Inactive Data Execution Prevention closing IE, AVG, etc.

NYRhock · 2011/04/09

Ran without the script, still hung up on the certutil.exe file.

broni · 2011/04/09

Try safe mode.

NYRhock · 2011/04/09

Otl

OTL logfile created on: 4/9/2011 6:21:14 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Rick\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 85.00% Memory free
6.00 Gb Paging File | 6.00 Gb Available in Paging File | 96.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 287.21 Gb Total Space | 148.95 Gb Free Space | 51.86% Space Free | Partition Type: NTFS
Drive D: | 10.88 Gb Total Space | 1.82 Gb Free Space | 16.70% Space Free | Partition Type: NTFS

Computer Name: RICK-LAPTOP | User Name: Rick | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/04/09 18:17:48 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Rick\Desktop\OTL.exe

========== Modules (SafeList) ==========

MOD - [2011/04/09 18:17:48 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Rick\Desktop\OTL.exe
MOD - [2010/08/31 08:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - [2011/02/15 05:38:06 | 007,421,280 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011/02/08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd)
SRV - [2011/02/08 05:33:40 | 002,707,512 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files\AVG\AVG10\avgfws.exe -- (avgfws)
SRV - [2010/03/15 12:50:36 | 001,142,224 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Program Files\Spyware Doctor\pctsSvc.exe -- (sdCoreService)
SRV - [2010/03/11 12:09:22 | 000,366,840 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Program Files\Spyware Doctor\pctsAuxs.exe -- (sdAuxService)
SRV - [2010/02/02 10:13:54 | 000,070,928 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Program Files\Spyware Doctor\TFEngine\TFService.exe -- (ThreatFire)
SRV - [2010/01/22 09:56:24 | 000,112,592 | ---- | M] (Threat Expert Ltd.) [Auto | Stopped] -- C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe -- (Browser Defender Update Service)
SRV - [2009/11/13 04:31:14 | 000,092,008 | ---- | M] (TomTom) [Auto | Stopped] -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2009/10/16 05:06:30 | 000,589,824 | ---- | M] ( ) [Auto | Stopped] -- C:\Windows\System32\lxducoms.exe -- (lxdu_device)
SRV - [2009/10/16 04:53:43 | 000,094,208 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\spool\DRIVERS\W32X86\3\\lxduserv.exe -- (lxduCATSCustConnectService)
SRV - [2008/10/06 09:54:52 | 000,365,952 | ---- | M] () [Auto | Stopped] -- C:\Program Files\SMINST\BLService.exe -- (Recovery Service for Windows)
SRV - [2008/01/20 19:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

========== Driver Services (SafeList) ==========

DRV - [2011/03/30 17:16:52 | 000,134,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV - [2011/03/01 14:25:18 | 000,034,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Stopped] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011/02/22 08:12:38 | 000,022,992 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH)
DRV - [2011/02/10 07:54:00 | 000,296,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2011/02/10 07:53:30 | 000,028,624 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AVGIDSShim.sys -- (AVGIDSShim)
DRV - [2011/02/10 07:53:28 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV - [2011/01/19 04:32:56 | 000,032,464 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86)
DRV - [2011/01/07 06:41:46 | 000,248,656 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2010/09/30 21:03:18 | 000,063,360 | ---- | M] (PC Tools) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pctplsg.sys -- (pctplsg)
DRV - [2010/09/30 21:03:16 | 000,218,592 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\PCTCore.sys -- (PCTCore)
DRV - [2010/07/12 04:34:02 | 000,054,112 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgfwd6x.sys -- (Avgfwfd)
DRV - [2010/04/04 10:29:33 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Stopped] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010/02/05 09:17:56 | 000,233,136 | ---- | M] (PC Tools) [Kernel | System | Running] -- C:\Windows\System32\drivers\pctgntdi.sys -- (pctgntdi)
DRV - [2010/02/02 10:13:54 | 000,059,664 | --S- | M] (PC Tools) [Kernel | Boot | Stopped] -- C:\Windows\system32\drivers\TfSysMon.sys -- (TfSysMon)
DRV - [2010/02/02 10:13:54 | 000,051,984 | --S- | M] (PC Tools) [Kernel | Boot | Stopped] -- C:\Windows\system32\drivers\TfFsMon.sys -- (TfFsMon)
DRV - [2010/02/02 10:13:54 | 000,033,552 | --S- | M] (PC Tools) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TfNetMon.sys -- (TfNetMon)
DRV - [2009/12/14 08:12:34 | 000,126,976 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)
DRV - [2008/06/10 11:54:36 | 000,123,904 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2008/06/05 09:58:42 | 000,222,208 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)
DRV - [2008/04/27 12:07:44 | 000,909,824 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008/01/20 19:23:21 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2008/01/20 19:23:20 | 002,225,664 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2007/10/17 16:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/06/18 17:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV - [2006/11/08 00:02:40 | 000,024,064 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\point32k.sys -- (Point32)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-614917396-159115435-229139963-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-614917396-159115435-229139963-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKU\S-1-5-21-614917396-159115435-229139963-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-614917396-159115435-229139963-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 79 01 F7 FB 01 F7 CB 01 [binary data]
IE - HKU\S-1-5-21-614917396-159115435-229139963-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-614917396-159115435-229139963-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:7
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:2.5.8.6
FF - prefs.js..extensions.enabledItems: {aac4043a-8832-4abe-9963-35377f30b8e6}:2.6.0.15
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.11.3.15590
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1209
FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.80
FF - prefs.js..network.proxy.no_proxies_on: "*.local "

FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/04/09 16:36:31 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/02 10:33:05 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/02 10:33:05 | 000,000,000 | ---D | M]

[2010/05/23 22:52:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rick\AppData\Roaming\Mozilla\Extensions
[2009/12/27 09:23:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rick\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
[2011/04/09 16:18:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rick\AppData\Roaming\Mozilla\Firefox\Profiles\tpivn49n.default\extensions
[2010/07/04 07:29:40 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Rick\AppData\Roaming\Mozilla\Firefox\Profiles\tpivn49n.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/05/23 22:57:00 | 000,000,000 | ---D | M] (Zynga Toolbar) -- C:\Users\Rick\AppData\Roaming\Mozilla\Firefox\Profiles\tpivn49n.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
[2010/05/23 23:07:43 | 000,000,000 | ---D | M] (Castle Age Toolbar) -- C:\Users\Rick\AppData\Roaming\Mozilla\Firefox\Profiles\tpivn49n.default\extensions\{aac4043a-8832-4abe-9963-35377f30b8e6}
[2011/04/02 16:04:10 | 000,000,000 | ---D | M] (BitDefender QuickScan) -- C:\Users\Rick\AppData\Roaming\Mozilla\Firefox\Profiles\tpivn49n.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2011/04/01 18:54:19 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/09/30 21:30:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/04/12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2011/04/09 14:58:45 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O3 - HKLM\..\Toolbar: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files\MSN\Toolbar\3.0.0541.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKU\S-1-5-21-614917396-159115435-229139963-1000\..\Toolbar\ShellBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKU\S-1-5-21-614917396-159115435-229139963-1000\..\Toolbar\WebBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
O3 - HKU\S-1-5-21-614917396-159115435-229139963-1000\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [EverioService] C:\Program Files\CyberLink\PCM4Everio\EverioService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [Lexmark 5600-6600 Series Fax Server] C:\Program Files\Lexmark 5600-6600 Series\fm3032.exe ()
O4 - HKLM..\Run: [lxduamon] C:\Program Files\Lexmark 5600-6600 Series\lxduamon.exe ()
O4 - HKLM..\Run: [lxdumon.exe] C:\Program Files\Lexmark 5600-6600 Series\lxdumon.exe ()
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDIRShortCut] C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-614917396-159115435-229139963-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-614917396-159115435-229139963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O15 - HKU\.DEFAULT\..Trusted Ranges: Range1 ([http] in Local intranet)
O15 - HKU\S-1-5-18\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {140E4DF8-9E14-4A34-9577-C77561ED7883} http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.1.71.0.cab (SysInfo Class)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} http://simcity.ea.com/update/EARTPX.cab (EARTPatchX Class)
O16 - DPF: {588031A3-94BF-4CDD-86D0-939F6F93910F} https://fixit.support.microsoft.com/ActiveX/FixItClient.CAB (FixItClient Class)
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {997C5A94-77F6-427D-A388-AC2B6ECF0F7C} https://www.mnlife.com/LifeSolutionsUpdate/setup.ocx (InstallShield Setup Player V14)
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab (MaxisSimCity4PatcherX Control)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Java Plug-in 1.5.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} http://www.cvsphoto.com/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab (Photo Upload Plugin Class)
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com/activex/ractrl.cab?lmi=100 (Performance Viewer Activex Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img35.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img35.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 14:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/09 18:17:48 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Rick\Desktop\OTL.exe
[2011/04/09 16:36:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2011
[2011/04/09 16:33:34 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG10
[2011/04/09 16:33:34 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\AVG
[2011/04/09 15:03:15 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/04/09 15:03:12 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011/04/09 13:19:56 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/04/08 20:12:51 | 000,000,000 | ---D | C] -- C:\Users\Rick\Desktop\DW7
[2011/04/03 07:18:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shockwave.com
[2011/04/03 07:18:03 | 000,000,000 | ---D | C] -- C:\Program Files\Shockwave.com
[2011/04/02 16:53:09 | 000,000,000 | ---D | C] -- C:\Users\Rick\AppData\Local\ElevatedDiagnostics
[2011/04/02 16:51:01 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft ATS
[2011/04/02 16:43:32 | 000,000,000 | ---D | C] -- C:\5ff93114ae7cf74bf0a9fb925f8c5153
[2011/04/02 16:06:10 | 000,000,000 | ---D | C] -- C:\Users\Rick\AppData\Roaming\QuickScan
[2011/04/02 13:49:57 | 000,000,000 | ---D | C] -- C:\Program Files\DLL Cure
[2011/04/02 08:34:23 | 000,000,000 | ---D | C] -- C:\Program Files\PC HealthPack
[2011/03/30 17:16:52 | 000,134,480 | ---- | C] (AVG Technologies CZ, s.r.o. ) -- C:\Windows\System32\drivers\AVGIDSDriver.sys
[2011/03/26 00:32:56 | 000,000,000 | ---D | C] -- C:\Users\Rick\Desktop\Dragon Quest 6 (J)
[2011/03/24 23:44:28 | 000,000,000 | ---D | C] -- C:\Users\Rick\Desktop\npr_dq6e
[2011/03/24 22:37:07 | 000,000,000 | ---D | C] -- C:\Users\Rick\Desktop\lips101
[2010/12/06 17:31:08 | 000,409,600 | ---- | C] ( ) -- C:\Windows\System32\lxducoin.dll
[2010/12/06 17:16:16 | 000,446,464 | ---- | C] ( ) -- C:\Windows\System32\LXDUhcp.dll
[2010/12/06 17:16:15 | 001,069,056 | ---- | C] ( ) -- C:\Windows\System32\lxduserv.dll
[2010/12/06 17:16:15 | 000,860,160 | ---- | C] ( ) -- C:\Windows\System32\lxduusb1.dll
[2010/12/06 17:16:15 | 000,364,544 | ---- | C] ( ) -- C:\Windows\System32\lxduinpa.dll
[2010/12/06 17:16:15 | 000,339,968 | ---- | C] ( ) -- C:\Windows\System32\lxduiesc.dll
[2010/12/06 17:16:14 | 000,651,264 | ---- | C] ( ) -- C:\Windows\System32\lxdupmui.dll
[2010/12/06 17:16:14 | 000,577,536 | ---- | C] ( ) -- C:\Windows\System32\lxdulmpm.dll
[2010/12/06 17:16:13 | 000,684,032 | ---- | C] ( ) -- C:\Windows\System32\lxduhbn3.dll
[2010/12/06 17:16:13 | 000,323,584 | ---- | C] ( ) -- C:\Windows\System32\lxduih.exe
[2010/12/06 17:16:11 | 000,761,856 | ---- | C] ( ) -- C:\Windows\System32\lxducomc.dll
[2010/12/06 17:16:11 | 000,589,824 | ---- | C] ( ) -- C:\Windows\System32\lxducoms.exe
[2010/12/06 17:16:11 | 000,376,832 | ---- | C] ( ) -- C:\Windows\System32\lxducomm.dll
[2010/12/06 17:16:11 | 000,364,544 | ---- | C] ( ) -- C:\Windows\System32\lxducfg.exe
[2010/08/25 18:59:08 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll

========== Files - Modified Within 30 Days ==========

[2011/04/09 18:20:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/04/09 18:17:48 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Rick\Desktop\OTL.exe
[2011/04/09 18:17:24 | 000,000,284 | ---- | M] () -- C:\ProgramData\hpqp.ini
[2011/04/09 18:13:33 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/04/09 18:13:33 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/04/09 18:13:25 | 000,000,878 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/09 18:13:07 | 000,396,752 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/04/09 18:06:36 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/09 16:47:44 | 112,052,125 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2011/04/09 16:47:44 | 000,649,963 | ---- | M] () -- C:\Windows\System32\drivers\AVG\iavifw.avm
[2011/04/09 16:36:35 | 000,000,830 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2011.lnk
[2011/04/09 14:58:45 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011/04/09 08:06:22 | 000,080,384 | ---- | M] () -- C:\Users\Rick\Desktop\MBRCheck.exe
[2011/04/08 21:35:28 | 335,324,093 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011/04/05 18:41:16 | 000,604,502 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/04/05 18:41:16 | 000,104,170 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/04/03 07:18:15 | 000,001,692 | ---- | M] () -- C:\Users\Public\Desktop\Shockwave Games.lnk
[2011/04/03 07:18:15 | 000,001,040 | ---- | M] () -- C:\Users\Public\Desktop\Diego's Dinosaur Rescue.lnk
[2011/04/02 16:24:35 | 000,001,356 | ---- | M] () -- C:\Users\Rick\AppData\Local\d3d9caps.dat
[2011/04/02 09:50:10 | 000,000,258 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2011/04/01 19:02:31 | 000,000,943 | ---- | M] () -- C:\Users\Rick\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/04/01 18:54:04 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat
[2011/04/01 18:54:04 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat
[2011/04/01 18:53:42 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2011/03/31 19:01:06 | 000,082,432 | ---- | M] () -- C:\Users\Rick\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/03/30 17:16:52 | 000,134,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) -- C:\Windows\System32\drivers\AVGIDSDriver.sys
[2011/03/22 10:07:03 | 000,000,318 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForRick.job
[2011/03/15 18:22:47 | 000,616,448 | ---- | M] () -- C:\Users\Rick\Desktop\CLC Brochure.pub

========== Files Created - No Company Name ==========

[2011/04/09 16:47:44 | 112,052,125 | ---- | C] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2011/04/09 16:47:44 | 000,649,963 | ---- | C] () -- C:\Windows\System32\drivers\AVG\iavifw.avm
[2011/04/09 16:36:35 | 000,000,830 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2011.lnk
[2011/04/09 08:06:22 | 000,080,384 | ---- | C] () -- C:\Users\Rick\Desktop\MBRCheck.exe
[2011/04/03 07:18:15 | 000,001,692 | ---- | C] () -- C:\Users\Public\Desktop\Shockwave Games.lnk
[2011/04/03 07:18:15 | 000,001,040 | ---- | C] () -- C:\Users\Public\Desktop\Diego's Dinosaur Rescue.lnk
[2011/04/02 09:50:10 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2011/04/01 18:53:42 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2011/03/15 18:22:45 | 000,616,448 | ---- | C] () -- C:\Users\Rick\Desktop\CLC Brochure.pub
[2010/12/17 22:42:38 | 000,000,535 | ---- | C] () -- C:\Windows\eReg.dat
[2010/12/06 17:27:45 | 000,040,960 | ---- | C] () -- C:\Windows\System32\lxduvs.dll
[2010/12/06 17:23:31 | 000,081,920 | ---- | C] () -- C:\Windows\System32\lxducaps.dll
[2010/12/06 17:23:30 | 001,036,288 | ---- | C] () -- C:\Windows\System32\lxdudrs.dll
[2010/12/06 17:23:30 | 000,069,632 | ---- | C] () -- C:\Windows\System32\lxducnv4.dll
[2010/12/06 17:22:58 | 000,045,056 | ---- | C] () -- C:\Windows\System32\LXDUPMON.DLL
[2010/12/06 17:22:58 | 000,032,768 | ---- | C] () -- C:\Windows\System32\LXDUFXPU.DLL
[2010/12/06 17:22:38 | 000,086,016 | ---- | C] () -- C:\Windows\System32\lxduoem.dll
[2010/12/06 17:19:04 | 000,000,044 | ---- | C] () -- C:\Windows\System32\lxdurwrd.ini
[2010/12/06 17:16:17 | 000,389,120 | ---- | C] () -- C:\Windows\System32\LXDUinst.dll
[2010/12/06 17:16:13 | 000,208,896 | ---- | C] () -- C:\Windows\System32\lxdugrd.dll
[2010/09/30 20:39:59 | 000,767,952 | ---- | C] () -- C:\Windows\BDTSupport.dll
[2010/05/08 20:31:24 | 000,000,121 | ---- | C] () -- C:\Windows\SIERRA.INI
[2010/04/25 16:26:23 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll
[2010/03/31 15:37:16 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2010/03/31 15:37:16 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2010/03/31 15:37:16 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2010/03/31 14:53:18 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2010/03/31 14:47:06 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll
[2010/03/31 14:47:06 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll
[2010/02/02 09:15:52 | 000,000,911 | ---- | C] () -- C:\Windows\STA2.ini
[2010/02/02 09:12:53 | 000,000,153 | ---- | C] () -- C:\Windows\ACROREAD.INI
[2009/09/10 14:35:01 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009/09/10 14:35:00 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
[2009/06/26 21:18:33 | 000,116,840 | ---- | C] () -- C:\Windows\hpqins00.dat
[2009/06/19 15:02:59 | 000,000,246 | ---- | C] () -- C:\Windows\ODBC.INI
[2009/06/19 15:02:59 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2009/05/14 14:29:30 | 000,008,520 | ---- | C] () -- C:\Windows\System32\ractrlkeyhook.dll
[2009/04/13 20:50:16 | 000,023,888 | ---- | C] () -- C:\Users\Rick\AppData\Roaming\UserTile.png
[2009/03/22 19:36:16 | 000,133,426 | ---- | C] () -- C:\Windows\hppins20.dat
[2009/03/22 19:35:56 | 000,016,655 | ---- | C] () -- C:\Windows\hppmdl20.dat
[2009/03/14 18:07:14 | 000,001,356 | ---- | C] () -- C:\Users\Rick\AppData\Local\d3d9caps.dat
[2009/02/28 21:38:22 | 000,082,432 | ---- | C] () -- C:\Users\Rick\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/02/28 20:09:19 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Pipe Organ
[2009/02/28 20:09:19 | 000,000,268 | RH-- | C] () -- C:\Users\Rick\AppData\Roaming\Piano Hard
[2009/02/28 20:09:19 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Podcasting
[2009/02/28 20:09:18 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdu.DAT
[2009/01/15 11:18:02 | 000,000,284 | ---- | C] () -- C:\ProgramData\hpqp.ini
[2008/10/23 02:56:12 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/07/06 13:29:46 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1518.dll
[2008/07/06 13:14:06 | 000,147,172 | ---- | C] () -- C:\Windows\System32\igfcg550.bin
[2008/06/29 07:52:14 | 000,005,120 | ---- | C] () -- C:\Windows\System32\HdmiCoin.dll
[2006/11/02 05:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 05:47:37 | 000,396,752 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 05:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 03:33:01 | 000,604,502 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 03:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 03:33:01 | 000,104,170 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 03:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 03:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 01:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 01:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 00:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 00:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006/03/09 02:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2002/02/27 17:50:00 | 000,197,120 | ---- | C] () -- C:\Windows\System32\patchw32.dll

========== LOP Check ==========

[2010/12/07 13:09:01 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\5600-6600 Series
[2009/03/05 17:21:12 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\aAvgApi
[2010/09/30 13:28:56 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\AVG10
[2010/05/17 02:10:08 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\AVG9
[2010/05/17 22:54:09 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\Azureus
[2010/05/14 10:37:52 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\Boolat Games
[2010/04/04 12:05:41 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\DAEMON Tools Lite
[2010/10/05 23:49:24 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\E8C88E442083185FE8F7CEA12A070E77
[2011/03/26 21:07:09 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\FrostWire
[2011/02/18 00:28:29 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\GetRightToGo
[2010/10/13 08:16:45 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\ICAClient
[2010/04/16 20:57:59 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\Image Zone Express
[2010/12/29 09:20:57 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\Lexmark Productivity Studio
[2010/09/30 18:45:02 | 000,000,000 | -HSD | M] -- C:\Users\Rick\AppData\Roaming\lowsec
[2009/09/30 21:08:08 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\LucasArts
[2009/07/06 00:06:58 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\Nikon
[2009/04/13 20:50:16 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\PeerNetworking
[2009/09/30 21:42:56 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\Petroglyph
[2010/04/16 20:57:58 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\Printer Info Cache
[2011/04/02 16:06:17 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\QuickScan
[2009/04/28 22:20:05 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\Research In Motion
[2009/12/27 09:23:22 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\TomTom
[2010/11/14 00:25:17 | 000,000,000 | ---D | M] -- C:\Users\Rick\AppData\Roaming\WildTangent
[2011/04/09 16:38:41 | 000,032,630 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Files - Unicode (All) ==========
[2010/07/09 18:10:29 | 000,000,036 | ---- | M] ()(C:\Windows\System32\?s) -- C:\Windows\System32\휘ś
[2010/07/09 18:10:29 | 000,000,036 | ---- | C] ()(C:\Windows\System32\?s) -- C:\Windows\System32\휘ś
[2010/02/16 10:38:47 | 000,000,036 | ---- | M] ()(C:\Windows\System32\?s) -- C:\Windows\System32\ŝ
[2010/02/16 10:38:47 | 000,000,036 | ---- | C] ()(C:\Windows\System32\?s) -- C:\Windows\System32\ŝ
[2010/01/31 15:16:11 | 000,000,036 | ---- | M] ()(C:\Windows\System32\?r) -- C:\Windows\System32\텐ŕ
[2010/01/31 15:16:11 | 000,000,036 | ---- | C] ()(C:\Windows\System32\?r) -- C:\Windows\System32\텐ŕ
[2010/01/26 21:42:32 | 000,000,036 | ---- | M] ()(C:\Windows\System32\?L) -- C:\Windows\System32\子Ļ
[2010/01/26 21:42:32 | 000,000,036 | ---- | C] ()(C:\Windows\System32\?L) -- C:\Windows\System32\子Ļ

========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Users\Rick\Downloads\Documents\Office2007TrialActivationKey.txt:Roxio EMC Stream
@Alternate Data Stream - 230 bytes -> C:\ProgramData\Temp:583FE1DA
@Alternate Data Stream - 227 bytes -> C:\ProgramData\Temp:C76CFF82
@Alternate Data Stream - 224 bytes -> C:\ProgramData\Temp:71112705
@Alternate Data Stream - 214 bytes -> C:\ProgramData\Temp:409A775B
@Alternate Data Stream - 210 bytes -> C:\ProgramData\Temp:225CD7D5
@Alternate Data Stream - 208 bytes -> C:\ProgramData\Temp:61F0C8FB
@Alternate Data Stream - 207 bytes -> C:\ProgramData\Temp:E7B49FBF
@Alternate Data Stream - 205 bytes -> C:\ProgramData\Temp:3DF63AD7
@Alternate Data Stream - 203 bytes -> C:\ProgramData\Temp:A05F750A
@Alternate Data Stream - 200 bytes -> C:\ProgramData\TempFC3B090
@Alternate Data Stream - 199 bytes -> C:\ProgramData\Temp31BE97C
@Alternate Data Stream - 197 bytes -> C:\ProgramData\Temp:40D8F125
@Alternate Data Stream - 192 bytes -> C:\ProgramData\TempFC5A2B2
@Alternate Data Stream - 185 bytes -> C:\ProgramData\Temp:5E9B629B
@Alternate Data Stream - 142 bytes -> C:\ProgramData\Temp:0B4227B4
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TempEF2E739
@Alternate Data Stream - 109 bytes -> C:\ProgramData\Temp:A8ADE5D8

< End of report >

NYRhock · 2011/04/09

Extras (from OTL)

OTL Extras logfile created on: 4/9/2011 6:21:14 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Rick\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 85.00% Memory free
6.00 Gb Paging File | 6.00 Gb Available in Paging File | 96.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 287.21 Gb Total Space | 148.95 Gb Free Space | 51.86% Space Free | Partition Type: NTFS
Drive D: | 10.88 Gb Total Space | 1.82 Gb Free Space | 16.70% Space Free | Partition Type: NTFS

Computer Name: RICK-LAPTOP | User Name: Rick | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02D8D899-E6A0-4218-AF02-9698C348F876}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{068FA43F-583D-4CDC-93E1-D7496E8171FB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{106BA5B3-CDC3-47BA-AC31-56690B8D1DE7}" = lport=10244 | protocol=6 | dir=in | app=system |
"{108A69D8-357F-434A-94D1-5F99695448E4}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{1D93E93C-FB37-48DE-B9F6-A66453073790}" = lport=10244 | protocol=6 | dir=in | app=system |
"{1F063066-C504-4595-96E0-6614C985E12B}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{30C1E8EA-00C6-4A91-8558-900616B4B780}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3C86A963-C1CB-4C44-94F2-367FAD47B7B1}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{40C11B43-4062-45DF-B9BC-E899EBF1AE9C}" = rport=10244 | protocol=6 | dir=out | app=system |
"{4610F2F3-976C-4BDF-A469-3A63E7FBB1B8}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{492CC834-713F-434F-BBEC-3B25A9CBB473}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4A3972ED-FB18-47EE-BAF9-1D09303B4962}" = lport=3390 | protocol=6 | dir=in | app=system |
"{77333D62-1AB5-4052-B9C7-0BB0E893F953}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8D6BA864-66F8-4925-9D30-10FF776FC3FC}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9145933B-94E6-4856-93D7-EDEC87E14B65}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{9BE39129-B2C5-4EE3-8615-F807AE5857B5}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{9FFE9441-0DE6-459F-ADC3-E427E6286623}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{BB7686D6-08FC-4542-8AF9-11F8E1B17280}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BCC9476E-230A-4A7F-A06D-6128887906F7}" = lport=3390 | protocol=6 | dir=in | app=system |
"{F03E875B-9E8F-4A31-9FAE-EE430FCF43A9}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F75A1CDB-34A7-443A-888B-F69BB447DFE1}" = rport=10244 | protocol=6 | dir=out | app=system |
"{F83063BD-C3CC-413B-B3D1-C6BF94DA8749}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04FE3661-4F46-4ECF-8982-A703658C2F03}" = protocol=17 | dir=in | app=c:\program files\cyberlink\pcm4everio\everioservice.exe |
"{0D9A8F4F-1DAA-4936-93A4-C3709D9C69B5}" = dir=in | app=c:\program files\hp\quickplay\qpservice.exe |
"{0FB9A865-8B00-4A58-98E6-F791581D95EC}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe |
"{11898436-4C9F-4245-AAFA-A46E782C8515}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe |
"{12B7A1E1-813A-417E-B3D2-5B825DDFD20C}" = dir=in | app=c:\program files\avg\avg8\avgemc.exe |
"{16D1F7DD-44C8-41FB-B3FF-CA91BC8F1134}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe |
"{1A6B4B52-8646-4BBD-8A13-27E8A7832574}" = protocol=17 | dir=in | app=c:\program files\lexmark 5600-6600 series\lxdufax.exe |
"{1B8CFC77-5727-4F89-8D06-6F9AB52E98C6}" = protocol=6 | dir=in | app=c:\program files\lexmark 5600-6600 series\lxduamon.exe |
"{250D2A18-F0D7-43B5-8F28-7EB2A7266A97}" = dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdupswx.exe |
"{2746A0BC-0141-4315-A429-EFE871B0A5D3}" = protocol=6 | dir=in | app=c:\program files\cyberlink\pcm4everio\everioservice.exe |
"{29822E3F-FC99-4593-8DF9-5D0CB6B52DA0}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{29E24543-74B9-4866-8C64-F8DB69D2AD6D}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgam.exe |
"{2A1B3767-F3F4-4801-91C0-CC85B650022E}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe |
"{2CD5701E-5155-442A-BC13-6D524CBF1E01}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgam.exe |
"{3053D97C-241E-4AC5-9170-CB3FF8399023}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
"{31B79435-CE22-4EA0-9130-80E43A84A335}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgdiagex.exe |
"{3B8E9C1D-2482-4395-9E41-ACA55B7F9790}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{3EECFD57-3FA1-418A-9D2C-C29A229B1E67}" = protocol=6 | dir=in | app=c:\program files\cyberlink\pcm4everio\pcm4everio.exe |
"{43C819DA-6F14-427C-BA9B-C7926954FC1B}" = dir=in | app=c:\program files\avg\avg8\avgnsx.exe |
"{4C4A5C78-2126-4815-864F-0D52AFD25E9A}" = dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdutime.exe |
"{57B03357-D5FA-41AC-BB1B-EAAC81BDD290}" = protocol=17 | dir=in | app=c:\windows\system32\lxducoms.exe |
"{5A85E359-9D73-4AD0-8436-4FB8F9907EF1}" = dir=in | app=c:\program files\hp\quickplay\qp.exe |
"{62854270-C589-48B0-9BAF-B50F89AEFF77}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgam.exe |
"{6488101D-70EA-4629-8042-C5282E5D84F6}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{6C9B654F-7351-4EB2-BCD0-42B86668BE47}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgam.exe |
"{7A24AEFC-D9DE-4B32-B26A-346390274605}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe |
"{7CC67158-C6E7-42A0-8246-97780C980753}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe |
"{7F359776-0989-4F7A-8A82-BFB181F64D87}" = dir=in | app=c:\program files\avg\avg8\avgam.exe |
"{83766235-776A-44E7-A9D3-8B63EA8C4A18}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{85BB0B57-941A-4FF6-88A1-D1AF1B776811}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe |
"{8D22D84F-8EE2-4A8A-ACF3-9C3A74889409}" = dir=in | app=c:\program files\avg\avg8\avgdiagex.exe |
"{8D4EBEA6-F2F0-4589-8617-3E1F9281671C}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgdiagex.exe |
"{9CE7B05F-0981-448E-BD80-424CFF24E758}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe |
"{A1510933-AC2F-4706-A48D-D30CCE5CC663}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |
"{A31E10BA-1AFD-4373-8E69-4CA6999C6C65}" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe |
"{A68AC95F-0E7E-4DA0-87CB-FDA690467B5B}" = dir=in | app=c:\program files\cyberlink\powerdirector express\pdx.exe |
"{A7314EDA-4A92-462C-9021-5C1A750DAE7A}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |
"{AF389F5F-7852-4C23-A838-BBA4156209BF}" = protocol=6 | dir=in | app=c:\program files\lexmark 5600-6600 series\frun.exe |
"{B2DFFAA7-C7C1-415D-B133-05AA73A97EBA}" = protocol=17 | dir=in | app=c:\program files\abbyy finereader 6.0 sprint\scan\scanman6.exe |
"{B46D1276-65BF-4DAD-B793-4A3902A5E8C3}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |
"{B51D6AB5-AB52-41F6-9281-302F247DE988}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgdiagex.exe |
"{BAB0BE01-5CB8-4E15-AD59-A50082BCBC77}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{BD9BBA84-FD4C-4BE2-84C7-E69D411EEA9E}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{C46E3005-89B8-49AD-A041-6486A6B0C714}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |
"{C4D834EF-9034-4105-86D1-24C31DD2B0E5}" = protocol=17 | dir=in | app=c:\program files\lucasarts\star wars empire at war\gamedata\sweaw.exe |
"{C70428A3-33EF-47E0-A5E4-CCB4A7E6ADEF}" = protocol=6 | dir=in | app=c:\program files\abbyy finereader 6.0 sprint\scan\scanman6.exe |
"{C92790C1-4068-4940-981E-E285BC4D92C1}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{CB495DB6-EB61-4198-B236-6FA5517D1C92}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe |
"{CD7BCD46-4842-4D6F-802B-3359D871C1E9}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe |
"{CDB210DF-0A7A-413E-A444-866A42D9C025}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgdiagex.exe |
"{D0243275-757B-4974-B2BC-0611C88A1C0F}" = protocol=6 | dir=in | app=c:\program files\lexmark 5600-6600 series\lxdufax.exe |
"{D0285827-061E-48E4-8B51-A8CC6EE22EA7}" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe |
"{D376DDCF-E5BD-43E2-880C-F310374968C5}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{D6568055-26C9-48F3-98FE-3D47ABD836DF}" = protocol=17 | dir=in | app=c:\program files\lexmark 5600-6600 series\lxduamon.exe |
"{DAC9C766-0855-417E-94DB-9BFD643E5469}" = protocol=17 | dir=in | app=c:\program files\lexmark 5600-6600 series\frun.exe |
"{DAEE9790-EAD0-46DA-B05B-2CB69F693DAB}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{E0E3659E-7057-48B5-B8C0-F72EBA58D409}" = dir=in | app=c:\program files\avg\avg8\avgdiag.exe |
"{E1C5B909-3EC2-47AC-9F92-A4D80529C2B6}" = protocol=17 | dir=in | app=c:\program files\cyberlink\pcm4everio\pcm4everio.exe |
"{EE52E914-9DA5-4E17-82AC-CB8CA591E138}" = protocol=6 | dir=in | app=c:\windows\system32\lxducoms.exe |
"{F2D3C12B-F41D-4DF1-B50B-915F253F9D5E}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{F4DFE2BF-62D5-4170-8227-2F6755159CB6}" = dir=in | app=c:\program files\avg\avg8\avgupd.exe |
"{F57743EB-0125-4CF3-97FE-B0FDC722ACAA}" = dir=in | app=c:\windows\system32\lxducoms.exe |
"{F696BC7B-851C-475A-94A1-C36D4FA6F02C}" = protocol=6 | dir=in | app=c:\program files\lucasarts\star wars empire at war\gamedata\sweaw.exe |
"{F7DD2B90-D099-4576-BA9C-1E203F07B252}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0054A0F6-00C9-4498-B821-B5C9578F433E}" = HP Help and Support
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer
"{0E4BC542-9CFD-4E97-B586-9F1E5516E7B9}" = Microsoft IntelliPoint 6.1
"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software 1.14.17.1
"{0F3B05E3-EBAC-11D4-8839-0008C7E93768}" = Merlin Marketing System 09.3.3
"{1017A80C-6F09-4548-A84D-EDD6AC9525F0}" = Lexmark Toolbar
"{10812DE7-2E57-4740-B226-6B3BE34AF9D7}" = Lexmark Tools for Office
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{154A4184-1A3D-4BF9-A5AE-4FA1660445F3}" = HP Total Care Advisor
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1a387d37-a1e3-4852-8aca-841f25325284}" = Pure Vegas Casino
"{1B343C8C-F170-4829-8481-E163317C5830}" = iTunes
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"{228C6B46-64E2-404E-898A-EF0830603EF4}" = HPNetworkAssistant
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{256AEBD0-41C6-471E-92B4-B256F5176A72}" = D7100
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 20
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support
"{31BFE5B6-3699-43CC-8CFF-32CF0F1B0608}" = SplashShopper for BlackBerry
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.40 H2
"{352310C3-E46B-42D3-8F32-54721FDD72D9}" = NetZero Preloader
"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
"{3877C901-7B90-4727-A639-B6ED2DD59D43}" = ESU for Microsoft Vista
"{39CEE1F2-12B6-4C50-9131-04BFCA110578}" = PowerCinema NE for Everio
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D374523-CFDE-461A-827E-2A102E2AB365}" = Star Wars Battlefront II
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{415B2719-AD3A-4944-B404-C472DB6085B3}" = Cisco EAP-FAST Module
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP DVD Play 3.7
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{57A5AEC1-97FC-474D-92C4-908FCC2253D4}" = HP Customer Experience Enhancements
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6003F12D-6DAF-4C3F-9FFA-F4A721DC6BBF}" = AVG 2011
"{6009F2FC-EC56-4e28-B91C-0BA5104D6419}" = SF_CDA_Software
"{6423EF83-6E1D-4D22-A36F-689CD19FD4D2}" = Juno Preloader
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}" = Cisco PEAP Module
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{714B6179-84C4-4FBE-B934-B6CF75ED37A5}" = D6100_D7100_D7300_Help
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7B15D70E-9449-4CFB-B9BC-798465B2BD5C}" = Norton Internet Security
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{83770D14-21B9-44B3-8689-F7B523F94560}" = Cisco LEAP Module
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{846DDADA-0239-4B67-A6B1-33658863793B}" = HPTCSSetup
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{96384578-C6A2-4EC6-92CD-B62A60713040}" = Microsoft Live Search Toolbar
"{9718521B-A345-4ad9-A52B-74D1435FB708}" = SF_CDA_ProductContext
"{97BBECCF-B1FD-4010-8D4B-EFC9E3CCEECF}" = Driver Whiz
"{981DE354-9301-440f-AAFC-025AA2354A93}" = HP Deskjet & Photosmart Printer Driver Software 8.0.A
"{99AE7207-8612-4DBA-A8F8-BAE5C633390D}" = Star Wars Empire at War
"{9ADABDDE-9644-461B-9E73-83FA3EFCAB50}" = HP Wireless Assistant
"{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
"{9E1BAB75-EB78-440D-94C0-A3857BE2E733}" = System Requirements Lab
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A7A34FC9-DF24-4A36-00AD-D4EFE94CC116}" = SimCity 4 Deluxe
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{AD72CFB4-C2BF-424E-9DF0-C7BAD1F30A11}" = Adobe Shockwave Player
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B28759B8-5FC6-4F56-9C6C-6EDAD36455A9}" = Roxio Media Manager
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B609E018-8A33-4BA9-B3D4-C1FD5AECB88C}" = Greeting Card Factory Deluxe 2.0
"{B6D0B141-B2BE-4DD0-B08F-B9186F3E36B3}" = HP User Guides 0118
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{C3A32068-8AB1-4327-BB16-BED9C6219DC7}" = Atheros Driver Installation Program
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{C8FD5BC1-92EF-4C15-92A9-F9AC7F61985F}" = HP Update
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE5E3F15-320A-4865-97D3-F07227C5BB2F}" = BlackBerry Desktop Software 4.5
"{CE7CB214-DB11-4B5D-A6AF-3B4ED47C68B7}" = Microsoft Game Studios Common Redistributables Pack 1
"{CE7E3BE0-2DD3-4416-A690-F9E4A99A8CFF}" = HP Active Support Library
"{CF9CD37C-E29A-11D5-AE3D-005004B8E30C}" = Digital Photo Navigator 1.5
"{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component
"{D2C5E510-BE6D-42CC-9F61-E4F939078474}" = Lexmark Printable Web
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{D45E8C45-B601-4A80-AFD8-E16338744DE1}" = ArcSoft Panorama Maker 4
"{D4E53304-1F6C-4111-9872-1BCD2CF5B642}" = AVG 2011
"{D9354DD0-C69A-469A-8A48-B9AA15A74174}" = Space Quest Collection(TM)
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DD35C328-F115-BEDA-6EEE-E00C5AACCCBC}" = muvee Reveal
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{EBFEEB3F-3E3B-4725-A4E0-376144CE4F76}" = Citrix XenApp Web Plugin
"{ECEE0279-785F-4CB3-9F28-E69813234BF8}" = SPORE Creature Creator Trial Edition
"{EDE721EC-870A-11D8-9D75-000129760D75}" = PowerDirector Express
"{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
"{F0AD5544-A516-4132-A50A-A79C989AF09B}" = Midland LifeSolutions
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Graphics Media Accelerator Driver
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F7FC9307-374E-4017-8E9D-DE1154780480}" = System Requirements Lab for Intel
"{F8208405-6C68-4DC5-89F3-E850293AEEEA}" = Midland LifeSolutions
"8461-7759-5462-8226" = Vuze
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Acrobat Reader 3.02" = Adobe Acrobat Reader 3.02
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AVG" = AVG 2011
"BFG-10 Days Under The Sea" = 10 Days Under The Sea
"BFGC" = Big Fish Games: Game Manager
"BFG-Deep Blue Sea" = Deep Blue Sea
"BFG-Escape Whisper Valley" = Escape Whisper Valley
"BFG-Midnight Mysteries - Salem Witch Trials" = Midnight Mysteries: Salem Witch Trials
"BFG-Mystery Case Files - Madame Fate" = Mystery Case Files: Madame Fate ®
"BFG-Mystery Cruise" = Mystery Cruise
"BFG-Mystery Masterpiece - The Moonstone" = Mystery Masterpiece: The Moonstone
"BFG-Mystery P.I. - The Lottery Ticket" = Mystery P.I. - The Lottery Ticket
"BFG-Mystery P.I. - The Vegas Heist" = Mystery P.I.: The Vegas Heist
"BFG-Mystery PI - The New York Fortune" = Mystery P.I.: The New York Fortune
"BFG-Tiger Eye - Part I - Curse of the Riddle Box" = Tiger Eye - Part I: Curse of the Riddle Box
"Birth of the Federation" = Birth of the Federation
"BlackBerry_{CE5E3F15-320A-4865-97D3-F07227C5BB2F}" = BlackBerry Desktop Software 4.5
"Browser Defender_is1" = Browser Defender 2.0.6.15
"Caillou Ready For School" = Caillou Ready For School
"CNXT_AUDIO_HDA" = Conexant HD Audio
"CNXT_MODEM_HDAUDIO_HERMOSA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Diego's Dinosaur Rescue" = Diego's Dinosaur Rescue
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX Setup
"Freelancer 1.0" = Freelancer
"FrostWire" = FrostWire 4.18.6
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"Lexmark 5600-6600 Series" = Lexmark 5600-6600 Series
"LucasArts' Star Wars Rebellion" = LucasArts' Star Wars Rebellion
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)
"Shockwave" = Shockwave
"Spyware Doctor" = Spyware Doctor 7.0
"Star Trek Armada II" = Star Trek Armada II
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TomTom HOME" = TomTom HOME 2.7.3.1894
"WildTangent hp Master Uninstall" = My HP Games
"WinRAR archiver" = WinRAR archiver

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-614917396-159115435-229139963-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0F3B05E3-EBAC-11D4-8839-0008C7E93768}" = Merlin Marketing System 09.3.3
"Move Media Player" = Move Media Player
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.8

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 9/6/2010 7:03:15 PM | Computer Name = RICK-LAPTOP | Source = Google Update | ID = 20
Description =

Error - 9/6/2010 8:03:19 PM | Computer Name = RICK-LAPTOP | Source = Google Update | ID = 20
Description =

Error - 9/6/2010 9:03:18 PM | Computer Name = RICK-LAPTOP | Source = Google Update | ID = 20
Description =

Error - 9/6/2010 10:03:16 PM | Computer Name = RICK-LAPTOP | Source = Google Update | ID = 20
Description =

Error - 9/6/2010 11:04:30 PM | Computer Name = RICK-LAPTOP | Source = Google Update | ID = 20
Description =

Error - 9/8/2010 12:48:44 AM | Computer Name = RICK-LAPTOP | Source = WinMgmt | ID = 10
Description =

Error - 9/8/2010 4:04:27 PM | Computer Name = RICK-LAPTOP | Source = Google Update | ID = 20
Description =

Error - 9/8/2010 5:04:27 PM | Computer Name = RICK-LAPTOP | Source = Google Update | ID = 20
Description =

Error - 9/8/2010 7:22:21 PM | Computer Name = RICK-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application DivXUpdate.exe, version 1.0.1.10, time stamp
0x4c06fc6d, faulting module MSVCP80.dll, version 8.0.50727.4053, time stamp 0x4a594cd0,
exception code 0xc0000005, fault offset 0x000100b5, process id 0x93c, application
start time 0x01cb4f10d229e755.

Error - 9/8/2010 7:30:16 PM | Computer Name = RICK-LAPTOP | Source = Application Hang | ID = 1002
Description = The program wmplayer.exe version 11.0.6002.18111 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 1728 Start Time: 01cb4fad9bb76f65 Termination Time: 86

[ Media Center Events ]
Error - 3/5/2009 10:36:56 PM | Computer Name = RICK-LAPTOP | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 4/5/2009 6:42:27 PM | Computer Name = RICK-LAPTOP | Source = Mcx2Dvcs | ID = 405
Description =

Error - 4/26/2009 1:35:38 PM | Computer Name = RICK-LAPTOP | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 8/16/2009 3:36:32 AM | Computer Name = RICK-LAPTOP | Source = Mcx2Dvcs | ID = 405
Description =

[ OSession Events ]
Error - 4/19/2009 1:52:52 AM | Computer Name = RICK-LAPTOP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session
lasted 141 seconds with 120 seconds of active time. This session ended with a crash.

Error - 3/1/2011 11:56:47 PM | Computer Name = RICK-LAPTOP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session
lasted 17679 seconds with 10920 seconds of active time. This session ended with
a crash.

[ System Events ]
Error - 4/9/2011 9:20:27 PM | Computer Name = RICK-LAPTOP | Source = DCOM | ID = 10005
Description =

Error - 4/9/2011 9:20:30 PM | Computer Name = RICK-LAPTOP | Source = DCOM | ID = 10005
Description =

Error - 4/9/2011 9:20:32 PM | Computer Name = RICK-LAPTOP | Source = DCOM | ID = 10005
Description =

Error - 4/9/2011 9:20:33 PM | Computer Name = RICK-LAPTOP | Source = DCOM | ID = 10005
Description =

Error - 4/9/2011 9:20:35 PM | Computer Name = RICK-LAPTOP | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description =

Error - 4/9/2011 9:21:36 PM | Computer Name = RICK-LAPTOP | Source = Service Control Manager | ID = 7001
Description =

Error - 4/9/2011 9:21:36 PM | Computer Name = RICK-LAPTOP | Source = Service Control Manager | ID = 7001
Description =

Error - 4/9/2011 9:21:36 PM | Computer Name = RICK-LAPTOP | Source = Service Control Manager | ID = 7001
Description =

Error - 4/9/2011 9:21:36 PM | Computer Name = RICK-LAPTOP | Source = Service Control Manager | ID = 7026
Description =

Error - 4/9/2011 9:22:20 PM | Computer Name = RICK-LAPTOP | Source = Service Control Manager | ID = 7001
Description =

< End of report >

broni · 2011/04/09

1. Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

2. Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.

Accept any prompts.

===================================================

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.11.3.15590
O15 - HKU\.DEFAULT\..Trusted Ranges: Range1 ([http] in Local intranet)
O15 - HKU\S-1-5-18\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
@Alternate Data Stream - 76 bytes -> C:\Users\Rick\Downloads\Documents\Office2007TrialActivationKey.txt:Roxio EMC Stream
@Alternate Data Stream - 230 bytes -> C:\ProgramData\Temp:583FE1DA
@Alternate Data Stream - 227 bytes -> C:\ProgramData\Temp:C76CFF82
@Alternate Data Stream - 224 bytes -> C:\ProgramData\Temp:71112705
@Alternate Data Stream - 214 bytes -> C:\ProgramData\Temp:409A775B
@Alternate Data Stream - 210 bytes -> C:\ProgramData\Temp:225CD7D5
@Alternate Data Stream - 208 bytes -> C:\ProgramData\Temp:61F0C8FB
@Alternate Data Stream - 207 bytes -> C:\ProgramData\Temp:E7B49FBF
@Alternate Data Stream - 205 bytes -> C:\ProgramData\Temp:3DF63AD7
@Alternate Data Stream - 203 bytes -> C:\ProgramData\Temp:A05F750A
@Alternate Data Stream - 200 bytes -> C:\ProgramData\Temp:DFC3B090
@Alternate Data Stream - 199 bytes -> C:\ProgramData\Temp:D31BE97C
@Alternate Data Stream - 197 bytes -> C:\ProgramData\Temp:40D8F125
@Alternate Data Stream - 192 bytes -> C:\ProgramData\Temp:DFC5A2B2
@Alternate Data Stream - 185 bytes -> C:\ProgramData\Temp:5E9B629B
@Alternate Data Stream - 142 bytes -> C:\ProgramData\Temp:0B4227B4
@Alternate Data Stream - 114 bytes -> C:\ProgramData\Temp:DEF2E739
@Alternate Data Stream - 109 bytes -> C:\ProgramData\Temp:A8ADE5D8

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.
====================================================

Last scans....

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.

Click on Start button to begin cleaning process.

TFC will close all running programs, and it may ask you to restart computer.

3. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program

Tick the box next to YES, I accept the Terms of Use

Click Start

IMPORTANT! UN-check Remove found threats

Accept any security warnings from your browser.

Check Scan archives

Click Start

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan completes, push List of found threats

Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

NOTE. If Eset won't find any threats, it won't produce any log.

NYRhock · 2011/04/09

The link provided for the java update is being blocked by the DEP. Should I ignore this and continue on?

(http://www.java.com/en/download/installed.jsp)

NYRhock · 2011/04/09

The Java Quick Starter is greyed out in Note 2 as well

broni · 2011/04/09

Go ahead with next step.

NYRhock · 2011/04/09

OTL (after reboot)

All processes killed
========== OTL ==========
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ not found.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ not found.
Prefs.js: toolbar@ask.com:3.11.3.15590 removed from extensions.enabledItems
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1\\http deleted successfully.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1\\http not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\Windows\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
ADS C:\Users\Rick\Downloads\Documents\Office2007TrialActivationKey.txt:Roxio EMC Stream deleted successfully.
ADS C:\ProgramData\Temp:583FE1DA deleted successfully.
ADS C:\ProgramData\Temp:C76CFF82 deleted successfully.
ADS C:\ProgramData\Temp:71112705 deleted successfully.
ADS C:\ProgramData\Temp:409A775B deleted successfully.
ADS C:\ProgramData\Temp:225CD7D5 deleted successfully.
ADS C:\ProgramData\Temp:61F0C8FB deleted successfully.
ADS C:\ProgramData\Temp:E7B49FBF deleted successfully.
ADS C:\ProgramData\Temp:3DF63AD7 deleted successfully.
ADS C:\ProgramData\Temp:A05F750A deleted successfully.
ADS C:\ProgramData\TempFC3B090 deleted successfully.
ADS C:\ProgramData\Temp31BE97C deleted successfully.
ADS C:\ProgramData\Temp:40D8F125 deleted successfully.
ADS C:\ProgramData\TempFC5A2B2 deleted successfully.
ADS C:\ProgramData\Temp:5E9B629B deleted successfully.
ADS C:\ProgramData\Temp:0B4227B4 deleted successfully.
ADS C:\ProgramData\TempEF2E739 deleted successfully.
ADS C:\ProgramData\Temp:A8ADE5D8 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Rick
->Temp folder emptied: 13951820 bytes
->Temporary Internet Files folder emptied: 108461425 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 2747 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 23798 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 159877 bytes

Total Files Cleaned = 117.00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: Rick
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.22.3 log created on 04092011_190827

Files\Folders moved on Reboot...
C:\Users\Rick\AppData\Local\Temp\ehmsas.txt moved successfully.
C:\Users\Rick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XUNDVNLG\ads[4].htm moved successfully.
C:\Users\Rick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\JNOXZ6TO\00b42e3a-b809-49b2-b433-cc45b2bc89d33rd_party_BBS[1].htm moved successfully.
C:\Users\Rick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\JNOXZ6TO\p-01-0VIaSjnOLg[1].gif moved successfully.
C:\Users\Rick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\JNOXZ6TO\p-01-0VIaSjnOLg[2].gif moved successfully.
C:\Users\Rick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\B4400AQ1\98512-active-data-execution-prevention-closing-ie-avg-etc-2[1].htm moved successfully.
C:\Users\Rick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\485TGO87\iframescript[2].htm moved successfully.
C:\Users\Rick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\Rick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.

Registry entries deleted on Reboot...

NYRhock · 2011/04/09

Security Check

Results of screen317's Security Check version 0.99.7
Windows Vista Service Pack 2 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
AVG 2011
Norton Internet Security
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Spyware Doctor 7.0
Java(TM) 6 Update 20
Java(TM) 6 Update 7
Out of date Java installed!
Adobe Flash Player 10.0.45.2
Adobe Reader 9.3.2
Out of date Adobe Reader installed!
Mozilla Firefox (3.6.16)
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
``````````End of Log````````````

broni · 2011/04/09

I can see some Norton's leftovers.
Please, run this tool to remove them: http://us.norton.com/support/kb/web_view.jsp?wv_type=public_web&docurl=20080710133834EN

Update Adobe Reader

You can download it from http://www.adobe.com/products/acrobat/readstep2.html
After installing the latest Adobe Reader, uninstall all previous versions.
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or other garbage.

I uploaded the latest Java version installer here: http://www.filedropper.com/jre-6u24-windows-i586-s
Download and install it.
Uninstall:
Java(TM) 6 Update 20
Java(TM) 6 Update 7

...and Eset....

NYRhock · 2011/04/10

Norton has be removed. Adobe Reader is updated. ESET did not find any viruses. JAVA Platform SE Binary is being blocked by the DEP (unable to update). Also, after every startup, the HPWAMain Module is also being blocked by the DEP.

broni · 2011/04/10

At this point.....

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:
Code:
:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]
Then click the Run Fix button at the top

Let the program run unhindered, reboot the PC when it is done

Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

Double-click OTL.exe to start the program.

Close all other programs apart from OTL as this step will require a reboot

On the OTL main screen, press the CLEANUP button

Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. Run defrag at your convenience.

11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

12. Regarding any current issues...

In this forum, we make sure, your computer is free of malware and your computer is clean
Because the access to malware forum is very limited, your best option is to create new topic about your current issue, at Windows section.
You'll get more attention.

NYRhock · 2011/04/10

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Rick
->Temp folder emptied: 19074535 bytes
->Temporary Internet Files folder emptied: 36486858 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 456 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16853 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 53.00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: Rick
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.22.3 log created on 04102011_100152

Files\Folders moved on Reboot...
C:\Users\Rick\AppData\Local\Temp\ehmsas.txt moved successfully.
C:\Users\Rick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\QF3T1TAP\ads[5].htm moved successfully.
C:\Users\Rick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\QF3T1TAP\audmeasure[1].gif moved successfully.
C:\Users\Rick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\QF3T1TAP\p-01-0VIaSjnOLg[1].gif moved successfully.
C:\Users\Rick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BLPVUQEE\00b42e3a-b809-49b2-b433-cc45b2bc89d33rd_party_BBS[1].htm moved successfully.
C:\Users\Rick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\AD5RV51H\98512-active-data-execution-prevention-closing-ie-avg-etc-3[1].htm moved successfully.
C:\Users\Rick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\AD5RV51H\p-01-0VIaSjnOLg[1].gif moved successfully.
C:\Users\Rick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\Rick\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.

Registry entries deleted on Reboot...

NYRhock · 2011/04/10

I just opened a new thread under the "Windows Vista" section. I just need to know if there is anything else that needs to be done after your last post.

Admin. · 2011/04/10

I see you have P2P software ( Azures, Limewire, BitTorrent, uTorrent etcâ€¦) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections.

References for the risk of these programs are here, and here.

I would strongly recommend that you uninstall them, and read the links above for educational value!

Note: Please be advised that continued use of these programs after being warned of the danger of infections from them, may result in the discontinued help of future cleaning of your system here at WindowsBBS Malware and Virus removal.

NYRhock · 2011/04/10

That program hasn't been used in months, and my problem started over 3 weeks ago. Apparently, it isn't malware and/or virus related, so there is something that is causing the DEP to act the way it is. Advise?

broni · 2011/04/10

We're pretty much done here, so, please continue in Windows forum.

NYRhock · 2011/04/10

Cool. Thank you very much for your help. I hope that this situation can get resolved soon.

broni · 2011/04/10

You're welcome

Log in or Sign up

Inactive Data Execution Prevention closing IE, AVG, etc.

NYRhock Inactive Thread Starter

broni Moderator Malware Analyst

NYRhock Inactive Thread Starter

NYRhock Inactive Thread Starter

broni Moderator Malware Analyst

NYRhock Inactive Thread Starter

NYRhock Inactive Thread Starter

broni Moderator Malware Analyst

NYRhock Inactive Thread Starter

NYRhock Inactive Thread Starter

broni Moderator Malware Analyst

NYRhock Inactive Thread Starter

broni Moderator Malware Analyst

NYRhock Inactive Thread Starter

NYRhock Inactive Thread Starter

Admin. Administrator Administrator Staff

NYRhock Inactive Thread Starter

broni Moderator Malware Analyst

NYRhock Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Inactive Data Execution Prevention closing IE, AVG, etc.

NYRhock Inactive Thread Starter

broni Moderator Malware Analyst

NYRhock Inactive Thread Starter

NYRhock Inactive Thread Starter

broni Moderator Malware Analyst

NYRhock Inactive Thread Starter

NYRhock Inactive Thread Starter

broni Moderator Malware Analyst

NYRhock Inactive Thread Starter

NYRhock Inactive Thread Starter

broni Moderator Malware Analyst

NYRhock Inactive Thread Starter

broni Moderator Malware Analyst

NYRhock Inactive Thread Starter

NYRhock Inactive Thread Starter

Admin. Administrator Administrator Staff

NYRhock Inactive Thread Starter

broni Moderator Malware Analyst

NYRhock Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches