Solved DDS.txt (log1)

Allright it took me almost an hour. A wonder that my computer even went on and worked when it had so many infections. Im not sure is this the right log and it is on finnish but i guess you'll manage with google translator.


ComboFix 10-10-11.05 - Sebastian 12.10.2010 20:11:17.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.358.1033.18.2525.1092 [GMT 3:00]
Sijainti: c:\users\Sebastian\Downloads\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Edellinen ajo -------
.
c:\programdata\SysWoW32
c:\programdata\SysWoW32\mu2119484299v4
c:\programdata\SysWoW32\mu2119484299v4.kwd
c:\programdata\SysWoW32\mu2119484299v5
c:\programdata\SysWoW32\mu2119484299v5.kwd
c:\programdata\SysWoW32\mu2119484299v6
c:\programdata\SysWoW32\mu2119484299v6.kwd
c:\programdata\SysWoW32\mu2119484299v7
c:\programdata\SysWoW32\mu2119484299v7.kwd
c:\programdata\SysWoW32\wu2119484299v0
c:\programdata\SysWoW32\wu2119484299v0.kwd
c:\programdata\SysWoW32\wu2119484299v1
c:\programdata\SysWoW32\wu2119484299v1.kwd
c:\programdata\SysWoW32\wu2119484299v2
c:\programdata\SysWoW32\wu2119484299v2.kwd
c:\programdata\SysWoW32\wu2119484299v3
c:\programdata\SysWoW32\wu2119484299v3.kwd
c:\programdata\unrar.exe
C:\sysmon
c:\users\Sebastian\AppData\Roaming\02000000f6cb615c784C.manifest
c:\users\Sebastian\AppData\Roaming\02000000f6cb615c784O.manifest
c:\users\Sebastian\AppData\Roaming\02000000f6cb615c784P.manifest
c:\users\Sebastian\AppData\Roaming\02000000f6cb615c784S.manifest
c:\users\Sebastian\AppData\Roaming\02000000f6cb615c879C.manifest
c:\users\Sebastian\AppData\Roaming\02000000f6cb615c879O.manifest
c:\users\Sebastian\AppData\Roaming\02000000f6cb615c879P.manifest
c:\users\Sebastian\AppData\Roaming\02000000f6cb615c879S.manifest
c:\windows\Downloaded Program Files\f3initialsetup1.0.1.1.inf

.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2010-09-12 to 2010-10-12 )))))))))))))))))
.

2010-10-12 17:32 . 2010-10-12 17:33 -------- d-----w- c:\users\Sebastian\AppData\Local\temp
2010-10-12 17:32 . 2010-10-12 17:32 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-12 16:01 . 2010-10-12 16:01 -------- d-----w- c:\programdata\FLEXnet
2010-10-11 14:41 . 2010-10-11 14:42 -------- d-----w- c:\windows\A8B9466986544126BD28D0D2412CDED6.TMP
2010-10-11 14:21 . 2010-10-11 14:23 -------- d-----w- c:\programdata\{951CCC02-4CE8-48BD-87DA-C99DB6D9B36E}
2010-10-11 14:21 . 2010-10-11 14:21 -------- d-----w- c:\users\Sebastian\AppData\Local\PackageAware
2010-10-10 17:18 . 2010-10-10 17:18 -------- d-----w- c:\users\Sebastian\AppData\Roaming\Malwarebytes
2010-10-10 17:09 . 2010-04-29 12:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-10 17:09 . 2010-10-10 17:09 -------- d-----w- c:\programdata\Malwarebytes
2010-10-10 17:09 . 2010-04-29 12:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-10 16:46 . 2010-10-11 14:06 -------- d-----w- c:\programdata\PCPitstop
2010-10-08 14:42 . 2010-09-09 22:52 6084944 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EC7ED81E-9CE9-475F-8291-267833B676D8}\mpengine.dll
2010-10-08 03:41 . 2010-10-08 03:41 -------- d-----w- c:\users\Sebastian\AppData\Roaming\Registry Mechanic
2010-10-06 15:14 . 2010-10-06 15:14 -------- d-----w- c:\program files\QuickTime
2010-09-29 14:49 . 2010-09-29 14:49 -------- d-----w- c:\program files\Babylon
2010-09-28 19:05 . 2010-09-30 05:05 -------- d-----w- c:\users\Sebastian\AppData\Local\PMB Files
2010-09-28 19:05 . 2010-09-28 19:07 -------- d-----w- c:\programdata\PMB Files
2010-09-28 19:05 . 2010-09-28 19:05 -------- d-----w- c:\program files\Pando Networks
2010-09-28 18:30 . 2010-09-28 18:32 -------- d-----w- c:\program files\DAEMON Tools Pro
2010-09-28 17:26 . 2010-09-28 17:26 -------- d-----w- c:\users\Sebastian\AppData\Roaming\Sakura
2010-09-28 17:21 . 2010-10-11 14:05 -------- d-----w- c:\users\Sebastian\AppData\Roaming\Juce VST Host
2010-09-27 18:00 . 2010-09-27 18:00 -------- d-----w- c:\program files\Common Files\TI Shared
2010-09-27 18:00 . 2010-09-27 18:02 -------- d-----w- c:\program files\TI Education
2010-09-27 15:57 . 2010-09-27 15:57 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-09-23 11:42 . 2010-09-23 11:42 95672 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2010-09-22 17:23 . 2010-04-14 18:22 40960 ----a-w- c:\windows\system32\allenocx.ocx
2010-09-22 17:23 . 2007-10-23 16:48 237659 ----a-w- c:\windows\system32\EZTW32.DLL
2010-09-22 17:23 . 2007-01-17 19:06 45056 ----a-w- c:\windows\system32\CF.ocx
2010-09-22 17:23 . 2005-10-09 00:04 40960 ----a-w- c:\windows\system32\hyperlink.ocx
2010-09-22 17:23 . 2004-07-28 19:49 49152 ----a-w- c:\windows\system32\PWAD.ocx
2010-09-22 17:23 . 2001-09-24 18:56 24576 ----a-w- c:\windows\system32\dirdlg2.ocx
2010-09-22 17:23 . 2000-07-05 15:22 24576 ----a-w- c:\windows\system32\runocx.ocx
2010-09-22 17:23 . 2010-09-22 17:23 -------- d-----w- c:\program files\NoteBook
2010-09-18 20:00 . 2010-09-18 20:00 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-09-18 19:50 . 2010-09-18 19:50 -------- d-----w- c:\windows\SQL9_KB970892_ENU
2010-09-17 14:58 . 2010-09-17 14:58 -------- d-----w- c:\users\Sebastian\AppData\Local\ESET
2010-09-17 14:56 . 2010-09-17 14:56 -------- d-----w- c:\program files\ESET
2010-09-16 18:00 . 2010-09-16 18:00 -------- d-----w- c:\program files\EA GAMES
2010-09-15 18:31 . 2010-09-15 18:35 -------- d-----w- c:\users\Sebastian\AppData\Roaming\Mount&Blade
2010-09-14 13:31 . 2004-02-04 07:27 49536 ----a-w- c:\windows\system32\drivers\tiehdusb.sys
2010-09-14 13:29 . 2004-01-28 12:03 21456 ----a-w- c:\windows\system32\drivers\SilvrLnk.sys

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

------- Sigcheck -------

[-] 2010-08-29 . 5B8AB8E9F38BC52ECD183B099093C2BD . 247296 . . [6.0.6000.16386] . . c:\windows\System32\shsvcs.dll
[7] 2008-01-21 . 27F10F348E508243F6254846F8370D0D . 247296 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6001.18000_none_cd305d2a1ced96e2\shsvcs.dll
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{6dabbda0-1da5-4a2f-bc89-2ae084c572fa} "= "c:\program files\ToggleSW\tbTogg.dll" [2009-12-31 2349080]

[HKEY_CLASSES_ROOT\clsid\{6dabbda0-1da5-4a2f-bc89-2ae084c572fa}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6dabbda0-1da5-4a2f-bc89-2ae084c572fa}]
2009-12-31 08:53 2349080 ----a-w- c:\program files\ToggleSW\tbTogg.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6dabbda0-1da5-4a2f-bc89-2ae084c572fa} "= "c:\program files\ToggleSW\tbTogg.dll" [2009-12-31 2349080]

[HKEY_CLASSES_ROOT\clsid\{6dabbda0-1da5-4a2f-bc89-2ae084c572fa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{6DABBDA0-1DA5-4A2F-BC89-2AE084C572FA} "= "c:\program files\ToggleSW\tbTogg.dll" [2009-12-31 2349080]

[HKEY_CLASSES_ROOT\clsid\{6dabbda0-1da5-4a2f-bc89-2ae084c572fa}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shell iconoverlayidentifiers\egisPSDP]
@= "{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} "
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-03-04 21:38 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wisdom-soft AutoScreenRecorder 3.1 Pro "= "0" [X]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-22 39408]
"Google Update "= "c:\users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-01-26 135664]
"WMPNSCFG "= "c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"DAEMON Tools Pro Agent "= "c:\program files\DAEMON Tools Pro\DTAgent.exe" [2010-04-15 427328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender "= "c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"BkupTray "= "c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-07 34040]
"SynTPEnh "= "c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-02-22 1037608]
"StartCCC "= "c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"RtHDVCpl "= "RtHDVCpl.exe" [2008-05-21 6144000]
"PLFSetI "= "c:\windows\PLFSetI.exe" [2007-10-23 200704]
"LManager "= "c:\progra~1\LAUNCH~1\LManager.exe" [2008-05-08 864576]
"eDataSecurity Loader "= "c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-03-04 526896]
"ePower_DMC "= "c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-04-30 397312]
"eRecoveryService "=" " [BU]
"WarReg_PopUp "= "c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104]
"Google Quick Search Box "= "c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-06-25 68592]
"AppleSyncNotifier "= "c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-04-12 47392]
"FBSSA "= "c:\program files\SGPSA\ie3sh.exe" [BU]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-09-24 40368]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-05-27 202256]
"WPCUMI "= "c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"egui "= "c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-08-12 2215064]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-5-22 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\syste m]
"EnableUIADesktopToggle "= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux3 "=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf010 00.sys]
@= "Driver "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDef end]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring "=dword:00000001

R2 gupdate;Google-päivityspalvelu (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-07 135664]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\McSACore.exe [2010-05-20 88176]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-04 131072]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-01-06 3478288]
R3 TpChoice;Touch Pad Detection Filter driver;c:\windows\system32\DRIVERS\TpChoice.sys [2007-12-26 17968]
R3 ZCinema_TSHD;ZCinema TruSurround HD driver;c:\windows\system32\drivers\ZCinema_SRS_i386.sys [2007-08-22 18448]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-09-28 697328]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-07-29 115008]
S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-07-29 136632]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-08-12 810144]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-07-29 96920]
S2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [2008-03-21 24576]
S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-07 50424]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-17 11032]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2008-03-28 210432]
S3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2008-04-15 51160]
S3 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sd.sys [2008-04-08 43736]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2008-03-19 22072]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
getPlusHelper REG_MULTI_SZ getPlusHelper
.
'Ajoitetut tehtävät'-kansion sisältö

2010-10-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-07 11:42]

2010-10-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-07 11:42]

2010-10-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4164418827-1815202133-2812620103-1003Core.job
- c:\users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-26 17:32]

2010-10-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4164418827-1815202133-2812620103-1003UA.job
- c:\users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-26 17:32]

2010-10-10 c:\windows\Tasks\Norton Security Scan for Sebastian.job
- c:\program files\Norton Security Scan\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-05-07 02:58]

2010-10-12 c:\windows\Tasks\User_Feed_Synchronization-{9B641645-B111-46D6-A57F-38AB22586DDE}.job
- c:\windows\system32\msfeedssync.exe [2009-08-10 20:13]
.
.
------- Täydentävä tarkistus -------
.
uStart Page = hxxp://search.babylon.com/home?AF=14542
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxps://www.battlefieldheroes.com/static/updater/BFHUpdater_4.0.21.0.cab
DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} - hxxps://plugins.valueactive.eu/flashax/iefax.cab
FF - ProfilePath - c:\users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\f42161rq.defaul t\
FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=14542
FF - prefs.js: browser.search.selectedEngine - Turvalliset hakutoiminnot
FF - prefs.js: browser.startup.homepage - www.google.fi
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=adbartrp&AF=14542&q=
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - component: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\n prpffbrowserrecordext.dll
FF - component: c:\users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\f42161rq.defaul t\extensions\{ce18769b-c7fa-42d2-860d-17c4662c70ad}\components\FFExternalAlert.dll
FF - component: c:\users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\f42161rq.defaul t\extensions\{ce18769b-c7fa-42d2-860d-17c4662c70ad}\components\RadioWMPCore.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - POISTETUT JÄMÄRIVIT - - - -

WebBrowser-{5B291E6C-9A74-4034-971B-A4B007A0B315} - (no file)



[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\npggsvc]
"ImagePath "= "c:\windows\system32\GameMon.des -service "
.
--------------------- LUKITUT REKISTERIAVAIMET ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
--------------------- Prosesseihin ladatut DLLt ---------------------

- - - - - - - > 'Explorer.exe'(3376)
c:\progra~1\mcafee\SITEAD~1\saHook.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
c:\windows\System32\SysHook.dll
.
Valmistumisajankohta: 2010-10-12 20:55:01
ComboFix-quarantined-files.txt 2010-10-12 17:54

Ennen ajoa: 62*744*825*856 bytes free
Ajon jälkeen: 64*429*334*528 bytes free

- - End Of File - - 5F92FACB82DA548D0E476E03805BFCE4

 

Allright heres the new one, bit what was wrong with the old?


ComboFix 10-10-12.03 - Sebastian 13.10.2010 16:48:31.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.358.1033.18.2525.1068 [GMT 3:00]
Sijainti: c:\users\Sebastian\Desktop\ComboFix.exe
Käytetyt komentorivivalitsimet :: c:\users\Sebastian\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\users\Sebastian\AppData\Roaming\Registry Mechanic "
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

.
--------------- FCopy ---------------

c:\windows\winsxs\x86_microsoft-windows-shsvcs_31bf3856ad364e35_6.0.6001.18000_none_cd305d2a1ced96e2\shsvcs.dll --> c:\windows\System32\shsvcs.dll
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2010-09-13 to 2010-10-13 )))))))))))))))))
.

2010-10-13 14:05 . 2010-10-13 14:05 -------- d-----w- c:\users\Sebastian\AppData\Local\temp
2010-10-13 14:05 . 2010-10-13 14:05 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-12 16:01 . 2010-10-12 16:01 -------- d-----w- c:\programdata\FLEXnet
2010-10-11 14:41 . 2010-10-11 14:42 -------- d-----w- c:\windows\A8B9466986544126BD28D0D2412CDED6.TMP
2010-10-11 14:21 . 2010-10-11 14:23 -------- d-----w- c:\programdata\{951CCC02-4CE8-48BD-87DA-C99DB6D9B36E}
2010-10-11 14:21 . 2010-10-11 14:21 -------- d-----w- c:\users\Sebastian\AppData\Local\PackageAware
2010-10-10 17:18 . 2010-10-10 17:18 -------- d-----w- c:\users\Sebastian\AppData\Roaming\Malwarebytes
2010-10-10 17:09 . 2010-04-29 12:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-10 17:09 . 2010-10-10 17:09 -------- d-----w- c:\programdata\Malwarebytes
2010-10-10 17:09 . 2010-04-29 12:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-10 16:46 . 2010-10-11 14:06 -------- d-----w- c:\programdata\PCPitstop
2010-10-08 14:42 . 2010-09-09 22:52 6084944 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EC7ED81E-9CE9-475F-8291-267833B676D8}\mpengine.dll
2010-10-08 03:41 . 2010-10-08 03:41 -------- d-----w- c:\users\Sebastian\AppData\Roaming\Registry Mechanic
2010-10-06 15:14 . 2010-10-06 15:14 -------- d-----w- c:\program files\QuickTime
2010-09-29 14:49 . 2010-09-29 14:49 -------- d-----w- c:\program files\Babylon
2010-09-28 19:05 . 2010-09-30 05:05 -------- d-----w- c:\users\Sebastian\AppData\Local\PMB Files
2010-09-28 19:05 . 2010-09-28 19:07 -------- d-----w- c:\programdata\PMB Files
2010-09-28 19:05 . 2010-09-28 19:05 -------- d-----w- c:\program files\Pando Networks
2010-09-28 18:30 . 2010-09-28 18:32 -------- d-----w- c:\program files\DAEMON Tools Pro
2010-09-28 17:26 . 2010-09-28 17:26 -------- d-----w- c:\users\Sebastian\AppData\Roaming\Sakura
2010-09-28 17:21 . 2010-10-11 14:05 -------- d-----w- c:\users\Sebastian\AppData\Roaming\Juce VST Host
2010-09-27 18:00 . 2010-09-27 18:00 -------- d-----w- c:\program files\Common Files\TI Shared
2010-09-27 18:00 . 2010-09-27 18:02 -------- d-----w- c:\program files\TI Education
2010-09-27 15:57 . 2010-09-27 15:57 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-09-23 11:42 . 2010-09-23 11:42 95672 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2010-09-22 17:23 . 2010-04-14 18:22 40960 ----a-w- c:\windows\system32\allenocx.ocx
2010-09-22 17:23 . 2007-10-23 16:48 237659 ----a-w- c:\windows\system32\EZTW32.DLL
2010-09-22 17:23 . 2007-01-17 19:06 45056 ----a-w- c:\windows\system32\CF.ocx
2010-09-22 17:23 . 2005-10-09 00:04 40960 ----a-w- c:\windows\system32\hyperlink.ocx
2010-09-22 17:23 . 2004-07-28 19:49 49152 ----a-w- c:\windows\system32\PWAD.ocx
2010-09-22 17:23 . 2001-09-24 18:56 24576 ----a-w- c:\windows\system32\dirdlg2.ocx
2010-09-22 17:23 . 2000-07-05 15:22 24576 ----a-w- c:\windows\system32\runocx.ocx
2010-09-22 17:23 . 2010-09-22 17:23 -------- d-----w- c:\program files\NoteBook
2010-09-18 20:00 . 2010-09-18 20:00 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-09-18 19:50 . 2010-09-18 19:50 -------- d-----w- c:\windows\SQL9_KB970892_ENU
2010-09-17 14:58 . 2010-09-17 14:58 -------- d-----w- c:\users\Sebastian\AppData\Local\ESET
2010-09-17 14:56 . 2010-09-17 14:56 -------- d-----w- c:\program files\ESET
2010-09-16 18:00 . 2010-09-16 18:00 -------- d-----w- c:\program files\EA GAMES
2010-09-15 18:31 . 2010-09-15 18:35 -------- d-----w- c:\users\Sebastian\AppData\Roaming\Mount&Blade
2010-09-14 13:31 . 2004-02-04 07:27 49536 ----a-w- c:\windows\system32\drivers\tiehdusb.sys
2010-09-14 13:29 . 2004-01-28 12:03 21456 ----a-w- c:\windows\system32\drivers\SilvrLnk.sys

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{6dabbda0-1da5-4a2f-bc89-2ae084c572fa} "= "c:\program files\ToggleSW\tbTogg.dll" [2009-12-31 2349080]

[HKEY_CLASSES_ROOT\clsid\{6dabbda0-1da5-4a2f-bc89-2ae084c572fa}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6dabbda0-1da5-4a2f-bc89-2ae084c572fa}]
2009-12-31 08:53 2349080 ----a-w- c:\program files\ToggleSW\tbTogg.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6dabbda0-1da5-4a2f-bc89-2ae084c572fa} "= "c:\program files\ToggleSW\tbTogg.dll" [2009-12-31 2349080]

[HKEY_CLASSES_ROOT\clsid\{6dabbda0-1da5-4a2f-bc89-2ae084c572fa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{6DABBDA0-1DA5-4A2F-BC89-2AE084C572FA} "= "c:\program files\ToggleSW\tbTogg.dll" [2009-12-31 2349080]

[HKEY_CLASSES_ROOT\clsid\{6dabbda0-1da5-4a2f-bc89-2ae084c572fa}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@= "{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} "
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-03-04 21:38 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wisdom-soft AutoScreenRecorder 3.1 Pro "= "0" [X]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-22 39408]
"Google Update "= "c:\users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-01-26 135664]
"WMPNSCFG "= "c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"DAEMON Tools Pro Agent "= "c:\program files\DAEMON Tools Pro\DTAgent.exe" [2010-04-15 427328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender "= "c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"BkupTray "= "c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-07 34040]
"SynTPEnh "= "c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-02-22 1037608]
"StartCCC "= "c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"RtHDVCpl "= "RtHDVCpl.exe" [2008-05-21 6144000]
"PLFSetI "= "c:\windows\PLFSetI.exe" [2007-10-23 200704]
"LManager "= "c:\progra~1\LAUNCH~1\LManager.exe" [2008-05-08 864576]
"eDataSecurity Loader "= "c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-03-04 526896]
"ePower_DMC "= "c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-04-30 397312]
"eRecoveryService "=" " [BU]
"WarReg_PopUp "= "c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104]
"Google Quick Search Box "= "c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-06-25 68592]
"AppleSyncNotifier "= "c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-04-12 47392]
"FBSSA "= "c:\program files\SGPSA\ie3sh.exe" [BU]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-09-24 40368]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-05-27 202256]
"WPCUMI "= "c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"egui "= "c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-08-12 2215064]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-5-22 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux3 "=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring "=dword:00000001

R2 gupdate;Google-päivityspalvelu (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-07 135664]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\McSACore.exe [2010-05-20 88176]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-04 131072]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-01-06 3478288]
R3 TpChoice;Touch Pad Detection Filter driver;c:\windows\system32\DRIVERS\TpChoice.sys [2007-12-26 17968]
R3 ZCinema_TSHD;ZCinema TruSurround HD driver;c:\windows\system32\drivers\ZCinema_SRS_i386.sys [2007-08-22 18448]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-09-28 697328]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-07-29 115008]
S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-07-29 136632]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-08-12 810144]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-07-29 96920]
S2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [2008-03-21 24576]
S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-07 50424]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-17 11032]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2008-03-28 210432]
S3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2008-04-15 51160]
S3 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sd.sys [2008-04-08 43736]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2008-03-19 22072]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
getPlusHelper REG_MULTI_SZ getPlusHelper
.
'Ajoitetut tehtävät'-kansion sisältö

2010-10-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-07 11:42]

2010-10-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-07 11:42]

2010-10-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4164418827-1815202133-2812620103-1003Core.job
- c:\users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-26 17:32]

2010-10-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4164418827-1815202133-2812620103-1003UA.job
- c:\users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-26 17:32]

2010-10-10 c:\windows\Tasks\Norton Security Scan for Sebastian.job
- c:\program files\Norton Security Scan\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-05-07 02:58]

2010-10-13 c:\windows\Tasks\User_Feed_Synchronization-{9B641645-B111-46D6-A57F-38AB22586DDE}.job
- c:\windows\system32\msfeedssync.exe [2009-08-10 20:13]
.
.
------- Täydentävä tarkistus -------
.
uStart Page = hxxp://search.babylon.com/home?AF=14542
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxps://www.battlefieldheroes.com/static/updater/BFHUpdater_4.0.21.0.cab
DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} - hxxps://plugins.valueactive.eu/flashax/iefax.cab
FF - ProfilePath - c:\users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\f42161rq.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=14542
FF - prefs.js: browser.search.selectedEngine - Turvalliset hakutoiminnot
FF - prefs.js: browser.startup.homepage - www.google.fi
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=adbartrp&AF=14542&q=
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - component: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll
FF - component: c:\users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\f42161rq.default\extensions\{ce18769b-c7fa-42d2-860d-17c4662c70ad}\components\FFExternalAlert.dll
FF - component: c:\users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\f42161rq.default\extensions\{ce18769b-c7fa-42d2-860d-17c4662c70ad}\components\RadioWMPCore.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\npggsvc]
"ImagePath "= "c:\windows\system32\GameMon.des -service "
.
--------------------- LUKITUT REKISTERIAVAIMET ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
--------------------- Prosesseihin ladatut DLLt ---------------------

- - - - - - - > 'Explorer.exe'(5084)
c:\progra~1\mcafee\SITEAD~1\saHook.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
c:\windows\System32\SysHook.dll
.
Valmistumisajankohta: 2010-10-13 17:10:35
ComboFix-quarantined-files.txt 2010-10-13 14:10
ComboFix2.txt 2010-10-12 17:55

Ennen ajoa: 64*015*417*344 bytes free
Ajon jälkeen: 64*539*234*304 bytes free

- - End Of File - - 83D004CE63003E00316DE51CD08E9FB0

 

extras:

OTL Extras logfile created on: 14.10.2010 12:25:40 - Run 1
OTL by OldTimer - Version 3.2.15.2 Folder = C:\Users\Sebastian\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18813)
Locale: 0000040B | Country: Finland | Language: FIN | Date Format: d.M.yyyy

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 46,00% Memory free
5,00 Gb Paging File | 4,00 Gb Available in Paging File | 72,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144,17 Gb Total Space | 63,00 Gb Free Space | 43,70% Space Free | Partition Type: NTFS
Drive D: | 144,15 Gb Total Space | 113,51 Gb Free Space | 78,74% Space Free | Partition Type: NTFS

Computer Name: SEBASTIANS-PC | User Name: Sebastian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0B31EA1D-40AD-4988-9B8A-75D87747E067}" = lport=6914 | protocol=17 | dir=in | name=league of legends launcher |
"{13F871E0-4107-4BD3-A73A-F74849ABAA0A}" = lport=6895 | protocol=6 | dir=in | name=league of legends launcher |
"{1B83FD66-3044-4244-B306-E4614C0A0613}" = lport=6927 | protocol=17 | dir=in | name=league of legends launcher |
"{3906DEB7-2066-4ADA-A1CB-357E412F898A}" = lport=6895 | protocol=17 | dir=in | name=league of legends launcher |
"{3AF04F4B-E4C0-41BF-83A3-4DAD53F2C6CA}" = lport=6968 | protocol=6 | dir=in | name=league of legends launcher |
"{45B20CD6-C807-4C20-BEA0-A3490278C3C7}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{4F7A9BF4-E02F-4A44-953C-D850B2F4D7D0}" = lport=6914 | protocol=6 | dir=in | name=league of legends launcher |
"{52FFA462-938C-48FE-8E3B-A6712FC9DAC4}" = lport=8394 | protocol=17 | dir=in | name=league of legends launcher |
"{75861E86-AC80-4CAD-AF22-AF47D412E76D}" = lport=6980 | protocol=17 | dir=in | name=league of legends launcher |
"{78896540-F6C0-4916-9974-644E96C2DC8A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{7E3985D7-CA6A-44A3-A614-31B4E5B33F43}" = lport=8394 | protocol=17 | dir=in | name=league of legends launcher |
"{7EEB12A0-F8C3-4364-8B86-8399605503BA}" = lport=6980 | protocol=6 | dir=in | name=league of legends launcher |
"{82C90A6D-FC1E-4F4E-BFC9-EDAE75623B90}" = lport=8394 | protocol=6 | dir=in | name=league of legends launcher |
"{A467CFE0-C7A7-4E75-A5F1-45272EB90D64}" = lport=6885 | protocol=17 | dir=in | name=league of legends launcher |
"{A7CC5709-25F8-48F5-853E-2A70BF88A013}" = lport=6927 | protocol=6 | dir=in | name=league of legends launcher |
"{B6A37D70-8D6A-4120-8707-DFAF9365665A}" = lport=6968 | protocol=17 | dir=in | name=league of legends launcher |
"{BA4A0B55-A14F-4F2C-A980-91A5F802E011}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{BE1107BD-6EBC-453A-B50C-B98F0DC9FD90}" = lport=6885 | protocol=6 | dir=in | name=league of legends launcher |
"{DBBD32AD-BECE-48F6-BF4F-C93528089B98}" = lport=6963 | protocol=6 | dir=in | name=league of legends launcher |
"{EDEE8A2D-3706-48A8-A53D-71EEE38E9DB8}" = lport=2869 | protocol=6 | dir=in | app=system |
"{EE9C0B7C-4D1C-49EF-B727-95F918A93785}" = lport=6963 | protocol=17 | dir=in | name=league of legends launcher |
"{F8F2AE14-A60D-4863-8C33-DE04BE210BC9}" = lport=8394 | protocol=6 | dir=in | name=league of legends launcher |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03419089-67A1-404B-A671-29D9AB6667D3}" = protocol=6 | dir=in | app=d:\frostwire\frostwire.exe |
"{03C28FB4-C973-4AFC-84B8-FD3BD6D5075F}" = protocol=6 | dir=in | app=c:\users\sebastian\downloads\audioconvertersetup.exe |
"{0E07F74B-5371-4133-AFFA-B48DCF480539}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{11F91DFE-BC62-4D0D-8A6A-7CDB37587B13}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\aliens vs predator demo\avp.exe |
"{18439875-36EF-4139-B049-CECA7569DEC0}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe |
"{1E12DD45-16E9-45B6-874D-AD3FBAC2208B}" = protocol=17 | dir=in | app=d:\battle field\bf2.exe |
"{20C9C1C5-DB69-466E-9E9B-6779A5493663}" = protocol=6 | dir=in | app=d:\battle field\bf2.exe |
"{27FDBD13-A629-4FC2-A353-24C2A35B7069}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe |
"{30916E73-1CB9-40D8-81CC-2CC6E5FF9059}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{3810A94C-B4F3-4800-B013-43F04589CE3D}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{39DFAA94-3785-4014-A05F-E76611AB9231}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
"{3AEDE40E-5040-4AE8-8681-889FE5E3BAD0}" = protocol=6 | dir=in | app=d:\lol\league of legends\game\league of legends.exe |
"{3EEF1512-ADFA-4344-A106-24B22D0CAAF6}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe |
"{40C82DF0-6063-4620-B06B-248C7A143EAB}" = protocol=6 | dir=in | app=d:\league of legends\air\lolclient.exe |
"{436670D3-A348-4D00-8475-7E11F1D0B213}" = protocol=6 | dir=in | app=d:\lol\league of legends\air\lolclient.exe |
"{46151EFB-755C-464B-A9AF-667929501061}" = protocol=6 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe |
"{498A9E63-D5B2-4B74-A91D-631C81015FDB}" = protocol=6 | dir=in | app=d:\lol\league of legends\game\league of legends.exe |
"{5D2B2A5D-BFF1-4F35-A126-CA4560DF0AAF}" = protocol=17 | dir=in | app=c:\users\sebastian\downloads\audioconvertersetup.exe |
"{5E3D4F7B-23F0-4BB5-9587-8CF8712ABC45}" = protocol=17 | dir=in | app=d:\league of legends\game\league of legends.exe |
"{6D97EFDF-45C6-409F-846E-FB4040F5EBCC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7435C12C-DF07-4BDB-863D-C82CC52E0A7B}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{7512F5AE-5EF0-474A-938F-CB18E2DB1E5A}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{7609FB1D-93E4-4926-8B54-CF5F38D0628D}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{77BE3E79-6E80-4212-8F05-80BBD9E2F270}" = dir=in | app=c:\windows\explorer.exe |
"{794F0033-A27C-4ED2-B96A-0EED32CC931B}" = protocol=17 | dir=in | app=d:\frostwire\frostwire.exe |
"{7ACC6E87-8C12-4adb-91B7-EFC3F2F4705A}" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"{7BC624D5-B619-4B10-BDF6-79BCCEB05E70}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe |
"{7C3EFB9B-1C6E-472C-BA96-F83BA4CA65B7}" = protocol=6 | dir=in | app=d:\steam\steam.exe |
"{7CEED114-4D8F-4675-B807-7C8778A7786F}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe |
"{7DF1A8B8-6841-4150-8E17-2155198FF624}" = protocol=6 | dir=in | app=d:\lol\league of legends\air\lolclient.exe |
"{7E1D0B56-6E4E-46DB-BF11-D36F03BF5C0D}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{88FB131A-B0F4-4A5E-92D8-1C4A9391E537}" = protocol=17 | dir=in | app=d:\lol\league of legends\game\league of legends.exe |
"{914003DF-EC5A-4095-B1CA-2075307D8A26}" = protocol=17 | dir=in | app=d:\steam\steamapps\common\mount and blade\runme.exe |
"{92459C5E-D350-4cba-AA74-C8F989C9336F}" = protocol=17 | dir=out | app=c:\windows\explorer.exe |
"{971FFD8C-2B96-4462-AD70-B4747BC0EF8B}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{9DBF083E-58E9-4E52-A2A2-680A5FA1C4F5}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{A39A8ED1-EAF1-4646-877A-DDD6AE8D0B76}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{A3DF52A9-112F-42D1-97EB-0645969A7303}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
"{B002C5EB-D045-4BDA-AC70-F64352091CD4}" = protocol=6 | dir=in | app=d:\steam\steamapps\common\mount and blade\runme.exe |
"{B078B2B6-A878-44ff-9BCC-458257924F96}" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"{B1A40E4F-58DB-490f-9D18-55B5194E8BD5}" = protocol=6 | dir=out | app=c:\windows\explorer.exe |
"{B851E8D3-84B2-4F7D-843A-961A6328A6EC}" = protocol=17 | dir=in | app=d:\league of legends\air\lolclient.exe |
"{B9F6D276-B421-4CEC-8ADB-E0D88912AF5F}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{C1C2C5D6-62FA-46B8-B513-962EC98A61BF}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{C3E9B20A-B7E2-4aab-9835-3C548937E46F}" = dir=out | app=c:\windows\explorer.exe |
"{CAD1509A-37E3-48EF-AD48-8CBD0B592D41}" = protocol=17 | dir=in | app=d:\lol\league of legends\air\lolclient.exe |
"{CBCADF1A-71C3-44B7-94F8-F6EF88E02723}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\aliens vs predator demo\avp.exe |
"{DA4B215C-0896-45F8-93F5-140508FB4F84}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{DB8C1EB1-DE9B-414B-B929-60A3AC72E996}" = protocol=17 | dir=in | app=d:\lol\league of legends\game\league of legends.exe |
"{DDE11382-8343-48A0-8486-3F09E513A03C}" = protocol=17 | dir=in | app=d:\lol\league of legends\air\lolclient.exe |
"{DE37FCAC-D82C-482B-BB29-635EB27FB9B9}" = protocol=6 | dir=in | app=d:\league of legends\game\league of legends.exe |
"{E67D0BEC-E1BB-4AE6-9621-EB5778AE071D}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{E6B1D981-9EF1-4594-A373-773756B029EE}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{E913C348-6DE4-4946-99E3-BCBC5720617B}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe |
"{E96F0930-BAE1-4518-8899-C3CA928AA718}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{EE30E560-8428-47A8-95FC-A9D76026D043}" = protocol=17 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe |
"{FBF2F32A-44CE-46A4-937E-D81446FFBBC6}" = protocol=17 | dir=in | app=d:\steam\steam.exe |
"TCP Query User{02E5C9C0-E158-4162-8BA1-B441976B654E}D:\steam\steamapps\webseba\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=d:\steam\steamapps\webseba\team fortress 2\hl2.exe |
"TCP Query User{11004E60-A439-4014-B7CE-6292A6B95E1A}C:\program files\ijji\ijji reactor\reactor.exe" = protocol=6 | dir=in | app=c:\program files\ijji\ijji reactor\reactor.exe |
"TCP Query User{28F5179E-9BEB-4D27-8CB1-B49A8785192C}C:\program files\frostwire\frostwire.exe" = protocol=6 | dir=in | app=c:\program files\frostwire\frostwire.exe |
"TCP Query User{2CDE8D79-BA98-4AD2-A726-E5D68EB14E32}C:\program files\bitlord\bitlord.exe" = protocol=6 | dir=in | app=c:\program files\bitlord\bitlord.exe |
"TCP Query User{41F05FFB-2D12-4FC7-B2AD-38C5C0DA1295}D:\steam\steamapps\webseba\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=d:\steam\steamapps\webseba\team fortress 2\hl2.exe |
"TCP Query User{454051FB-870C-4A13-BD01-682A29287DD5}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"TCP Query User{4649067D-461D-4B63-85C1-4F86AC873D49}D:\league of legends\lol.launcher.exe" = protocol=6 | dir=in | app=d:\league of legends\lol.launcher.exe |
"TCP Query User{706BA469-9F69-4B84-93E4-459DDF293510}C:\users\sebastian\appdata\local\google\chrome\application\chrome.exe" = protocol=6 | dir=in | app=c:\users\sebastian\appdata\local\google\chrome\application\chrome.exe |
"TCP Query User{795DEFF2-2B39-4AEA-BBB0-398ED08213C8}C:\program files\steam\steamapps\webseba\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\webseba\team fortress 2\hl2.exe |
"TCP Query User{90F73BA5-BA62-4744-B9E8-4EEE5E8E5626}D:\frostwire\frostwire.exe" = protocol=6 | dir=in | app=d:\frostwire\frostwire.exe |
"TCP Query User{C7061905-CD20-495B-993E-26DCFB8C7A21}C:\program files\xfire\xfire.exe" = protocol=6 | dir=in | app=c:\program files\xfire\xfire.exe |
"UDP Query User{2B916D88-D4A1-4E15-9386-2C3F0C3CD3AA}C:\program files\ijji\ijji reactor\reactor.exe" = protocol=17 | dir=in | app=c:\program files\ijji\ijji reactor\reactor.exe |
"UDP Query User{2DDB1824-09B9-48DE-8F49-4E18E7A4085A}C:\program files\frostwire\frostwire.exe" = protocol=17 | dir=in | app=c:\program files\frostwire\frostwire.exe |
"UDP Query User{3D36F076-1974-4D7D-8354-BF4F0DE5386A}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"UDP Query User{4547CDC3-76EB-4E57-9C9C-4BFFB309A553}C:\users\sebastian\appdata\local\google\chrome\application\chrome.exe" = protocol=17 | dir=in | app=c:\users\sebastian\appdata\local\google\chrome\application\chrome.exe |
"UDP Query User{46AA7EFF-0F13-456D-8CB6-84EB3D8C4A5A}C:\program files\xfire\xfire.exe" = protocol=17 | dir=in | app=c:\program files\xfire\xfire.exe |
"UDP Query User{5A1D8056-DC56-4D40-BD5D-A284F1015DFF}C:\program files\bitlord\bitlord.exe" = protocol=17 | dir=in | app=c:\program files\bitlord\bitlord.exe |
"UDP Query User{89BA7007-7EAE-46DA-8A5C-8174B3A6414E}C:\program files\steam\steamapps\webseba\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\webseba\team fortress 2\hl2.exe |
"UDP Query User{8F079AF9-0F2F-47AE-85BB-32C77E0512A1}D:\league of legends\lol.launcher.exe" = protocol=17 | dir=in | app=d:\league of legends\lol.launcher.exe |
"UDP Query User{98BAA4C3-B538-4CB4-A5AC-98C111C2D130}D:\frostwire\frostwire.exe" = protocol=17 | dir=in | app=d:\frostwire\frostwire.exe |
"UDP Query User{A4BC1D01-0A0D-4F15-AACA-8592B42558B7}D:\steam\steamapps\webseba\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=d:\steam\steamapps\webseba\team fortress 2\hl2.exe |
"UDP Query User{D3744CF5-BB09-4414-8404-1ABF7625DD52}D:\steam\steamapps\webseba\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=d:\steam\steamapps\webseba\team fortress 2\hl2.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0046FA01-C5B9-4985-BACB-398DC480FC05}" = Adobe Photoshop CS3
"{0087799A-6484-2297-16D1-314C8D51EB5C}" = CCC Help Turkish
"{008B104E-AD08-D176-D974-9E795A3B5930}" = CCC Help English
"{01D60497-9C75-DFB2-6702-73288FAAF569}" = CCC Help Finnish
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.0.1.6300
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{08E77A66-9566-2C8F-4924-87AF3EEC4C8D}" = Catalyst Control Center Localization Korean
"{0E93710D-31E5-477C-8A4B-5032B484BE74}" = Windows Live inloggningsassistenten
"{0F685585-6664-3B0F-8FFF-824EF3EC808F}" = CCC Help Chinese Standard
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{11FA22E0-699F-57FB-2ED5-81518FD4D26B}" = Catalyst Control Center Localization Czech
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{13D85C14-2B85-419F-AC41-C7F21E68B25D}" = Acer eSettings Management
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{1ADA324F-E40F-1763-8A4C-C2B1C3221C8B}" = Catalyst Control Center Localization German
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{21BC64BE-7760-932B-9070-BAE49E82E4C0}" = CCC Help Russian
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{247EC1CE-C81F-298F-EDDE-666C02C58193}" = CCC Help Spanish
"{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2
"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0
"{2503CD86-B4C1-2EB7-30F8-A06F1156EE44}" = CCC Help German
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 21
"{27F3E373-93BF-441E-826B-98C33DF309B5}" = AMD USB Audio Driver Filter
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2A6F9CF1-E874-FAAE-ACBF-50DEAB6A2866}" = Catalyst Control Center Localization Chinese Traditional
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{2C3AD6F9-0DD7-E2A2-363F-749247AE9603}" = CCC Help Czech
"{2E484859-4C24-718C-C637-368B04F14142}" = Catalyst Control Center Localization Russian
"{30C5CDC6-67DE-F761-507F-E156FB7CF098}" = Catalyst Control Center Localization Italian
"{3304A9B5-C51F-42D4-B827-C77D607AC87B}" = Catalyst Control Center Localization Chinese Standard
"{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}" = McAfee SiteAdvisor
"{36E3F10E-E909-0B45-B58B-CAF9864B22FF}" = Catalyst Control Center Localization Danish
"{372B31CF-77FB-4E29-860C-A0EA2985AB7F}" = O2Micro Flash Memory Card Reader Driver Installer(x86)
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3CFD59CA-BC0C-0A69-C420-5F6E54565246}" = ccc-core-static
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{448D6CAA-B84F-148E-DF21-D9145CD70791}" = Catalyst Control Center Localization Thai
"{459E81F6-51BB-F78C-EB9A-619499B7E7B8}" = CCC Help Korean
"{49471DB8-7F3C-42DB-89C2-AC50FA0C5290}" = Camtasia Studio 7
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BFA8833-058B-4DF6-8EAE-A48904C7571E}" = ESET NOD32 Antivirus
"{4EA50CE2-3549-5E6B-DB7F-EC1FB21C98EB}" = CCC Help Italian
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{5025C2C2-E2DA-54CA-6AA3-2B796ED5E371}" = CCC Help Dutch
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{5204292B-0CDB-B240-65CE-F4CF17919E2D}" = Catalyst Control Center Localization Hungarian
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{548AF5C1-54E3-4B74-A3E5-D5E6CB7D487C}" = O2Micro Flash Memory Card Reader Driver (x86)
"{56B4002F-671C-49F4-984C-C760FE3806B5}" = Microsoft SQL Server VSS Writer
"{5776FA35-21C8-A6C6-3B32-C5528AE4054F}" = CCC Help Danish
"{58A8EF55-37A0-F2C2-A35B-CA97E8F3D5C3}" = CCC Help Hungarian
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{59ED508E-4239-EAD2-8D50-8923AADCFD76}" = Catalyst Control Center Graphics Full New
"{5A70922D-9365-43CC-ADA9-CB84E4A54E4E}" = Windows Live Essentials
"{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}" = Sony USB Driver
"{5D751B45-0F9F-0B9E-F3EA-25821C9D7F49}" = CCC Help Thai
"{5FEBF468-5AC2-4C66-AD80-DF85C085AA73}" = InterVideo WinDVD 8
"{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
"{672CFCDF-759F-5F3C-077D-8B1A172FE150}" = Catalyst Control Center Localization Swedish
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A5A8BEE-5493-C8F3-978F-6DC2A612D070}" = Catalyst Control Center Localization Portuguese
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6CB07378-C076-D335-7D38-37AC272D899A}" = Catalyst Control Center Localization Greek
"{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
"{6F7EA6CA-79F4-44A0-A370-8E82BB16534A}" = NTI Shadow
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{70B7E2EA-6CF1-C7BC-5F0E-7467F114BD5E}" = Catalyst Control Center Core Implementation
"{70E392D0-9A63-CD3B-11E4-4B66B7C68DE9}" = Catalyst Control Center Localization Spanish
"{760E3EF8-577D-483E-9CB2-E759880AD82E}" = League of Legends
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{796127AB-1065-1DE9-3F6B-B4A00455FD34}" = CCC Help Chinese Traditional
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{85D808E9-8D08-90FF-B0FB-2732EC386A58}" = Catalyst Control Center Localization Japanese
"{89AD7027-B6B2-47DF-21F2-D8A46A6DB13F}" = ATI Catalyst Install Manager
"{8C55354D-62FC-7BBD-91CB-199365A64331}" = CCC Help French
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{8F1B6239-FEA0-450A-A950-B05276CE177C}" = Acer Empowering Technology
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-040B-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Finnish) 2007
"{90120000-0016-040B-0000-0000000FF1CE}_HOMESTUDENTR_{DCB679BA-7B0C-4D8C-B443-79701F6FA01C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-040B-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Finnish) 2007
"{90120000-0018-040B-0000-0000000FF1CE}_HOMESTUDENTR_{DCB679BA-7B0C-4D8C-B443-79701F6FA01C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-040B-0000-0000000FF1CE}" = Microsoft Office Word MUI (Finnish) 2007
"{90120000-001B-040B-0000-0000000FF1CE}_HOMESTUDENTR_{DCB679BA-7B0C-4D8C-B443-79701F6FA01C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040B-0000-0000000FF1CE}" = Microsoft Office Proof (Finnish) 2007
"{90120000-001F-040B-0000-0000000FF1CE}_HOMESTUDENTR_{8C00DF3E-E8BD-4C6A-B86F-0135E11DAF1C}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-041D-0000-0000000FF1CE}" = Microsoft Office Proof (Swedish) 2007
"{90120000-001F-041D-0000-0000000FF1CE}_HOMESTUDENTR_{43722AA8-ACEA-4F54-9B83-2467D376EF8A}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-002C-040B-0000-0000000FF1CE}" = Microsoft Office Proofing (Finnish) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-040B-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Finnish) 2007
"{90120000-006E-040B-0000-0000000FF1CE}_HOMESTUDENTR_{06921DF8-773B-45F8-9464-6BB1C56FEF21}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-040B-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Finnish) 2007
"{90120000-00A1-040B-0000-0000000FF1CE}_HOMESTUDENTR_{DCB679BA-7B0C-4D8C-B443-79701F6FA01C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{90A40409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{95C8E6D2-8D1A-1846-F8CF-FC5BF2682D3E}" = Catalyst Control Center Graphics Full Existing
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9B28716A-CAB1-F0E0-A975-83F9C7294F64}" = Catalyst Control Center Graphics Light
"{9BBE7AA1-AFA8-4D76-8FC2-1FDFD9BD3371}" = Windows Live Mail
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A176487F-227E-3F91-C7AF-679E0E34AC0C}" = ccc-utility
"{A18BB607-BC5A-474E-88FD-C215B91A0F97}" = Dance eJay 7
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A5633652-3795-4829-BB0B-644F0279E279}" = Acer eDataSecurity Management
"{A64A5576-D862-44F8-89DC-2B17FCC9B86E}" = Broadcom Gigabit Integrated Controller
"{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}" = Acer Crystal Eye Webcam 2.0.8
"{A8B94669-8654-4126-BD28-D0D2412CDED6}" = TI Connect 1.6
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.5
"{AD0EF554-9674-3C40-914C-E728036D6B5B}" = CCC Help Polish
"{AFAC914D-9E83-4A89-8ABE-427521C82CCF}" = Safari
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B1AAC909-15F7-74EC-5D4D-70E3240CD30A}" = Catalyst Control Center Localization Dutch
"{B24380E2-B8C4-5FC5-F11D-27300AB9B3A3}" = Catalyst Control Center Localization Norwegian
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B32C4059-6E7A-41EF-AD20-56DF1872B923}" = Business Contact Manager for Outlook 2007 SP2
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B8E11DD5-8FC7-6EFB-42A3-1D9C58CDFD84}" = CCC Help Portuguese
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BA165460-FCF7-4D6C-A7A2-F2321700720F}" = MobileMe Control Panel
"{BD68F46D-8A82-4664-8E68-F87C55BDEFD4}" = Microsoft SQL Server Native Client
"{BF23DA5D-6205-4BE2-36B4-B74D671FF0D1}" = CCC Help Greek
"{C3C9EB3D-24FA-4462-B784-0EC6AAFCD2DD}" = Fable - The Lost Chapters
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CC434C7B-54AF-7181-1F33-6BD4DF382FE2}" = CCC Help Japanese
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1
"{CE7CB214-DB11-4B5D-A6AF-3B4ED47C68B7}" = Microsoft Game Studios Common Redistributables Pack 1
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D1BB4446-AE9C-4256-9A7F-4D46604D2462}" = Adobe Setup
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D5068583-D569-468B-9755-5FBF5848F46F}" = Sony Picture Utility
"{D7C81D2F-9490-518E-893F-0E9AC41415DE}" = Catalyst Control Center Localization Finnish
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DF39E385-C2E0-F044-022B-2A8A565B7182}" = Catalyst Control Center Localization Polish
"{E28088C5-E768-4A1B-B308-A9F3ED28ABBE}" = OpenOffice.org 3.0
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E5CFDA19-A86E-4276-AB8E-5165E2FC98B8}" = Hernline
"{E5FB0690-C5F4-DD4F-4360-D1F360582DCE}" = CCC Help Swedish
"{E62A1F01-07B7-4541-A835-EE5B0BF064C2}" = Microsoft Antimalware
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{EB900AF8-CC61-4E15-871B-98D1EA3E8025}" = QuickTime
"{EC928237-A3BD-4640-ABD0-E49E758F2315}" = Windows Live Messenger
"{EE94CB5C-9DD8-0373-42C3-A4F9F4A775BA}" = Catalyst Control Center Localization Turkish
"{EF98A02A-1748-4762-9B7D-5ED1600520D5}" = Microsoft Security Essentials
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4BCAAD1-95DF-DF91-4A06-471D97884038}" = CCC Help Norwegian
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"{FA378A8C-5F03-519A-AE78-91E93B50FC6A}" = Catalyst Control Center Localization French
"{FA4DDF14-0227-47ED-9FB0-3290E84E8938}" = Catalyst Control Center - Branding
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_2ac78060bc5856b0c1cf873bb919b58" = Adobe Photoshop CS3
"Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
"Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
"Any Video Converter_is1" = Any Video Converter 2.7.7
"BitLord" = BitLord 1.1
"Business Contact Manager" = Business Contact Manager for Outlook 2007 SP2
"CamStudio" = CamStudio
"Cheat Engine 5.6.1_is1" = Cheat Engine 5.6.1
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118" = HDAUDIO Soft Data Fax Modem with SmartCP
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"ExpressBurn" = Express Burn
"FL Studio 9" = FL Studio 9
"Graboid Video" = Graboid Video 1.71
"GridVista" = Acer GridVista
"Guild Wars" = Guild Wars
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"hon" = Heroes of Newerth
"ILoveThisAdPlatformFF" = FFILoveThisAdPlatform
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{5FEBF468-5AC2-4C66-AD80-DF85C085AA73}" = InterVideo WinDVD 8
"InstallShield_{6F7EA6CA-79F4-44A0-A370-8E82BB16534A}" = NTI Shadow
"InstallShield_{C3C9EB3D-24FA-4462-B784-0EC6AAFCD2DD}" = Fable - The Lost Chapters
"League of Legends_is1" = League of Legends
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Essentials" = Microsoft Security Essentials
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox (3.0.13)" = Mozilla Firefox (3.0.13)
"NoteBook DEMO_is1" = NoteBook 5.3.6
"NSS" = Norton Security Scan
"PROHYBRIDR" = 2007 Microsoft Office system
"RC DareDevil" = RC DareDevil
"RealPlayer 12.0" = RealPlayer
"Steam App 22100" = Mount & Blade
"Steam App 440" = Team Fortress 2
"Streamingstar Converter_is1" = Streamingstar Converter
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"ToggleSW Toolbar" = ToggleSW Toolbar
"ToolBox" = NCH Toolbox
"WarBirds" = WarBirds
"WinLiveSuite_Wave3" = Windows Live Essentials
"Vista Boot Logo Generator_is1" = Vista Boot Logo Generator v1.2
"VistaGlazz_is1" = VistaGlazz 2.1
"VLC media player" = VLC media player 1.0.1
"Xfire" = Xfire (remove only)

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11.10.2010 0:21:04 | Computer Name = Sebastians-PC | Source = WinMgmt | ID = 10
Description =

Error - 11.10.2010 8:16:52 | Computer Name = Sebastians-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Common
Files\Apple\Mobile Device Support\AppleSyncNotifier.exe ". Dependent Assembly Microsoft.VC80.CRT,processorArchitecture= "x86 ",publicKeyToken= "1fc8b3b9a1e18e3b ",type= "win32 ",version= "8.0.50727.4053 "
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 11.10.2010 8:30:43 | Computer Name = Sebastians-PC | Source = WinMgmt | ID = 10
Description =

Error - 11.10.2010 8:31:55 | Computer Name = Sebastians-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Common
Files\Apple\Mobile Device Support\AppleSyncNotifier.exe ". Dependent Assembly Microsoft.VC80.CRT,processorArchitecture= "x86 ",publicKeyToken= "1fc8b3b9a1e18e3b ",type= "win32 ",version= "8.0.50727.4053 "
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 11.10.2010 8:35:12 | Computer Name = Sebastians-PC | Source = MsiInstaller | ID = 1013
Description =

Error - 11.10.2010 8:35:12 | Computer Name = Sebastians-PC | Source = MsiInstaller | ID = 11935
Description =

Error - 11.10.2010 8:35:34 | Computer Name = Sebastians-PC | Source = MsiInstaller | ID = 11500
Description =

Error - 11.10.2010 8:42:33 | Computer Name = Sebastians-PC | Source = WinMgmt | ID = 10
Description =

Error - 11.10.2010 9:03:51 | Computer Name = Sebastians-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Common
Files\Apple\Mobile Device Support\AppleSyncNotifier.exe ". Dependent Assembly Microsoft.VC80.CRT,processorArchitecture= "x86 ",publicKeyToken= "1fc8b3b9a1e18e3b ",type= "win32 ",version= "8.0.50727.4053 "
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 11.10.2010 11:13:27 | Computer Name = Sebastians-PC | Source = EventSystem | ID = 4621
Description =

[ OSession Events ]
Error - 15.8.2010 13:19:08 | Computer Name = Sebastians-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4287
seconds with 180 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 24.11.2009 8:48:10 | Computer Name = Sebastians-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 24.11.2009 8:48:10 | Computer Name = Sebastians-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 24.11.2009 8:48:10 | Computer Name = Sebastians-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 24.11.2009 9:06:00 | Computer Name = Sebastians-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 24.11.2009 9:06:00 | Computer Name = Sebastians-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 24.11.2009 9:06:00 | Computer Name = Sebastians-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 24.11.2009 9:08:17 | Computer Name = Sebastians-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 24.11.2009 9:08:17 | Computer Name = Sebastians-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 24.11.2009 9:08:17 | Computer Name = Sebastians-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 24.11.2009 13:14:36 | Computer Name = Sebastians-PC | Source = Service Control Manager | ID = 7011
Description =


< End of report >

 

OTL logfile created on: 14.10.2010 12:25:40 - Run 1
OTL by OldTimer - Version 3.2.15.2 Folder = C:\Users\Sebastian\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18813)
Locale: 0000040B | Country: Finland | Language: FIN | Date Format: d.M.yyyy

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 46,00% Memory free
5,00 Gb Paging File | 4,00 Gb Available in Paging File | 72,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144,17 Gb Total Space | 63,00 Gb Free Space | 43,70% Space Free | Partition Type: NTFS
Drive D: | 144,15 Gb Total Space | 113,51 Gb Free Space | 78,74% Space Free | Partition Type: NTFS

Computer Name: SEBASTIANS-PC | User Name: Sebastian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days

========== Processes (SafeList) ==========

PRC - [2010.10.14 12:23:29 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Sebastian\Desktop\OTL.exe
PRC - [2010.10.06 08:49:00 | 000,411,432 | ---- | M] (Valve Corporation) -- C:\Program Files\Common Files\Steam\SteamService.exe
PRC - [2010.08.26 16:59:46 | 001,242,448 | ---- | M] (Valve Corporation) -- D:\Steam\Steam.exe
PRC - [2010.08.13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010.08.12 14:16:26 | 000,810,144 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
PRC - [2010.08.12 14:16:12 | 002,215,064 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
PRC - [2010.05.27 15:13:58 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2010.05.20 17:19:16 | 000,088,176 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee\SiteAdvisor\McSACore.exe
PRC - [2010.03.25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
PRC - [2009.03.22 11:29:55 | 000,039,408 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2008.10.29 09:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.05.21 05:06:00 | 006,144,000 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2008.04.30 20:02:40 | 000,397,312 | ---- | M] (Acer Inc.) -- C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
PRC - [2008.04.07 08:42:36 | 000,034,040 | ---- | M] () -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
PRC - [2008.04.07 08:42:24 | 000,050,424 | ---- | M] (NewTech InfoSystems, Inc.) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
PRC - [2008.03.21 23:22:52 | 000,024,576 | ---- | M] () -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
PRC - [2008.03.05 00:38:34 | 000,500,784 | ---- | M] (Egis Incorporated) -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
PRC - [2008.03.05 00:38:28 | 000,526,896 | ---- | M] (Egis Incorporated) -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
PRC - [2008.03.03 23:11:14 | 000,016,384 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
PRC - [2008.01.21 05:24:13 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2008.01.21 05:23:43 | 000,056,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wermgr.exe
PRC - [2008.01.12 03:50:16 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
PRC - [2007.12.07 02:15:28 | 000,110,592 | ---- | M] () -- C:\Acer\Mobility Center\MobilityService.exe
PRC - [2007.07.24 12:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) -- C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
PRC - [2007.02.13 04:43:44 | 000,065,536 | ---- | M] (O2Micro International) -- C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
PRC - [2007.01.04 20:48:50 | 000,112,152 | ---- | M] (InterVideo) -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe


========== Modules (SafeList) ==========

MOD - [2010.10.14 12:23:29 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Sebastian\Desktop\OTL.exe
MOD - [2010.07.14 13:30:14 | 000,018,688 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee\SiteAdvisor\sahook.dll
MOD - [2008.01.21 05:24:37 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx
MOD - [2008.01.21 05:23:44 | 001,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2010.10.06 08:49:00 | 000,411,432 | ---- | M] (Valve Corporation) [On_Demand | Running] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010.08.13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010.08.12 14:18:40 | 000,033,584 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv)
SRV - [2010.08.12 14:16:26 | 000,810,144 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)
SRV - [2010.05.20 17:19:16 | 000,088,176 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service)
SRV - [2010.03.25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)
SRV - [2010.01.06 19:13:00 | 003,478,288 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\System32\GameMon.des -- (npggsvc)
SRV - [2009.12.17 17:36:24 | 000,067,360 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2009.04.23 12:36:54 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008.04.07 08:42:24 | 000,050,424 | ---- | M] (NewTech InfoSystems, Inc.) [Auto | Running] -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe -- (NTIBackupSvc)
SRV - [2008.04.04 13:03:14 | 000,131,072 | ---- | M] () [Auto | Stopped] -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe -- (NTISchedulerSvc)
SRV - [2008.03.21 23:22:52 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe -- (ETService)
SRV - [2008.03.05 00:38:34 | 000,500,784 | ---- | M] (Egis Incorporated) [Auto | Running] -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe -- (eDataSecurity Service)
SRV - [2008.03.03 23:11:14 | 000,016,384 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe -- (BUNAgentSvc)
SRV - [2008.01.21 05:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.12 03:50:16 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)
SRV - [2007.12.07 02:15:28 | 000,110,592 | ---- | M] () [Auto | Running] -- C:\Acer\Mobility Center\MobilityService.exe -- (MobilityService)
SRV - [2007.07.24 12:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto | Running] -- C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2007.02.13 04:43:44 | 000,065,536 | ---- | M] (O2Micro International) [Auto | Running] -- C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe -- (o2flash)
SRV - [2007.01.04 20:48:50 | 000,112,152 | ---- | M] (InterVideo) [Auto | Running] -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Running] -- C:\Users\SEBAST~1\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2010.09.28 21:32:39 | 000,697,328 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2010.07.29 13:31:26 | 000,136,632 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\Windows\System32\drivers\eamonm.sys -- (eamonm)
DRV - [2010.07.29 13:31:26 | 000,115,008 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\System32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2010.07.29 13:31:26 | 000,096,920 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\epfwwfpr.sys -- (epfwwfpr)
DRV - [2010.03.25 21:30:22 | 000,042,368 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)
DRV - [2008.05.21 05:01:00 | 002,143,136 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008.04.30 11:33:48 | 003,551,232 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008.04.28 20:26:42 | 000,014,352 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO)
DRV - [2008.04.27 22:07:44 | 000,909,824 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008.04.19 01:33:48 | 000,175,632 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\ahcix86s.sys -- (ahcix86s)
DRV - [2008.04.15 21:13:14 | 000,051,160 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\o2media.sys -- (O2MDRDR)
DRV - [2008.04.08 21:46:02 | 000,043,736 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\o2sd.sys -- (O2SDRDR)
DRV - [2008.03.28 14:44:56 | 000,210,432 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\b57nd60x.sys -- (b57nd60x)
DRV - [2008.03.21 20:48:24 | 000,015,392 | ---- | M] (Acer, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\int15.sys -- (int15)
DRV - [2008.03.19 19:28:52 | 000,022,072 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbfilter.sys -- (usbfilter)
DRV - [2008.03.05 00:38:44 | 000,060,464 | ---- | M] (Egis Incorporated) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\PSDVdisk.sys -- (psdvdisk)
DRV - [2008.03.05 00:38:44 | 000,016,944 | ---- | M] (Egis Incorporated) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\PSDNServ.sys -- (PSDNServ)
DRV - [2008.03.05 00:38:42 | 000,018,992 | ---- | M] (Egis Incorporated) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\psdfilter.sys -- (PSDFilter)
DRV - [2008.02.22 22:50:48 | 000,198,064 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP)
DRV - [2008.02.14 19:17:10 | 000,080,424 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwaudio.sys -- (btwaudio)
DRV - [2008.01.31 04:52:06 | 000,014,848 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV - [2008.01.31 04:51:50 | 000,013,824 | ---- | M] (NewTech Infosystems Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\UBHelper.sys -- (UBHelper)
DRV - [2008.01.21 05:23:27 | 000,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR)
DRV - [2008.01.21 05:23:27 | 000,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2008.01.21 05:23:27 | 000,031,288 | ---- | M] (LSI Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2008.01.21 05:23:26 | 000,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2008.01.21 05:23:26 | 000,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2008.01.21 05:23:26 | 000,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2008.01.21 05:23:25 | 000,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2008.01.21 05:23:25 | 000,089,656 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2008.01.21 05:23:24 | 001,122,360 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2008.01.21 05:23:24 | 000,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2008.01.21 05:23:24 | 000,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2008.01.21 05:23:23 | 000,235,064 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2008.01.21 05:23:23 | 000,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2008.01.21 05:23:23 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2008.01.21 05:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2008.01.21 05:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2008.01.21 05:23:23 | 000,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2008.01.21 05:23:23 | 000,030,720 | ---- | M] (National Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nscirda.sys -- (NSCIRDA)
DRV - [2008.01.21 05:23:22 | 000,342,584 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2008.01.21 05:23:22 | 000,200,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VSTAZL3.SYS -- (HSFHWAZL)
DRV - [2008.01.21 05:23:21 | 000,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2008.01.21 05:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2008.01.21 05:23:21 | 000,073,088 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008.01.21 05:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2008.01.21 05:23:20 | 000,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2008.01.21 05:23:00 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2008.01.21 05:23:00 | 000,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2008.01.21 05:23:00 | 000,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2007.12.26 09:23:10 | 000,017,968 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TpChoice.sys -- (TpChoice)
DRV - [2007.08.22 15:26:32 | 000,018,448 | ---- | M] (SRS Labs, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZCinema_SRS_i386.sys -- (ZCinema_TSHD)
DRV - [2007.07.16 18:20:26 | 000,016,168 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwrchid.sys -- (btwrchid)
DRV - [2007.07.16 18:20:24 | 000,080,936 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwavdt.sys -- (btwavdt)
DRV - [2007.04.17 21:09:28 | 000,011,032 | ---- | M] (InterVideo) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\regi.sys -- (regi)
DRV - [2006.12.22 22:50:24 | 000,985,600 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DPV.sys -- (HSF_DPV)
DRV - [2006.12.22 22:49:04 | 000,207,360 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWAZL.sys -- (HSXHWAZL)
DRV - [2006.12.22 22:48:54 | 000,659,968 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_CNXT.sys -- (winachsf)
DRV - [2006.11.29 03:44:52 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2006.11.03 08:29:38 | 000,021,264 | ---- | M] (Dritek System Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\DKbFltr.sys -- (DKbFltr)
DRV - [2006.11.02 12:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006.11.02 12:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006.11.02 12:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006.11.02 12:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006.11.02 12:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006.11.02 12:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006.11.02 12:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006.11.02 12:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006.11.02 12:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006.11.02 12:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006.11.02 12:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006.11.02 11:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006.11.02 11:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006.11.02 11:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006.11.02 11:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006.11.02 11:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006.11.02 11:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006.11.02 10:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2004.02.04 10:27:56 | 000,049,536 | ---- | M] (Texas Instruments Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tiehdusb.sys -- (TIEHDUSB)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {6dabbda0-1da5-4a2f-bc89-2ae084c572fa} - C:\Program Files\ToggleSW\tbTogg.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/home?AF=14542
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = F5 CD 86 00 0E F1 19 42 B4 08 CB E4 80 A1 E1 0B [binary data]
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\..\URLSearchHook: {6dabbda0-1da5-4a2f-bc89-2ae084c572fa} - C:\Program Files\ToggleSW\tbTogg.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Turvalliset hakutoiminnot "
FF - prefs.js..browser.search.defaulturl: "http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=14542 "
FF - prefs.js..browser.search.order.1: "Search the web (Babylon) "
FF - prefs.js..browser.search.selectedEngine: "Turvalliset hakutoiminnot "
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.fi "
FF - prefs.js..extensions.enabledItems: {9CE11043-9A15-4207-A565-0C94C42D590D}:11.3.7.0
FF - prefs.js..extensions.enabledItems: {ce18769b-c7fa-42d2-860d-17c4662c70ad}:2.7.2.0
FF - prefs.js..extensions.enabledItems: bejeweledblitz3cheat@thecybershadow.net:2.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.2
FF - prefs.js..extensions.enabledItems: m3ffxtbr@mywebsearch.com:1.1
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.4
FF - prefs.js..extensions.enabledItems: {0dd4f99f-9c48-488e-be49-a21d608d3172}:1.0
FF - prefs.js..extensions.enabledItems: {1bce9228-a236-5601-a33e-9a8361a6ce34}:4.6.6.3
FF - prefs.js..keyword.URL: "http://search.babylon.com/?babsrc=adbartrp&AF=14542&q= "
FF - prefs.js..network.proxy.no_proxies_on: "*.local "


FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010.05.27 15:15:10 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\m3ffxtbr@mywebsearch.com: C:\Program Files\MyWebSearch\bar\3.bin File not found
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010.09.30 22:20:26 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.10.12 16:55:57 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.10.12 16:55:57 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010.09.17 17:56:19 | 000,000,000 | ---D | M]

[2009.11.26 00:59:20 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Mozilla\Extensions
[2009.11.26 00:59:20 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Mozilla\Extensions\IMVUClientXUL@imvu.com
[2010.10.05 23:38:47 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\f42161rq.default\extensions
[2010.09.07 16:03:06 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\f42161rq.default\extensions\{0dd4f99f-9c48-488e-be49-a21d608d3172}
[2009.10.29 19:50:49 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\f42161rq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.09.29 17:49:35 | 000,000,000 | ---D | M] (Babylon-English Toolbar) -- C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\f42161rq.default\extensions\{ce18769b-c7fa-42d2-860d-17c4662c70ad}
[2010.05.12 00:40:21 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\f42161rq.default\extensions\bejeweledblitz3cheat@thecybershadow.net
[2009.10.29 19:51:01 | 000,005,407 | ---- | M] () -- C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\f42161rq.default\searchplugins\fast-browser-search.xml
[2010.04.23 09:46:37 | 000,000,254 | ---- | M] () -- C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\f42161rq.default\searchplugins\Search.xml
[2010.10.10 21:28:25 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010.04.23 09:46:51 | 000,000,000 | ---D | M] (z) -- C:\Program Files\Mozilla Firefox\extensions\{1bce9228-a236-5601-a33e-9a8361a6ce34}
[2010.05.24 16:29:20 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.19 19:26:41 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.09.29 17:49:24 | 000,002,226 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
[2010.10.05 23:38:54 | 000,002,036 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\McSiteAdvisor.xml

O1 HOSTS File: ([2010.10.12 12:34:53 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (ToggleSW Toolbar) - {6dabbda0-1da5-4a2f-bc89-2ae084c572fa} - C:\Program Files\ToggleSW\tbTogg.dll (Conduit Ltd.)
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O3 - HKLM\..\Toolbar: (ToggleSW Toolbar) - {6dabbda0-1da5-4a2f-bc89-2ae084c572fa} - C:\Program Files\ToggleSW\tbTogg.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (ToggleSW Toolbar) - {6DABBDA0-1DA5-4A2F-BC89-2AE084C572FA} - C:\Program Files\ToggleSW\tbTogg.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [BkupTray] C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe ()
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)
O4 - HKLM..\Run: [eRecoveryService] File not found
O4 - HKLM..\Run: [FBSSA] C:\Program Files\SGPSA\ie3sh.exe File not found
O4 - HKLM..\Run: [Google Quick Search Box] C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe (Google Inc.)
O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [MSSE] C:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Incorporated)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
O4 - HKCU..\Run: [DAEMON Tools Pro Agent] C:\Program Files\DAEMON Tools Pro\DTAgent.exe (DT Soft Ltd)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [Wisdom-soft AutoScreenRecorder 3.1 Pro] File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowLegacyWebView = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowUnhashedWebView = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} https://www.battlefieldheroes.com/static/updater/BFHUpdater_4.0.21.0.cab (Battlefield Heroes Updater)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} https://plugins.valueactive.eu/flashax/iefax.cab (Flash Casino Helper Control)
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll (PCPitstop Exam)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 213.243.153.170 213.243.153.171
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.19 00:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.iac2 - C:\Program Files\StreamingStar\StreamingstarConverter\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.vorbis - C:\Windows\System32\vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv50 - C:\Program Files\StreamingStar\StreamingstarConverter\ir50_32.dll (Intel Corporation)
Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)
Drivers32: VIDC.XFR1 - C:\Windows\System32\xfcodec.dll ()

 

Continues from previous:
CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 90 Days ==========

[2010.10.14 12:23:21 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Users\Sebastian\Desktop\OTL.exe
[2010.10.13 22:16:28 | 000,000,000 | ---D | C] -- C:\Users\Sebastian\AppData\Local\TechSmith
[2010.10.13 20:15:58 | 000,000,000 | ---D | C] -- C:\Users\Sebastian\Documents\Camtasia Studio
[2010.10.13 20:13:39 | 000,000,000 | ---D | C] -- C:\Windows\System32\QuickTime
[2010.10.13 20:07:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\TechSmith Shared
[2010.10.13 20:07:00 | 000,000,000 | ---D | C] -- C:\ProgramData\TechSmith
[2010.10.13 17:43:41 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Essentials
[2010.10.13 17:10:37 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010.10.13 17:10:37 | 000,000,000 | ---D | C] -- C:\Users\Sebastian\AppData\Local\temp
[2010.10.13 17:09:29 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2010.10.13 16:43:27 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2010.10.13 16:43:15 | 000,000,000 | ---D | C] -- C:\ComboFix
[2010.10.13 16:42:39 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010.10.12 19:22:48 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2010.10.12 19:01:41 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet
[2010.10.12 07:20:58 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2010.10.12 07:20:57 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2010.10.12 07:20:40 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010.10.12 06:54:38 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010.10.11 17:41:29 | 000,000,000 | ---D | C] -- C:\Windows\A8B9466986544126BD28D0D2412CDED6.TMP
[2010.10.11 17:21:35 | 000,000,000 | ---D | C] -- C:\ProgramData\{951CCC02-4CE8-48BD-87DA-C99DB6D9B36E}
[2010.10.11 17:21:01 | 000,000,000 | ---D | C] -- C:\Users\Sebastian\AppData\Local\PackageAware
[2010.10.11 07:20:04 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2010.10.10 20:18:00 | 000,000,000 | ---D | C] -- C:\Users\Sebastian\AppData\Roaming\Malwarebytes
[2010.10.10 20:09:15 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.10.10 20:09:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.10.10 20:09:08 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.10.10 19:46:33 | 000,000,000 | ---D | C] -- C:\ProgramData\PCPitstop
[2010.10.08 18:24:15 | 000,000,000 | ---D | C] -- C:\Users\Sebastian\Documents\Mount&Blade Savegames
[2010.10.08 06:41:19 | 000,000,000 | ---D | C] -- C:\Users\Sebastian\AppData\Roaming\Registry Mechanic
[2010.10.06 18:14:24 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010.09.29 17:49:27 | 000,000,000 | ---D | C] -- C:\Program Files\Babylon
[2010.09.28 22:05:57 | 000,000,000 | ---D | C] -- C:\Users\Sebastian\AppData\Local\PMB Files
[2010.09.28 22:05:52 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files
[2010.09.28 22:05:31 | 000,000,000 | ---D | C] -- C:\Program Files\Pando Networks
[2010.09.28 21:30:58 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Pro
[2010.09.28 20:26:44 | 000,000,000 | ---D | C] -- C:\Users\Sebastian\AppData\Roaming\Sakura
[2010.09.28 20:21:05 | 000,000,000 | ---D | C] -- C:\Users\Sebastian\AppData\Roaming\Juce VST Host
[2010.09.27 21:00:29 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\TI Shared
[2010.09.27 21:00:26 | 000,000,000 | ---D | C] -- C:\Program Files\TI Education
[2010.09.27 18:57:23 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard
[2010.09.22 20:23:50 | 000,049,152 | ---- | C] (Martin Allen 2002, 2004) -- C:\Windows\System32\PWAD.ocx
[2010.09.22 20:23:50 | 000,045,056 | ---- | C] (Martin Allen 2002, 2007) -- C:\Windows\System32\CF.ocx
[2010.09.22 20:23:50 | 000,040,960 | ---- | C] (Martin Allen 2002, 2005) -- C:\Windows\System32\hyperlink.ocx
[2010.09.22 20:23:50 | 000,040,960 | ---- | C] (Martin Allen 1999, 2002, 2007, 2010) -- C:\Windows\System32\allenocx.ocx
[2010.09.22 20:23:50 | 000,024,576 | ---- | C] (Martin Allen 2000) -- C:\Windows\System32\runocx.ocx
[2010.09.22 20:23:50 | 000,024,576 | ---- | C] (Martin Allen 1999) -- C:\Windows\System32\dirdlg2.ocx
[2010.09.22 20:23:47 | 000,000,000 | ---D | C] -- C:\Program Files\NoteBook
[2010.09.18 23:00:16 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2010.09.18 22:50:27 | 000,000,000 | ---D | C] -- C:\Windows\SQL9_KB970892_ENU
[2010.09.17 17:58:54 | 000,000,000 | ---D | C] -- C:\Users\Sebastian\AppData\Local\ESET
[2010.09.17 17:56:14 | 000,000,000 | ---D | C] -- C:\ProgramData\ESET
[2010.09.17 17:56:14 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2010.09.16 21:11:35 | 000,000,000 | ---D | C] -- C:\Users\Sebastian\Documents\Battlefield 2
[2010.09.16 21:00:42 | 000,000,000 | ---D | C] -- C:\Program Files\EA GAMES
[2010.09.15 21:31:57 | 000,000,000 | ---D | C] -- C:\Users\Sebastian\AppData\Roaming\Mount&Blade
[2010.09.14 16:31:20 | 000,049,536 | ---- | C] (Texas Instruments Incorporated) -- C:\Windows\System32\drivers\tiehdusb.sys
[2010.09.14 16:29:48 | 000,021,456 | ---- | C] (Texas Instruments Incorporated) -- C:\Windows\System32\drivers\SilvrLnk.sys
[2010.09.14 16:26:54 | 000,000,000 | ---D | C] -- C:\Users\Sebastian\Documents\MyTIData
[2010.09.12 18:44:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Alwil Software
[2010.09.12 18:44:37 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2010.09.10 17:45:44 | 000,000,000 | ---D | C] -- C:\Users\Sebastian\AppData\Roaming\SnapTeam
[2010.09.10 17:45:28 | 000,000,000 | ---D | C] -- C:\Program Files\Snap
[2010.09.05 14:00:08 | 000,000,000 | ---D | C] -- C:\Windows\UbiSoft
[2010.08.29 21:28:27 | 000,000,000 | ---D | C] -- C:\Program Files\CodeGazer
[2010.08.29 21:27:50 | 002,227,093 | ---- | C] (CodeGazer ) -- C:\Users\Sebastian\Documents\VistaGlazzSetup.exe
[2010.08.29 21:21:30 | 000,000,000 | ---D | C] -- C:\Users\Sebastian\Documents\wOOdy____by_dimage
[2010.08.27 06:07:47 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2010.08.19 19:31:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010.08.15 21:24:41 | 000,000,000 | ---D | C] -- C:\Program Files\StreamingStar
[2010.08.15 11:10:11 | 000,000,000 | ---D | C] -- C:\Users\Sebastian\AppData\Roaming\Leadertech
[2010.08.12 13:34:05 | 000,000,000 | ---D | C] -- C:\Program Files\McAfeeMOBK
[2010.08.12 13:33:26 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee Online Backup
[2010.08.12 13:27:11 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Mcafee
[2010.08.12 13:27:06 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee
[2010.08.12 13:24:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Media Center Programs
[2010.08.12 13:24:09 | 000,000,000 | ---D | C] -- C:\Program Files\Guild Wars
[2010.07.29 13:31:26 | 000,136,632 | ---- | C] (ESET) -- C:\Windows\System32\drivers\eamonm.sys
[2010.07.29 13:31:26 | 000,115,008 | ---- | C] (ESET) -- C:\Windows\System32\drivers\ehdrv.sys
[2010.07.29 13:31:26 | 000,096,920 | ---- | C] (ESET) -- C:\Windows\System32\drivers\epfwwfpr.sys
[9 C:\Users\Sebastian\AppData\Roaming\*.tmp files -> C:\Users\Sebastian\AppData\Roaming\*.tmp -> ]
[3 C:\Users\Sebastian\Documents\*.tmp files -> C:\Users\Sebastian\Documents\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010.10.14 12:35:00 | 000,000,430 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{9B641645-B111-46D6-A57F-38AB22586DDE}.job
[2010.10.14 12:23:29 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Sebastian\Desktop\OTL.exe
[2010.10.14 12:22:54 | 000,000,566 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Sebastian.job
[2010.10.14 12:21:38 | 000,056,832 | ---- | M] () -- C:\Users\Sebastian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.10.14 12:20:12 | 000,000,996 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.10.14 12:17:27 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.10.14 12:17:27 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.10.14 12:17:10 | 000,001,034 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4164418827-1815202133-2812620103-1003UA.job
[2010.10.14 12:16:51 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.10.13 20:13:46 | 000,000,520 | ---- | M] () -- C:\Users\Public\Desktop\Camtasia Studio 7.lnk
[2010.10.13 17:43:45 | 000,000,946 | ---- | M] () -- C:\Users\Public\Desktop\Microsoft Security Essentials.lnk
[2010.10.13 17:17:00 | 000,000,982 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4164418827-1815202133-2812620103-1003Core.job
[2010.10.13 16:40:23 | 003,878,092 | R--- | M] () -- C:\Users\Sebastian\Desktop\ComboFix.exe
[2010.10.12 19:42:05 | 000,001,235 | ---- | M] () -- C:\Users\Sebastian\Desktop\Documents.lnk
[2010.10.12 19:36:41 | 000,000,992 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.10.12 19:36:30 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml
[2010.10.12 19:24:31 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2010.10.12 12:34:53 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010.10.11 23:14:24 | 000,638,788 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.10.11 23:14:24 | 000,121,394 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.10.11 07:17:42 | 156,789,947 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010.10.07 14:40:27 | 000,000,680 | ---- | M] () -- C:\Users\Sebastian\AppData\Local\d3d9caps.dat
[2010.09.30 22:44:15 | 001,967,440 | ---- | M] () -- C:\Users\Sebastian\Documents\zynga_toolbar.exe
[2010.09.28 21:32:39 | 000,697,328 | ---- | M] (Duplex Secure Ltd.) -- C:\Windows\System32\drivers\sptd.sys
[2010.09.28 20:32:21 | 000,010,752 | ---- | M] () -- C:\Windows\System32\BASSMOD.dll
[2010.09.28 19:34:59 | 001,749,024 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.09.23 20:18:33 | 000,002,028 | ---- | M] () -- C:\Users\Sebastian\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010.09.12 18:49:51 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2010.09.01 22:48:53 | 000,000,162 | -H-- | M] () -- C:\Users\Sebastian\Documents\~$rjehdus.docx
[2010.08.29 21:27:51 | 002,227,093 | ---- | M] (CodeGazer ) -- C:\Users\Sebastian\Documents\VistaGlazzSetup.exe
[2010.08.17 02:41:05 | 000,000,258 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2010.07.29 13:31:26 | 000,136,632 | ---- | M] (ESET) -- C:\Windows\System32\drivers\eamonm.sys
[2010.07.29 13:31:26 | 000,115,008 | ---- | M] (ESET) -- C:\Windows\System32\drivers\ehdrv.sys
[2010.07.29 13:31:26 | 000,096,920 | ---- | M] (ESET) -- C:\Windows\System32\drivers\epfwwfpr.sys
[9 C:\Users\Sebastian\AppData\Roaming\*.tmp files -> C:\Users\Sebastian\AppData\Roaming\*.tmp -> ]
[3 C:\Users\Sebastian\Documents\*.tmp files -> C:\Users\Sebastian\Documents\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.10.13 20:13:46 | 000,000,520 | ---- | C] () -- C:\Users\Public\Desktop\Camtasia Studio 7.lnk
[2010.10.13 17:43:45 | 000,000,946 | ---- | C] () -- C:\Users\Public\Desktop\Microsoft Security Essentials.lnk
[2010.10.12 19:41:16 | 000,001,235 | ---- | C] () -- C:\Users\Sebastian\Desktop\Documents.lnk
[2010.10.12 07:20:59 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010.10.12 07:20:58 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010.10.12 07:20:58 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010.10.12 07:20:57 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010.10.12 07:20:57 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010.10.12 06:51:14 | 003,878,092 | R--- | C] () -- C:\Users\Sebastian\Desktop\ComboFix.exe
[2010.09.30 22:44:00 | 001,967,440 | ---- | C] () -- C:\Users\Sebastian\Documents\zynga_toolbar.exe
[2010.09.28 20:32:21 | 000,010,752 | ---- | C] () -- C:\Windows\System32\BASSMOD.dll
[2010.09.22 20:23:50 | 000,237,659 | ---- | C] () -- C:\Windows\System32\EZTW32.DLL
[2010.09.01 22:48:53 | 000,000,162 | -H-- | C] () -- C:\Users\Sebastian\Documents\~$rjehdus.docx
[2010.08.29 19:38:50 | 000,002,028 | ---- | C] () -- C:\Users\Sebastian\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010.08.27 05:44:10 | 156,789,947 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010.08.17 02:41:05 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010.07.09 22:04:40 | 000,041,872 | ---- | C] () -- C:\Windows\System32\xfcodec.dll
[2010.04.15 17:19:53 | 000,001,048 | -HS- | C] () -- C:\ProgramData\1952369025
[2010.04.15 17:19:52 | 000,000,817 | ---- | C] () -- C:\ProgramData\604936657
[2010.04.15 17:19:45 | 000,000,113 | ---- | C] () -- C:\ProgramData\sl364862227
[2010.04.15 16:16:08 | 000,029,696 | ---- | C] () -- C:\Windows\System32\pthread.dll
[2010.02.11 23:29:57 | 000,000,056 | ---- | C] () -- C:\Users\Sebastian\AppData\Roaming\748e9ed6
[2009.12.24 14:02:22 | 000,003,654 | ---- | C] () -- C:\Windows\System32\drivers\Sonyhcp.dll
[2009.11.15 09:27:29 | 000,022,528 | ---- | C] () -- C:\Windows\System32\avutil.dll
[2009.11.15 09:27:28 | 001,945,088 | ---- | C] () -- C:\Windows\System32\avcodec.dll
[2009.11.15 09:27:28 | 000,219,136 | ---- | C] () -- C:\Windows\System32\avformat.dll
[2009.10.10 12:44:45 | 000,000,063 | ---- | C] () -- C:\Windows\SIERRA.INI
[2009.09.10 22:01:53 | 000,001,114 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2009.09.08 17:49:16 | 000,139,152 | ---- | C] () -- C:\Users\Sebastian\AppData\Roaming\PnkBstrK.sys
[2009.08.03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009.04.15 17:36:10 | 000,000,680 | ---- | C] () -- C:\Users\Sebastian\AppData\Local\d3d9caps.dat
[2009.03.23 20:57:51 | 000,000,552 | ---- | C] () -- C:\Users\Sebastian\AppData\Local\d3d8caps.dat
[2009.03.22 09:50:10 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2009.03.22 09:49:39 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2009.03.21 18:37:47 | 000,056,832 | ---- | C] () -- C:\Users\Sebastian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.03.21 18:24:34 | 000,204,800 | ---- | C] () -- C:\Windows\System32\SysHook.dll
[2009.03.21 18:21:55 | 000,091,992 | ---- | C] () -- C:\Users\Sebastian\AppData\Local\edsinstaller.txt-20090321.log
[2009.03.21 18:19:35 | 000,626,688 | ---- | C] () -- C:\Windows\Image.dll
[2009.03.21 18:19:35 | 000,000,036 | ---- | C] () -- C:\Windows\PidList.ini
[2009.03.21 18:11:51 | 000,001,694 | ---- | C] () -- C:\Windows\RtDefLvl.ini
[2008.05.02 07:22:52 | 000,487,424 | ---- | C] () -- C:\Windows\System32\INT15.dll
[2008.05.02 07:20:06 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIOFM4.dll
[2008.05.02 07:20:06 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN5.dll
[2008.05.01 13:10:30 | 000,872,448 | ---- | C] () -- C:\Windows\iconv.dll
[2008.05.01 13:10:30 | 000,743,424 | ---- | C] () -- C:\Windows\libxml2.dll
[2008.05.01 13:09:55 | 000,000,042 | ---- | C] () -- C:\Windows\Prelaunch.ini
[2006.11.02 15:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 10:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2001.12.27 02:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll
[2001.11.14 13:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
[2001.09.04 09:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll
[2001.07.31 02:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll
[2001.07.24 08:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll

========== LOP Check ==========

[2010.07.06 14:00:17 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Any Video Converter
[2010.09.28 21:51:21 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\DAEMON Tools Pro
[2010.07.31 16:33:59 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\FrostWire
[2009.10.04 11:04:25 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\GetRightToGo
[2010.09.19 14:17:41 | 000,000,000 | -H-D | M] -- C:\Users\Sebastian\AppData\Roaming\ijjigame
[2010.10.11 17:05:58 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Juce VST Host
[2010.08.15 11:10:11 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Leadertech
[2010.05.17 11:25:48 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\LolClient
[2010.03.15 23:56:29 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\LolClient.F24C99354F615F3BAB18AE7B93E3F9B9E8784FA6.1
[2010.09.15 21:35:16 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Mount&Blade
[2010.05.25 16:20:20 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Mount&Blade Warband
[2009.03.26 16:12:28 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\OpenOffice.org
[2010.10.08 06:41:19 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Registry Mechanic
[2010.09.28 20:26:44 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Sakura
[2010.09.28 16:48:07 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\SnapTeam
[2010.04.22 19:34:53 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Sony
[2010.04.13 23:47:28 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\SynthMaker
[2010.06.10 22:19:25 | 000,000,000 | ---D | M] -- C:\Users\Sebastian\AppData\Roaming\Uniblue
[2010.10.12 19:24:38 | 000,032,540 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010.10.14 12:35:00 | 000,000,430 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{9B641645-B111-46D6-A57F-38AB22586DDE}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2006.09.19 00:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2008.01.21 05:24:42 | 000,333,203 | RHS- | M] () -- C:\bootmgr
[2008.02.06 02:25:41 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2010.10.13 17:10:35 | 000,015,987 | ---- | M] () -- C:\ComboFix.txt
[2006.09.19 00:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2010.04.15 17:24:28 | 000,000,000 | ---- | M] () -- C:\data.txt
[2010.05.07 19:38:58 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010.05.07 19:38:58 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2010.10.12 19:36:10 | 2962,677,760 | -HS- | M] () -- C:\pagefile.sys
[2008.06.20 12:46:24 | 000,005,393 | -HS- | M] () -- C:\Patch.rev
[2008.05.01 13:29:13 | 000,000,152 | RHS- | M] () -- C:\preload.rev
[2009.03.21 18:14:32 | 000,000,426 | ---- | M] () -- C:\RHDSetup.log

< %systemroot%\Fonts\*.com >
[2006.11.02 15:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006.11.02 15:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006.11.02 15:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006.11.02 15:37:12 | 000,030,808 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006.09.19 00:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008.01.21 05:23:14 | 000,089,600 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006.11.02 15:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006.10.26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008.01.21 05:43:21 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2008.01.21 06:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 06:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 06:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 13:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 13:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010.02.02 19:59:41 | 000,000,456 | -HS- | M] () -- C:\Users\Sebastian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010.10.13 16:40:23 | 003,878,092 | R--- | M] () -- C:\Users\Sebastian\Desktop\ComboFix.exe
[2010.10.14 12:23:29 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Sebastian\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2009.03.21 18:03:16 | 000,000,402 | -HS- | M] () -- C:\Users\Sebastian\Favorites\desktop.ini
[2010.04.25 21:36:08 | 000,000,220 | ---- | M] () -- C:\Users\Sebastian\Favorites\NCH Audio and Telephony Software.lnk

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2010.04.15 17:19:53 | 000,001,048 | -HS- | M] () -- C:\ProgramData\1952369025
[2010.04.16 17:52:12 | 000,000,817 | ---- | M] () -- C:\ProgramData\604936657
[2009.11.19 23:01:08 | 000,001,114 | ---- | M] () -- C:\ProgramData\hpzinstall.log
[2010.08.17 02:41:05 | 000,000,258 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2010.04.15 17:19:45 | 000,000,113 | ---- | M] () -- C:\ProgramData\sl364862227

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >
Acer Crystal Eye webcam.EXE

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


========== Alternate Data Streams ==========

@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:1EE00E38
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP1B5B4F1

< End of report >

 

When i started my computer just now something strange happened. The vista theme and color scheme just disappeared and instead it looks like ****. Not even the classic windows color scheme. I put up the pictures here: http://wtff.yolasite.com/
What went bad?

 

Yeah i did but nothing changed the matter. I can't use custom themes either nor aero and its something with the vista that doesn't show. Ill try to figure out what happened while i wait for your next response. Well theres the log, what next?

P.S I didn't happen while i was watching the screen, it allready looked like that when i loggen in, but the login screen looks like it should...

 

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\m3ffxtbr@mywebsearch.com deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\eRecoveryService deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\FBSSA deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Wisdom-soft AutoScreenRecorder 3.1 Pro deleted successfully.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\Windows\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
C:\Windows\A8B9466986544126BD28D0D2412CDED6.TMP folder moved successfully.
C:\Users\Sebastian\AppData\Roaming\Registry Mechanic folder moved successfully.
C:\Users\Sebastian\AppData\Roaming\206D.tmp deleted successfully.
C:\Users\Sebastian\AppData\Roaming\3841.tmp deleted successfully.
C:\Users\Sebastian\AppData\Roaming\4A6B.tmp deleted successfully.
C:\Users\Sebastian\AppData\Roaming\4C4.tmp deleted successfully.
C:\Users\Sebastian\AppData\Roaming\5280.tmp deleted successfully.
C:\Users\Sebastian\AppData\Roaming\8D74.tmp deleted successfully.
C:\Users\Sebastian\AppData\Roaming\AA52.tmp deleted successfully.
C:\Users\Sebastian\AppData\Roaming\D8B5.tmp deleted successfully.
C:\Users\Sebastian\AppData\Roaming\F9DC.tmp deleted successfully.
C:\Users\Sebastian\Documents\~WRL0003.tmp deleted successfully.
C:\Users\Sebastian\Documents\~WRL0004.tmp deleted successfully.
C:\Users\Sebastian\Documents\~WRL2412.tmp deleted successfully.
C:\Windows\msdownld.tmp folder deleted successfully.
ADS C:\ProgramData\TEMP:1EE00E38 deleted successfully.
ADS C:\ProgramData\TEMP1B5B4F1 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 134 bytes
->Flash cache emptied: 56579 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Sebastian
->Temp folder emptied: 5145062 bytes
->Temporary Internet Files folder emptied: 13665036 bytes
->Java cache emptied: 89025154 bytes
->FireFox cache emptied: 41926211 bytes
->Google Chrome cache emptied: 253265948 bytes
->Apple Safari cache emptied: 9601024 bytes
->Flash cache emptied: 233942 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2164748 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 396,00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: Sebastian
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb


OTL by OldTimer - Version 3.2.15.2 log created on 10152010_220317

Files\Folders moved on Reboot...
File\Folder C:\Windows\temp\TMP000000018C3AC53D8D38CB96 not found!

Registry entries deleted on Reboot...

 

Running security check, pc seems better, the apparence is still a problem, ESET uninstalled. Can you find out from a scan or something what has gone wrong with the apparence?

 

Results of screen317's Security Check version 0.99.5
Windows Vista Service Pack 1 (UAC is enabled)
Out of date service pack!!
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Microsoft Security Essentials
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Java(TM) 6 Update 21
Adobe Flash Player 10.1.85.3
Adobe Reader 8.2.5
Out of date Adobe Reader installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Microsoft Security Essentials msseces.exe
Microsoft Small Business Business Contact Manager BcmSqlStartupSvc.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

 

QuickScan Beta 32-bit v0.9.9.50
-------------------------------
Scan date: Fri Oct 15 23:08:47 2010
Machine ID: 240E99D1

C:\Windows\system32\ivireg.ivr - could not be scanned


No infection found.
-------------------



Processes
---------
Acer eDataSecurity Management 3604 C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
Acer ePower Management 3628 C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
Catalyst Control Centre 2476 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
Catalyst Control Centre 2904 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
DefaultSettingEXE Application 1088 C:\Windows\PLFSetI.exe
Google Chrome 3428 C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
Google Chrome 4848 C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
Google Chrome 5064 C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
Google Chrome 5120 C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
Google Chrome 5128 C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
Google Chrome 5140 C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
Google Chrome 5148 C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
Google Chrome 5276 C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
Google Chrome 5576 C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
GoogleToolbarNotifier 3960 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
HD Audio Control Panel 1068 C:\Windows\RtHDVCpl.exe
Java(TM) Platform SE Auto Updater 2 0 3904 C:\Program Files\Common Files\Java\Java Update\jusched.exe
Microsoft Security Essentials 3992 C:\Program Files\Microsoft Security Essentials\msseces.exe
Microsoft® Windows® Operating System 2132 C:\Program Files\Windows Media Player\wmpnscfg.exe
Microsoft® Windows® Operating System 3640 C:\Windows\ehome\ehmsas.exe
Microsoft® Windows® Operating System 3060 C:\Windows\ehome\ehtray.exe
Microsoft® Windows® Operating System 3876 C:\Windows\explorer.exe
Microsoft® Windows® Operating System 3740 C:\Windows\System32\dwm.exe
Microsoft® Windows® Operating System 3704 C:\Windows\System32\taskeng.exe
Microsoft® Windows® Operating System 3248 C:\Windows\System32\wbem\unsecapp.exe
NTI Backup Now 5 2532 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
Quick Search Box 3684 C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
RealPlayer (32-bit) 3800 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
Realtek HD Audio Data Rerouter 2496 C:\Users\SEBAST~1\AppData\Local\temp\RtkBtMnt.exe
Synaptics Pointing Device Driver 892 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
Windows 3700 C:\Windows\System32\wpcumi.exe


Network activity
----------------
Process chrome.exe (4848) connected on port 80 (HTTP) --> 74.125.39.105
Process chrome.exe (4848) connected on port 80 (HTTP) --> 74.125.39.113
Process chrome.exe (4848) connected on port 80 (HTTP) --> 74.125.39.113
Process chrome.exe (4848) connected on port 80 (HTTP) --> 193.184.164.176
Process chrome.exe (4848) connected on port 80 (HTTP) --> 193.184.164.192
Process chrome.exe (4848) connected on port 80 (HTTP) --> 193.184.164.192
Process chrome.exe (4848) connected on port 80 (HTTP) --> 193.184.164.192
Process chrome.exe (4848) connected on port 80 (HTTP) --> 193.184.164.192
Process chrome.exe (4848) connected on port 80 (HTTP) --> 193.184.164.192
Process chrome.exe (4848) connected on port 80 (HTTP) --> 193.184.164.192
Process chrome.exe (4848) connected on port 80 (HTTP) --> 193.184.164.183
Process chrome.exe (4848) connected on port 80 (HTTP) --> 193.184.164.158
Process chrome.exe (4848) connected on port 80 (HTTP) --> 193.184.164.158
Process chrome.exe (4848) connected on port 80 (HTTP) --> 193.184.164.158
Process chrome.exe (4848) connected on port 80 (HTTP) --> 193.184.164.158
Process chrome.exe (4848) connected on port 443 (HTTP over SSL) --> 74.125.39.95
Process chrome.exe (4848) connected on port 80 (HTTP) --> 193.184.164.158
Process chrome.exe (4848) connected on port 80 (HTTP) --> 193.184.164.158
Process chrome.exe (4848) connected on port 80 (HTTP) --> 74.125.39.113
Process chrome.exe (4848) connected on port 80 (HTTP) --> 95.100.156.20
Process chrome.exe (4848) connected on port 80 (HTTP) --> 95.100.149.115
Process chrome.exe (4848) connected on port 443 (HTTP over SSL) --> 74.125.39.132



Autoruns and critical files
---------------------------
Acer eDataSecurity Management C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
Acer ePower Management C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
Adobe Acrobat C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
Adobe Reader and Acrobat Manager C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Adobe Systems, Inc. Adobe Gamma Loader C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Catalyst® Control Center C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
DAEMON Tools Pro C:\Program Files\DAEMON Tools Pro\DTAgent.exe
DefaultSettingEXE Application C:\Windows\PLFSetI.exe
Google Update C:\Users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe
GoogleToolbarNotifier C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
HD Audio Control Panel C:\Windows\RtHDVCpl.exe
Java(TM) Platform SE Auto Updater 2 0 C:\Program Files\Common Files\Java\Java Update\jusched.exe
Launch Manager C:\Program Files\Launch Manager\LManager.exe
Microsoft Security Essentials C:\Program Files\Microsoft Security Essentials\msseces.exe
Microsoft® Windows® Operating System C:\Program Files\Windows Media Player\wmpnscfg.exe
Microsoft® Windows® Operating System C:\Windows\ehome\ehtray.exe
Microsoft® Windows® Operating System C:\Windows\System32\browseui.dll
Microsoft® Windows® Operating System c:\windows\system32\userinit.exe
MobileMe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
NTI Backup Now 5 C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
Quick Search Box C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
QuickTime C:\Program Files\QuickTime\QTTask.exe
RealPlayer (32-bit) C:\Program Files\Common Files\Real\Update_OB\realsched.exe
Synaptics Pointing Device Driver C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
Windows C:\Windows\System32\wpcumi.exe
Windows Defender C:\Program Files\Windows Defender\MSASCui.exe
Windows® Internet Explorer C:\Windows\System32\webcheck.dll
WR_PopUp C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe


Browser plugins
---------------
ijji Optimizer Application C:\Windows\Downloaded Program Files\ijjiOptimizer.exe
Acer eDataSecurity Management c:\program files\acer\empowering technology\edatasecurity\x86\edstoolbar.dll
AcroIEHelper Library c:\program files\common files\adobe\acrobat\activex\acroiehelper.dll
ActiveToolBand Module c:\program files\acer\empowering technology\edatasecurity\x86\activetoolband.dll
Adobe Acrobat C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll
Babylon Chrome Plugin C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb\1.0_0\BabylonChromePI.dll
BitDefender QuickScan C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie\0.9.9.50_0\npqscan.dll
BitDefender QuickScan C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie\0.9.9.50_0\npqslauncher.dll
Bonjour C:\Program Files\Bonjour\mdnsNSP.dll
ChannelingPluginforReactor Dynamic Link C:\Windows\Downloaded Program Files\ChannelingPluginforReactor.dll
Conduit Toolbar c:\program files\togglesw\tbtogg.dll
EA Battlefield Heroes Updater C:\Windows\Downloaded Program Files\BFHUpdater.dll
EA Battlefield Heroes Updater C:\Windows\Downloaded Program Files\BFHUpdater.exe
Facebook Photo Uploader 5 C:\Windows\Downloaded Program Files\PhotoUploader55.ocx
FFExternalAlert.dll C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\f42161rq.default\extensions\{ce18769b-c7fa-42d2-860d-17c4662c70ad}\components\FFExternalAlert.dll
FlashAX C:\Windows\Downloaded Program Files\iefax.dll
getPlus+(R) C:\Windows\Downloaded Program Files\gp.ocx
getPlusPlus for Adobe 16260 C:\Program Files\Mozilla Firefox\plugins\np_gp.dll
Google Earth Plugin C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
Google Toolbar for Internet Explorer c:\program files\google\google toolbar\googletoolbar_32.dll
Google Update C:\Program Files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
Google Update C:\Users\Sebastian\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll
GoogleToolbarNotifier C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll
ijjiPCPlugin C:\Windows\Downloaded Program Files\ijjiPCPlugin.dll
Java Deployment Toolkit 6.0.210.7 C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
Java(TM) Platform SE 6 U21 c:\program files\java\jre6\bin\jp2ssv.dll
Java(TM) Platform SE 6 U21 C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
McAfee SiteAdvisor c:\program files\mcafee\siteadvisor\mcieplg.dll
Microsoft® Windows Live Login Helper c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll
Microsoft® Windows Media Player Firefox C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
Microsoft® Windows® Operating System C:\Windows\System32\mswsock.dll
Microsoft® Windows® Operating System C:\Windows\System32\NapiNSP.dll
Microsoft® Windows® Operating System C:\Windows\System32\nlaapi.dll
Microsoft® Windows® Operating System C:\Windows\System32\pnrpnsp.dll
Microsoft® Windows® Operating System C:\Windows\System32\winrnr.dll
Microsoft® Windows® Operating System C:\Windows\System32\wshbth.dll
Mozilla Default Plug-in C:\Program Files\Mozilla Firefox\plugins\npnul32.dll
NPSWF32.dll C:\Windows\system32\Macromed\Flash\NPSWF32.dll
Pando Web Plugin C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll
PC Pitstop C:\Windows\Downloaded Program Files\pcpitstop2.dll
RadioWMPCore.dll C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\f42161rq.default\extensions\{ce18769b-c7fa-42d2-860d-17c4662c70ad}\components\RadioWMPCore.dll
RealJukebox NS Plugin C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll
RealJukebox NS Plugin C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
RealPlayer Download and Record Plugin c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
RealPlayer Version Plugin C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll
RealPlayer Version Plugin C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
RealPlayer(tm) G2 LiveConnect-Enabled P C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
RealPlayer(tm) G2 LiveConnect-Enabled P C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
RealPlayer(tm) HTML5VideoShim Plug-In ( C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
Shockwave for Director C:\Windows\system32\Adobe\Director\np32dsw.dll
Windows Presentation Foundation C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
Windows® Internet Explorer C:\Windows\System32\ieframe.dll


Missing files
-------------
File not found: C:\Users\SEBAST~1\AppData\Local\Temp\catchme.sys
--> HKLM\System\ControlSet001\services\catchme\ "ImagePath "

File not found: C:\Windows\System32\appmgmts.dll
--> HKLM\System\ControlSet001\services\AppMgmt\Parameters\ "ServiceDll "

File not found: system32\DRIVERS\ipinip.sys
--> HKLM\System\ControlSet001\services\IpInIp\ "ImagePath "

File not found: system32\DRIVERS\nwlnkflt.sys
--> HKLM\System\ControlSet001\services\NwlnkFlt\ "ImagePath "

File not found: system32\DRIVERS\nwlnkfwd.sys
--> HKLM\System\ControlSet001\services\NwlnkFwd\ "ImagePath "


Scan
----


No file uploaded.

Scan finished - communication took 5 sec
Total traffic - 0.06 MB sent, 1.30 KB recvd
Scanned 1267 files and modules - 138 seconds

==============================================================================

 

Adobe reader updated to 9.4.0.