.microsoft.com/fwlink/?LinkId=69157



*** The above keys may not need fixing ***

==== FINAL CHECK ====

==== EOF ====

That worked. Can you run MBAM now?

ok sure

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4391

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18928

05/08/2010 04:27:02
mbam-log-2010-08-05 (04-27-02).txt

Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|L:\|M:\|)
Objects scanned: 472097
Time elapsed: 1 hour(s), 56 minute(s), 54 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

since this mbam scan i have been experiencing blue screen crashes and memory dumps. this wasnt happening before.... help! also i cant switch system restore off, its frozen

Hello.
Please re-run Combofix.

here it is

ComboFix 10-08-05.02 - strider 05/08/2010 22:03:01.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.1918.538 [GMT 1:00]
Running from: c:\users\strider\Desktop\ComboFix.exe
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Fast Browser Search
c:\program files\Fast Browser Search\IE\1.bat
c:\program files\Fast Browser Search\IE\BHO.dll
c:\program files\Fast Browser Search\IE\ClearRecycleBin.exe
c:\program files\Fast Browser Search\IE\FbsSearchProviderIE8.exe
c:\program files\Fast Browser Search\IE\fbstoolbar.manifest
c:\program files\Fast Browser Search\IE\ie3sh.exe
c:\program files\Fast Browser Search\IE\MTWB3SH.dll
c:\program files\Fast Browser Search\IE\SearchAssistant.dll
c:\program files\Fast Browser Search\IE\SearchGuardPlus.exe
c:\program files\Fast Browser Search\IE\SearchGuardPlus.ico
c:\program files\Fast Browser Search\IE\SGPU.ico
c:\program files\Fast Browser Search\IE\sgpUpdater.exe
c:\program files\Fast Browser Search\IE\SGPUpdaterS.exe
c:\program files\Fast Browser Search\IE\tbs_include_script_003175.js
c:\program files\Fast Browser Search\IE\tbs_include_script_005064.js
c:\program files\Fast Browser Search\IE\tbs_include_script_012817.js
c:\program files\Fast Browser Search\IE\uninstall.exe
c:\program files\Fast Browser Search\IE\uninstalSGP.exe
c:\program files\Fast Browser Search\IE\uninstalSGPU.exe
c:\program files\Fast Browser Search\IE\update.exe
c:\program files\SGPSA
c:\program files\SGPSA\BHO.dll
c:\program files\SGPSA\ie3sh.exe
c:\program files\SGPSA\mtWB3sh.dll
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\system32\%appdata%
.
---- Previous Run -------
.
c:\program files\Fast Browser Search\IE\1.bat
c:\program files\Fast Browser Search\IE\about.html
c:\program files\Fast Browser Search\IE\affid.dat
c:\program files\Fast Browser Search\IE\basis.xml
c:\program files\Fast Browser Search\IE\basis_br.xml
c:\program files\Fast Browser Search\IE\basis_de.xml
c:\program files\Fast Browser Search\IE\basis_en.xml
c:\program files\Fast Browser Search\IE\basis_es.xml
c:\program files\Fast Browser Search\IE\basis_fr.xml
c:\program files\Fast Browser Search\IE\basis_it.xml
c:\program files\Fast Browser Search\IE\basis_nr.xml
c:\program files\Fast Browser Search\IE\basis_pt.xml
c:\program files\Fast Browser Search\IE\basis_ru.xml
c:\program files\Fast Browser Search\IE\basis_tr.xml
c:\program files\Fast Browser Search\IE\BHO.dll
c:\program files\Fast Browser Search\IE\ClearRecycleBin.exe
c:\program files\Fast Browser Search\IE\error.html
c:\program files\Fast Browser Search\IE\fbsProtection.xml
c:\program files\Fast Browser Search\IE\FbsSearchProvider.xml
c:\program files\Fast Browser Search\IE\FbsSearchProviderIE8.exe
c:\program files\Fast Browser Search\IE\fbstoolbar.jar
c:\program files\Fast Browser Search\IE\fbstoolbar.manifest
c:\program files\Fast Browser Search\IE\icons.bmp
c:\program files\Fast Browser Search\IE\ie3sh.exe
c:\program files\Fast Browser Search\IE\info.txt
c:\program files\Fast Browser Search\IE\local.xml
c:\program files\Fast Browser Search\IE\logobg.bmp
c:\program files\Fast Browser Search\IE\MTWB3SH.dll
c:\program files\Fast Browser Search\IE\MTWBtoolbar.html
c:\program files\Fast Browser Search\IE\search.bmp
c:\program files\Fast Browser Search\IE\search_br.bmp
c:\program files\Fast Browser Search\IE\search_de.bmp
c:\program files\Fast Browser Search\IE\search_es.bmp
c:\program files\Fast Browser Search\IE\search_fr.bmp
c:\program files\Fast Browser Search\IE\search_it.bmp
c:\program files\Fast Browser Search\IE\search_pt.bmp
c:\program files\Fast Browser Search\IE\search_ru.bmp
c:\program files\Fast Browser Search\IE\SearchAssistant.dll
c:\program files\Fast Browser Search\IE\SearchGuardPlus.exe
c:\program files\Fast Browser Search\IE\SearchGuardPlus.ico
c:\program files\Fast Browser Search\IE\SGPU.ico
c:\program files\Fast Browser Search\IE\sgpUpdater.exe
c:\program files\Fast Browser Search\IE\sgpUpdater.xml
c:\program files\Fast Browser Search\IE\SGPUpdaterS.exe
c:\program files\Fast Browser Search\IE\tbs_include_script_003175.js
c:\program files\Fast Browser Search\IE\tbs_include_script_005064.js
c:\program files\Fast Browser Search\IE\tbs_include_script_012817.js
c:\program files\Fast Browser Search\IE\Toolbar Help.htm
c:\program files\Fast Browser Search\IE\uninstall.exe
c:\program files\Fast Browser Search\IE\uninstalSGP.exe
c:\program files\Fast Browser Search\IE\uninstalSGPU.exe
c:\program files\Fast Browser Search\IE\update.exe
c:\program files\Fast Browser Search\IE\version.txt
c:\program files\SGPSA\BHO.dll
c:\program files\SGPSA\ie3sh.exe
c:\program files\SGPSA\mtWB3sh.dll
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\Downloaded Program Files\popcaploader.inf
L:\dds.pif

.
((((((((((((((((((((((((( Files Created from 2010-07-05 to 2010-08-05 )))))))))))))))))))))))))))))))
.

2010-08-05 21:14 . 2010-08-05 21:20 -------- d-----w- c:\users\strider\AppData\Local\temp
2010-08-05 21:14 . 2010-08-05 21:14 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-08-04 02:02 . 2010-08-04 02:02 -------- d-----w- c:\windows\CheckSur
2010-08-03 22:15 . 2010-08-03 22:15 -------- d-----w- c:\users\strider\AppData\Roaming\AVS4YOU
2010-08-03 22:13 . 2010-08-03 22:16 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-08-03 22:13 . 2010-08-03 22:16 -------- d-----w- c:\program files\AVS4YOU
2010-08-03 22:13 . 2010-08-03 22:15 -------- d-----w- c:\programdata\AVS4YOU
2010-08-03 22:13 . 2008-08-13 10:22 974848 ----a-w- c:\windows\system32\mfc70.dll
2010-08-03 22:13 . 2008-08-13 10:22 487424 ----a-w- c:\windows\system32\msvcp70.dll
2010-08-03 22:13 . 2008-08-13 10:22 344064 ----a-w- c:\windows\system32\msvcr70.dll
2010-08-03 22:13 . 2008-08-13 10:22 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2010-08-03 22:13 . 2008-08-13 10:22 24576 ----a-w- c:\windows\system32\msxml3a.dll
2010-08-03 22:04 . 2010-08-03 22:04 -------- d-----w- c:\users\strider\AppData\Local\Xilisoft
2010-08-03 22:03 . 2010-08-03 22:03 -------- d-----w- c:\users\strider\AppData\Roaming\Xilisoft
2010-07-30 21:50 . 2010-07-30 21:50 -------- d-----w- c:\users\strider\AppData\Roaming\CheckPoint
2010-07-30 21:49 . 2010-07-30 21:49 -------- d-----w- c:\program files\CheckPoint
2010-07-30 21:49 . 2010-04-05 20:00 910208 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-07-30 21:49 . 2010-04-05 20:00 221568 ----a-w- c:\windows\system32\drivers\netio.sys
2010-07-30 21:49 . 2010-04-05 15:14 31232 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2010-07-30 21:48 . 2010-06-23 12:51 103936 ----a-w- c:\windows\system32\zlcommdb.dll
2010-07-30 21:48 . 2010-06-23 12:51 69120 ----a-w- c:\windows\system32\zlcomm.dll
2010-07-30 21:48 . 2010-06-23 12:51 1238528 ----a-w- c:\windows\system32\zpeng25.dll
2010-07-30 21:48 . 2010-07-30 21:50 -------- d-----w- c:\windows\system32\ZoneLabs
2010-07-30 21:48 . 2010-05-15 15:30 457304 ----a-w- c:\windows\system32\drivers\vsdatant.sys
2010-07-30 21:48 . 2010-07-30 21:48 -------- d-----w- c:\program files\Zone Labs
2010-07-30 21:47 . 2010-08-05 21:19 -------- d-----w- c:\windows\Internet Logs
2010-07-30 21:47 . 2010-07-30 21:47 -------- d-----w- c:\programdata\CheckPoint
2010-07-24 20:59 . 2010-07-24 20:59 -------- d-----w- c:\users\strider\AppData\Roaming\Nero
2010-07-24 20:57 . 2010-07-24 20:58 -------- d-----w- c:\programdata\Nero
2010-07-24 20:57 . 2010-07-24 20:57 -------- d-----w- c:\program files\Common Files\Nero
2010-07-24 20:57 . 2010-07-24 20:58 -------- d-----w- c:\program files\Nero
2010-07-24 20:26 . 2010-07-24 20:26 -------- d-----w- c:\users\strider\AppData\Local\AskToolbar
2010-07-24 20:09 . 2010-07-24 20:09 -------- d-----w- c:\program files\Ask.com
2010-07-24 15:09 . 2010-07-24 15:09 -------- d-----w- c:\users\strider\AppData\Roaming\AnvSoft
2010-07-24 15:09 . 2010-07-24 15:09 -------- d-----w- c:\program files\AnvSoft
2010-07-24 14:39 . 2010-08-04 12:27 -------- d-----w- c:\users\strider\AppData\Roaming\uTorrent

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-05 21:17 . 2010-05-12 01:51 -------- d-----w- c:\program files\Common Files\Akamai
2010-08-05 21:17 . 2010-02-01 20:55 -------- d-----w- c:\users\strider\AppData\Roaming\WTablet
2010-08-04 19:01 . 2008-03-25 01:29 15756 ----a-w- c:\users\strider\AppData\Roaming\wklnhst.dat
2010-08-04 12:29 . 2008-04-22 23:40 -------- d-----w- c:\program files\Common Files\Adobe
2010-08-03 15:21 . 2008-08-02 15:57 -------- d-----w- c:\programdata\FLEXnet
2010-07-31 01:33 . 2009-01-07 03:08 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-07-30 21:53 . 2008-10-03 01:32 -------- d-----w- c:\programdata\Symantec
2010-07-30 21:53 . 2007-11-30 17:16 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-07-30 21:50 . 2010-07-30 21:48 421442 ---ha-w- c:\windows\system32\drivers\vsconfig.xml
2010-07-30 21:46 . 2008-03-24 17:57 -------- d-----w- c:\program files\Norton 360
2010-07-14 02:03 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-07-09 09:23 . 2009-10-20 21:10 -------- d-----w- c:\program files\GameSpy Arcade
2010-07-09 09:17 . 2009-10-20 21:04 -------- d-----w- c:\program files\Firefly Studios
2010-07-09 09:17 . 2007-11-30 16:54 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-30 21:49 . 2010-06-30 21:49 -------- d-----w- c:\program files\Defraggler
2010-06-30 21:48 . 2010-04-13 21:33 -------- d-----w- c:\program files\CCleaner
2010-06-25 02:02 . 2008-03-24 17:31 -------- d-----w- c:\program files\Microsoft.NET
2010-06-16 00:42 . 2010-05-17 13:03 21840 ----atw- c:\windows\system32\SIntfNT.dll
2010-06-16 00:42 . 2010-05-17 13:03 17212 ----atw- c:\windows\system32\SIntf32.dll
2010-06-16 00:42 . 2010-05-17 13:03 12067 ----atw- c:\windows\system32\SIntf16.dll
2010-06-12 02:10 . 2008-03-24 17:29 -------- d-----w- c:\programdata\Microsoft Help
2010-05-26 17:06 . 2010-06-11 03:25 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-26 14:47 . 2010-06-11 03:25 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-05-21 13:14 . 2009-10-03 01:14 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-17 23:55 . 2008-03-24 17:25 77704 ----a-w- c:\users\strider\AppData\Local\GDIPFONTCACHEV1.DAT
2010-05-12 22:34 . 2010-05-12 01:52 1228416 ----a-w- c:\users\strider\MasterCollection_CS5_LS1.exe
2008-07-11 20:31 . 2008-03-28 14:45 168 --sha-r- c:\windows\System32\7D9B0BEDEE.sys
2008-07-11 20:31 . 2008-03-28 14:38 2516 --sha-w- c:\windows\System32\KGyGaAvL.sys
2007-11-30 16:21 . 2007-11-30 16:15 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"AdobeBridge"="" [BU]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-14 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"HostManager"="c:\program files\Common Files\AOL\1206467242\ee\AOLSoftware.exe" [2006-11-14 50736]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-07-07 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-07 8466432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-07-07 81920]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2010-06-23 1043968]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2010-04-19 17:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Users^strider^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\strider\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-03-06 02:44 500208 ------w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 03:57 406992 ----a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
2009-02-25 15:48 2356088 ----a-w- c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDog305]
2005-08-05 22:15 61440 ----a-w- c:\windows\VM305_STI.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-19 07:33 125952 ----a-w- c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
[ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-09 00:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2007-04-18 15:01 65536 ----a-w- c:\hp\support\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
c:\program files\iTunes\iTunesHelper.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2006-12-08 16:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2010-04-29 14:39 1090952 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]
c:\program files\Norton 360\osCheck.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OsdMaestro]
2007-02-15 11:59 118784 ----a-w- c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-01-05 16:18 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2008-01-15 10:26 4874240 ----a-w- c:\windows\RtHDVCpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateReg]
2007-04-07 10:56 54936 ----a-w- c:\windows\System32\jureg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2010-07-31 01:33 2403568 ----a-w- c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-06-14 22:57 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
2010-02-19 12:37 517096 ----a-w- c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):74,80,56,0e,4c,44,ca,01

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-10-29 133104]
R3 PCD5SRVC{BD6912E3-AC9D80E8-05040000};PCD5SRVC{BD6912E3-AC9D80E8-05040000} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\PC-DOC~1\PCD5SRVC.pkms [2007-09-13 25760]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2010-04-19 12872]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 vsdatant7;vsdatant7;c:\windows\system32\drivers\vsdatant.win7.sys [x]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [2009-01-30 15656]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 ZSMC0305;A4 TECH PC Camera V;c:\windows\system32\Drivers\usbVM305.sys [2006-05-08 391688]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-04-19 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2010-07-14 67656]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2008-01-19 21504]
S2 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [2010-05-04 503080]
S2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2009-07-15 4408616]
S2 WTouchService;WTouch Service;c:\program files\WTouch\WTouchService.exe [2009-07-15 112936]
S3 WacomVTHid;Virtual Touch Driver;c:\windows\system32\DRIVERS\WacomVTHid.sys [2009-05-20 13224]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder

2010-08-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-29 13:33]

2010-08-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-29 13:33]

2010-08-05 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2008-02-22 12:25]

2010-08-04 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2008-02-22 12:25]

2010-08-05 c:\windows\Tasks\User_Feed_Synchronization-{536220E9-C4F9-4DAC-9509-9B60EC2758BC}.job
- c:\windows\system32\msfeedssync.exe [2010-06-11 04:30]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
LSP: c:\windows\system32\wpclsp.dll
.
.
------- File Associations -------
.
inifile=%SystemRoot%\System32\NOTEPAD.EXE %1"
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-05 22:19
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\PCD5SRVC{BD6912E3-AC9D80E8-05040000}]
"ImagePath"="\??\c:\progra~1\PC-DOC~1\PCD5SRVC.pkms"
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\program files\WTouch\WTouchUser.exe
c:\program files\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\PSIService.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\WUDFHost.exe
c:\windows\system32\WTablet\Pen_TabletUser.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\System32\rundll32.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\DllHost.exe
.
**************************************************************************
.
Completion time: 2010-08-05 22:35:47 - machine was rebooted
ComboFix-quarantined-files.txt 2010-08-05 21:35

Pre-Run: 106,168,827,904 bytes free
Post-Run: 110,426,296,320 bytes free

Current=2 Default=2 Failed=1 LastKnownGood=8 Sets=1,2,3,4,5,6,7,8
- - End Of File - - 8FCD3F1094BD1BDA32CE9B8140AB2969

Hello.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /uninstall

This will also reset your restore points.

Run ESET Online Scan
Please do an online scan with ESET Online Scanner. Please use Internet Explorer as it uses ActiveX.

• Check (tick) this box: YES, I accept the Terms of Use.
  
• Click on the Start button next to it.
  
• When prompted to run ActiveX. click Yes.
  
• You will be asked to install an ActiveX. Click Install.
  
• Once installed, the scanner will be initialized.
  
• After the scanner is initialized, click Start.
  
• Check (tick) Remove found threats box.
  
• Check (tick) Scan unwanted applications.
  
• Click on Scan.
  
• It will start scanning. Please be patient.
  
• Once the scan is done, the log will be saved here: C:\Program Files\esetonlinescanner\log.txt.
  

hi, it didnt save any log text anywhere, however it did find and clean a trojan of some sort. but i have no info to post, shall i run it again?

No.
How is the machine running now?

it seems fine! do i need to install anything else to keep it this clean? you guys are awesome x

Yes, 1 more thing.
Did you uninstall/remove Norton 360 during this fix? I see leftover traces of it, yet not a full installation of it.

its been unistalled as far as i knew. there shouldnt be any traces left.

It's just a leftover in the registry I saw.

You aren't running Anti Virus Software

Please install Avira antivirus otherwise you won't be protected.

1) Antivir PersonalEditionClassic
-Free anti-virus software for Windows.
-Detects and removes more than 50,000 viruses. Free support.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts.

ok doing that now, thanks for all your help x