Author Topic: Host Process has stopped working/Explorer crash/Aero problems (Read 28601 times)

mcdidd · « **on:** September 06, 2010, 08:54:52 AM »

My computer was infected with a virus a couple days ago and things started going crazy. I have Windows Vista Home Premium and I have the Aero interface activated. When I open Windows Explorer, it crashes and it brings up a "Windows Explorer is not responding" window (This window is using the Windows Classic theme...) and the computer completely goes crazy. If I restart Explorer, it often reloads in Windows Classic theme (Not Aero). Also, the Host Process stops responding so I cannot run many programs. I have scanned my computer with Malwarebytes, SUPERAntiSpyware, and HijackThis, and I have logs ready to post. If someone can help me, let me know if you'd like me to attach the logs or post their contents. Thanks in advance.

PS: Now I'm getting a notification that says "Windows could not connect to the User Profile Service service." I also have a browser redirect problem. Can someone help me out? I need this computer virus free as soon as possible.

harry 48 · « **Reply #1 on:** September 06, 2010, 12:16:37 PM »

please post the logs for the expert to see

Allan · « **Reply #2 on:** September 06, 2010, 12:20:45 PM »

Please follow the instructions in the following link:
http://www.computerhope.com/forum/index.php/topic,46313.0.html

mcdidd · « **Reply #3 on:** September 06, 2010, 12:27:48 PM »

Allan, I have already followed all the instructions in that link and I have all the logs ready to post. I just need to know if someone can help me so I can post them.

Allan · « **Reply #4 on:** September 06, 2010, 12:33:53 PM »

I don't understand why you have multiple threads going on this.

mcdidd · « **Reply #5 on:** September 06, 2010, 01:06:57 PM »

Sorry Allan, I wasn't sure if I had posted in the correct place. Anyway, here are the logs.

[recovering disk space - old attachment deleted by admin]

mcdidd · « **Reply #6 on:** September 06, 2010, 03:05:36 PM »

Now Windows Explorer keeps crashing. What is the next step?

mcdidd · « **Reply #7 on:** September 08, 2010, 03:46:34 PM »

Can someone please help me? My computer freezes up and explorer crashes every time I type a single letter into Start Search. Someone, please tell me what to do because I can't take this any longer.

SuperDave · « **Reply #8 on:** September 15, 2010, 03:52:32 PM »

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.

Sorry for being so late. Do you still require help?

mcdidd · « **Reply #9 on:** September 15, 2010, 04:36:25 PM »

SuperDave, thanks for the reply. I'm not completely sure if my computer is still infected, so can you guide me through scans so I can figure out if any further action is required? Thanks in advance.

SuperDave · « **Reply #10 on:** September 15, 2010, 06:42:21 PM »

Please download ComboFix

from BleepingComputer.com

Alternate link: GeeksToGo.com

Rename ComboFix.exe to commy.exe before you save it to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here
Click Start then copy paste the following command into the search box & hit enter: "%userprofile%\desktop\commy.exe" /stepdel
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. This will not install in Vista. Just continue scanning, and skip the console install.
When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply.

If you have problems with ComboFix usage, see How to use ComboFix
******************************
Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1
Link 2

* Unzip SecurityCheck.zip and a folder named Security Check should appear.
* Open the Security Check folder and double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.

mcdidd · « **Reply #11 on:** September 16, 2010, 03:41:26 PM »

SuperDave, do you want me to copy the contents of the logs and paste them in my reply, or attach the logs?

SuperDave · « **Reply #12 on:** September 16, 2010, 04:58:47 PM »

Copy and paste is the way to go.

mcdidd · « **Reply #13 on:** September 16, 2010, 06:04:45 PM »

My antivirus detected ComboFix as a virus in itself... Should I go ahead and allow it access?

BC_Programmer · « **Reply #14 on:** September 16, 2010, 08:20:32 PM »

Quote from: SuperDave on September 15, 2010, 06:42:21 PM

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here

mcdidd · « **Reply #15 on:** September 16, 2010, 10:15:00 PM »

When I run ComboFix, it kills my internet connection, so i have to restart my computer. It never completes the scan fully. It always stops responding. Also, ComboFix appears to have created a new folder in the C: drive. When i click on it, it takes me back to Computer.

[recovering disk space - old attachment deleted by admin]

SuperDave · « **Reply #16 on:** September 17, 2010, 12:11:52 PM »

Delete your copy of ComboFix; download a fresh copy, except before you download it, rename it to blackpudding.bat

Navigate to Start --> Run, and enter the following command exactly as shown:

"%userprofile%\desktop\blackpudding.bat" /killall

See if ComboFix will run now

mcdidd · « **Reply #17 on:** September 17, 2010, 05:20:59 PM »

It didn't work. I tried running it again, and something stopped working. Then it said it was creating a log, but instead, it crashed my computer. I got the dreaded blue screen of death. I checked in the location the log would have saved in and it's not there.

[recovering disk space - old attachment deleted by admin]

SuperDave · « **Reply #18 on:** September 18, 2010, 05:17:56 PM »

Ok. Delete ComboFix and we'll try this instead.

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Under the Custom Scan box paste this in

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%\*.exe
%systemroot%\*. /mp /s
c:\$recycle.bin\*.* /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
nvstor32.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
explorer.exe
svchost.exe
userinit.exe
qmgr.dll
ws2_32.dll
proquota.exe
imm32.dll
kernel32.dll
ndis.sys
autochk.exe
spoolsv.exe
xmlprov.dll
ntmssvc.dll
mswsock.dll
Beep.SYS
ntfs.sys
termsrv.dll
sfcfiles.dll
st3shark.sys
ahcix86.sys
srsvc.dll
nvrd32.sys
/md5stop
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time

mcdidd · « **Reply #19 on:** September 18, 2010, 09:38:24 PM »

Here is ORL.txtOTL logfile created on: 9/18/2010 8:41:15 PM - Run 1
OTL by OldTimer - Version 3.2.12.1 Folder = C:\Users\Antoun\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 43.00% Memory free
6.00 Gb Paging File | 4.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.71 Gb Total Space | 253.01 Gb Free Space | 55.52% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 4.37 Gb Free Space | 43.75% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive K: | 930.86 Gb Total Space | 648.33 Gb Free Space | 69.65% Space Free | Partition Type: NTFS

Computer Name: GOBRAN-PC
Current User Name: Antoun
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/09/18 20:40:17 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Antoun\Desktop\OTL.exe
PRC - [2010/09/16 18:01:42 | 000,975,928 | ---- | M] (Google Inc.) -- C:\Users\Antoun\AppData\Local\Google\Chrome\Application\chrome.exe
PRC - [2010/09/14 16:49:42 | 000,352,976 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
PRC - [2010/07/20 09:45:30 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2010/06/10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/06/02 19:50:58 | 001,144,104 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2010/05/26 12:59:26 | 001,730,944 | ---- | M] (Microsoft Corp.) -- C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2010/05/26 12:59:26 | 000,198,528 | ---- | M] (Microsoft Corp.) -- C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2010/05/21 06:27:04 | 000,173,352 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe
PRC - [2010/05/20 15:27:26 | 000,762,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\vVX3000.exe
PRC - [2010/05/20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe
PRC - [2010/05/14 11:00:26 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2010/05/07 07:36:10 | 000,092,008 | ---- | M] (TomTom) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
PRC - [2009/11/05 09:44:16 | 000,110,592 | ---- | M] (WDC) -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
PRC - [2009/09/10 09:58:25 | 000,168,960 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmplayer.exe
PRC - [2009/08/03 10:29:04 | 000,102,400 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
PRC - [2009/08/03 10:22:58 | 000,233,472 | ---- | M] (Teruten) -- C:\Windows\System32\FsUsbExService.Exe
PRC - [2009/06/16 09:58:08 | 000,020,480 | ---- | M] (Memeo) -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
PRC - [2009/04/11 01:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/04/11 01:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2008/12/06 19:32:22 | 000,886,784 | ---- | M] () -- C:\Program Files\AeroSnap\AeroSnap.exe
PRC - [2008/09/16 12:03:18 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
PRC - [2008/08/14 00:04:44 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
PRC - [2008/01/17 07:22:20 | 004,907,008 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007/12/05 06:17:24 | 000,077,824 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AERTSrv.exe
PRC - [2006/11/03 18:02:14 | 000,050,688 | ---- | M] (Avanquest Software ) -- C:\Program Files\Digital Line Detect\DLG.exe
PRC - [2006/11/03 17:04:46 | 000,304,008 | ---- | M] () -- C:\Program Files\Dell Photo AIO Printer 926\memcard.exe

========== Modules (SafeList) ==========

MOD - [2010/09/18 20:40:17 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Antoun\Desktop\OTL.exe
MOD - [2009/04/11 01:21:38 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll
MOD - [2008/01/20 21:24:37 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe -- (SessionLauncher)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)
SRV - [2010/09/17 17:41:10 | 000,411,432 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010/09/14 16:49:42 | 000,352,976 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe -- (AVP)
SRV - [2010/06/10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/06/04 16:52:12 | 000,049,504 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010/05/26 12:59:26 | 001,730,944 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010/05/21 06:27:04 | 000,173,352 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5)
SRV - [2010/05/20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2010/05/14 11:00:26 | 000,249,136 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2010/05/07 07:36:10 | 000,092,008 | ---- | M] (TomTom) [Auto | Running] -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2010/03/30 12:43:02 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010/03/18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/12/15 18:34:31 | 000,030,192 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe -- (GoogleDesktopManager-110309-193829)
SRV - [2009/11/05 09:44:16 | 000,110,592 | ---- | M] (WDC) [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe -- (WDDMService)
SRV - [2009/09/24 20:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009/08/03 10:22:58 | 000,233,472 | ---- | M] (Teruten) [Auto | Running] -- C:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService)
SRV - [2009/06/16 09:58:08 | 000,020,480 | ---- | M] (Memeo) [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe -- (WDSmartWareBackgroundService)
SRV - [2008/09/16 12:03:18 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor7.0)
SRV - [2008/08/14 00:04:44 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2008/07/24 00:56:21 | 000,016,680 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe -- (GoToAssist)
SRV - [2008/05/14 10:32:18 | 000,309,744 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe -- (RoxLiveShare10)
SRV - [2008/05/14 10:32:10 | 000,166,384 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe -- (RoxWatch10)
SRV - [2008/05/14 10:31:38 | 001,120,752 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe -- (RoxMediaDB10)
SRV - [2008/04/07 10:17:30 | 000,430,592 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008/01/20 21:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/12/05 06:17:24 | 000,077,824 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AERTSrv.exe -- (AERTFilters)
SRV - [2006/10/11 16:48:50 | 000,532,480 | ---- | M] ( ) [Auto | Stopped] -- C:\Windows\System32\dlcxcoms.exe -- (dlcx_device)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ScreamingBAudio.sys -- (SCREAMINGBDRIVER)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ManyCam.sys -- (ManyCam)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ivusb.sys -- (ivusb)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Antoun\AppData\Local\Temp\cpuz132\cpuz132_x32.sys -- (cpuz132)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Antoun\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_Vista\AVGIDSShim.sys -- (AVGIDSShimvtx)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_Vista\AVGIDSFilter.sys -- (AVGIDSFiltervtx)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_Vista\AVGIDSDriver.sys -- (AVGIDSDrivervtx)
DRV - [2010/09/14 16:49:42 | 000,488,024 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\Windows\System32\drivers\klif.sys -- (KLIF)
DRV - [2010/09/08 20:09:05 | 000,023,456 | ---- | M] (Phoenix Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\DrvAgent32.sys -- (DrvAgent32)
DRV - [2010/08/08 18:27:09 | 000,025,168 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\AVGIDSvx.sys -- (AVGIDSErHrvtx)
DRV - [2010/06/09 17:43:52 | 000,011,352 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\System32\drivers\kl2.sys -- (kl2)
DRV - [2010/06/09 17:43:50 | 000,132,184 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\kl1.sys -- (KL1)
DRV - [2010/06/04 16:02:50 | 000,018,528 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rdpdispm.sys -- (RDPDISPM)
DRV - [2010/05/20 15:27:26 | 001,961,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VX3000.sys -- (VX3000)
DRV - [2010/04/22 19:07:34 | 000,022,104 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\System32\drivers\klim6.sys -- (KLIM6)
DRV - [2009/11/04 17:54:12 | 000,040,552 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mfesmfk.sys -- (mfesmfk)
DRV - [2009/11/04 17:53:40 | 000,034,248 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mferkdk.sys -- (mferkdk)
DRV - [2009/11/02 20:27:16 | 000,019,984 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\klmouflt.sys -- (klmouflt)
DRV - [2009/08/03 10:22:58 | 000,036,608 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk)
DRV - [2009/05/13 12:41:02 | 000,121,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscemdm.sys -- (sscemdm)
DRV - [2009/05/13 12:41:02 | 000,090,240 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscebus.sys -- (sscebus) SAMSUNG USB Composite Device V2 driver (WDM)
DRV - [2009/05/13 12:41:02 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscemdfl.sys -- (sscemdfl)
DRV - [2009/04/10 23:42:54 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2009/02/26 12:39:50 | 004,569,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx)
DRV - [2009/02/13 12:02:52 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wdcsam.sys -- (WDC_SAM)
DRV - [2008/12/26 12:56:04 | 000,017,792 | ---- | M] (Avnex) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vcsvad.sys -- (VCSVADHWSer) Avnex Virtual Audio Device (WDM)
DRV - [2008/05/07 22:07:20 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DPV.sys -- (HSF_DPV)
DRV - [2008/05/07 22:05:18 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2008/05/07 22:04:16 | 000,661,504 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_CNXT.sys -- (winachsf)
DRV - [2008/01/24 11:06:40 | 002,054,872 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008/01/23 10:08:58 | 000,099,456 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\bsusbser.sys -- (bsusbser)
DRV - [2008/01/20 21:23:49 | 000,007,680 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\umpass.sys -- (UMPass)
DRV - [2008/01/20 21:23:27 | 000,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR)
DRV - [2008/01/20 21:23:27 | 000,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2008/01/20 21:23:27 | 000,031,288 | ---- | M] (LSI Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2008/01/20 21:23:26 | 000,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2008/01/20 21:23:26 | 000,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2008/01/20 21:23:26 | 000,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2008/01/20 21:23:25 | 000,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2008/01/20 21:23:25 | 000,089,656 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2008/01/20 21:23:24 | 001,122,360 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2008/01/20 21:23:24 | 000,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2008/01/20 21:23:24 | 000,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2008/01/20 21:23:23 | 000,235,064 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2008/01/20 21:23:23 | 000,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2008/01/20 21:23:23 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2008/01/20 21:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2008/01/20 21:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2008/01/20 21:23:23 | 000,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2008/01/20 21:23:22 | 000,342,584 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2008/01/20 21:23:21 | 000,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2008/01/20 21:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2008/01/20 21:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2008/01/20 21:23:20 | 000,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2008/01/20 21:23:00 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2008/01/20 21:23:00 | 000,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2008/01/20 21:23:00 | 000,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2008/01/02 23:13:18 | 001,044,984 | ---- | M] (Broadcom Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\BCMWL6.SYS -- (BCM43XX)
DRV - [2007/10/18 00:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/05/01 16:08:40 | 000,132,232 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SaiH0460.sys -- (SaiH0460)
DRV - [2007/04/29 03:42:24 | 000,228,224 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2007/04/26 05:41:38 | 000,304,920 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastor.sys -- (iaStor)
DRV - [2007/01/19 07:07:03 | 000,013,184 | ---- | M] (Xponaut) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\xpntwbd.sys -- (Xponaut_WBD) Xponaut WaveBridge Device (WDM)
DRV - [2006/11/02 04:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 04:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 04:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 04:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 04:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 04:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 04:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 04:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 04:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 04:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 04:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 03:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 03:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 03:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 03:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 03:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 03:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 02:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 02:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} - C:\Program Files\Swag_Bucks\tbSwag.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} - C:\Program Files\Swag_Bucks\tbSwag.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginen ame: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=736148"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: [email protected]:5.0
FF - prefs.js..extensions.enabledItems: {3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}:2.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {27182e60-b5f3-411c-b545-b44205977502}:1.0
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6483
FF - prefs.js..extensions.enabledItems: *Blocked Russian URL*:11.0.1.400
FF - prefs.js..extensions.enabledItems: *Blocked Russian URL*:11.0.1.400
FF - prefs.js..keyword.URL: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=LMW2&o=16046&locale=en_US&q="

FF - HKLM\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\Firefox [2010/05/26 15:01:09 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010/06/09 07:10:13 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2010/07/02 00:29:30 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/17 17:43:12 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/11 16:37:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\THBExt [2010/09/10 21:05:20 | 000,000,000 | ---D | M]

[2010/02/06 17:51:41 | 000,000,000 | ---D | M] -- C:\Users\Antoun\AppData\Roaming\Mozilla\Extensions
[2010/02/06 17:51:41 | 000,000,000 | ---D | M] -- C:\Users\Antoun\AppData\Roaming\Mozilla\Extensions\[email protected]
[2009/12/15 18:16:37 | 000,000,000 | ---D | M] -- C:\Users\Antoun\AppData\Roaming\Mozilla\Extensions\[email protected]
[2010/09/13 21:03:20 | 000,000,000 | ---D | M] -- C:\Users\Antoun\AppData\Roaming\Mozilla\Firefox\Profiles\7lv6i28j.default\extensions
[2010/01/27 16:23:28 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Antoun\AppData\Roaming\Mozilla\Firefox\Profiles\7lv6i28j.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/01 22:28:24 | 000,002,425 | ---- | M] () -- C:\Users\Antoun\AppData\Roaming\Mozilla\Firefox\Profiles\7lv6i28j.default\searchplugins\askcom.xml
[2010/09/10 21:08:17 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/09/09 16:27:28 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/06/19 08:16:18 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/20 13:40:53 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/09/10 21:08:17 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla *Blocked Russian URL*
[2010/09/10 21:08:15 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla *Blocked Russian URL*
[2009/11/19 16:16:28 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2010/04/12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2009/11/19 16:16:29 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll

O1 HOSTS File: ([2010/09/17 18:30:54 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Swag Bucks Toolbar) - {8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} - C:\Program Files\Swag_Bucks\tbSwag.dll (Conduit Ltd.)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll (Microsoft Corporation)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (ChromeFrame BHO) - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files\Google\Chrome Frame\Application\6.0.472.62\npchrome_frame.dll (Google Inc.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Swag Bucks Toolbar) - {8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} - C:\Program Files\Swag_Bucks\tbSwag.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (@C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Swag Bucks Toolbar) - {8BDEA9D6-6F62-45EB-8EE9-8A81AF0D2F94} - C:\Program Files\Swag_Bucks\tbSwag.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [Bing Bar] C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe (Microsoft Corp.)
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [DLCXCATS] C:\Windows\System32\spool\DRIVERS\W32X86\3\DLCXtime.DLL ()
O4 - HKLM..\Run: [dlcxmon.exe] C:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe ()
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [FaxCenterServer] C:\Program Files\Dell PC Fax\fm3032.exe ()
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [lifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [MemoryCardManager] C:\Program Files\Dell Photo AIO Printer 926\memcard.exe ()
O4 - HKLM..\Run: [Microsoft Default Manager] C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NPSStartup] File not found
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime Alternative\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [VX3000] C:\Windows\vVX3000.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AeroSnap] C:\Program Files\AeroSnap\AeroSnap.exe ()
O4 - HKCU..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKCU..\Run: [cdloader] C:\Users\Antoun\AppData\Roaming\mjusbsp\cdloader2.exe (magicJack L.P.)
O4 - HKCU..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)
O4 - HKCU..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm ()
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: &Virtual Keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 172.16.0.1
O18 - Protocol\Handler\gcf {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files\Google\Chrome Frame\Application\6.0.472.62\npchrome_frame.dll (Google Inc.)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\kloehk.dll (Kaspersky Lab ZAO)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\Windows\system32\klogon.dll - C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
O24 - Desktop WallPaper: C:\Users\Antoun\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Antoun\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...com [@ = ComFile] -- Reg Error: Key error. File not found
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

MsConfig - State: "startup" - 0

SafeBootMin: AppMgmt - C:\Windows\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: MCODS - Reg Error: Value error.
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PEVSystemStart - Service
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: procexp90.Sys - Driver
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - C:\Windows\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SafeBootNet: HelpSvc - Service
SafeBootNet: MCODS - Reg Error: Value error.
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PEVSystemStart - Service
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: procexp90.Sys - Driver
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX: {01EE80FB-7377-8E01-4146-57C3698DE15E} - DirectX
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C5F49C72-9B67-2604-D2DD-CDF7E107C98F} - Internet Explorer
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker 2.6
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Reg Error: Value error.
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{3919ede4-91b6-4fc3-8303-3e92cad40725} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} -

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

========== Files/Folders - Created Within 90 Days ==========

[2010/09/18 20:40:12 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\Antoun\Desktop\OTL.exe
[2010/09/17 18:39:46 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2010/09/17 18:30:48 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010/09/17 18:15:23 | 000,000,000 | ---D | C] -- C:\ComboFix
[2010/09/17 18:15:01 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010/09/16 17:16:14 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2010/09/16 17:16:14 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2010/09/16 17:16:14 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2010/09/16 17:15:54 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010/09/16 17:15:16 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/09/10 21:04:30 | 000,000,000 | ---D | C] -- C:\Program Files\Kaspersky Lab
[2010/09/10 21:03:51 | 000,488,024 | ---- | C] (Kaspersky Lab) -- C:\Windows\System32\drivers\klif.sys
[2010/09/10 20:44:04 | 000,000,000 | ---D | C] -- C:\kleaner.tmp
[2010/09/10 19:53:17 | 000,000,000 | ---D | C] -- C:\Program Files\Dell PC Fax
[2010/09/09 18:51:17 | 000,000,000 | R--D | C] -- C:\Users\Antoun\Desktop\Prom
[2010/09/09 18:50:18 | 000,000,000 | ---D | C] -- C:\Users\Antoun\Desktop\Senior Pics
[2010/09/09 16:25:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2010/09/09 16:04:24 | 000,053,248 | ---- | C] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\System32\CSVer.dll
[2010/09/09 16:02:30 | 000,000,000 | ---D | C] -- C:\Windows\System32\Lang
[2010/09/09 15:59:44 | 000,131,072 | ---- | C] (Dell, Inc.) -- C:\Windows\System32\DellSPMsg.dll
[2010/09/08 20:09:06 | 000,023,456 | ---- | C] (Phoenix Technologies) -- C:\Windows\System32\drivers\DrvAgent32.sys
[2010/09/08 20:09:05 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Local\eSupport.com
[2010/09/08 20:00:00 | 000,572,728 | ---- | C] (Copyright © 2009 Phoenix Technologies LTD. All Rights Reserved.) -- C:\Users\Antoun\Desktop\DriverAgent.exe
[2010/09/08 19:56:27 | 001,913,032 | ---- | C] (Trend Micro Inc.) -- C:\Users\Antoun\Desktop\HousecallLauncher.exe
[2010/09/08 17:11:45 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Local\ABBYY
[2010/09/08 16:45:56 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Local\PunkBuster
[2010/09/08 16:22:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2010/09/07 20:40:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab Setup Files
[2010/09/04 12:31:05 | 000,000,000 | ---D | C] -- C:\Users\Antoun\Desktop\Logs
[2010/09/04 11:41:12 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Roaming\SUPERAntiSpyware.com
[2010/09/04 11:41:12 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2010/09/04 11:41:03 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2010/09/04 09:46:21 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Roaming\ViGlance
[2010/09/04 09:46:21 | 000,000,000 | ---D | C] -- C:\Program Files\ViGlance
[2010/09/04 09:17:42 | 000,000,000 | ---D | C] -- C:\Program Files\CodeGazer
[2010/09/04 09:08:33 | 000,000,000 | ---D | C] -- C:\Users\Antoun\Desktop\Windows 7 Style
[2010/09/03 15:36:07 | 000,000,000 | ---D | C] -- C:\Users\Antoun\Documents\VirtualDJ
[2010/09/03 15:36:04 | 000,000,000 | ---D | C] -- C:\Program Files\VirtualDJ
[2010/09/02 23:50:19 | 000,000,000 | ---D | C] -- C:\Program Files\NaturalSoft
[2010/09/02 17:02:19 | 000,000,000 | ---D | C] -- C:\Program Files\Dell Photo AIO Printer 926(545)
[2010/08/24 23:17:38 | 000,000,000 | ---D | C] -- C:\Users\Antoun\Documents\Pamela Call Recordings
[2010/08/23 11:58:44 | 000,000,000 | ---D | C] -- C:\Users\Antoun\Desktop\KFC Cole Slaw Fat Free Recipe_files
[2010/08/23 11:52:35 | 000,000,000 | ---D | C] -- C:\Users\Antoun\Desktop\Top Secret Recipes_files
[2010/08/21 18:45:50 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUpMedia
[2010/08/20 12:15:59 | 000,000,000 | ---D | C] -- C:\Users\Antoun\Desktop\andy
[2010/08/17 17:43:09 | 000,000,000 | ---D | C] -- C:\Program Files\Coupons
[2010/08/17 10:09:01 | 000,000,000 | ---D | C] -- C:\found.000
[2010/08/16 21:08:31 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2010/08/16 21:08:19 | 000,000,000 | ---D | C] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/08/16 21:08:17 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2010/08/16 21:04:10 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2010/08/13 18:16:17 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft LifeCam
[2010/08/13 15:11:41 | 000,413,696 | ---- | C] (Creative Labs) -- C:\Windows\System32\wrap_oal.dll
[2010/08/13 15:11:41 | 000,110,592 | ---- | C] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\Windows\System32\OpenAL32.dll
[2010/08/13 15:11:41 | 000,000,000 | ---D | C] -- C:\Program Files\OpenAL
[2010/08/13 15:11:19 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Roaming\flightgear.org
[2010/08/13 15:09:17 | 000,000,000 | ---D | C] -- C:\Program Files\FlightGear
[2010/08/11 12:28:36 | 000,000,000 | ---D | C] -- C:\$AVG
[2010/08/11 06:56:18 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Roaming\AVG9
[2010/08/08 21:52:51 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Local\thglmndwu
[2010/08/08 18:27:09 | 000,025,168 | ---- | C] (AVG Technologies CZ, s.r.o. ) -- C:\Windows\System32\drivers\AVGIDSvx.sys
[2010/08/08 18:23:59 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
[2010/08/05 10:35:41 | 000,000,000 | ---D | C] -- C:\OtsLabs
[2010/08/04 17:56:38 | 000,088,560 | ---- | C] (Sonic Solutions) -- C:\Users\Antoun\DC_ShellExt.dll
[2010/08/04 17:07:47 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Roaming\Screaming Bee
[2010/08/04 17:07:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Screaming Bee
[2010/08/04 17:06:08 | 000,000,000 | ---D | C] -- C:\Program Files\Screaming Bee
[2010/08/02 12:35:28 | 000,000,000 | ---D | C] -- C:\Program Files\Dell
[2010/08/02 12:35:19 | 000,000,000 | ---D | C] -- C:\Program Files\Dell Photo AIO Printer 926
[2010/08/02 12:34:55 | 001,224,704 | ---- | C] ( ) -- C:\Windows\System32\dlcxserv.dll
[2010/08/02 12:34:55 | 000,991,232 | ---- | C] ( ) -- C:\Windows\System32\dlcxusb1.dll
[2010/08/02 12:34:55 | 000,696,320 | ---- | C] ( ) -- C:\Windows\System32\dlcxhbn3.dll
[2010/08/02 12:34:55 | 000,684,032 | ---- | C] ( ) -- C:\Windows\System32\dlcxcomc.dll
[2010/08/02 12:34:55 | 000,643,072 | ---- | C] ( ) -- C:\Windows\System32\dlcxpmui.dll
[2010/08/02 12:34:55 | 000,585,728 | ---- | C] ( ) -- C:\Windows\System32\dlcxlmpm.dll
[2010/08/02 12:34:55 | 000,532,480 | ---- | C] ( ) -- C:\Windows\System32\dlcxcoms.exe
[2010/08/02 12:34:55 | 000,421,888 | ---- | C] ( ) -- C:\Windows\System32\dlcxcomm.dll
[2010/08/02 12:34:55 | 000,413,696 | ---- | C] ( ) -- C:\Windows\System32\dlcxinpa.dll
[2010/08/02 12:34:55 | 000,397,312 | ---- | C] ( ) -- C:\Windows\System32\dlcxiesc.dll
[2010/08/02 12:34:55 | 000,380,928 | ---- | C] ( ) -- C:\Windows\System32\dlcxih.exe
[2010/08/02 12:34:55 | 000,323,584 | ---- | C] ( ) -- C:\Windows\System32\dlcxhcp.dll
[2010/08/02 12:34:55 | 000,163,840 | ---- | C] ( ) -- C:\Windows\System32\dlcxprox.dll
[2010/08/02 12:34:55 | 000,094,208 | ---- | C] ( ) -- C:\Windows\System32\dlcxpplc.dll
[2010/08/02 12:34:54 | 000,381,832 | ---- | C] ( ) -- C:\Windows\System32\dlcxcfg.exe
[2010/08/02 11:48:17 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Drivers HeadQuarters
[2010/07/30 15:57:05 | 000,000,000 | ---D | C] -- C:\Program Files\Carbonite
[2010/07/30 15:57:04 | 000,000,000 | -HSD | C] -- C:\Windows\ftpcache
[2010/07/30 10:51:53 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Local\tjnet
[2010/07/29 22:35:08 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Roaming\mjusbsp
[2010/07/29 18:22:47 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Symantec Shared
[2010/07/29 17:50:23 | 000,000,000 | ---D | C] -- C:\Users\Antoun\Documents\WebCam Media
[2010/07/29 17:41:02 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Roaming\ArcSoft
[2010/07/27 12:30:38 | 000,000,000 | ---D | C] -- C:\games
[2010/07/24 15:33:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Alwil Software
[2010/07/24 15:33:39 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2010/07/22 18:19:18 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Roaming\CBS Interactive
[2010/07/22 18:08:30 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Roaming\Auslogics
[2010/07/22 18:08:25 | 000,000,000 | ---D | C] -- C:\Program Files\Auslogics
[2010/07/20 09:46:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\xing shared
[2010/07/20 09:45:31 | 000,000,000 | ---D | C] -- C:\Program Files\real
[2010/07/18 21:13:14 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2010/07/18 20:36:55 | 000,000,000 | ---D | C] -- C:\Users\Antoun\Documents\FIFA 10
[2010/07/18 20:20:05 | 000,000,000 | ---D | C] -- C:\Program Files\EA Sports
[2010/07/18 18:02:24 | 000,278,528 | ---- | C] (Real Networks, Inc) -- C:\Windows\System32\pncrt.dll
[2010/07/18 18:02:21 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Real
[2010/07/18 18:02:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Real
[2010/07/18 18:02:16 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Roaming\Real
[2010/07/14 23:24:24 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Local\SkypeFx
[2010/07/14 23:23:48 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Local\IsolatedStorage
[2010/07/14 22:24:38 | 000,000,000 | ---D | C] -- C:\AV_LOGS
[2010/07/14 22:15:24 | 000,017,792 | ---- | C] (Avnex) -- C:\Windows\System32\drivers\vcsvad.sys
[2010/07/14 16:34:29 | 000,000,000 | ---D | C] -- C:\Program Files\Xponaut
[2010/07/13 12:00:59 | 000,000,000 | ---D | C] -- C:\Fraps
[2010/07/10 18:04:37 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2010/07/10 18:02:52 | 000,000,000 | ---D | C] -- C:\ProgramData\RegInOut
[2010/07/10 18:02:47 | 000,000,000 | ---D | C] -- C:\Windows\RegInOut
[2010/07/10 15:44:22 | 000,000,000 | ---D | C] -- C:\Program Files\Steam
[2010/07/10 15:34:31 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Roaming\VSRevoGroup
[2010/07/09 22:42:00 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2010/07/09 10:37:50 | 000,000,000 | ---D | C] -- C:\Users\Antoun\Documents\Groove Workspace Templates
[2010/07/04 17:47:37 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Local\Chromium
[2010/07/02 00:43:44 | 000,000,000 | ---D | C] -- C:\Windows\en
[2010/07/02 00:28:00 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Local\Windows Live
[2010/07/01 21:35:12 | 000,228,024 | ---- | C] (Kaspersky Lab ZAO) -- C:\Windows\System32\klogon.dll
[2010/06/29 10:08:26 | 000,000,000 | ---D | C] -- C:\Windows\System32\EXP
[2010/06/28 15:34:38 | 000,000,000 | ---D | C] -- C:\Users\Antoun\Desktop\P90X
[2010/06/27 20:23:58 | 000,000,000 | ---D | C] -- C:\Users\Antoun\AppData\Roaming\Stereoscopic Player
[2010/06/25 21:19:33 | 000,000,000 | ---D | C] -- C:\Users\Antoun\Documents\Electronic Arts
[2010/06/25 20:48:48 | 000,000,000 | ---D | C] -- C:\Program Files\Electronic Arts
[2010/06/23 23:38:41 | 000,000,000 | ---D | C] -- C:\Program Files\Rockstar Games
[2010/06/23 10:38:41 | 000,000,0

mcdidd · « **Reply #20 on:** September 18, 2010, 09:40:29 PM »

Here is Extras.txtOTL Extras logfile created on: 9/18/2010 8:41:15 PM - Run 1
OTL by OldTimer - Version 3.2.12.1 Folder = C:\Users\Antoun\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 43.00% Memory free
6.00 Gb Paging File | 4.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.71 Gb Total Space | 253.01 Gb Free Space | 55.52% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 4.37 Gb Free Space | 43.75% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive K: | 930.86 Gb Total Space | 648.33 Gb Free Space | 69.65% Space Free | Partition Type: NTFS

Computer Name: GOBRAN-PC
Current User Name: Antoun
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.bat [@ = batfile] -- Reg Error: Key error. File not found
.cmd [@ = cmdfile] -- Reg Error: Key error. File not found
.com [@ = ComFile] -- Reg Error: Key error. File not found
.exe [@ = exefile] -- Reg Error: Key error. File not found
.html [@ = ChromeHTML] -- C:\Users\Antoun\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [OtsMedia.Surf] -- "C:\OtsLabs\OTSPLAY.EXE" "%1" /play /surf File not found
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{07C8A054-4A60-4C54-8C60-9740FE71A48E}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{095AAC0E-5B1A-4AA9-AC52-FC19DEAAAC60}" = rport=5722 | protocol=6 | dir=out | svc=dfsr | app=%systemroot%\system32\dfsr.exe |
"{0D2910EF-716E-4941-BFEB-A19127963D35}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{0F895530-ED41-4B90-8576-B52C9705CEC6}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{0F9711B0-EEB8-4887-A694-EE059CBF1327}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{1014B18F-BEF0-46A3-9929-AAD27B1F9044}" = lport=138 | protocol=17 | dir=in | app=system |
"{13F10CA8-0B74-410F-A1D9-B3A6C7B35AD7}" = lport=139 | protocol=6 | dir=in | app=system |
"{1F8CB754-A2C0-4F27-9058-A6AEB882B038}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{272EFD83-891E-497F-AD95-8C004547A998}" = rport=2869 | protocol=6 | dir=out | app=system |
"{2CE4E326-0DA9-4E04-8112-E0A3EEFF8B18}" = lport=5358 | protocol=6 | dir=in | app=system |
"{2FFD4320-3983-43D0-BA36-D509DF16699E}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{30843E0C-E6CD-4FE6-9B8B-32D008C4D476}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{312703B3-8086-4EBB-BABE-9B6B21D1870B}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{445AE412-CB0F-47D7-9BEC-D3E32E23746B}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{450504E6-D0CB-428D-AA40-19FC7B4DD56D}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |
"{453A599E-4A30-4481-ADC6-16D276F41BA0}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{4B8060DD-71B5-4F93-8D2C-C0A14DCAC7FF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{4CC9ED30-9D0A-4AA7-A1B4-79EA2CEB1228}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{4E222117-4CDE-488F-856D-C28FAFE3BE23}" = rport=3587 | protocol=6 | dir=out | svc=p2psvc | app=%systemroot%\system32\svchost.exe |
"{4E6A4EEC-A950-4855-9809-F26E80B15D5C}" = rport=138 | protocol=17 | dir=out | app=system |
"{53FA82CC-DF15-47B9-86BA-49EAF69C7C7F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{549C03EC-70B7-44F4-942C-B2E2D3E18610}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{636A780A-9B3B-4483-B849-C9B68FD3C2BF}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{687940B3-0233-4FFD-9D96-D794C6B741BC}" = lport=10244 | protocol=6 | dir=in | app=system |
"{6CA4B667-6C95-4C08-922B-2FD98A0A2F35}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{6D93BD0A-4964-40D2-97AE-3531BCB53700}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{711D9D71-2B0F-4F1A-A25A-C8CAD81C60B1}" = rport=10244 | protocol=6 | dir=out | app=system |
"{7457A8C8-2E3F-40C4-BF77-84329464BAB7}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{80967951-83E4-47E5-A9AD-C5D434E2983E}" = lport=137 | protocol=17 | dir=in | app=system |
"{826877E3-F14D-4623-BDF5-E0AC5D86EAB1}" = rport=3587 | protocol=6 | dir=out | svc=p2psvc | app=%systemroot%\system32\svchost.exe |
"{83606E60-C4A0-4B8A-A9ED-84FDC449F632}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{84EBA5A7-C4F1-4AFF-9BD3-522F8B6ECCBA}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{84F34962-E538-4D1B-B7AB-16367E8A46A3}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\netproj.exe |
"{8B24D1A6-FEE9-418D-A339-9F8DEDE444BA}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8B6C7ED5-124F-4075-A711-3E371123BFE9}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{92D2DDD8-57FD-4261-BADF-3780B05D848F}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\netproj.exe |
"{93C09A13-6F1C-4462-B82E-E51606BCAEED}" = rport=137 | protocol=17 | dir=out | app=system |
"{95D4F1EF-0BF0-4283-96E7-2241D069FB23}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\p2phost.exe |
"{986B4CC2-389F-4BC8-9C0A-F9CB53A0FE0F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{995FA51F-BA46-4252-A094-BA5902975AE3}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{998ED9FA-23B5-413C-B06A-E2C033FCE43A}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{A0F38444-CEB8-4701-A21C-76995503F8B7}" = lport=10244 | protocol=6 | dir=in | app=system |
"{A1BBDBC6-3FAD-4599-A86C-140EEC7CCA7A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A44958E2-E82E-4EE8-BE81-D4FBF157ED7B}" = lport=5357 | protocol=6 | dir=in | app=system |
"{AB4E19D1-0A1A-45C2-9FFE-AA3830E15BC9}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{ACAF1DA9-F77E-487B-BCCB-7ABEAEA0B552}" = lport=5722 | protocol=6 | dir=in | svc=dfsr | app=%systemroot%\system32\dfsr.exe |
"{B1009C08-0F50-42B9-94CF-854CE2F4DBC1}" = lport=2869 | protocol=6 | dir=in | app=system |
"{B1B343CF-487D-43ED-B3DE-AA7ED2A8D3DB}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{B553C9BE-3A19-4C00-A883-7573477B64C9}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{B6882089-4BFF-47DE-AA36-7554151F1E5E}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\netproj.exe |
"{B6E1BA9C-DAA1-4446-9842-DF03C09470C4}" = rport=445 | protocol=6 | dir=out | app=system |
"{B860A28D-62C2-43A1-9083-B2648AB96F8F}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{B87E4944-A8A4-466D-8467-3AEE0D43F457}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B8DEF439-2866-405D-AADD-F27CAAD66D95}" = lport=2869 | protocol=6 | dir=in | app=system |
"{B902E664-5AD6-41FF-80D5-DC1A602F990B}" = lport=3390 | protocol=6 | dir=in | app=system |
"{BC3B14CC-6F68-48F6-A053-FEB52D59312E}" = rport=5722 | protocol=6 | dir=out | svc=dfsr | app=%systemroot%\system32\dfsr.exe |
"{BE3DBCA6-D39E-449E-BFCE-CEE629400D91}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C298C65F-AA02-4163-BAD0-5B0D67343997}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\p2phost.exe |
"{C356BB75-D029-4125-A6A6-6BBDF7A523FE}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{C6D90465-CD87-4874-8D33-664F203C5CD7}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{C8688EE6-C1FE-44EC-8CD8-E243D64497DD}" = lport=3587 | protocol=6 | dir=in | svc=p2psvc | app=%systemroot%\system32\svchost.exe |
"{CA29C49E-64B2-43A5-B47A-A09A748FEEC2}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CF5F4659-65D3-4F30-8213-F54E8F977B0F}" = rport=139 | protocol=6 | dir=out | app=system |
"{D15D1211-6797-4277-B8E9-029EBC3BF7EF}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D717FA94-9319-46E5-A068-90749E3CABC6}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\netproj.exe |
"{D82EFDEE-6B42-4114-B131-998F24A401B9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{D8EE44FC-3513-46D5-843F-95568645D0A1}" = lport=3587 | protocol=6 | dir=in | svc=p2psvc | app=%systemroot%\system32\svchost.exe |
"{DA13E3D0-95FC-4F7B-9439-7378D8AD7147}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{DB2464F7-F16B-4FA1-B178-40DD7FC9CFD7}" = lport=5722 | protocol=6 | dir=in | svc=dfsr | app=%systemroot%\system32\dfsr.exe |
"{DBE27912-9886-4B69-8A3D-335AA4E7C69B}" = rport=10244 | protocol=6 | dir=out | app=system |
"{E0384D84-83D2-44A6-BBDD-129D1215334E}" = rport=5357 | protocol=6 | dir=out | app=system |
"{E111B87F-4E95-431A-9A8D-C5233B940063}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{E53FFB19-8DF2-4A59-9C9B-04CBA4AC46FD}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{F3A2C61E-E43A-4DEC-AB5D-B49E8CE0C136}" = lport=445 | protocol=6 | dir=in | app=system |
"{F4D2C78A-BA2C-4CD6-98E9-49A346292016}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{F4E82952-F463-4BA2-9177-798971F0DD07}" = lport=3390 | protocol=6 | dir=in | app=system |
"{F5AF2F1F-BD36-4D07-A85F-A81F63D1AA32}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{F64CF6B3-B5A8-463C-AA23-410E0CE3C6AB}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{F7124FB9-9F62-4CF8-9AA5-77A9725AA63C}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{FB9609C9-A23C-46EA-AC73-8EB64FB0AA53}" = rport=5358 | protocol=6 | dir=out | app=system |
"{FD145FD1-E319-4C3F-837F-0FAC076D2347}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02F541B8-AD64-4568-B5B9-50360E7D2A5E}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{05346CDE-4638-4457-A25F-B3CACD5BD78A}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |
"{091905EE-E090-4D75-A767-5935D7C8826B}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{0A047010-D7FB-4EC6-84FA-4A4722D068E2}" = protocol=6 | dir=out | app=%systemroot%\system32\p2phost.exe |
"{0C1B839D-5405-478D-9A71-E99C362B5BE3}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |
"{1AE42DAA-B8FD-48B1-B578-0F2AF290DB2A}" = dir=in | app=c:\program files\avg\avg9\avgam.exe |
"{1E95A455-6902-4C76-A2ED-A53B97157204}" = protocol=6 | dir=out | app=%systemroot%\system32\netproj.exe |
"{23C3E672-1714-4C4B-9FC4-1BD2985BB316}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{286258F0-2502-4DE5-B781-D04B09B6E752}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{286E1511-F6B9-449E-BC73-AADF90E9C8FB}" = protocol=17 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe |
"{2A02962E-A383-49B8-8ED0-4B7372697717}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{311E2DD6-7F34-43B1-BB46-0DFE96465C0C}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{3312B492-5ADC-42EB-BAB0-045ADA66D82A}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{3A8BCE06-CEB0-4664-852E-D47850BECEC5}" = protocol=17 | dir=in | app=c:\program files\dell photo aio printer 926\dlcxmon.exe |
"{3FDB6F08-86D0-4ECF-A6A7-8652C6229526}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{41312CE1-3A85-4F30-8ABE-01CA58BA95DE}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\america's army 3\binaries\aa3game.exe |
"{44B8C401-5610-4B4C-BF47-F300903221DF}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe |
"{46B5B0C3-527D-43D1-BBC0-6FC7ED233D3C}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{4858BB52-E1F3-4E4E-997B-ED815CAF2ED3}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{4A59EE2A-CCD9-48C7-BDC2-374C573653B9}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{4F3DC908-652A-483C-926E-624F3058E462}" = protocol=6 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe |
"{503D07AD-2AEC-4825-9096-608B12D4198E}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{51769661-D7B1-4083-96B9-5CBF23FD2EB4}" = protocol=6 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{52B23DBC-107E-440D-890A-D74935A377AA}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{53ED9E8F-8A24-4DC0-A36A-B898FA768FF5}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{5CC2C4F2-81C8-4F96-986D-32313AD78C44}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |
"{5F535683-9326-4AD7-80A5-6EC4E6954DD8}" = protocol=17 | dir=in | app=c:\program files\dell photo aio printer 926\dlcxaiox.exe |
"{66BA0DEC-D595-4ED0-8700-DDCB23498461}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{6F57C3F3-DBD2-4329-BEDC-F4F2A7EBE56C}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |
"{765E5A60-1CED-4E2B-82C1-CEEB7DC3E1A8}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{7A6A1C85-E88F-4693-BF93-2BE70EC0B958}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe |
"{8336877C-EF08-4728-891F-C7A109BE2CC4}" = protocol=17 | dir=in | app=c:\users\antoun\appdata\roaming\facebook\facebook.exe |
"{85E5847F-4EB0-4621-89C6-7563D2FCB2BD}" = dir=in | app=c:\program files\avg\avg9\avgnsx.exe |
"{8897C355-AA62-4E28-81F4-152872860430}" = protocol=6 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe |
"{88E35B0E-793B-416E-8A66-E4D7B5ACBB8D}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe |
"{89DB7CC6-45A5-4A8C-8061-C7F72FEDA1AF}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{8C006CB6-3170-45EF-98C1-55D57C87BB62}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe |
"{8FC985E1-F801-4B6D-B36C-FF889DF1EF21}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe |
"{94170438-CC7F-484D-AA72-C02255306077}" = protocol=58 | dir=in | [email protected],-28545 |
"{964EB691-7A02-4109-B26F-7EE4704420EC}" = protocol=6 | dir=in | app=c:\program files\dell photo aio printer 926\dlcxaiox.exe |
"{976F1049-3B4F-4788-AE83-29A33A4E9236}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe |
"{98F01F95-E91F-4D8B-88AF-E8182778F10B}" = protocol=6 | dir=in | app=c:\windows\system32\dlcxcoms.exe |
"{98FF2085-A1BC-47D4-9277-0EDAAE523FBC}" = protocol=17 | dir=in | app=c:\windows\system32\dlcxcoms.exe |
"{9AEADF3B-3F3D-4EF0-93AC-3C2981FE591B}" = dir=in | app=c:\program files\avg\avg9\avgupd.exe |
"{9B394E2D-5D7C-4C7F-A434-EC0B810ECA05}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{9F339ADA-CE4E-4C88-B83F-9C900C278690}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe |
"{A70E5BBE-7D96-4EF0-B534-8CAD439EAE64}" = protocol=17 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe |
"{AA224219-3A6E-4D78-828B-5CA15622414F}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{ACDBD916-1BFC-4820-9C9A-7A78E027FE58}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe |
"{B3EDE281-14EF-4B3A-9535-691C0497D27E}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{B614B134-3C2D-4472-BEE6-AAA6A8B77FB8}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe |
"{BBD3A7B3-19FE-4708-8D2A-B7E27D60CD1D}" = protocol=6 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{BD77BFAD-C801-49AC-BCB1-7679995529B6}" = protocol=58 | dir=in | [email protected],-148 |
"{BDF77756-38FA-4B34-9C80-AB703C111E20}" = protocol=1 | dir=in | [email protected],-28543 |
"{BF58AE35-8E97-4A6F-B6DA-3A04CCDBF041}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{C5082A58-C1C8-48AC-9F1E-E77E94463042}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{C9D1506A-2A26-403A-84EF-3ECAED3B299A}" = protocol=6 | dir=in | app=c:\program files\dell photo aio printer 926\dlcxmon.exe |
"{CA38E4DC-BD49-4C11-8698-4E3B7C62430E}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{CF3975D8-B8D4-4C8C-BA88-67DBC314FA53}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{D32299E7-05AD-4DDB-8F4E-11D94327148B}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe |
"{D52ED267-44EE-4082-B537-40416196BF8C}" = protocol=6 | dir=out | app=%systemroot%\system32\p2phost.exe |
"{D812CBDA-2F2A-4728-83D4-D44BABF268FB}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{D83AE7FE-911A-411E-B41E-8B7E6F96DB0E}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{D8B4396F-80A5-4F7B-98DE-8A806A3E535E}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe |
"{DC3E5AA2-904C-4D99-B31E-CE046ED34CB8}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{E100B17F-84F6-43B2-A080-70A0C9C5DF50}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{E387B395-5AAE-454D-8C05-4AC47B3ACC00}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe |
"{E3AB4F7E-D3CD-4B82-AA2F-6534027F8FFC}" = dir=in | app=c:\program files\avg\avg9\avgdiagex.exe |
"{E42E0840-91E6-4DB6-A7C8-7B3382A83978}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\america's army 3\binaries\aa3game.exe |
"{E92487F9-1F88-44B2-B616-C5DA244DE810}" = protocol=6 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe |
"{ECEE7467-8B06-4849-AE77-6776373097B7}" = protocol=6 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe |
"{EE196193-42D1-47D2-843A-D0DEAB780698}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{F0940E85-50F5-416A-B076-C4475FC501BF}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{F0E220A2-9BAE-494D-93C9-083B2CC65E51}" = protocol=58 | dir=out | [email protected],-28546 |
"{F2FD5DD1-84DF-4CE2-B85F-404C387A4490}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{F5966F86-C32E-4E7B-B53C-A2296658FFCC}" = protocol=6 | dir=in | app=c:\users\antoun\appdata\roaming\facebook\facebook.exe |
"{F64ECA71-CA87-4664-8C0F-1EB6EA61D1AB}" = protocol=1 | dir=out | [email protected],-28544 |
"{F713A93F-DE8E-445C-8EA0-892DADA2E1D3}" = protocol=17 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe |
"{F7DE38B4-B98F-4781-BAEB-A45B601C4001}" = protocol=6 | dir=in | app=%systemroot%\system32\netproj.exe |
"{F9F63248-69B8-4A75-AFB2-69CF9613BBB6}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{FE8FBBA7-24C5-4F85-82BB-00D32C5591E1}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{FEBCB0F7-6AA8-4B88-B741-19A5688AC395}" = protocol=17 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe |
"TCP Query User{1F2A77CE-46FD-4B8F-A210-B7A177E7BB16}C:\users\antoun\desktop\tvuplayer_green.v2.5.2.2\tvuplayer.exe" = protocol=6 | dir=in | app=c:\users\antoun\desktop\tvuplayer_green.v2.5.2.2\tvuplayer.exe |
"TCP Query User{2AAB0724-F026-40BC-AE2A-69D2510ED43F}C:\users\antoun\appdata\local\google\chrome\application\chrome.exe" = protocol=6 | dir=in | app=c:\users\antoun\appdata\local\google\chrome\application\chrome.exe |
"TCP Query User{7981A52D-F6F0-4E8A-813A-1F6622F8D2A5}O:\system\apps\2682b3c3-4abb-4741-9e82-9314a63baaa1\data\skype.exe" = protocol=6 | dir=in | app=o:\system\apps\2682b3c3-4abb-4741-9e82-9314a63baaa1\data\skype.exe |
"TCP Query User{7B81E462-70B2-4612-8DA8-9343231A7327}C:\users\antoun\desktop\andy's school stuff\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\users\antoun\desktop\andy's school stuff\limewire\limewire.exe |
"TCP Query User{8CC6E534-F3DB-4D26-8284-AB2FF7E00F62}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{AA72AA08-C862-4274-A4B5-82B2C75608AC}C:\program files\microsoft games\halo trial\halo.exe" = protocol=6 | dir=in | app=c:\program files\microsoft games\halo trial\halo.exe |
"TCP Query User{ABC5886C-BA5F-4322-A497-293467F45CFE}C:\users\antoun\appdata\roaming\mjusbsp\magicjack.exe" = protocol=6 | dir=in | app=c:\users\antoun\appdata\roaming\mjusbsp\magicjack.exe |
"TCP Query User{B80A44C4-D86F-4F7E-95F0-EA0453CB5A3E}C:\users\antoun\desktop\andy's school stuff\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\users\antoun\desktop\andy's school stuff\limewire\limewire.exe |
"TCP Query User{BD973EF3-3EFA-44E9-AFD4-765A951E0EA0}C:\users\antoun\desktop\fifa 2005\fifa2005.exe" = protocol=6 | dir=in | app=c:\users\antoun\desktop\fifa 2005\fifa2005.exe |
"TCP Query User{E8D34DAF-E5C7-44E5-855F-4C060A446568}C:\users\antoun\appdata\local\google\chrome\application\chrome.exe" = protocol=6 | dir=in | app=c:\users\antoun\appdata\local\google\chrome\application\chrome.exe |
"TCP Query User{F1402105-1F0B-44BF-B914-EA86DCA610F4}C:\users\antoun\desktop\fifa 2005\fifa2005.exe" = protocol=6 | dir=in | app=c:\users\antoun\desktop\fifa 2005\fifa2005.exe |
"TCP Query User{F1555FC6-4C8E-4391-98A7-5F85E0E5B953}C:\users\antoun\downloads\tvuplayer_green.v2.5.2.2\tvuplayer.exe" = protocol=6 | dir=in | app=c:\users\antoun\downloads\tvuplayer_green.v2.5.2.2\tvuplayer.exe |
"UDP Query User{0149AD2F-1C24-42D0-A1FC-C99DB8BBDB8C}C:\users\antoun\desktop\fifa 2005\fifa2005.exe" = protocol=17 | dir=in | app=c:\users\antoun\desktop\fifa 2005\fifa2005.exe |
"UDP Query User{032C629A-D8D8-482D-B60E-EEE1C3142F9E}C:\users\antoun\appdata\local\google\chrome\application\chrome.exe" = protocol=17 | dir=in | app=c:\users\antoun\appdata\local\google\chrome\application\chrome.exe |
"UDP Query User{1938DF44-4D25-46F6-8E76-0B6C4F94E5E6}C:\users\antoun\downloads\tvuplayer_green.v2.5.2.2\tvuplayer.exe" = protocol=17 | dir=in | app=c:\users\antoun\downloads\tvuplayer_green.v2.5.2.2\tvuplayer.exe |
"UDP Query User{27813F73-620E-4C10-8940-A6FABB0D14A7}C:\users\antoun\desktop\andy's school stuff\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\users\antoun\desktop\andy's school stuff\limewire\limewire.exe |
"UDP Query User{405E36B6-0007-44F2-8FBF-3F8CEA13B815}C:\program files\microsoft games\halo trial\halo.exe" = protocol=17 | dir=in | app=c:\program files\microsoft games\halo trial\halo.exe |
"UDP Query User{43C42B86-F3ED-4A36-8541-5A57C401282E}C:\users\antoun\desktop\tvuplayer_green.v2.5.2.2\tvuplayer.exe" = protocol=17 | dir=in | app=c:\users\antoun\desktop\tvuplayer_green.v2.5.2.2\tvuplayer.exe |
"UDP Query User{75E5E397-9EB1-49B3-8011-55D896DF78CC}C:\users\antoun\appdata\local\google\chrome\application\chrome.exe" = protocol=17 | dir=in | app=c:\users\antoun\appdata\local\google\chrome\application\chrome.exe |
"UDP Query User{CBD225C0-5B70-4F1B-8E4C-EE55EA306A85}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{DB02E9ED-A52F-4E26-9BF7-5740B4BB2F7D}O:\system\apps\2682b3c3-4abb-4741-9e82-9314a63baaa1\data\skype.exe" = protocol=17 | dir=in | app=o:\system\apps\2682b3c3-4abb-4741-9e82-9314a63baaa1\data\skype.exe |
"UDP Query User{E5621B8B-E0E2-4C48-A748-64D4E7A26370}C:\users\antoun\appdata\roaming\mjusbsp\magicjack.exe" = protocol=17 | dir=in | app=c:\users\antoun\appdata\roaming\mjusbsp\magicjack.exe |
"UDP Query User{ECB5BFCB-4DD0-4CF0-91E3-06C1201A4BF2}C:\users\antoun\desktop\andy's school stuff\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\users\antoun\desktop\andy's school stuff\limewire\limewire.exe |
"UDP Query User{FF9BCF3B-E168-401A-9C01-471A9F013718}C:\users\antoun\desktop\fifa 2005\fifa2005.exe" = protocol=17 | dir=in | app=c:\users\antoun\desktop\fifa 2005\fifa2005.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{007EA334-6071-41BF-B8C7-4C4E37E49DA7}" = Messenger Companion
"{035C76D2-7D8E-484D-8CA3-686C0B474A2B}" = MSVCRT
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = Bing Bar
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{098122AB-C605-4853-B441-C0A4EB359B75}" = DirectXInstallService
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{11202615-E557-4ECF-9B86-F59C81E52909}" = FIFA 10
"{11EFF057-8ED2-4321-A19D-D673DECB36CC}" = Junk Mail filter update
"{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}" = Adobe AIR
"{1A25F3EF-7C66-4B3E-9507-D015C88C41B1}" = Windows Live Remote Client Resources
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.6
"{1CAC7A41-583B-4483-9FA5-3E5465AFF8C2}" = Microsoft Default Manager
"{1DCCB2B0-A482-464F-94F6-1219693E34F0}_is1" = AeroSnap 0.61
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{224935E4-2014-4B22-95DC-2CCF5428B4BF}" = Windows Live Writer
"{232DB76D-4751-41A9-9EC2-CDC0DAC1FAB6}" = WD SmartWare
"{2578D94A-A88A-4643-9DAA-F0A5E981EB04}" = Windows Live Messenger
"{2607FE6B-1D61-46E5-A544-54666B0EF908}" = Windows Live Mail
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 20
"{2C4F4D53-78D6-41FB-A4D7-105C537464EB}" = Mesh Runtime
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{321AC187-D400-41B4-BDEB-F3E80FFCE20F}" = Windows Live Remote Service
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D9892BB-A751-4E48-ADC8-E4289956CE1D}" = QuickTime
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{3FB3647F-B6A6-46B4-8613-A09BCFAB80F0}" = Roxio Creator Premier 10
"{469EF13B-4AD0-48D7-AF89-6B92278293E2}" = Roxio Creator Premier
"{46BAF2A0-3789-4E49-B000-4BB64426D1BF}" = Windows Live Installer
"{46C106C9-3856-4A6A-AAC8-7070FBA02D2F}" = Windows Live Movie Maker
"{488A6828-2E74-4517-9E9E-CD50664B0EBE}" = Windows Live MIME IFilter
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D3C9F4B-4B7D-4E5D-99B9-0123AB0D51ED}" = Dell DataSafe Online
"{4EC66844-AE87-47DC-B02D-E36C75EAF22C}" = Windows Live Sync Beta
"{4F7177E9-2B54-48B4-AAFD-03FA1F87A542}" = Bing Bar Platform
"{52CDDA92-56B6-4BA5-BD8D-E13B186008CB}" = D3DX10
"{597E70FF-7C46-4EED-8092-91B7C2E0529D}" = Google SketchUp 7
"{5DBBF8D4-9C80-4D80-BFB7-54B35A7ABB5E}" = Productivity Programs
"{5E39FDEE-7676-4BB7-9E2B-8224D7D74406}_is1" = Moyea Video Converter version 2.5.1.1757
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FC7AB5C-61FC-42DF-A923-5139BCF10D42}" = Microsoft LifeCam
"{617BD5B7-53EF-4D1E-81B5-3CD995CC0058}" = Windows Live Remote Service Resources
"{61E7F654-7D99-4C69-94D8-DF53E297AF9B}" = Windows Live Photo Common
"{6592C2B8-949A-4C88-BCB9-0990A218B215}" = Windows Live UX Platform
"{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}" = Garmin USB Drivers
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Internet Security 2011
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B0AE911-A3F4-4D55-9CA7-C76DC2BCEA86}" = Windows Live UX Platform Language Pack
"{6B7B6D4D-8F9B-4CB3-8CA4-BCA9CC4C1A22}" = EDocs
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{74B0BEB0-2EB3-448F-B8E9-40983BC902E1}" = Windows Live SOXE Definitions
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{777CA40C-0206-4EF6-A0FC-618BF06BF8D0}" = Intel(R) PRO Network Connections 12.1.11.0
"{7A8E7F22-3628-4846-A578-516BDCB2CEAA}" = Windows Live Sync Beta
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{7EFA8362-CE86-46E7-BEB9-B2DB4F0D0EE6}" = Windows Live Photo Gallery Beta
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83BC206C-98A5-4CF3-B884-2B58CD4AB951}" = Windows Live Writer
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Roxio CinePlayer Decoder Pack
"{8E74FC72-018A-4EC5-86AA-D8021309D484}" = Windows Live Messenger
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91803386-4FBD-4C38-9644-26B0F9464031}" = Windows Live Photo Gallery
"{91F7F3F3-CE80-48C3-8327-7D24A0A5716A}" = iTunes
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-0048-0409-0000-0000000FF1CE}" = Microsoft Outlook Hotmail Connector 32-bit
"{95140000-004E-0409-0000-0000000FF1CE}" = Microsoft Outlook Social Connector 32-bit
"{95140000-0079-0409-0000-0000000FF1CE}" = Windows Live Provider for Microsoft Outlook Social Connector 32-bit
"{9527A496-5DF9-412A-ADC7-168BA5379CA6}" = Microsoft Flight Simulator X
"{98C73E3D-0486-4DD8-938B-EC9B1AF35B9C}" = Windows Live Remote Client
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D0467C4-F69C-4E9D-8765-7774D8971F5C}" = Windows Live Messenger Companion Core
"{9E1BAB75-EB78-440D-94C0-A3857BE2E733}" = System Requirements Lab
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A93944F2-D2D4-4750-BFE7-9A288FEAF2CF}" = Apple Application Support
"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution
"{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-1033-F400-7760-000000000004}{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-7AD7-1033-7B44-A81000000003}" = Adobe Reader 8.1.0
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{AFBBF30D-ADA9-4313-464E-14458B6BE034}" = PhotoshopdotcomInspirationBrowser
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B3DAF54F-DB25-4586-9EF1-96D24BB14088}" = Windows Movie Maker 2.6
"{B5BD2B33-FDB8-4DE5-87B3-2810CAF4A6E4}" = Windows Live PIMT Platform
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{C2687C43-507E-4D4B-A30A-3C836C756226}" = Windows Live Mail
"{C2D129C0-7508-11DF-9F1B-005056806466}" = Google Earth
"{C39A4E1F-9AF1-4FE1-A80E-A5B867FABB42}" = Dell Best of Web
"{C7DD94A8-F775-426C-B56C-8E555A59F9E2}" = Garmin Communicator Plugin
"{c9920352-04e6-469d-bab8-e2b9c7c75415}.sdb" = Microsoft Automated Troubleshooting Services Shim
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CB6075D9-F912-40AE-BEA6-E590DA24F16B}" = Adobe Photoshop Elements 7.0
"{CCF6B621-7C92-4A45-9A87-F7968D87925A}" = Windows Live ID Sign-in Assistant
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D4790ACB-4BB4-4FE6-9F64-1D4486C8E40C}" = Windows Live Photo Common Beta
"{D65F8E34-C050-4E6C-86DB-D2B9075749A0}" = Windows Live Sync ActiveX Control for Remote Connections
"{D8CE69B0-9274-4b8c-BA49-0FF6A20A3C65}" = SAMSUNG SYMBIAN USB Download Driver
"{D943C8AC-9E03-4C2D-B54C-A28ABE931665}" = Windows Live Movie Maker
"{DA25B88F-FEBE-48F2-9203-0FC682A4E92B}" = Segoe UI
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag
"{E24DFAA7-9495-4F7D-BB9E-211C2D0A76E5}" = Windows Live Writer Resources
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{EACF374B-9D4C-4A07-8EB3-706BD8DAA650}" = Windows Live Essentials Beta
"{EC877639-07AB-495C-BFD1-D63AF9140810}" = Roxio Activation Module
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator Premier
"{EE338AB8-4E85-4C04-AC07-1357A266DD35}" = Windows Live Writer
"{EFBE9DAB-9C80-4911-847B-2A2C25E8F9CB}" = Windows Live SOXE
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem Diagnostic Tool
"{F6CB42B9-F033-4152-8813-FF11DA8E6A78}" = Dell Dock
"{FA5D1C9E-154D-49B1-8CF0-DF5FAB6171EA}" = Windows Live Communications Platform
"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner
"49CF605F02C7954F4E139D18828DE298CD59217 C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"7-Zip" = 7-Zip 4.65
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 7" = Adobe Photoshop Elements 7.0
"B991B020-2968-11D8-AF23-444553540000_is1" = FreeMind
"CCleaner" = CCleaner
"CNXT_MODEM_PCI_HSF" = Conexant D850 PCI V.92 Modem
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"Dell Fax Solutions" = Fax Solutions
"Dell Photo AIO Printer 926" = Dell Photo AIO Printer 926
"Digsby" = Digsby
"DivX Setup.divx.com" = DivX Setup
"DriverAgent.exe" = DriverAgent by eSupport.com
"E24870CB6AA1C3511635FF9020A3E9471287FBE 7" = Windows Driver Package - MobileTop (sshpmdm) Modem (01/26/2008 2.6.0.0)
"ENTERPRISE" = Microsoft Office Enterprise 2007
"FairUse Wizard 2" = FairUse Wizard 2
"FlightGear_is1" = FlightGear v2.0.0
"Fraps" = Fraps
"GameSpy Arcade" = GameSpy Arcade
"Google Chrome Frame" = Google Chrome Frame
"Google Desktop" = Google Desktop
"GoToAssist" = GoToAssist 8.0.0.514
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"Icy Tower v1.4_is1" = Icy Tower v1.4
"InstallShield_{9527A496-5DF9-412A-ADC7-168BA5379CA6}" = Microsoft Flight Simulator X
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"InstallWIX_{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Internet Security 2011
"LAME for Audacity_is1" = LAME v3.98.2 for Audacity
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.5.10)" = Mozilla Firefox (3.5.10)
"MuseScore 0.9" = MuseScore 0.9 MuseScore score typesetter
"Musicnotes Combined Installer_is1" = Musicnotes Software Suite 1.4.2
"OpenAL" = OpenAL
"packagefactory_is1" = PackageFactory for U3 (build 100)
"PhotoshopdotcomInspirationBrowser.4C35C 4D325D350FE0114230CBADCA2DDD0AC8D25.1" = Adobe Photoshop.com Inspiration Browser
"PROSetDX" = Intel(R) PRO Network Connections 12.1.11.0
"PunkBusterSvc" = PunkBuster Services
"QuicktimeAlt_is1" = QuickTime Alternative 1.81
"RealPlayer 12.0" = RealPlayer
"Revo Uninstaller" = Revo Uninstaller 1.89
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software
"SAMSUNG Mobile Modem V2" = SAMSUNG Mobile Modem V2 Software
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Download Driver" = SAMSUNG Mobile USB Download Driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SAMSUNG USB Mobile Device" = SAMSUNG USB Mobile Device Software
"SimpleSizer_is1" = SimpleSizer
"Sketchpad" = Sketchpad
"Steam App 13140" = America's Army 3
"Swag_Bucks Toolbar" = Swag_Bucks Toolbar
"TeamViewer 5" = TeamViewer 5
"TomTom HOME" = TomTom HOME 2.7.4.1962
"vcmm" = Vice City Mod Manager
"WinLiveSuite" = Windows Live Essentials Beta
"WinRAR archiver" = WinRAR archiver

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"f031ef6ac137efc5" = Dell Driver Download Manager
"Google Chrome" = Google Chrome
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

SuperDave · « **Reply #21 on:** September 19, 2010, 07:02:07 PM »

I strongly recommend that you remove Ask from your computer because it;

•Promotes its toolbars on sites targeted to kids.

•Promotes its toolbars through ads that appear to be part of other companies' sites.

•Promotes its toolbars through other companies' spyware.

•Installs without any disclosure whatsoever and without any consent whatsoever.

•Solicits installations via "deceptive door openers" that do not accurately describe the offer; failing to affirmatively show a license agreement; linking to a EULA via an off-screen link.

•Makes confusing changes to users' browsers -- increasing Ask's revenues while taking users to pages they didn't intend to visit.

See Here for more info.

If you choose to follow my recommendation then please go to Start > Control Panel > Add/Remove Programs and remove the following programs if present.

•AskBarDis or anything related to Ask

Then please find and delete this folder in bold (if present):
C:\Program Files\AskBarDis. or anything related to Ask.
********************************************
* Open OTL
* Copy and Paste the following text in the codebox into the Custom Scans/Fixes window.

Code: [Select]

:OTL
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found

:Files
C:\found.000

:COMMANDS
[resethosts]
[purity]
[clearrestorepoints]
[emptytemp]
[start explorer]

* Click Run Fix
* OTLI2 may ask to reboot the machine. Please do so if asked.
* Click OK
* A report will open. Copy and Paste that report in your next reply.
*****************************************
Please run these scans again and post the logs.

SUPERAntiSpyware

If you already have SUPERAntiSpyware be sure to check for updates before scanning!

Download SuperAntispyware Free Edition (SAS)
* Double-click the icon on your desktop to run the installer.
* When asked to Update the program definitions, click Yes
* If you encounter any problems while downloading the updates, manually download and unzip them from here
* Next click the Preferences button.

•Under Start-Up Options uncheck Start SUPERAntiSpyware when Windows starts
* Click the Scanning Control tab.
* Under Scanner Options make sure only the following are checked:

•Close browsers before scanning
•Scan for tracking cookies
•Terminate memory threats before quarantining
•Please leave the others unchecked

•Click the Close button to leave the control center screen.

* On the main screen click Scan your computer
* On the left check the box for the drive you are scanning.
* On the right choose Perform Complete Scan
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete a summary box will appear. Click OK
* Make sure everything in the white box has a check next to it, then click Next
* It will quarantine what it found and if it asks if you want to reboot, click Yes

•To retrieve the removal information please do the following:
•After reboot, double-click the SUPERAntiSpyware icon on your desktop.
•Click Preferences. Click the Statistics/Logs tab.

•Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.

•It will open in your default text editor (preferably Notepad).
•Save the notepad file to your desktop by clicking (in notepad) File > Save As...

* Save the log somewhere you can easily find it. (normally the desktop)
* Click close and close again to exit the program.
*Copy and Paste the log in your post.
**********************************

Please download Malwarebytes Anti-Malware from here.

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Full Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
Please save the log to a location you will remember.
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
*********************************
Please run the Security check in Reply #10 and post the log.

mcdidd · « **Reply #22 on:** September 24, 2010, 09:23:46 PM »

OTL could not create a host file. Anyway, here are the logs you asked for. I have to attach them because they are too big.

[recovering disk space - old attachment deleted by admin]

SuperDave · « **Reply #23 on:** September 25, 2010, 11:20:39 AM »

Update Your Java (JRE)

Old versions of Java have vulnerabilities that malware can use to infect your system.

First Verify your Java Version

If there are any other version(s) installed then update now.

Get the new version (if needed)

If your version is out of date install the newest version of the Sun Java Runtime Environment.

Note: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Be sure to close ALL open web browsers before starting the installation.

Remove any old versions

1. Download JavaRa and unzip the file to your Desktop.
2. Open JavaRA.exe and choose Remove Older Versions
3. Once complete exit JavaRA.
4. Run CCleaner.

Additional Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and reboot your computer.

**********************************
Please download the newest version of Adobe Acrobat Reader from Adobe.com

Before installing: it is important to remove older versions of Acrobat Reader since it does not do so automatically and old versions still leave you vulnerable.
Go to the Control Panel and enter Add or Remove Programs.
Search in the list for all previous installed versions of Adobe Acrobat Reader. Uninstall/Remove each of them.

Once old versions are gone, please install the newest version.
************************************
Please delete ComboFix from your desktop because it's too old. Please make sure your Anti-Virus and AntiSpyware applications are disabled before running ComboFix.

Please download ComboFix

from BleepingComputer.com

Alternate link: GeeksToGo.com

Rename ComboFix.exe to commy.exe before you save it to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here
Click Start then copy paste the following command into the search box & hit enter: "%userprofile%\desktop\commy.exe" /stepdel
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. This will not install in Vista. Just continue scanning, and skip the console install.
When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply.

If you have problems with ComboFix usage, see How to use ComboFix

mcdidd · « **Reply #24 on:** September 25, 2010, 11:52:10 AM »

SuperDave, When I verify my Java version, it says "You have the recommended Java installed (Version 6 Update 21)." What should I do? And I also have a trial of Adobe Acrobat Pro 9 installed.

SuperDave · « **Reply #25 on:** September 25, 2010, 05:23:10 PM »

Quote from: mcdidd on September 25, 2010, 11:52:10 AM

SuperDave, When I verify my Java version, it says "You have the recommended Java installed (Version 6 Update 21)." What should I do? And I also have a trial of Adobe Acrobat Pro 9 installed.

The Security Check showed that you only have 20. You can uninstall the other versions and proceed with ComboFix.

mcdidd · « **Reply #26 on:** September 30, 2010, 06:37:27 PM »

Here is the ComboFix log.

ComboFix 10-09-29.01 - Antoun 09/29/2010 19:19:35.4.4 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3060.1571 [GMT -5:00]
Running from: c:\users\Antoun\Desktop\commy.exe
Command switches used :: /stepdel
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\users\Public\mscore.exe

.
((((((((((((((((((((((((( Files Created from 2010-08-28 to 2010-09-30 )))))))))))))))))))))))))))))))
.

2010-09-30 00:30 . 2010-09-30 00:30   --------   d-----w-   c:\users\Mcx1\AppData\Local\temp
2010-09-30 00:30 . 2010-09-30 00:30   --------   d-----w-   c:\users\Default\AppData\Local\temp
2010-09-30 00:30 . 2010-09-30 00:30   --------   d-----w-   c:\users\Antoun\AppData\Local\temp
2010-09-30 00:30 . 2010-09-30 00:30   --------   d-----w-   c:\users\Antoun - Copy\AppData\Local\temp
2010-09-30 00:03 . 2010-09-30 00:04   --------   d-----w-   C:\32788R22FWJFW
2010-09-30 00:02 . 2010-09-30 00:02   --------   d-----w-   c:\program files\Sun
2010-09-29 23:56 . 2010-09-29 23:56   --------   d-----w-   c:\programdata\CinemaNow
2010-09-29 23:43 . 2007-08-24 17:55   277504   ----a-w-   c:\programdata\mpDRM\XCTSecureBurn.dll
2010-09-29 23:43 . 2007-08-24 17:55   322048   ----a-w-   c:\programdata\mpDRM\ISOCreatorSecure.dll
2010-09-29 23:43 . 2007-08-24 17:55   303616   ----a-w-   c:\programdata\mpDRM\mpDRMHelper3.dll
2010-09-29 23:43 . 2007-08-24 17:55   192000   ----a-w-   c:\programdata\mpDRM\mpDRM.dll
2010-09-29 23:43 . 2010-09-29 23:43   --------   d-----w-   c:\programdata\mpDRM
2010-09-29 23:43 . 2010-09-29 23:43   --------   d-----w-   c:\program files\Common Files\mpDRM
2010-09-29 23:43 . 2010-09-29 23:43   --------   d-----w-   c:\programdata\fluxDVD
2010-09-29 23:43 . 2010-09-29 23:43   --------   d-----w-   c:\program files\Common Files\fluxDVD
2010-09-29 23:42 . 2010-09-29 23:42   --------   d-----w-   c:\program files\CinemaNow
2010-09-27 13:56 . 2010-09-27 13:56   1049936   ----a-w-   c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\bases\sw2\klavasyswatch.dll
2010-09-26 03:41 . 2010-09-26 03:41   --------   d-----w-   c:\windows\lhsp
2010-09-25 23:13 . 2010-09-25 23:14   --------   d-----w-   c:\program files\VirtualDJ
2010-09-25 00:24 . 2010-09-25 00:24   --------   d-----w-   c:\program files\Audacity
2010-09-22 02:07 . 2010-08-17 23:54   280064   ----a-w-   c:\windows\system32\XpsGdiConverter.dll
2010-09-22 02:07 . 2010-08-17 23:54   135680   ----a-w-   c:\windows\system32\XpsRasterService.dll
2010-09-22 02:07 . 2010-08-17 23:52   979456   ----a-w-   c:\windows\system32\MFH264Dec.dll
2010-09-22 02:07 . 2010-08-17 23:51   357376   ----a-w-   c:\windows\system32\MFHEAACdec.dll
2010-09-22 02:07 . 2010-08-17 23:51   261632   ----a-w-   c:\windows\system32\mfreadwrite.dll
2010-09-22 02:07 . 2010-08-17 23:51   302592   ----a-w-   c:\windows\system32\mfmp4src.dll
2010-09-22 02:07 . 2010-08-17 23:50   680960   ----a-w-   c:\windows\system32\d2d1.dll
2010-09-22 02:07 . 2010-08-17 23:49   1174528   ----a-w-   c:\windows\system32\d3d10warp.dll
2010-09-22 02:07 . 2010-08-17 23:49   1068032   ----a-w-   c:\windows\system32\DWrite.dll
2010-09-22 02:07 . 2010-08-17 23:49   797184   ----a-w-   c:\windows\system32\FntCache.dll
2010-09-22 02:07 . 2010-08-17 23:48   161280   ----a-w-   c:\windows\system32\d3d10_1.dll
2010-09-22 02:07 . 2010-08-17 23:48   219648   ----a-w-   c:\windows\system32\d3d10_1core.dll
2010-09-22 02:05 . 2010-09-22 02:05   --------   d-----w-   c:\program files\Feedback Tool
2010-09-21 01:33 . 2010-09-29 23:40   --------   d-----w-   c:\program files\Dell
2010-09-20 01:37 . 2010-09-20 01:37   63488   ----a-w-   c:\users\Antoun\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-09-20 01:37 . 2010-09-20 01:37   52224   ----a-w-   c:\users\Antoun\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-09-20 01:37 . 2010-09-20 01:37   117760   ----a-w-   c:\users\Antoun\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-09-20 01:24 . 2010-09-20 01:24   --------   d-----w-   C:\_OTL
2010-09-15 22:59 . 2010-04-16 16:46   502272   ----a-w-   c:\windows\system32\usp10.dll
2010-09-15 22:59 . 2010-08-17 14:11   128000   ----a-w-   c:\windows\system32\spoolsv.exe
2010-09-15 22:59 . 2010-04-05 17:02   317952   ----a-w-   c:\windows\system32\MP4SDECD.DLL
2010-09-15 22:59 . 2010-05-27 20:08   739328   ----a-w-   c:\windows\system32\inetcomm.dll
2010-09-14 21:49 . 2010-09-14 21:49   989880   ----a-w-   c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav11\11.0.1.400\updater.dll
2010-09-14 21:49 . 2010-09-14 21:49   84664   ----a-w-   c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav11\11.0.1.400\libola.dll
2010-09-14 21:49 . 2010-09-14 21:49   391864   ----a-w-   c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav11\11.0.1.400\klifpp.dll
2010-09-14 21:49 . 2010-09-14 21:49   146104   ----a-w-   c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav11\11.0.1.400\threatsmanager.dll
2010-09-14 21:49 . 2010-09-14 21:49   117432   ----a-w-   c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav11\11.0.1.400\dumpwriter.dll
2010-09-14 21:49 . 2010-09-14 21:49   495192   ----a-w-   c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav11\11.0.1.400\sys\i386\6.0\klif.sys
2010-09-14 21:49 . 2010-09-14 21:49   357096   ----a-w-   c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav11\11.0.1.400\avp.exe
2010-09-11 01:44 . 2010-09-11 01:44   --------   d-----w-   C:\kleaner.tmp
2010-09-11 00:53 . 2010-09-11 00:53   --------   d-----w-   c:\program files\Dell PC Fax
2010-09-11 00:01 . 2010-09-11 00:01   139152   ----a-w-   c:\windows\system32\drivers\PnkBstrK.sys
2010-09-11 00:01 . 2010-09-11 00:01   139152   ----a-w-   c:\users\Antoun\AppData\Roaming\PnkBstrK.sys
2010-09-11 00:01 . 2010-09-11 00:01   111928   ----a-w-   c:\windows\system32\PnkBstrB.exe
2010-09-11 00:01 . 2010-09-11 00:01   794408   ----a-w-   c:\windows\system32\pbsvc.exe
2010-09-11 00:01 . 2010-09-11 00:01   75064   ----a-w-   c:\windows\system32\PnkBstrA.exe
2010-09-09 21:25 . 2010-09-09 21:25   --------   d-----w-   c:\program files\Common Files\Skype
2010-09-09 21:04 . 2009-02-05 15:53   53248   ----a-w-   c:\windows\system32\CSVer.dll
2010-09-09 20:59 . 2009-11-23 23:31   131072   ----a-w-   c:\windows\system32\DellSPMsg.dll
2010-09-09 02:19 . 2008-05-15 00:35   237568   ----a-w-   c:\windows\system32\UCI32M30.dll
2010-09-09 02:19 . 2008-05-08 03:07   980992   ----a-w-   c:\windows\system32\drivers\HSX_DPV.sys
2010-09-09 02:19 . 2008-05-08 03:05   266752   ----a-w-   c:\windows\system32\drivers\HSXHWBS2.sys
2010-09-09 02:19 . 2008-05-08 03:04   661504   ----a-w-   c:\windows\system32\drivers\HSX_CNXT.sys
2010-09-09 02:19 . 2007-10-18 05:36   8704   ----a-w-   c:\windows\system32\drivers\XAudio.sys
2010-09-09 01:09 . 2010-09-09 01:09   23456   ----a-w-   c:\windows\system32\drivers\DrvAgent32.sys
2010-09-09 01:09 . 2010-09-09 01:09   --------   d-----w-   c:\users\Antoun\AppData\Local\eSupport.com
2010-09-08 22:11 . 2010-09-08 22:11   --------   d-----w-   c:\users\Antoun\AppData\Local\ABBYY
2010-09-08 21:45 . 2010-09-08 21:45   --------   d-----w-   c:\users\Antoun\AppData\Local\PunkBuster
2010-09-08 21:22 . 2010-09-29 22:53   --------   d-----w-   c:\programdata\Kaspersky Lab
2010-09-08 01:40 . 2010-09-08 01:40   --------   d-----w-   c:\programdata\Kaspersky Lab Setup Files
2010-09-06 19:59 . 2010-09-06 19:59   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\Yahoo!
2010-09-06 19:59 . 2010-09-06 19:59   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\Windows Live Writer
2010-09-06 19:59 . 2009-12-30 23:05   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\Western DigitalTemp
2010-09-06 19:58 . 2010-09-06 19:58   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\Western Digital
2010-09-06 19:58 . 2010-09-06 19:58   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\ViGlance
2010-09-06 19:58 . 2010-09-06 19:58   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\TomTom
2010-09-06 19:58 . 2010-05-31 05:34   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\TeamViewer
2010-09-06 19:58 . 2010-09-06 19:58   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\SUPERAntiSpyware.com
2010-09-06 19:58 . 2010-09-06 19:58   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\Sports Interactive
2010-09-06 19:58 . 2010-09-06 19:58   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\skypePM
2010-09-06 19:58 . 2010-07-24 00:21   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\Stereoscopic Player
2010-09-06 19:56 . 2010-09-06 19:58   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\Skype
2010-09-06 19:56 . 2010-09-06 19:56   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\Sibelius Software
2010-09-06 19:56 . 2010-09-06 19:56   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\Screaming Bee
2010-09-06 19:56 . 2010-09-06 19:56   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\Samsung
2010-09-06 19:51 . 2010-09-06 19:51   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\Roxio
2010-09-06 19:51 . 2010-09-06 19:51   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\PC Suite
2010-09-06 19:51 . 2010-02-16 23:14   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\PeerNetworking
2010-09-06 19:51 . 2010-09-06 19:51   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\NCH Swift Sound
2010-09-06 19:51 . 2010-09-06 19:51   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\MPEG Streamclip
2010-09-06 19:51 . 2010-09-06 19:51   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\Moyea
2010-09-06 19:51 . 2010-09-06 19:51   --------   d-----w-   c:\users\Antoun - Copy\AppData\Roaming\mjusbsp
2010-09-06 19:49 . 2010-09-06 19:49   --------   d-----w-   c:\users\Antoun - Copy\AppData\Local\xAltInfo
2010-09-06 19:49 . 2010-06-06 06:13   --------   d-----w-   c:\users\Antoun - Copy\AppData\Local\WMTools Downloaded Files
2010-09-06 19:49 . 2010-09-06 19:49   --------   d-----w-   c:\users\Antoun - Copy\AppData\Local\Windows Live Writer
2010-09-06 19:49 . 2010-09-06 19:49   --------   d-----w-   c:\users\Antoun - Copy\AppData\Local\Windows Live
2010-09-06 19:49 . 2010-09-06 19:49   --------   d-----w-   c:\users\Antoun - Copy\AppData\Local\Western Digital
2010-09-06 19:49 . 2009-12-30 23:05   --------   d-----w-   c:\users\Antoun - Copy\AppData\Local\Western DigitalTemp
2010-09-06 19:48 . 2010-09-06 19:49   --------   d-----w-   c:\users\Antoun - Copy\AppData\Local\VirtualStore
2010-09-06 19:43 . 2010-09-06 19:43   --------   d-----w-   c:\users\Antoun - Copy\AppData\Local\IsolatedStorage
2010-09-06 19:42 . 2010-09-06 19:43   --------   d-----w-   c:\users\Antoun - Copy\AppData\Local\Google
2010-09-06 19:42 . 2010-09-06 19:42   --------   d-----w-   c:\users\Antoun - Copy\AppData\Local\ElevatedDiagnostics
2010-09-06 19:36 . 2010-09-06 19:59   --------   d-sha-w-   c:\users\Antoun - Copy
2010-09-04 16:41 . 2010-09-04 16:41   --------   d-----w-   c:\users\Antoun\AppData\Roaming\SUPERAntiSpyware.com
2010-09-04 16:41 . 2010-09-04 16:41   --------   d-----w-   c:\programdata\SUPERAntiSpyware.com
2010-09-04 16:41 . 2010-09-20 01:37   --------   d-----w-   c:\program files\SUPERAntiSpyware
2010-09-04 14:46 . 2010-09-04 15:58   --------   d-----w-   c:\program files\ViGlance
2010-09-04 14:46 . 2010-09-04 14:46   --------   d-----w-   c:\users\Antoun\AppData\Roaming\ViGlance
2010-09-04 14:17 . 2010-09-04 14:17   --------   d-----w-   c:\program files\CodeGazer
2010-09-03 04:50 . 2010-09-03 04:59   --------   d-----w-   c:\program files\NaturalSoft
2010-09-02 22:02 . 2010-09-06 18:57   --------   d-----w-   c:\program files\Dell Photo AIO Printer 926(545)

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-30 00:00 . 2008-07-24 05:40   --------   d-----w-   c:\program files\Java
2010-09-29 23:40 . 2006-11-02 10:25   86016   ----a-w-   c:\windows\Inf\infpub.dat
2010-09-29 23:40 . 2006-11-02 10:25   143360   ----a-w-   c:\windows\Inf\infstrng.dat
2010-09-29 23:40 . 2010-09-29 23:40   --------   d-----w-   c:\program files\Dell Photo AIO Printer 926
2010-09-29 22:12 . 2010-07-10 20:44   --------   d-----w-   c:\program files\Steam
2010-09-28 01:42 . 2009-12-16 03:29   --------   d-----w-   c:\users\Antoun\AppData\Roaming\Skype
2010-09-28 00:01 . 2009-12-18 23:53   --------   d-----w-   c:\users\Antoun\AppData\Roaming\skypePM
2010-09-27 13:58 . 2010-06-30 23:43   1049936   ----a-w-   c:\programdata\Kaspersky Lab\AVP11\Bases\klavasyswatch.dll
2010-09-26 20:30 . 2006-11-02 10:25   143360   ----a-w-   c:\windows\Inf\infstor.dat
2010-09-25 23:07 . 2009-12-15 21:30   141952   ----a-w-   c:\users\Antoun\AppData\Local\GDIPFONTCACHEV1.DAT
2010-09-21 19:26 . 2008-07-24 05:46   --------   d-----w-   c:\program files\Google
2010-09-20 23:01 . 2010-09-20 23:01   2785176   ----a-w-   c:\programdata\SPLBB06.tmp
2010-09-20 22:28 . 2008-07-24 05:40   --------   d-----w-   c:\program files\Common Files\Java
2010-09-17 23:41 . 2010-05-21 21:38   --------   d-----w-   c:\program files\Common Files\Steam
2010-09-16 22:33 . 2006-11-02 11:18   --------   d-----w-   c:\program files\Windows Mail
2010-09-16 22:00 . 2009-12-15 22:43   --------   d-----w-   c:\programdata\Microsoft Help
2010-09-15 22:45 . 2010-05-10 00:08   --------   d-----w-   c:\program files\Microsoft Silverlight
2010-09-14 21:49 . 2010-09-14 21:49   989880   ----a-w-   c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav11\11.0.1.400\updater.dll
2010-09-14 21:49 . 2010-09-14 21:49   146104   ----a-w-   c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav11\11.0.1.400\threatsmanager.dll
2010-09-14 21:49 . 2010-09-14 21:49   84664   ----a-w-   c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav11\11.0.1.400\libola.dll
2010-09-14 21:49 . 2010-09-14 21:49   395960   ----a-w-   c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav11\11.0.1.400\klifpp.dll
2010-09-14 21:49 . 2010-09-14 21:49   117432   ----a-w-   c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav11\11.0.1.400\dumpwriter.dll
2010-09-14 21:48 . 2010-09-14 21:48   352976   ----a-w-   c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav11\11.0.1.400\avp.exe
2010-09-14 21:48 . 2010-09-14 21:48   488024   ----a-w-   c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav11\11.0.1.400\sys\i386\6.0\klif.sys
2010-09-11 21:43 . 2009-12-18 20:28   --------   d-----w-   c:\users\Antoun\AppData\Roaming\DellFaxCtr
2010-09-11 02:49 . 2010-08-17 22:50   288080   ----a-w-   c:\programdata\Kaspersky Lab\AVP11\Bases\avengine.dll
2010-09-11 02:43 . 2010-09-11 02:43   288080   ----a-w-   c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\bases\av\kdb\i386\win\avengine.dll
2010-09-11 02:07 . 2010-09-11 02:07   97549   ----a-w-   c:\windows\system32\drivers\klick.dat
2010-09-11 02:07 . 2010-09-11 02:07   113933   ----a-w-   c:\windows\system32\drivers\klin.dat
2010-09-11 02:06 . 2006-11-02 12:37   --------   d-----w-   c:\program files\Windows Sidebar
2010-09-11 02:04 . 2010-09-11 02:04   --------   d-----w-   c:\program files\Kaspersky Lab
2010-09-11 02:00 . 2010-08-08 23:23   --------   d-----w-   c:\program files\AVG
2010-09-11 01:58 . 2009-12-16 23:59   --------   d-----w-   c:\program files\McAfee
2010-09-11 01:58 . 2008-07-24 05:46   --------   d-----w-   c:\programdata\McAfee
2010-09-11 01:44 . 2010-08-08 23:28   0   ----a-w-   c:\windows\system32\drivers\AvgLdx86.sys
2010-09-09 21:27 . 2009-12-16 03:15   --------   d-----r-   c:\program files\Skype
2010-09-09 21:25 . 2009-12-16 03:15   --------   d-----w-   c:\programdata\Skype
2010-09-09 21:04 . 2008-07-24 05:42   --------   d-----w-   c:\program files\Intel
2010-09-09 02:19 . 2008-07-24 00:31   --------   d-----w-   c:\program files\CONEXANT
2010-09-09 00:30 . 2010-01-15 21:46   --------   d-----w-   c:\program files\Windows Portable Devices
2010-09-09 00:30 . 2006-11-02 12:37   --------   d-----w-   c:\program files\Windows Photo Gallery
2010-09-09 00:30 . 2006-11-02 12:37   --------   d-----w-   c:\program files\Windows Defender
2010-09-09 00:30 . 2009-12-23 05:22   --------   d-----w-   c:\users\Antoun\AppData\Roaming\MusE
2010-09-09 00:29 . 2010-03-31 16:44   --------   d-----w-   c:\programdata\FLEXnet
2010-09-09 00:29 . 2010-01-16 17:14   --------   d-----w-   c:\program files\YouTube Downloader
2010-09-09 00:29 . 2009-12-19 00:01   --------   d-----w-   c:\program files\Windows Live
2010-09-09 00:29 . 2010-06-07 05:13   --------   d-----w-   c:\program files\Moyea
2010-09-09 00:29 . 2010-08-13 23:16   --------   d-----w-   c:\program files\Microsoft LifeCam
2010-09-09 00:29 . 2010-04-18 01:39   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2010-09-09 00:29 . 2009-12-16 02:37   --------   d-----w-   c:\program files\Digsby
2010-09-09 00:29 . 2009-12-15 22:59   --------   d-----w-   c:\program files\dl_Cats
2010-09-09 00:29 . 2010-07-10 23:04   --------   d-----w-   c:\program files\CCleaner
2010-09-09 00:29 . 2008-07-24 05:46   --------   d-----w-   c:\program files\Common Files\Adobe
2010-09-09 00:29 . 2010-03-27 22:14   --------   d-----w-   c:\program files\7-Zip
2010-09-04 02:19 . 2010-09-06 19:37   139616   ----a-w-   c:\users\Antoun - Copy\AppData\Local\GDIPFONTCACHEV1.DAT
2010-09-04 00:57 . 2008-07-24 06:00   --------   d-----w-   c:\programdata\Dell
2010-09-01 05:46 . 2010-09-22 02:09   1355264   ----a-w-   c:\windows\system32\jscript9.dll
2010-09-01 05:44 . 2010-09-22 02:09   1122304   ----a-w-   c:\windows\system32\wininet.dll
2010-09-01 05:44 . 2010-09-22 02:09   424960   ----a-w-   c:\windows\system32\vbscript.dll
2010-09-01 05:43 . 2010-09-22 02:09   23552   ----a-w-   c:\windows\system32\licmgr10.dll
2010-09-01 05:43 . 2010-09-22 02:09   72704   ----a-w-   c:\windows\system32\SetDepNx.exe
2010-09-01 05:43 . 2010-09-22 02:09   142848   ----a-w-   c:\windows\system32\ieUnatt.exe
2010-09-01 05:43 . 2010-09-22 02:09   114176   ----a-w-   c:\windows\system32\iesysprep.dll
2010-09-01 05:43 . 2010-09-22 02:09   76800   ----a-w-   c:\windows\system32\SetIEInstalledDate.exe
2010-09-01 05:43 . 2010-09-22 02:09   74752   ----a-w-   c:\windows\system32\RegisterIEPKEYs.exe
2010-09-01 05:42 . 2010-09-22 02:09   51200   ----a-w-   c:\windows\system32\admparse.dll
2010-09-01 05:42 . 2010-09-22 02:09   75264   ----a-w-   c:\windows\system32\iesetup.dll
2010-09-01 05:42 . 2010-09-22 02:09   110592   ----a-w-   c:\windows\system32\IEAdvpack.dll
2010-09-01 05:42 . 2010-09-22 02:09   150016   ----a-w-   c:\windows\system32\iexpress.exe
2010-09-01 05:42 . 2010-09-22 02:09   149504   ----a-w-   c:\windows\system32\wextract.exe
2010-09-01 05:42 . 2010-09-22 02:09   33280   ----a-w-   c:\windows\system32\imgutil.dll
2010-09-01 05:42 . 2010-09-22 02:09   48640   ----a-w-   c:\windows\system32\mshtmler.dll
2010-09-01 05:42 . 2010-09-22 02:09   11264   ----a-w-   c:\windows\system32\mshta.exe
2010-09-01 05:41 . 2010-09-22 02:09   160768   ----a-w-   c:\windows\system32\msls31.dll
2010-08-26 00:10 . 2010-08-13 20:11   --------   d-----w-   c:\users\Antoun\AppData\Roaming\flightgear.org
2010-08-21 23:45 . 2010-08-21 23:45   --------   d-----w-   c:\programdata\TuneUpMedia
2010-08-20 20:28 . 2010-08-17 02:08   --------   d-----w-   c:\program files\iTunes
2010-08-20 18:01 . 2010-04-30 23:32   --------   d-----w-   c:\program files\Yahoo!
2010-08-20 17:52 . 2010-09-06 19:50   1536   ----a-w-   c:\users\Antoun - Copy\AppData\Roaming\Sketchpad 5 Preferences.dat
2010-08-20 17:52 . 2010-01-23 05:27   1536   ----a-w-   c:\users\Antoun\AppData\Roaming\Sketchpad 5 Preferences.dat
2010-08-18 19:16 . 2010-08-18 19:16   271696   ----a-w-   c:\programdata\Kaspersky Lab\AVP11\Bases\sys_critical_obj.dll
2010-08-17 22:43 . 2010-08-17 22:43   --------   d-----w-   c:\program files\Coupons
2010-08-17 02:15 . 2010-04-11 22:49   --------   d-----w-   c:\users\Antoun\AppData\Roaming\Apple Computer
2010-08-17 02:09 . 2010-08-17 02:08   --------   d-----w-   c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-08-17 02:08 . 2010-08-17 02:08   --------   d-----w-   c:\program files\iPod
2010-08-17 02:08 . 2009-12-16 01:41   --------   d-----w-   c:\program files\Common Files\Apple
2010-08-17 02:08 . 2010-06-06 05:28   --------   d-----w-   c:\programdata\Apple Computer
2010-08-17 02:06 . 2010-06-06 05:28   --------   d-----w-   c:\program files\QuickTime Alternative
2010-08-17 02:04 . 2010-08-17 02:04   --------   d-----w-   c:\program files\Bonjour
2010-08-17 01:58 . 2010-08-17 01:58   73000   ----a-w-   c:\programdata\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe
2010-08-14 17:26 . 2010-05-23 14:19   --------   d-----w-   c:\program files\Movie Maker 2.6
2010-08-13 20:11 . 2010-08-13 20:11   413696   ----a-w-   c:\windows\system32\wrap_oal.dll
2010-08-13 20:11 . 2010-08-13 20:11   110592   ----a-w-   c:\windows\system32\OpenAL32.dll
2010-08-13 20:11 . 2010-08-13 20:11   --------   d-----w-   c:\program files\OpenAL
2010-08-13 20:09 . 2010-08-13 20:09   --------   d-----w-   c:\program files\FlightGear
2010-08-11 11:56 . 2010-08-11 11:56   --------   d-----w-   c:\users\Antoun\AppData\Roaming\AVG9
2010-08-10 17:30 . 2009-12-19 00:02   --------   d-----w-   c:\program files\Microsoft
2010-08-08 23:27 . 2010-08-08 23:27   25168   ----a-w-   c:\windows\system32\drivers\AVGIDSvx.sys
2010-08-08 04:33 . 2010-06-26 01:48   --------   d-----w-   c:\program files\Electronic Arts
2010-08-04 22:34 . 2010-08-04 22:06   --------   d-----w-   c:\program files\Screaming Bee
2009-12-15 23:34 . 2009-12-16 12:04   119808   ----a-w-   c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2008-07-24 08:24 . 2008-07-24 08:24   8192   --sha-w-   c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}"= "c:\program files\Swag_Bucks\tbSwag.dll" [2010-03-17 2355224]

[HKEY_CLASSES_ROOT\clsid\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}]
2010-03-17 20:45   2355224   ----a-w-   c:\program files\Swag_Bucks\tbSwag.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}"= "c:\program files\Swag_Bucks\tbSwag.dll" [2010-03-17 2355224]

[HKEY_CLASSES_ROOT\clsid\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{8BDEA9D6-6F62-45EB-8EE9-8A81AF0D2F94}"= "c:\program files\Swag_Bucks\tbSwag.dll" [2010-03-17 2355224]

[HKEY_CLASSES_ROOT\clsid\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-06-07 4176760]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"AeroSnap"="c:\program files\AeroSnap\AeroSnap.exe" [2008-12-07 886784]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2010-05-07 247144]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-08-03 102400]
"Steam"="c:\program files\Steam\Steam.exe" [2010-09-09 1242448]
"cdloader"="c:\users\Antoun\AppData\Roaming\mjusbsp\cdloader2.exe" [2010-02-26 50520]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-17 4907008]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-12-15 30192]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"VX3000"="c:\windows\vVX3000.exe" [2010-05-20 762736]
"NPSStartup"="" [BU]
"Bing Bar"="c:\program files\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe" [2010-04-27 243544]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-07-20 202256]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]
"QuickTime Task"="c:\program files\QuickTime Alternative\QTTask.exe" [2010-03-19 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-02-26 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-02-26 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-02-26 150552]
"FaxCenterServer"="c:\program files\Dell PC Fax\fm3032.exe" [2006-06-15 307200]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe" [2010-09-14 352976]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-12 640376]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"dlcxmon.exe"="c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe" [2007-01-12 292336]
"MemoryCardManager"="c:\program files\Dell Photo AIO Printer 926\memcard.exe" [2006-11-03 304008]
"CinemaNowMediaManagerApp"="c:\program files\CinemaNow\CinemaNow Media Manager\CinemaNowShell.exe" [2010-01-14 2148848]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-7-24 50688]
WDDMStatus.lnk - c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2009-11-5 2057536]
WDSmartWare.lnk - c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe [2009-11-5 9116480]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-07-24 05:56   10536   ----a-w-   c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 CNPreloadedSvc;CinemaNow Preloaded Service;c:\program files\CinemaNow\CinemaNow Media Manager\PreloadedSvc.exe [2010-01-14 144880]
R2 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe [2006-10-11 532480]
R2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-21 135664]
R2 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [2008-05-14 309744]
R2 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [2008-05-14 166384]
R2 SessionLauncher;SessionLauncher;c:\users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe

R3 AVGIDSDrivervtx;AVG9IDSDriver;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_Vista\AVGIDSDriver.sys

R3 AVGIDSFiltervtx;AVG9IDSFilter;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_Vista\AVGIDSFilter.sys

R3 AVGIDSShimvtx;AVG9IDSShim;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_Vista\AVGIDSShim.sys

R3 bsusbser;PHD USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\bsusbser.sys [2008-01-23 99456]
R3 DrvAgent32;DrvAgent32;c:\windows\system32\Drivers\DrvAgent32.sys [2010-09-09 23456]
R3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2009-12-15 30192]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys

R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys

R3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2008-05-14 1120752]
R3 SaiH0460;SaiH0460;c:\windows\system32\DRIVERS\SaiH0460.sys [2007-05-01 132232]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys

R3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\DRIVERS\sscebus.sys [2009-05-13 90240]
R3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\DRIVERS\sscemdfl.sys [2009-05-13 14976]
R3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\DRIVERS\sscemdm.sys [2009-05-13 121856]
R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\DRIVERS\vcsvad.sys [2008-12-26 17792]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 wlcrasvc;Windows Live Devices remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-06-04 49504]
S0 AVGIDSErHrvtx;AVG9IDSErHr;c:\windows\System32\Drivers\AVGIDSvx.sys [2010-08-08 25168]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2010-06-09 11352]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2010-04-23 22104]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [2008-09-16 169312]
S2 AERTFilters;Andrea RT Filters Service;c:\windows\system32\AERTSrv.exe [2007-12-05 77824]
S2 CinemaNow Service;CinemaNow Service;c:\program files\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe [2010-01-14 129520]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-08-03 233472]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-05-21 173352]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2010-05-07 92008]
S2 WDDMService;WD SmartWare Drive Manager;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [2009-11-05 110592]
S2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [2009-06-16 20480]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-08-03 36608]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-03 19984]
S3 RDPDISPM;RDPDISPM;c:\windows\system32\DRIVERS\rdpdispm.sys [2010-06-04 18528]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2009-02-13 11520]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - FSUSBEXDISK

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-21 03:01]

2010-09-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-21 03:01]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.msn.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {{0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\Windows Live\Companion\companioncore.dll
Trusted Zone: cinemanow.com
FF - ProfilePath - c:\users\Antoun\AppData\Roaming\Mozilla\Firefox\Profiles\7lv6i28j.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=LMW2&o=16046&locale=en_US&q=
FF - component: c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\components\FFGlobalExtension.dll
FF - component: c:\program files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\components\SEPsearchhelperff.dll
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - component: c:\program files\Mozilla *Blocked Russian URL*\components\abhelperxpcom.dll
FF - component: c:\program files\Mozilla *Blocked Russian URL*\components\kavlinkfilter.dll
FF - component: c:\program files\MSN Toolbar\Platform\5.0.1449.0\Firefox\components\DomBridge.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC} - (no file)
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-Google Update - c:\users\Antoun\AppData\Local\Google\Update\GoogleUpdate.exe

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0011\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-09-29 19:32:47
ComboFix-quarantined-files.txt 2010-09-30 00:32

Pre-Run: 270,032,527,360 bytes free
Post-Run: 275,089,764,352 bytes free

Current=1 Default=1 Failed=0 LastKnownGood=1 Sets=1,2,3,4,5,6,7
- - End Of File - - 83F79ACDC163CE873DD867DB1EBEE38A

SuperDave · « **Reply #27 on:** September 30, 2010, 07:12:27 PM »

Re-running ComboFix to remove infections:

Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Open notepad and copy/paste the text in the quotebox below into it:
Quote
KillAll::

File::

C:\kleaner.tmp
c:\programdata\SPLBB06.tmp

DDS::
Trusted Zone: cinemanow.com
Save this as CFScript.txt, in the same location as ComboFix.exe
Referring to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at C:\ComboFix.txt
I don't need to see the log this time.

***********************************
Please download 7-Zip and install it. If you already have it, no need to reinstall.

Then, download RootkitUnhooker and save the setup to your Desktop.

Right-click on the RootkitUnhooker setup and mouse-over 7-Zip then click Extract to "RKU***"
Once that is done, enter the folder, and double-click on the setup file. Navigate through setup and finish.
Once that is done, you will see another folder that was created inside the RKU folder. Enter that folder, and double-click on the randomly named file. (It will be alpha-numeric and have an EXE extension on it.)
It will initialize itself and load the scanner. It will also install its driver. Please wait for the interface to begin.
Once inside the interface, do not fix anything. Click on the Report tab.
Next, click on the Scan button and a popup will show. Make sure all are checked, then click on OK. It will begin scanning. When it gets to the Files tab, it will ask you what drives to scan. Just select C:\ and hit OK.
It will finish in about 5 minutes or a little longer depending on how badly infected the system is, or if your security software is enabled.
When finished, it will show the report in the Report tab. Please copy all of it, and post it in your next reply. Depending on how large the log is, you may have to use two or three posts to get all the information in.

mcdidd · « **Reply #28 on:** October 15, 2010, 06:22:31 PM »

Hi SuperDave,
Sorry it took so long to get back to you.

Quote

Then, download RootkitUnhooker and save the setup to your Desktop.

Right-click on the RootkitUnhooker setup and mouse-over 7-Zip then click Extract to "RKU***"
Once that is done, enter the folder, and double-click on the setup file. Navigate through setup and finish.
Once that is done, you will see another folder that was created inside the RKU folder. Enter that folder, and double-click on the randomly named file. (It will be alpha-numeric and have an EXE extension on it.)
It will initialize itself and load the scanner. It will also install its driver. Please wait for the interface to begin.
Once inside the interface, do not fix anything. Click on the Report tab.
Next, click on the Scan button and a popup will show. Make sure all are checked, then click on OK. It will begin scanning. When it gets to the Files tab, it will ask you what drives to scan. Just select C:\ and hit OK.
It will finish in about 5 minutes or a little longer depending on how badly infected the system is, or if your security software is enabled.
When finished, it will show the report in the Report tab. Please copy all of it, and post it in your next reply. Depending on how large the log is, you may have to use two or three posts to get all the information in.

I tried this, but It didn't work. I should inform you that the original problem I was experiencing when I started this forum somehow resolved itself, but my computer still isn't in the best shape. I can't really think of specific problems, so I think this forum has served its purpose. Thank you so much for all the help time you put into this.

SuperDave · « **Reply #29 on:** October 16, 2010, 01:26:30 PM »

We can some more scans, if you wish, but it's up to you.

mcdidd · « **Reply #30 on:** October 16, 2010, 04:57:32 PM »

Ok, I suppose it wouldn't do any harm. What's next?

SuperDave · « **Reply #31 on:** October 16, 2010, 07:11:09 PM »

Did you run the ComboFix script as described in Reply #27?

Please try this scanner.

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.

mcdidd · « **Reply #32 on:** October 22, 2010, 08:49:00 AM »

I ran the ComboFix script. I tried GMER Rootkit Scanner twice and I got the dreaded blue screen both times. I have a question. My computer is running Vista Home Premium, and I will be upgrading to Windows 7 Professional in a couple weeks (It must be a clean install, since the version I am upgrading to does not correspond to the version I have now), so should any problem that exists now be gone after the upgrade?

SuperDave · « **Reply #33 on:** October 22, 2010, 12:00:19 PM »

If you do a reformat and install the new OS you should be good to go.
To wipe the drive clean, reformat and reinstall the OS. Please read:
•When should I re-format? How should I reinstall?

mcdidd · « **Reply #34 on:** October 22, 2010, 12:33:21 PM »

I am planning on using Windows Easy Transfer before I install it. So will any threats be transfered as well?

SuperDave · « **Reply #35 on:** October 23, 2010, 06:53:35 PM »

You will be safer by doing a full wipe of your harddrive.

mcdidd · « **Reply #36 on:** October 24, 2010, 03:17:04 PM »

Ok. What is important to back up before I upgrade?

SuperDave · « **Reply #37 on:** October 25, 2010, 01:21:50 PM »

Backing up files before formatting

If you backup any files they should be scanned from a clean properly protected PC before restoring. Also be careful what scanner is used as some are very poor at detecting and even worse at protecting from this infection. In fact due to the nature of these new infections there are probably no tools that will properly protect you from the infection. Be very selective and only backup files you can not replace like text documents and personal photos.

Do not back up to another machine! It will likely become infected also. Burn to DVD/CD, a flash drive or to an external drive which has nothing else on it and which you can format should it become infected from the backups.

I suggest running at least 3 of the below scanners on the backup files. Run the first scan then reboot before running the second then reboot after the second before running the third.

-) Dr.Web CureIt!
-) AVG Win32/Virut Removal Tool
-) Symantwc W32.Virut Removal Tool
-) McAfee Avert Stinger
-) Microsoft Windows Malicious Software Removal Tool

If you do not know how to perform a fresh install, use this website -> www.windowsreinstall.com/

Computer Hope Forum

News:

Author Topic: Host Process has stopped working/Explorer crash/Aero problems (Read 28601 times)

mcdidd

harry 48

Allan

mcdidd

Allan

mcdidd

mcdidd

mcdidd

SuperDave

mcdidd

SuperDave

mcdidd

SuperDave

mcdidd

BC_Programmer

mcdidd

SuperDave

mcdidd

SuperDave

mcdidd

mcdidd

SuperDave

mcdidd

SuperDave

mcdidd

SuperDave

mcdidd

SuperDave

mcdidd

SuperDave

mcdidd

SuperDave

mcdidd

SuperDave

mcdidd

SuperDave

mcdidd

SuperDave