Computer Hope

Software => Computer viruses and spyware => Topic started by: vawill4891 on November 27, 2010, 08:56:33 AM

Title: Application cannot be executed. The file *** is infected.
Post by: vawill4891 on November 27, 2010, 08:56:33 AM

I am getting this message and it will not allow me to run the anti-virus or anti-malware program on my computer. Can anyone help me get rid of this killer virus?

Title: Re: Application cannot be executed. The file *** is infected.
Post by: harry 48 on November 27, 2010, 10:49:24 AM

go to below and complete , post 3 logs

rename hjt to snipper.exe , and rename mbam to anything and run them both

http://www.computerhope.com/forum/index.php/topic,46313.0.html

Title: Re: Application cannot be executed. The file *** is infected.
Post by: SuperDave on November 27, 2010, 12:28:42 PM

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
**********************************************
Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
Save Rkill to your desktop.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.exe (http://download.bleepingcomputer.com/grinler/rkill.exe)
Rkill.com (http://download.bleepingcomputer.com/grinler/rkill.com)
Rkill.scr (http://download.bleepingcomputer.com/grinler/rkill.scr)
Rkill.pif (http://download.bleepingcomputer.com/grinler/rkill.pif)

Once you've gotten one of them to run then try to immediately run the following.

Now download and Run exeHelper.

Please download exeHelper from Raktor (http://www.raktor.net/exeHelper/exeHelper.com) to your desktop.

Double-click on exeHelper.com to run the fix. A black window should pop up, press any key to close once the fix is completed. A log file named log.txt will be created in the directory where you ran exeHelper.com Attach the log.txt file to your next message.

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).
***********************************************
SUPERAntiSpyware

If you already have SUPERAntiSpyware be sure to check for updates before scanning!

Download SuperAntispyware Free Edition (SAS) (http://www.superantispyware.com/download.html)
* Double-click the icon on your desktop to run the installer.
* When asked to Update the program definitions, click Yes
* If you encounter any problems while downloading the updates, manually download and unzip them from here
* Next click the Preferences button.

•Under Start-Up Options uncheck Start SUPERAntiSpyware when Windows starts
* Click the Scanning Control tab.
* Under Scanner Options make sure only the following are checked:

•Close browsers before scanning
•Scan for tracking cookies
•Terminate memory threats before quarantining
•Please leave the others unchecked

•Click the Close button to leave the control center screen.

* On the main screen click Scan your computer
* On the left check the box for the drive you are scanning.
* On the right choose Perform Complete Scan
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete a summary box will appear. Click OK
* Make sure everything in the white box has a check next to it, then click Next
* It will quarantine what it found and if it asks if you want to reboot, click Yes

•To retrieve the removal information please do the following:
•After reboot, double-click the SUPERAntiSpyware icon on your desktop.
•Click Preferences. Click the Statistics/Logs tab.

•Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.

•It will open in your default text editor (preferably Notepad).
•Save the notepad file to your desktop by clicking (in notepad) File > Save As...

* Save the log somewhere you can easily find it. (normally the desktop)
* Click close and close again to exit the program.
*Copy and Paste the log in your post.
****************************************
(http://img233.imageshack.us/img233/7729/mbamicontw5.gif) Please download Malwarebytes Anti-Malware from here (http://www.malwarebytes.org/mbam/program/mbam-setup.exe).

Double Click mbam-setup.exe to install the application.
- Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
- If an update is found, it will download and install the latest version.
- Once the program has loaded, select "Perform Full Scan", then click Scan.
- The scan may take some time to finish,so please be patient.
- When the scan is complete, click OK, then Show Results to view the results.
- Make sure that everything is checked, and click Remove Selected.
- When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
- Please save the log to a location you will remember.
- The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
- Copy and paste the entire report in your next reply.
Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Title: Re: Application cannot be executed. The file *** is infected.
Post by: vawill4891 on November 27, 2010, 04:54:40 PM

thanks for the help, here are the logs

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Ran as Will on 11/27/2010 at 17:32:24.

Services Stopped:

Processes terminated by Rkill or while it was running:

C:\Users\Will\AppData\Local\Temp\kkrmqceja\ohesbyjtsbl.exe
C:\Users\Will\Downloads\rkill(6).exe

Rkill completed on 11/27/2010 at 17:32:27.

exeHelper by Raktor
Build 20100414
Run at exeHelper by Raktor
Build 20100414
Run at 10:49:36 on 11/27/10exeHelper by Raktor
Build 20100414
exeHelper by Raktor
Build 20100414
Run at 10:51:57exeHelper by Raktor
Build 20100414
Run at 10:52:00 on 11/27/10exeHelper by Raktor
Build 20100414
exeHelper by Raktor
exeHelper by Raktor
Build 20100414
Run at exeHelper by Raktor
Build 20100414
Run at 11:00:54 on 11/27/10
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

exeHelper by Raktor
Build 20100414
Run at 17:18:23 on 11/27/10
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

exeHelper by Raktor
Build 20100414
Run at 17:32:40 on 11/27/10
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/27/2010 at 06:10 PM

Application Version : 4.32.1000

Core Rules Database Version : 4487
Trace Rules Database Version: 2303

Scan type : Complete Scan
Total Scan Time : 00:36:47

Memory items scanned : 728
Memory threats detected : 0
Registry items scanned : 5927
Registry threats detected : 0
File items scanned : 157439
File threats detected : 7

Adware.Tracking Cookie
   C:\Users\Will\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
   C:\Users\Will\AppData\Roaming\Microsoft\Windows\Cookies\will@advertising[1].txt
   C:\Users\Will\AppData\Roaming\Microsoft\Windows\Cookies\will@doubleclick[2].txt
   C:\Users\Will\AppData\Roaming\Microsoft\Windows\Cookies\will@atwola[1].txt
   C:\Users\Will\AppData\Roaming\Microsoft\Windows\Cookies\will@tacoda[2].txt
   C:\Users\Will\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
   C:\Users\Will\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4052

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

11/27/2010 6:52:28 PM
mbam-log-2010-11-27 (18-52-28).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 265239
Time elapsed: 37 minute(s), 17 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Title: Re: Application cannot be executed. The file *** is infected.
Post by: SuperDave on November 27, 2010, 06:22:05 PM

Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1 (http://screen317.spywareinfoforum.org/SecurityCheck.exe)
Link 2 (http://screen317.changelog.fr/SecurityCheck.exe)

* Unzip SecurityCheck.zip and a folder named Security Check should appear.
* Open the Security Check folder and double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
*******************************************
Please download ComboFix (http://img7.imageshack.us/img7/4930/combofix.gif) from BleepingComputer.com (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)

Alternate link: GeeksToGo.com (http://subs.geekstogo.com/ComboFix.exe)

Rename ComboFix.exe to commy.exe before you save it to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here (http://www.bleepingcomputer.com/forums/topic114351.html)
Click Start then copy paste the following command into the search box & hit enter: "%userprofile%\desktop\commy.exe" /stepdel
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. This will not install in Vista. Just continue scanning, and skip the console install.
When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply.

If you have problems with ComboFix usage, see How to use ComboFix (http://www.bleepingcomputer.com/combofix/how-to-use-combofix)

Title: Re: Application cannot be executed. The file *** is infected.
Post by: vawill4891 on November 27, 2010, 08:34:18 PM

I apologize as I must be doing something incorrect.

The checkup folder ends up being empty after doing its process.

And the Combo Fix says it is only compatible with Win 2000 and WinXP and will not let me use it.

Am I missing something?

Title: Re: Application cannot be executed. The file *** is infected.
Post by: SuperDave on November 28, 2010, 11:41:47 AM

Download OTL (http://oldtimer.geekstogo.com/OTL.exe) to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Under the Custom Scan box paste this in

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%\*.exe
%systemroot%\*. /mp /s
c:\$recycle.bin\*.* /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
nvstor32.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
explorer.exe
svchost.exe
userinit.exe
qmgr.dll
ws2_32.dll
proquota.exe
imm32.dll
kernel32.dll
ndis.sys
autochk.exe
spoolsv.exe
xmlprov.dll
ntmssvc.dll
mswsock.dll
Beep.SYS
ntfs.sys
termsrv.dll
sfcfiles.dll
st3shark.sys
ahcix86.sys
srsvc.dll
nvrd32.sys
/md5stop
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time

Title: Re: Application cannot be executed. The file *** is infected.
Post by: vawill4891 on November 28, 2010, 09:55:55 PM

OTL logfile created on: 11/28/2010 11:46:04 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\Will\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

6.00 Gb Total Physical Memory | 4.00 Gb Available Physical Memory | 62.00% Memory free
12.00 Gb Paging File | 10.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465.66 Gb Total Space | 323.33 Gb Free Space | 69.43% Space Free | Partition Type: NTFS
Drive D: | 465.75 Gb Total Space | 465.65 Gb Free Space | 99.98% Space Free | Partition Type: NTFS

Computer Name: WILL-DESKTOP | User Name: Will | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/11/28 23:43:47 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Will\Downloads\OTL.exe
PRC - [2010/11/26 12:44:03 | 001,242,448 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Steam\steam.exe
PRC - [2010/10/29 05:56:25 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2010/10/12 18:11:42 | 004,258,136 | ---- | M] (AOL Inc.) -- C:\Program Files (x86)\AIM\aim.exe
PRC - [2010/09/12 03:06:36 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe
PRC - [2009/11/24 18:51:40 | 000,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe
PRC - [2009/11/24 18:51:35 | 000,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
PRC - [2009/11/24 18:51:21 | 000,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
PRC - [2009/11/24 18:48:48 | 000,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
PRC - [2009/11/24 18:43:56 | 000,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
PRC - [2009/11/10 18:05:34 | 000,248,320 | ---- | M] () -- C:\Program Files (x86)\Razer\Lachesis\razerhid.exe
PRC - [2009/10/30 06:57:08 | 000,369,200 | ---- | M] (DT Soft Ltd) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
PRC - [2009/10/14 13:36:56 | 002,793,304 | ---- | M] () -- C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
PRC - [2009/10/07 01:47:22 | 000,125,464 | ---- | M] (Logitech Inc.) -- C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
PRC - [2009/07/16 15:35:42 | 005,458,704 | ---- | M] (Logitech Inc.) -- C:\Program Files (x86)\Logitech\Logitech Vid\Vid.exe
PRC - [2009/04/23 06:29:18 | 007,418,368 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2009/04/23 06:29:14 | 007,424,000 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2008/06/15 12:14:30 | 001,692,672 | ---- | M] (PANTERASoft) -- C:\Program Files (x86)\HDD Health\hddhealth.exe
PRC - [2007/06/05 10:37:12 | 000,163,840 | ---- | M] (Razer Inc.) -- C:\Program Files (x86)\Razer\Lachesis\razerofa.exe

========== Modules (SafeList) ==========

MOD - [2010/11/28 23:43:47 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Will\Downloads\OTL.exe
MOD - [2010/09/12 03:06:56 | 000,040,960 | ---- | M] () -- C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
MOD - [2010/08/21 00:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
MOD - [2003/03/18 15:14:52 | 000,499,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\MSVCP71.dll
MOD - [2003/02/20 22:42:22 | 000,348,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\MSVCR71.dll

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2009/11/24 22:17:16 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009/11/24 18:51:35 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus)
SRV:64bit: - [2009/11/24 18:51:21 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner)
SRV:64bit: - [2009/11/24 18:48:48 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner)
SRV:64bit: - [2009/11/24 18:43:56 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv)
SRV:64bit: - [2009/10/07 01:47:10 | 000,191,000 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcS64)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2010/09/15 21:12:00 | 000,411,432 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2010/02/01 02:48:29 | 000,834,544 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2009/12/19 09:11:40 | 000,314,400 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009/11/24 22:52:14 | 006,174,720 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009/11/24 18:50:05 | 000,022,096 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2009/11/24 18:49:56 | 000,065,616 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2009/10/16 21:09:14 | 000,029,952 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Lachesis.sys -- (VaneFltr)
DRV:64bit: - [2009/10/07 08:49:28 | 006,379,288 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lvuvc64.sys -- (LVUVC64) Logitech QuickCam Pro 5000(UVC)
DRV:64bit: - [2009/10/07 08:47:46 | 000,327,704 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64)
DRV:64bit: - [2009/10/07 08:45:38 | 000,271,640 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lvpopf64.sys -- (lvpopf64)
DRV:64bit: - [2009/10/07 01:45:50 | 000,030,232 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LVPr2M64.sys -- (LVPr2Mon)
DRV:64bit: - [2009/10/07 01:45:50 | 000,030,232 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LVPr2M64.sys -- (LVPr2M64)
DRV:64bit: - [2009/09/30 09:34:30 | 000,121,872 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009/08/28 19:42:52 | 000,049,152 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2009/07/13 20:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2009/07/13 20:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/17 07:19:14 | 000,015,208 | ---- | M] (Secunia) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\psi_mf.sys -- (PSI)
DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2009/12/16 16:27:00 | 000,007,408 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)
DRV - [2009/12/16 16:26:58 | 000,009,968 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] -- C:\Program Files (x86)\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2009/12/16 16:26:56 | 000,074,480 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] -- C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://store.steampowered.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 09 B2 8D C3 DD 97 CA 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:23012

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://store.steampowered.com/|http://www.gametap.com/|http://www.gog.com/en/frontpage/"
FF - prefs.js..extensions.enabledItems: [email protected]:1.1.1.0014
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.5
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 50370

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/09/12 03:06:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.15\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/10/29 05:56:25 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.15\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/10/29 05:56:25 | 000,000,000 | ---D | M]

[2010/01/17 20:38:09 | 000,000,000 | ---D | M] -- C:\Users\Will\AppData\Roaming\Mozilla\Extensions
[2010/11/27 23:34:09 | 000,000,000 | ---D | M] -- C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\xptvc9dx.default\extensions
[2010/02/01 02:48:52 | 000,000,000 | ---D | M] -- C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\xptvc9dx.default\extensions\[email protected]
[2010/02/01 02:48:48 | 000,002,055 | ---- | M] () -- C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\xptvc9dx.default\searchplugins\daemon-search.xml
[2010/11/27 23:34:09 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/02/17 17:21:02 | 000,238,776 | ---- | M] (Pando Networks) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npPandoWebInst.dll

O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4:64bit: - HKLM..\Run: [] File not found
O4:64bit: - HKLM..\Run: [Launch LCDMon] C:\Program Files\Logitech\G-series Software\LCDMon.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Launch LGDCore] C:\Program Files\Logitech\G-series Software\LGDCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [Lachesis] C:\Program Files (x86)\Razer\Lachesis\razerhid.exe ()
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [Aim] C:\Program Files (x86)\AIM\aim.exe (AOL Inc.)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [HDDHealth] C:\Program Files (x86)\HDD Health\HDDHealth.exe (PANTERASoft)
O4 - HKCU..\Run: [jgyjwhrk] C:\Users\Will\AppData\Local\Temp\kkrmqceja\ohesbyjtsbl.exe ()
O4 - HKCU..\Run: [Logitech Vid] C:\Program Files (x86)\Logitech\Logitech Vid\vid.exe (Logitech Inc.)
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
O4 - Startup: C:\Users\Will\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O22:64bit: - SharedTaskScheduler: {1984DD45-52CF-49cd-AB77-18F378FEA264} - FencesShellExt - C:\Program Files (x86)\Stardock\Fences\FencesMenu64.dll (Stardock)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files (x86)\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{4889a322-f022-11df-95b2-001fbc0119d1}\Shell - "" = AutoRun
O33 - MountPoints2\{4889a322-f022-11df-95b2-001fbc0119d1}\Shell\AutoRun\command - "" = G:\TL-Bootstrap.exe -- File not found
O33 - MountPoints2\{63afdb93-0f06-11df-b303-001fbc0119d1}\Shell - "" = AutoRun
O33 - MountPoints2\{63afdb93-0f06-11df-b303-001fbc0119d1}\Shell\AutoRun\command - "" = F:\_AUTORUN\AUTORUN.EXE -- File not found
O33 - MountPoints2\{63afdb93-0f06-11df-b303-001fbc0119d1}\Shell\instDX\command - "" = F:\directX\dxsetup.exe -- File not found
O33 - MountPoints2\{63afdb93-0f06-11df-b303-001fbc0119d1}\Shell\readme\command - "" = notepad readme.txt
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PEVSystemStart - Service
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: procexp90.Sys - Driver
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PEVSystemStart - Service
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: procexp90.Sys - Driver
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PEVSystemStart - Service
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: procexp90.Sys - Driver
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PEVSystemStart - Service
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: procexp90.Sys - Driver
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: VIDC.FPS1 - frapsv64.dll (Beepa P/L)
Drivers32:64bit: vidc.i420 - lvcod64.dll (Logitech Inc.)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\SysWow64\frapsvid.dll (Beepa P/L)
Drivers32: vidc.i420 - C:\Windows\SysWow64\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

========== Files/Folders - Created Within 30 Days ==========

[2010/11/27 22:31:53 | 000,000,000 | R--D | C] -- C:\32788R22FWJFW
[2010/11/26 12:56:52 | 000,000,000 | ---D | C] -- C:\Users\Will\Documents\SimCity 4
[2010/11/21 21:27:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Graboid
[2010/11/09 20:28:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GearBunnies
[2010/11/06 14:28:53 | 000,000,000 | ---D | C] -- C:\Users\Will\Documents\Electronic Arts
[2010/10/30 21:51:29 | 000,000,000 | ---D | C] -- C:\Users\Will\Desktop\bronxtale-td
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/11/28 22:57:00 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/11/28 21:57:00 | 000,000,890 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/11/28 21:07:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/11/28 18:31:44 | 000,000,496 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Will.job
[2010/11/27 22:28:53 | 000,000,000 | ---- | M] () -- C:\Windows\LCDMedia.INI
[2010/11/27 22:28:03 | 003,981,232 | ---- | M] () -- C:\Users\Will\Desktop\commy.exe.exe
[2010/11/27 22:21:15 | 000,913,714 | ---- | M] () -- C:\Users\Will\Desktop\SecurityCheck.exe
[2010/11/27 19:19:39 | 000,726,316 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010/11/27 19:19:39 | 000,623,940 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010/11/27 19:19:39 | 000,106,316 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010/11/27 17:35:54 | 000,013,632 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/11/27 17:35:54 | 000,013,632 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/11/27 17:28:38 | 529,928,191 | -HS- | M] () -- C:\hiberfil.sys
[2010/11/27 11:31:27 | 000,001,009 | ---- | M] () -- C:\Users\Public\Desktop\MW.lnk
[2010/11/26 12:45:11 | 000,000,221 | ---- | M] () -- C:\Users\Will\Desktop\SimCity 4 Deluxe.url
[2010/11/26 12:45:11 | 000,000,221 | ---- | M] () -- C:\Users\Will\Desktop\Recettear An Item Shop's Tale.url
[2010/11/26 12:45:11 | 000,000,221 | ---- | M] () -- C:\Users\Will\Desktop\Puzzle Agent.url
[2010/11/26 12:45:11 | 000,000,221 | ---- | M] () -- C:\Users\Will\Desktop\Jolly Rover.url
[2010/11/26 12:45:11 | 000,000,221 | ---- | M] () -- C:\Users\Will\Desktop\And Yet It Moves.url
[2010/11/26 12:45:11 | 000,000,220 | ---- | M] () -- C:\Users\Will\Desktop\Gish.url
[2010/11/10 18:09:28 | 000,000,767 | ---- | M] () -- C:\Users\Will\Desktop\Ywain-(Hib) Eldritch.gbt
[2010/11/09 20:28:43 | 000,000,968 | ---- | M] () -- C:\Users\Public\Desktop\LottoBunny.lnk
[2010/11/09 20:28:43 | 000,000,968 | ---- | M] () -- C:\Users\Public\Desktop\GearBunnyX.lnk
[2010/11/09 20:28:43 | 000,000,963 | ---- | M] () -- C:\Users\Public\Desktop\GearBunny Classic.lnk
[2010/11/09 20:28:43 | 000,000,963 | ---- | M] () -- C:\Users\Public\Desktop\DataBunny.lnk
[2010/11/08 11:57:49 | 000,002,340 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2010/10/31 20:44:34 | 000,000,006 | ---- | M] () -- C:\Users\Will\AppData\Roaming\start
[2010/10/31 20:43:32 | 000,000,006 | ---- | M] () -- C:\Users\Will\AppData\Roaming\completescan
[2010/10/31 20:35:25 | 000,000,010 | ---- | M] () -- C:\Users\Will\AppData\Roaming\install
[2010/10/31 20:34:41 | 000,000,207 | ---- | M] () -- C:\Users\Will\AppData\Roaming\dkfjasdfshd.bat
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/11/27 22:28:53 | 000,000,000 | ---- | C] () -- C:\Windows\LCDMedia.INI
[2010/11/27 22:24:08 | 003,981,232 | ---- | C] () -- C:\Users\Will\Desktop\commy.exe.exe
[2010/11/27 22:18:11 | 000,913,714 | ---- | C] () -- C:\Users\Will\Desktop\SecurityCheck.exe
[2010/11/26 12:45:11 | 000,000,221 | ---- | C] () -- C:\Users\Will\Desktop\SimCity 4 Deluxe.url
[2010/11/26 12:45:11 | 000,000,221 | ---- | C] () -- C:\Users\Will\Desktop\Recettear An Item Shop's Tale.url
[2010/11/26 12:45:11 | 000,000,221 | ---- | C] () -- C:\Users\Will\Desktop\Puzzle Agent.url
[2010/11/26 12:45:11 | 000,000,221 | ---- | C] () -- C:\Users\Will\Desktop\Jolly Rover.url
[2010/11/26 12:45:11 | 000,000,221 | ---- | C] () -- C:\Users\Will\Desktop\And Yet It Moves.url
[2010/11/26 12:45:11 | 000,000,220 | ---- | C] () -- C:\Users\Will\Desktop\Gish.url
[2010/11/10 18:09:28 | 000,000,767 | ---- | C] () -- C:\Users\Will\Desktop\Ywain-(Hib) Eldritch.gbt
[2010/11/09 20:28:43 | 000,000,968 | ---- | C] () -- C:\Users\Public\Desktop\LottoBunny.lnk
[2010/11/09 20:28:43 | 000,000,968 | ---- | C] () -- C:\Users\Public\Desktop\GearBunnyX.lnk
[2010/11/09 20:28:43 | 000,000,963 | ---- | C] () -- C:\Users\Public\Desktop\GearBunny Classic.lnk
[2010/11/09 20:28:43 | 000,000,963 | ---- | C] () -- C:\Users\Public\Desktop\DataBunny.lnk
[2010/10/31 20:44:34 | 000,000,006 | ---- | C] () -- C:\Users\Will\AppData\Roaming\start
[2010/10/31 20:43:32 | 000,000,006 | ---- | C] () -- C:\Users\Will\AppData\Roaming\completescan
[2010/10/31 20:35:25 | 000,000,010 | ---- | C] () -- C:\Users\Will\AppData\Roaming\install
[2010/10/31 20:34:41 | 000,000,207 | ---- | C] () -- C:\Users\Will\AppData\Roaming\dkfjasdfshd.bat
[2010/06/13 15:55:12 | 000,000,047 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2010/02/20 19:12:44 | 000,000,268 | ---- | C] () -- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2008/10/07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\SysWow64\physxcudart_20.dll
[2008/10/07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll

========== LOP Check ==========

[2010/10/22 20:23:29 | 000,000,000 | ---D | M] -- C:\Users\Will\AppData\Roaming\acccore
[2010/10/30 23:50:08 | 000,000,000 | ---D | M] -- C:\Users\Will\AppData\Roaming\BitTorrent
[2010/02/18 00:00:22 | 000,000,000 | ---D | M] -- C:\Users\Will\AppData\Roaming\DAEMON Tools Lite
[2010/08/29 17:17:04 | 000,000,000 | ---D | M] -- C:\Users\Will\AppData\Roaming\Electronic Arts
[2010/02/16 02:22:59 | 000,000,000 | ---D | M] -- C:\Users\Will\AppData\Roaming\Leadertech
[2010/04/03 01:23:31 | 000,000,000 | ---D | M] -- C:\Users\Will\AppData\Roaming\LimeWire
[2010/05/01 01:14:46 | 000,000,000 | ---D | M] -- C:\Users\Will\AppData\Roaming\Mobipocket
[2010/04/05 02:34:46 | 000,000,000 | ---D | M] -- C:\Users\Will\AppData\Roaming\OpenOffice.org
[2010/01/28 02:24:54 | 000,000,000 | ---D | M] -- C:\Users\Will\AppData\Roaming\Razer
[2010/01/27 18:19:42 | 000,000,000 | ---D | M] -- C:\Users\Will\AppData\Roaming\runic games
[2010/01/17 20:58:25 | 000,000,000 | ---D | M] -- C:\Users\Will\AppData\Roaming\Stardock
[2009/07/14 00:08:49 | 000,024,896 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< %systemroot%\*. /mp /s >

< c:\$recycle.bin\*.* /s >
[2010/11/22 22:58:15 | 000,000,129 | -HS- | M] () -- c:\$recycle.bin\S-1-5-20\desktop.ini
[2010/07/25 20:23:40 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I0FSZWP.ipa
[2010/10/30 21:53:01 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I0QWSLP.pak
[2010/09/23 23:43:36 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I0XJWJE.ipa
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I10BMOR.r02
[2010/06/13 19:46:46 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I11DRDX.avi
[2010/05/07 00:29:45 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I1916WI.avi
[2010/10/30 21:53:01 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I1BT8ZA.pak
[2010/05/07 00:29:27 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I1IN7P9.torrent
[2010/10/30 21:53:01 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I1N2WS9.pak
[2010/06/13 19:46:46 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I22WLZH.torrent
[2010/06/13 19:42:31 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I2TZ09D.avi
[2010/05/07 00:29:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I2WDHKJ.mkv
[2010/05/18 02:07:46 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I2WNXAA.ipa
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I33JMNC.r04
[2010/05/09 03:28:18 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I36RKUO.ipa
[2010/09/11 17:59:50 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I38U5YO.mkv
[2010/05/07 00:29:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I38ZZ9X.mkv
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I3E56ZA.r42
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I3OKDD9.r32
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I3S91HQ.r24
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I3U93C8.r12
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I4FILG9.r06
[2010/07/03 12:51:13 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I4JBWUK.ipa
[2010/10/30 21:53:01 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I4JU7FW.pak
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I4RFPNO.r31
[2010/09/23 23:50:24 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I4UL11S.avi
[2010/07/25 20:24:40 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I509VFX.ipa
[2010/09/11 17:59:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I52DKTM.nfo
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I56E0O8.r09
[2010/09/03 01:31:43 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I5P2M5K.ipa
[2010/05/07 00:29:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I5YY9XO.srt
[2010/05/07 00:29:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I621J62.srt
[2010/05/07 00:29:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I65ZXGY.torrent
[2010/05/27 11:47:41 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I68EQ1Z.ipa
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I692X7Q.r44
[2010/09/03 01:31:16 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I6BJ59L.ipa
[2010/05/07 00:29:45 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I6BK1XA.torrent
[2010/05/27 11:48:57 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I6QQUEK.ipa
[2010/09/23 23:50:24 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I71XN0C.avi
[2010/09/03 01:31:27 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I726FLZ.ipa
[2010/05/07 00:29:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I740IKY.mkv
[2010/09/23 23:43:41 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I754WHY.ipa
[2010/07/03 12:51:36 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I77JGQ9.ipa
[2010/07/25 20:25:33 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I79WH0S.ipa
[2010/07/03 12:51:06 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I7C29J5.ipa
[2010/09/23 23:42:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I7H7NVR.ipa
[2010/05/07 00:29:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I7HEBTD.srt
[2010/09/23 23:50:24 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I7ZU5J9.avi
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I82MOYS.r20
[2010/08/19 03:27:31 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I8BS4GQ.ipa
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I8GQG1Y.r25
[2010/05/07 00:29:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I8I26X9.srt
[2010/10/30 21:53:01 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I8I7CH8.pak
[2010/05/27 11:47:23 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I8THZTS.ipa
[2010/07/03 12:52:05 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I8Y8IEM.ipa
[2010/10/30 21:53:01 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I96CED3.pak
[2010/07/03 12:51:19 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$I97NTFB.ipa
[2010/09/23 23:50:24 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IA0ON57.avi
[2010/09/11 17:59:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IA1JMTB.jpg
[2010/10/10 15:38:28 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IA38Z5N
[2010/10/10 15:40:50 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IA3PCO8
[2010/09/11 17:59:50 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IAAARHQ.nfo
[2010/09/23 23:43:13 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IAEBV2E.ipa
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IAINJ19.r29
[2010/05/07 00:29:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IARZRAR.mkv
[2010/05/22 16:47:42 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IAWCB5B
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IAZDZ0K.r34
[2010/10/30 21:53:01 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IB12NGD.pak
[2010/07/03 12:51:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IB1STSS.ipa
[2010/09/11 17:59:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IBBQTJ6.avi
[2010/05/18 02:07:54 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IBJ3KQK.ipa
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IBOI3H0.r43
[2010/05/07 00:29:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IBXWSNB.mkv
[2010/07/25 20:24:26 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IBZ2QC9.ipa
[2010/05/07 00:29:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$ICLQN2Q.mkv
[2010/09/11 17:59:50 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$ICUWDHT.avi
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$ICV8RRC.nfo
[2010/07/25 20:24:35 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$ICXJZ55.ipa
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$ID5JTCO.r07
[2010/07/03 12:50:52 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$ID8NWML.ipa
[2010/09/03 01:32:55 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IDGCLG8.ipa
[2010/07/03 12:52:26 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IDNEOSQ.ipa
[2010/09/23 23:42:57 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IDSC9TJ.ipa
[2010/05/07 00:29:27 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IDU5MKN.txt
[2010/07/03 12:50:59 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IDV9FAG.ipa
[2010/05/27 11:49:16 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IEC83RU.ipa
[2010/11/22 22:36:44 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IEMA0QK.png
[2010/05/07 00:29:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IEN8UXS.mkv
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IETCHQW.r39
[2010/05/07 00:29:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IEVIHOH.srt
[2010/09/23 23:43:00 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IFC2L5V.ipa
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IFDH0CY.r46
[2010/05/27 11:49:04 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IFJ2G8Q.ipa
[2010/09/03 01:31:13 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IFJEC72.ipa
[2010/06/13 19:53:37 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IFN8HG6.avi
[2010/08/14 11:41:16 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IFWYAHA.ipa
[2010/07/25 20:24:59 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IFZ0C3M.ipa
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IG31YEQ.r36
[2010/05/07 00:29:27 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IG4PYZH.txt
[2010/09/23 23:50:24 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IG748TL.avi
[2010/08/14 11:41:27 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IG7R9WT.ipa
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IGCVKD0.r30
[2010/08/14 11:40:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IGJBHN2.ipa
[2010/09/11 17:59:50 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IGNUNH7.nfo
[2010/07/03 12:52:16 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IGPY59N.ipa
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IGSJNGT.r28
[2010/07/03 12:51:40 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IGT3FJR.ipa
[2010/09/23 23:50:24 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IGTQFWC.avi
[2010/09/11 17:59:51 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IH4OR6L.txt
[2010/07/03 12:52:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IH5LYTO.ipa
[2010/05/07 00:29:27 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IHER0WI.txt
[2010/07/03 12:51:47 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IHGSUIH.ipa
[2010/05/12 13:27:37 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IHTH3T9.ipa
[2010/05/07 00:29:45 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IIAN02W.torrent
[2010/09/23 23:50:24 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IIGUAMZ.avi
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IIJ9CJ9.r03
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IIQVL18.r22
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IISURAF.r45
[2010/10/30 21:53:01 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IJAZIXY.pak
[2010/07/25 20:25:15 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IJDLHX3.ipa
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IJPNR66.r16
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IJTMJ93.idx
[2010/05/30 11:28:52 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IJTTD7C.ipa
[2010/06/18 23:42:21 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IJWAIPJ.ipa
[2010/08/14 11:41:47 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IJWI996.ipa
[2010/09/03 01:32:42 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IJX3QCQ.ipa
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IJXYG63.r23
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IKDA1RH.r21
[2010/07/03 12:52:38 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IKDM1VH.ipa
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IL6WPAP.torrent
[2010/09/23 23:50:24 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IL7L1EE.avi
[2010/10/30 23:50:03 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$IL7SEIC.r08
[2010/09/27 00:43:00 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2479393777-1000\$ILB7K9B
[2010/09/03 01:32:00 | 000,000,544 | ---- | M] () -- c:\$recycle.bin\S-1-5-21-1823074419-131638360-2

Title: Re: Application cannot be executed. The file *** is infected.
Post by: SuperDave on November 29, 2010, 01:28:20 PM

Aha! a 64 bit machine(grinding my teeth and cursing under my breath). Very hard to clean but I'll try.
You can delete ComboFix from your desktop.

P2P - The log shows evidence of P2P software installed on your machine BitTorrent and LimeWire . We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It is certainly contributing to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.
*******************************************
There was supposed to be two txt files but I'm only see one. Please try to find the other and post it.

* Open OTL
* Copy and Paste the following text in the codebox into the Custom Scans/Fixes window.

Code: [Select]

:OTL
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:23012
O4:64bit: - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [jgyjwhrk] C:\Users\Will\AppData\Local\Temp\kkrmqceja\ohesbyjtsbl.exe ()
:COMMANDS
[resethosts]
[purity]
[clearrestorepoints]
[emptytemp]
[start explorer]

* Click Run Fix
* OTLI2 may ask to reboot the machine. Please do so if asked.
* Click OK
* A report will open. Copy and Paste that report in your next reply.
*************************************************************

Title: Re: Application cannot be executed. The file *** is infected.
Post by: vawill4891 on November 29, 2010, 04:03:24 PM

here is the extras.txt file, sorry I thought I had pasted it in. I will paste the results of the next log in the next post after my computer restarts.

I was not aware I had any p2p applications on my computer, and did just delete the BitTorrent one you were speaking of, but I did not find the Limewire one you were speaking of, does it go by any other name so I can make sure to get rid of it? I can only assume my brother installed it without my knowledge. =(

Once again I really do appreciate all the help.

OTL Extras logfile created on: 11/28/2010 11:46:04 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\Will\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

6.00 Gb Total Physical Memory | 4.00 Gb Available Physical Memory | 62.00% Memory free
12.00 Gb Paging File | 10.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465.66 Gb Total Space | 323.33 Gb Free Space | 69.43% Space Free | Partition Type: NTFS
Drive D: | 465.75 Gb Total Space | 465.65 Gb Free Space | 99.98% Space Free | Partition Type: NTFS

Computer Name: WILL-DESKTOP | User Name: Will | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{3705C708-1B8A-43A3-8E94-6BAB33A3384B}" = Logitech G-series Keyboard Software
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{84BC87D4-0480-4E10-B15D-1E7886D55180}" = iTunes
"{8DA5428C-3D35-317C-2FBA-485AAC49E9C0}" = ccc-utility64
"{987FE247-4E69-4A2E-A961-D14F901FDBF6}" = Logitech Webcam Software
"{9EFC40E3-5F31-4F75-8445-286273F74D8E}" = Apple Mobile Device Support
"{CCC50A42-892B-AF23-6188-6E8D2FDF34E3}" = ATI Catalyst Install Manager
"{DAE239CE-EB9D-4EB3-B0D4-528D6BAA48FD}" = Bonjour
"{E78A769A-592F-4154-8277-07CC3BDCAAD8}" = MobileMe Control Panel
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0BDE949A-3CF5-3852-B4F7-92EAE4F25F73}" = CCC Help English
"{10CD364B-FFCC-48BE-B469-B9622A033075}" = Fences
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1" = Media Player Classic - Home Cinema v. 1.3.1249.0
"{26A24AE4-039D-4CA4-87B4-2F83216013F0}" = Java(TM) 6 Update 13
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 17
"{342126E1-173C-4585-BFBE-3EBDD20E3E9E}" = Mobipocket Reader 6.2
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{45350494-82B7-3E53-85B7-79A1AD9AE080}" = Catalyst Control Center Graphics Light
"{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}" = Logitech Vid
"{525E7F71-67C1-806E-69D0-892CC3CE2F8E}" = Catalyst Control Center Graphics Full Existing
"{537306C2-CDAC-F606-5D46-D5727F58FAD3}" = Catalyst Control Center Graphics Previews Vista
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{66FF4C48-0083-4E60-8556-B883AB200092}" = Heroes of Might and Magic V - Tribes of the East
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{72736F5F-520D-472A-88CC-7B02872FD34E}" = ATI Catalyst Registration
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{87BB78C4-F36D-4D93-A7C7-F80F18219848}" = AMD DnD V1.0.19
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8136 8168 8169 Ethernet Driver
"{88DDBE5E-8AC0-F463-AC50-E56FAA2E3CEB}" = Catalyst Control Center Graphics Previews Common
"{897B3B21-8691-26F5-97E8-A9955C20BB20}" = Catalyst Control Center HydraVision Full
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A67BB21E-D419-45BB-AB86-7D87D14BBCE2}" = Safari
"{A842C34B-2083-6947-BC0E-5654BDBADCDA}" = Catalyst Control Center Graphics Full New
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{BA3B34EB-3F4B-0E19-0916-971C1AD3F0AD}" = Catalyst Control Center InstallProxy
"{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX
"{CB166F48-6219-2DFD-8800-191BE6F5923A}" = ccc-core-static
"{CB4532F7-A1BD-46D2-9938-3E7D4656FB18}" = Razer Lachesis
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{DA703982C580418795BF4001AA9D7061}" = DivX Plus Media Foundation Components
"{E0B71631-6AA8-C596-A485-8480E92DD745}" = Catalyst Control Center Core Implementation
"{E1B2DF7C-A176-4A1D-9D32-3CEC5037A524}" = Apple Application Support
"{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"360Share Pro" = 360Share Pro(remove only)
"7-Zip" = 7-Zip 4.65
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AIM_7" = AIM 7
"avast!" = avast! Antivirus
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.3
"AVS4YOU Video Converter 6_is1" = AVS Video Converter 6
"BitTorrent" = BitTorrent
"com.adobe.mauby.4875E02D9FB21EE389F73B8 D1702B320485DF8CE.1" = Acrobat.com
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"Dark Age of Camelot" = Dark Age of Camelot
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"Fences" = Fences
"Fraps" = Fraps
"GearBunnies_is1" = GearBunnyX and Classic 1.102
"Google Chrome" = Google Chrome
"HDD Health_is1" = HDD Health v3.3 Beta
"Heroes of Might and Magic II Gold" = Heroes(TM) II Gold
"Heroes of Might and Magic IV" = Heroes of Might and Magic® IV: Winds of War
"Heroes of Might and Magic® III" = Heroes of Might and Magic® III Complete
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Might and Magic® VI" = Might and Magic® VI
"Might and Magic® VII" = Might and Magic® VII
"Mozilla Firefox (3.5.15)" = Mozilla Firefox (3.5.15)
"NeroVision!UninstallKey" = Nero Digital
"NSS" = Norton Security Scan
"RealPlayer 12.0" = RealPlayer
"Secunia PSI" = Secunia PSI
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"StarCraft II Beta" = StarCraft II Beta
"Steam App 17030" = Global Agenda - Beta
"Steam App 18700" = And Yet It Moves
"Steam App 24780" = SimCity 4 Deluxe
"Steam App 31270" = Puzzle Agent
"Steam App 3190" = King's Bounty: Armored Princess - Demo
"Steam App 34200" = Aliens vs Predator Demo
"Steam App 41500" = Torchlight
"Steam App 58200" = Jolly Rover
"Steam App 630" = Alien Swarm
"Steam App 70400" = Recettear: An Item Shop's Tale
"Steam App 9500" = Gish
"VLC media player" = VLC media player 1.1.4
"Warcraft III" = Warcraft III
"Warhammer Online - Age of Reckoning" = Warhammer Online - Age of Reckoning
"WinRAR archiver" = WinRAR archiver
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Toolbar" = Yahoo! Toolbar

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"HuluDesktop" = Hulu Desktop
"SOE-EverQuest II Streaming (US English)" = EverQuest II (US English)

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11/22/2010 1:49:17 AM | Computer Name = Will-Desktop | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "C:\Program Files (x86)\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "C:\Program
Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value
"MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBE R_MAJOR.BUILD_NUMBER_MINOR" of attribute
"version" in element "assemblyIdentity" is invalid.

Error - 11/22/2010 11:27:32 PM | Computer Name = Will-Desktop | Source = Application Error | ID = 1000
Description = Faulting application name: firefox.exe, version: 1.9.1.3951, time
stamp: 0x4cc7a96f Faulting module name: jvm.dll, version: 14.3.0.1, time stamp: 0x4ad1ccc7
Exception
code: 0xc0000005 Fault offset: 0x000c6542 Faulting process id: 0x14d4 Faulting application
start time: 0x01cb84606942022a Faulting application path: C:\Program Files (x86)\Mozilla
Firefox\firefox.exe Faulting module path: C:\PROGRA~2\Java\jre6\bin\client\jvm.dll
Report
Id: 9ad73d47-f6b1-11df-95b2-001fbc0119d1

Error - 11/23/2010 7:35:05 PM | Computer Name = Will-Desktop | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 11/24/2010 1:30:38 AM | Computer Name = Will-Desktop | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "C:\Program Files (x86)\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "C:\Program
Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value
"MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBE R_MAJOR.BUILD_NUMBER_MINOR" of attribute
"version" in element "assemblyIdentity" is invalid.

Error - 11/25/2010 10:04:49 PM | Computer Name = Will-Desktop | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "C:\Program Files (x86)\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "C:\Program
Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value
"MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBE R_MAJOR.BUILD_NUMBER_MINOR" of attribute
"version" in element "assemblyIdentity" is invalid.

Error - 11/26/2010 11:40:18 AM | Computer Name = Will-Desktop | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "C:\Program Files (x86)\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "C:\Program
Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value
"MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBE R_MAJOR.BUILD_NUMBER_MINOR" of attribute
"version" in element "assemblyIdentity" is invalid.

Error - 11/27/2010 11:38:21 PM | Computer Name = Will-Desktop | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 11/27/2010 11:38:21 PM | Computer Name = Will-Desktop | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 11/27/2010 11:38:22 PM | Computer Name = Will-Desktop | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .

Error - 11/28/2010 4:30:53 AM | Computer Name = Will-Desktop | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "C:\Program Files (x86)\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "C:\Program
Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value
"MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBE R_MAJOR.BUILD_NUMBER_MINOR" of attribute
"version" in element "assemblyIdentity" is invalid.

[ System Events ]
Error - 11/27/2010 6:33:14 PM | Computer Name = Will-Desktop | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\SUPERAntiSpyware\SASDIFSV.SYS has been
blocked from loading due to incompatibility with this system. Please contact your
software vendor for a compatible version of the driver.

Error - 11/27/2010 6:33:14 PM | Computer Name = Will-Desktop | Source = Service Control Manager | ID = 7000
Description = The SASDIFSV service failed to start due to the following error: %%1275

Error - 11/27/2010 6:33:15 PM | Computer Name = Will-Desktop | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS has been blocked
from loading due to incompatibility with this system. Please contact your software
vendor for a compatible version of the driver.

Error - 11/27/2010 6:33:15 PM | Computer Name = Will-Desktop | Source = Service Control Manager | ID = 7000
Description = The SASENUM service failed to start due to the following error: %%1275

Error - 11/27/2010 6:33:16 PM | Computer Name = Will-Desktop | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.sys has been
blocked from loading due to incompatibility with this system. Please contact your
software vendor for a compatible version of the driver.

Error - 11/27/2010 6:33:16 PM | Computer Name = Will-Desktop | Source = Service Control Manager | ID = 7000
Description = The SASKUTIL service failed to start due to the following error: %%1275

Error - 11/27/2010 6:33:57 PM | Computer Name = Will-Desktop | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.sys has been
blocked from loading due to incompatibility with this system. Please contact your
software vendor for a compatible version of the driver.

Error - 11/27/2010 6:33:57 PM | Computer Name = Will-Desktop | Source = Service Control Manager | ID = 7000
Description = The SASKUTIL service failed to start due to the following error: %%1275

Error - 11/27/2010 6:33:58 PM | Computer Name = Will-Desktop | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\SUPERAntiSpyware\SASDIFSV.SYS has been
blocked from loading due to incompatibility with this system. Please contact your
software vendor for a compatible version of the driver.

Error - 11/27/2010 6:33:58 PM | Computer Name = Will-Desktop | Source = Service Control Manager | ID = 7000
Description = The SASDIFSV service failed to start due to the following error: %%1275

< End of report >

Title: Re: Application cannot be executed. The file *** is infected.
Post by: vawill4891 on November 29, 2010, 04:12:23 PM

All processes killed
========== OTL ==========
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\TkBellExe deleted successfully.
C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\jgyjwhrk deleted successfully.
C:\Users\Will\AppData\Local\Temp\kkrmqceja\ohesbyjtsbl.exe moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Error: Unable to interpret <[clearrestorepoints]> in the current context!

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: Will
->Temp folder emptied: 7942256922 bytes
->Temporary Internet Files folder emptied: 75341746 bytes
->Java cache emptied: 49214247 bytes
->FireFox cache emptied: 96362871 bytes
->Google Chrome cache emptied: 11432047 bytes
->Flash cache emptied: 149096 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 711168 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 22811987 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 84860 bytes
RecycleBin emptied: 26996528811 bytes

Total Files Cleaned = 33,564.00 mb

OTL by OldTimer - Version 3.2.17.3 log created on 11292010_175943

Files\Folders moved on Reboot...
C:\Users\Will\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Windows\temp\_avast4_\Webshlock.txt not found!
File move failed. C:\Windows\temp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot.
File move failed. C:\Windows\temp\logishrd\LVPrcInj02.dll scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Title: Re: Application cannot be executed. The file *** is infected.
Post by: SuperDave on November 29, 2010, 04:16:52 PM

Quote

delete the BitTorrent one you were speaking of, but I did not find the Limewire one you were speaking of, does it go by any other name so I can make sure to get rid of it?

As I mentioned, I only found traces of it. Programs should not be deleted; they should be uninstalled, whenever possible.
You can also uninstall Java(TM) 6 Update 13 and Java(TM) 6 Update 17

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan (http://eset.com/onlinescan)
•Click the (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetOnline.png) button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

Click on (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetSmartInstall.png) to download the ESET Smart Installer. Save it to your desktop.
Double click on the (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetSmartInstallDesktopIcon.png) icon on your desktop.

•Check (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetAcceptTerms.png)
•Click the (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetStart.png) button.
•Accept any security warnings from your browser.
•Check (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetScanArchives.png)
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetListThreats.png)
•Push (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetExport.png), and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetBack.png) button.
•Push (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetFinish.png)
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

Title: Re: Application cannot be executed. The file *** is infected.
Post by: vawill4891 on November 30, 2010, 03:42:39 PM

C:\Users\Will\Downloads\VLCSetup.exe   a variant of Win32/Adware.HotBar.G application   cleaned by deleting - quarantined
C:\Users\Will\Downloads\XvidSetup(2).exe   a variant of Win32/Adware.HotBar.H application   cleaned by deleting - quarantined
C:\Users\Will\Downloads\XvidSetup(3).exe   a variant of Win32/Adware.HotBar.H application   cleaned by deleting - quarantined
C:\Users\Will\Downloads\XvidSetup.exe   a variant of Win32/Adware.HotBar.H application   cleaned by deleting - quarantined

Title: Re: Application cannot be executed. The file *** is infected.
Post by: SuperDave on November 30, 2010, 05:04:39 PM

So, how's your computer working?

Title: Re: Application cannot be executed. The file *** is infected.
Post by: vawill4891 on November 30, 2010, 07:04:04 PM

Its working very well, I havent had any popups for any virus's, which is awesome. Do you think I am all cleaned out now?

Title: Re: Application cannot be executed. The file *** is infected.
Post by: SuperDave on December 01, 2010, 12:20:09 PM

The sound good. Let's do some cleanup.

To remove all of the tools we used and the files and folders they created do the following:
Double click OTL.exe.

Click the CleanUp button.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes.

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.
********************************************
To set a new Restore Point.

Click Start button , click Control Panel, click System and Maintenance, and then clicking System. In the left pane, click System Protection. If you are prompted for an administrator password or confirmation, type the password or provide confirmation. To turn off System Protection for a hard disk, clear the check box next to the disk, and then click OK. Reboot to Normal Mode.
Click the Start button , click Control Panel, click System and Maintenance, and then click System.
In the left pane, click System Protection. If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
To turn on System Protection for a hard disk, select the check box next to the disk, and then click OK.
*****************************************************
Clean out your temporary internet files and temp files.

Download TFC by OldTimer (http://oldtimer.geekstogo.com/TFC.exe) to your desktop.

Double-click TFC.exe to run it.

Note: If you are running on Vista, right-click on the file and choose Run As Administrator

TFC will close all programs when run, so make sure you have saved all your work before you begin.

* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.

Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.
********************************************
Just in case you don't have a second-party firewall.

Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.

Remember only install ONE firewall

1) Comodo Personal Firewall (http://www.majorgeeks.com/Comodo_Personal_Firewall_d5033.html) (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
2) Online Armor (http://www.majorgeeks.com/Online_Armor_Free_d4872.html)
3) Agnitum Outpost (http://www.majorgeeks.com/Outpost_Firewall_Free_d1056.html)
4) PC Tools Firewall Plus (http://www.majorgeeks.com/PC_Tools_Firewall_Plus_d5470.html)

If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
**************************************
Use the Secunia Software Inspector (http://secunia.com/software_inspector) to check for out of date software.

•Click Start Now

•Check the box next to Enable thorough system inspection.

•Click Start

•Allow the scan to finish and scroll down to see if any updates are needed.
•Update anything listed.
.
----------

Go to Microsoft Windows Update (http://windowsupdate.microsoft.com/) and get all critical updates.

----------

I suggest using WOT - Web of Trust (http://www.mywot.com/). WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html)- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer (http://www.bleepingcomputer.com/forums/tutorial49.html) from Spyware and Malware
* If you don't know what ActiveX controls are, see here (http://www.webopedia.com/TERM/A/ActiveX_control.html)

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. (http://www.safer-networking.org/en/spybotsd/index.html) Guide: Use Spybot's Immunize Feature (http://www.bleepingcomputer.com/tutorials/tutorial43.html#immunize) to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ (http://www.safer-networking.org/en/faq/index.html)

Check out Keeping Yourself Safe On The Web (http://evilfantasy.wordpress.com/2008/05/20/keeping-yourself-safe-on-the-web/) for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It may not be Malware (http://evilfantasy.wordpress.com/2008/05/24/slow-computer-it-may-not-be-malware/) for free cleaning/maintenance tools to help keep your computer running smoothly.
Safe Surfing!