Solved BSODs - Corrupt Memory Dumps

[Resolved] BSODs - Corrupt Memory Dumps

Here's a link to a thread I posted in the Windows 7 forum: http://www.windowsbbs.com/windows-7/96875-bsod-probably-caused-csrss-exe.html#post545140

I was directed here for potential Malware assistance. Many thanks for any help!

STEP 1:
Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Database version: 5367

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

12/21/2010 1:55:23 PM
mbam-log-2010-12-21 (13-55-23).txt

Scan type: Quick scan
Objects scanned: 158716
Time elapsed: 42 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

STEP 2:
GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-12-21 14:04:34
Windows 6.1.7600
Running: n21nzenl.exe


---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xD5 0x22 0x54 0x3C ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xD6 0x99 0x89 0xCA ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x6D 0xEF 0xE5 0x92 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xD5 0x22 0x54 0x3C ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xD6 0x99 0x89 0xCA ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x6D 0xEF 0xE5 0x92 ...

---- EOF - GMER 1.0.15 ----


STEP 3:
Locks up the machine every time

STEP 4:

DDS (Ver_10-12-12.02) - NTFS_AMD64
Run by ***** at 15:07:09.24 on Tue 12/21/2010
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_23
Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.12279.10358 [GMT -5:00]

AV: ESET Smart Security 4.2 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET Smart Security 4.2 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: ESET Personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe
C:\Program Files\ESET Smart Security\x86\ekrn.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\CheckPoint\Endpoint Connect\TracSrvWrapper.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\taskhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ESET Smart Security\egui.exe
C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe
C:\Program Files (x86)\wamp\wampmanager.exe
C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files (x86)\PowerDVD10\PowerDVD10\PDVD10Serv.exe
C:\Program Files (x86)\Cyberlink\Shared files\brs.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\CheckPoint\Endpoint Connect\TrGUI.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Program Files (x86)\wamp\bin\apache\apache2.2.11\bin\httpd.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe
C:\Program Files (x86)\wamp\bin\apache\apache2.2.11\bin\httpd.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\DllHost.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Users\****.****\Desktop\dds.scr
C:\Windows\system32\conhost.exe

============== Pseudo HJT Report ===============

uURLSearchHooks: SearchHook Class: {bc86e1ab-eda5-4059-938f-ce307b0c6f0a} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll
mWinlogon: Userinit=userinit.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
mRun: [BCU] "C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe "
mRun: [NUSB3MON] "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe "
mRun: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [RemoteControl10] "C:\Program Files (x86)\PowerDVD10\PowerDVD10\PDVD10Serv.exe "
mRun: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared files\brs.exe
mRun: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe "
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe "
mRun: [Check Point Endpoint Security] "C:\Program Files (x86)\CheckPoint\Endpoint Connect\TrGUI.exe "
mRun: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe "
mRun: [SSDMonitor] C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MOZILL~1.LNK - C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\STARTW~1.LNK - C:\Program Files (x86)\wamp\wampmanager.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://juniper.net/dana-cached/sc/JuniperSetupClient.cab
TCP: {33312B5E-4042-4032-B244-ADFE32F5BC64} = 205.152.37.23,205.152.150.23
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
BHO-X64: URLRedirectionBHO - No File
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
mRun-x64: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
mRun-x64: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe
mRun-x64: [egui] "C:\Program Files\ESET Smart Security\egui.exe" /hide /waitservice
mRun-x64: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe "
================= FIREFOX ===================

FF - ProfilePath - C:\Users\****~1.***\AppData\Roaming\Mozilla\Firefox\Profiles\cvkqe6so.default\
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\VLC\npvlc.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: All-in-One Sidebar: {097d3191-e6fa-4728-9826-b533d755359d} - %profile%\extensions\{097d3191-e6fa-4728-9826-b533d755359d}
FF - Ext: Xmarks: foxmarks@kei.com - %profile%\extensions\foxmarks@kei.com
FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com

============= SERVICES / DRIVERS ===============

R0 mv91xx;mv91xx;C:\Windows\System32\drivers\mv91xx.sys [2009-12-25 297512]
R0 Si3124r5;SiI-3124 SoftRaid 5 Controller;C:\Windows\System32\drivers\Si3124r5.sys [2010-11-16 340008]
R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2010/11/17 20:36:48];C:\Program Files (x86)\PowerDVD10\PowerDVD10\NavFilter\000.fcl [2010-8-26 146928]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-4-6 203776]
R2 BCUService;Browser Configuration Utility Service;C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-26 223464]
R2 eamonm;eamonm;C:\Windows\System32\drivers\eamonm.sys [2010-9-3 170104]
R2 ekrn;ESET Service;C:\Program Files\ESET Smart Security\x86\ekrn.exe [2010-11-4 810144]
R2 epfwwfp;epfwwfp;C:\Windows\System32\drivers\epfwwfp.sys [2010-7-29 50624]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2010-12-20 632792]
R2 TracSrvWrapper;Check Point Endpoint Security;C:\Program Files (x86)\CheckPoint\Endpoint Connect\TracSrvWrapper.exe [2010-9-26 4142608]
R3 amdkmdag;amdkmdag;C:\Windows\System32\drivers\atikmdag.sys [2010-10-27 8012288]
R3 amdkmdap;amdkmdap;C:\Windows\System32\drivers\atikmpag.sys [2010-10-27 287232]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;C:\Windows\System32\drivers\e1y62x64.sys [2010-11-16 290008]
R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2010-1-22 77824]
R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2010-1-22 180224]
R3 vna_ap;Check Point Virtual Network Adapter - Apollo;C:\Windows\System32\drivers\vnaap.sys [2010-9-26 161256]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 DIRECTIO;DIRECTIO;C:\Program Files (x86)\PerformanceTest\DirectIo.sys [2010-11-17 15872]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]
S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2010-9-28 51712]
S3 uvnc_service;uvnc_service;C:\Program Files\UltraVNC\winvnc.exe [2010-11-18 1793976]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-11-17 1255736]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;C:\Program Files\Microsoft SQL Server\100\Shared\sqladhlp.exe [2009-7-22 61976]
S4 RsFx0103;RsFx0103 Driver;C:\Windows\System32\drivers\RsFx0103.sys [2009-3-30 311656]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2010-9-17 430424]

=============== Created Last 30 ================

2010-12-21 18:54:01 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2010-12-21 18:53:58 24152 ----a-w- C:\Windows\System32\drivers\mbam.sys
2010-12-21 14:54:07 8199504 ----a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{13EC8C98-A748-42F3-A682-C71E1A7DED98}\mpengine.dll
2010-12-21 03:48:26 3610624 ----a-w- C:\Windows\System32\avisynth.dll
2010-12-21 03:48:26 2300928 ----a-w- C:\Windows\System32\DevIL.dll
2010-12-21 02:39:53 1892184 ----a-w- C:\Windows\SysWow64\D3DX9_42.dll
2010-12-20 17:28:17 880640 ----a-w- C:\Windows\SysWow64\UniBox10.ocx
2010-12-20 17:28:17 506368 ----a-w- C:\Windows\SysWow64\msxml.dll
2010-12-20 17:28:17 212992 ----a-w- C:\Windows\SysWow64\UniBoxVB12.ocx
2010-12-20 17:28:17 1101824 ----a-w- C:\Windows\SysWow64\UniBox210.ocx
2010-12-15 20:44:59 978944 ----a-w- C:\Windows\SysWow64\wininet.dll
2010-12-10 21:46:03 34152 ----a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys
2010-12-10 21:46:03 126312 ----a-w- C:\Windows\System32\GEARAspi64.dll
2010-12-10 21:46:03 107368 ----a-w- C:\Windows\SysWow64\GEARAspi.dll
2010-12-10 21:36:48 72536 ----a-w- C:\Windows\SysWow64\perf-MSSQL$SQLEXPRESS-sqlctr10.2.4000.0.dll
2010-12-10 21:36:48 108376 ----a-w- C:\Windows\System32\perf-MSSQL$SQLEXPRESS-sqlctr10.2.4000.0.dll
2010-12-10 21:36:48 105816 ----a-w- C:\Windows\System32\SQSRVRES.DLL
2010-12-10 21:21:15 78872 ----a-w- C:\Windows\System32\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.1.2531.0.dll
2010-12-10 21:21:15 50200 ----a-w- C:\Windows\SysWow64\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.1.2531.0.dll
2010-12-10 21:17:41 1853216 ----a-w- C:\PROGRA~3\Microsoft\VisualStudio\10.0\1033\ResourceCache.dll
2010-12-10 04:59:14 4068864 ----a-w- C:\Windows\System32\mf.dll
2010-12-10 04:59:14 3181568 ----a-w- C:\Windows\SysWow64\mf.dll
2010-12-10 04:59:14 257024 ----a-w- C:\Windows\System32\mfreadwrite.dll
2010-12-10 04:59:14 206848 ----a-w- C:\Windows\System32\mfps.dll
2010-12-10 04:59:14 196608 ----a-w- C:\Windows\SysWow64\mfreadwrite.dll
2010-12-10 04:59:14 1888256 ----a-w- C:\Windows\System32\WMVDECOD.DLL
2010-12-10 04:59:14 1619456 ----a-w- C:\Windows\SysWow64\WMVDECOD.DLL
2010-12-09 19:29:44 7680 ----a-w- C:\Program Files\Internet Explorer\iecompat.dll
2010-12-09 19:29:44 7680 ----a-w- C:\Program Files (x86)\Internet Explorer\iecompat.dll

==================== Find3M ====================

2010-11-18 21:09:23 521448 ----a-w- C:\Windows\System32\deployJava1.dll
2010-11-18 01:30:48 505128 ----a-w- C:\Windows\SysWow64\msvcp71.dll
2010-11-18 01:30:48 353576 ----a-w- C:\Windows\SysWow64\msvcr71.dll
2010-11-18 01:30:48 29480 ----a-w- C:\Windows\SysWow64\msxml3a.dll
2010-11-17 05:01:40 0 ----a-w- C:\Windows\ativpsrm.bin
2010-11-12 23:53:06 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2010-11-10 07:28:46 301936 ----a-w- C:\Windows\WLXPGSS.SCR
2010-11-04 06:35:53 1194496 ----a-w- C:\Windows\System32\wininet.dll
2010-11-04 06:31:34 57856 ----a-w- C:\Windows\System32\licmgr10.dll
2010-11-04 05:48:36 44544 ----a-w- C:\Windows\SysWow64\licmgr10.dll
2010-11-04 05:16:14 482816 ----a-w- C:\Windows\System32\html.iec
2010-11-04 04:41:26 386048 ----a-w- C:\Windows\SysWow64\html.iec
2010-11-04 04:35:37 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
2010-11-04 04:08:54 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2010-11-02 05:18:17 524288 ----a-w- C:\Windows\System32\wmicmiplugin.dll
2010-11-02 05:17:38 473600 ----a-w- C:\Windows\System32\taskcomp.dll
2010-11-02 05:17:38 1169408 ----a-w- C:\Windows\System32\taskschd.dll
2010-11-02 05:16:53 1114624 ----a-w- C:\Windows\System32\schedsvc.dll
2010-11-02 05:10:47 464384 ----a-w- C:\Windows\System32\taskeng.exe
2010-11-02 05:10:32 285696 ----a-w- C:\Windows\System32\schtasks.exe
2010-11-02 04:40:36 496128 ----a-w- C:\Windows\SysWow64\taskschd.dll
2010-11-02 04:40:36 305152 ----a-w- C:\Windows\SysWow64\taskcomp.dll
2010-11-02 04:34:44 192000 ----a-w- C:\Windows\SysWow64\taskeng.exe
2010-11-02 04:34:33 179712 ----a-w- C:\Windows\SysWow64\schtasks.exe
2010-10-27 09:00:16 8012288 ----a-w- C:\Windows\System32\drivers\atikmdag.sys
2010-10-27 08:25:38 21422592 ----a-w- C:\Windows\System32\atio6axx.dll
2010-10-27 08:08:18 16281600 ----a-w- C:\Windows\SysWow64\atioglxx.dll
2010-10-27 07:55:32 143360 ----a-w- C:\Windows\System32\atiapfxx.exe
2010-10-27 07:55:24 547328 ----a-w- C:\Windows\SysWow64\aticfx32.dll
2010-10-27 07:54:24 645120 ----a-w- C:\Windows\System32\aticfx64.dll
2010-10-27 07:52:18 450560 ----a-w- C:\Windows\System32\ATIDEMGX.dll
2010-10-27 07:52:14 478208 ----a-w- C:\Windows\System32\atieclxx.exe
2010-10-27 07:51:38 203776 ----a-w- C:\Windows\System32\atiesrxx.exe
2010-10-27 07:50:30 120320 ----a-w- C:\Windows\System32\atitmm64.dll
2010-10-27 07:50:16 423424 ----a-w- C:\Windows\System32\atipdl64.dll
2010-10-27 07:50:10 356352 ----a-w- C:\Windows\SysWow64\atipdlxx.dll
2010-10-27 07:49:58 278528 ----a-w- C:\Windows\SysWow64\Oemdspif.dll
2010-10-27 07:49:54 16384 ----a-w- C:\Windows\System32\atimuixx.dll
2010-10-27 07:49:50 59392 ----a-w- C:\Windows\System32\atiedu64.dll
2010-10-27 07:49:46 43520 ----a-w- C:\Windows\SysWow64\ati2edxx.dll
2010-10-27 07:46:58 4020736 ----a-w- C:\Windows\SysWow64\atidxx32.dll
2010-10-27 07:38:04 4744704 ----a-w- C:\Windows\System32\atidxx64.dll
2010-10-27 07:35:30 51200 ----a-w- C:\Windows\System32\aticalrt64.dll
2010-10-27 07:35:28 46080 ----a-w- C:\Windows\SysWow64\aticalrt.dll
2010-10-27 07:35:20 44544 ----a-w- C:\Windows\System32\aticalcl64.dll
2010-10-27 07:35:18 44032 ----a-w- C:\Windows\SysWow64\aticalcl.dll
2010-10-27 07:35:08 6815744 ----a-w- C:\Windows\System32\aticaldd64.dll
2010-10-27 07:33:52 5441536 ----a-w- C:\Windows\SysWow64\aticaldd.dll
2010-10-27 07:28:22 4094464 ----a-w- C:\Windows\SysWow64\atiumdag.dll
2010-10-27 07:22:04 5218304 ----a-w- C:\Windows\System32\atiumd64.dll
2010-10-27 07:15:00 58880 ----a-w- C:\Windows\System32\coinst.dll
2010-10-27 07:14:58 349184 ----a-w- C:\Windows\System32\atiadlxx.dll
2010-10-27 07:14:52 249856 ----a-w- C:\Windows\SysWow64\atiadlxy.dll
2010-10-27 07:14:44 14848 ----a-w- C:\Windows\System32\atig6pxx.dll
2010-10-27 07:14:42 12800 ----a-w- C:\Windows\SysWow64\atiglpxx.dll
2010-10-27 07:14:42 12800 ----a-w- C:\Windows\System32\atiglpxx.dll
2010-10-27 07:14:38 31744 ----a-w- C:\Windows\System32\atig6txx.dll
2010-10-27 07:14:32 27136 ----a-w- C:\Windows\SysWow64\atigktxx.dll
2010-10-27 07:14:24 287232 ----a-w- C:\Windows\System32\drivers\atikmpag.sys
2010-10-27 07:13:44 39936 ----a-w- C:\Windows\System32\atiuxp64.dll
2010-10-27 07:13:36 30720 ----a-w- C:\Windows\SysWow64\atiuxpag.dll
2010-10-27 07:13:30 37888 ----a-w- C:\Windows\System32\atiu9p64.dll
2010-10-27 07:13:24 28672 ----a-w- C:\Windows\SysWow64\atiu9pag.dll
2010-10-27 07:12:56 53248 ----a-w- C:\Windows\System32\drivers\ati2erec.dll
2010-10-27 06:57:04 3221504 ----a-w- C:\Windows\System32\atiumd6a.dll
2010-10-27 06:50:10 3460096 ----a-w- C:\Windows\SysWow64\atiumdva.dll
2010-10-27 06:37:18 53760 ----a-w- C:\Windows\System32\atimpc64.dll
2010-10-27 06:37:18 53760 ----a-w- C:\Windows\System32\amdpcom64.dll
2010-10-27 06:37:14 52736 ----a-w- C:\Windows\SysWow64\atimpc32.dll
2010-10-27 06:37:14 52736 ----a-w- C:\Windows\SysWow64\amdpcom32.dll
2010-10-27 05:06:22 2048 ----a-w- C:\Windows\System32\tzres.dll
2010-10-27 04:32:36 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2010-10-20 05:20:01 46080 ----a-w- C:\Windows\System32\atmlib.dll
2010-10-20 04:54:18 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
2010-10-20 03:09:15 3124224 ----a-w- C:\Windows\System32\win32k.sys
2010-10-20 03:05:46 367104 ----a-w- C:\Windows\System32\atmfd.dll
2010-10-20 02:58:41 294400 ----a-w- C:\Windows\SysWow64\atmfd.dll
2010-10-19 15:41:44 270720 ------w- C:\Windows\System32\MpSigStub.exe
2010-10-16 05:23:13 112000 ----a-w- C:\Windows\System32\consent.exe
2010-10-16 05:19:41 395776 ----a-w- C:\Windows\System32\webio.dll
2010-10-16 04:36:10 314368 ----a-w- C:\Windows\SysWow64\webio.dll
2010-10-07 17:36:16 96544 ----a-w- C:\Windows\System32\dnssd.dll
2010-10-07 17:36:16 69408 ----a-w- C:\Windows\System32\jdns_sd.dll
2010-10-07 17:36:16 237856 ----a-w- C:\Windows\System32\dnssdX.dll
2010-10-07 17:36:16 119584 ----a-w- C:\Windows\System32\dns-sd.exe
2010-10-07 17:23:02 91424 ----a-w- C:\Windows\SysWow64\dnssd.dll
2010-10-07 17:23:02 75040 ----a-w- C:\Windows\SysWow64\jdns_sd.dll
2010-10-07 17:23:02 197920 ----a-w- C:\Windows\SysWow64\dnssdX.dll
2010-10-07 17:23:02 107808 ----a-w- C:\Windows\SysWow64\dns-sd.exe
2010-09-30 21:25:10 40104 ----a-w- C:\Windows\System32\drivers\ElbyCDIO.sys
2010-09-30 11:18:24 89256 ----a-w- C:\Windows\SysWow64\ElbyCDIO.dll
2010-09-28 20:44:52 51712 ----a-w- C:\Windows\System32\drivers\usbaapl64.sys
2010-09-28 20:44:52 4184352 ----a-w- C:\Windows\System32\usbaaplrc.dll
2010-09-26 23:55:34 30096 ----a-w- C:\Windows\System32\vnaap_coinstall.dll
2010-09-26 23:55:34 154016 ----a-w- C:\Windows\SysWow64\CPEPC_PLAP_user64.dll
2010-09-26 23:55:34 154016 ----a-w- C:\Windows\System32\CPEPC_PLAP.dll
2010-09-26 23:55:28 87456 ----a-w- C:\Windows\SysWow64\epcginashim_user64.dll
2010-09-26 23:55:28 87456 ----a-w- C:\Windows\System32\epcginashim.dll
2010-09-26 23:55:26 161256 ----a-w- C:\Windows\System32\drivers\vnaap.sys

============= FINISH: 15:07:21.38 ===============

 

Thanks!

Not much here:

Bootkit Remover:

First it threw this message in a dialog bog:

ATA_PASS_THROUGH_DIRECT is not supported by your disk controller.
SCSI_PASS_THROUGH_DIRECT will be use for disk I/O.

I'm using a revodrive over PCI-Express.

And here's the log file:

Bootkit Remover
(c) 2009 eSage Lab
www.esagelab.com

Program version: 1.2.0.0
OS Version: Microsoft Windows 7 (build 7600), 64-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`06500000
ATA_Read(): DeviceIoControl() ERROR 1
Boot sector MD5 is: bb4f1627d8b9beda49ac0d010229f3ff

Size Device Name MBR Status
--------------------------------------------
111 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)


Done;
Press any key to quit...

ComboFix:

ComboFix 10-12-21.01 - **** 12/21/2010 18:44:07.1.8 - x64
Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.12279.10951 [GMT -5:00]
Running from: c:\users\****.****\Desktop\ComboFix.exe
AV: ESET Smart Security 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET Personal firewall *Disabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2010-11-21 to 2010-12-21 )))))))))))))))))))))))))))))))
.

2010-12-21 23:46 . 2010-12-21 23:46 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-12-21 19:18 . 2010-12-21 19:18 -------- d-----w- c:\program files (x86)\MBR Check
2010-12-21 19:17 . 2010-12-21 19:17 -------- d-----w- c:\program files (x86)\GMER (Detect Rootkits)
2010-12-21 18:54 . 2010-12-21 18:54 -------- d-----w- c:\programdata\Malwarebytes
2010-12-21 18:54 . 2010-11-29 22:42 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2010-12-21 18:53 . 2010-12-21 18:54 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2010-12-21 18:53 . 2010-11-29 22:42 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-21 18:52 . 2010-12-21 18:52 -------- d-----w- c:\program files (x86)\Temp File Cleaner
2010-12-21 14:54 . 2010-11-10 05:35 8199504 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{13EC8C98-A748-42F3-A682-C71E1A7DED98}\mpengine.dll
2010-12-21 03:48 . 2010-04-17 01:06 3610624 ----a-w- c:\windows\system32\avisynth.dll
2010-12-21 03:48 . 2009-04-30 01:25 2300928 ----a-w- c:\windows\system32\DevIL.dll
2010-12-21 02:39 . 2009-09-04 22:29 1892184 ----a-w- c:\windows\SysWow64\D3DX9_42.dll
2010-12-21 02:11 . 2010-12-21 02:13 -------- d-----w- c:\program files (x86)\Blue Screen View
2010-12-20 17:28 . 2008-04-02 21:54 1101824 ----a-w- c:\windows\SysWow64\UniBox210.ocx
2010-12-20 17:28 . 2008-04-02 21:53 212992 ----a-w- c:\windows\SysWow64\UniBoxVB12.ocx
2010-12-20 17:28 . 2008-04-02 21:53 880640 ----a-w- c:\windows\SysWow64\UniBox10.ocx
2010-12-20 17:28 . 2004-08-04 13:00 506368 ----a-w- c:\windows\SysWow64\msxml.dll
2010-12-20 17:28 . 2010-12-20 17:28 -------- d-----w- c:\program files (x86)\Common Files\PC Tools
2010-12-20 15:25 . 2010-12-20 15:25 -------- d-----w- C:\symbols
2010-12-20 15:22 . 2010-12-20 15:22 -------- d-----w- c:\program files (x86)\DebugWiz
2010-12-20 15:20 . 2010-12-21 02:00 -------- d-----w- c:\program files\Debugging Tools for Windows (x64)
2010-12-20 15:17 . 2010-12-20 15:17 -------- d-----w- c:\program files\Microsoft SDKs
2010-12-15 20:44 . 2010-11-04 06:37 696592 ----a-w- c:\program files\Internet Explorer\iexplore.exe
2010-12-10 21:46 . 2010-12-10 21:46 -------- dc----w- c:\windows\system32\DRVSTORE
2010-12-10 21:46 . 2009-05-18 18:17 34152 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-12-10 21:46 . 2008-04-17 17:12 126312 ----a-w- c:\windows\system32\GEARAspi64.dll
2010-12-10 21:46 . 2008-04-17 17:12 107368 ----a-w- c:\windows\SysWow64\GEARAspi.dll
2010-12-10 21:36 . 2010-09-17 17:35 105816 ----a-w- c:\windows\system32\SQSRVRES.DLL
2010-12-10 21:36 . 2010-09-17 17:33 108376 ----a-w- c:\windows\system32\perf-MSSQL$SQLEXPRESS-sqlctr10.2.4000.0.dll
2010-12-10 21:36 . 2010-09-17 15:16 72536 ----a-w- c:\windows\SysWow64\perf-MSSQL$SQLEXPRESS-sqlctr10.2.4000.0.dll
2010-12-10 21:36 . 2010-12-10 21:36 -------- d-----w- c:\program files\Microsoft.NET
2010-12-10 21:21 . 2009-07-22 08:17 78872 ----a-w- c:\windows\system32\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.1.2531.0.dll
2010-12-10 21:21 . 2009-07-22 08:17 50200 ----a-w- c:\windows\SysWow64\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.1.2531.0.dll
2010-12-10 21:21 . 2010-12-10 21:21 -------- d-----w- c:\windows\system32\RsFx
2010-12-10 21:14 . 2010-12-10 21:14 -------- d-----w- c:\windows\symbols
2010-12-10 05:05 . 2010-12-10 05:05 -------- d-----w- c:\windows\en
2010-12-10 05:01 . 2010-12-10 05:02 -------- d-----w- c:\program files (x86)\Windows Live
2010-12-10 05:01 . 2009-09-04 22:44 69464 ----a-w- c:\windows\SysWow64\XAPOFX1_3.dll
2010-12-10 05:01 . 2009-09-04 22:44 515416 ----a-w- c:\windows\SysWow64\XAudio2_5.dll
2010-12-10 05:01 . 2009-09-04 22:29 453456 ----a-w- c:\windows\SysWow64\d3dx10_42.dll
2010-12-10 05:01 . 2009-09-04 22:29 523088 ----a-w- c:\windows\system32\d3dx10_42.dll
2010-12-10 05:01 . 2006-11-29 18:06 4398360 ----a-w- c:\windows\system32\d3dx9_32.dll
2010-12-10 05:01 . 2006-11-29 18:06 3426072 ----a-w- c:\windows\SysWow64\d3dx9_32.dll
2010-12-10 04:59 . 2010-12-10 04:59 -------- d-----w- c:\program files (x86)\Common Files\Windows Live
2010-12-10 04:59 . 2010-05-23 10:15 1619456 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2010-12-10 04:59 . 2010-05-23 10:11 196608 ----a-w- c:\windows\SysWow64\mfreadwrite.dll
2010-12-10 04:59 . 2010-05-23 10:11 3181568 ----a-w- c:\windows\SysWow64\mf.dll
2010-12-10 04:59 . 2010-05-23 08:37 1888256 ----a-w- c:\windows\system32\WMVDECOD.DLL
2010-12-10 04:59 . 2010-05-23 08:35 257024 ----a-w- c:\windows\system32\mfreadwrite.dll
2010-12-10 04:59 . 2010-05-23 08:35 206848 ----a-w- c:\windows\system32\mfps.dll
2010-12-10 04:59 . 2010-05-23 08:35 4068864 ----a-w- c:\windows\system32\mf.dll
2010-12-09 19:29 . 2010-10-19 08:47 7680 ----a-w- c:\program files\Internet Explorer\iecompat.dll
2010-12-09 19:29 . 2010-10-19 08:10 7680 ----a-w- c:\program files (x86)\Internet Explorer\iecompat.dll
2010-12-09 17:05 . 2010-12-09 17:05 -------- d-----w- c:\program files (x86)\Microsoft Synchronization Services
2010-12-09 17:05 . 2010-12-10 05:03 -------- d-----w- c:\program files (x86)\Microsoft SQL Server Compact Edition
2010-12-09 17:05 . 2010-12-09 17:05 -------- d-----w- c:\windows\PCHEALTH
2010-12-09 17:02 . 2010-12-09 17:02 -------- d-----w- c:\program files (x86)\Microsoft Analysis Services
2010-12-09 17:02 . 2010-12-09 17:02 -------- d-----w- c:\windows\SHELLNEW
2010-12-09 17:02 . 2010-12-16 08:01 -------- d-----w- c:\programdata\Microsoft Help
2010-12-09 17:02 . 2010-12-09 17:02 -------- d-----r- C:\MSOCache
2010-12-06 21:45 . 2010-12-06 21:45 -------- d-----w- c:\users\Public\Roaming
2010-12-06 16:06 . 2010-12-06 16:06 -------- d-----w- c:\windows\SysWow64\Zonelabs
2010-12-06 15:29 . 2010-12-06 16:06 -------- d-----w- c:\windows\Internet Logs

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-18 21:09 . 2010-11-18 21:09 521448 ----a-w- c:\windows\system32\deployJava1.dll
2010-11-18 01:30 . 2010-11-18 01:35 505128 ----a-w- c:\windows\SysWow64\msvcp71.dll
2010-11-18 01:30 . 2010-11-18 01:35 353576 ----a-w- c:\windows\SysWow64\msvcr71.dll
2010-11-18 01:30 . 2010-11-18 01:35 29480 ----a-w- c:\windows\SysWow64\msxml3a.dll
2010-11-12 23:53 . 2010-11-18 21:05 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2010-11-10 07:28 . 2010-11-10 07:28 301936 ----a-w- c:\windows\WLXPGSS.SCR
2010-10-27 09:00 . 2010-10-27 09:00 8012288 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2010-10-27 08:25 . 2010-10-27 08:25 21422592 ----a-w- c:\windows\system32\atio6axx.dll
2010-10-27 08:08 . 2010-10-27 08:08 16281600 ----a-w- c:\windows\SysWow64\atioglxx.dll
2010-10-27 07:55 . 2010-10-27 07:55 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2010-10-27 07:55 . 2010-10-27 07:55 547328 ----a-w- c:\windows\SysWow64\aticfx32.dll
2010-10-27 07:54 . 2010-10-27 07:54 645120 ----a-w- c:\windows\system32\aticfx64.dll
2010-10-27 07:52 . 2010-11-17 04:59 450560 ----a-w- c:\windows\system32\ATIDEMGX.dll
2010-10-27 07:52 . 2010-04-07 02:13 478208 ----a-w- c:\windows\system32\atieclxx.exe
2010-10-27 07:51 . 2010-04-07 02:12 203776 ----a-w- c:\windows\system32\atiesrxx.exe
2010-10-27 07:50 . 2010-10-27 07:50 120320 ----a-w- c:\windows\system32\atitmm64.dll
2010-10-27 07:50 . 2010-04-07 02:10 423424 ----a-w- c:\windows\system32\atipdl64.dll
2010-10-27 07:50 . 2010-10-27 07:50 356352 ----a-w- c:\windows\SysWow64\atipdlxx.dll
2010-10-27 07:49 . 2010-10-27 07:49 278528 ----a-w- c:\windows\SysWow64\Oemdspif.dll
2010-10-27 07:49 . 2010-10-27 07:49 16384 ----a-w- c:\windows\system32\atimuixx.dll
2010-10-27 07:49 . 2010-10-27 07:49 59392 ----a-w- c:\windows\system32\atiedu64.dll
2010-10-27 07:49 . 2010-10-27 07:49 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll
2010-10-27 07:46 . 2010-10-27 07:46 4020736 ----a-w- c:\windows\SysWow64\atidxx32.dll
2010-10-27 07:38 . 2010-10-27 07:38 4744704 ----a-w- c:\windows\system32\atidxx64.dll
2010-10-27 07:35 . 2010-10-27 07:35 51200 ----a-w- c:\windows\system32\aticalrt64.dll
2010-10-27 07:35 . 2010-10-27 07:35 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll
2010-10-27 07:35 . 2010-10-27 07:35 44544 ----a-w- c:\windows\system32\aticalcl64.dll
2010-10-27 07:35 . 2010-10-27 07:35 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll
2010-10-27 07:35 . 2010-10-27 07:35 6815744 ----a-w- c:\windows\system32\aticaldd64.dll
2010-10-27 07:33 . 2010-10-27 07:33 5441536 ----a-w- c:\windows\SysWow64\aticaldd.dll
2010-10-27 07:28 . 2010-10-27 07:28 4094464 ----a-w- c:\windows\SysWow64\atiumdag.dll
2010-10-27 07:22 . 2010-10-27 07:22 5218304 ----a-w- c:\windows\system32\atiumd64.dll
2010-10-27 07:15 . 2010-11-17 04:59 58880 ----a-w- c:\windows\system32\coinst.dll
2010-10-27 07:14 . 2010-04-07 01:24 349184 ----a-w- c:\windows\system32\atiadlxx.dll
2010-10-27 07:14 . 2010-10-27 07:14 249856 ----a-w- c:\windows\SysWow64\atiadlxy.dll
2010-10-27 07:14 . 2010-10-27 07:14 14848 ----a-w- c:\windows\system32\atig6pxx.dll
2010-10-27 07:14 . 2010-10-27 07:14 12800 ----a-w- c:\windows\SysWow64\atiglpxx.dll
2010-10-27 07:14 . 2010-10-27 07:14 12800 ----a-w- c:\windows\system32\atiglpxx.dll
2010-10-27 07:14 . 2010-10-27 07:14 31744 ----a-w- c:\windows\system32\atig6txx.dll
2010-10-27 07:14 . 2010-10-27 07:14 27136 ----a-w- c:\windows\SysWow64\atigktxx.dll
2010-10-27 07:14 . 2010-10-27 07:14 287232 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2010-10-27 07:13 . 2010-04-07 01:22 39936 ----a-w- c:\windows\system32\atiuxp64.dll
2010-10-27 07:13 . 2010-10-27 07:13 30720 ----a-w- c:\windows\SysWow64\atiuxpag.dll
2010-10-27 07:13 . 2010-10-27 07:13 37888 ----a-w- c:\windows\system32\atiu9p64.dll
2010-10-27 07:13 . 2010-10-27 07:13 28672 ----a-w- c:\windows\SysWow64\atiu9pag.dll
2010-10-27 07:12 . 2010-10-27 07:12 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2010-10-27 06:57 . 2010-10-27 06:57 3221504 ----a-w- c:\windows\system32\atiumd6a.dll
2010-10-27 06:50 . 2010-10-27 06:50 3460096 ----a-w- c:\windows\SysWow64\atiumdva.dll
2010-10-27 06:37 . 2010-10-27 06:37 53760 ----a-w- c:\windows\system32\atimpc64.dll
2010-10-27 06:37 . 2010-10-27 06:37 53760 ----a-w- c:\windows\system32\amdpcom64.dll
2010-10-27 06:37 . 2010-10-27 06:37 52736 ----a-w- c:\windows\SysWow64\atimpc32.dll
2010-10-27 06:37 . 2010-10-27 06:37 52736 ----a-w- c:\windows\SysWow64\amdpcom32.dll
2010-10-19 15:41 . 2010-11-16 22:20 270720 ------w- c:\windows\system32\MpSigStub.exe
2010-10-07 17:36 . 2010-10-07 17:36 96544 ----a-w- c:\windows\system32\dnssd.dll
2010-10-07 17:36 . 2010-10-07 17:36 69408 ----a-w- c:\windows\system32\jdns_sd.dll
2010-10-07 17:36 . 2010-10-07 17:36 237856 ----a-w- c:\windows\system32\dnssdX.dll
2010-10-07 17:36 . 2010-10-07 17:36 119584 ----a-w- c:\windows\system32\dns-sd.exe
2010-10-07 17:23 . 2010-10-07 17:23 91424 ----a-w- c:\windows\SysWow64\dnssd.dll
2010-10-07 17:23 . 2010-10-07 17:23 75040 ----a-w- c:\windows\SysWow64\jdns_sd.dll
2010-10-07 17:23 . 2010-10-07 17:23 197920 ----a-w- c:\windows\SysWow64\dnssdX.dll
2010-10-07 17:23 . 2010-10-07 17:23 107808 ----a-w- c:\windows\SysWow64\dns-sd.exe
2010-09-30 21:25 . 2010-09-30 21:25 40104 ----a-w- c:\windows\system32\drivers\ElbyCDIO.sys
2010-09-30 11:18 . 2010-09-30 11:18 89256 ----a-w- c:\windows\SysWow64\ElbyCDIO.dll
2010-09-28 20:44 . 2010-09-28 20:44 51712 ----a-w- c:\windows\system32\drivers\usbaapl64.sys
2010-09-28 20:44 . 2010-09-28 20:44 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
2010-09-26 23:55 . 2010-09-26 23:55 30096 ----a-w- c:\windows\system32\vnaap_coinstall.dll
2010-09-26 23:55 . 2010-09-26 23:55 154016 ----a-w- c:\windows\SysWow64\CPEPC_PLAP_user64.dll
2010-09-26 23:55 . 2010-09-26 23:55 154016 ----a-w- c:\windows\system32\CPEPC_PLAP.dll
2010-09-26 23:55 . 2010-09-26 23:55 87456 ----a-w- c:\windows\SysWow64\epcginashim_user64.dll
2010-09-26 23:55 . 2010-09-26 23:55 87456 ----a-w- c:\windows\system32\epcginashim.dll
2010-09-26 23:55 . 2010-09-26 23:55 161256 ----a-w- c:\windows\system32\drivers\vnaap.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCU "= "c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-10-26 375000]
"NUSB3MON "= "c:\program files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-01-22 106496]
"JMB36X IDE Setup "= "c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"StartCCC "= "c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-04-07 102400]
"RemoteControl10 "= "c:\program files (x86)\PowerDVD10\PowerDVD10\PDVD10Serv.exe" [2010-02-03 87336]
"BDRegion "= "c:\program files (x86)\Cyberlink\Shared files\brs.exe" [2010-08-26 75048]
"AdobeCS5ServiceManager "= "c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-23 402432]
"SwitchBoard "= "c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"Adobe Reader Speed Launcher "= "c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]
"Adobe ARM "= "c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"SunJavaUpdateSched "= "c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Check Point Endpoint Security "= "c:\program files (x86)\CheckPoint\Endpoint Connect\TrGUI.exe" [2010-09-26 738824]
"BCSSync "= "c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"QuickTime Task "= "c:\program files (x86)\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper "= "c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-11-18 421160]
"SSDMonitor "= "c:\program files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2009-10-14 104408]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Mozilla Thunderbird.lnk - c:\program files (x86)\Mozilla Thunderbird\thunderbird.exe [2010-11-18 12584112]
start WampServer.lnk - c:\program files (x86)\wamp\wampmanager.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 0 (0x0)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableLUA "= 0 (0x0)
"EnableUIADesktopToggle "= 0 (0x0)
"PromptOnSecureDesktop "= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 DIRECTIO;DIRECTIO;c:\program files (x86)\PerformanceTest\DirectIo.sys [2008-03-19 15872]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2010-09-28 51712]
R3 uvnc_service;uvnc_service;c:\program files\UltraVNC\WinVNC.exe [2009-12-07 1793976]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-11-17 1255736]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-22 61976]
R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 311656]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2010-09-17 430424]
S0 mv91xx;mv91xx;c:\windows\system32\DRIVERS\mv91xx.sys [2009-12-25 297512]
S0 Si3124r5;SiI-3124 SoftRaid 5 Controller;c:\windows\system32\DRIVERS\Si3124r5.sys [2010-04-13 340008]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-11-18 834544]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-07-29 141264]
S2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2010/11/17 20:36];c:\program files (x86)\PowerDVD10\PowerDVD10\NavFilter\000.fcl [2010-08-26 17:18 146928]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-10-27 203776]
S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-26 223464]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-09-03 170104]
S2 ekrn;ESET Service;c:\program files\ESET Smart Security\x86\ekrn.exe [2010-11-04 810144]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2010-07-29 50624]
S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2010-12-20 632792]
S2 TracSrvWrapper;Check Point Endpoint Security;c:\program files (x86)\CheckPoint\Endpoint Connect\TracSrvWrapper.exe [2010-09-26 4142608]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-10-27 8012288]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-10-27 287232]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y62x64.sys [2010-04-07 290008]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-01-22 77824]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-01-22 180224]
S3 vna_ap;Check Point Virtual Network Adapter - Apollo;c:\windows\system32\DRIVERS\vnaap.sys [2010-09-26 161256]

.
Contents of the 'Scheduled Tasks' folder
.

--------- x86-64 -----------


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl "= "c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-07-22 11048040]
"IAAnotif "= "c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2010-02-08 186904]
"egui "= "c:\program files\ESET Smart Security\egui.exe" [2010-11-04 2919168]
"AdobeAAMUpdater-1.0 "= "c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs "=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: {33312B5E-4042-4032-B244-ADFE32F5BC64} = 205.152.37.23,205.152.150.23
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://juniper.net/dana-cached/sc/JuniperSetupClient.cab
FF - ProfilePath - c:\users\****.****\AppData\Roaming\Mozilla\Firefox\Profiles\cvkqe6so.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: All-in-One Sidebar: {097d3191-e6fa-4728-9826-b533d755359d} - %profile%\extensions\{097d3191-e6fa-4728-9826-b533d755359d}
FF - Ext: Xmarks: foxmarks@kei.com - %profile%\extensions\foxmarks@kei.com
FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com
.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}]
"ImagePath "= "\??\c:\program files (x86)\PowerDVD10\PowerDVD10\NavFilter\000.fcl "
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10g_ActiveX.exe,-101 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10g_ActiveX.exe "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Shockwave Flash Object "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx "
"ThreadingModel "= "Apartment "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@= "0 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@= "ShockwaveFlash.ShockwaveFlash.10 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx, 1 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "ShockwaveFlash.ShockwaveFlash "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Macromedia Flash Factory Object "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx "
"ThreadingModel "= "Apartment "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@= "FlashFactory.FlashFactory.1 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx, 1 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "FlashFactory.FlashFactory "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution "= "{15727DE6-F92D-4E46-ACB4-0E2C58B31A18} "

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key "= "ActionsPane3 "
"Location "= "c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd "

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2010-12-21 18:47:36
ComboFix-quarantined-files.txt 2010-12-21 23:47

Pre-Run: 50,874,597,376 bytes free
Post-Run: 50,297,290,752 bytes free

- - End Of File - - F93E51FC05A0ADCA9276C60C6F84F83D

 

BSOD.txt

I notice a lot of the crashes haven't left minidump files.

==================================================
Dump File : 122010-10576-01.dmp
Crash Time : 12/20/2010 2:25:26 PM
Bug Check String : CRITICAL_OBJECT_TERMINATION
Bug Check Code : 0x000000f4
Parameter 1 : 00000000`00000003
Parameter 2 : fffffa80`0bd25b30
Parameter 3 : fffffa80`0bd25e10
Parameter 4 : fffff800`02fd75d0
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+70740
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7600.16617 (win7_gdr.100618-1621)
Processor : x64
Computer Name :
Full Path : C:\Windows\Minidump\122010-10576-01.dmp
Processors Count : 8
Major Version : 15
Minor Version : 7600
==================================================

==================================================
Dump File : 122010-17565-01.dmp
Crash Time : 12/20/2010 9:54:30 AM
Bug Check String : CRITICAL_OBJECT_TERMINATION
Bug Check Code : 0x000000f4
Parameter 1 : 00000000`00000003
Parameter 2 : fffffa80`0cbb5b30
Parameter 3 : fffffa80`0cbb5e10
Parameter 4 : fffff800`02fd55d0
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+70740
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7600.16617 (win7_gdr.100618-1621)
Processor : x64
Computer Name :
Full Path : C:\Windows\Minidump\122010-17565-01.dmp
Processors Count : 8
Major Version : 15
Minor Version : 7600
==================================================

==================================================
Dump File : 121710-10420-01.dmp
Crash Time : 12/17/2010 11:24:58 AM
Bug Check String : CRITICAL_OBJECT_TERMINATION
Bug Check Code : 0x000000f4
Parameter 1 : 00000000`00000003
Parameter 2 : fffffa80`0cd6cb30
Parameter 3 : fffffa80`0cd6ce10
Parameter 4 : fffff800`02fcb5d0
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+70740
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7600.16617 (win7_gdr.100618-1621)
Processor : x64
Computer Name :
Full Path : C:\Windows\Minidump\121710-10420-01.dmp
Processors Count : 8
Major Version : 15
Minor Version : 7600
==================================================

otl.txt

OTL logfile created on: 12/21/2010 7:57:54 PM - Run 1
OTL by OldTimer - Version 3.2.18.0 Folder = C:\Users\****.****\Desktop
64bit- An unknown product (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

12.00 Gb Total Physical Memory | 10.00 Gb Available Physical Memory | 87.00% Memory free
24.00 Gb Paging File | 22.00 Gb Available in Paging File | 92.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111.70 Gb Total Space | 46.76 Gb Free Space | 41.86% Space Free | Partition Type: NTFS
Drive T: | 143.89 Gb Total Space | 71.83 Gb Free Space | 49.92% Space Free | Partition Type: NTFS
Drive U: | 1397.26 Gb Total Space | 1254.09 Gb Free Space | 89.75% Space Free | Partition Type: NTFS
Drive W: | 1397.28 Gb Total Space | 24.47 Gb Free Space | 1.75% Space Free | Partition Type: NTFS

Computer Name: **** | User Name: **** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/12/21 19:56:45 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\****.****\Desktop\OTL.exe
PRC - [2010/12/20 12:28:56 | 000,632,792 | ---- | M] (PC Tools) -- C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe
PRC - [2010/11/04 17:15:50 | 000,810,144 | ---- | M] (ESET) -- C:\Program Files\ESET Smart Security\x86\ekrn.exe
PRC - [2010/10/16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/09/26 18:55:30 | 004,142,608 | ---- | M] (Check Point Software Technologies) -- C:\Program Files (x86)\CheckPoint\Endpoint Connect\TracSrvWrapper.exe
PRC - [2010/08/26 05:18:34 | 000,075,048 | ---- | M] (cyberlink) -- C:\Program Files (x86)\Cyberlink\Shared files\brs.exe
PRC - [2010/06/04 15:34:36 | 000,623,984 | ---- | M] (Juniper Networks) -- C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe
PRC - [2010/02/08 16:21:58 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2010/02/08 16:21:28 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2010/02/03 00:08:56 | 000,087,336 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\PowerDVD10\PowerDVD10\PDVD10Serv.exe
PRC - [2010/01/22 12:29:40 | 000,106,496 | ---- | M] (NEC Electronics Corporation) -- C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
PRC - [2009/10/26 13:16:00 | 000,223,464 | ---- | M] (DeviceVM, Inc.) -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
PRC - [2009/10/26 13:15:56 | 000,375,000 | ---- | M] (DeviceVM, Inc.) -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe
PRC - [2009/10/14 15:42:38 | 000,104,408 | ---- | M] (PC Tools) -- C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe


========== Modules (SafeList) ==========

MOD - [2010/12/21 19:56:45 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\****.****\Desktop\OTL.exe
MOD - [2010/08/21 00:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2010/11/04 17:18:12 | 000,042,360 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET Smart Security\EHttpSrv.exe -- (EhttpSrv)
SRV:64bit: - [2010/11/04 17:15:50 | 000,810,144 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET Smart Security\x86\ekrn.exe -- (ekrn)
SRV:64bit: - [2010/10/27 02:51:38 | 000,203,776 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009/12/07 00:22:14 | 001,793,976 | ---- | M] (UltraVNC) [On_Demand | Stopped] -- C:\Program Files\UltraVNC\WinVNC.exe -- (uvnc_service)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/13 20:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2010/12/20 12:28:56 | 000,632,792 | ---- | M] (PC Tools) [Auto | Running] -- C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe -- (PCToolsSSDMonitorSvc)
SRV - [2010/10/16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/09/26 18:55:30 | 004,142,608 | ---- | M] (Check Point Software Technologies) [Auto | Running] -- C:\Program Files (x86)\CheckPoint\Endpoint Connect\TracSrvWrapper.exe -- (TracSrvWrapper)
SRV - [2010/06/04 15:34:36 | 000,623,984 | ---- | M] (Juniper Networks) [Auto | Running] -- C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe -- (dsNcService)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010/02/08 16:21:28 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2009/10/26 13:16:00 | 000,223,464 | ---- | M] (DeviceVM, Inc.) [Auto | Running] -- C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe -- (BCUService)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\MediaCoder Audio Edition x64\SysInfoX64.sys -- (CrystalSysInfo)
DRV:64bit: - [2010/11/17 22:38:27 | 000,834,544 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2010/10/27 04:00:16 | 008,012,288 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2010/10/27 02:14:24 | 000,287,232 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010/09/30 16:25:10 | 000,040,104 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2010/09/28 15:44:52 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2010/09/26 18:55:26 | 000,161,256 | ---- | M] (Check Point Software Technologies) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vnaap.sys -- (vna_ap)
DRV:64bit: - [2010/09/14 08:16:15 | 000,125,888 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AnyDVD.sys -- (AnyDVD)
DRV:64bit: - [2010/09/13 10:18:28 | 000,457,264 | ---- | M] (Check Point Software Technologies Ltd.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vsdatant.sys -- (vsdatant)
DRV:64bit: - [2010/09/03 06:13:46 | 000,170,104 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\eamonm.sys -- (eamonm)
DRV:64bit: - [2010/07/29 12:31:26 | 000,171,152 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\epfw.sys -- (epfw)
DRV:64bit: - [2010/07/29 12:31:26 | 000,141,264 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ehdrv.sys -- (ehdrv)
DRV:64bit: - [2010/07/29 12:31:26 | 000,050,624 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\epfwwfp.sys -- (epfwwfp)
DRV:64bit: - [2010/07/29 12:31:26 | 000,033,632 | ---- | M] (ESET) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\epfwndis.sys -- (Epfwndis)
DRV:64bit: - [2010/06/04 15:07:26 | 000,032,768 | ---- | M] (Juniper Networks) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dsNcAdpt.sys -- (dsNcAdpt)
DRV:64bit: - [2010/04/13 18:08:00 | 000,340,008 | ---- | M] (Silicon Image, Inc) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\Si3124r5.sys -- (Si3124r5)
DRV:64bit: - [2010/04/13 18:08:00 | 000,022,568 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\SiWinAcc.sys -- (SiFilter)
DRV:64bit: - [2010/04/13 18:08:00 | 000,016,936 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\SiRemFil.sys -- (SiRemFil)
DRV:64bit: - [2010/04/07 03:04:00 | 000,290,008 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1y62x64.sys -- (e1yexpress) Intel(R)
DRV:64bit: - [2010/03/09 05:21:42 | 000,123,408 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2010/02/08 16:12:02 | 000,409,624 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010/01/22 12:22:22 | 000,180,224 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010/01/22 12:22:18 | 000,077,824 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2009/12/25 02:05:40 | 000,297,512 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mv91xx.sys -- (mv91xx)
DRV:64bit: - [2009/10/29 03:14:38 | 000,115,824 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID)
DRV:64bit: - [2009/07/15 22:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)
DRV:64bit: - [2009/07/13 20:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2009/07/13 20:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2010/09/14 08:16:15 | 000,125,888 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2010/08/26 12:18:24 | 000,146,928 | ---- | M] (CyberLink Corp.) [2010/11/17 20:36:48] [Kernel | Auto | Running] -- C:\Program Files (x86)\PowerDVD10\PowerDVD10\NavFilter\000.fcl -- ({1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC})
DRV - [2008/03/19 17:14:52 | 000,015,872 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\PerformanceTest\DirectIo.sys -- (DIRECTIO)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = FF 03 E2 E8 85 A0 CB 01 [binary data]
IE - HKCU\..\URLSearchHook: {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll (DeviceVM, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {097d3191-e6fa-4728-9826-b533d755359d}:0.7.12
FF - prefs.js..extensions.enabledItems: foxmarks@kei.com:3.9.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/12/11 12:15:22 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/12/11 12:15:22 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2010/12/20 14:56:45 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET Smart Security\Mozilla Thunderbird [2010/11/17 21:36:16 | 000,000,000 | ---D | M]

[2010/12/20 22:12:21 | 000,000,000 | ---D | M] -- C:\Users\****.****\AppData\Roaming\mozilla\Extensions
[2010/12/20 15:02:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\****.****\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010/12/20 22:12:21 | 000,000,000 | ---D | M] -- C:\Users\****.****\AppData\Roaming\mozilla\Extensions\MediaCoder
[2010/12/21 18:20:35 | 000,000,000 | ---D | M] -- C:\Users\****.****\AppData\Roaming\mozilla\Firefox\Profiles\cvkqe6so.default\extensions
[2010/12/20 15:21:15 | 000,000,000 | ---D | M] (All-in-One Sidebar) -- C:\Users\****.****\AppData\Roaming\mozilla\Firefox\Profiles\cvkqe6so.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}
[2010/12/20 15:21:17 | 000,000,000 | ---D | M] -- C:\Users\****.****\AppData\Roaming\mozilla\Firefox\Profiles\cvkqe6so.default\extensions\firebug@software.joehewitt.com
[2010/12/20 15:21:18 | 000,000,000 | ---D | M] -- C:\Users\****.****\AppData\Roaming\mozilla\Firefox\Profiles\cvkqe6so.default\extensions\foxmarks@kei.com
[2010/12/21 18:20:35 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/11/18 16:05:13 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/12/20 16:00:17 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2010/11/12 18:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/12/16 12:18:24 | 000,000,927 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [egui] C:\Program Files\ESET Smart Security\egui.exe (ESET)
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [BCU] C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)
O4 - HKLM..\Run: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared files\brs.exe (cyberlink)
O4 - HKLM..\Run: [Check Point Endpoint Security] C:\Program Files (x86)\CheckPoint\Endpoint Connect\TrGUI.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation)
O4 - HKLM..\Run: [RemoteControl10] C:\Program Files (x86)\PowerDVD10\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SSDMonitor] C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe (PC Tools)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O28:64bit: - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2010/12/21 19:56:40 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\****.****\Desktop\OTL.exe
[2010/12/21 19:08:08 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2010/12/21 18:47:38 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010/12/21 18:43:45 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2010/12/21 18:43:45 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2010/12/21 18:43:45 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2010/12/21 18:43:42 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010/12/21 18:43:29 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/12/21 18:43:15 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010/12/21 18:25:12 | 000,083,968 | ---- | C] (eSage Lab) -- C:\Users\****.****\Desktop\remover.exe
[2010/12/21 14:18:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MBR Check
[2010/12/21 14:17:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GMER (Detect Rootkits)
[2010/12/21 13:54:12 | 000,000,000 | ---D | C] -- C:\Users\****.****\AppData\Roaming\Malwarebytes
[2010/12/21 13:54:01 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010/12/21 13:54:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010/12/21 13:53:58 | 000,024,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2010/12/21 13:53:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010/12/21 13:52:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Temp File Cleaner
[2010/12/20 23:11:56 | 000,000,000 | ---D | C] -- C:\Program Files\AviSynth
[2010/12/20 22:48:26 | 003,610,624 | ---- | C] (The Public) -- C:\Windows\SysNative\avisynth.dll
[2010/12/20 22:48:26 | 002,300,928 | ---- | C] (Abysmal Software) -- C:\Windows\SysNative\DevIL.dll
[2010/12/20 22:48:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AviSynth 2.5
[2010/12/20 22:44:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MeGUI
[2010/12/20 22:12:17 | 000,000,000 | ---D | C] -- C:\Users\****.****\AppData\Local\Broad Intelligence
[2010/12/20 21:39:30 | 000,000,000 | ---D | C] -- C:\Users\****.****\AppData\Roaming\Winamp
[2010/12/20 21:39:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp
[2010/12/20 21:35:44 | 000,000,000 | ---D | C] -- C:\Users\****.****\AppData\Roaming\Broad Intelligence
[2010/12/20 21:35:39 | 000,000,000 | ---D | C] -- C:\Program Files\MediaCoder Audio Edition x64
[2010/12/20 21:13:53 | 000,000,000 | ---D | C] -- C:\Users\****.****\Documents\Visual Studio 2010
[2010/12/20 21:11:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Blue Screen View
[2010/12/20 20:16:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Yamb
[2010/12/20 15:01:14 | 000,000,000 | R--D | C] -- C:\Users\****.****\Searches
[2010/12/20 15:01:13 | 000,000,000 | ---D | C] -- C:\Users\****.****\AppData\Roaming\Identities
[2010/12/20 15:01:12 | 000,000,000 | R--D | C] -- C:\Users\****.****\Contacts
[2010/12/20 15:01:11 | 000,000,000 | --SD | C] -- C:\Users\****.****\AppData\Roaming\Microsoft
[2010/12/20 15:01:11 | 000,000,000 | R--D | C] -- C:\Users\****.****\Videos
[2010/12/20 15:01:11 | 000,000,000 | R--D | C] -- C:\Users\****.****\Saved Games
[2010/12/20 15:01:11 | 000,000,000 | R--D | C] -- C:\Users\****.****\Pictures
[2010/12/20 15:01:11 | 000,000,000 | R--D | C] -- C:\Users\****.****\Music
[2010/12/20 15:01:11 | 000,000,000 | R--D | C] -- C:\Users\****.****\Links
[2010/12/20 15:01:11 | 000,000,000 | R--D | C] -- C:\Users\****.****\Favorites
[2010/12/20 15:01:11 | 000,000,000 | R--D | C] -- C:\Users\****.****\Downloads
[2010/12/20 15:01:11 | 000,000,000 | R--D | C] -- C:\Users\****.****\Documents
[2010/12/20 15:01:11 | 000,000,000 | R--D | C] -- C:\Users\****.****\Desktop
[2010/12/20 15:01:11 | 000,000,000 | -HSD | C] -- C:\Users\****.****\Documents\My Videos
[2010/12/20 15:01:11 | 000,000,000 | -HSD | C] -- C:\Users\****.****\Documents\My Pictures
[2010/12/20 15:01:11 | 000,000,000 | -HSD | C] -- C:\Users\****.****\Documents\My Music
[2010/12/20 15:01:11 | 000,000,000 | -H-D | C] -- C:\Users\****\AppData
[2010/12/20 15:01:11 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\Temp
[2010/12/20 15:01:11 | 000,000,000 | ---D | C] -- C:\Users\****.****\AppData\Local\Microsoft
[2010/12/20 15:01:11 | 000,000,000 | ---D | C] -- C:\Users\****.****\AppData\Roaming\Media Center Programs
[2010/12/20 15:01:11 | 000,000,000 | ---D | C] -- C:\Users\****.****\AppData\Roaming\Macromedia
[2010/12/20 12:28:17 | 001,101,824 | ---- | C] (Woodbury Associates Limited) -- C:\Windows\SysWow64\UniBox210.ocx
[2010/12/20 12:28:17 | 000,880,640 | ---- | C] (Woodbury Associates Limited) -- C:\Windows\SysWow64\UniBox10.ocx
[2010/12/20 12:28:17 | 000,212,992 | ---- | C] (Woodbury Associates Limited) -- C:\Windows\SysWow64\UniBoxVB12.ocx
[2010/12/20 12:28:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PC Tools
[2010/12/20 12:28:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Registry Mechanic
[2010/12/20 10:25:03 | 000,000,000 | ---D | C] -- C:\symbols
[2010/12/20 10:22:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DebugWiz
[2010/12/20 10:20:24 | 000,000,000 | ---D | C] -- C:\Program Files\Debugging Tools for Windows (x64)
[2010/12/20 10:17:15 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft SDKs
[2010/12/17 11:24:58 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2010/12/15 08:43:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FastStone Image Viewer
[2010/12/14 17:06:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DNSBench
[2010/12/10 16:46:03 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE
[2010/12/10 16:45:50 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2010/12/10 16:45:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2010/12/10 16:45:50 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2010/12/10 16:45:50 | 000,000,000 | ---D | C] -- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2010/12/10 16:45:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2010/12/10 16:45:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
[2010/12/10 16:45:29 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2010/12/10 16:45:25 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2010/12/10 16:45:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour
[2010/12/10 16:36:24 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2010/12/10 16:21:00 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\RsFx
[2010/12/10 16:20:46 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio 9.0
[2010/12/10 16:18:57 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft SQL Server
[2010/12/10 16:18:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server
[2010/12/10 16:18:50 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Sync Framework
[2010/12/10 16:18:48 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Synchronization Services
[2010/12/10 16:18:48 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft SQL Server Compact Edition
[2010/12/10 16:17:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft ASP.NET
[2010/12/10 16:17:49 | 000,000,000 | ---D | C] -- C:\Program Files\IIS
[2010/12/10 16:17:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\IIS
[2010/12/10 16:16:33 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\1033
[2010/12/10 16:16:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 10.0
[2010/12/10 16:16:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft F#
[2010/12/10 16:16:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Merge Modules
[2010/12/10 16:14:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 9.0
[2010/12/10 16:14:29 | 000,000,000 | ---D | C] -- C:\Windows\symbols
[2010/12/10 16:14:29 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio 10.0
[2010/12/10 16:14:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SDKs
[2010/12/10 16:14:29 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Help Viewer
[2010/12/10 16:14:29 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\1033
[2010/12/10 00:05:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2010/12/10 00:05:13 | 000,000,000 | ---D | C] -- C:\Windows\en
[2010/12/10 00:01:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live
[2010/12/09 23:59:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Windows Live
[2010/12/09 12:05:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Synchronization Services
[2010/12/09 12:05:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER
[2010/12/09 12:05:01 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2010/12/09 12:05:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
[2010/12/09 12:02:53 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2010/12/09 12:02:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services
[2010/12/09 12:02:47 | 000,000,000 | ---D | C] -- C:\Windows\SHELLNEW
[2010/12/09 12:02:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office
[2010/12/09 12:02:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2010/12/09 12:02:29 | 000,000,000 | R--D | C] -- C:\MSOCache
[2010/12/06 11:06:24 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Zonelabs
[2010/12/06 10:29:00 | 000,000,000 | ---D | C] -- C:\Windows\Internet Logs
[2010/12/06 10:08:07 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2010/12/06 10:08:06 | 000,000,000 | ---D | C] -- C:\ProgramData\CheckPoint

========== Files - Modified Within 30 Days ==========

[2010/12/21 19:56:45 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\****.****\Desktop\OTL.exe
[2010/12/21 19:14:58 | 000,015,040 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/12/21 19:14:58 | 000,015,040 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/12/21 19:13:49 | 000,872,514 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010/12/21 19:13:49 | 000,726,310 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010/12/21 19:13:49 | 000,146,328 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010/12/21 19:07:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/12/21 19:07:50 | 1066,745,854 | -HS- | M] () -- C:\hiberfil.sys
[2010/12/21 18:40:59 | 003,995,873 | R--- | M] () -- C:\Users\****.****\Desktop\ComboFix.exe
[2010/12/21 18:25:05 | 000,039,605 | ---- | M] () -- C:\Users\****.****\Desktop\bootkit_remover.rar
[2010/12/21 15:06:46 | 000,624,128 | ---- | M] () -- C:\Users\****.****\Desktop\dds.scr
[2010/12/20 23:21:58 | 000,001,996 | -H-- | M] () -- C:\Users\****.****\Documents\Default.rdp
[2010/12/20 20:42:12 | 850,867,040 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010/12/16 03:18:39 | 004,906,640 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2010/12/15 14:44:38 | 000,001,456 | ---- | M] () -- C:\Users\****.****\AppData\Local\Adobe Save for Web 12.0 Prefs
[2010/12/15 00:10:11 | 000,148,820 | -H-- | M] () -- C:\Windows\SysWow64\mlfcache.dat
[2010/12/10 18:24:07 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2010/12/10 16:35:13 | 000,864,234 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010/12/10 00:03:16 | 000,000,020 | ---- | M] () -- C:\Windows\ôóÃ
[2010/11/29 17:42:18 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010/11/29 17:42:06 | 000,024,152 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

========== Files Created - No Company Name ==========

[2010/12/21 18:43:45 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010/12/21 18:43:45 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010/12/21 18:43:45 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
[2010/12/21 18:43:45 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010/12/21 18:43:45 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010/12/21 18:40:47 | 003,995,873 | R--- | C] () -- C:\Users\****.****\Desktop\ComboFix.exe
[2010/12/21 18:25:05 | 000,039,605 | ---- | C] () -- C:\Users\****.****\Desktop\bootkit_remover.rar
[2010/12/21 15:06:42 | 000,624,128 | ---- | C] () -- C:\Users\****.****\Desktop\dds.scr
[2010/12/20 16:52:46 | 000,001,996 | -H-- | C] () -- C:\Users\****.****\Documents\Default.rdp
[2010/12/20 15:19:36 | 000,001,456 | ---- | C] () -- C:\Users\****.****\AppData\Local\Adobe Save for Web 12.0 Prefs
[2010/12/17 11:24:56 | 850,867,040 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010/12/10 18:24:07 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2010/12/10 16:14:18 | 000,864,234 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010/12/10 00:03:16 | 000,000,020 | ---- | C] () -- C:\Windows\ôóÃ
[2010/11/18 16:41:12 | 001,589,248 | ---- | C] () -- C:\Windows\SysWow64\libmysql_d.dll
[2010/11/17 00:52:46 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib
[2010/11/16 23:39:58 | 000,039,511 | ---- | C] () -- C:\Windows\Ascd_log.ini
[2010/11/16 23:38:33 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2010/11/16 23:38:28 | 000,028,404 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/04/02 07:30:14 | 000,010,296 | ---- | C] () -- C:\Windows\SysWow64\drivers\ASUSHWIO.SYS

========== LOP Check ==========

[2010/12/20 22:12:17 | 000,000,000 | ---D | M] -- C:\Users\****.****\AppData\Roaming\Broad Intelligence
[2010/12/20 15:02:42 | 000,000,000 | ---D | M] -- C:\Users\****.****\AppData\Roaming\CheckPoint
[2010/12/20 15:21:13 | 000,000,000 | ---D | M] -- C:\Users\****.****\AppData\Roaming\DAEMON Tools Lite
[2010/12/20 15:02:42 | 000,000,000 | ---D | M] -- C:\Users\****.****\AppData\Roaming\ESET
[2010/12/20 15:21:14 | 000,000,000 | ---D | M] -- C:\Users\****.****\AppData\Roaming\FileZilla
[2010/12/20 15:21:14 | 000,000,000 | ---D | M] -- C:\Users\****.****\AppData\Roaming\Juniper Networks
[2010/12/20 15:21:18 | 000,000,000 | ---D | M] -- C:\Users\****.****\AppData\Roaming\Opera
[2010/12/20 15:21:19 | 000,000,000 | ---D | M] -- C:\Users\****.****\AppData\Roaming\phpDesigner
[2010/12/20 15:21:19 | 000,000,000 | ---D | M] -- C:\Users\****.****\AppData\Roaming\Registry Mechanic
[2010/12/20 15:03:44 | 000,000,000 | ---D | M] -- C:\Users\****.****\AppData\Roaming\Scooter Software
[2010/12/20 15:02:42 | 000,000,000 | ---D | M] -- C:\Users\****.****\AppData\Roaming\Thunderbird
[2010/12/19 17:52:59 | 000,011,986 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/12/20 21:08:45 | 000,040,479 | ---- | M] () -- C:\debuglog.txt
[2010/12/21 19:07:50 | 1066,745,854 | -HS- | M] () -- C:\hiberfil.sys
[2010/12/21 19:07:53 | 4285,640,702 | -HS- | M] () -- C:\pagefile.sys
[2010/11/16 23:41:13 | 000,002,158 | ---- | M] () -- C:\RHDSetup.log

< %systemroot%\Fonts\*.com >
[2009/07/14 00:32:31 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 00:32:31 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 00:32:31 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 00:32:31 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 15:49:50 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/11/10 02:28:46 | 000,301,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 23:54:24 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/12/20 15:38:50 | 000,000,221 | -HS- | M] () -- C:\Users\****.****\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/12/21 18:40:59 | 003,995,873 | R--- | M] () -- C:\Users\****.****\Desktop\ComboFix.exe
[2010/12/21 19:56:45 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\****.****\Desktop\OTL.exe
[2010/09/01 15:33:49 | 000,083,968 | ---- | M] (eSage Lab) -- C:\Users\****.****\Desktop\remover.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2009/06/10 16:20:04 | 000,000,802 | ---- | M] () -- C:\Windows\addins\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >
[2010/11/19 09:55:19 | 000,008,192 | ---- | M] () -- C:\Windows\security\database\edb.chk
[2010/11/19 09:55:19 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edb.log
[2010/11/19 09:38:00 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edbres00001.jrs
[2010/11/19 09:38:00 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edbres00002.jrs

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2010/12/20 15:02:00 | 000,000,402 | -HS- | M] () -- C:\Users\****.****\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2010/11/17 20:39:43 | 000,000,040 | -HS- | M] () -- C:\ProgramData\.zreglib

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


< MD5 for: CSRSS.EXE >
[2009/07/13 20:39:02 | 000,007,680 | ---- | M] (Microsoft Corporation) MD5=60C2862B4BF0FD9F582EF344C2B1EC72 -- C:\Windows\winsxs\amd64_microsoft-windows-csrss_31bf3856ad364e35_6.1.7600.16385_none_b4d8d57efdc6b4f3\csrss.exe

========== Alternate Data Streams ==========

@Alternate Data Stream - 142 bytes -> C:\ProgramData\Temp1B5B4F1

< End of report >

 

extras.txt

OTL Extras logfile created on: 12/21/2010 7:57:54 PM - Run 1
OTL by OldTimer - Version 3.2.18.0 Folder = C:\Users\****.****\Desktop
64bit- An unknown product (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

12.00 Gb Total Physical Memory | 10.00 Gb Available Physical Memory | 87.00% Memory free
24.00 Gb Paging File | 22.00 Gb Available in Paging File | 92.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111.70 Gb Total Space | 46.76 Gb Free Space | 41.86% Space Free | Partition Type: NTFS
Drive T: | 143.89 Gb Total Space | 71.83 Gb Free Space | 49.92% Space Free | Partition Type: NTFS
Drive U: | 1397.26 Gb Total Space | 1254.09 Gb Free Space | 89.75% Space Free | Partition Type: NTFS
Drive W: | 1397.28 Gb Total Space | 24.47 Gb Free Space | 1.75% Space Free | Partition Type: NTFS

Computer Name: **** | User Name: **** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll ",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll ",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with FastStone] -- "C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe" "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [MediaMonkey.1Play] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)
Directory [MediaMonkey.2PlayNext] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)
Directory [MediaMonkey.3Enqueue] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1 ",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll ",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll ",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with FastStone] -- "C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe" "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [MediaMonkey.1Play] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" "%1" (Ventis Media Inc.)
Directory [MediaMonkey.2PlayNext] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /NEXT "%1" (Ventis Media Inc.)
Directory [MediaMonkey.3Enqueue] -- "C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe" /ADD "%1" (Ventis Media Inc.)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{034106B5-54B7-467F-B477-5B7DBB492624}" = Microsoft Sync Framework Services v1.0 SP1 (x64)
"{0826F9E4-787E-481D-83E0-BC6A57B056D5}" = Microsoft SQL Server VSS Writer
"{0F37D969-1260-419E-B308-EF7D29ABDE20}" = Web Deployment Tool
"{1AB7EDC5-D891-34C5-9FF1-BE6A85ACC44B}" = Microsoft Team Foundation Server 2010 Object Model - ENU
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{1D1CEEF8-3741-45BD-8E77-963E1DEBDDD3}" = Microsoft Sync Services for ADO.NET v2.0 SP1 (x64)
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{23170F69-40C1-2702-0919-000001000000}" = 7-Zip 9.19 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86416022FF}" = Java(TM) 6 Update 22 (64-bit)
"{2F14965D-567B-4E59-ADEB-0A2CC1E3ADDF}" = Sql Server Customer Experience Improvement Program
"{3156336D-8E44-3671-A6FE-AE51D3D6564E}" = Microsoft Windows SDK for Windows 7 (7.1)
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4A8CE6D7-4D52-43B9-970B-03FC75FAD667}" = Microsoft SQL Server System CLR Types (x64)
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5340A3B5-3853-4745-BED2-DD9FF5371331}" = Microsoft SQL Server 2008 Common Files
"{57A55288-6BA7-47F4-9F6D-9E4086463471}" = ESET Smart Security
"{5E7C1826-EA36-F47A-A345-40D0550F6077}" = ATI Catalyst Install Manager
"{662014D2-0450-37ED-ABAE-157C88127BEB}" = Visual Studio 2010 Prerequisites - English
"{6EBE8BAF-C5CF-632B-1554-075EB5969532}" = ccc-utility64
"{7B4878EF-9823-DF4A-668A-4946B928F85F}" = AMD Drag and Drop Transcoding
"{8040925F-354C-8395-5A8B-3AFB2AE6DDE9}" = ATI AVIVO64 Codecs
"{8125F749-B244-4F7B-811E-532165C5F2D5}" = Microsoft SQL Server 2008 RsFx Driver
"{8438EC02-B8A9-462D-AC72-1B521349C001}" = Microsoft Sync Framework Runtime v1.0 SP1 (x64)
"{84E30D73-E30F-3A02-BAA0-5353C04DD18A}" = Microsoft Windows SDK Intellisense and Reference Assemblies (30514)
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{893F27E6-D6BE-4B9F-80E6-0ADA694A31A8}" = Microsoft SQL Server 2008 Common Files
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{94D70749-4281-39AC-AD90-B56A0E0A402E}" = Microsoft Visual C++ 2010 x64 Runtime - 10.0.30319
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{963BFE7E-C350-4346-B43C-B02358306A45}" = Apple Mobile Device Support
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{B6EFD9A5-2ECE-4C22-BAEC-D16E73EA2013}" = iTunes
"{BD430C50-784F-32CD-87E7-A8C47EE6107F}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"{C0C690C8-F335-4BA4-A2AD-675EAD1DFA90}" = Microsoft SQL Server 2008 Setup Support Files
"{C3AF5BD8-30D5-41F5-AF61-705D98146B0F}" = Microsoft SQL Server 2008 Native Client
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{CC8BA866-16A7-4667-BA0C-C494A1E7B2BF}" = Microsoft SQL Server 2008 Database Engine Shared
"{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
"{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}" = Microsoft SQL Server Compact 3.5 SP2 x64 ENU
"{D5558268-0050-4B95-AD5E-426960E1EFE1}" = Intel(R) Network Connections 15.3.68.0
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{DA67488A-2689-4F10-B90F-D2F6977509D6}" = Microsoft SQL Server 2008 R2 Management Objects (x64)
"{DBFC6AAE-DCCB-4C23-B01C-3EDDDC03298B}" = Debugging Tools for Windows (x64)
"{DF167CE3-60E7-44EA-99EC-2507C51F37AE}" = Microsoft SQL Server 2008 Database Engine Shared
"{E4F5E48E-7155-4CF9-88CD-7F377EC9AC54}" = Bonjour
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FA7394B8-CE65-4F9E-AC99-F372AD365424}" = Microsoft SQL Server 2008 Database Engine Services
"{FBD367D1-642F-47CF-B79B-9BE48FB34007}" = Microsoft SQL Server 2008 Database Engine Services
"{FCADA26A-5672-31DD-BF0E-BA76ECF9B02D}" = Microsoft Help Viewer 1.0
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft SQL Server 10" = Microsoft SQL Server 2008 (64-bit)
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008 (64-bit)
"Microsoft Team Foundation Server 2010 Object Model - ENU" = Microsoft Team Foundation Server 2010 Object Model - ENU
"Microsoft Visual Studio 2010 Tools for Office Runtime (x64)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"PROSetDX" = Intel(R) Network Connections 15.3.68.0
"SDKSetup_7.1.7600.0.30514" = Microsoft Windows SDK for Windows 7 (7.1)
"Ultravnc2_is1" = UltraVNC 1.0.8.2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{08049894-D7DD-8DE6-8A54-DD525D849897}" = CCC Help German
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0DDCEC37-369C-484B-B16D-B4413FD42FB9}" = Microsoft SQL Server 2008 R2 Data-Tier Application Framework
"{0E3DFC64-CC49-4BE2-8C9C-58EF129675DB}" = Microsoft Sync Framework SDK v1.0 SP1
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{112C23F2-C036-4D40-BED4-0CB47BF5555C}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 ENU
"{11F92E7C-9B69-6ACC-F98C-87F3C5A07DB8}" = Catalyst Control Center Graphics Full New
"{14DD7530-CCD2-3798-B37D-3839ED6A441C}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{1803A630-3C38-4D2B-9B9A-0CB37243539C}" = Microsoft ASP.NET MVC 2
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1E61D839-80EF-A34E-18F5-BEC48F596C32}" = HydraVision
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2012098D-EEE9-4769-8DD3-B038050854D4}" = Microsoft Silverlight 3 SDK
"{24BBF5DC-93D2-34FE-A3D3-E2C777E8AF46}" = CCC Help Chinese Standard
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 23
"{27B85A16-14D6-C818-7AB3-156C3AAD344B}" = CCC Help French
"{2A2F3AE8-246A-4252-BB26-1BEB45627074}" = Microsoft SQL Server System CLR Types
"{2E190C8E-682A-409D-9329-539E24C9D1C1}" = Opera 10.63
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMicron JMB36X Driver
"{3A9FC03D-C685-4831-94CF-4EDFD3749497}" = Microsoft SQL Server Compact 3.5 SP2 ENU
"{40416836-56CC-4C0E-A6AF-5C34BADCE483}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BCE392F-1E25-CC80-8404-0950AD18ED90}" = Catalyst Control Center Localization All
"{4E968D9C-21A7-4915-B698-F7AEB913541D}" = Microsoft SQL Server 2008 R2 Management Objects
"{571EA7DD-E326-5A3E-A830-299ED019C45B}" = ccc-core-static
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68405149-C5EE-46D2-D23C-A3EB723760C3}" = Catalyst Control Center Graphics Light
"{6A86554B-8928-30E4-A53C-D7337689134D}" = Microsoft Visual C++ 2010 x86 Runtime - 10.0.30319
"{6B9B0C6F-E5FA-4633-A640-AB98A272ECCA}" = Safari
"{6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3}" = Microsoft Visual Studio Macro Tools
"{6E9EF98E-259E-416D-B5F8-0ABDB99942CE}" = Adobe Flash Player 10 ActiveX
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{729A3000-BC8A-3B74-BA5D-5068FE12D70C}" = Microsoft Visual F# 2.0 Runtime
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78C3657E-742C-40B1-9F53-E5A921D40F17}" = Microsoft SQL Server 2008 R2 Transact-SQL Language Service
"{7DB632A5-7BBE-6D3B-FD5D-21B840344965}" = Catalyst Control Center Graphics Previews Vista
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97C8E553-DE92-6459-93B8-3DB30465AAA4}" = Catalyst Control Center Graphics Full Existing
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AC41D924-8C68-4BD5-A7A1-0AE4176C31A6}" = Crystal Reports for Visual Studio
"{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X
"{ACE28263-76A4-4BF5-B6F4-8BD719595969}" = Microsoft SQL Server Database Publishing Wizard 1.4
"{B0140C6D-C573-F3CF-3915-7822B6C31B3C}" = CCC Help Spanish
"{B3C71458-E28E-DE91-C904-CEA9F16A5CA8}" = Catalyst Control Center Core Implementation
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{B83E0BDD-8873-A5C1-99FA-D5232DA196CA}" = Catalyst Control Center HydraVision Full
"{B9A94D4F-DA93-BD8F-3B40-8E79214800DA}" = Catalyst Control Center InstallProxy
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C688457E-03FD-4941-923B-A27F4D42A7DD}" = Microsoft SQL Server 2008 Browser
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D6B15AE6-B052-363E-B6BB-C4714CBA6509}" = Microsoft Visual Studio 2010 Professional - ENU
"{D793423B-FF18-4A54-B9C9-75B3396BAAC4}" = Browser Configuration Utility
"{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E5AE9031-79A5-4627-9641-BEFA82819B08}" = Microsoft SQL Server 2008 R2 Data-Tier Application Project
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{f508ae38-2d20-413e-a55c-58c86661f045}" = Check Point Endpoint Security
"{FBB02B04-C034-4382-A3F6-57416E2752C4}" = Adobe Creative Suite 5 Master Collection
"{FD6559C0-38A3-2BD3-A475-CA800609D530}" = CCC Help English
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AnyDVD" = AnyDVD
"AviSynth" = AviSynth 2.5
"BeyondCompare3_is1" = Beyond Compare Version 3.1.11
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"FastStone Image Viewer" = FastStone Image Viewer 4.2
"FileZilla Client" = FileZilla Client 3.3.5.1
"InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver
"InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"Juniper Network Connect 6.5.0" = Juniper Networks Network Connect 6.5.0
"Juniper_Setup_Client Activex Control" = Juniper Networks Setup Client Activex Control
"MagniDriver" = marvell 91xx driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MediaMonkey_is1" = MediaMonkey 3.2
"Microsoft Visual Studio 2010 Professional - ENU" = Microsoft Visual Studio 2010 Professional - ENU
"Microsoft Visual Studio Macro Tools" = Microsoft Visual Studio Macro Tools
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"Mozilla Thunderbird (3.1.7)" = Mozilla Thunderbird (3.1.7)
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"PerformanceTest 7_is1" = PerformanceTest v7.0
"phpDesigner7_is1" = phpDesigner 7 version 7.2.2
"PremiumSoft Navicat Premium_is1" = PremiumSoft Navicat Premium 9.0
"Registry Mechanic_is1" = Registry Mechanic 9.0
"VLC media player" = VLC media player 1.1.5
"Winamp" = Winamp
"WinLiveSuite" = Windows Live Essentials

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/21/2010 3:49:07 AM | Computer Name = **** | Source = Application Error | ID = 1000
Description = Faulting application name: regsvr32.exe, version: 6.1.7600.16385,
time stamp: 0x4a5bca28 Faulting module name: kernel32.dll, version: 6.1.7600.16385,
time stamp: 0x4a5bdbde Exception code: 0xc0000005 Fault offset: 0x0001c802 Faulting
process id: 0xa38 Faulting application start time: 0x01cba0e38b100177 Faulting application
path: C:\Windows\SysWOW64\regsvr32.exe Faulting module path: C:\Windows\syswow64\kernel32.dll
Report
Id: c9c73217-0cd6-11e0-84b5-54a472c03f13

Error - 12/21/2010 11:24:00 AM | Computer Name = **** | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 12/21/2010 11:24:00 AM | Computer Name = **** | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 999

Error - 12/21/2010 11:24:00 AM | Computer Name = **** | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 999

Error - 12/21/2010 2:51:17 PM | Computer Name = **** | Source = Apache Service | ID = 3299
Description = The Apache service named reported the following error: >>> Warning:
DocumentRoot [C:/Program Files/Apache Software Foundation/Apache2.2/docs/dummy-host.localhost]
does not exist .

Error - 12/21/2010 2:51:17 PM | Computer Name = **** | Source = Apache Service | ID = 3299
Description = The Apache service named reported the following error: >>> Warning:
DocumentRoot [C:/Program Files/Apache Software Foundation/Apache2.2/docs/dummy-host2.localhost]
does not exist .

Error - 12/21/2010 3:59:34 PM | Computer Name = **** | Source = Apache Service | ID = 3299
Description = The Apache service named reported the following error: >>> Warning:
DocumentRoot [C:/Program Files/Apache Software Foundation/Apache2.2/docs/dummy-host.localhost]
does not exist .

Error - 12/21/2010 3:59:34 PM | Computer Name = **** | Source = Apache Service | ID = 3299
Description = The Apache service named reported the following error: >>> Warning:
DocumentRoot [C:/Program Files/Apache Software Foundation/Apache2.2/docs/dummy-host2.localhost]
does not exist .

Error - 12/21/2010 4:04:57 PM | Computer Name = **** | Source = Apache Service | ID = 3299
Description = The Apache service named reported the following error: >>> Warning:
DocumentRoot [C:/Program Files/Apache Software Foundation/Apache2.2/docs/dummy-host.localhost]
does not exist .

Error - 12/21/2010 4:04:57 PM | Computer Name = **** | Source = Apache Service | ID = 3299
Description = The Apache service named reported the following error: >>> Warning:
DocumentRoot [C:/Program Files/Apache Software Foundation/Apache2.2/docs/dummy-host2.localhost]
does not exist .

[ System Events ]
Error - 12/21/2010 8:13:24 PM | Computer Name = **** | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did
not allow the name to be claimed by this computer.

Error - 12/21/2010 8:18:34 PM | Computer Name = **** | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did
not allow the name to be claimed by this computer.

Error - 12/21/2010 8:23:44 PM | Computer Name = **** | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did
not allow the name to be claimed by this computer.

Error - 12/21/2010 8:28:54 PM | Computer Name = **** | Source = BROWSER | ID = 8009
Description =

Error - 12/21/2010 8:28:54 PM | Computer Name = **** | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did
not allow the name to be claimed by this computer.

Error - 12/21/2010 8:34:04 PM | Computer Name = **** | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did
not allow the name to be claimed by this computer.

Error - 12/21/2010 8:39:14 PM | Computer Name = **** | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did
not allow the name to be claimed by this computer.

Error - 12/21/2010 8:44:24 PM | Computer Name = **** | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did
not allow the name to be claimed by this computer.

Error - 12/21/2010 8:49:34 PM | Computer Name = **** | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did
not allow the name to be claimed by this computer.

Error - 12/21/2010 8:54:44 PM | Computer Name = **** | Source = NetBT | ID = 4321
Description = The name "WORKGROUP :1d" could not be registered on the interface
with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did
not allow the name to be claimed by this computer.


< End of report >

 

Many, many thanks, broni.

SystemLook:

SystemLook 04.09.10 by jpshortstuff
Log created at 10:44 on 22/12/2010 by ****
Administrator - Elevation successful

========== filefind ==========

Searching for "csrss.exe "
C:\Windows\System32\csrss.exe --a---- 7680 bytes [23:19 13/07/2009] [01:39 14/07/2009] 60C2862B4BF0FD9F582EF344C2B1EC72
C:\Windows\winsxs\amd64_microsoft-windows-csrss_31bf3856ad364e35_6.1.7600.16385_none_b4d8d57efdc6b4f3\csrss.exe --a---- 7680 bytes [23:19 13/07/2009] [01:39 14/07/2009] 60C2862B4BF0FD9F582EF344C2B1EC72

-= EOF =-

JavaRa:

JavaRa 1.16 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Wed Dec 22 10:50:25 2010

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0008-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0009-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}

------------------------------------

Finished reporting.

Registry Mechanic:

I appreciate the reasons not to use this. I actually only installed it after deleting/recreating my user profile (per instructions from the Windows 7 forum). I backed up my profile directory, deleted, recreated, and one-by-one copied over files I needed for essential application settings. I then ran Registry Mechanic just out of curiosity to see if there were massive amounts of dead links. Anyway, I have no real need for it, so I uninstalled it as suggested. The BSOD problem was occurring for weeks before the install.

OTL:

All processes killed
========== OTL ==========
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
ADS C:\ProgramData\Temp1B5B4F1 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: ****
->Temp folder emptied: 0 bytes

User: ****.****
->Temp folder emptied: 1496011 bytes
->Temporary Internet Files folder emptied: 65670 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 74753855 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Opera cache emptied: 240 bytes
->Flash cache emptied: 456 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2098 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 73.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: ****

User: ****.****
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.18.0 log created on 12222010_105254

Files\Folders moved on Reboot...
C:\Users\****.****\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

VEW:

Vino's Event Viewer v01c run on Windows 2008 in English
Report run at 22/12/2010 10:57:18 AM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 06/12/2010 3:53:39 PM
Type: Critical Category: 0
Event: 2 Source: Microsoft-Windows-ApplicationExperienceInfrastructure
The application (Check Point, from vendor Check Point Software Technologies) was hard-blocked and raised the following: Check Point is incompatible with this version of Windows. For more information, contact Check Point Software Technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 22/12/2010 3:21:06 PM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledSPRetry 998

Log: 'Application' Date/Time: 22/12/2010 3:21:06 PM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledEvent 998

Log: 'Application' Date/Time: 22/12/2010 3:21:06 PM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: Continuously busy for more than a second

Log: 'Application' Date/Time: 21/12/2010 8:04:57 PM
Type: Error Category: 0
Event: 3299 Source: Apache Service
The Apache service named reported the following error: >>> Warning: DocumentRoot [C:/Program Files/Apache Software Foundation/Apache2.2/docs/dummy-host2.localhost] does not exist .

Log: 'Application' Date/Time: 21/12/2010 8:04:57 PM
Type: Error Category: 0
Event: 3299 Source: Apache Service
The Apache service named reported the following error: >>> Warning: DocumentRoot [C:/Program Files/Apache Software Foundation/Apache2.2/docs/dummy-host.localhost] does not exist .

Log: 'Application' Date/Time: 21/12/2010 7:59:34 PM
Type: Error Category: 0
Event: 3299 Source: Apache Service
The Apache service named reported the following error: >>> Warning: DocumentRoot [C:/Program Files/Apache Software Foundation/Apache2.2/docs/dummy-host2.localhost] does not exist .

Log: 'Application' Date/Time: 21/12/2010 7:59:34 PM
Type: Error Category: 0
Event: 3299 Source: Apache Service
The Apache service named reported the following error: >>> Warning: DocumentRoot [C:/Program Files/Apache Software Foundation/Apache2.2/docs/dummy-host.localhost] does not exist .

Log: 'Application' Date/Time: 21/12/2010 6:51:17 PM
Type: Error Category: 0
Event: 3299 Source: Apache Service
The Apache service named reported the following error: >>> Warning: DocumentRoot [C:/Program Files/Apache Software Foundation/Apache2.2/docs/dummy-host2.localhost] does not exist .

Log: 'Application' Date/Time: 21/12/2010 6:51:17 PM
Type: Error Category: 0
Event: 3299 Source: Apache Service
The Apache service named reported the following error: >>> Warning: DocumentRoot [C:/Program Files/Apache Software Foundation/Apache2.2/docs/dummy-host.localhost] does not exist .

Log: 'Application' Date/Time: 21/12/2010 3:24:00 PM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledSPRetry 999

Log: 'Application' Date/Time: 21/12/2010 3:24:00 PM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledEvent 999

Log: 'Application' Date/Time: 21/12/2010 3:24:00 PM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: Continuously busy for more than a second

Log: 'Application' Date/Time: 21/12/2010 7:49:07 AM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application name: regsvr32.exe, version: 6.1.7600.16385, time stamp: 0x4a5bca28 Faulting module name: kernel32.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdbde Exception code: 0xc0000005 Fault offset: 0x0001c802 Faulting process id: 0xa38 Faulting application start time: 0x01cba0e38b100177 Faulting application path: C:\Windows\SysWOW64\regsvr32.exe Faulting module path: C:\Windows\syswow64\kernel32.dll Report Id: c9c73217-0cd6-11e0-84b5-54a472c03f13

Log: 'Application' Date/Time: 21/12/2010 4:14:46 AM
Type: Error Category: 0
Event: 3299 Source: Apache Service
The Apache service named reported the following error: >>> Warning: DocumentRoot [C:/Program Files/Apache Software Foundation/Apache2.2/docs/dummy-host2.localhost] does not exist .

Log: 'Application' Date/Time: 21/12/2010 4:14:46 AM
Type: Error Category: 0
Event: 3299 Source: Apache Service
The Apache service named reported the following error: >>> Warning: DocumentRoot [C:/Program Files/Apache Software Foundation/Apache2.2/docs/dummy-host.localhost] does not exist .

Log: 'Application' Date/Time: 21/12/2010 3:56:58 AM
Type: Error Category: 101
Event: 1002 Source: Application Hang
The program MeGUI.exe version 0.3.5.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: 13f8 Start Time: 01cba0c285a9d5b6 Termination Time: 2 Application Path: C:\Program Files (x86)\MeGUI\MeGUI.exe Report Id: 5a2b6fe0-0cb6-11e0-83bc-54a472c03f13

Log: 'Application' Date/Time: 21/12/2010 3:04:13 AM
Type: Error Category: 0
Event: 3299 Source: Apache Service
The Apache service named reported the following error: >>> Warning: DocumentRoot [C:/Program Files/Apache Software Foundation/Apache2.2/docs/dummy-host2.localhost] does not exist .

Log: 'Application' Date/Time: 21/12/2010 3:04:13 AM
Type: Error Category: 0
Event: 3299 Source: Apache Service
The Apache service named reported the following error: >>> Warning: DocumentRoot [C:/Program Files/Apache Software Foundation/Apache2.2/docs/dummy-host.localhost] does not exist .

Log: 'Application' Date/Time: 21/12/2010 2:18:37 AM
Type: Error Category: 0
Event: 3299 Source: Apache Service
The Apache service named reported the following error: >>> Warning: DocumentRoot [C:/Program Files/Apache Software Foundation/Apache2.2/docs/dummy-host2.localhost] does not exist .

Log: 'Application' Date/Time: 21/12/2010 2:18:37 AM
Type: Error Category: 0
Event: 3299 Source: Apache Service
The Apache service named reported the following error: >>> Warning: DocumentRoot [C:/Program Files/Apache Software Foundation/Apache2.2/docs/dummy-host.localhost] does not exist .

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 21/12/2010 9:45:46 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Log: 'System' Date/Time: 21/12/2010 8:04:40 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Log: 'System' Date/Time: 21/12/2010 7:59:17 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Log: 'System' Date/Time: 21/12/2010 1:42:06 AM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Log: 'System' Date/Time: 21/12/2010 1:38:08 AM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Log: 'System' Date/Time: 20/12/2010 7:25:22 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Log: 'System' Date/Time: 20/12/2010 2:54:19 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Log: 'System' Date/Time: 17/12/2010 4:24:54 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Log: 'System' Date/Time: 06/12/2010 3:24:01 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Log: 'System' Date/Time: 06/12/2010 3:22:04 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Log: 'System' Date/Time: 06/12/2010 3:16:22 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Log: 'System' Date/Time: 06/12/2010 3:14:31 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Log: 'System' Date/Time: 04/12/2010 5:35:51 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Log: 'System' Date/Time: 30/11/2010 2:58:48 AM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Log: 'System' Date/Time: 17/11/2010 7:04:43 PM
Type: Critical Category: 63
Event: 41 Source: Microsoft-Windows-Kernel-Power
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 22/12/2010 3:54:24 PM
Type: Error Category: 0
Event: 4321 Source: NetBT
The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did not allow the name to be claimed by this computer.

Log: 'System' Date/Time: 22/12/2010 3:52:54 PM
Type: Error Category: 0
Event: 7031 Source: Service Control Manager
The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Log: 'System' Date/Time: 22/12/2010 3:52:38 PM
Type: Error Category: 0
Event: 4321 Source: NetBT
The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did not allow the name to be claimed by this computer.

Log: 'System' Date/Time: 22/12/2010 3:47:28 PM
Type: Error Category: 0
Event: 4321 Source: NetBT
The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did not allow the name to be claimed by this computer.

Log: 'System' Date/Time: 22/12/2010 3:42:18 PM
Type: Error Category: 0
Event: 4321 Source: NetBT
The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did not allow the name to be claimed by this computer.

Log: 'System' Date/Time: 22/12/2010 3:37:08 PM
Type: Error Category: 0
Event: 4321 Source: NetBT
The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did not allow the name to be claimed by this computer.

Log: 'System' Date/Time: 22/12/2010 3:20:48 PM
Type: Error Category: 0
Event: 4321 Source: NetBT
The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did not allow the name to be claimed by this computer.

Log: 'System' Date/Time: 22/12/2010 3:15:38 PM
Type: Error Category: 0
Event: 4321 Source: NetBT
The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did not allow the name to be claimed by this computer.

Log: 'System' Date/Time: 22/12/2010 3:10:28 PM
Type: Error Category: 0
Event: 4321 Source: NetBT
The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did not allow the name to be claimed by this computer.

Log: 'System' Date/Time: 22/12/2010 3:10:28 PM
Type: Error Category: 0
Event: 8020 Source: BROWSER
The browser was unable to promote itself to master browser. The computer that currently believes it is the master browser is unknown.

Log: 'System' Date/Time: 22/12/2010 3:05:18 PM
Type: Error Category: 0
Event: 4321 Source: NetBT
The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did not allow the name to be claimed by this computer.

Log: 'System' Date/Time: 22/12/2010 3:00:08 PM
Type: Error Category: 0
Event: 4321 Source: NetBT
The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did not allow the name to be claimed by this computer.

Log: 'System' Date/Time: 22/12/2010 2:54:58 PM
Type: Error Category: 0
Event: 4321 Source: NetBT
The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did not allow the name to be claimed by this computer.

Log: 'System' Date/Time: 22/12/2010 2:49:48 PM
Type: Error Category: 0
Event: 4321 Source: NetBT
The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did not allow the name to be claimed by this computer.

Log: 'System' Date/Time: 22/12/2010 3:21:59 AM
Type: Error Category: 0
Event: 4321 Source: NetBT
The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did not allow the name to be claimed by this computer.

Log: 'System' Date/Time: 22/12/2010 3:16:49 AM
Type: Error Category: 0
Event: 4321 Source: NetBT
The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did not allow the name to be claimed by this computer.

Log: 'System' Date/Time: 22/12/2010 3:11:39 AM
Type: Error Category: 0
Event: 4321 Source: NetBT
The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did not allow the name to be claimed by this computer.

Log: 'System' Date/Time: 22/12/2010 3:06:29 AM
Type: Error Category: 0
Event: 4321 Source: NetBT
The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did not allow the name to be claimed by this computer.

Log: 'System' Date/Time: 22/12/2010 3:01:19 AM
Type: Error Category: 0
Event: 4321 Source: NetBT
The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.x.x. The computer with the IP address 192.168.x.x did not allow the name to be claimed by this computer.

Log: 'System' Date/Time: 22/12/2010 3:01:19 AM
Type: Error Category: 0
Event: 8020 Source: BROWSER
The browser was unable to promote itself to master browser. The computer that currently believes it is the master browser is unknown.



Looking at that last log, I'm going to uninstall CheckPoint. It's a VPN client that is supposed to be Win7x64 compatable, but it doesn't really matter since the server I would connect to hasn't installed the Windows 7 patch to allow me to connect anyway, so it's useless to me now.

I'm also going to uninstall the wampserver that's throwing those dummy-host.localhost errors, not because of the errors themselves, but that I decided to run my wampserver off a different machine, and I don't need this local one anymore.

 

Thanks!

On the critical events, 3 of those are from me trying to run MBRCheck and locking up the system, but the rest are still of concern. I read the info at that link and confirmed that I am not using Intel C-State, which really only leaves RAM.

Security Check:

Results of screen317's Security Check version 0.99.7
Windows 7 (UAC is disabled!)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Disabled!
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Java(TM) 6 Update 23
Out of date Java installed!
Adobe Flash Player 10.1.102.64
Adobe Reader X
Mozilla Firefox (3.6.13)
Mozilla Thunderbird (3.1.7)
````````````````````````````````
Process Check:
objlist.exe by Laurent
``````````End of Log````````````

TFC:

Ran without incident. Don't see a log.

ESET:

Running the scan now, but I have a licensed and updated ESET Smart Security and ran a full scan last night, so it's unlikely we'll see anything here. I'll post the results when it's done just in case.

 

0 infected files from ESET

Standard drive diagnostic tools probably won't work since I'm using an OCZ Revodrive (SSD).

 

broni,

My apologies for not getting back to you. I have been distracted celebrating the holidays with friends and family. Thank you deeply for all of your help. I don't know if we've actually solved anything, but I feel good about the numerous potential problems we have eliminated through this process.

To give you an update of my status:

1) Ran OTL, but didn't clear the restore points. I understand the risk this poses, but I'd rather be aware of what could happen if I restore prior to this process than eliminate the option. If nothing strange happens with my machine for a while, I'll revisit this.
2) Ran it.
3) Done
4) I change passwords frequently anyway, so no worries here.
5) Decided not to do this after reading about the product. Browsed the forums and could see that sites were being rated poorly due to personal disagreements between forum members or political persuasion or whatever issue unrelated to security. I'm sure it's a well-intentioned product but not for me.
6) Good idea. Scheduled a weekly task. Takes 1 min, 35 secs.
7) Sure. Scheduled a reminder. Don't want to automate that.
8) Awesome software. Wish I knew about this earlier. Found a potential threat in my Flash Player version (shocking! ) I updated the version and a few minutes later saw a balloon in my tray telling me a zombie file had been removed. Is that the old version? The balloon went away and there's no log or anything I can find to look into this further.
9) I'll pass on this for now.
10) Not relevant. SSD drive.
11) Read it. Good tips for the novice user.
12) Since you asked, when I woke my machine up from a good "sleep ", all of my open apps had crashed and my Event Viewer was filled with this:

The device, \Device\Harddisk0\DR0, is not ready for access yet.

No BSOD, and I restarted explorer.exe, and everything was fine (rebooted anyway). I fear my drive could be the source of my headaches?

Again, many, many thanks for the help. I am very impressed with this forum and will recommend it to others.