Solved Task Mgr says 80% of physical drive in use - does not make sense

[Resolved] Task Mgr says 80% of physical drive in use - does not make sense

Hello BBS mods and advisors,

First, thank you in advance for your help. My problem is this: In the past month, my computer went from running fine to running extremely slow and now will run no more than one program at a time without freezing and having to be restarted. I do have Microsoft Security Essentials and it scans clear, but did do the required downloads and scans as per your requirements, and will attach the logs at the end of this post. Windows Task Manager says that 80 + % of my hard drive is in use at any given time with only one window open to the internet and no other programs running. This does not make sense, as I look at my computers resources and it shows that I have less than half of my memory used. I keep deleting programs that I don't use, have looked at the start up programs and I don't see anything wrong there - I just don't know where to go from here. Thanks again for any help you can offer. Following are the logs from running the programs as directed.

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-09-02 17:07:21
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\00000052 WDC_WD50 rev.12.0
Running: 78wjbikh.exe; Driver: C:\Users\h\AppData\Local\Temp\fxldipog.sys


---- Kernel code sections - GMER 1.0.15 ----

? c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4EE0BF94-E0DE-43C8-A6FC-F791D57CF843}\MpKsl3b20f9ef.sys The system cannot find the file specified. !

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\Explorer.EXE[3904] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [6F8D7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3904] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [6F92A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3904] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [6F8DBB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3904] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [6F8CF695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3904] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [6F8D75E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3904] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [6F8CE7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3904] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [6F908395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3904] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [6F8DDA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3904] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [6F8CFFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3904] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [6F8CFF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3904] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [6F8C71CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3904] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [6F95CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3904] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [6F8FC8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3904] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [6F8CD968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3904] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [6F8C6853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3904] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [6F8C687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3904] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [6F8D2AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-09-02 17:22:39
-----------------------------
17:22:39.551 OS Version: Windows 6.0.6002 Service Pack 2
17:22:39.552 Number of processors: 2 586 0x4303
17:22:39.557 ComputerName: H-PC UserName: h
17:22:45.295 Initialize success
17:23:56.742 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000052
17:23:56.746 Disk 0 Vendor: WDC_WD50 12.0 Size: 476940MB BusType: 6
17:23:59.073 Disk 0 MBR read successfully
17:23:59.077 Disk 0 MBR scan
17:23:59.080 Disk 0 Windows VISTA default MBR code
17:23:59.159 Disk 0 scanning sectors +976771072
17:23:59.561 Disk 0 scanning C:\Windows\system32\drivers
17:24:51.303 Service scanning
17:24:52.559 Service MpKsl04f4fc0e c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{03D87959-F3BA-4B00-BA07-17C0973282AA}\MpKsl04f4fc0e.sys **LOCKED** 32
17:24:52.575 Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32
17:24:53.468 Modules scanning
17:25:16.823 Disk 0 trace - called modules:
17:25:16.856 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor32.sys ndis.sys nvmfdx32.sys
17:25:16.861 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84f08450]
17:25:16.869 3 CLASSPNP.SYS[865a68b3] -> nt!IofCallDriver -> [0x83f74940]
17:25:16.878 5 acpi.sys[806126bc] -> nt!IofCallDriver -> \Device\00000052[0x84915b20]
17:25:16.887 Scan finished successfully
17:26:07.684 Disk 0 MBR has been saved successfully to "C:\Users\h\Documents\MBR.dat "
17:26:07.692 The log file has been saved successfully to "C:\Users\h\Documents\aswMBR.txt "
17:26:45.206 Disk 0 MBR has been saved successfully to "C:\Users\h\Desktop\MBR.dat "
17:26:45.215 The log file has been saved successfully to "C:\Users\h\Desktop\aswMBR.txt "


.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.19120 BrowserJavaVersion: 1.6.0_26
Run by h at 17:31:20 on 2011-09-02
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6002.2.1252.1.1033.18.1022.250 [GMT -7:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\AERTSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6071203
uWindow Title = Internet Explorer provided by Dell
uInternet Settings,ProxyOverride = <local>;*.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
Trusted Zone: battle.net\www
Trusted Zone: bigfishgames.com\www
Trusted Zone: faunasphere.com
Trusted Zone: faunasphere.com\www
Trusted Zone: taxactonline.com\www
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.0.1 205.171.3.25
TCP: Interfaces\{6B7029E6-1317-4471-86D3-DCE97E649AAC} : DhcpNameServer = 192.168.0.1 205.171.3.25
AppInit_DLLs: c:\progra~1\google\google~2\GOEC62~1.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\h\appdata\roaming\mozilla\firefox\profiles\adb3gney.default\
FF - component: c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava11.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava12.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava13.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava14.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava32.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npoji610.dll
FF - plugin: c:\users\h\appdata\roaming\mozilla\plugins\NPAbacheck.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
.
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165648]
R1 MpKsl04f4fc0e;MpKsl04f4fc0e;c:\programdata\microsoft\microsoft antimalware\definition updates\{03d87959-f3ba-4b00-ba07-17c0973282aa}\MpKsl04f4fc0e.sys [2011-9-2 28752]
R2 AERTFilters;Andrea RT Filters Service;c:\windows\system32\AERTSrv.exe [2007-12-5 77824]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-4-5 21504]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 65024]
R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2011-4-27 208944]
R3 USBPNPA;USB PnP Sound Device Interface;c:\windows\system32\drivers\CM108.sys [2007-6-28 1310720]
R4 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-1-3 22712]
R4 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-1-3 366640]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245; "c:\program files\google\google desktop search\googledesktop.exe" --> c:\program files\google\google desktop search\GoogleDesktop.exe [?]
S3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\microsoft fix it center\Matsvc.exe [2011-6-13 267568]
S3 PTDMBus;PANTECH USB Modem Composite Device Driver ;c:\windows\system32\drivers\PTDMBus.sys [2009-1-25 29952]
S3 PTDMMdm;PANTECH USB Modem Drivers ;c:\windows\system32\drivers\PTDMMdm.sys [2009-1-25 41856]
S3 PTDMVsp;PANTECH USB Modem Serial Port ;c:\windows\system32\drivers\PTDMVsp.sys [2009-1-25 39936]
S3 PTDMWWAN;PANTECH USB Modem WWAN Driver;c:\windows\system32\drivers\PTDMWWAN.sys [2009-1-25 59520]
.
=============== Created Last 30 ================
.
2011-09-03 00:08:27 28752 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{03d87959-f3ba-4b00-ba07-17c0973282aa}\MpKsl04f4fc0e.sys
2011-09-03 00:08:18 7152464 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{03d87959-f3ba-4b00-ba07-17c0973282aa}\mpengine.dll
2011-08-25 03:12:08 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-17 04:02:09 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-16 16:46:37 -------- d-----w- C:\Temp
2011-08-16 16:05:14 -------- d-sh--w- C:\found.002
2011-08-12 00:24:53 -------- d-----w- C:\a1181f117b234072d9e9
2011-08-11 17:04:17 439632 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\{247253b4-c1d8-44fd-b074-e83e43f1bd06}\gapaengine.dll
2011-08-10 15:23:59 71680 ----a-w- c:\windows\system32\iesetup.dll
2011-08-10 15:23:59 197632 ----a-w- c:\program files\internet explorer\IEShims.dll
2011-08-10 15:23:59 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2011-08-10 15:23:59 109056 ----a-w- c:\windows\system32\iesysprep.dll
2011-08-10 15:23:58 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-08-10 15:23:58 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2011-08-10 15:15:19 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat
2011-08-10 15:13:39 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-08-10 15:12:13 3602832 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-08-10 15:12:13 3550096 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-08-10 15:12:10 375808 ----a-w- c:\windows\system32\winsrv.dll
2011-08-10 15:11:57 913296 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-08-10 15:11:57 31232 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2011-08-06 10:02:41 -------- d-----w- c:\users\h\appdata\roaming\Funzai!
2011-08-06 07:53:28 -------- d-----w- c:\users\h\appdata\roaming\Alawar Entertainment
.
==================== Find3M ====================
.
2011-07-23 11:04:29 916480 ----a-w- c:\windows\system32\wininet.dll
2011-07-23 10:59:52 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-07-23 10:03:47 385024 ----a-w- c:\windows\system32\html.iec
2011-07-07 02:52:42 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-07 02:52:42 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-14 05:09:22 65328 ----a-w- c:\windows\apppatch\matsshim.dll
.
============= FINISH: 17:33:04.75 ===============


.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vistaâ„¢ Home Premium
Boot Device: \Device\HarddiskVolume3
Install Date: 12/3/2007 7:59:51 AM
System Uptime: 9/1/2011 1:24:19 AM (40 hours ago)
.
Motherboard: Dell Inc. | | 0RY206
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 5600+ | Socket AM2 | 2800/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 456 GiB total, 241.677 GiB free.
D: is FIXED (NTFS) - 10 GiB total, 4.69 GiB free.
E: is CDROM (CDFS)
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP1588: 9/1/2011 12:58:31 AM - Windows Update
RP1589: 9/2/2011 12:00:14 AM - Scheduled Checkpoint
RP1590: 9/2/2011 1:37:10 AM - Windows Update
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
32 Bit HP CIO Components Installer
5700_Help
Abacast Client
Acrobat.com
Adobe Acrobat 5.0
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Reader 9.4.5
Adobe Shockwave Player
Agatha Christie: 4:50 from Paddington
Alchemist's Apprentice
Ancient Quest of Saqqarah
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Azada: Ancient Magic
Bejeweled 2 Deluxe
Big Fish Games: Game Manager
Bonjour
BPD_Scan
BPDSoftware
BPDSoftware_Ini
Browser Address Error Redirector
BufferChm
Classic Adventures: The Great Gatsby
Compatibility Pack for the 2007 Office system
Conexant D850 PCI V.92 Modem
Consumer Complete Care Services Agreement
Dark Parables: The Exiled Prince Collector's Edition
Dell Getting Started Guide
Dell Support Center
Destinations
DeviceManagementQFolder
Diablo II
Digital Line Detect
DocProc
DocProcQFolder
Dolphins Dice Slots
Dream Day True Love
Dream Day Wedding Bella Italia
Dream Day Wedding: Viva Las Vegas
eFax Messenger
Enlightenus
eSupportQFolder
Fax
G-Force
Gardenscapes
gtss saver
Hardwood Solitaire III
Heartwild Solitaire
Heartwild Solitaire: Book Two
Hidden Expedition: Amazon â„¢
Hidden Expedition: Everest â„¢
Hidden Mysteries: Notre Dame - Secrets of Paris
Hidden Object Crosswords
Hide and Secret: The Lost World
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Driver Diagnostics
HP Imaging Device Functions 8.0
HP OCR Software 8.0
HP Officejet All-In-One Series
HP Photosmart Essential
HP Solution Center 8.0
HP Update
HPProductAssistant
HPSSupply
iTunes
J5700
Java Auto Updater
Java(TM) 6 Update 26
Java(TM) SE Runtime Environment 6
Kyodai Mahjongg 2006 v1.42
Malwarebytes' Anti-Malware version 1.51.1.1800
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Antimalware
Microsoft Automated Troubleshooting Services Shim
Microsoft Fix it Center
Microsoft IntelliPoint 6.1
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Security Client
Microsoft Security Essentials
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works
Modem Diagnostic Tool
Mozilla Firefox (3.5.5)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Music, Photos & Videos Launcher
Mystery Case Files: Madame Fate&trade;
Mystery Case Files: Ravenhearst â„¢
Mystery Case Files: Return to Ravenhearst â„¢
Nemo's Secret: The Nautilus
NetWaiting
Next Generation Visualisations
Nord
NVIDIA Display Control Panel
NVIDIA Drivers
NVIDIANetworkDiagnostic
OpenAL
Pahelika: Secret Legends
PANTECH PC USB Modem Software
Phantasmat Collector's Edition
Pirates Plunder
Plants vs. Zombies
Poker Superstars III
Product Documentation Launcher
ProductContext
Puppetshow Lost Town Piano Screen Saver
Puppetshow Lost Town Faces Screen Saver
Pure Hidden
PVSonyDll
QualxServ Service Agreement
QuickTime
Realtek High Definition Audio Driver
Renovate & Relocate: Boston
SamainSS
Scan
ScriptFTP
Season Match 2
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2509488)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft Office 2007 System (KB2541012)
Security Update for Microsoft Office Excel 2007 (KB2541007)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Serif PanoramaPlus Starter Edition
Slingo Mystery: Who's Gold
SolutionCenter
Sonic Activation Module
Speex for Windows 1.0.5
Spirits of Mystery Amber Maiden Octopus Screen Saver
Start Stop Universal Transcription System
Status
Stedman's Plus Spellchecker 2008 Standard Edition (Shared Components)
Stedman's Plus Standard Edition
Sylcount IV Gold Edition
System Requirements Lab
The Rise of Atlantis
Toolbox
TrayApp
U3Launcher
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Wal-Mart Digital Photo Manager
WebReg
WhiteCap
.
==== Event Viewer Messages From Past Week ========
.
9/1/2011 12:37:44 AM, Error: Service Control Manager [7022] - The KtmRm for Distributed Transaction Coordinator service hung on starting.
9/1/2011 12:31:43 AM, Error: Service Control Manager [7023] - The HP CUE DeviceDiscovery Service service terminated with the following error: Unspecified error
9/1/2011 12:19:50 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
9/1/2011 12:19:47 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
9/1/2011 12:19:38 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments " " in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
9/1/2011 12:19:34 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
9/1/2011 12:19:18 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: MpFilter spldr Wanarpv6
9/1/2011 12:19:18 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments " " in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
9/1/2011 12:19:13 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
9/1/2011 12:17:20 AM, Error: EventLog [6008] - The previous system shutdown at 5:31:42 PM on 8/31/2011 was unexpected.
9/1/2011 1:31:38 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Media Player Network Sharing Service service to connect.
9/1/2011 1:31:38 AM, Error: Service Control Manager [7000] - The Windows Media Player Network Sharing Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
9/1/2011 1:28:59 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Spooler service.
9/1/2011 1:28:59 AM, Error: Service Control Manager [7000] - The SupportSoft Sprocket Service (dellsupportcenter) service failed to start due to the following error: The system cannot find the file specified.
9/1/2011 1:28:59 AM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
8/31/2011 5:24:06 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: After starting, the service hung in a start-pending state.
8/31/2011 5:23:46 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments " " in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
8/31/2011 5:23:05 PM, Error: Service Control Manager [7022] - The Network Location Awareness service hung on starting.
8/31/2011 5:21:38 PM, Error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting.
8/31/2011 5:18:48 PM, Error: EventLog [6008] - The previous system shutdown at 4:56:50 PM on 8/31/2011 was unexpected.
8/31/2011 1:10:02 AM, Error: volsnap [14] - The shadow copies of volume C: were aborted because of an IO failure on volume C:.
8/30/2011 12:03:35 AM, Error: Schannel [36874] - An SSL connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.
.
==== End Of File ===========================

 

Thank you Pete - I did not realize that my issue was definitely malware/virus-related - just ran the tests because I thought that they were required for help on any situation to rule them out. You must have seen something in the logs that I do not have the knowledge to recognize - thanks again!

 

And here is the malwarebytes log - sorry to have missed posting it previously - thanks again.

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7635

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19120

9/2/2011 1:28:42 AM
mbam-log-2011-09-02 (01-28-42).txt

Scan type: Quick scan
Objects scanned: 169212
Time elapsed: 6 minute(s), 11 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

 

Hello Broni,

Thank you for your reply and your time! Here is the log from Process Explorer. I noticed that it did not say I had 80% or more of my memory being used, but then again, I did not have anything else running. I hope it will show what is slowing my machine down so badly and creating the "not responding" problem. Thanks again!

System Idle Process 0 99.22 0 K 24 K
System 4 0.78 0 K 1,776 K
Interrupts n/a < 0.01 0 K 0 K Hardware Interrupts and DPCs
smss.exe 440 288 K 232 K Windows Session Manager Microsoft Corporation \SystemRoot\System32\smss.exe
csrss.exe 556 < 0.01 1,732 K 2,188 K Client Server Runtime Process Microsoft Corporation C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
wininit.exe 608 1,412 K 560 K Windows Start-Up Application Microsoft Corporation wininit.exe
services.exe 652 2,792 K 3,080 K Services and Controller app Microsoft Corporation C:\Windows\system32\services.exe
svchost.exe 852 < 0.01 2,988 K 3,512 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k DcomLaunch
mobsync.exe 3820 3,208 K 1,156 K Microsoft Sync Center Microsoft Corporation C:\Windows\System32\mobsync.exe -Embedding
unsecapp.exe 2676 < 0.01 2,292 K 2,160 K Sink to receive asynchronous callbacks for WMI client application Microsoft Corporation C:\Windows\system32\wbem\unsecapp.exe -Embedding
WmiPrvSE.exe 2988 < 0.01 3,340 K 3,176 K WMI Provider Host Microsoft Corporation C:\Windows\system32\wbem\wmiprvse.exe
nvvsvc.exe 900 2,504 K 768 K NVIDIA Driver Helper Service, Version 197.28 NVIDIA Corporation C:\Windows\system32\nvvsvc.exe
nvvsvc.exe 1452 < 0.01 4,524 K 1,228 K NVIDIA Driver Helper Service, Version 197.28 NVIDIA Corporation C:\Windows\system32\nvvsvc.exe -session -first
svchost.exe 928 < 0.01 3,356 K 3,084 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k rpcss
MsMpEng.exe 984 < 0.01 100,152 K 59,864 K Antimalware Service Executable Microsoft Corporation "c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe "
svchost.exe 1080 14,744 K 4,892 K Host Process for Windows Services Microsoft Corporation C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
audiodg.exe 1288 16,120 K 11,456 K Windows Audio Device Graph Isolation Microsoft Corporation C:\Windows\system32\AUDIODG.EXE 0x27c
svchost.exe 1144 < 0.01 66,468 K 44,264 K Host Process for Windows Services Microsoft Corporation C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
dwm.exe 2908 < 0.01 1,240 K 2,324 K Desktop Window Manager Microsoft Corporation "C:\Windows\system32\Dwm.exe "
WUDFHost.exe 3600 2,920 K 1,744 K Windows Driver Foundation - User-mode Driver Framework Host Process Microsoft Corporation "C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-fcd4b8e4-0c35-4b9f-8510-e0c5b7b8a43f -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-cdf2269c-75aa-4a18-8776-6e84cfb9d71a -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7d888aee-0210-4c41-a9a0-60f7a79c38d4 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:2c54a308-52d1-44d0-b2e8-bed209ce93b9
svchost.exe 1192 < 0.01 27,884 K 16,660 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k netsvcs
taskeng.exe 3668 < 0.01 9,472 K 3,168 K Task Scheduler Engine Microsoft Corporation taskeng.exe {13803899-18D7-49DB-8C7C-098F877D40FF}
taskeng.exe 2308 2,128 K 1,728 K Task Scheduler Engine Microsoft Corporation taskeng.exe {8AEB4220-A34C-46B5-82E9-BFCD7CE27CC4}
svchost.exe 1312 1,972 K 1,348 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k GPSvcGroup
SLsvc.exe 1336 6,020 K 1,392 K Microsoft Software Licensing Service Microsoft Corporation C:\Windows\system32\SLsvc.exe
svchost.exe 1384 < 0.01 8,304 K 5,244 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k LocalService
svchost.exe 1540 < 0.01 23,500 K 8,724 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k NetworkService
spoolsv.exe 1864 < 0.01 6,460 K 3,140 K Spooler SubSystem App Microsoft Corporation C:\Windows\System32\spoolsv.exe
svchost.exe 1888 18,700 K 7,300 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
AERTSrv.exe 248 368 K 356 K Andrea filters APO access service (32-bit) Andrea Electronics Corporation C:\Windows\system32\AERTSrv.exe
AppleMobileDeviceService.exe 300 < 0.01 3,168 K 824 K MobileDeviceService Apple Inc. "C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe "
mDNSResponder.exe 380 1,812 K 1,720 K Bonjour Service Apple Inc. "C:\Program Files\Bonjour\mDNSResponder.exe "
svchost.exe 448 2,076 K 560 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k bthsvcs
svchost.exe 560 4,536 K 2,188 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k hpdevmgmt
svchost.exe 844 1,048 K 536 K Host Process for Windows Services Microsoft Corporation C:\Windows\System32\svchost.exe -k HPZ12
svchost.exe 1516 844 K 552 K Host Process for Windows Services Microsoft Corporation C:\Windows\System32\svchost.exe -k HPZ12
svchost.exe 1788 2,252 K 768 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
svchost.exe 1488 4,532 K 1,032 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k imgsvc
svchost.exe 1364 584 K 608 K Host Process for Windows Services Microsoft Corporation C:\Windows\System32\svchost.exe -k WerSvcGroup
SearchIndexer.exe 1356 < 0.01 38,372 K 11,528 K Microsoft Windows Search Indexer Microsoft Corporation C:\Windows\system32\SearchIndexer.exe /Embedding
XAudio.exe 204 < 0.01 760 K 532 K Modem Audio Service Conexant Systems, Inc. C:\Windows\system32\DRIVERS\xaudio.exe
NisSrv.exe 3964 6,792 K 1,136 K Microsoft Network Inspection System Microsoft Corporation "c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe "
svchost.exe 1400 1,548 K 344 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
svchost.exe 2152 3,520 K 752 K Host Process for Windows Services Microsoft Corporation C:\Windows\system32\svchost.exe -k WindowsMobile
mbamservice.exe 1048 < 0.01 89,724 K 25,024 K Malwarebytes' Anti-Malware Malwarebytes Corporation "C:\Users\h\Desktop\Maintenance\Malwarebytes' Anti-Malware\mbamservice.exe "
lsass.exe 668 3,348 K 2,728 K Local Security Authority Process Microsoft Corporation C:\Windows\system32\lsass.exe
lsm.exe 684 1,764 K 1,512 K Local Session Manager Service Microsoft Corporation C:\Windows\system32\lsm.exe
csrss.exe 620 < 0.01 7,948 K 8,972 K Client Server Runtime Process Microsoft Corporation C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
winlogon.exe 724 2,152 K 2,256 K Windows Logon Application Microsoft Corporation winlogon.exe
explorer.exe 3532 < 0.01 25,508 K 29,764 K Windows Explorer Microsoft Corporation explorer.exe
msseces.exe 2296 < 0.01 6,204 K 3,884 K Microsoft Security Client User Interface Microsoft Corporation "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
mbamgui.exe 2388 2,284 K 1,424 K Malwarebytes' Anti-Malware Malwarebytes Corporation "C:\Users\h\Desktop\Maintenance\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
DLG.exe 2444 < 0.01 2,128 K 672 K Digital Line Detection Avanquest Software "C:\Program Files\Digital Line Detect\DLG.exe"
procexp.exe 1664 < 0.01 22,984 K 33,544 K Sysinternals Process Explorer Sysinternals - www.sysinternals.com "C:\Users\h\AppData\Local\Temp\Temp1_ProcessExplorer.zip\procexp.exe "

 

Hi Broni,

It is not CPU usage that I have the problem with - it says (when I am running for instance one program and have a couple of internet windows open) that 80%+ of the physical drive is in use and then everything stops responding completely and I have to use task manager to close things down. I apologize if I did not use the correct terminology - I am still learning. Let me know if there is another program I should run to give you what you need to know. Thank you so much for your help and time. I greatly appreciate it!

 

Hello Broni,

I ran Combofix without any problems and am posting the log below. Thank you again very much for your help.

ComboFix 11-09-13.04 - h 09/13/2011 17:25:28.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1022.453 [GMT -7:00]
Running from: c:\users\h\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\h\AppData\Roaming\.#
c:\users\h\AppData\Roaming\Island
c:\users\h\AppData\Roaming\Island\space.rgt
c:\users\h\AppData\Roaming\TMInc
c:\users\h\AppData\Roaming\TMInc\game.cfg
c:\users\h\AppData\Roaming\TMInc\user1.sav
c:\windows\iun6002.exe
c:\windows\system32\ccrpTmr6.dll
c:\windows\system32\comct332.ocx
.
.
((((((((((((((((((((((((( Files Created from 2011-08-14 to 2011-09-14 )))))))))))))))))))))))))))))))
.
.
2011-09-14 00:31 . 2011-09-14 00:32 -------- d-----w- c:\users\h\AppData\Local\temp
2011-09-14 00:31 . 2011-09-14 00:31 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-09-13 06:05 . 2011-09-13 06:05 28752 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{00A2EEDB-4EDB-4AD0-BFE9-32BBA5F0FE53}\MpKslb6e80a0d.sys
2011-09-13 06:04 . 2011-08-12 02:44 7152464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{00A2EEDB-4EDB-4AD0-BFE9-32BBA5F0FE53}\mpengine.dll
2011-09-08 01:44 . 2010-11-30 17:43 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{49589A3C-C470-42E2-ADF0-F05080B3BD42}\gapaengine.dll
2011-08-25 03:12 . 2011-07-11 13:25 2048 ----a-w- c:\windows\system32\tzres.dll
2011-08-17 04:02 . 2011-08-31 13:28 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-16 16:46 . 2011-08-16 16:46 -------- d-----w- C:\Temp
2011-08-16 16:05 . 2011-08-16 16:05 -------- d-----w- C:\found.002
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-12 02:44 . 2011-01-21 08:21 7152464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-07-23 11:04 . 2011-08-10 15:24 916480 ----a-w- c:\windows\system32\wininet.dll
2011-07-23 11:00 . 2011-08-10 15:23 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-07-23 10:59 . 2011-08-10 15:24 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-07-23 10:59 . 2011-08-10 15:23 71680 ----a-w- c:\windows\system32\iesetup.dll
2011-07-23 10:59 . 2011-08-10 15:23 109056 ----a-w- c:\windows\system32\iesysprep.dll
2011-07-23 10:03 . 2011-08-10 15:24 385024 ----a-w- c:\windows\system32\html.iec
2011-07-23 09:27 . 2011-08-10 15:23 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2011-07-23 09:25 . 2011-08-10 15:23 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2011-07-13 03:39 . 2011-07-27 13:09 6881616 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll
2011-07-07 02:52 . 2011-01-03 21:18 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-07 02:52 . 2011-01-03 21:18 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-06 15:31 . 2011-08-10 15:13 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-20 08:54 . 2011-08-10 15:12 3602832 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-06-20 08:54 . 2011-08-10 15:12 3550096 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-06-17 20:13 . 2011-08-10 15:11 913296 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-06-17 16:03 . 2011-08-10 15:12 375808 ----a-w- c:\windows\system32\winsrv.dll
2011-06-17 13:31 . 2011-08-10 15:11 31232 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC "= "c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-12-3 50688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA "= 0 (0x0)
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^LaunchU3.exe.lnk]
backup=c:\windows\pss\LaunchU3.exe.lnk.CommonStartup
backupExtension=.CommonStartup
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\LaunchU3.exe.lnk
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-03-30 04:59 937920 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
2007-05-25 06:03 17920 ----a-w- c:\dell\E-Center\EULALauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2006-12-11 04:52 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
2007-02-05 23:52 849280 ----a-w- c:\program files\Microsoft IntelliPoint\ipoint.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2006-10-03 17:35 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2006-10-03 17:37 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-01-25 22:08 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2010-03-24 01:25 13684328 ----a-w- c:\windows\System32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2010-03-24 01:25 110696 ----a-w- c:\windows\System32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvSvc]
2010-03-24 01:25 985704 ----a-w- c:\windows\System32\nvsvc.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-30 00:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2008-01-17 14:22 4907008 ----a-w- c:\windows\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-04-08 19:59 254696 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 07:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile-based device management]
2007-05-31 15:21 648072 ----a-w- c:\windows\WindowsMobile\wmdcBase.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-99570673-1611037384-3961291737-1000]
"EnableNotificationsRef "=dword:00000001
.
R1 MpKsl0d4375c8;MpKsl0d4375c8;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6710CA42-EAD7-477F-9A45-0BC38672B2A3}\MpKsl0d4375c8.sys [x]
R1 MpKsl182e9cd9;MpKsl182e9cd9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{57694BA4-DB07-4B34-9A58-C3D7B2B8E8EC}\MpKsl182e9cd9.sys [x]
R1 MpKsl561ee90a;MpKsl561ee90a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{423EE799-3057-4231-8A74-371D79B50114}\MpKsl561ee90a.sys [x]
R1 MpKsl8bf9e6fb;MpKsl8bf9e6fb;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{67B76513-3A06-41C3-9857-1EEB8F5CE384}\MpKsl8bf9e6fb.sys [x]
R1 MpKslcd0c3dcd;MpKslcd0c3dcd;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{57694BA4-DB07-4B34-9A58-C3D7B2B8E8EC}\MpKslcd0c3dcd.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [x]
R3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\Microsoft Fix it Center\Matsvc.exe [2011-06-14 267568]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944]
R3 PTDMBus;PANTECH USB Modem Composite Device Driver ;c:\windows\system32\DRIVERS\PTDMBus.sys [2007-08-18 29952]
R3 PTDMMdm;PANTECH USB Modem Drivers ;c:\windows\system32\DRIVERS\PTDMMdm.sys [2007-08-18 41856]
R3 PTDMVsp;PANTECH USB Modem Serial Port ;c:\windows\system32\DRIVERS\PTDMVsp.sys [2007-08-18 39936]
R3 PTDMWWAN;PANTECH USB Modem WWAN Driver;c:\windows\system32\DRIVERS\PTDMWWAN.sys [2007-08-18 59520]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S1 MpKsl1bb8c399;MpKsl1bb8c399;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8B8A09B9-E09D-4C12-81E3-7735E811CDBE}\MpKsl1bb8c399.sys [x]
S1 MpKslb6e80a0d;MpKslb6e80a0d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{00A2EEDB-4EDB-4AD0-BFE9-32BBA5F0FE53}\MpKslb6e80a0d.sys [2011-09-13 28752]
S1 MpKsle8be064a;MpKsle8be064a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8B8A09B9-E09D-4C12-81E3-7735E811CDBE}\MpKsle8be064a.sys [x]
S2 AERTFilters;Andrea RT Filters Service;c:\windows\system32\AERTSrv.exe [2007-12-05 77824]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-07-07 22712]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
S3 USBPNPA;USB PnP Sound Device Interface;c:\windows\system32\drivers\CM108.sys [2007-06-28 1310720]
S4 MBAMService;MBAMService;c:\users\h\Desktop\Maintenance\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-07 366640]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MPKSL51352211
*NewlyCreated* - MPKSLB6E80A0D
*NewlyCreated* - PROCEXP141
*Deregistered* - MpKsl51352211
*Deregistered* - PCDSRVC{E9D79540-57D5953E-06020101}_0
*Deregistered* - PROCEXP141
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-22 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-06-21 18:08]
.
2011-09-13 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-06-21 18:08]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6071203
uInternet Settings,ProxyOverride = <local>;*.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: battle.net\www
Trusted Zone: bigfishgames.com\www
Trusted Zone: faunasphere.com
Trusted Zone: faunasphere.com\www
Trusted Zone: taxactonline.com\www
TCP: DhcpNameServer = 192.168.0.1 205.171.3.25
FF - ProfilePath - c:\users\h\AppData\Roaming\Mozilla\Firefox\Profiles\adb3gney.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-DellSupportCenter - c:\program files\Dell Support Center\bin\sprtcmd.exe
MSConfigStartUp-dscactivate - c:\program files\Dell Support Center\gs_agent\custom\dsca.exe
MSConfigStartUp-GoBoingo - c:\program files\Alltel\GoBoingo\AlltelWifi.exe
MSConfigStartUp-Google Desktop Search - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
MSConfigStartUp-pccguide - c:\program files\Trend Micro\Internet Security 14\pccguide.exe
AddRemove-Hardwood Solitaire III - c:\program files\Hardwood Solitaire III\Solitaire III.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-13 17:32
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,63,e3,a0,d0,f2,dc,86,43,af,f4,a2,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,63,e3,a0,d0,f2,dc,86,43,af,f4,a2,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
Completion time: 2011-09-13 17:34:12
ComboFix-quarantined-files.txt 2011-09-14 00:34
.
Pre-Run: 265,879,924,736 bytes free
Post-Run: 265,898,614,784 bytes free
.
- - End Of File - - FB006772F4FE85C31591BB21A4B2E32A

 

Ran OTL - problems posting logs

Thank you again for reopening this thread, Broni. I am still having problems, and it actually seemed to freeze up and do the "not responding" thing with both programs and webpages worse after Combofix. I ran OTL with the directions given, and will post the logs as directed below. Hopefully it will show what the problem is. I feel like the proverbial person that takes their car to the mechanic and says: "Really! It was making this noise before - I don't know why it won't do it now!" Thanks again for your help and time.

Okay, I went to post the logs here and it will not allow me to do so - even one at a time they are too long - the BBS site gives me an error that says that the text I have entered is too long. Should I break each log in approximately half, or....?

 

Okay - I think it will take 4 posts, because I did try to split them up originally and even one at a time it was too much - anyway, here is the first half of the OTL.Txt log (tried to break it off somewhere where there seemed to be a break):

OTL logfile created on: 9/22/2011 7:18:16 PM - Run 1
OTL by OldTimer - Version 3.2.29.1 Folder = C:\Users\h\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19120)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1021.76 Mb Total Physical Memory | 526.68 Mb Available Physical Memory | 51.55% Memory free
2.41 Gb Paging File | 1.62 Gb Available in Paging File | 67.10% Paging File free
Paging file location(s): ?:\pagefile.sys

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.71 Gb Total Space | 244.30 Gb Free Space | 53.61% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 4.53 Gb Free Space | 45.32% Space Free | Partition Type: NTFS
Drive E: | 542.65 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 5.46 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive H: | 3.81 Gb Total Space | 0.09 Gb Free Space | 2.37% Space Free | Partition Type: FAT32

Computer Name: H-PC | User Name: h | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/09/22 19:12:31 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\h\Desktop\OTL.exe
PRC - [2011/06/15 15:16:48 | 000,997,920 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2011/04/27 15:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
PRC - [2011/04/27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2009/04/10 23:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2007/12/05 06:17:24 | 000,077,824 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AERTSrv.exe


========== Modules (No Company Name) ==========

MOD - [2008/06/20 00:42:13 | 000,043,520 | ---- | M] () -- C:\Windows\System32\CmdLineExt03.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (stllssvr)
SRV - File not found [Auto | Stopped] -- -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - File not found [On_Demand | Stopped] -- -- (GoogleDesktopManager-061008-081103)
SRV - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Disabled | Stopped] -- C:\Users\h\Desktop\Maintenance\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011/06/13 22:09:22 | 000,267,568 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Fix it Center\Matsvc.exe -- (MatSvc)
SRV - [2011/04/27 15:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV - [2011/04/27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2008/04/06 02:45:47 | 000,079,360 | ---- | M] (WoltersKluwerLWW) [On_Demand | Stopped] -- C:\Program Files\Common Files\WoltersKluwerLWW Shared\Service\LWWLicenseService.exe -- (LWWLicenseService)
SRV - [2008/01/19 00:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/12/05 06:17:24 | 000,077,824 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AERTSrv.exe -- (AERTFilters)
SRV - [2007/05/31 08:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007/05/31 08:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | System | Running] -- -- (MpKsl0e8c94c0)
DRV - [2011/09/21 22:29:28 | 000,028,752 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{EE62FF16-DECF-43AA-A10C-1D5429D12F3F}\MpKsl81b40e7f.sys -- (MpKsl81b40e7f)
DRV - [2011/07/06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011/04/27 15:25:24 | 000,065,024 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2011/04/18 13:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)
DRV - [2010/03/24 05:23:16 | 011,614,760 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007/08/17 18:56:46 | 000,059,520 | ---- | M] (DEVGURU Co,LTD.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PTDMWWAN.sys -- (PTDMWWAN)
DRV - [2007/08/17 18:56:40 | 000,039,936 | ---- | M] (DEVGURU Co,LTD.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PTDMVsp.sys -- (PTDMVsp)
DRV - [2007/08/17 18:56:38 | 000,041,856 | ---- | M] (DEVGURU Co,LTD.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PTDMMdm.sys -- (PTDMMdm)
DRV - [2007/08/17 18:56:34 | 000,029,952 | ---- | M] (DEVGURU Co,LTD.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PTDMBus.sys -- (PTDMBus)
DRV - [2007/08/09 18:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\nvstor32.sys -- (nvstor32)
DRV - [2007/06/28 07:18:10 | 001,310,720 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CM108.sys -- (USBPNPA)
DRV - [2007/03/15 06:57:30 | 001,059,112 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2006/11/08 00:02:40 | 000,024,064 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\point32k.sys -- (Point32)
DRV - [2006/11/02 00:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006/11/02 00:30:55 | 000,200,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2006/10/18 11:08:18 | 000,258,048 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2006/08/04 17:39:10 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6071203
IE - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local

========== FireFox ==========

FF - prefs.js..network.proxy.no_proxies_on: "localhost,127.0.0.1 "

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@adobe.com/Acrobat,version=5.1: C:\Program Files\Adobe\Acrobat 5.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\h\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\h\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/01/19 20:23:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/06/20 15:33:17 | 000,000,000 | ---D | M]

[2008/12/18 17:50:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\h\AppData\Roaming\Mozilla\Extensions
[2008/12/18 17:50:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\h\AppData\Roaming\Mozilla\Extensions\{6334D996-EA3E-4a0e-AA8D-15BA56B37241}
[2010/01/16 01:19:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\h\AppData\Roaming\Mozilla\Firefox\Profiles\adb3gney.default\extensions
[2009/12/09 11:10:23 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\h\AppData\Roaming\Mozilla\Firefox\Profiles\adb3gney.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2008/12/18 18:00:40 | 000,000,000 | ---D | M] ( "I ♥ Miro ") -- C:\Users\h\AppData\Roaming\Mozilla\Firefox\Profiles\adb3gney.default\extensions\{216ec66d-214a-43ea-92f0-5373f8405c88}
[2011/06/22 19:12:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/03/31 06:51:17 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/06/22 19:12:47 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011/05/04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\h\AppData\Local\Google\Chrome\Application\14.0.835.186\gcswf32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\h\AppData\Local\Google\Chrome\Application\14.0.835.186\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\h\AppData\Local\Google\Chrome\Application\14.0.835.186\pdf.dll
CHR - plugin: Abacast v2.1b3 (Enabled) = C:\Users\h\AppData\Roaming\Mozilla\plugins\NPAbacheck.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\h\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Dale Chihuly = C:\Users\h\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnenonhiffdmndmgiinmldkabciohign\3_0\

O1 HOSTS File: ([2011/09/13 17:32:04 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll File not found
O15 - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\..Trusted Domains: battle.net ([www] http in Trusted sites)
O15 - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\..Trusted Domains: bigfishgames.com ([www] http in Trusted sites)
O15 - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\..Trusted Domains: faunasphere.com ([]http in Trusted sites)
O15 - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\..Trusted Domains: faunasphere.com ([www] * in Trusted sites)
O15 - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\..Trusted Domains: taxactonline.com ([www] https in Trusted sites)
O15 - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\..Trusted Ranges: Range1 ([https] in Trusted sites)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 205.171.3.25
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6B7029E6-1317-4471-86D3-DCE97E649AAC}: DhcpNameServer = 192.168.0.1 205.171.3.25
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\h\Pictures\thunderstorm on the beach.jpg
O24 - Desktop BackupWallPaper: C:\Users\h\Pictures\thunderstorm on the beach.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 14:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2001/04/18 00:23:00 | 000,000,041 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O32 - AutoRun File - [2007/02/12 12:53:42 | 000,000,277 | R--- | M] () - F:\autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.alf2cd - C:\Windows\System32\alf2cd.acm (NCT Company)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.rhetorex - rhetorex.acm File not found
Drivers32: msacm.speexacm - C:\Windows\System32\speexw.acm (http://www.speex.org/)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/09/22 19:08:23 | 000,582,656 | ---- | C] (OldTimer Tools) -- C:\Users\h\Desktop\OTL.exe
[2011/09/19 01:42:27 | 000,000,000 | ---D | C] -- C:\Users\h\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sacra Terra - Angelic Night
[2011/09/19 01:42:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sacra Terra - Angelic Night
[2011/09/19 01:42:27 | 000,000,000 | ---D | C] -- C:\Program Files\Sacra Terra - Angelic Night
[2011/09/13 17:34:21 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/09/13 17:34:14 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011/09/13 17:34:14 | 000,000,000 | ---D | C] -- C:\Users\h\AppData\Local\temp
[2011/09/13 17:21:40 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/09/13 17:21:40 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/09/13 17:21:40 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/09/13 17:21:34 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/09/13 17:21:30 | 000,000,000 | ---D | C] -- C:\Qoobox
[2008/11/28 14:54:44 | 008,346,560 | ---- | C] (Dell, Inc. ) -- C:\Users\h\AppData\Roaming\DataSafeDotNet.exe
[2006/10/31 09:08:36 | 000,018,944 | ---- | C] ( ) -- C:\Windows\System32\Implode.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/09/22 19:12:31 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\h\Desktop\OTL.exe
[2011/09/22 18:55:00 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-99570673-1611037384-3961291737-1000UA.job
[2011/09/22 18:16:52 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/09/22 18:16:31 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/09/22 17:55:19 | 000,000,840 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-99570673-1611037384-3961291737-1000Core.job
[2011/09/22 09:00:07 | 000,000,506 | ---- | M] () -- C:\Windows\tasks\SystemToolsDailyTest.job
[2011/09/19 20:11:01 | 000,000,564 | ---- | M] () -- C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2011/09/19 01:43:32 | 000,001,883 | ---- | M] () -- C:\Users\Public\Desktop\Play Sacra Terra - Angelic Night.lnk
[2011/09/18 08:36:27 | 000,052,165 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011/09/18 08:36:27 | 000,052,165 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011/09/15 22:15:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/09/13 17:32:04 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011/09/10 10:23:49 | 000,642,508 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/09/10 10:23:48 | 000,119,660 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/09/10 10:06:22 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2011/09/02 17:26:07 | 000,000,512 | ---- | M] () -- C:\Users\h\Documents\MBR.dat
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/09/22 17:50:43 | 000,000,892 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-99570673-1611037384-3961291737-1000UA.job
[2011/09/22 17:50:41 | 000,000,840 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-99570673-1611037384-3961291737-1000Core.job
[2011/09/19 01:43:32 | 000,001,883 | ---- | C] () -- C:\Users\Public\Desktop\Play Sacra Terra - Angelic Night.lnk
[2011/09/13 17:21:40 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2011/09/13 17:21:40 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011/09/13 17:21:40 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/09/13 17:21:40 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/09/13 17:21:40 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/09/02 17:26:07 | 000,000,512 | ---- | C] () -- C:\Users\h\Documents\MBR.dat
[2010/04/14 03:47:31 | 000,052,165 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010/04/14 03:47:31 | 000,052,165 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010/03/27 10:41:38 | 000,136,110 | ---- | C] () -- C:\Windows\hpwins10.dat.temp
[2010/03/27 10:41:38 | 000,001,042 | ---- | C] () -- C:\Windows\hpwmdl10.dat.temp
[2010/03/27 10:29:11 | 000,136,283 | ---- | C] () -- C:\Windows\hpwins10.dat
[2009/12/26 22:15:51 | 000,000,190 | ---- | C] () -- C:\Windows\settings.ini
[2009/07/17 23:01:50 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/07/17 23:01:50 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009/02/02 20:39:55 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat
[2009/01/21 02:03:19 | 000,000,016 | ---- | C] () -- C:\Windows\popcinfo.dat
[2008/12/18 17:35:31 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2008/11/13 06:05:18 | 000,001,732 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2008/10/28 17:09:20 | 000,000,680 | ---- | C] () -- C:\Users\h\AppData\Local\d3d9caps.dat
[2008/09/03 17:52:37 | 000,000,037 | ---- | C] () -- C:\Windows\cdplayer.ini
[2008/08/15 11:17:33 | 000,308,224 | ---- | C] () -- C:\Windows\System32\Lffpx7.dll
[2008/08/15 11:17:33 | 000,091,136 | ---- | C] () -- C:\Windows\System32\Lfkodak.dll
[2008/07/28 03:01:10 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/04/28 00:36:44 | 000,000,127 | ---- | C] () -- C:\Windows\pccillin.ini
[2008/04/12 15:38:05 | 000,038,270 | ---- | C] () -- C:\Windows\DIIUnin.dat
[2008/04/09 04:09:01 | 000,001,644 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2008/04/09 04:09:01 | 000,000,288 | ---- | C] () -- C:\Windows\ODBC.INI
[2007/12/30 16:13:31 | 000,000,196 | ---- | C] () -- C:\Users\h\AppData\Roaming\wklnhst.dat
[2007/12/14 23:34:31 | 000,000,000 | ---- | C] () -- C:\Windows\iPlayer.INI
[2007/12/08 11:52:52 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll
[2007/12/07 15:22:56 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
[2007/12/07 15:22:55 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
[2007/12/07 15:22:55 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
[2007/12/07 13:42:27 | 000,031,744 | ---- | C] () -- C:\Users\h\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/12/03 08:09:58 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2007/10/11 01:07:55 | 000,049,152 | ---- | C] () -- C:\Windows\System32\sndcvtlb.dll
[2007/10/11 01:07:37 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2007/10/11 01:07:35 | 000,348,672 | ---- | C] () -- C:\Windows\System32\HIDWatch.dll
[2007/09/17 09:45:55 | 000,010,314 | ---- | C] () -- C:\Windows\hpwscr10.dat
[2007/09/17 09:45:15 | 000,001,042 | ---- | C] () -- C:\Windows\hpwmdl10.dat
[2007/03/19 04:04:58 | 000,003,584 | ---- | C] () -- C:\Windows\System32\namResES.dll
[2007/03/19 04:04:58 | 000,003,072 | ---- | C] () -- C:\Windows\System32\namResIT.dll
[2007/03/19 04:04:58 | 000,003,072 | ---- | C] () -- C:\Windows\System32\namResFR.dll
[2007/03/19 04:04:58 | 000,003,072 | ---- | C] () -- C:\Windows\System32\namResENG.dll
[2007/03/19 04:04:58 | 000,003,072 | ---- | C] () -- C:\Windows\System32\namResDE.dll
[2007/03/19 04:04:56 | 000,003,584 | ---- | C] () -- C:\Windows\System32\namResPTB.dll
[2007/03/19 04:04:56 | 000,003,072 | ---- | C] () -- C:\Windows\System32\namResZHC.dll
[2007/03/19 04:04:56 | 000,003,072 | ---- | C] () -- C:\Windows\System32\namResKO.dll
[2007/03/19 04:04:56 | 000,003,072 | ---- | C] () -- C:\Windows\System32\namResJA.dll
[2007/03/19 04:04:54 | 000,022,016 | ---- | C] () -- C:\Windows\System32\nam_page.dll
[2007/03/19 04:04:54 | 000,003,072 | ---- | C] () -- C:\Windows\System32\namResZHT.dll
[2006/11/10 06:26:12 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2006/11/02 05:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 05:47:37 | 000,343,536 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 05:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 03:33:01 | 000,642,508 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 03:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 03:33:01 | 000,119,660 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 03:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 03:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006/11/02 03:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 01:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 01:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 00:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 00:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006/10/31 09:08:20 | 000,030,793 | ---- | C] () -- C:\Windows\System32\crtslv.dll
[2006/10/31 09:07:48 | 000,172,102 | ---- | C] () -- C:\Windows\System32\CRAnalyzer.dll

========== LOP Check ==========

[2010/07/06 02:51:48 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\A Gypsy's Tale - The Tower of Secrets
[2009/07/06 02:44:36 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Aisle 5 Games, Inc
[2010/07/01 15:30:05 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Alawar
[2011/08/06 00:53:28 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Alawar Entertainment
[2011/05/05 22:27:41 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\AlderGames
[2009/03/14 01:24:29 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Anabel
[2011/07/19 00:57:22 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Anarchy
[2008/06/28 22:04:01 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Ancient Quest of Saqqarah__bfg
[2010/06/06 00:34:53 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Arkadium
[2010/11/03 23:23:59 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Artifex Mundi
[2011/04/18 02:38:14 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Artogon
[2011/04/10 21:39:39 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Awem
[2010/12/27 22:54:40 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\BanzaiInteractive
[2009/09/20 01:06:54 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Batovi
[2008/09/06 05:25:21 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\BeachPartyCraze
[2008/10/26 22:10:25 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Beanbag Studios
[2011/01/21 07:00:47 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Bicyclestudios
[2011/02/21 16:10:19 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Big Fish Games
[2009/11/09 19:09:02 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\blg
[2009/08/24 20:22:36 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\BloodTies
[2011/08/06 01:59:53 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Blue Tea Games
[2011/07/27 06:14:02 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Boolat Games
[2011/01/06 02:04:55 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Boomzap
[2009/03/06 05:43:53 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\BrandX Games
[2009/11/10 01:34:59 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\BVS Solitaire Collection
[2010/09/24 22:56:54 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Camel101
[2009/10/17 01:35:31 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\casanova
[2008/12/23 02:33:11 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Cat's Eye Games
[2008/11/24 20:51:06 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\cerasus.media
[2009/12/08 01:30:51 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\ChaYoWo Games
[2009/01/31 01:05:27 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Coyotes Tale
[2009/12/26 23:15:57 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Curious Sense
[2011/05/28 15:28:03 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\DailyMagic
[2011/03/13 03:21:31 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\DarkParablesBriarRose_BFG
[2011/07/25 08:00:21 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Dekovir
[2009/09/10 21:30:24 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\DivoGames
[2010/01/13 01:24:07 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Dragon Altar Games
[2009/04/08 20:29:31 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Dream Farm Games
[2009/11/02 01:24:07 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\DreamDale
[2011/02/18 13:51:04 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Dying for Daylight
[2011/02/17 22:56:24 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Dying for Daylight Shared
[2009/02/03 15:14:53 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\eFax Messenger
[2009/01/02 06:32:57 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\eGames
[2010/11/24 06:43:49 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\EleFun Games
[2009/12/12 07:40:31 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\ElementalsTheMagicKey
[2011/08/06 22:57:11 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Elephant Games
[2011/04/17 17:46:30 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Enki Games
[2009/07/06 03:44:31 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Enlightenus
[2009/06/11 23:32:10 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Enlightenus1Beta
[2010/08/07 00:37:38 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Enlightenus2_BFG
[2010/08/07 02:47:48 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\ERS G-Studio
[2011/05/01 18:38:07 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\ERS Game Studios
[2009/12/29 23:19:11 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\EscapeTheMuseum2
[2009/01/17 20:47:48 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Fabulous Finds
[2010/02/18 06:41:57 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Faerie Solitaire
[2009/03/12 14:30:09 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Flood Light Games
[2011/01/13 17:57:32 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Floodlight Games
[2009/01/18 23:10:55 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\FloodLightGames
[2009/10/13 17:34:17 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\FlyWheelGames
[2008/09/02 06:02:23 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\ForgottenRiddles
[2008/08/11 23:39:55 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\ForgottenRiddles2
[2010/09/26 09:28:44 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Freeze Tag
[2011/07/06 02:13:04 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Friday's games
[2011/06/18 04:00:51 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Frogwares
[2011/01/07 16:21:04 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\funkitron
[2011/05/30 03:01:49 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Funswitch
[2011/08/06 03:02:41 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Funzai!
[2009/08/17 22:55:15 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\GameInvest
[2011/06/29 03:28:23 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\GameMill Entertainment
[2010/09/26 02:34:02 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Gamers Digital
[2009/07/12 20:33:33 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Games
[2009/07/01 23:36:43 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\GAMESHASTRA
[2011/03/15 21:18:37 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\GAMGO
[2010/09/24 22:56:47 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\GarageGames
[2010/10/02 17:06:56 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Ghost Ship Studios
[2011/07/06 02:09:56 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Gogii
[2008/12/02 01:15:31 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Gogii Games
[2010/01/30 02:45:28 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Gold Casual Games
[2010/02/17 22:11:53 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Green Clover Games
[2011/06/15 01:39:41 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\GreenSauceGames
[2009/10/29 13:47:38 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\GTM_Bodie
[2011/06/03 08:35:22 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Happy Muffin Top
[2011/07/25 16:41:30 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\HdO Adventure
[2009/04/22 21:51:14 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\HiT-MM
[2011/05/14 18:17:17 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\HitPoint Studios
[2008/09/24 01:11:44 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Home Sweet Home 2
[2010/04/21 23:35:55 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\HorizonWimba
[2009/09/09 01:49:47 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\HSA
[2008/03/10 12:33:05 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Image Zone Express
[2011/01/12 11:07:55 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\iMaxGen
[2010/08/04 03:06:03 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Immortal Lovers
[2007/12/09 07:50:53 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\InterTrust
[2009/01/07 02:45:49 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\IOMediaSupport6SZZ001s
[2009/06/01 14:48:26 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\IronCode
[2009/02/03 15:15:47 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\j2 Global
[2010/05/31 04:28:45 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Jetdogs Studios
[2009/01/28 21:20:50 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Jetsetter
[2011/02/03 23:49:54 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Jewel Keepers Easter Island
[2011/02/23 21:15:58 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Jewel Match 3
[2009/12/26 22:15:53 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\JoyBits
[2010/03/09 07:31:29 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\LaJangada
[2011/06/03 08:53:51 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Lazy Turtle Games
[2011/07/09 03:12:12 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\LestaStudio
[2009/03/15 21:13:23 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Lost in the City
[2010/03/15 23:33:23 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Ludia
[2009/08/21 22:18:50 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\MA
[2010/11/13 23:51:38 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\MA2
[2008/07/19 04:48:16 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Magic Academy
[2009/10/10 06:40:59 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Magic Academy 2
[2010/05/23 03:48:01 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Magic3
[2009/11/02 00:43:24 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\MagicBall4
[2010/05/31 21:02:11 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\MagicIndie
[2011/03/28 03:42:01 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\margrave3_full
[2009/09/20 19:10:35 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\MBT
[2009/10/09 03:21:03 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Meridian93
[2009/11/05 01:44:36 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Merscom
[2009/10/14 20:12:41 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Millennium_Saves
[2009/10/31 17:27:05 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\MissTeriTale3
[2009/01/28 19:45:57 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Mousechief
[2011/06/06 01:41:46 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\MumboJumbo
[2011/02/09 21:17:26 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Muse
[2008/10/19 23:25:12 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Mushroom Age
[2010/07/10 07:01:51 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Mutant Arcade
[2011/02/03 23:56:40 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\My Games
[2010/12/18 10:36:57 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Mystery of Mortlake Mansion
[2008/09/14 00:55:00 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\MysteryStudio
[2011/01/27 08:13:26 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Namco
[2010/08/02 09:51:37 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Odian Games
[2009/09/20 21:32:22 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Once Upon a Time in Chicago
[2011/06/20 15:39:41 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Orneon
[2009/12/31 23:55:51 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\OtherSide Realm of Eons
[2009/01/02 04:52:08 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\panoramik
[2008/12/18 17:50:26 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Participatory Culture Foundation
[2011/05/24 16:10:43 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\PCDr
[2009/10/15 04:37:14 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Ph03nixNewMedia
[2011/01/07 20:25:47 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Phantasmat_bf_ce1
[2008/09/01 19:31:33 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Pirateville
[2011/07/20 10:10:43 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\PlayFirst
[2010/10/26 16:34:39 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\PlayPond
[2009/12/26 22:05:21 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Playrix Entertainment
[2009/08/23 03:32:17 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\PoBros
[2009/08/22 02:08:16 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Princess Isabella
[2008/01/18 12:22:05 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Printer Info Cache
[2010/03/18 06:34:45 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\QB9
[2010/10/18 01:47:22 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\quickclick
[2009/07/05 02:10:07 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Quirky Games
[2011/05/15 22:54:53 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\ReelDealSlotQuest_Alice
[2011/04/25 02:52:01 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\ReelDealVampireAdventure
[2008/08/23 23:16:19 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Righteous Kill
[2009/02/13 13:02:52 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\RobinsonCrusoe
[2010/12/30 00:19:02 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Sahmon Games
[2010/05/30 20:04:26 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Scholastic
[2008/10/23 12:30:34 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\SecretIslandEng
[2009/03/07 03:41:56 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\SerpentOfIsis
[2010/05/01 21:00:35 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Settlement. Colossus
[2010/06/06 00:52:30 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\SevenSails
[2011/03/21 16:31:41 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\ShaoLin
[2008/12/16 23:47:05 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Shape games
[2009/08/30 02:21:30 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\she_is_a_shadow
[2011/04/03 15:50:36 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Silverback Productions
[2010/07/08 02:13:43 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Skunk Studios
[2009/01/25 15:41:44 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Smith Micro
[2009/02/11 06:50:31 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\SoundSpectrum
[2010/09/06 03:52:49 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Specialbit
[2009/01/07 02:45:49 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Spinapse
[2011/04/17 17:44:35 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\SpinTop Games
[2008/07/21 21:53:55 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\SprillBermudeEng
[2009/08/30 16:06:05 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\SprillRichiEng
[2008/06/19 01:30:16 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\SultansLabyrinth
[2010/06/09 01:54:41 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\SulusGames
[2009/01/07 02:46:13 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Suspects and Clues Players
[2009/01/07 02:45:51 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Suspects and Clues Prefs
[2010/07/01 13:55:33 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\TeleportGamesLtd
[2007/12/30 16:13:32 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Template
[2011/01/12 12:11:33 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\TFS2
[2011/07/17 23:58:59 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\TheFlyingDutchman
[2008/08/22 03:12:30 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\TheScruffs
[2011/01/29 03:30:06 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\TikisLab
[2009/11/09 18:39:28 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\TitanicMystery
[2011/04/27 17:12:31 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\TOMI3
[2010/05/01 20:39:55 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Top Evidence
[2010/03/03 23:33:24 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\TripleHippo
[2009/05/07 00:02:22 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Twintale Entertainment
[2009/07/13 21:43:33 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Ubisoft
[2010/11/15 13:16:25 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\URSE Games
[2009/07/05 20:06:36 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\V-Games
[2009/10/08 06:59:28 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\VampireSaga
[2010/12/13 23:33:49 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Vast Studios
[2011/07/04 15:46:19 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\VendelGAMES
[2011/02/08 08:27:36 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Virtual Prophecy
[2011/04/27 15:58:19 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Vogat Interactive
[2008/01/14 02:13:23 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Wal-Mart
[2011/01/26 17:17:20 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\WhiteBirdsProductions
[2010/08/27 00:06:02 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\YoudaGames
[2011/09/19 20:11:01 | 000,000,564 | ---- | M] () -- C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
[2011/09/10 10:06:25 | 000,032,532 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011/09/22 09:00:07 | 000,000,506 | ---- | M] () -- C:\Windows\Tasks\SystemToolsDailyTest.job

 

OTL.Txt (1 of 2)

Okay - I think it will take 4 posts, because I did try to split them up originally and even one at a time it was too much - anyway, here is the first half of the OTL.Txt log (tried to break it off somewhere where there seemed to be a break):

OTL logfile created on: 9/22/2011 7:18:16 PM - Run 1
OTL by OldTimer - Version 3.2.29.1 Folder = C:\Users\h\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19120)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1021.76 Mb Total Physical Memory | 526.68 Mb Available Physical Memory | 51.55% Memory free
2.41 Gb Paging File | 1.62 Gb Available in Paging File | 67.10% Paging File free
Paging file location(s): ?:\pagefile.sys

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.71 Gb Total Space | 244.30 Gb Free Space | 53.61% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 4.53 Gb Free Space | 45.32% Space Free | Partition Type: NTFS
Drive E: | 542.65 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 5.46 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive H: | 3.81 Gb Total Space | 0.09 Gb Free Space | 2.37% Space Free | Partition Type: FAT32

Computer Name: H-PC | User Name: h | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/09/22 19:12:31 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\h\Desktop\OTL.exe
PRC - [2011/06/15 15:16:48 | 000,997,920 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2011/04/27 15:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
PRC - [2011/04/27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2009/04/10 23:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2007/12/05 06:17:24 | 000,077,824 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AERTSrv.exe


========== Modules (No Company Name) ==========

MOD - [2008/06/20 00:42:13 | 000,043,520 | ---- | M] () -- C:\Windows\System32\CmdLineExt03.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (stllssvr)
SRV - File not found [Auto | Stopped] -- -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - File not found [On_Demand | Stopped] -- -- (GoogleDesktopManager-061008-081103)
SRV - [2011/07/06 19:52:38 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Disabled | Stopped] -- C:\Users\h\Desktop\Maintenance\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011/06/13 22:09:22 | 000,267,568 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Fix it Center\Matsvc.exe -- (MatSvc)
SRV - [2011/04/27 15:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV - [2011/04/27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2008/04/06 02:45:47 | 000,079,360 | ---- | M] (WoltersKluwerLWW) [On_Demand | Stopped] -- C:\Program Files\Common Files\WoltersKluwerLWW Shared\Service\LWWLicenseService.exe -- (LWWLicenseService)
SRV - [2008/01/19 00:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/12/05 06:17:24 | 000,077,824 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AERTSrv.exe -- (AERTFilters)
SRV - [2007/05/31 08:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007/05/31 08:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | System | Running] -- -- (MpKsl0e8c94c0)
DRV - [2011/09/21 22:29:28 | 000,028,752 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{EE62FF16-DECF-43AA-A10C-1D5429D12F3F}\MpKsl81b40e7f.sys -- (MpKsl81b40e7f)
DRV - [2011/07/06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011/04/27 15:25:24 | 000,065,024 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2011/04/18 13:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)
DRV - [2010/03/24 05:23:16 | 011,614,760 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007/08/17 18:56:46 | 000,059,520 | ---- | M] (DEVGURU Co,LTD.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PTDMWWAN.sys -- (PTDMWWAN)
DRV - [2007/08/17 18:56:40 | 000,039,936 | ---- | M] (DEVGURU Co,LTD.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PTDMVsp.sys -- (PTDMVsp)
DRV - [2007/08/17 18:56:38 | 000,041,856 | ---- | M] (DEVGURU Co,LTD.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PTDMMdm.sys -- (PTDMMdm)
DRV - [2007/08/17 18:56:34 | 000,029,952 | ---- | M] (DEVGURU Co,LTD.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PTDMBus.sys -- (PTDMBus)
DRV - [2007/08/09 18:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\nvstor32.sys -- (nvstor32)
DRV - [2007/06/28 07:18:10 | 001,310,720 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CM108.sys -- (USBPNPA)
DRV - [2007/03/15 06:57:30 | 001,059,112 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2006/11/08 00:02:40 | 000,024,064 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\point32k.sys -- (Point32)
DRV - [2006/11/02 00:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006/11/02 00:30:55 | 000,200,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2006/10/18 11:08:18 | 000,258,048 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2006/08/04 17:39:10 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6071203
IE - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local

========== FireFox ==========

FF - prefs.js..network.proxy.no_proxies_on: "localhost,127.0.0.1 "

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@adobe.com/Acrobat,version=5.1: C:\Program Files\Adobe\Acrobat 5.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\h\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\h\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/01/19 20:23:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/06/20 15:33:17 | 000,000,000 | ---D | M]

[2008/12/18 17:50:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\h\AppData\Roaming\Mozilla\Extensions
[2008/12/18 17:50:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\h\AppData\Roaming\Mozilla\Extensions\{6334D996-EA3E-4a0e-AA8D-15BA56B37241}
[2010/01/16 01:19:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\h\AppData\Roaming\Mozilla\Firefox\Profiles\adb3gney.default\extensions
[2009/12/09 11:10:23 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\h\AppData\Roaming\Mozilla\Firefox\Profiles\adb3gney.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2008/12/18 18:00:40 | 000,000,000 | ---D | M] ( "I ♥ Miro ") -- C:\Users\h\AppData\Roaming\Mozilla\Firefox\Profiles\adb3gney.default\extensions\{216ec66d-214a-43ea-92f0-5373f8405c88}
[2011/06/22 19:12:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/03/31 06:51:17 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/06/22 19:12:47 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011/05/04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\h\AppData\Local\Google\Chrome\Application\14.0.835.186\gcswf32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\h\AppData\Local\Google\Chrome\Application\14.0.835.186\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\h\AppData\Local\Google\Chrome\Application\14.0.835.186\pdf.dll
CHR - plugin: Abacast v2.1b3 (Enabled) = C:\Users\h\AppData\Roaming\Mozilla\plugins\NPAbacheck.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\h\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Dale Chihuly = C:\Users\h\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnenonhiffdmndmgiinmldkabciohign\3_0\

O1 HOSTS File: ([2011/09/13 17:32:04 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll File not found
O15 - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\..Trusted Domains: battle.net ([www] http in Trusted sites)
O15 - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\..Trusted Domains: bigfishgames.com ([www] http in Trusted sites)
O15 - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\..Trusted Domains: faunasphere.com ([]http in Trusted sites)
O15 - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\..Trusted Domains: faunasphere.com ([www] * in Trusted sites)
O15 - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\..Trusted Domains: taxactonline.com ([www] https in Trusted sites)
O15 - HKU\S-1-5-21-99570673-1611037384-3961291737-1000\..Trusted Ranges: Range1 ([https] in Trusted sites)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 205.171.3.25
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6B7029E6-1317-4471-86D3-DCE97E649AAC}: DhcpNameServer = 192.168.0.1 205.171.3.25
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\h\Pictures\thunderstorm on the beach.jpg
O24 - Desktop BackupWallPaper: C:\Users\h\Pictures\thunderstorm on the beach.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 14:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2001/04/18 00:23:00 | 000,000,041 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O32 - AutoRun File - [2007/02/12 12:53:42 | 000,000,277 | R--- | M] () - F:\autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.alf2cd - C:\Windows\System32\alf2cd.acm (NCT Company)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.rhetorex - rhetorex.acm File not found
Drivers32: msacm.speexacm - C:\Windows\System32\speexw.acm (http://www.speex.org/)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/09/22 19:08:23 | 000,582,656 | ---- | C] (OldTimer Tools) -- C:\Users\h\Desktop\OTL.exe
[2011/09/19 01:42:27 | 000,000,000 | ---D | C] -- C:\Users\h\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sacra Terra - Angelic Night
[2011/09/19 01:42:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sacra Terra - Angelic Night
[2011/09/19 01:42:27 | 000,000,000 | ---D | C] -- C:\Program Files\Sacra Terra - Angelic Night
[2011/09/13 17:34:21 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/09/13 17:34:14 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011/09/13 17:34:14 | 000,000,000 | ---D | C] -- C:\Users\h\AppData\Local\temp
[2011/09/13 17:21:40 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/09/13 17:21:40 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/09/13 17:21:40 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/09/13 17:21:34 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/09/13 17:21:30 | 000,000,000 | ---D | C] -- C:\Qoobox
[2008/11/28 14:54:44 | 008,346,560 | ---- | C] (Dell, Inc. ) -- C:\Users\h\AppData\Roaming\DataSafeDotNet.exe
[2006/10/31 09:08:36 | 000,018,944 | ---- | C] ( ) -- C:\Windows\System32\Implode.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/09/22 19:12:31 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\h\Desktop\OTL.exe
[2011/09/22 18:55:00 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-99570673-1611037384-3961291737-1000UA.job
[2011/09/22 18:16:52 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/09/22 18:16:31 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/09/22 17:55:19 | 000,000,840 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-99570673-1611037384-3961291737-1000Core.job
[2011/09/22 09:00:07 | 000,000,506 | ---- | M] () -- C:\Windows\tasks\SystemToolsDailyTest.job
[2011/09/19 20:11:01 | 000,000,564 | ---- | M] () -- C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job
[2011/09/19 01:43:32 | 000,001,883 | ---- | M] () -- C:\Users\Public\Desktop\Play Sacra Terra - Angelic Night.lnk
[2011/09/18 08:36:27 | 000,052,165 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011/09/18 08:36:27 | 000,052,165 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011/09/15 22:15:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/09/13 17:32:04 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011/09/10 10:23:49 | 000,642,508 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/09/10 10:23:48 | 000,119,660 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/09/10 10:06:22 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2011/09/02 17:26:07 | 000,000,512 | ---- | M] () -- C:\Users\h\Documents\MBR.dat
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/09/22 17:50:43 | 000,000,892 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-99570673-1611037384-3961291737-1000UA.job
[2011/09/22 17:50:41 | 000,000,840 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-99570673-1611037384-3961291737-1000Core.job
[2011/09/19 01:43:32 | 000,001,883 | ---- | C] () -- C:\Users\Public\Desktop\Play Sacra Terra - Angelic Night.lnk
[2011/09/13 17:21:40 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2011/09/13 17:21:40 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011/09/13 17:21:40 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/09/13 17:21:40 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/09/13 17:21:40 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/09/02 17:26:07 | 000,000,512 | ---- | C] () -- C:\Users\h\Documents\MBR.dat
[2010/04/14 03:47:31 | 000,052,165 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010/04/14 03:47:31 | 000,052,165 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010/03/27 10:41:38 | 000,136,110 | ---- | C] () -- C:\Windows\hpwins10.dat.temp
[2010/03/27 10:41:38 | 000,001,042 | ---- | C] () -- C:\Windows\hpwmdl10.dat.temp
[2010/03/27 10:29:11 | 000,136,283 | ---- | C] () -- C:\Windows\hpwins10.dat
[2009/12/26 22:15:51 | 000,000,190 | ---- | C] () -- C:\Windows\settings.ini
[2009/07/17 23:01:50 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/07/17 23:01:50 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009/02/02 20:39:55 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat
[2009/01/21 02:03:19 | 000,000,016 | ---- | C] () -- C:\Windows\popcinfo.dat
[2008/12/18 17:35:31 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2008/11/13 06:05:18 | 000,001,732 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2008/10/28 17:09:20 | 000,000,680 | ---- | C] () -- C:\Users\h\AppData\Local\d3d9caps.dat
[2008/09/03 17:52:37 | 000,000,037 | ---- | C] () -- C:\Windows\cdplayer.ini
[2008/08/15 11:17:33 | 000,308,224 | ---- | C] () -- C:\Windows\System32\Lffpx7.dll
[2008/08/15 11:17:33 | 000,091,136 | ---- | C] () -- C:\Windows\System32\Lfkodak.dll
[2008/07/28 03:01:10 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/04/28 00:36:44 | 000,000,127 | ---- | C] () -- C:\Windows\pccillin.ini
[2008/04/12 15:38:05 | 000,038,270 | ---- | C] () -- C:\Windows\DIIUnin.dat
[2008/04/09 04:09:01 | 000,001,644 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2008/04/09 04:09:01 | 000,000,288 | ---- | C] () -- C:\Windows\ODBC.INI
[2007/12/30 16:13:31 | 000,000,196 | ---- | C] () -- C:\Users\h\AppData\Roaming\wklnhst.dat
[2007/12/14 23:34:31 | 000,000,000 | ---- | C] () -- C:\Windows\iPlayer.INI
[2007/12/08 11:52:52 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll
[2007/12/07 15:22:56 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
[2007/12/07 15:22:55 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
[2007/12/07 15:22:55 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
[2007/12/07 13:42:27 | 000,031,744 | ---- | C] () -- C:\Users\h\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/12/03 08:09:58 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2007/10/11 01:07:55 | 000,049,152 | ---- | C] () -- C:\Windows\System32\sndcvtlb.dll
[2007/10/11 01:07:37 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2007/10/11 01:07:35 | 000,348,672 | ---- | C] () -- C:\Windows\System32\HIDWatch.dll
[2007/09/17 09:45:55 | 000,010,314 | ---- | C] () -- C:\Windows\hpwscr10.dat
[2007/09/17 09:45:15 | 000,001,042 | ---- | C] () -- C:\Windows\hpwmdl10.dat
[2007/03/19 04:04:58 | 000,003,584 | ---- | C] () -- C:\Windows\System32\namResES.dll
[2007/03/19 04:04:58 | 000,003,072 | ---- | C] () -- C:\Windows\System32\namResIT.dll
[2007/03/19 04:04:58 | 000,003,072 | ---- | C] () -- C:\Windows\System32\namResFR.dll
[2007/03/19 04:04:58 | 000,003,072 | ---- | C] () -- C:\Windows\System32\namResENG.dll
[2007/03/19 04:04:58 | 000,003,072 | ---- | C] () -- C:\Windows\System32\namResDE.dll
[2007/03/19 04:04:56 | 000,003,584 | ---- | C] () -- C:\Windows\System32\namResPTB.dll
[2007/03/19 04:04:56 | 000,003,072 | ---- | C] () -- C:\Windows\System32\namResZHC.dll
[2007/03/19 04:04:56 | 000,003,072 | ---- | C] () -- C:\Windows\System32\namResKO.dll
[2007/03/19 04:04:56 | 000,003,072 | ---- | C] () -- C:\Windows\System32\namResJA.dll
[2007/03/19 04:04:54 | 000,022,016 | ---- | C] () -- C:\Windows\System32\nam_page.dll
[2007/03/19 04:04:54 | 000,003,072 | ---- | C] () -- C:\Windows\System32\namResZHT.dll
[2006/11/10 06:26:12 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2006/11/02 05:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 05:47:37 | 000,343,536 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 05:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 03:33:01 | 000,642,508 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 03:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 03:33:01 | 000,119,660 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 03:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 03:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006/11/02 03:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 01:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 01:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 00:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 00:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006/10/31 09:08:20 | 000,030,793 | ---- | C] () -- C:\Windows\System32\crtslv.dll
[2006/10/31 09:07:48 | 000,172,102 | ---- | C] () -- C:\Windows\System32\CRAnalyzer.dll

========== LOP Check ==========

[2010/07/06 02:51:48 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\A Gypsy's Tale - The Tower of Secrets
[2009/07/06 02:44:36 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Aisle 5 Games, Inc
[2010/07/01 15:30:05 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Alawar
[2011/08/06 00:53:28 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Alawar Entertainment
[2011/05/05 22:27:41 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\AlderGames
[2009/03/14 01:24:29 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Anabel
[2011/07/19 00:57:22 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Anarchy
[2008/06/28 22:04:01 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Ancient Quest of Saqqarah__bfg
[2010/06/06 00:34:53 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Arkadium
[2010/11/03 23:23:59 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Artifex Mundi
[2011/04/18 02:38:14 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Artogon
[2011/04/10 21:39:39 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Awem
[2010/12/27 22:54:40 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\BanzaiInteractive
[2009/09/20 01:06:54 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Batovi
[2008/09/06 05:25:21 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\BeachPartyCraze
[2008/10/26 22:10:25 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Beanbag Studios
[2011/01/21 07:00:47 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Bicyclestudios
[2011/02/21 16:10:19 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Big Fish Games
[2009/11/09 19:09:02 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\blg
[2009/08/24 20:22:36 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\BloodTies
[2011/08/06 01:59:53 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Blue Tea Games
[2011/07/27 06:14:02 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Boolat Games
[2011/01/06 02:04:55 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Boomzap
[2009/03/06 05:43:53 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\BrandX Games
[2009/11/10 01:34:59 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\BVS Solitaire Collection
[2010/09/24 22:56:54 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Camel101
[2009/10/17 01:35:31 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\casanova
[2008/12/23 02:33:11 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Cat's Eye Games
[2008/11/24 20:51:06 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\cerasus.media
[2009/12/08 01:30:51 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\ChaYoWo Games
[2009/01/31 01:05:27 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Coyotes Tale
[2009/12/26 23:15:57 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Curious Sense
[2011/05/28 15:28:03 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\DailyMagic
[2011/03/13 03:21:31 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\DarkParablesBriarRose_BFG
[2011/07/25 08:00:21 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Dekovir
[2009/09/10 21:30:24 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\DivoGames
[2010/01/13 01:24:07 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Dragon Altar Games
[2009/04/08 20:29:31 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Dream Farm Games
[2009/11/02 01:24:07 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\DreamDale
[2011/02/18 13:51:04 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Dying for Daylight
[2011/02/17 22:56:24 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Dying for Daylight Shared
[2009/02/03 15:14:53 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\eFax Messenger
[2009/01/02 06:32:57 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\eGames
[2010/11/24 06:43:49 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\EleFun Games
[2009/12/12 07:40:31 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\ElementalsTheMagicKey
[2011/08/06 22:57:11 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Elephant Games
[2011/04/17 17:46:30 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Enki Games
[2009/07/06 03:44:31 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Enlightenus
[2009/06/11 23:32:10 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Enlightenus1Beta
[2010/08/07 00:37:38 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Enlightenus2_BFG
[2010/08/07 02:47:48 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\ERS G-Studio
[2011/05/01 18:38:07 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\ERS Game Studios
[2009/12/29 23:19:11 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\EscapeTheMuseum2
[2009/01/17 20:47:48 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Fabulous Finds
[2010/02/18 06:41:57 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Faerie Solitaire
[2009/03/12 14:30:09 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Flood Light Games
[2011/01/13 17:57:32 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Floodlight Games
[2009/01/18 23:10:55 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\FloodLightGames
[2009/10/13 17:34:17 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\FlyWheelGames
[2008/09/02 06:02:23 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\ForgottenRiddles
[2008/08/11 23:39:55 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\ForgottenRiddles2
[2010/09/26 09:28:44 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Freeze Tag
[2011/07/06 02:13:04 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Friday's games
[2011/06/18 04:00:51 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Frogwares
[2011/01/07 16:21:04 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\funkitron
[2011/05/30 03:01:49 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Funswitch
[2011/08/06 03:02:41 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Funzai!
[2009/08/17 22:55:15 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\GameInvest
[2011/06/29 03:28:23 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\GameMill Entertainment
[2010/09/26 02:34:02 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Gamers Digital
[2009/07/12 20:33:33 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Games
[2009/07/01 23:36:43 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\GAMESHASTRA
[2011/03/15 21:18:37 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\GAMGO
[2010/09/24 22:56:47 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\GarageGames
[2010/10/02 17:06:56 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Ghost Ship Studios
[2011/07/06 02:09:56 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Gogii
[2008/12/02 01:15:31 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Gogii Games
[2010/01/30 02:45:28 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Gold Casual Games
[2010/02/17 22:11:53 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Green Clover Games
[2011/06/15 01:39:41 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\GreenSauceGames
[2009/10/29 13:47:38 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\GTM_Bodie
[2011/06/03 08:35:22 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Happy Muffin Top
[2011/07/25 16:41:30 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\HdO Adventure
[2009/04/22 21:51:14 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\HiT-MM
[2011/05/14 18:17:17 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\HitPoint Studios
[2008/09/24 01:11:44 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Home Sweet Home 2
[2010/04/21 23:35:55 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\HorizonWimba
[2009/09/09 01:49:47 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\HSA
[2008/03/10 12:33:05 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Image Zone Express
[2011/01/12 11:07:55 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\iMaxGen
[2010/08/04 03:06:03 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Immortal Lovers
[2007/12/09 07:50:53 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\InterTrust
[2009/01/07 02:45:49 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\IOMediaSupport6SZZ001s
[2009/06/01 14:48:26 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\IronCode
[2009/02/03 15:15:47 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\j2 Global
[2010/05/31 04:28:45 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Jetdogs Studios
[2009/01/28 21:20:50 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Jetsetter
[2011/02/03 23:49:54 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Jewel Keepers Easter Island
[2011/02/23 21:15:58 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Jewel Match 3
[2009/12/26 22:15:53 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\JoyBits
[2010/03/09 07:31:29 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\LaJangada
[2011/06/03 08:53:51 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Lazy Turtle Games
[2011/07/09 03:12:12 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\LestaStudio
[2009/03/15 21:13:23 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Lost in the City
[2010/03/15 23:33:23 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Ludia
[2009/08/21 22:18:50 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\MA
[2010/11/13 23:51:38 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\MA2
[2008/07/19 04:48:16 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Magic Academy
[2009/10/10 06:40:59 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Magic Academy 2
[2010/05/23 03:48:01 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Magic3
[2009/11/02 00:43:24 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\MagicBall4
[2010/05/31 21:02:11 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\MagicIndie
[2011/03/28 03:42:01 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\margrave3_full
[2009/09/20 19:10:35 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\MBT
[2009/10/09 03:21:03 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Meridian93
[2009/11/05 01:44:36 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Merscom
[2009/10/14 20:12:41 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Millennium_Saves
[2009/10/31 17:27:05 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\MissTeriTale3
[2009/01/28 19:45:57 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Mousechief
[2011/06/06 01:41:46 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\MumboJumbo
[2011/02/09 21:17:26 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Muse
[2008/10/19 23:25:12 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Mushroom Age
[2010/07/10 07:01:51 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Mutant Arcade
[2011/02/03 23:56:40 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\My Games
[2010/12/18 10:36:57 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Mystery of Mortlake Mansion
[2008/09/14 00:55:00 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\MysteryStudio
[2011/01/27 08:13:26 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Namco
[2010/08/02 09:51:37 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Odian Games
[2009/09/20 21:32:22 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Once Upon a Time in Chicago
[2011/06/20 15:39:41 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Orneon
[2009/12/31 23:55:51 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\OtherSide Realm of Eons
[2009/01/02 04:52:08 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\panoramik
[2008/12/18 17:50:26 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Participatory Culture Foundation
[2011/05/24 16:10:43 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\PCDr
[2009/10/15 04:37:14 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Ph03nixNewMedia
[2011/01/07 20:25:47 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Phantasmat_bf_ce1
[2008/09/01 19:31:33 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Pirateville
[2011/07/20 10:10:43 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\PlayFirst
[2010/10/26 16:34:39 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\PlayPond
[2009/12/26 22:05:21 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Playrix Entertainment
[2009/08/23 03:32:17 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\PoBros
[2009/08/22 02:08:16 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Princess Isabella
[2008/01/18 12:22:05 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Printer Info Cache
[2010/03/18 06:34:45 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\QB9
[2010/10/18 01:47:22 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\quickclick
[2009/07/05 02:10:07 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Quirky Games
[2011/05/15 22:54:53 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\ReelDealSlotQuest_Alice
[2011/04/25 02:52:01 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\ReelDealVampireAdventure
[2008/08/23 23:16:19 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Righteous Kill
[2009/02/13 13:02:52 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\RobinsonCrusoe
[2010/12/30 00:19:02 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Sahmon Games
[2010/05/30 20:04:26 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Scholastic
[2008/10/23 12:30:34 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\SecretIslandEng
[2009/03/07 03:41:56 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\SerpentOfIsis
[2010/05/01 21:00:35 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Settlement. Colossus
[2010/06/06 00:52:30 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\SevenSails
[2011/03/21 16:31:41 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\ShaoLin
[2008/12/16 23:47:05 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Shape games
[2009/08/30 02:21:30 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\she_is_a_shadow
[2011/04/03 15:50:36 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Silverback Productions
[2010/07/08 02:13:43 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Skunk Studios
[2009/01/25 15:41:44 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Smith Micro
[2009/02/11 06:50:31 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\SoundSpectrum
[2010/09/06 03:52:49 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Specialbit
[2009/01/07 02:45:49 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Spinapse
[2011/04/17 17:44:35 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\SpinTop Games
[2008/07/21 21:53:55 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\SprillBermudeEng
[2009/08/30 16:06:05 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\SprillRichiEng
[2008/06/19 01:30:16 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\SultansLabyrinth
[2010/06/09 01:54:41 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\SulusGames
[2009/01/07 02:46:13 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Suspects and Clues Players
[2009/01/07 02:45:51 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Suspects and Clues Prefs
[2010/07/01 13:55:33 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\TeleportGamesLtd
[2007/12/30 16:13:32 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Template
[2011/01/12 12:11:33 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\TFS2
[2011/07/17 23:58:59 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\TheFlyingDutchman
[2008/08/22 03:12:30 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\TheScruffs
[2011/01/29 03:30:06 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\TikisLab
[2009/11/09 18:39:28 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\TitanicMystery
[2011/04/27 17:12:31 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\TOMI3
[2010/05/01 20:39:55 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Top Evidence
[2010/03/03 23:33:24 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\TripleHippo
[2009/05/07 00:02:22 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Twintale Entertainment
[2009/07/13 21:43:33 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Ubisoft
[2010/11/15 13:16:25 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\URSE Games
[2009/07/05 20:06:36 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\V-Games
[2009/10/08 06:59:28 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\VampireSaga
[2010/12/13 23:33:49 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Vast Studios
[2011/07/04 15:46:19 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\VendelGAMES
[2011/02/08 08:27:36 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Virtual Prophecy
[2011/04/27 15:58:19 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Vogat Interactive
[2008/01/14 02:13:23 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\Wal-Mart
[2011/01/26 17:17:20 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\WhiteBirdsProductions
[2010/08/27 00:06:02 | 000,000,000 | ---D | M] -- C:\Users\h\AppData\Roaming\YoudaGames
[2011/09/19 20:11:01 | 000,000,564 | ---- | M] () -- C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
[2011/09/10 10:06:25 | 000,032,532 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011/09/22 09:00:07 | 000,000,506 | ---- | M] () -- C:\Windows\Tasks\SystemToolsDailyTest.job

 

OTL.Txt (2 of 2)

color=#E56717]========== Purity Check ==========[/color]



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2006/09/18 14:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2009/04/10 23:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2006/11/10 06:22:24 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2011/09/13 17:34:12 | 000,017,148 | ---- | M] () -- C:\ComboFix.txt
[2006/09/18 14:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2007/12/03 15:54:23 | 000,004,811 | RH-- | M] () -- C:\dell.sdr
[2008/04/09 04:04:52 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2008/04/09 04:04:52 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008/04/14 18:54:33 | 000,000,297 | ---- | M] () -- C:\nslookup.txt
[2011/09/22 16:26:19 | 1556,881,408 | -HS- | M] () -- C:\pagefile.sys
[2008/06/30 15:25:59 | 003,629,681 | ---- | M] (Sylvan Software ) -- C:\ScIVG20.exe
[2008/09/15 05:37:40 | 000,001,715 | ---- | M] () -- C:\tracert.txt
[2011/07/31 00:17:37 | 000,003,180 | ---- | M] () -- C:\z_prof_log.txt

< %systemroot%\Fonts\*.com >
[2006/11/02 05:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 05:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 05:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/18 05:56:27 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 14:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2007/08/17 21:27:36 | 000,273,920 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\hpzpp4x6.dll
[2006/10/26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/09/29 09:34:18 | 013,828,096 | ---- | M] () -- C:\Windows\gtss.scr
[2011/03/18 11:32:44 | 000,561,152 | ---- | M] () -- C:\Windows\SamainSS.scr
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/04/05 20:00:08 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 03:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 03:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 03:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 03:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 03:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/04/06 02:20:52 | 000,000,286 | -HS- | M] () -- C:\Users\h\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/09/22 19:12:31 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\h\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >
[2011/06/13 21:13:08 | 000,000,786 | ---- | M] () -- C:\Windows\AppPatch\Custom\{c9920352-04e6-469d-bab8-e2b9c7c75415}.sdb

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >
[2008/02/10 03:38:12 | 014,520,461 | ---- | M] (Rene-Gilles Deberdt ) -- C:\Users\h\kyo2006.exe

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2007/12/07 13:38:12 | 000,000,402 | -HS- | M] () -- C:\Users\h\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2009/09/09 01:33:20 | 000,000,354 | ---- | M] () -- C:\ProgramData\aygda_save.log
[2009/03/12 14:29:32 | 000,000,262 | ---- | M] () -- C:\ProgramData\ayg_save.log
[2010/07/14 02:33:36 | 000,008,580 | ---- | M] () -- C:\ProgramData\hpzinstall.log
[2011/09/18 08:36:27 | 000,052,165 | ---- | M] () -- C:\ProgramData\nvModes.001

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:F0AB86C0
@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:EEB25EAE
@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:C63E7DE2
@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:ABFEED8E
@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:9EC86225
@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:43301D1D
@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:067F588D
@Alternate Data Stream - 98 bytes -> C:\ProgramData\TEMP:BA05E0C4
@Alternate Data Stream - 98 bytes -> C:\ProgramData\TEMP:3473F385
@Alternate Data Stream - 97 bytes -> C:\ProgramData\TEMP:F33592E3
@Alternate Data Stream - 97 bytes -> C:\ProgramData\TEMP:73CF0D7D
@Alternate Data Stream - 96 bytes -> C:\ProgramData\TEMP:164FA86E
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMPAE3649B
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:59C113EC
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:54D5DB8A
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:1CAF6B12
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:1316EAD4
@Alternate Data Stream - 94 bytes -> C:\ProgramData\TEMP:F9E10A82
@Alternate Data Stream - 94 bytes -> C:\ProgramData\TEMP:CEF2A14E
@Alternate Data Stream - 94 bytes -> C:\ProgramData\TEMP:A4CDE823
@Alternate Data Stream - 94 bytes -> C:\ProgramData\TEMP:506E1E25
@Alternate Data Stream - 238 bytes -> C:\ProgramData\TEMP:9D6EAEC3
@Alternate Data Stream - 238 bytes -> C:\ProgramData\TEMP:0A74923C
@Alternate Data Stream - 237 bytes -> C:\ProgramData\TEMP:B190BE3A
@Alternate Data Stream - 237 bytes -> C:\ProgramData\TEMP:71612023
@Alternate Data Stream - 237 bytes -> C:\ProgramData\TEMP:123A86B5
@Alternate Data Stream - 236 bytes -> C:\ProgramData\TEMP:BF6A2C54
@Alternate Data Stream - 236 bytes -> C:\ProgramData\TEMP:961B84C5
@Alternate Data Stream - 236 bytes -> C:\ProgramData\TEMP:938EB9FC
@Alternate Data Stream - 236 bytes -> C:\ProgramData\TEMP:19474103
@Alternate Data Stream - 235 bytes -> C:\ProgramData\TEMP:A9056F42
@Alternate Data Stream - 235 bytes -> C:\ProgramData\TEMP:A819A132
@Alternate Data Stream - 235 bytes -> C:\ProgramData\TEMP:63210866
@Alternate Data Stream - 234 bytes -> C:\ProgramData\TEMP:F0A06891
@Alternate Data Stream - 234 bytes -> C:\ProgramData\TEMP:A2FF62A6
@Alternate Data Stream - 234 bytes -> C:\ProgramData\TEMP:91FFEC32
@Alternate Data Stream - 234 bytes -> C:\ProgramData\TEMP:864881BF
@Alternate Data Stream - 234 bytes -> C:\ProgramData\TEMP:6247E766
@Alternate Data Stream - 234 bytes -> C:\ProgramData\TEMP:4A01545C
@Alternate Data Stream - 233 bytes -> C:\ProgramData\TEMP:ED2D63E4
@Alternate Data Stream - 233 bytes -> C:\ProgramData\TEMP:ECF3C50F
@Alternate Data Stream - 233 bytes -> C:\ProgramData\TEMP:E8C44CB4
@Alternate Data Stream - 233 bytes -> C:\ProgramData\TEMP:E29063FF
@Alternate Data Stream - 233 bytes -> C:\ProgramData\TEMP4BB0AD6
@Alternate Data Stream - 233 bytes -> C:\ProgramData\TEMP:BF640EE5
@Alternate Data Stream - 233 bytes -> C:\ProgramData\TEMP:A6D6E537
@Alternate Data Stream - 233 bytes -> C:\ProgramData\TEMP:3969ACF7
@Alternate Data Stream - 233 bytes -> C:\ProgramData\TEMP:0EC7A545
@Alternate Data Stream - 233 bytes -> C:\ProgramData\TEMP:0696EC8E
@Alternate Data Stream - 232 bytes -> C:\ProgramData\TEMP:F8F070C2
@Alternate Data Stream - 232 bytes -> C:\ProgramData\TEMP:C1F1392C
@Alternate Data Stream - 232 bytes -> C:\ProgramData\TEMP:99B20AD0
@Alternate Data Stream - 232 bytes -> C:\ProgramData\TEMP:53B8C5D2
@Alternate Data Stream - 232 bytes -> C:\ProgramData\TEMP:4FA837B4
@Alternate Data Stream - 232 bytes -> C:\ProgramData\TEMP:25D6137A
@Alternate Data Stream - 231 bytes -> C:\ProgramData\TEMP:EDC744FB
@Alternate Data Stream - 231 bytes -> C:\ProgramData\TEMP:E7B4296D
@Alternate Data Stream - 231 bytes -> C:\ProgramData\TEMP:9F38BF31
@Alternate Data Stream - 231 bytes -> C:\ProgramData\TEMP:54380FEC
@Alternate Data Stream - 231 bytes -> C:\ProgramData\TEMP:0785072C
@Alternate Data Stream - 230 bytes -> C:\ProgramData\TEMP:E14FA16F
@Alternate Data Stream - 230 bytes -> C:\ProgramData\TEMP:C76CFF82
@Alternate Data Stream - 230 bytes -> C:\ProgramData\TEMP:C72A744C
@Alternate Data Stream - 230 bytes -> C:\ProgramData\TEMP:8924043A
@Alternate Data Stream - 230 bytes -> C:\ProgramData\TEMP:852F2262
@Alternate Data Stream - 230 bytes -> C:\ProgramData\TEMP:71004506
@Alternate Data Stream - 230 bytes -> C:\ProgramData\TEMP:2495D97A
@Alternate Data Stream - 229 bytes -> C:\ProgramData\TEMP:E732B44B
@Alternate Data Stream - 229 bytes -> C:\ProgramData\TEMP:C0BCE04B
@Alternate Data Stream - 229 bytes -> C:\ProgramData\TEMP:89C28CF6
@Alternate Data Stream - 229 bytes -> C:\ProgramData\TEMP:7ADB695A
@Alternate Data Stream - 229 bytes -> C:\ProgramData\TEMP:75798D9A
@Alternate Data Stream - 229 bytes -> C:\ProgramData\TEMP:0F38B460
@Alternate Data Stream - 228 bytes -> C:\ProgramData\TEMP:F84B8DB5
@Alternate Data Stream - 228 bytes -> C:\ProgramData\TEMP:F5B51004
@Alternate Data Stream - 228 bytes -> C:\ProgramData\TEMP:B54E4B5A
@Alternate Data Stream - 228 bytes -> C:\ProgramData\TEMP:B0456F0C
@Alternate Data Stream - 228 bytes -> C:\ProgramData\TEMP:8B4B9596
@Alternate Data Stream - 228 bytes -> C:\ProgramData\TEMP:689AB7E9
@Alternate Data Stream - 228 bytes -> C:\ProgramData\TEMP:4AA3DAA3
@Alternate Data Stream - 228 bytes -> C:\ProgramData\TEMP:488F7244
@Alternate Data Stream - 227 bytes -> C:\ProgramData\TEMP:EFF3C3C8
@Alternate Data Stream - 227 bytes -> C:\ProgramData\TEMP:C48A983C
@Alternate Data Stream - 227 bytes -> C:\ProgramData\TEMP:80BFDE16
@Alternate Data Stream - 227 bytes -> C:\ProgramData\TEMP:4D551822
@Alternate Data Stream - 226 bytes -> C:\ProgramData\TEMP:F41E22A9
@Alternate Data Stream - 226 bytes -> C:\ProgramData\TEMP47B19A6
@Alternate Data Stream - 226 bytes -> C:\ProgramData\TEMP:88C0A705
@Alternate Data Stream - 226 bytes -> C:\ProgramData\TEMP:87A3A233
@Alternate Data Stream - 226 bytes -> C:\ProgramData\TEMP:43ECEA33
@Alternate Data Stream - 225 bytes -> C:\ProgramData\TEMP3A89E47
@Alternate Data Stream - 225 bytes -> C:\ProgramData\TEMP0757AAB
@Alternate Data Stream - 225 bytes -> C:\ProgramData\TEMP:C6D0ABC3
@Alternate Data Stream - 225 bytes -> C:\ProgramData\TEMP:C48905F4
@Alternate Data Stream - 225 bytes -> C:\ProgramData\TEMP:A60D0FA6
@Alternate Data Stream - 225 bytes -> C:\ProgramData\TEMP:7FCB9D0D
@Alternate Data Stream - 225 bytes -> C:\ProgramData\TEMP:5080697C
@Alternate Data Stream - 224 bytes -> C:\ProgramData\TEMP:ED51D3ED
@Alternate Data Stream - 224 bytes -> C:\ProgramData\TEMP:E6C6EB3B
@Alternate Data Stream - 224 bytes -> C:\ProgramData\TEMP:627153F1
@Alternate Data Stream - 224 bytes -> C:\ProgramData\TEMP:61B54B15
@Alternate Data Stream - 224 bytes -> C:\ProgramData\TEMP:13EF4AF6
@Alternate Data Stream - 224 bytes -> C:\ProgramData\TEMP:1181620C
@Alternate Data Stream - 223 bytes -> C:\ProgramData\TEMP:FA29CA24
@Alternate Data Stream - 223 bytes -> C:\ProgramData\TEMP:6F0B6A5A
@Alternate Data Stream - 223 bytes -> C:\ProgramData\TEMP:2AE74FF9
@Alternate Data Stream - 223 bytes -> C:\ProgramData\TEMP:0FE0A03C
@Alternate Data Stream - 223 bytes -> C:\ProgramData\TEMP:07241935
@Alternate Data Stream - 223 bytes -> C:\ProgramData\TEMP:054F0F17
@Alternate Data Stream - 222 bytes -> C:\ProgramData\TEMPB4C77AD
@Alternate Data Stream - 222 bytes -> C:\ProgramData\TEMP:ADE67221
@Alternate Data Stream - 222 bytes -> C:\ProgramData\TEMP:8E5EA40F
@Alternate Data Stream - 222 bytes -> C:\ProgramData\TEMP:697DDE2B
@Alternate Data Stream - 222 bytes -> C:\ProgramData\TEMP:5E413CD6
@Alternate Data Stream - 222 bytes -> C:\ProgramData\TEMP:397D67BA
@Alternate Data Stream - 222 bytes -> C:\ProgramData\TEMP:0E22C5DB
@Alternate Data Stream - 221 bytes -> C:\ProgramData\TEMP:2AF322BF
@Alternate Data Stream - 221 bytes -> C:\ProgramData\TEMP:213AFE42
@Alternate Data Stream - 220 bytes -> C:\ProgramData\TEMP:C22674B6
@Alternate Data Stream - 220 bytes -> C:\ProgramData\TEMP:9FD757A9
@Alternate Data Stream - 220 bytes -> C:\ProgramData\TEMP:8999FD56
@Alternate Data Stream - 220 bytes -> C:\ProgramData\TEMP:8944C195
@Alternate Data Stream - 220 bytes -> C:\ProgramData\TEMP:6A0A47E7
@Alternate Data Stream - 220 bytes -> C:\ProgramData\TEMP:5FA4CB99
@Alternate Data Stream - 220 bytes -> C:\ProgramData\TEMP:5CE91C67
@Alternate Data Stream - 220 bytes -> C:\ProgramData\TEMP:53DF59D1
@Alternate Data Stream - 220 bytes -> C:\ProgramData\TEMP:1D6B18F1
@Alternate Data Stream - 220 bytes -> C:\ProgramData\TEMP:0FA1EAA7
@Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:BBCB4421
@Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:A5241382
@Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:A4E7D25F
@Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:A167A0BB
@Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:7DC5D762
@Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:6444B424
@Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:5A7229F8
@Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:3539CD43
@Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:2871B698
@Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:23834E1E
@Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:225CD7D5
@Alternate Data Stream - 218 bytes -> C:\ProgramData\TEMP:FAB64002
@Alternate Data Stream - 218 bytes -> C:\ProgramData\TEMP:A6D89509
@Alternate Data Stream - 218 bytes -> C:\ProgramData\TEMP:97C4F81F
@Alternate Data Stream - 218 bytes -> C:\ProgramData\TEMP:90D89144
@Alternate Data Stream - 218 bytes -> C:\ProgramData\TEMP:895A78C5
@Alternate Data Stream - 218 bytes -> C:\ProgramData\TEMP:7E082023
@Alternate Data Stream - 218 bytes -> C:\ProgramData\TEMP:587F3582
@Alternate Data Stream - 218 bytes -> C:\ProgramData\TEMP:52C24010
@Alternate Data Stream - 218 bytes -> C:\ProgramData\TEMP:2CC32B31
@Alternate Data Stream - 218 bytes -> C:\ProgramData\TEMP:2B1EA607
@Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:FED25C29
@Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP31BE97C
@Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:C7973317
@Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:C10635F6
@Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:C07A6A6B
@Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:BDCD8531
@Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:90865A6D
@Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:569CEE83
@Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:378824DE
@Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:124B94C0
@Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:10E0E83D
@Alternate Data Stream - 216 bytes -> C:\ProgramData\TEMP:E2CFA9CD
@Alternate Data Stream - 216 bytes -> C:\ProgramData\TEMPD04902E
@Alternate Data Stream - 216 bytes -> C:\ProgramData\TEMPB77E2C4
@Alternate Data Stream - 216 bytes -> C:\ProgramData\TEMP:C0A9B815
@Alternate Data Stream - 216 bytes -> C:\ProgramData\TEMP:A5584049
@Alternate Data Stream - 216 bytes -> C:\ProgramData\TEMP:870649A4
@Alternate Data Stream - 216 bytes -> C:\ProgramData\TEMP:7A032A04
@Alternate Data Stream - 216 bytes -> C:\ProgramData\TEMP:5C6EBC69
@Alternate Data Stream - 216 bytes -> C:\ProgramData\TEMP:59465B40
@Alternate Data Stream - 216 bytes -> C:\ProgramData\TEMP:3D186293
@Alternate Data Stream - 216 bytes -> C:\ProgramData\TEMP:206470A5
@Alternate Data Stream - 215 bytes -> C:\ProgramData\TEMP:FDDD8917
@Alternate Data Stream - 215 bytes -> C:\ProgramData\TEMPE875C30
@Alternate Data Stream - 215 bytes -> C:\ProgramData\TEMP8D58038
@Alternate Data Stream - 215 bytes -> C:\ProgramData\TEMP:C9CDDE5E
@Alternate Data Stream - 215 bytes -> C:\ProgramData\TEMP:C67CB31A
@Alternate Data Stream - 215 bytes -> C:\ProgramData\TEMP:94B46CA2
@Alternate Data Stream - 215 bytes -> C:\ProgramData\TEMP:943E8182
@Alternate Data Stream - 215 bytes -> C:\ProgramData\TEMP:89CF6F9C
@Alternate Data Stream - 215 bytes -> C:\ProgramData\TEMP:7FD903D7
@Alternate Data Stream - 215 bytes -> C:\ProgramData\TEMP:78739EC9
@Alternate Data Stream - 215 bytes -> C:\ProgramData\TEMP:68B61847
@Alternate Data Stream - 215 bytes -> C:\ProgramData\TEMP:55F44B88
@Alternate Data Stream - 215 bytes -> C:\ProgramData\TEMP:3DB6F365
@Alternate Data Stream - 215 bytes -> C:\ProgramData\TEMP:2BFCDF84
@Alternate Data Stream - 215 bytes -> C:\ProgramData\TEMP:1C201DEB
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:FC2D0F32
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:E5294695
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP2593961
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:C0893153
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:91DEEE71
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:609CAC7C
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:40EE25BB
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:341C1FBD
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:1968990D
@Alternate Data Stream - 214 bytes -> C:\ProgramData\TEMP:177313FB
@Alternate Data Stream - 213 bytes -> C:\ProgramData\TEMP:E80802C7
@Alternate Data Stream - 213 bytes -> C:\ProgramData\TEMP:B8EB1B99
@Alternate Data Stream - 213 bytes -> C:\ProgramData\TEMP:B64F7263
@Alternate Data Stream - 213 bytes -> C:\ProgramData\TEMP:AABCC5A7
@Alternate Data Stream - 213 bytes -> C:\ProgramData\TEMP:A774141A
@Alternate Data Stream - 212 bytes -> C:\ProgramData\TEMP:F33C37D5
@Alternate Data Stream - 212 bytes -> C:\ProgramData\TEMP:E6CDFB4A
@Alternate Data Stream - 212 bytes -> C:\ProgramData\TEMPE47A3DA
@Alternate Data Stream - 212 bytes -> C:\ProgramData\TEMP48500F8
@Alternate Data Stream - 212 bytes -> C:\ProgramData\TEMP:A56D6987
@Alternate Data Stream - 212 bytes -> C:\ProgramData\TEMP:85C3B823
@Alternate Data Stream - 212 bytes -> C:\ProgramData\TEMP:6AF67671
@Alternate Data Stream - 212 bytes -> C:\ProgramData\TEMP:67C320D1
@Alternate Data Stream - 212 bytes -> C:\ProgramData\TEMP:5A2E8BBF
@Alternate Data Stream - 212 bytes -> C:\ProgramData\TEMP:4EE95FE7
@Alternate Data Stream - 212 bytes -> C:\ProgramData\TEMP:09708CB7
@Alternate Data Stream - 212 bytes -> C:\ProgramData\TEMP:090FB735
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:FAFEC4B9
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:EC20549D
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:CB16385F
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:C2F24DB5
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:A58B27C9
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:88E8CC2E
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:737160C1
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:700B9342
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:620EC79A
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:60A4BB64
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:4B1195DD
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:33EA030E
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:26A148EB
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:1CDEDE11
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:1C6CB897
@Alternate Data Stream - 211 bytes -> C:\ProgramData\TEMP:1B389835
@Alternate Data Stream - 210 bytes -> C:\ProgramData\TEMP:F1DEA771
@Alternate Data Stream - 210 bytes -> C:\ProgramData\TEMP:EB40BC91
@Alternate Data Stream - 210 bytes -> C:\ProgramData\TEMP:B0EB578B
@Alternate Data Stream - 210 bytes -> C:\ProgramData\TEMP:98DFF516
@Alternate Data Stream - 210 bytes -> C:\ProgramData\TEMP:89C22C79
@Alternate Data Stream - 210 bytes -> C:\ProgramData\TEMP:69AF9D20
@Alternate Data Stream - 210 bytes -> C:\ProgramData\TEMP:2B9555D8
@Alternate Data Stream - 210 bytes -> C:\ProgramData\TEMP:101708D3
@Alternate Data Stream - 210 bytes -> C:\ProgramData\TEMP:0E684AC9
@Alternate Data Stream - 209 bytes -> C:\ProgramData\TEMPFC3B090
@Alternate Data Stream - 209 bytes -> C:\ProgramData\TEMP:A3B8F70C
@Alternate Data Stream - 209 bytes -> C:\ProgramData\TEMP:6425A235
@Alternate Data Stream - 209 bytes -> C:\ProgramData\TEMP:61AF2B29
@Alternate Data Stream - 209 bytes -> C:\ProgramData\TEMP:6017A808
@Alternate Data Stream - 209 bytes -> C:\ProgramData\TEMP:2D2461E7
@Alternate Data Stream - 208 bytes -> C:\ProgramData\TEMP:FD000392
@Alternate Data Stream - 208 bytes -> C:\ProgramData\TEMPA9A5EA8
@Alternate Data Stream - 208 bytes -> C:\ProgramData\TEMP:CF61CE5A
@Alternate Data Stream - 208 bytes -> C:\ProgramData\TEMP:943971F5
@Alternate Data Stream - 207 bytes -> C:\ProgramData\TEMP:FC8FFA4E
@Alternate Data Stream - 207 bytes -> C:\ProgramData\TEMP507B5A8
@Alternate Data Stream - 207 bytes -> C:\ProgramData\TEMP:AFB24B00
@Alternate Data Stream - 207 bytes -> C:\ProgramData\TEMP:9BFB769D
@Alternate Data Stream - 207 bytes -> C:\ProgramData\TEMP:996104FC
@Alternate Data Stream - 207 bytes -> C:\ProgramData\TEMP:842B0AED
@Alternate Data Stream - 207 bytes -> C:\ProgramData\TEMP:7C412B92
@Alternate Data Stream - 207 bytes -> C:\ProgramData\TEMP:370E4EFB
@Alternate Data Stream - 207 bytes -> C:\ProgramData\TEMP:0DAD93FF
@Alternate Data Stream - 207 bytes -> C:\ProgramData\TEMP:041C0562
@Alternate Data Stream - 206 bytes -> C:\ProgramData\TEMP:F6A0889A
@Alternate Data Stream - 206 bytes -> C:\ProgramData\TEMP:F42B5B0E
@Alternate Data Stream - 206 bytes -> C:\ProgramData\TEMP:CD9109D4
@Alternate Data Stream - 206 bytes -> C:\ProgramData\TEMP:A31B5E9B
@Alternate Data Stream - 206 bytes -> C:\ProgramData\TEMP:9EE6560D
@Alternate Data Stream - 206 bytes -> C:\ProgramData\TEMP:774A0E14
@Alternate Data Stream - 206 bytes -> C:\ProgramData\TEMP:71A89A93
@Alternate Data Stream - 206 bytes -> C:\ProgramData\TEMP:71112705
@Alternate Data Stream - 206 bytes -> C:\ProgramData\TEMP:57B2B96C
@Alternate Data Stream - 206 bytes -> C:\ProgramData\TEMP:008586AE
@Alternate Data Stream - 205 bytes -> C:\ProgramData\TEMP:45F3AD49
@Alternate Data Stream - 204 bytes -> C:\ProgramData\TEMP46ECFD5
@Alternate Data Stream - 204 bytes -> C:\ProgramData\TEMP:B845F669
@Alternate Data Stream - 204 bytes -> C:\ProgramData\TEMP:61F0C8FB
@Alternate Data Stream - 204 bytes -> C:\ProgramData\TEMP:598E0FFA
@Alternate Data Stream - 204 bytes -> C:\ProgramData\TEMP:4FE30352
@Alternate Data Stream - 204 bytes -> C:\ProgramData\TEMP:315B4A13
@Alternate Data Stream - 204 bytes -> C:\ProgramData\TEMP:270A3983
@Alternate Data Stream - 203 bytes -> C:\ProgramData\TEMP:FC2E567F
@Alternate Data Stream - 203 bytes -> C:\ProgramData\TEMP:F14D1F80
@Alternate Data Stream - 203 bytes -> C:\ProgramData\TEMP:F1175E1D
@Alternate Data Stream - 203 bytes -> C:\ProgramData\TEMP:EE39C93C
@Alternate Data Stream - 203 bytes -> C:\ProgramData\TEMP92485C9
@Alternate Data Stream - 203 bytes -> C:\ProgramData\TEMP:7972CF54
@Alternate Data Stream - 203 bytes -> C:\ProgramData\TEMP:55E3C0E0
@Alternate Data Stream - 203 bytes -> C:\ProgramData\TEMP:4CF76F21
@Alternate Data Stream - 203 bytes -> C:\ProgramData\TEMP:0F38F234
@Alternate Data Stream - 202 bytes -> C:\ProgramData\TEMP:C8E82994
@Alternate Data Stream - 202 bytes -> C:\ProgramData\TEMP:B8384DB6
@Alternate Data Stream - 202 bytes -> C:\ProgramData\TEMP:2F141B68
@Alternate Data Stream - 202 bytes -> C:\ProgramData\TEMP:27D1368B
@Alternate Data Stream - 201 bytes -> C:\ProgramData\TEMP:E51234A9
@Alternate Data Stream - 201 bytes -> C:\ProgramData\TEMP:614F17D3
@Alternate Data Stream - 201 bytes -> C:\ProgramData\TEMP:52641FBE
@Alternate Data Stream - 201 bytes -> C:\ProgramData\TEMP:3313A48D
@Alternate Data Stream - 200 bytes -> C:\ProgramData\TEMP:B6FD7157
@Alternate Data Stream - 200 bytes -> C:\ProgramData\TEMP:A692C296
@Alternate Data Stream - 200 bytes -> C:\ProgramData\TEMP:7A0EFE63
@Alternate Data Stream - 200 bytes -> C:\ProgramData\TEMP:78E0DF72
@Alternate Data Stream - 200 bytes -> C:\ProgramData\TEMP:43982D5E
@Alternate Data Stream - 200 bytes -> C:\ProgramData\TEMP:40D8F125
@Alternate Data Stream - 200 bytes -> C:\ProgramData\TEMP:0D3CE40A
@Alternate Data Stream - 199 bytes -> C:\ProgramData\TEMP:260575F1
@Alternate Data Stream - 198 bytes -> C:\ProgramData\TEMP:848CC150
@Alternate Data Stream - 197 bytes -> C:\ProgramData\TEMP:BD9F7E4E
@Alternate Data Stream - 197 bytes -> C:\ProgramData\TEMP:25249477
@Alternate Data Stream - 197 bytes -> C:\ProgramData\TEMP:24FECE50
@Alternate Data Stream - 196 bytes -> C:\ProgramData\TEMP:8DF68137
@Alternate Data Stream - 196 bytes -> C:\ProgramData\TEMP:3D36932D
@Alternate Data Stream - 195 bytes -> C:\ProgramData\TEMP:F3EFA8A8
@Alternate Data Stream - 195 bytes -> C:\ProgramData\TEMP:B904C348
@Alternate Data Stream - 195 bytes -> C:\ProgramData\TEMP:92A815D8
@Alternate Data Stream - 195 bytes -> C:\ProgramData\TEMP:8BA6C9F8
@Alternate Data Stream - 195 bytes -> C:\ProgramData\TEMP:17C48B08
@Alternate Data Stream - 195 bytes -> C:\ProgramData\TEMP:0AC32449
@Alternate Data Stream - 194 bytes -> C:\ProgramData\TEMP:FB97DB91
@Alternate Data Stream - 194 bytes -> C:\ProgramData\TEMP:F5E90ED3
@Alternate Data Stream - 194 bytes -> C:\ProgramData\TEMP0668210
@Alternate Data Stream - 194 bytes -> C:\ProgramData\TEMP:55818279
@Alternate Data Stream - 194 bytes -> C:\ProgramData\TEMP:28CDD861
@Alternate Data Stream - 193 bytes -> C:\ProgramData\TEMP:E91ADC66
@Alternate Data Stream - 193 bytes -> C:\ProgramData\TEMP:BB71BBA2
@Alternate Data Stream - 193 bytes -> C:\ProgramData\TEMP:B1381B34
@Alternate Data Stream - 193 bytes -> C:\ProgramData\TEMP:3595B780
@Alternate Data Stream - 193 bytes -> C:\ProgramData\TEMP:31106FCB
@Alternate Data Stream - 192 bytes -> C:\ProgramData\TEMP:E32966C0
@Alternate Data Stream - 192 bytes -> C:\ProgramData\TEMP:5E9B629B
@Alternate Data Stream - 192 bytes -> C:\ProgramData\TEMP:5D351BC6
@Alternate Data Stream - 191 bytes -> C:\ProgramData\TEMP:FB7C1D10
@Alternate Data Stream - 191 bytes -> C:\ProgramData\TEMP:E690114B
@Alternate Data Stream - 191 bytes -> C:\ProgramData\TEMP:4FE42FFC
@Alternate Data Stream - 190 bytes -> C:\ProgramData\TEMP:CB0EB1DE
@Alternate Data Stream - 190 bytes -> C:\ProgramData\TEMP:C5AE4E07
@Alternate Data Stream - 190 bytes -> C:\ProgramData\TEMP:BE7C4A02
@Alternate Data Stream - 190 bytes -> C:\ProgramData\TEMP:3FD496E1
@Alternate Data Stream - 190 bytes -> C:\ProgramData\TEMP:275AA066
@Alternate Data Stream - 189 bytes -> C:\ProgramData\TEMP:ECCE99EF
@Alternate Data Stream - 189 bytes -> C:\ProgramData\TEMP:4A29ED9D
@Alternate Data Stream - 188 bytes -> C:\ProgramData\TEMP:95198126
@Alternate Data Stream - 188 bytes -> C:\ProgramData\TEMP:70E897B5
@Alternate Data Stream - 176 bytes -> C:\ProgramData\TEMP:4220A65C
@Alternate Data Stream - 175 bytes -> C:\ProgramData\TEMP:7F208CC4
@Alternate Data Stream - 159 bytes -> C:\ProgramData\TEMP:48864ADF
@Alternate Data Stream - 157 bytes -> C:\ProgramData\TEMP:F5912EAD
@Alternate Data Stream - 150 bytes -> C:\ProgramData\TEMP667795F
@Alternate Data Stream - 150 bytes -> C:\ProgramData\TEMP:C46995DA
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:1095ECE1
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:689E7F7D
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:A4AF8D0D
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:7BFAAE70
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:6E2D80C8
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:2727F067
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:147A3409
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:80F63EC3
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:33E12B7A
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:EB333CFC
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:7C8AA9A6
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:2775F9E2
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:9C337CCE
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:65684E14
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:3B4DA230
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:F19A4790
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:9812B773
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:8CFBA95C
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:2E3F04BC
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:178093AE
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:57B374AB
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:4EC7F009
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:EB68CA55
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:EB4FEEF5
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:E411AA0D
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:436BE28C
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:596E2371
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:571CCF8E
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:0988A428
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:058A7351
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP055FC10
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:AE75CCC8
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:5A15BCD4
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:988216DA
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:5974EE7C
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:2C15D427
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:B894C266
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:48977386
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:4239238F
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:6C5EC3CD
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:6B05AF40
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:5E8C18F1
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:918B7566
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:5025C6E4
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:4C528C86
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:0F6AC518
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP72D7897
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:98982C88
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:4363DE71
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:329BA65B
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:90B52091
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:7EABF26C
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:6114143B
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:45FE2B4E
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:40DA0795
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:237E4B91
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:FFB7D95C
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:ED2998F5
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:E4FCDFD9
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:8C37BA2F
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:6C235A19
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:65B8AF94
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:5FEFEAEF
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:5520ED93
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:4709F39D
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:38B32B54
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:2FBB2B9B
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:1B927722
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:FDF9B285
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:E774F04D
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:E5F85065
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP390A6A7
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:96AFAB10
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:A4F63AED
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:9ACB70D7
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:9398DBB4
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:9290C91C
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:5FD35242
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:3C5ABDC7
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:072F1F69
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:A2865730
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:405D842B
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:6BFA43EB
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:59846E5E
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:56E66A88
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:2DF54B62
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:1F7A10DD
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:070D9534
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:E0888117
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:C30487EE
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:9E4F05ED
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:9B9B0020
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:8401B6D5
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:7C3E753C
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:60C897F3
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:5D17C178
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:C7857F06
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:B2735F9E
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:A7DA2BCD
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:A4076A3B
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:769BB147
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:69D59C23
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:63CFD724
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:4DCAC4BC
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:3E06C78F
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:1CB96B16
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:EC2381A4
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:B4980368
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:96C9689F
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:7F66BF58
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:7B52659E
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:68EF6203
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:52A22573
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:331B76C7
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:C039C6AC
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:A3251D01
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:8E7F155B
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:2F6462DF
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:0D278FB5
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:067BF339
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:95970EA3
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:82529191
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:58C9BCAC
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:3B68494D
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:161AA30B
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:086DE893
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMPE9F4320
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:B3196E8D
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:B2CD146E
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:8BFA0030
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:523B97A0
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:00D5EBC2
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:63C29481
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:57176330
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:51F17BB8
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:13AA281B
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:EC0A74A1
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:C0A9D0E7
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:8DB31C20
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:7A0FEE87
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:316EAAE9
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:2B9146DE
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:2AFE7797
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:12D2EB9C
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:A26AFC00
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:51E1A4D8
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:BD27B7FC
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:5345C8F6
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:33DB8278
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:2342AE46
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:0F0A5896
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:E717F65C
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:E3F37A7D
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:C36B1175
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:B093E177
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:0BF96601
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:00F7B10F
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP387C245
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:6710EF08
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:1DEE6B65
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:09064307
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:0664ADFC
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:02A78DF6
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:9DF07E8F
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:91EA783C
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:7AA6FC81
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:7776B809
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:2E49D185
@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:8BCF4DE2
@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:2BC498A4
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:BF07EA98
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:BB3CECA4
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:B1FBBD09
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:7547DA5B
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:322D2CD3
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:F5B69884
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:E945C214
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:9C012695
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:E3CEEC4C
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:3C282BEA
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:28DB0DC4
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:FC4EA67C
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:7E0EFF7B
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:EAFDF1CF
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:A296A63F
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:7881FECE
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:561B1D2B
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:C9FD258B

< End of report >

 

Extras.Txt

OTL Extras logfile created on: 9/22/2011 7:18:16 PM - Run 1
OTL by OldTimer - Version 3.2.29.1 Folder = C:\Users\h\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19120)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1021.76 Mb Total Physical Memory | 526.68 Mb Available Physical Memory | 51.55% Memory free
2.41 Gb Paging File | 1.62 Gb Available in Paging File | 67.10% Paging File free
Paging file location(s): ?:\pagefile.sys

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.71 Gb Total Space | 244.30 Gb Free Space | 53.61% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 4.53 Gb Free Space | 45.32% Space Free | Partition Type: NTFS
Drive E: | 542.65 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 5.46 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive H: | 3.81 Gb Total Space | 0.09 Gb Free Space | 2.37% Space Free | Partition Type: FAT32

Computer Name: H-PC | User Name: h | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-99570673-1611037384-3961291737-1000]
"EnableNotifications" = 0
"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{3FEBCF58-B8DC-4FBE-931F-9C9DC34B1E9A}" = lport=138 | protocol=17 | dir=in | app=system |
"{42382AFD-7557-4BB2-8432-BBB95224815D}" = lport=137 | protocol=17 | dir=in | app=system |
"{4D2F6B64-1C88-40B6-8CC3-F45C64DE047D}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe |
"{53A5EA12-CBC9-4A1A-AD53-E47BE3C6E58E}" = lport=445 | protocol=6 | dir=in | app=system |
"{7C65528C-03D7-470E-A0E4-947B3501C908}" = lport=139 | protocol=6 | dir=in | app=system |
"{9AE35852-D4B2-4F73-8E75-1C80F6740791}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{A8E098FC-D988-4280-B7EF-EF2A6DB2A458}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{AC491D33-4A9E-4C71-B501-B29D27D55D48}" = rport=445 | protocol=6 | dir=out | app=system |
"{B519617F-E013-46C9-ACFF-F6333318A827}" = rport=137 | protocol=17 | dir=out | app=system |
"{B6D53159-EC80-48FE-9275-2BED11D92DA2}" = rport=139 | protocol=6 | dir=out | app=system |
"{D7D61E12-326A-4D89-9DE8-F2051A521BF6}" = rport=138 | protocol=17 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{179153CF-3FF1-408F-89EE-CDB40D191733}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{197410D5-69EA-41EC-9EE1-08D893BEEF4A}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{2A18F538-9836-4FB9-BD18-961F9F86D564}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{3462ED53-F33D-4EA2-9C59-BBB614C51E06}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{4980BBFE-E882-4205-A19E-039DBB146060}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{5A2CCA7C-434C-43FE-B4EC-EAB60ACB44FF}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{63F9520F-027E-42E5-A82C-EE56944CCC2B}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{6C7FAA71-6F9B-4DDF-9B4C-67F2A73ADA1E}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{6EB5725A-7AD7-48BF-8DF6-C932E25BEE4C}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{7390D6AB-BB13-4E54-BB32-1E64417ECDFC}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{84BCDAC5-13F1-4485-9044-5685960EF755}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{8A684538-3752-4FFD-B213-22135BFBFCB3}" = protocol=17 | dir=in | app=c:\program files\diablo ii\diablo ii.exe |
"{9953998A-3F13-424D-9322-40875F91991B}" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"{A3A2C4A4-5008-4691-B542-57CA80E53627}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe |
"{A90526F5-09B4-40B0-92B3-DEF36F00452F}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{A9304670-8EF6-4C1F-8124-8F7C0C002B3F}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{ACCB2CB3-B5FC-4540-9894-624F4FD904B0}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{B075E607-68EA-41BC-AA67-DA4368D3B6CC}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{B745C3D8-72CF-40BB-B1C3-2EDDCFCE00D0}" = protocol=6 | dir=in | app=c:\program files\diablo ii\diablo ii.exe |
"{C018CA4B-949A-4001-A254-BBDBB054B98A}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{CDB8607A-0AD2-4E0B-98EA-5EEC6CA71B5E}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{D4AF8B03-D527-419D-8D57-7EB002053597}" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"{FFB72173-18E5-41EC-BE8F-D20791A1073A}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"TCP Query User{3F019B46-F6D8-4BA5-9995-E485236A0AF5}C:\program files\diablo ii\game.exe" = protocol=6 | dir=in | app=c:\program files\diablo ii\game.exe |
"TCP Query User{F7A46E0D-772D-49CD-B81E-3E0D70590DC7}C:\program files\scriptftp\scriptftp.exe" = protocol=6 | dir=in | app=c:\program files\scriptftp\scriptftp.exe |
"UDP Query User{2A3696A1-66DB-4816-B3D5-BCDE0D671527}C:\program files\scriptftp\scriptftp.exe" = protocol=17 | dir=in | app=c:\program files\scriptftp\scriptftp.exe |
"UDP Query User{8B20669A-C86F-40EA-A071-DB93769253AC}C:\program files\diablo ii\game.exe" = protocol=17 | dir=in | app=c:\program files\diablo ii\game.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0090A87C-3E0E-43D4-AA71-A71B06563A4A}" = Dell Support Center
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0E4BC542-9CFD-4E97-B586-9F1E5516E7B9}" = Microsoft IntelliPoint 6.1
"{0EC7C406-B592-4686-BAC1-AD29A85EAE6A}" = HP Driver Diagnostics
"{0F756CD9-4A1E-409B-B101-601DDC4C03AA}" = QualxServ Service Agreement
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 26
"{279FAF7D-8D2B-429C-A8C7-C61BD8E0CFF3}" = Sylcount IV Gold Edition
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2E376AD9-5C49-4F7D-A0BA-6A44E8FA5A3B}" = Next Generation Visualisations
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3C43EAE7-22C0-4b33-ABFB-3757ECA5FD7B}" = HP Officejet All-In-One Series
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{40724630-C95F-449d-B71D-777CFDE9EA21}" = J5700
"{40BA976E-38B8-4C63-990C-50999C8C3521}" = BPD_Scan
"{41A96655-19FB-473c-AAB7-429E372527C8}" = ProductContext
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5BF5F9C5-E95B-4AFA-94BE-F2A9CA73B61D}" = Apple Mobile Device Support
"{5D0F0C1F-46B0-4AA2-B8DC-02E5FE777C19}" = 5700_Help
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{6421F085-1FAA-DE13-D02A-CFB412C522A4}" = Acrobat.com
"{64AEB598-E518-4AD0-B02B-99F365B8054C}" = Serif PanoramaPlus Starter Edition
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7A7DC702-DEDE-42A8-8722-B3BA724D546F}" = Fax
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110265407}" = Bejeweled 2 Deluxe
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112548397}" = The Rise of Atlantis
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89CEAE14-DD0F-448E-9554-15781EC9DB24}" = Product Documentation Launcher
"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{978C25EE-5777-46e4-8988-732C297CBDBD}" = Status
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B1FD9CE-0776-4f0b-A6F5-C6AB7B650CDF}" = Destinations
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A2CC286B-BFE9-4D1F-9EDA-AA3E8289CA12}" = BPDSoftware_Ini
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{AAD47011-8518-4608-9656-951DA35B587B}" = iTunes
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.6
"{B29B0066-547B-402c-9C0D-090E2F928A01}" = PANTECH PC USB Modem Software
"{B7588D45-AFDC-4C93-9E2E-A100F3554B64}" = Microsoft Fix it Center
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{C1771DDC-BEA1-4375-B2A2-B46F43ACB476}" = Wal-Mart Digital Photo Manager
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{c9920352-04e6-469d-bab8-e2b9c7c75415}.sdb" = Microsoft Automated Troubleshooting Services Shim
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D7769185-9A7C-48D4-8874-5388743A1DE2}" = Music, Photos & Videos Launcher
"{D8E363A7-88B7-446D-B2C0-E26CE4DC8E54}" = U3Launcher
"{DF6DA606-904D-4C18-823F-A4CFC3035E53}" = eFax Messenger
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E8C06CB3-5DB2-4689-B1DC-4A0220DEA96C}" = Consumer Complete Care Services Agreement
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{ECAD4F6A-0BF3-4028-9C81-E5D9F9606CBA}" = BPDSoftware
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{EFAD4066-CAF3-4B27-9669-12EED352C376}" = NVIDIANetworkDiagnostic
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem Diagnostic Tool
"{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player
"BFG-Alchemist's Apprentice" = Alchemist's Apprentice
"BFG-Ancient Quest of Saqqarah" = Ancient Quest of Saqqarah
"BFGC" = Big Fish Games: Game Manager
"BFG-Dark Parables - The Exiled Prince Collector's Edition" = Dark Parables: The Exiled Prince Collector's Edition
"BFG-Dream Day True Love" = Dream Day True Love
"BFG-Dream Day Wedding - Viva Las Vegas" = Dream Day Wedding: Viva Las Vegas
"BFG-Dream Day Wedding Bella Italia" = Dream Day Wedding Bella Italia
"BFG-Enlightenus" = Enlightenus
"BFG-Gardenscapes" = Gardenscapes
"BFG-Heartwild Solitaire" = Heartwild Solitaire
"BFG-Heartwild Solitaire - Book Two" = Heartwild Solitaire: Book Two
"BFG-Hidden Expedition - Amazon" = Hidden Expedition: Amazon â„¢
"BFG-Hidden Expedition - Everest" = Hidden Expedition: Everest â„¢
"BFG-Hidden Object Crosswords" = Hidden Object Crosswords
"BFG-Mystery Case Files - Madame Fate" = Mystery Case Files: Madame Fate&trade;
"BFG-Mystery Case Files - Ravenhearst" = Mystery Case Files: Ravenhearst â„¢
"BFG-Mystery Case Files - Return to Ravenhearst" = Mystery Case Files: Return to Ravenhearst â„¢
"BFG-Pahelika - Secret Legends" = Pahelika: Secret Legends
"BFG-Phantasmat Collector's Edition" = Phantasmat Collector's Edition
"BFG-Poker Superstars III" = Poker Superstars III
"BFG-Pure Hidden" = Pure Hidden
"BFG-Renovate & Relocate - Boston" = Renovate & Relocate: Boston
"BFG-Sacra Terra - Angelic Night" = Sacra Terra: Angelic Night
"BFG-Season Match 2" = Season Match 2
"BFG-Slingo Mystery - Who's Gold" = Slingo Mystery: Who's Gold
"BFG-The Great Gatsby" = Classic Adventures: The Great Gatsby
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1" = Conexant D850 PCI V.92 Modem
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Dell Support Center" = Dell Support Center
"Diablo II" = Diablo II
"G-Force" = G-Force
"gtss" = gtss saver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPOCR" = HP OCR Software 8.0
"InstallShield_{8F73DC53-04A6-4D35-B876-0DDB3C136A6B}" = Stedman's Plus Standard Edition
"InstallShield_{EFAD4066-CAF3-4B27-9669-12EED352C376}" = NVIDIANetworkDiagnostic
"Kyodai Mahjongg 2006_is1" = Kyodai Mahjongg 2006 v1.42
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox (3.5.5)" = Mozilla Firefox (3.5.5)
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"Puppetshow Lost Town Piano" = Puppetshow Lost Town Piano Screen Saver
"Puppetshow Lost Town Faces" = Puppetshow Lost Town Faces Screen Saver
"SamainSS" = SamainSS
"ScriptFTP" = ScriptFTP
"Speex for Windows_is1" = Speex for Windows 1.0.5
"Spirits of Mystery Amber Maiden Octopus" = Spirits of Mystery Amber Maiden Octopus Screen Saver
"Start Stop Universal Transcription System9.8.6" = Start Stop Universal Transcription System
"SystemRequirementsLab" = System Requirements Lab
"Uninstaller_B5223000_Stedman's Plus Spellchecker 2008 Standard Edition" = Stedman's Plus Spellchecker 2008 Standard Edition (Shared Components)
"WhiteCap" = WhiteCap

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-99570673-1611037384-3961291737-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Abacast Client" = Abacast Client

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/6/2011 7:00:09 PM | Computer Name = h-PC | Source = Perflib | ID = 1010
Description =

Error - 4/6/2011 7:00:13 PM | Computer Name = h-PC | Source = Perflib | ID = 1008
Description =

Error - 4/7/2011 7:00:19 PM | Computer Name = h-PC | Source = Perflib | ID = 1010
Description =

Error - 4/7/2011 7:00:24 PM | Computer Name = h-PC | Source = Perflib | ID = 1008
Description =

Error - 4/8/2011 7:00:23 PM | Computer Name = h-PC | Source = Perflib | ID = 1010
Description =

Error - 4/9/2011 7:00:18 PM | Computer Name = h-PC | Source = Perflib | ID = 1010
Description =

Error - 4/9/2011 7:00:24 PM | Computer Name = h-PC | Source = Perflib | ID = 1008
Description =

Error - 4/10/2011 7:00:20 PM | Computer Name = h-PC | Source = Perflib | ID = 1010
Description =

Error - 4/11/2011 1:52:42 AM | Computer Name = h-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 4/11/2011 1:53:25 AM | Computer Name = h-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

[ Media Center Events ]
Error - 12/19/2007 4:09:52 AM | Computer Name = h-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 12/19/2007 6:06:18 AM | Computer Name = h-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 12/20/2007 12:58:29 AM | Computer Name = h-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 12/21/2007 4:58:40 PM | Computer Name = h-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 12/22/2007 2:27:01 PM | Computer Name = h-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 12/11/2008 3:37:34 PM | Computer Name = h-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.TimerRecord failed; Win32 GetLastError
returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

Error - 3/18/2010 11:28:07 PM | Computer Name = h-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.TimerRecord failed; Win32 GetLastError
returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

Error - 3/19/2010 12:12:09 AM | Computer Name = h-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.TimerRecord failed; Win32 GetLastError
returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

Error - 3/19/2010 1:54:02 AM | Computer Name = h-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.TimerRecord failed; Win32 GetLastError
returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

Error - 4/7/2010 4:26:39 AM | Computer Name = h-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.TimerRecord failed; Win32 GetLastError
returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

[ System Events ]
Error - 9/16/2011 2:24:21 AM | Computer Name = h-PC | Source = BROWSER | ID = 8032
Description =

Error - 9/17/2011 1:27:37 AM | Computer Name = h-PC | Source = Microsoft Antimalware | ID = 2001
Description = %%860 has encountered an error trying to update signatures. New Signature
Version: Previous Signature Version: 1.111.2284.0 Update Source: %%859 Update Stage:
%%852 Source Path: http://www.microsoft.com Signature Type: %%800 Update Type: %%803

User:
NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7604.0 Error
code: 0x8024402c Error description: An unexpected problem occurred while checking
for updates. For information on installing or troubleshooting updates, see Help
and Support.

Error - 9/17/2011 1:32:11 AM | Computer Name = h-PC | Source = Microsoft Antimalware | ID = 2001
Description = %%860 has encountered an error trying to update signatures. New Signature
Version: Previous Signature Version: 1.111.2284.0 Update Source: %%859 Update Stage:
%%852 Source Path: http://www.microsoft.com Signature Type: %%800 Update Type: %%803

User:
NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7604.0 Error
code: 0x8024402c Error description: An unexpected problem occurred while checking
for updates. For information on installing or troubleshooting updates, see Help
and Support.

Error - 9/17/2011 8:06:20 AM | Computer Name = h-PC | Source = BROWSER | ID = 8032
Description =

Error - 9/17/2011 10:13:44 AM | Computer Name = h-PC | Source = volsnap | ID = 393230
Description = The shadow copies of volume C: were aborted because of an IO failure
on volume C:.

Error - 9/19/2011 4:06:20 AM | Computer Name = h-PC | Source = Schannel | ID = 36874
Description = An SSL connection request was received from a remote client application,
but none of the cipher suites supported by the client application are supported
by the server. The SSL connection request has failed.

Error - 9/21/2011 12:03:44 PM | Computer Name = h-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 9/21/2011 7:24:29 PM | Computer Name = h-PC | Source = DCOM | ID = 10005
Description =

Error - 9/21/2011 7:24:29 PM | Computer Name = h-PC | Source = Service Control Manager | ID = 7009
Description =

Error - 9/21/2011 7:24:29 PM | Computer Name = h-PC | Source = Service Control Manager | ID = 7000
Description =


< End of report >