Jump to content

Acer Laptop, Windows Vista, Everything not responding

Chelle6285

By Chelle6285
in Resolved Malware Removal Logs

 Share

Recommended Posts

Chelle6285

Chelle6285

Posted
Posted

Hello,

My computer Starts without any problem

The internet Automatically connects to the wireless router and firefox works

I can install programs

I can end processes

I can open pictures, documents, and zip files

download files

I Can not:

Delete any files

Uninstall any programs

Run System restore through windows but runs through advanced startup options

Run Tests or diagnostics

Anti virus won't even turn on

Online antivirus scans

Yahoo messenger, windows media player, and any other program

open network and sharing windows

Start any services that are not already running

Rename or move files

When I do the above, it goes into not responding and I see the little blue circle of loading and I have to end explorer.exe

some services are listed as automatic but they say stopped, and when i try to make a service automatic, it freezes

I ran system restore to the earliest point possible, and it is running faster, but that is all that has changed. When it's ran in safemode, there is no change either.

I downloaded malwarebytes, but it gets to 2 seconds and freezes.

The only thing that has been done to this computer recently is i bought a new universal power cord.

Link to post
Share on other sites
Gammo

Gammo

Posted
Posted

Hi,

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Here is a guide on how to disable them:
    Click me
    If you can't disable them then just continue on.
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

RcAuto1.gif

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

whatnext.png

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

Link to post
Share on other sites
Gammo

Gammo

Posted
Posted

Hi,

Download TFC to your desktop

  • Open the file and close any other windows.
  • It will close all programs itself when run, make sure to let it run uninterrupted.
  • Click the Start button to begin the process. The program should not take long to finish its job
  • Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Start Malwarebytes' Anti-Malware

  • Once the program has loaded, click the "Update" tab and click the "Check For updates" button.
  • Once the updates were downloaded, click the "Scanner" tab, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I'd like us to scan your machine with ESET OnlineScan

  1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  2. Click the esetOnline.png button.
  3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

    2. Click on esetSmartInstall.png to download the ESET Smart Installer. Save it to your desktop.
    3. Double click on the esetSmartInstallDesktopIcon.png icon on your desktop.

    4. Check esetAcceptTerms.png
    5. Click the esetStart.png button.
    6. Accept any security warnings from your browser.
    7. Check esetScanArchives.png
    8. Push the Start button.
    9. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    10. When the scan completes, push esetListThreats.png
    11. Push esetExport.png, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    12. Push the esetBack.png button.
    13. Push esetFinish.png

Link to post
Share on other sites
Chelle6285

Chelle6285

Posted
  • Author
Posted

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4583

Windows 6.0.6002 Service Pack 2 (Safe Mode)

Internet Explorer 7.0.6002.18005

9/9/2010 12:24:29 PM

mbam-log-2010-09-09 (12-24-29).txt

Scan type: Quick scan

Objects scanned: 136458

Time elapsed: 5 minute(s), 58 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

______________________________________________________________________________

ESET Online Scan

NO THREATS FOUND.

Scanned Files: 120294

Infected Files: 0

Cleaned Files: 0

Total Scan Time: 01:11:42

Scan Status: Finished

Link to post
Share on other sites
Gammo

Gammo

Posted
Posted

Hi,

Download OTL to your Desktop

  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Check the box that says Scan All Users.
  • Download the following file scan.txt to your Desktop. Click here to download it. You may need to right click on it and select "Save"
  • Double click inside the Custom Scan box at the bottom
  • A window will appear saying "Click Ok to load a custom scan from a file or Cancel to cancel"
  • Click the Ok button and navigate to the file scan.txt which we just saved to your desktop
  • Select scan.txt and click Open. Writing will now appear under the Custom Scan box
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

Link to post
Share on other sites
Chelle6285

Chelle6285

Posted
  • Author
Posted

OTL logfile created on: 9/9/2010 5:09:32 PM - Run 1

OTL by OldTimer - Version 3.2.11.0 Folder = C:\Users\Chelle\Downloads

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6002.18005)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 375.00 Mb Available Physical Memory | 37.00% Memory free

3.00 Gb Paging File | 2.00 Gb Available in Paging File | 83.00% Paging File free

Paging file location(s): c:\pagefile.sys 2000 2000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 68.77 Gb Total Space | 33.94 Gb Free Space | 49.35% Space Free | Partition Type: NTFS

Drive D: | 68.56 Gb Total Space | 56.26 Gb Free Space | 82.05% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: CHELLE-NOTEBOOK

Current User Name: Chelle

Logged in as Administrator.

Current Boot Mode: SafeMode with Networking

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/09/09 17:02:26 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Chelle\Downloads\OTL.exe

PRC - [2010/09/08 12:03:46 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe

PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2008/07/09 17:05:22 | 000,018,704 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe

========== Modules (SafeList) ==========

MOD - [2010/09/09 17:02:26 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Chelle\Downloads\OTL.exe

MOD - [2010/03/04 13:33:45 | 000,430,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll

MOD - [2009/09/30 21:02:04 | 000,334,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceApi.dll

MOD - [2009/09/24 22:10:10 | 000,974,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecs.dll

MOD - [2009/06/10 07:41:46 | 002,386,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WMVCORE.DLL

MOD - [2009/04/11 02:28:25 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wbem\wmiutils.dll

MOD - [2009/04/11 02:28:25 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wbem\wbemsvc.dll

MOD - [2009/04/11 02:28:25 | 000,030,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wbem\wbemprox.dll

MOD - [2009/04/11 02:28:24 | 000,380,416 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll

MOD - [2009/04/11 02:28:23 | 002,226,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\networkexplorer.dll

MOD - [2009/04/11 02:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SLC.dll

MOD - [2009/04/11 02:28:22 | 000,231,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll

MOD - [2009/04/11 02:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wbem\fastprox.dll

MOD - [2009/04/11 02:28:19 | 000,120,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\EhStorAPI.dll

MOD - [2009/04/11 02:28:19 | 000,114,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\EhStorShell.dll

MOD - [2009/04/11 02:28:18 | 000,061,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\davclnt.dll

MOD - [2009/04/11 02:28:18 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cscapi.dll

MOD - [2009/04/11 02:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\rsaenh.dll

MOD - [2009/04/11 02:21:38 | 001,748,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396

ca17ae07\GdiPlus.dll

MOD - [2009/04/11 02:21:38 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll

MOD - [2008/01/19 03:36:58 | 000,223,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WMASF.DLL

MOD - [2008/01/19 03:36:49 | 000,188,928 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wbem\wbemdisp.dll

MOD - [2008/01/19 03:36:48 | 000,357,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wbemcomn.dll

MOD - [2008/01/19 03:36:40 | 000,080,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\thumbcache.dll

MOD - [2008/01/19 03:36:37 | 000,376,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sxs.dll

MOD - [2008/01/19 03:35:58 | 000,063,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ntlanman.dll

MOD - [2008/01/19 03:34:07 | 000,183,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\duser.dll

MOD - [2008/01/19 03:33:42 | 000,326,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\actxprxy.dll

MOD - [2008/01/19 03:33:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx

MOD - [2006/11/02 05:46:04 | 000,017,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drprov.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe -- (nmraapache)

SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (CLTNetCnService)

SRV - [2010/02/05 17:19:44 | 001,141,112 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Microsoft Windows OneCare Live\winss.exe -- (winss)

SRV - [2010/02/05 17:19:42 | 000,026,120 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe -- (OcHealthMon)

SRV - [2009/09/24 21:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)

SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [On_Demand | Stopped] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)

SRV - [2008/07/09 17:05:22 | 000,018,704 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe -- (OneCareMP)

SRV - [2008/01/19 03:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2008/01/08 18:20:44 | 000,451,896 | ---- | M] (Pure Networks, Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)

SRV - [2007/11/27 22:45:02 | 000,869,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe -- (msfwsvc)

SRV - [2007/07/03 14:40:10 | 000,053,248 | ---- | M] (Acer Inc.) [Auto | Stopped] -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe -- (eRecoveryService)

SRV - [2007/06/28 21:50:52 | 000,024,576 | ---- | M] () [Auto | Stopped] -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe -- (eSettingsService)

SRV - [2007/06/13 19:54:36 | 000,135,168 | R--- | M] (Acer Inc.) [Auto | Stopped] -- C:\Acer\Empowering Technology\eNet\eNet Service.exe -- (eNet Service)

SRV - [2007/06/13 14:23:54 | 000,167,936 | ---- | M] (acer) [Auto | Stopped] -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe -- (WMIService)

SRV - [2007/06/12 21:50:30 | 000,355,096 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel®

SRV - [2007/04/25 19:34:30 | 000,457,512 | ---- | M] (HiTRSUT) [Auto | Stopped] -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe -- (eDataSecurity Service)

SRV - [2007/04/23 12:53:48 | 000,024,576 | ---- | M] (Acer Inc.) [Auto | Stopped] -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe -- (eLockService)

SRV - [2007/01/14 17:31:30 | 000,046,592 | ---- | M] () [Auto | Stopped] -- C:\Acer\ALaunch\ALaunchSvc.exe -- (ALaunchService)

SRV - [2006/11/24 15:57:54 | 000,107,008 | ---- | M] () [Auto | Stopped] -- C:\Acer\Mobility Center\MobilityService.exe -- (MobilityService)

SRV - [2006/10/05 15:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Stopped] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Chelle\AppData\Local\Temp\catchme.sys -- (catchme)

DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\blbdrive.sys -- (blbdrive)

DRV - [2009/05/09 02:14:20 | 000,014,736 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nuidfltr.sys -- (NuidFltr)

DRV - [2009/04/11 00:42:54 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)

DRV - [2008/11/23 16:59:31 | 000,018,816 | ---- | M] (RIF) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dvd43llh.sys -- (dvd43llh)

DRV - [2008/10/28 09:29:36 | 002,476,544 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx)

DRV - [2008/08/18 06:15:48 | 000,921,600 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)

DRV - [2008/05/15 16:15:16 | 000,053,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\MpFilter.sys -- (MpFilter)

DRV - [2008/01/08 18:16:10 | 000,024,888 | ---- | M] (Pure Networks, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\pnarp.sys -- (pnarp)

DRV - [2007/11/27 22:45:00 | 000,091,200 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\msfwdrv.sys -- (MSFWDrv)

DRV - [2007/11/27 22:44:54 | 000,037,440 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\msfwhlpr.sys -- (MSFWHLPR)

DRV - [2007/08/13 00:33:31 | 000,006,144 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NTIDrvr.sys -- (NTIDrvr)

DRV - [2007/07/22 18:00:44 | 000,180,736 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\b57nd60x.sys -- (b57nd60x)

DRV - [2007/06/12 14:38:26 | 001,729,152 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)

DRV - [2007/05/30 08:07:10 | 001,780,576 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)

DRV - [2007/04/25 19:34:44 | 000,016,680 | ---- | M] (HiTRUST) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\PSDNServ.sys -- (PSDNServ)

DRV - [2007/04/25 19:34:40 | 000,060,712 | ---- | M] (HiTRUST) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\psdvdisk.sys -- (psdvdisk)

DRV - [2007/04/25 19:34:38 | 000,020,776 | ---- | M] (HiTRUST) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\psdfilter.sys -- (PSDFilter)

DRV - [2007/03/28 10:51:40 | 000,043,008 | ---- | M] (Winbond Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\winbondcir.sys -- (winbondcir)

DRV - [2007/03/22 01:02:04 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)

DRV - [2007/03/21 15:58:56 | 000,304,920 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\iaStor.sys -- (iaStor)

DRV - [2007/03/09 22:03:20 | 000,182,584 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP)

DRV - [2007/03/09 17:56:04 | 001,163,616 | ---- | M] (Agere Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2007/02/24 17:42:22 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)

DRV - [2007/01/23 19:40:20 | 000,042,496 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)

DRV - [2006/12/07 22:12:02 | 000,076,584 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Acer\Empowering Technology\eRecovery\int15.sys -- (int15)

DRV - [2006/11/02 09:29:38 | 000,021,264 | ---- | M] (Dritek System Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\DKbFltr.sys -- (DKbFltr)

DRV - [2006/11/02 05:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)

DRV - [2006/11/02 05:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)

DRV - [2006/11/02 05:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)

DRV - [2006/11/02 05:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)

DRV - [2006/11/02 05:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)

DRV - [2006/11/02 05:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)

DRV - [2006/11/02 05:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)

DRV - [2006/11/02 05:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)

DRV - [2006/11/02 05:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)

DRV - [2006/11/02 05:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)

DRV - [2006/11/02 05:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)

DRV - [2006/11/02 05:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)

DRV - [2006/11/02 05:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)

DRV - [2006/11/02 05:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)

DRV - [2006/11/02 05:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)

DRV - [2006/11/02 05:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)

DRV - [2006/11/02 05:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)

DRV - [2006/11/02 05:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)

DRV - [2006/11/02 05:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)

DRV - [2006/11/02 05:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)

DRV - [2006/11/02 05:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)

DRV - [2006/11/02 05:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)

DRV - [2006/11/02 05:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)

DRV - [2006/11/02 05:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)

DRV - [2006/11/02 05:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)

DRV - [2006/11/02 05:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)

DRV - [2006/11/02 05:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)

DRV - [2006/11/02 05:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)

DRV - [2006/11/02 05:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)

DRV - [2006/11/02 05:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)

DRV - [2006/11/02 05:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)

DRV - [2006/11/02 05:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)

DRV - [2006/11/02 05:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)

DRV - [2006/11/02 05:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)

DRV - [2006/11/02 05:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)

DRV - [2006/11/02 04:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)

DRV - [2006/11/02 04:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)

DRV - [2006/11/02 04:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)

DRV - [2006/11/02 04:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)

DRV - [2006/11/02 04:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)

DRV - [2006/11/02 04:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)

DRV - [2006/11/02 03:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)

DRV - [2006/11/02 03:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel®

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...&ar=msnhome

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...&ar=msnhome

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)

IE - HKU\S-1-5-20\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)

IE - HKU\S-1-5-21-2634554404-4035684415-2601721625-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm

IE - HKU\S-1-5-21-2634554404-4035684415-2601721625-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1

IE - HKU\S-1-5-21-2634554404-4035684415-2601721625-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch

IE - HKU\S-1-5-21-2634554404-4035684415-2601721625-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search

IE - HKU\S-1-5-21-2634554404-4035684415-2601721625-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe...-8&fr=b1ie7

IE - HKU\S-1-5-21-2634554404-4035684415-2601721625-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2077543

IE - HKU\S-1-5-21-2634554404-4035684415-2601721625-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKU\S-1-5-21-2634554404-4035684415-2601721625-1000\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)

IE - HKU\S-1-5-21-2634554404-4035684415-2601721625-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"

FF - prefs.js..browser.search.defaultenginename: "Yahoo"

FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?fr=ffsp1&p="

FF - prefs.js..browser.search.order.1: "Ask.com"

FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"

FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"

FF - prefs.js..browser.search.param.yahoo-type: "${8}"

FF - prefs.js..browser.search.selectedEngine: "Yahoo"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}:6.0.12

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16

FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.2.1

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}:6.0.19

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.90

FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.9

FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=ffds1&p="

FF - prefs.js..network.proxy.ftp: "192.168.1.1"

FF - prefs.js..network.proxy.gopher: "65.24.70.10"

FF - prefs.js..network.proxy.http: "192.668.1.125"

FF - prefs.js..network.proxy.socks: "65.24.2.11"

FF - prefs.js..network.proxy.socks_version: 4

FF - prefs.js..network.proxy.ssl: "255.255"

FF - prefs.js..network.proxy.type: 4

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/07/01 03:01:41 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.9\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/08 12:03:49 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.9\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/08 12:03:49 | 000,000,000 | ---D | M]

[2008/10/12 19:53:17 | 000,000,000 | ---D | M] -- C:\Users\Chelle\AppData\Roaming\Mozilla\Extensions

[2008/10/12 19:53:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Chelle\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

[2010/09/08 23:23:06 | 000,000,000 | ---D | M] -- C:\Users\Chelle\AppData\Roaming\Mozilla\Firefox\Profiles\io14n2jr.default\extensions

[2010/09/03 19:56:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Chelle\AppData\Roaming\Mozilla\Firefox\Profiles\io14n2jr.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}

[2010/05/11 00:14:53 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Chelle\AppData\Roaming\Mozilla\Firefox\Profiles\io14n2jr.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2010/09/06 15:59:43 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus®)) -- C:\Users\Chelle\AppData\Roaming\Mozilla\Firefox\Profiles\io14n2jr.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}

[2008/10/12 21:38:09 | 000,000,000 | ---D | M] -- C:\Users\Chelle\AppData\Roaming\Mozilla\Firefox\Profiles\io14n2jr.default\extensions\OberonGameHost@OberonGames.com

[2010/09/03 19:56:05 | 000,000,000 | ---D | M] -- C:\Users\Chelle\AppData\Roaming\Mozilla\Firefox\Profiles\io14n2jr.default\extensions\personas@christopher.beard

[2010/03/24 12:24:27 | 000,002,424 | ---- | M] () -- C:\Users\Chelle\AppData\Roaming\Mozilla\Firefox\Profiles\io14n2jr.default\searchplugins\askcom.xml

[2010/09/08 23:23:06 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

[2010/09/08 12:03:49 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[2009/03/08 00:35:18 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

[2009/03/27 10:38:25 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

[2009/08/06 20:52:15 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

[2009/12/02 17:27:18 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

[2009/11/17 16:14:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

[2010/03/31 22:49:33 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}

[2010/05/01 12:58:52 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010/09/08 12:03:45 | 000,023,512 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll

[2010/09/08 12:03:45 | 000,138,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll

[2007/04/10 18:21:08 | 000,163,256 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll

[2010/04/12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

[2010/09/08 12:03:47 | 000,064,984 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll

[2010/04/02 09:30:43 | 000,095,672 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll

[2009/07/17 16:44:40 | 000,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll

[2009/07/17 16:44:40 | 000,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll

[2009/07/17 16:44:40 | 000,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll

[2009/07/17 16:44:40 | 000,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll

[2009/07/17 16:44:40 | 000,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll

[2009/07/17 16:44:41 | 000,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll

[2009/07/17 16:44:41 | 000,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll

[2007/03/09 19:16:44 | 000,189,496 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll

[2010/09/06 15:58:50 | 000,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml

[2010/09/06 15:58:50 | 000,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml

[2010/09/06 15:58:50 | 000,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml

[2010/09/06 15:58:50 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml

[2010/09/06 15:58:51 | 000,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml

[2010/09/06 15:58:51 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml

[2010/09/06 15:58:51 | 000,001,096 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml

O1 HOSTS File: ([2010/09/09 00:32:36 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - No CLSID value found.

O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)

O3 - HKU\S-1-5-21-2634554404-4035684415-2601721625-1000\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)

O3 - HKU\S-1-5-21-2634554404-4035684415-2601721625-1000\..\Toolbar\WebBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)

O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files\Acer Assist\launcher.exe ()

O4 - HKLM..\Run: [eAudio] C:\Acer\Empowering Technology\eAudio\eAudio.exe (CyberLink)

O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe (HiTRUST)

O4 - HKLM..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe (Intel Corporation)

O4 - HKLM..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)

O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()

O4 - HKLM..\Run: [OneCareUI] C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe (Microsoft Corporation)

O4 - HKLM..\Run: [Persistence] C:\Windows\System32\igfxpers.exe (Intel Corporation)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-2634554404-4035684415-2601721625-1000..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe (AWS Convergence Technologies, Inc.)

O4 - HKU\.DEFAULT..\RunOnce: [Application Restart #0] C:\Windows\System32\osk.exe (Microsoft Corporation)

O4 - HKU\S-1-5-18..\RunOnce: [Application Restart #0] C:\Windows\System32\osk.exe (Microsoft Corporation)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BindDirectlyToPropertySetStorage = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-2634554404-4035684415-2601721625-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-2634554404-4035684415-2601721625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0

O7 - HKU\S-1-5-21-2634554404-4035684415-2601721625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\S-1-5-21-2634554404-4035684415-2601721625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2

O7 - HKU\S-1-5-21-2634554404-4035684415-2601721625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1

O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\nlaapi.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O15 - HKU\S-1-5-21-2634554404-4035684415-2601721625-1000\..Trusted Domains: adobe.com ([www] https in Trusted sites)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07)

O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_16)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)

O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp - No CLSID value found

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)

O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp3.dll (Pure Networks, Inc.)

O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)

O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\Windows\System32\shell32.dll (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\Windows\System32\sysdm.cpl (Microsoft Corporation)

O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)

O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\Windows\System32\browseui.dll (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\Chelle\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg

O24 - Desktop BackupWallPaper: C:\Users\Chelle\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg

O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found

O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)

O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)

O31 - SafeBoot: AlternateShell - cmd.exe

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/09/09 12:45:18 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2010/09/09 11:58:46 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Users\Chelle\Desktop\TFC.exe

[2010/09/09 00:37:17 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2010/09/09 00:37:14 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2010/09/09 00:37:14 | 000,000,000 | ---D | C] -- C:\Users\Chelle\AppData\Local\temp

[2010/09/09 00:20:34 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe

[2010/09/09 00:20:32 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW

[2010/09/06 16:32:15 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2010/09/06 16:32:15 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2010/09/06 16:32:14 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2010/09/06 16:32:02 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2010/09/06 16:28:14 | 000,000,000 | ---D | C] -- C:\Qoobox

[2010/09/06 15:59:45 | 000,000,000 | ---D | C] -- C:\ProgramData\NOS

[2010/09/06 15:59:45 | 000,000,000 | ---D | C] -- C:\Program Files\NOS

[2010/09/03 16:07:52 | 000,000,000 | ---D | C] -- C:\Users\Chelle\AppData\Roaming\Malwarebytes

[2010/09/03 16:07:43 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2010/09/03 16:07:41 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2010/09/03 16:07:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2010/09/03 16:07:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2010/09/02 03:38:19 | 000,000,000 | ---D | C] -- C:\found.000

[2010/09/01 20:06:27 | 000,000,000 | ---D | C] -- C:\Users\Chelle\AppData\Roaming\QuickScan

[2007/11/19 14:53:44 | 000,172,032 | ---- | C] ( ) -- C:\Windows\System32\rsnp2uvc.dll

[2007/11/19 14:53:44 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll

[2007/08/13 00:40:32 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\Interop.Shell32.dll

[2007/08/12 23:36:13 | 000,045,056 | ---- | C] ( ) -- C:\Windows\PLFSet.dll

========== Files - Modified Within 30 Days ==========

[2010/09/09 17:04:05 | 003,145,728 | -HS- | M] () -- C:\Users\Chelle\ntuser.dat

[2010/09/09 12:50:16 | 000,703,448 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI

[2010/09/09 12:50:16 | 000,603,026 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2010/09/09 12:50:16 | 000,104,456 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2010/09/09 12:43:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2010/09/09 12:42:16 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2010/09/09 12:42:16 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2010/09/09 12:42:16 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT

[2010/09/09 12:41:42 | 000,524,288 | -HS- | M] () -- C:\Users\Chelle\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms

[2010/09/09 12:41:42 | 000,065,536 | -HS- | M] () -- C:\Users\Chelle\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf

[2010/09/09 12:41:38 | 001,659,823 | -H-- | M] () -- C:\Users\Chelle\AppData\Local\IconCache.db

[2010/09/09 12:34:55 | 002,672,312 | ---- | M] () -- C:\Users\Chelle\Desktop\esetsmartinstaller_enu.exe

[2010/09/09 12:30:53 | 000,272,600 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2010/09/09 11:57:56 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Chelle\Desktop\TFC.exe

[2010/09/09 00:32:44 | 000,000,215 | ---- | M] () -- C:\Windows\system.ini

[2010/09/09 00:32:36 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts

[2010/09/09 00:12:28 | 003,840,723 | R--- | M] () -- C:\Users\Chelle\Desktop\ComboFix.exe

[2010/09/04 00:44:08 | 172,902,177 | ---- | M] () -- C:\Windows\MEMORY.DMP

[2010/09/03 16:07:47 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\kioskea.exe.lnk

[2010/09/01 23:23:38 | 000,006,756 | ---- | M] () -- C:\Users\Chelle\AppData\Local\d3d9caps.dat

========== Files Created - No Company Name ==========

[2010/09/09 12:34:50 | 002,672,312 | ---- | C] () -- C:\Users\Chelle\Desktop\esetsmartinstaller_enu.exe

[2010/09/09 00:12:28 | 003,840,723 | R--- | C] () -- C:\Users\Chelle\Desktop\ComboFix.exe

[2010/09/06 16:32:16 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe

[2010/09/06 16:32:15 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe

[2010/09/06 16:32:15 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2010/09/06 16:32:15 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2010/09/06 16:32:15 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2010/09/04 00:44:08 | 172,902,177 | ---- | C] () -- C:\Windows\MEMORY.DMP

[2010/09/03 16:07:47 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\kioskea.exe.lnk

[2010/05/23 00:28:04 | 000,000,047 | ---- | C] () -- C:\Windows\WinInit.Ini

[2010/05/19 16:43:09 | 000,069,632 | ---- | C] () -- C:\Windows\System32\lxdmoem.dll

[2010/01/19 00:26:36 | 000,000,000 | ---- | C] () -- C:\Windows\PhantomofVenice.INI

[2009/07/31 18:54:29 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2008/10/28 09:35:26 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1591.dll

[2008/10/18 16:02:50 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini

[2008/06/14 21:32:57 | 000,000,000 | ---- | C] () -- C:\Windows\iPlayer.INI

[2008/06/12 20:50:21 | 000,000,125 | -HS- | C] () -- C:\ProgramData\.zreglib

[2008/06/09 18:29:41 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI

[2008/06/03 22:08:28 | 000,000,000 | ---- | C] () -- C:\Windows\Game.INI

[2008/04/06 00:49:12 | 000,000,094 | ---- | C] () -- C:\Users\Chelle\AppData\Local\fusioncache.dat

[2008/03/21 16:30:08 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll

[2008/03/21 16:28:54 | 000,000,416 | ---- | C] () -- C:\Windows\System32\dtu100.dll.manifest

[2008/03/02 11:23:19 | 000,018,944 | ---- | C] () -- C:\Users\Chelle\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2008/03/02 04:00:47 | 000,006,756 | ---- | C] () -- C:\Users\Chelle\AppData\Local\d3d9caps.dat

[2008/03/01 21:18:16 | 000,029,239 | ---- | C] () -- C:\Users\Chelle\AppData\Roaming\UserTile.png

[2008/02/11 19:55:18 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1437.dll

[2008/01/02 17:57:36 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1409.dll

[2008/01/02 17:47:22 | 001,953,696 | ---- | C] () -- C:\Windows\System32\igklg400.dll

[2008/01/02 17:47:22 | 001,533,360 | ---- | C] () -- C:\Windows\System32\igklg450.dll

[2008/01/02 17:47:22 | 000,104,636 | ---- | C] () -- C:\Windows\System32\igmedcompkrn.dll

[2007/11/19 15:43:34 | 000,000,030 | ---- | C] () -- C:\Windows\SETPANEL.INI

[2007/11/19 15:43:33 | 000,000,092 | ---- | C] () -- C:\Windows\CLEANUP.INI

[2007/08/14 03:30:25 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN4.dll

[2007/08/13 00:47:50 | 000,076,584 | ---- | C] () -- C:\Windows\System32\drivers\int15.sys

[2007/08/13 00:47:50 | 000,015,656 | ---- | C] () -- C:\Windows\System32\drivers\int15_64.sys

[2007/08/13 00:47:17 | 000,065,536 | ---- | C] () -- C:\Windows\System32\NATTraversal.dll

[2007/08/13 00:40:27 | 000,331,776 | ---- | C] () -- C:\Windows\System32\ScrollBarLib.dll

[2007/08/13 00:00:34 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll

[2007/08/12 23:58:20 | 000,001,132 | ---- | C] () -- C:\Windows\RtDefLvl.ini

[2007/08/12 23:37:11 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2007/08/12 23:36:23 | 000,910,464 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll

[2007/08/12 23:36:23 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1268.dll

[2007/08/12 23:36:13 | 001,729,152 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys

[2007/04/25 19:33:22 | 000,266,240 | ---- | C] () -- C:\Windows\System32\NotesExtmngr.dll

[2007/04/25 19:32:50 | 000,204,800 | ---- | C] () -- C:\Windows\System32\NotesActnMenu.dll

[2007/04/25 19:32:46 | 000,086,016 | ---- | C] () -- C:\Windows\System32\MSNSpook.dll

[2007/04/25 19:31:00 | 000,028,672 | ---- | C] () -- C:\Windows\System32\BatchCrypto.dll

[2007/04/25 19:30:52 | 000,073,728 | ---- | C] () -- C:\Windows\System32\APISlice.dll

[2007/04/25 19:30:44 | 000,063,488 | ---- | C] () -- C:\Windows\System32\ShowErrMsg.dll

[2006/12/25 18:44:48 | 000,022,016 | ---- | C] () -- C:\Windows\System32\MailFormat_U.dll

[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2001/12/26 19:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll

[2001/09/04 02:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll

[2001/07/30 19:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll

[2001/07/24 01:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >

[2007/08/13 00:44:54 | 000,003,380 | ---- | M] () -- C:\-20070812.log

[2006/09/18 17:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat

[2009/04/11 02:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr

[2007/08/13 00:17:22 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK

[2010/09/09 00:37:12 | 000,012,622 | ---- | M] () -- C:\ComboFix.txt

[2006/09/18 17:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys

[2010/05/03 20:46:14 | 000,000,091 | ---- | M] () -- C:\MCEDS.log

[2010/05/03 20:44:32 | 000,000,091 | ---- | M] () -- C:\MDisc.log

[2010/05/03 20:45:03 | 000,000,091 | ---- | M] () -- C:\MDR.log

[2010/09/09 12:43:30 | 2097,152,000 | -HS- | M] () -- C:\pagefile.sys

[2010/05/03 20:45:51 | 000,000,091 | ---- | M] () -- C:\PMovie.log

[2010/05/03 20:45:27 | 000,000,091 | ---- | M] () -- C:\PowerDV.log

[2007/08/12 23:59:05 | 000,000,420 | ---- | M] () -- C:\RHDSetup.log

[2010/09/04 13:25:49 | 000,000,356 | ---- | M] () -- C:\rkill.log

[2010/05/03 20:46:09 | 000,000,090 | ---- | M] () -- C:\SDMA.log

[2007/08/13 00:34:44 | 000,000,178 | ---- | M] () -- C:\setup.log

[2009/08/05 10:58:09 | 001,255,828 | ---- | M] () -- C:\SystemEvent.log

[2007/08/13 00:44:26 | 001,718,938 | ---- | M] () -- C:\vcredist_x86.log

[2009/08/05 10:56:07 | 000,141,046 | ---- | M] () -- C:\WinSSEvent.log

[2008/06/16 22:09:33 | 000,000,162 | ---- | M] () -- C:\YServer.txt

< %systemroot%\Fonts\*.com >

[2006/11/02 08:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont

[2006/11/02 08:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont

[2006/11/02 08:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont

[2009/08/04 21:59:58 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >

[2006/09/18 17:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

[2006/11/02 08:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

[2008/04/19 02:13:17 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

[2006/11/02 06:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2006/11/02 06:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2006/11/02 06:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2006/11/02 06:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2006/11/02 06:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >

[2009/08/05 11:16:03 | 000,000,286 | -HS- | M] () -- C:\Users\Chelle\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

[2010/09/09 00:12:28 | 003,840,723 | R--- | M] () -- C:\Users\Chelle\Desktop\ComboFix.exe

[2010/09/09 12:34:55 | 002,672,312 | ---- | M] () -- C:\Users\Chelle\Desktop\esetsmartinstaller_enu.exe

[2010/09/09 11:57:56 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Chelle\Desktop\TFC.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

[2009/08/05 11:13:59 | 000,008,192 | ---- | M] () -- C:\Windows\security\database\edb.chk

[2009/08/05 11:13:29 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edb.log

[2009/08/05 11:13:29 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edbres00001.jrs

[2009/08/05 11:13:29 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edbres00002.jrs

[2009/08/05 11:13:29 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edbtmp.log

[2009/08/05 11:13:29 | 001,056,768 | ---- | M] () -- C:\Windows\security\database\tmp.edb

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >

[2008/03/01 04:52:42 | 000,000,402 | -HS- | M] () -- C:\Users\Chelle\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

[2009/02/20 14:35:09 | 000,000,125 | -HS- | M] () -- C:\ProgramData\.zreglib

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.exe >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< %USERPROFILE%\Templates\*.tmp >

< %SYSTEMDRIVE%\explorexxx.exe\*.* >

< %Windir%\Installer\*.tmp >

< %systemroot%\System32\*.xco >

< %ProgramFiles%\system32\*.* >

< %systemroot%\System32\windos\*.* >

< %SystemRoot%\system32\sandbox\*.* >

< %SystemRoot%\system32\*.amo >

< %SystemRoot%\system32\Windows Live\*.* >

< %ProgramFiles%\logs\*.* >

< %ProgramFiles%\Bifrost\*.* >

< %SystemRoot%\system32\*.goo >

< %systemroot%\system32\IME\*.* >

< %systemroot%\BackUp\*.* >

< %systemroot%\system32\*.ico >

[2006/09/18 17:31:55 | 000,107,620 | ---- | M] () -- C:\Windows\System32\acwizard.ico

< %systemroot%\system\*.dat >

< %systemroot%\system\*.exe >

< %AppData%\Macromedia\Common\*.* >

< %SYSTEMDRIVE%\dir\*.* /s >

< %systemroot%\system32\ras\*.exe >

< %SYSTEMDRIVE%\MFILES\*.* >

< %SYSTEMDRIVE%\mDNSRespon.exe\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-06-12 07:03:50

========== Alternate Data Streams ==========

@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:A95A95AC

@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:0A73A758

@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:AA9519A6

@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:7B212553

@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:D3A8AA31

< End of report >

Link to post
Share on other sites
Chelle6285

Chelle6285

Posted
  • Author
Posted

OTL Extras logfile created on: 9/9/2010 5:09:32 PM - Run 1

OTL by OldTimer - Version 3.2.11.0 Folder = C:\Users\Chelle\Downloads

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6002.18005)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 375.00 Mb Available Physical Memory | 37.00% Memory free

3.00 Gb Paging File | 2.00 Gb Available in Paging File | 83.00% Paging File free

Paging file location(s): c:\pagefile.sys 2000 2000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 68.77 Gb Total Space | 33.94 Gb Free Space | 49.35% Space Free | Partition Type: NTFS

Drive D: | 68.56 Gb Total Space | 56.26 Gb Free Space | 82.05% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: CHELLE-NOTEBOOK

Current User Name: Chelle

Logged in as Administrator.

Current Boot Mode: SafeMode with Networking

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_USERS\S-1-5-21-2634554404-4035684415-2601721625-1000\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 File not found

https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"FirewallDisableNotify" = 0

"AntiVirusDisableNotify" = 0

"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-2634554404-4035684415-2601721625-1000]

"EnableNotifications" = 0

"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{1C0481D5-D4AE-4959-B9B2-962682BC6E90}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{1F0D4F84-1A81-459B-A633-898D80FEAAE7}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{21911571-88E2-42B0-B2D8-F6B772239270}" = lport=445 | protocol=6 | dir=in | app=system |

"{246CB1B3-F0D7-4ED1-8226-B43EBF47F36C}" = lport=10243 | protocol=6 | dir=in | app=system |

"{34BDE319-CCBE-487A-9A6C-5A269EF30C6A}" = lport=67 | protocol=17 | dir=in | name=dhcp discovery service |

"{371981ED-A23B-49D8-92BC-C5CD6CCBDC59}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{3F99DA6E-5B2E-480A-967D-ED96AAF20601}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 |

"{40FE62E5-2AB6-4541-803B-CE9BBB0367FA}" = lport=2869 | protocol=6 | dir=in | app=system |

"{59564884-FB87-4B52-AF5C-756CC85B4B61}" = rport=445 | protocol=6 | dir=out | app=system |

"{5C7E852C-5A42-4429-93BF-E51699748A93}" = rport=139 | protocol=6 | dir=out | app=system |

"{67E4496D-90B5-4A7D-94F7-B80C07E04C67}" = rport=10243 | protocol=6 | dir=out | app=system |

"{74F57E4F-5BFE-41C1-A5CF-4581BBEA682E}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 |

"{75C9BCC2-5705-4B4F-94B4-2446D43544D5}" = lport=139 | protocol=6 | dir=in | app=system |

"{771177E5-2B81-4ED4-9877-FC11B14A1C6A}" = lport=63331 | protocol=6 | dir=in | name=windows live onecare |

"{91565422-C9B0-4FDA-B2CA-B2BA0383B8D3}" = lport=138 | protocol=17 | dir=in | app=system |

"{947101AE-66ED-4725-BB68-1A494C02FEC9}" = lport=2869 | protocol=6 | dir=in | app=system |

"{963DDF4C-BF4A-442C-8959-148C9E55EA3E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |

"{96771A07-004B-426F-8550-DC74D95727F3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{9702548C-FABB-44A3-B559-A3ACD6807C3F}" = lport=67 | protocol=17 | dir=in | name=dhcp discovery service |

"{9D9FFF77-7976-4B29-9AB1-7E2E0DC68693}" = rport=137 | protocol=17 | dir=out | app=system |

"{A8255A64-9068-428E-80CB-B84717A6C088}" = rport=138 | protocol=17 | dir=out | app=system |

"{B725BC33-D8EE-4268-8FCC-09A4B3202348}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{BE2DCDF7-BD14-4042-BA9F-5B340C1841FD}" = lport=63331 | protocol=6 | dir=in | name=windows live onecare |

"{CDA1D6DB-86B2-46FF-A792-92137C3C6E76}" = lport=137 | protocol=17 | dir=in | app=system |

"{D3DBFC8A-A74D-45F2-A494-19B52FDA03B5}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{E914B501-A9FC-43A2-B69B-EDD0841D61CF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |

"{F0DBCA48-3C1F-4EF1-AD72-BB93F808B294}" = lport=63331 | protocol=6 | dir=in | name=windows live onecare |

"{FB677A41-212A-4C32-9F1B-83C31A1C3225}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{039A3694-AB3B-4995-BE61-D1A76F7558E7}" = protocol=6 | dir=in | app=c:\program files\curse\curseclient.exe |

"{0884DC0D-B941-4900-B97A-AE55EF212381}" = protocol=6 | dir=in | app=c:\program files\world of warcraft\wow-2.3.3.7799-to-2.4.0.8089-enus-downloader.exe |

"{0A658795-6474-4A74-965F-9B25A15CE8DA}" = protocol=17 | dir=in | app=c:\windows\system32\lxddcoms.exe |

"{0B73CF6D-4A15-44C4-BCD1-3FDFF406E34D}" = protocol=6 | dir=in | app=c:\program files\lexmark 5000 series\lxdmamon.exe |

"{0C68A205-85BC-4B0D-9696-AFB2736FA96C}" = protocol=6 | dir=in | app=c:\program files\lexmark 5000 series\frun.exe |

"{12C88213-3B7A-46A1-B380-5AA00D3F9B70}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |

"{16DAF2C6-EA64-4EB6-A06C-F584B1B347E4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

"{1D252DC9-60FE-446A-B125-537C125CF71D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |

"{24CEC1A0-4D79-4C41-87D7-1DF1ED5E665A}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |

"{2C09060C-CD91-41A0-91AB-E78BC7FFBAC2}" = protocol=17 | dir=in | app=c:\program files\lexmark 5000 series\lxdmfax.exe |

"{2D04486C-2793-432A-BB8D-52CB96D1D983}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |

"{2EC79A96-345A-4FD9-841F-FD58ABB66949}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |

"{393D1057-CCDA-4106-8496-AFD35FE95362}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |

"{3A0E3D7A-1343-49A8-B859-242E8134A9CB}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |

"{4195B551-364D-4955-ACA6-3AC4D5E81FCB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |

"{5423218A-9FD9-4C9B-A438-2EF82132B8E5}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |

"{5D9E75A8-529F-4FCA-BAEE-D87FBD96267A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

"{5EF5421A-DE27-41BE-AE2B-53D0FFB3DB1F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

"{6AD4C84F-FABD-4684-AF84-0FBA9092DCA2}" = protocol=17 | dir=in | app=c:\program files\world of warcraft\wow-2.3.3.7799-to-2.4.0.8089-enus-downloader.exe |

"{6BE71982-E119-4764-B838-908B43C7C941}" = protocol=6 | dir=in | app=c:\program files\lexmark 5000 series\lxdmmon.exe |

"{7DBE2542-0EFB-4174-9F59-1DF75937D9DB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |

"{7EEA302E-8795-40E6-8DAD-1160428BBE93}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe |

"{805C06B7-22F1-4574-8EF6-4104C676A235}" = protocol=6 | dir=in | app=c:\windows\system32\lxddcoms.exe |

"{80E7446C-6D93-407F-A168-198814852D8D}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |

"{84155521-391C-4E1E-92F7-C1AFB40DC854}" = protocol=17 | dir=in | app=c:\windows\system32\lxdmcoms.exe |

"{842AEBD9-5FCF-4B9A-A080-AA29740316AB}" = protocol=17 | dir=in | app=c:\program files\world of warcraft\wow-2.3.0-enus-downloader.exe |

"{86D9E5F1-BB4C-41D4-A446-0894077E6283}" = protocol=17 | dir=in | app=c:\program files\lexmark 5000 series\lxdmamon.exe |

"{8E71BE31-0B09-4A09-B0A2-FBC33A162DCB}" = protocol=6 | dir=in | app=c:\windows\system32\lxdmcoms.exe |

"{93DF7D4A-8FC5-4D3E-9B1C-E260E23761AD}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

"{99ABFCC0-1C66-4B08-B3BE-77E71F839F0F}" = protocol=17 | dir=in | app=c:\program files\lexmark 5000 series\lxdmmon.exe |

"{A0B07DDD-1CBF-4394-9C44-23F39ED590D2}" = protocol=17 | dir=in | app=c:\program files\lexmark 5000 series\frun.exe |

"{A15BF1FE-A4A4-400F-B7B3-7F4FE2A3761D}" = protocol=6 | dir=out | app=system |

"{A6A7FF11-5B25-4D96-90D4-1ED3A133D344}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |

"{AE4B2D12-7C0A-4C96-9301-0A7E9FC54254}" = protocol=17 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe |

"{C076E64E-BBC6-49EF-8E0B-18EE8246F77F}" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |

"{C169F3F9-72E7-4026-B8C7-206E3A7072D0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |

"{C2F853CD-4581-47A2-B610-3621EA20B1EF}" = protocol=6 | dir=in | app=c:\program files\world of warcraft\wow-2.3.0-enus-downloader.exe |

"{C871C396-11AE-4486-9F39-CAB6E3F4AA79}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdmpswx.exe |

"{D75A4B88-3680-4587-AC1A-DA52BE3CABB9}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |

"{E08CF960-6DC7-4554-833C-D8AEC49D2142}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdmpswx.exe |

"{E1EB5069-898F-4ED6-9449-2E94B50D57A4}" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |

"{E9E63704-18B4-4E41-BAD9-E82449C37E31}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |

"{EAEE6981-3A81-41E3-87DD-971CE73E50FC}" = protocol=17 | dir=in | app=c:\program files\curse\curseclient.exe |

"{F8E4B1C3-BD5B-4A2A-B857-162E7E7A0595}" = protocol=6 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe |

"{FB1A7CD0-29EE-476E-8844-79424DBB12A0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |

"{FC73198A-1AC3-4106-86F9-B55FFEC90B2E}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |

"{FCDF75B3-EA88-497C-AD4D-37A38BBB4C90}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |

"{FD8D8F59-AFE8-47CF-B3A0-27B29858D052}" = protocol=6 | dir=in | app=c:\program files\lexmark 5000 series\lxdmfax.exe |

"{FEBDFF99-D609-438B-8BBF-CD8A87CD9B33}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |

"TCP Query User{2F2A8EB4-BD3A-44A8-B233-D6EAEF7C4F7F}C:\users\chelle\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe" = protocol=6 | dir=in | app=c:\users\chelle\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe |

"TCP Query User{5788E586-2E85-4912-8BEE-B5B22A6E1D83}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |

"TCP Query User{5D4BA0C9-D79D-43D9-BAF1-28B222D9BF47}C:\program files\turbine\dungeons & dragons online - stormreach\dndclient.exe" = protocol=6 | dir=in | app=c:\program files\turbine\dungeons & dragons online - stormreach\dndclient.exe |

"TCP Query User{6DB812D4-94AD-4818-9C13-1AC39296E3FF}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |

"TCP Query User{793C2D06-914F-4614-B6DB-8694B9B3F9A9}C:\program files\yahoo!\messenger\yserver.exe" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |

"TCP Query User{81209DC8-73F7-481E-A1F2-C452604C528D}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

"TCP Query User{F124187A-7F0C-4ED5-B7B6-A3E5147E54F4}C:\users\chelle\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe" = protocol=6 | dir=in | app=c:\users\chelle\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe |

"UDP Query User{2A3CC294-AB8F-4C20-9633-1622E4503982}C:\users\chelle\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe" = protocol=17 | dir=in | app=c:\users\chelle\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe |

"UDP Query User{435E2B07-EFBA-4EE4-8D3A-83E7D8CB7953}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

"UDP Query User{6E556044-36E2-4AAA-84D1-C4C2E7405637}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |

"UDP Query User{97885E94-0F61-445F-BAA5-E65794D68798}C:\users\chelle\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe" = protocol=17 | dir=in | app=c:\users\chelle\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe |

"UDP Query User{ABD94594-96E8-403D-B365-854FF4AE469F}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |

"UDP Query User{B12DE7DB-212B-4F2D-8A4F-3BAC232C96B3}C:\program files\turbine\dungeons & dragons online - stormreach\dndclient.exe" = protocol=17 | dir=in | app=c:\program files\turbine\dungeons & dragons online - stormreach\dndclient.exe |

"UDP Query User{DF10A747-5FC0-4EF1-BC2E-E9595188DC55}C:\program files\yahoo!\messenger\yserver.exe" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In

"{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}" = Acer eLock Management

"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool

"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT

"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java 6 Update 20

"{26A24AE4-039D-4CA4-87B4-2F83216016F0}" = Java 6 Update 16

"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros for Acer Driver v7.2.0.215_Foxconn Installation Program

"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java 6 Update 7

"{3851147E-5A91-4469-BA4D-13FFFCC8A920}" = Microsoft Windows OneCare Live v2.5.2900.20 Idcrl Install

"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = Acer Crystal Eye webcam

"{427967BF-09F8-46D5-9275-37001CCBBA5D}" = Winbond CIR Drivers

"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{5660022E-F3F2-4126-8CC5-9726C47150EB}" = Microsoft Windows Live OneCare Resources v2.5.2900.30

"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml

"{57265292-228A-41FA-9AEC-4620CBCC2739}" = Acer eAudio Management

"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management

"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{6513E869-647F-40FD-A55D-CFC92579B9BA}" = PX Engine

"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD

"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver

"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8B21B9EF-6DBF-4F63-8CC7-9F6A56D1EE8E}" = GTOneCare

"{8F018A9E-56DE-4A79-A5EF-25F413F1D538}" = WeatherBug

"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger

"{AA047D7C-5E7C-4878-B75C-77589151B563}" = Acer Crystal Eye webcam

"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology

"{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.2

"{AEBEF8E1-11B9-4458-A619-14EEE48A5BB4}" = Pure Networks Platform

"{AEEAE013-92F1-4515-B278-139F1A692A36}" = Acer eDataSecurity Management

"{B6F7DBE7-2FE2-458F-A738-B10832746036}" = Microsoft Reader

"{BF839132-BD43-4056-ACBF-4377F4A88E2A}" = Acer ePresentation Management

"{C06554A1-2C1E-4D20-B613-EE62C79927CC}" = Acer eNet Management

"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1

"{CE65A9A0-9686-45C6-9098-3C9543A412F0}" = Acer eSettings Management

"{D07A8E7E-D324-4945-BA8C-E532AD008FF3}" = Microsoft Windows OneCare Live v2.5.2900.30

"{E26B83D1-C0BB-41BC-8F44-31D5354DD6AF}" = Microsoft Windows OneCare Live AntiSpyware and AntiVirus

"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager

"{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1

"{EB5F211D-85D5-44C4-BB15-1207C77EF430}" = Visual C++ 8.0 Runtime Setup Package

"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform

"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F3B58D4E-7324-44E4-A6B3-65D2DB8D1FE9}" = Microsoft Protection Service

"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call

"{F90D6825-8F1F-4E3A-9E42-A9C8A9DD1033}" = Nero 7 Essentials

"{FC57FC53-104C-415C-98D7-B05E659461A9}" = Broadcom Gigabit Integrated Controller

"Acer Assist" = Acer Assist

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player 11.5

"Agere Systems Soft Modem" = Agere Systems HDA Modem

"CDisplay_is1" = CDisplay 1.8

"DivX Setup.divx.com" = DivX Setup

"DVD Shrink_is1" = DVD Shrink 3.2

"DVD43_is1" = DVD43 v4.4.0

"EAX Unified" = EAX Unified

"ESET Online Scanner" = ESET Online Scanner v3

"GridVista" = Acer GridVista

"HDMI" = Intel® Graphics Media Accelerator Driver

"LManager" = Launch Manager

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Mozilla Firefox (3.6.9)" = Mozilla Firefox (3.6.9)

"Network MagicUninstall" = Network Magic

"NVIDIA Drivers" = NVIDIA Drivers

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"SystemRequirementsLab" = System Requirements Lab

"WinLiveSuite_Wave3" = Windows Live Essentials

"WinSS" = Windows Live OneCare

"Yahoo! Messenger" = Yahoo! Messenger

"Yahoo! Software Update" = Yahoo! Software Update

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2634554404-4035684415-2601721625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 9/9/2010 12:40:14 AM | Computer Name = Chelle-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description =

Error - 9/9/2010 12:03:01 PM | Computer Name = Chelle-Notebook | Source = EventSystem | ID = 4609

Description =

Error - 9/9/2010 12:08:00 PM | Computer Name = Chelle-Notebook | Source = EventSystem | ID = 4609

Description =

Error - 9/9/2010 12:18:06 PM | Computer Name = Chelle-Notebook | Source = EventSystem | ID = 4609

Description =

Error - 9/9/2010 12:44:56 PM | Computer Name = Chelle-Notebook | Source = EventSystem | ID = 4609

Description =

Error - 9/9/2010 12:45:07 PM | Computer Name = Chelle-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description =

Error - 9/9/2010 12:45:13 PM | Computer Name = Chelle-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description =

Error - 9/9/2010 12:45:13 PM | Computer Name = Chelle-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description =

Error - 9/9/2010 4:59:39 PM | Computer Name = Chelle-Notebook | Source = System Restore | ID = 8193

Description =

Error - 9/9/2010 5:05:00 PM | Computer Name = Chelle-Notebook | Source = System Restore | ID = 8193

Description =

[ Media Center Events ]

Error - 4/29/2009 11:18:13 PM | Computer Name = Chelle-Notebook | Source = MCUpdate | ID = 0

Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 6/9/2009 3:26:47 PM | Computer Name = Chelle-Notebook | Source = MCUpdate | ID = 0

Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ System Events ]

Error - 9/9/2010 12:18:44 PM | Computer Name = Chelle-Notebook | Source = Service Control Manager | ID = 7001

Description =

Error - 9/9/2010 12:18:44 PM | Computer Name = Chelle-Notebook | Source = Service Control Manager | ID = 7001

Description =

Error - 9/9/2010 12:18:45 PM | Computer Name = Chelle-Notebook | Source = Service Control Manager | ID = 7001

Description =

Error - 9/9/2010 12:30:45 PM | Computer Name = Chelle-Notebook | Source = HTTP | ID = 15021

Description =

Error - 9/9/2010 12:44:48 PM | Computer Name = Chelle-Notebook | Source = DCOM | ID = 10005

Description =

Error - 9/9/2010 12:44:56 PM | Computer Name = Chelle-Notebook | Source = DCOM | ID = 10005

Description =

Error - 9/9/2010 12:44:58 PM | Computer Name = Chelle-Notebook | Source = DCOM | ID = 10005

Description =

Error - 9/9/2010 12:44:59 PM | Computer Name = Chelle-Notebook | Source = DCOM | ID = 10005

Description =

Error - 9/9/2010 12:45:05 PM | Computer Name = Chelle-Notebook | Source = Service Control Manager | ID = 7001

Description =

Error - 9/9/2010 12:45:05 PM | Computer Name = Chelle-Notebook | Source = Service Control Manager | ID = 7026

Description =

[ Windows OneCare Events ]

Error - 7/3/2010 6:04:37 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 8001

Description = Successfully detected a local printer failed to share it PrinterName

= Journal Note Writer MachineName = CHELLE-NOTEBOOK ShareName = DriverName = Journal

Note Writer Driver Driver FileName = jnwdrv.dll Driver Version = 3 Driver File Creation

date = 0 Driver Port = Journal Note Writer Port: Eligibility For Sharing = 1 Shared

By OneCare = 0 Pre-OneCare Status = 0 Local Printer = 0 Sharing Status = 0 Error Type

= 5 Error Code = 0x0 EventID = 1 TelemetryAutoGuid = {E1EABAD5-10E0-48C3-A757-3EA00DA3D6BB}

Error - 7/3/2010 6:04:40 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 8001

Description = Successfully detected a local printer failed to share it PrinterName

= Journal Note Writer MachineName = CHELLE-NOTEBOOK ShareName = DriverName = Journal

Note Writer Driver Driver FileName = jnwdrv.dll Driver Version = 3 Driver File Creation

date = 0 Driver Port = Journal Note Writer Port: Eligibility For Sharing = 1 Shared

By OneCare = 0 Pre-OneCare Status = 0 Local Printer = 0 Sharing Status = 0 Error Type

= 5 Error Code = 0x0 EventID = 1 TelemetryAutoGuid = {E1EABAD5-10E0-48C3-A757-3EA00DA3D6BB}

Error - 7/3/2010 10:06:53 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 1002

Description = Service could not be started.

Error - 7/3/2010 10:20:56 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 1002

Description = Service could not be started.

Error - 7/3/2010 10:58:39 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 1002

Description = Service could not be started.

Error - 7/3/2010 11:03:26 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 1002

Description = Service could not be started.

Error - 7/3/2010 11:15:42 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 1002

Description = Service could not be started.

Error - 7/3/2010 11:25:25 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 1002

Description = Service could not be started.

Error - 7/3/2010 11:34:26 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 8001

Description = Successfully detected a local printer failed to share it PrinterName

= Microsoft XPS Document Writer MachineName = CHELLE-NOTEBOOK ShareName = DriverName

= Microsoft XPS Document Writer Driver FileName = mxdwdrv.dll Driver Version = 3 Driver

File Creation date = 0 Driver Port = XPSPort: Eligibility For Sharing = 1 Shared By

OneCare = 0 Pre-OneCare Status = 1 Local Printer = 0 Sharing Status = 1 Error Type

= 5 Error Code = 0x0 EventID = 1 TelemetryAutoGuid = {6CDA198C-CAC8-4BE3-94D8-0F588A78FCBD}

Error - 7/3/2010 11:34:26 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 8001

Description = Successfully detected a local printer failed to share it PrinterName

= Journal Note Writer MachineName = CHELLE-NOTEBOOK ShareName = DriverName = Journal

Note Writer Driver Driver FileName = jnwdrv.dll Driver Version = 3 Driver File Creation

date = 0 Driver Port = Journal Note Writer Port: Eligibility For Sharing = 1 Shared

By OneCare = 0 Pre-OneCare Status = 0 Local Printer = 0 Sharing Status = 0 Error Type

= 5 Error Code = 0x0 EventID = 1 TelemetryAutoGuid = {6CDA198C-CAC8-4BE3-94D8-0F588A78FCBD}

< End of report >

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_USERS\S-1-5-21-2634554404-4035684415-2601721625-1000\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 File not found

https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"FirewallDisableNotify" = 0

"AntiVirusDisableNotify" = 0

"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-2634554404-4035684415-2601721625-1000]

"EnableNotifications" = 0

"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{1C0481D5-D4AE-4959-B9B2-962682BC6E90}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{1F0D4F84-1A81-459B-A633-898D80FEAAE7}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{21911571-88E2-42B0-B2D8-F6B772239270}" = lport=445 | protocol=6 | dir=in | app=system |

"{246CB1B3-F0D7-4ED1-8226-B43EBF47F36C}" = lport=10243 | protocol=6 | dir=in | app=system |

"{34BDE319-CCBE-487A-9A6C-5A269EF30C6A}" = lport=67 | protocol=17 | dir=in | name=dhcp discovery service |

"{371981ED-A23B-49D8-92BC-C5CD6CCBDC59}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{3F99DA6E-5B2E-480A-967D-ED96AAF20601}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 |

"{40FE62E5-2AB6-4541-803B-CE9BBB0367FA}" = lport=2869 | protocol=6 | dir=in | app=system |

"{59564884-FB87-4B52-AF5C-756CC85B4B61}" = rport=445 | protocol=6 | dir=out | app=system |

"{5C7E852C-5A42-4429-93BF-E51699748A93}" = rport=139 | protocol=6 | dir=out | app=system |

"{67E4496D-90B5-4A7D-94F7-B80C07E04C67}" = rport=10243 | protocol=6 | dir=out | app=system |

"{74F57E4F-5BFE-41C1-A5CF-4581BBEA682E}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 |

"{75C9BCC2-5705-4B4F-94B4-2446D43544D5}" = lport=139 | protocol=6 | dir=in | app=system |

"{771177E5-2B81-4ED4-9877-FC11B14A1C6A}" = lport=63331 | protocol=6 | dir=in | name=windows live onecare |

"{91565422-C9B0-4FDA-B2CA-B2BA0383B8D3}" = lport=138 | protocol=17 | dir=in | app=system |

"{947101AE-66ED-4725-BB68-1A494C02FEC9}" = lport=2869 | protocol=6 | dir=in | app=system |

"{963DDF4C-BF4A-442C-8959-148C9E55EA3E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |

"{96771A07-004B-426F-8550-DC74D95727F3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{9702548C-FABB-44A3-B559-A3ACD6807C3F}" = lport=67 | protocol=17 | dir=in | name=dhcp discovery service |

"{9D9FFF77-7976-4B29-9AB1-7E2E0DC68693}" = rport=137 | protocol=17 | dir=out | app=system |

"{A8255A64-9068-428E-80CB-B84717A6C088}" = rport=138 | protocol=17 | dir=out | app=system |

"{B725BC33-D8EE-4268-8FCC-09A4B3202348}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{BE2DCDF7-BD14-4042-BA9F-5B340C1841FD}" = lport=63331 | protocol=6 | dir=in | name=windows live onecare |

"{CDA1D6DB-86B2-46FF-A792-92137C3C6E76}" = lport=137 | protocol=17 | dir=in | app=system |

"{D3DBFC8A-A74D-45F2-A494-19B52FDA03B5}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{E914B501-A9FC-43A2-B69B-EDD0841D61CF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |

"{F0DBCA48-3C1F-4EF1-AD72-BB93F808B294}" = lport=63331 | protocol=6 | dir=in | name=windows live onecare |

"{FB677A41-212A-4C32-9F1B-83C31A1C3225}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{039A3694-AB3B-4995-BE61-D1A76F7558E7}" = protocol=6 | dir=in | app=c:\program files\curse\curseclient.exe |

"{0884DC0D-B941-4900-B97A-AE55EF212381}" = protocol=6 | dir=in | app=c:\program files\world of warcraft\wow-2.3.3.7799-to-2.4.0.8089-enus-downloader.exe |

"{0A658795-6474-4A74-965F-9B25A15CE8DA}" = protocol=17 | dir=in | app=c:\windows\system32\lxddcoms.exe |

"{0B73CF6D-4A15-44C4-BCD1-3FDFF406E34D}" = protocol=6 | dir=in | app=c:\program files\lexmark 5000 series\lxdmamon.exe |

"{0C68A205-85BC-4B0D-9696-AFB2736FA96C}" = protocol=6 | dir=in | app=c:\program files\lexmark 5000 series\frun.exe |

"{12C88213-3B7A-46A1-B380-5AA00D3F9B70}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |

"{16DAF2C6-EA64-4EB6-A06C-F584B1B347E4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

"{1D252DC9-60FE-446A-B125-537C125CF71D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |

"{24CEC1A0-4D79-4C41-87D7-1DF1ED5E665A}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |

"{2C09060C-CD91-41A0-91AB-E78BC7FFBAC2}" = protocol=17 | dir=in | app=c:\program files\lexmark 5000 series\lxdmfax.exe |

"{2D04486C-2793-432A-BB8D-52CB96D1D983}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |

"{2EC79A96-345A-4FD9-841F-FD58ABB66949}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |

"{393D1057-CCDA-4106-8496-AFD35FE95362}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |

"{3A0E3D7A-1343-49A8-B859-242E8134A9CB}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |

"{4195B551-364D-4955-ACA6-3AC4D5E81FCB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |

"{5423218A-9FD9-4C9B-A438-2EF82132B8E5}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |

"{5D9E75A8-529F-4FCA-BAEE-D87FBD96267A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

"{5EF5421A-DE27-41BE-AE2B-53D0FFB3DB1F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

"{6AD4C84F-FABD-4684-AF84-0FBA9092DCA2}" = protocol=17 | dir=in | app=c:\program files\world of warcraft\wow-2.3.3.7799-to-2.4.0.8089-enus-downloader.exe |

"{6BE71982-E119-4764-B838-908B43C7C941}" = protocol=6 | dir=in | app=c:\program files\lexmark 5000 series\lxdmmon.exe |

"{7DBE2542-0EFB-4174-9F59-1DF75937D9DB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |

"{7EEA302E-8795-40E6-8DAD-1160428BBE93}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe |

"{805C06B7-22F1-4574-8EF6-4104C676A235}" = protocol=6 | dir=in | app=c:\windows\system32\lxddcoms.exe |

"{80E7446C-6D93-407F-A168-198814852D8D}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |

"{84155521-391C-4E1E-92F7-C1AFB40DC854}" = protocol=17 | dir=in | app=c:\windows\system32\lxdmcoms.exe |

"{842AEBD9-5FCF-4B9A-A080-AA29740316AB}" = protocol=17 | dir=in | app=c:\program files\world of warcraft\wow-2.3.0-enus-downloader.exe |

"{86D9E5F1-BB4C-41D4-A446-0894077E6283}" = protocol=17 | dir=in | app=c:\program files\lexmark 5000 series\lxdmamon.exe |

"{8E71BE31-0B09-4A09-B0A2-FBC33A162DCB}" = protocol=6 | dir=in | app=c:\windows\system32\lxdmcoms.exe |

"{93DF7D4A-8FC5-4D3E-9B1C-E260E23761AD}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

"{99ABFCC0-1C66-4B08-B3BE-77E71F839F0F}" = protocol=17 | dir=in | app=c:\program files\lexmark 5000 series\lxdmmon.exe |

"{A0B07DDD-1CBF-4394-9C44-23F39ED590D2}" = protocol=17 | dir=in | app=c:\program files\lexmark 5000 series\frun.exe |

"{A15BF1FE-A4A4-400F-B7B3-7F4FE2A3761D}" = protocol=6 | dir=out | app=system |

"{A6A7FF11-5B25-4D96-90D4-1ED3A133D344}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |

"{AE4B2D12-7C0A-4C96-9301-0A7E9FC54254}" = protocol=17 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe |

"{C076E64E-BBC6-49EF-8E0B-18EE8246F77F}" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |

"{C169F3F9-72E7-4026-B8C7-206E3A7072D0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |

"{C2F853CD-4581-47A2-B610-3621EA20B1EF}" = protocol=6 | dir=in | app=c:\program files\world of warcraft\wow-2.3.0-enus-downloader.exe |

"{C871C396-11AE-4486-9F39-CAB6E3F4AA79}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdmpswx.exe |

"{D75A4B88-3680-4587-AC1A-DA52BE3CABB9}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |

"{E08CF960-6DC7-4554-833C-D8AEC49D2142}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdmpswx.exe |

"{E1EB5069-898F-4ED6-9449-2E94B50D57A4}" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |

"{E9E63704-18B4-4E41-BAD9-E82449C37E31}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |

"{EAEE6981-3A81-41E3-87DD-971CE73E50FC}" = protocol=17 | dir=in | app=c:\program files\curse\curseclient.exe |

"{F8E4B1C3-BD5B-4A2A-B857-162E7E7A0595}" = protocol=6 | dir=in | app=c:\program files\common files\pure networks shared\platform\nmsrvc.exe |

"{FB1A7CD0-29EE-476E-8844-79424DBB12A0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |

"{FC73198A-1AC3-4106-86F9-B55FFEC90B2E}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |

"{FCDF75B3-EA88-497C-AD4D-37A38BBB4C90}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |

"{FD8D8F59-AFE8-47CF-B3A0-27B29858D052}" = protocol=6 | dir=in | app=c:\program files\lexmark 5000 series\lxdmfax.exe |

"{FEBDFF99-D609-438B-8BBF-CD8A87CD9B33}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |

"TCP Query User{2F2A8EB4-BD3A-44A8-B233-D6EAEF7C4F7F}C:\users\chelle\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe" = protocol=6 | dir=in | app=c:\users\chelle\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe |

"TCP Query User{5788E586-2E85-4912-8BEE-B5B22A6E1D83}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |

"TCP Query User{5D4BA0C9-D79D-43D9-BAF1-28B222D9BF47}C:\program files\turbine\dungeons & dragons online - stormreach\dndclient.exe" = protocol=6 | dir=in | app=c:\program files\turbine\dungeons & dragons online - stormreach\dndclient.exe |

"TCP Query User{6DB812D4-94AD-4818-9C13-1AC39296E3FF}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |

"TCP Query User{793C2D06-914F-4614-B6DB-8694B9B3F9A9}C:\program files\yahoo!\messenger\yserver.exe" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |

"TCP Query User{81209DC8-73F7-481E-A1F2-C452604C528D}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

"TCP Query User{F124187A-7F0C-4ED5-B7B6-A3E5147E54F4}C:\users\chelle\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe" = protocol=6 | dir=in | app=c:\users\chelle\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe |

"UDP Query User{2A3CC294-AB8F-4C20-9633-1622E4503982}C:\users\chelle\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe" = protocol=17 | dir=in | app=c:\users\chelle\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe |

"UDP Query User{435E2B07-EFBA-4EE4-8D3A-83E7D8CB7953}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

"UDP Query User{6E556044-36E2-4AAA-84D1-C4C2E7405637}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |

"UDP Query User{97885E94-0F61-445F-BAA5-E65794D68798}C:\users\chelle\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe" = protocol=17 | dir=in | app=c:\users\chelle\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe |

"UDP Query User{ABD94594-96E8-403D-B365-854FF4AE469F}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |

"UDP Query User{B12DE7DB-212B-4F2D-8A4F-3BAC232C96B3}C:\program files\turbine\dungeons & dragons online - stormreach\dndclient.exe" = protocol=17 | dir=in | app=c:\program files\turbine\dungeons & dragons online - stormreach\dndclient.exe |

"UDP Query User{DF10A747-5FC0-4EF1-BC2E-E9595188DC55}C:\program files\yahoo!\messenger\yserver.exe" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In

"{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}" = Acer eLock Management

"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool

"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT

"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java 6 Update 20

"{26A24AE4-039D-4CA4-87B4-2F83216016F0}" = Java 6 Update 16

"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros for Acer Driver v7.2.0.215_Foxconn Installation Program

"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java 6 Update 7

"{3851147E-5A91-4469-BA4D-13FFFCC8A920}" = Microsoft Windows OneCare Live v2.5.2900.20 Idcrl Install

"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = Acer Crystal Eye webcam

"{427967BF-09F8-46D5-9275-37001CCBBA5D}" = Winbond CIR Drivers

"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{5660022E-F3F2-4126-8CC5-9726C47150EB}" = Microsoft Windows Live OneCare Resources v2.5.2900.30

"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml

"{57265292-228A-41FA-9AEC-4620CBCC2739}" = Acer eAudio Management

"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management

"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{6513E869-647F-40FD-A55D-CFC92579B9BA}" = PX Engine

"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD

"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver

"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8B21B9EF-6DBF-4F63-8CC7-9F6A56D1EE8E}" = GTOneCare

"{8F018A9E-56DE-4A79-A5EF-25F413F1D538}" = WeatherBug

"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger

"{AA047D7C-5E7C-4878-B75C-77589151B563}" = Acer Crystal Eye webcam

"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology

"{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.2

"{AEBEF8E1-11B9-4458-A619-14EEE48A5BB4}" = Pure Networks Platform

"{AEEAE013-92F1-4515-B278-139F1A692A36}" = Acer eDataSecurity Management

"{B6F7DBE7-2FE2-458F-A738-B10832746036}" = Microsoft Reader

"{BF839132-BD43-4056-ACBF-4377F4A88E2A}" = Acer ePresentation Management

"{C06554A1-2C1E-4D20-B613-EE62C79927CC}" = Acer eNet Management

"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1

"{CE65A9A0-9686-45C6-9098-3C9543A412F0}" = Acer eSettings Management

"{D07A8E7E-D324-4945-BA8C-E532AD008FF3}" = Microsoft Windows OneCare Live v2.5.2900.30

"{E26B83D1-C0BB-41BC-8F44-31D5354DD6AF}" = Microsoft Windows OneCare Live AntiSpyware and AntiVirus

"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager

"{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1

"{EB5F211D-85D5-44C4-BB15-1207C77EF430}" = Visual C++ 8.0 Runtime Setup Package

"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform

"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F3B58D4E-7324-44E4-A6B3-65D2DB8D1FE9}" = Microsoft Protection Service

"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call

"{F90D6825-8F1F-4E3A-9E42-A9C8A9DD1033}" = Nero 7 Essentials

"{FC57FC53-104C-415C-98D7-B05E659461A9}" = Broadcom Gigabit Integrated Controller

"Acer Assist" = Acer Assist

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player 11.5

"Agere Systems Soft Modem" = Agere Systems HDA Modem

"CDisplay_is1" = CDisplay 1.8

"DivX Setup.divx.com" = DivX Setup

"DVD Shrink_is1" = DVD Shrink 3.2

"DVD43_is1" = DVD43 v4.4.0

"EAX Unified" = EAX Unified

"ESET Online Scanner" = ESET Online Scanner v3

"GridVista" = Acer GridVista

"HDMI" = Intel® Graphics Media Accelerator Driver

"LManager" = Launch Manager

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Mozilla Firefox (3.6.9)" = Mozilla Firefox (3.6.9)

"Network MagicUninstall" = Network Magic

"NVIDIA Drivers" = NVIDIA Drivers

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"SystemRequirementsLab" = System Requirements Lab

"WinLiveSuite_Wave3" = Windows Live Essentials

"WinSS" = Windows Live OneCare

"Yahoo! Messenger" = Yahoo! Messenger

"Yahoo! Software Update" = Yahoo! Software Update

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2634554404-4035684415-2601721625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 9/9/2010 12:40:14 AM | Computer Name = Chelle-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description =

Error - 9/9/2010 12:03:01 PM | Computer Name = Chelle-Notebook | Source = EventSystem | ID = 4609

Description =

Error - 9/9/2010 12:08:00 PM | Computer Name = Chelle-Notebook | Source = EventSystem | ID = 4609

Description =

Error - 9/9/2010 12:18:06 PM | Computer Name = Chelle-Notebook | Source = EventSystem | ID = 4609

Description =

Error - 9/9/2010 12:44:56 PM | Computer Name = Chelle-Notebook | Source = EventSystem | ID = 4609

Description =

Error - 9/9/2010 12:45:07 PM | Computer Name = Chelle-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description =

Error - 9/9/2010 12:45:13 PM | Computer Name = Chelle-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description =

Error - 9/9/2010 12:45:13 PM | Computer Name = Chelle-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description =

Error - 9/9/2010 4:59:39 PM | Computer Name = Chelle-Notebook | Source = System Restore | ID = 8193

Description =

Error - 9/9/2010 5:05:00 PM | Computer Name = Chelle-Notebook | Source = System Restore | ID = 8193

Description =

[ Media Center Events ]

Error - 4/29/2009 11:18:13 PM | Computer Name = Chelle-Notebook | Source = MCUpdate | ID = 0

Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 6/9/2009 3:26:47 PM | Computer Name = Chelle-Notebook | Source = MCUpdate | ID = 0

Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ System Events ]

Error - 9/9/2010 12:18:44 PM | Computer Name = Chelle-Notebook | Source = Service Control Manager | ID = 7001

Description =

Error - 9/9/2010 12:18:44 PM | Computer Name = Chelle-Notebook | Source = Service Control Manager | ID = 7001

Description =

Error - 9/9/2010 12:18:45 PM | Computer Name = Chelle-Notebook | Source = Service Control Manager | ID = 7001

Description =

Error - 9/9/2010 12:30:45 PM | Computer Name = Chelle-Notebook | Source = HTTP | ID = 15021

Description =

Error - 9/9/2010 12:44:48 PM | Computer Name = Chelle-Notebook | Source = DCOM | ID = 10005

Description =

Error - 9/9/2010 12:44:56 PM | Computer Name = Chelle-Notebook | Source = DCOM | ID = 10005

Description =

Error - 9/9/2010 12:44:58 PM | Computer Name = Chelle-Notebook | Source = DCOM | ID = 10005

Description =

Error - 9/9/2010 12:44:59 PM | Computer Name = Chelle-Notebook | Source = DCOM | ID = 10005

Description =

Error - 9/9/2010 12:45:05 PM | Computer Name = Chelle-Notebook | Source = Service Control Manager | ID = 7001

Description =

Error - 9/9/2010 12:45:05 PM | Computer Name = Chelle-Notebook | Source = Service Control Manager | ID = 7026

Description =

[ Windows OneCare Events ]

Error - 7/3/2010 6:04:37 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 8001

Description = Successfully detected a local printer failed to share it PrinterName

= Journal Note Writer MachineName = CHELLE-NOTEBOOK ShareName = DriverName = Journal

Note Writer Driver Driver FileName = jnwdrv.dll Driver Version = 3 Driver File Creation

date = 0 Driver Port = Journal Note Writer Port: Eligibility For Sharing = 1 Shared

By OneCare = 0 Pre-OneCare Status = 0 Local Printer = 0 Sharing Status = 0 Error Type

= 5 Error Code = 0x0 EventID = 1 TelemetryAutoGuid = {E1EABAD5-10E0-48C3-A757-3EA00DA3D6BB}

Error - 7/3/2010 6:04:40 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 8001

Description = Successfully detected a local printer failed to share it PrinterName

= Journal Note Writer MachineName = CHELLE-NOTEBOOK ShareName = DriverName = Journal

Note Writer Driver Driver FileName = jnwdrv.dll Driver Version = 3 Driver File Creation

date = 0 Driver Port = Journal Note Writer Port: Eligibility For Sharing = 1 Shared

By OneCare = 0 Pre-OneCare Status = 0 Local Printer = 0 Sharing Status = 0 Error Type

= 5 Error Code = 0x0 EventID = 1 TelemetryAutoGuid = {E1EABAD5-10E0-48C3-A757-3EA00DA3D6BB}

Error - 7/3/2010 10:06:53 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 1002

Description = Service could not be started.

Error - 7/3/2010 10:20:56 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 1002

Description = Service could not be started.

Error - 7/3/2010 10:58:39 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 1002

Description = Service could not be started.

Error - 7/3/2010 11:03:26 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 1002

Description = Service could not be started.

Error - 7/3/2010 11:15:42 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 1002

Description = Service could not be started.

Error - 7/3/2010 11:25:25 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 1002

Description = Service could not be started.

Error - 7/3/2010 11:34:26 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 8001

Description = Successfully detected a local printer failed to share it PrinterName

= Microsoft XPS Document Writer MachineName = CHELLE-NOTEBOOK ShareName = DriverName

= Microsoft XPS Document Writer Driver FileName = mxdwdrv.dll Driver Version = 3 Driver

File Creation date = 0 Driver Port = XPSPort: Eligibility For Sharing = 1 Shared By

OneCare = 0 Pre-OneCare Status = 1 Local Printer = 0 Sharing Status = 1 Error Type

= 5 Error Code = 0x0 EventID = 1 TelemetryAutoGuid = {6CDA198C-CAC8-4BE3-94D8-0F588A78FCBD}

Error - 7/3/2010 11:34:26 PM | Computer Name = Chelle-Notebook | Source = WinSS | ID = 8001

Description = Successfully detected a local printer failed to share it PrinterName

= Journal Note Writer MachineName = CHELLE-NOTEBOOK ShareName = DriverName = Journal

Note Writer Driver Driver FileName = jnwdrv.dll Driver Version = 3 Driver File Creation

date = 0 Driver Port = Journal Note Writer Port: Eligibility For Sharing = 1 Shared

By OneCare = 0 Pre-OneCare Status = 0 Local Printer = 0 Sharing Status = 0 Error Type

= 5 Error Code = 0x0 EventID = 1 TelemetryAutoGuid = {6CDA198C-CAC8-4BE3-94D8-0F588A78FCBD}

< End of report >

Link to post
Share on other sites
Chelle6285

Chelle6285

Posted
  • Author
Posted

Today in normal mode - I was uploading some photos, and I noticed that several of my processes were doubled. I noticed 2 explorer.exe's and taskeng.exe 3 times, local, chelle, and system. I ended one of the explorer's which popped up when i tried to delete something - but when i ended it - the taskbar didn't go away as usual. Also is desktop.ini supposed to have a interactive user?

Link to post
Share on other sites
Gammo

Gammo

Posted
Posted

Hi,

I don't think your problem is malware related. I suggest you start a new topic here.

Your logs appears to be clean now. There is only a bit of cleanup that we will deal with in this post, as well as prevention from future infections. :)

Remove Combofix now that we're done with it.

  • Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
  • Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
    CF_Uninstall-1.jpg
  • Please follow the prompts to uninstall Combofix.
  • You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  • Download OTC to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please download JavaRa to your desktop and unzip it to its own folder

  • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
  • Accept any prompts.
  • Open JavaRa.exe again and select Search For Updates.
  • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Keep a backup of your important files

Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Make proper use of your anti-virus and firewall

You should keep your anti-virus and firewall guard enabled at all times, don't shut them off unless there's a specific reason to do so.

Also, regularly performing a full system scan with your anti-virus program is a good idea to make sure nothing has slipped through your protection. Once every two weeks works well for many people. You can set the scan to run during a time when you don't plan to use the computer and just leave it to complete on its own.

Keep in mind that anti-virus programs are far from perfect. They don't protect you against every piece of malware that's out there, so don't trust them blindly. If an anti-virus reports a file as 'clean' then it's doesn't necessarily has to mean it is.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Keep all your software updated

It is important to keep up on system updates from Microsoft by regularly checking their website at: http://windowsupdate.microsoft.com/, as these patch critical security vulnerabilities and help to keep you safe.

It's also important to keep programs up to date so that malware doesn't exploit any old security flaws. FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Java and Adobe Reader are two of the main security vulnerabilities. You can find the latest version of Java here, you will want the Java SE Runtime Environment (JRE) one. You can find the latest version of Adobe Reader here.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Use a safer web browser

Internet Explorer is not the most secure tool for browsing the web. It has been known to be very susceptible to infection, and there are a couple good free alternatives: Firefox and Opera. Both are excellent faster, safer, more powerful and functional free alternatives to Internet Explorer. It's definitely worth the short period of adjustment to start using one of these. If you wish to continue using Internet Explorer, it would be a good idea to follow the tutorial here which will help you to make IE much safer.

If you decide to use the Firefox browser, the McAfee SiteAdvisor add-on will nicely help to enhance your security. This add-on tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Some other security programs

It is wise these days to have a few security programs installed and running on your machine except from just an anti-virus and a firewall. I will list some of them.

  • A good anti-spyware program installed on your pc is very important to help remove any spyware that may have gotten on your computer. I highly recommend Malwarebytes' Anti-Malware.
  • SpywareBlaster to help prevent spyware from installing in the first place.
  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. This prevents your computer from connecting to those sites in the future.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Be careful

Having security programs installed is very helpful to you, but none of them have the gift of human thought. The best way to make sure you don't get infected is to exercise common sense. Be careful of what websites you visit - if a site looks suspicious, trust your instincts and get out of there. Be careful of what attachments you open in emails and files you download from websites - check them over carefully to make sure that you know what you're getting.

Using peer-to-peer programs (eg: LimeWire, BitTorrent, uTorrent, Kazaa) or downloading cracks and keygens is something else to avoid. These are the most common way to get infected. Malware writers use these programs to spread infections as it is the easiest way for them. The majority of infections we see in the Malware Removal forum are due to people using p2p programs to download cracks/keygens/warez. These are not only illegal, but will always contain some form of malware. You have no way of verifying that the things you download are legitimate or that they don't contain malware. Even with an up to date anti-virus and firewall, some of these things will still infect you. It is highly recommend that you uninstall all peer-to-peer programs. It just isn't worth it.

Other common ways of getting infected are dis-reputable sites forcing you to download and install a codec. Or viruses using Instant Messaging programs (Windows Live Messenger, MSN Messenger, AIM) to send a file claiming it to be "photos" from a friend, only for it to turn out to be a virus.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Slow computer?

If your computer begins to slow down in the future for no particular reason, your first step should not be to come to the malware forum. As your computer ages and is used, it's parts wear, files and programs accumulate, and its performance can decrease. To restore your computer's performance to its best possible level, follow the steps in this page written by malware expert Miekiemoes.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I'll leave this thread open for a couple days in case you come across any lingering problems that need fixing, then I'll close it up. If you need it reopened for any reason just shoot me a PM. It's been a pleasure working with you, now best of luck!

Cheers,

Gammo :)

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.