Bad Pool Header BSoD

[117]

I just recently updated webroot antivirus with spy sweeper and it stopped working, so I reinstalled it. It still won't work and I started getting BSoDs including Bad Pool Header. I installed Kaspersky to see if that would help, but i keep getting BSoDs

Here is my Hijackthis log, thanks in advance :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 3:16:30 PM, on 10/17/2010

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v8.00 (8.00.6001.18928)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe

C:\Program Files (x86)\ASUS\Direct Console\DCHelper.exe

C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe

C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

C:\Program Files (x86)\Webroot\Security\Current\Framework\WRTray.exe

C:\Program Files (x86)\Microsoft Works\WkCalRem.exe

C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\avp.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - (no file)

F2 - REG:system.ini: UserInit=userinit.exe

O1 - Hosts: ::1 localhost

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\ievkbd.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll

O4 - HKLM\..\Run: [WebrootTrayApp] "C:\Program Files (x86)\Webroot\Security\Current\Framework\WRTray.exe"

O4 - HKLM\..\Run: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\avp.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Startup: wkcalrem.LNK = C:\Program Files (x86)\Microsoft Works\WkCalRem.exe

O4 - Global Startup: tisspwiz.lnk = C:\Program Files\Trend Micro\Internet Security\tisspwiz.exe

O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\ie_banner_deny.htm

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000

O8 - Extra context menu item: Se&nd to OneNote - res:///105

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: &Virtual Keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll

O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O13 - Gopher Prefix:

O16 - DPF: {A3256902-51FA-45A0-8A97-FC1143C169D9} (Diagnostics ActiveX WebControl) - http://support.microsoft.com/mats/DiagWebControl.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O20 - AppInit_DLLs: C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll

O23 - Service: ADSM Service (ADSMService) - ASUSTek Computer Inc. - C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe

O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe

O23 - Service: Kaspersky PURE (AVP) - Kaspersky Lab - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\avp.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe

O23 - Service: CryptoStorage control service (CSObjectsSrv) - Infowatch - C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe

O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)

O23 - Service: Intel

[Elise]

Hello ,

And My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

• The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
  
• Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
  
• The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  
• Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.
  

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Please download OTL from one of the following mirrors:
  • This is THE Mirror
    

  [*]Save it to your desktop.

  [*]Double click on the icon on your desktop.

  [*]Click the "Scan All Users" checkbox.

  [*]Push the Quick Scan button.

  [*]Two reports will open, copy and paste them in a reply here:

  • OTListIt.txt <-- Will be opened
    
  • Extra.txt <-- Will be minimized
    

Please download Rootkit Unhooker and save it to your Desktop

• Double-click on RKUnhookerLE to run it
  
• Click the Report tab, then click Scan
  
• Check Drivers, Stealth and uncheck the rest
  
• Click OK
  
• Wait until it's finished and then go to File > Save Report
  
• Save the report to your Desktop
  

Copy the entire contents of the report and paste it in a reply here.

Note - you may get this warning it is ok, just ignore: "Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

• A detailed description of your problems
  
• A new OTL log (don't forget extra.txt)
  
• RKU log
  

Thanks and again sorry for the delay.

[117]

Might I add that I am running Vista64

My HijackThis Log

---------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 3:21:44 PM, on 10/20/2010

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v8.00 (8.00.6001.18928)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\ASUS\Direct Console\DCHelper.exe

C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe

C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe

C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

C:\Program Files (x86)\Microsoft Works\WkCalRem.exe

C:\Program Files (x86)\Webroot\Security\Current\Framework\WRTray.exe

C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\avp.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\Desktop\OTL.exe

C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - (no file)

F2 - REG:system.ini: UserInit=userinit.exe

O1 - Hosts: ::1 localhost

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\ievkbd.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll

O4 - HKLM\..\Run: [WebrootTrayApp] "C:\Program Files (x86)\Webroot\Security\Current\Framework\WRTray.exe"

O4 - HKLM\..\Run: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\avp.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun

O4 - HKCU\..\Run: [Google Update] "C:\Users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe" /c

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Startup: wkcalrem.LNK = C:\Program Files (x86)\Microsoft Works\WkCalRem.exe

O4 - Global Startup: tisspwiz.lnk = C:\Program Files\Trend Micro\Internet Security\tisspwiz.exe

O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\ie_banner_deny.htm

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000

O8 - Extra context menu item: Se&nd to OneNote - res:///105

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: &Virtual Keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll

O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O13 - Gopher Prefix:

O16 - DPF: {A3256902-51FA-45A0-8A97-FC1143C169D9} (Diagnostics ActiveX WebControl) - http://support.microsoft.com/mats/DiagWebControl.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O20 - AppInit_DLLs: C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll

O23 - Service: ADSM Service (ADSMService) - ASUSTek Computer Inc. - C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe

O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe

O23 - Service: Kaspersky PURE (AVP) - Kaspersky Lab - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\avp.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe

O23 - Service: CryptoStorage control service (CSObjectsSrv) - Infowatch - C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe

O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)

O23 - Service: Intel

[117]

OTL logfile created on: 10/20/2010 3:27:36 PM - Run 1

OTL by OldTimer - Version 3.2.16.0 Folder = C:\Users\Owner\Desktop

64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18928)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 29.00% Memory free

8.00 Gb Paging File | 4.00 Gb Available in Paging File | 51.00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 287.35 Gb Total Space | 82.93 Gb Free Space | 28.86% Space Free | Partition Type: NTFS

Drive E: | 234.18 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: OWNER-PC | User Name: Owner | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days

========== Processes (SafeList) ==========

PRC - [2010/10/20 15:17:52 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Owner\Desktop\OTL.exe

PRC - [2010/10/17 15:10:47 | 000,396,288 | ---- | M] (Trend Micro Inc.) -- C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

PRC - [2010/10/01 08:05:55 | 001,286,960 | ---- | M] (Webroot Software, Inc. ) -- C:\Program Files (x86)\Webroot\Security\Current\Framework\WRTray.exe

PRC - [2010/10/01 08:01:45 | 003,066,528 | ---- | M] (Webroot Software, Inc. ) -- C:\Program Files (x86)\Webroot\Security\Current\Framework\WRConsumerService.exe

PRC - [2010/09/22 13:41:50 | 003,872,776 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files (x86)\Webroot\Security\Current\Plugins\AntiMalware\AEI.exe

PRC - [2010/09/20 22:40:50 | 000,977,976 | ---- | M] (Google Inc.) -- C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

PRC - [2010/08/13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

PRC - [2010/01/27 17:40:47 | 000,075,064 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe

PRC - [2010/01/11 21:59:00 | 000,240,232 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

PRC - [2009/12/25 16:43:40 | 000,340,456 | ---- | M] (Kaspersky Lab) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\avp.exe

PRC - [2009/12/21 17:34:38 | 000,743,992 | ---- | M] (Infowatch) -- C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe

PRC - [2009/10/30 17:29:58 | 000,136,448 | ---- | M] (Panda Security, S.L.) -- C:\Program Files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe

PRC - [2009/04/10 23:28:15 | 000,247,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wbem\WmiPrvSE.exe

PRC - [2008/08/29 16:06:16 | 000,223,800 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe

PRC - [2008/08/13 22:00:16 | 000,158,264 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe

PRC - [2008/08/13 22:00:08 | 000,113,208 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe

PRC - [2008/08/13 21:59:56 | 000,301,624 | ---- | M] () -- C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe

PRC - [2008/08/13 21:59:52 | 000,100,920 | ---- | M] () -- C:\Program Files (x86)\ASUS\ATK Hotkey\AsLdrSrv.exe

PRC - [2008/08/13 17:21:56 | 002,482,176 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe

PRC - [2008/06/17 23:10:24 | 000,297,528 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe

PRC - [2008/03/31 03:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe

PRC - [2008/03/24 22:39:18 | 000,322,104 | ---- | M] (ASUSTek.) -- C:\Program Files (x86)\ASUS\Direct Console\DCHelper.exe

PRC - [2007/11/30 12:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe

PRC - [2007/08/08 01:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe

PRC - [2007/08/03 13:24:54 | 000,125,496 | ---- | M] () -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

PRC - [2007/06/19 23:04:50 | 000,046,432 | ---- | M] (Microsoft

[117]

OTL Extras logfile created on: 10/20/2010 3:27:36 PM - Run 1

OTL by OldTimer - Version 3.2.16.0 Folder = C:\Users\Owner\Desktop

64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18928)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 29.00% Memory free

8.00 Gb Paging File | 4.00 Gb Available in Paging File | 51.00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 287.35 Gb Total Space | 82.93 Gb Free Space | 28.86% Space Free | Partition Type: NTFS

Drive E: | 234.18 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: OWNER-PC | User Name: Owner | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.url[@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-4175058383-3051591843-2860766605-1000\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %* File not found

cmdfile [open] -- "%1" %* File not found

comfile [open] -- "%1" %* File not found

exefile [open] -- "%1" %* File not found

helpfile [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %* File not found

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1" File not found

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S File not found

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"AutoUpdateDisableNotify" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = 9F 9E 16 8C DC 5B C8 01 [binary data]

"VistaSp2" = E4 61 B3 9B A3 EB C9 01 [binary data]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring" = 1

"" =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"oobe_av" = 1

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{07ABCA57-1629-4ED5-85DD-507F58903CF5}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |

"{0EBB074A-F743-4407-AA80-13FC7547E040}" = rport=137 | protocol=17 | dir=out | app=system |

"{109BFD04-784B-4F21-9A84-49F2CDED019A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{242FA838-2571-4610-9560-CFCD5397EEBC}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |

"{386182B9-976F-4104-B602-AEC155C5730B}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |

"{4292D589-F864-4AC6-8880-D29E0C104E21}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 |

"{45F49A04-64FA-4DAA-BDCB-D46C8432A83A}" = lport=138 | protocol=17 | dir=in | app=system |

"{48EBCF61-1D12-4482-9674-AC5E0DF33D9F}" = lport=139 | protocol=6 | dir=in | app=system |

"{490615F7-2B8A-4732-90C9-47642262AA10}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{4B3EC2B5-02DA-47C4-A2BE-B6590BC1C317}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{4D814F33-992F-4E50-9246-895B599ADBAE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{4F60031C-CC8D-415E-BF4A-79F75C1EB478}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{533BCD6C-DAA7-4C14-80AC-10BDD140B386}" = rport=445 | protocol=6 | dir=out | app=system |

"{567F8122-AAAE-4FF4-AA04-D3ECB9254EDE}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{5E32DB0D-9482-4AF8-BDBF-7F5F85353D4E}" = rport=10244 | protocol=6 | dir=out | app=system |

"{5FBB07A8-7E64-4F1A-ABEC-41304101851C}" = lport=10244 | protocol=6 | dir=in | app=system |

"{5FF2D921-F71F-4CD1-A75E-0BA51F7F95A3}" = lport=3390 | protocol=6 | dir=in | app=system |

"{68751426-8C67-429D-959A-E25DCE880FB4}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{6C540116-85A3-44C2-886B-A133A9F723F6}" = lport=2869 | protocol=6 | dir=in | app=system |

"{8B86B4E6-5B1A-4E20-B20B-C7900993E3A9}" = lport=10244 | protocol=6 | dir=in | app=system |

"{95D0F6FD-DEB8-4F31-90B6-3BA18C1C50C6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |

"{96763935-BC3E-4F2B-8548-B304C6740047}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |

"{A1274A59-0E89-49FA-9ADE-860F2CAED73E}" = rport=139 | protocol=6 | dir=out | app=system |

"{A3527C6B-0553-46B5-931D-239A8D80CC68}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |

"{C4668472-2BBD-4F7E-9F46-8C6DBA50FE08}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe |

"{C688214B-2EB1-4BFE-864A-5D799CB24488}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{C8C3364C-6E5B-4ADF-A9FE-CE28DCCA974E}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |

"{CA93626D-4403-42BE-800E-2DE3CA62FE4B}" = rport=10244 | protocol=6 | dir=out | app=system |

"{CCF4B1B0-BDC2-4F6B-98CC-730BED9CC076}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{CD7746D8-F7B1-461C-A21C-9171ACEDABD1}" = lport=445 | protocol=6 | dir=in | app=system |

"{CDFAD196-8E42-4E8D-A2D4-809C423DEFA9}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |

"{D45250F4-EF76-46D3-AB70-DC2317DBD979}" = lport=137 | protocol=17 | dir=in | app=system |

"{D555CDFB-A656-4EE8-8361-56C4F365A5CF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

"{DC8CBADA-6B5B-4758-8DA7-19D346118B30}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |

"{E2294275-88DF-4A01-B39C-4FFE22A75E69}" = lport=3390 | protocol=6 | dir=in | app=system |

"{EEC68A96-643B-45C1-9F6B-6C506DB83A24}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{F36932C8-BE48-4B76-B300-EF46A6BC5A83}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

"{FA98064D-08EB-4C12-968A-462248A263E9}" = rport=138 | protocol=17 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{038D2138-105D-4368-8E53-294626ED8780}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\alien swarm\srcds.exe |

"{04F0A340-0621-4FCB-8B9F-A91EBC967CEF}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |

"{052CC8A1-B8DC-470B-84C1-F660B42AB4B8}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sixense truemotion sdk\sixensesteamlauncher.exe |

"{057D0DE9-8BE7-4A8F-B5C6-933F8F9F17B3}" = protocol=17 | dir=in | app=c:\program files (x86)\ventrilo\ventrilo.exe |

"{07EF894E-A506-4C8B-9B41-1422A88244CA}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\alien swarm\bin\sdklauncher.exe |

"{0CDC7B44-7863-40F3-AE43-5E5F1E975AA1}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |

"{180DBEF2-AF56-4DE0-B84D-ED55C1CAAA10}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\america's army 3\binaries\aa3game.exe |

"{1A4127AC-1F0D-4B58-A3E4-65F7F5FA8B8E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |

"{1F21B11D-D084-4765-91E1-0C8CB45C226B}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |

"{1FCF3A12-7BB2-4232-83C5-8093E9328AE3}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.3.9183-to-3.0.8.9464-enus-downloader.exe |

"{21547E49-332C-43CE-8ADD-135A2B7BCC3F}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\wow-3.1.3.9947-to-3.2.0.10192-enus-downloader.exe |

"{223EFC07-1002-42BB-B25A-FF9C0017AC1E}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |

"{248CC053-B59D-4A56-B28F-4EB450E72BB3}" = protocol=6 | dir=in | app=c:\program files (x86)\stardock games\sins of a solar empire\sins of a solar empire.exe |

"{2527CF40-3483-41ED-B9C7-2E665F97FBF0}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\r.u.s.e. beta\ruse.exe |

"{25A4F219-50D6-4333-8357-0FDDA4FB1C2D}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |

"{26743243-4DE5-4C26-8D90-73FD3C92C3F5}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\moon base alpha\binaries\win32\moonbasealphagame.exe |

"{272B4B3E-0FF5-449C-8B70-8F3E56CD4068}" = protocol=17 | dir=in | app=c:\program files (x86)\stardock games\sins of a solar empire\sins of a solar empire.exe |

"{2C3CEE90-91CE-4CAE-8918-65094C5419C3}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\trackmania nations forever\tmforever.exe |

"{330B7520-40DA-45AD-B41B-BD2E1330F502}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.3.9183-to-3.0.8.9464-enus-downloader.exe |

"{33C0D2E6-5C79-463B-ADCD-C5EE07227CF4}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.9.9551-to-3.1.0.9767-enus-downloader.exe |

"{375B3578-B2B7-4008-AAE8-674BDEBECCB7}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mightier\mightier.exe |

"{3CDD356C-CCE4-424B-ABCA-77E89E16E5E7}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |

"{3CF07297-6A86-47CC-B352-891FA7FF5F14}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.1.1.9835-to-3.1.2.9901-enus-downloader.exe |

"{3DB714A8-F74E-40E8-A42C-CE292A720642}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\alien swarm\bin\sdklauncher.exe |

"{4749367C-8647-421E-BB6E-2241A44AF541}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\alien swarm\srcds.exe |

"{4C44CD52-44FD-4BDA-A977-ABD4A4B45105}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\james cameron's avatar - the game\bin\avatarlauncher.exe |

"{4C74749F-C6A1-410E-ABDA-A609458377B2}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |

"{5156835D-33E5-4CF3-B6D4-6647AED7A8DC}" = protocol=17 | dir=in | app=c:\program files (x86)\lucasarts\star wars empire at war\gamedata\sweaw.exe |

"{549F4BED-D2EB-46B3-A11D-EB6A7DF61EC7}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |

"{550EE04A-A4AD-40F2-AA42-DAF1E8F54415}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.8.9506-to-3.0.9.9551-enus-downloader.exe |

"{56C9D916-DD8C-45F6-B9E7-DF0A1E5F332F}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |

"{5D3B4485-D993-46A2-9881-39AEF6E3FC89}" = protocol=6 | dir=in | app=c:\program files (x86)\samsung\samsung new pc studio\npsasvr.exe |

"{5F2996B5-50CA-4789-B8AA-1902D1914624}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |

"{63EA0ED3-B0BE-4D52-9066-53CB9A88AE98}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\james cameron's avatar - the game\bin\avatar.exe |

"{669576C3-EEC0-4E1C-8B3A-9F6C9BCFC573}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |

"{68D5666C-282E-443A-9E6A-035C0E4986AF}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |

"{68F6BF18-E89A-4CBB-A20D-7A8F4F383168}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |

"{738C45AA-5D40-4253-8CA5-AC413921BB00}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |

"{74D11672-7D41-4E0C-9848-95D7766FF7B6}" = protocol=17 | dir=in | app=c:\program files (x86)\logitech touch mouse server\itouch-server-win.exe |

"{78C9FC06-995A-45EC-A967-98956CEF0FC6}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |

"{79F9DABC-1B05-4E8D-AC4C-13D85B9C9DA9}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\between - demo\between.exe |

"{829EF33A-3636-4700-8D05-CC398822150B}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\trackmania nations forever\tmforever.exe |

"{873B9E4E-2734-4841-9B7F-30A3CD747FC9}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |

"{89FE51D5-9673-4CDD-96EA-291883F79422}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mightier\mightier.exe |

"{8DD94E9D-4C2F-48E8-84B8-77E544795A40}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\james cameron's avatar - the game\bin\avatarlauncher.exe |

"{915D7F20-94BD-4BC7-9B4B-FDE56A3BEBA0}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\coil\coil.exe |

"{93D10C4F-5C32-4827-BB69-793C88631D77}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |

"{93FAEC2B-4928-434C-94AC-6A54CB85F007}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\spacewar\steamworksexample.exe |

"{A1A7EF43-502A-4720-9448-EDD496860BBE}" = dir=in | app=c:\program files (x86)\windows live\messenger\livecall.exe |

"{A4B5BFD0-1761-44FD-B2F4-B16A399636FD}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\between - demo\between.exe |

"{AA4BA9C8-A1D7-43ED-9E7B-5E05A0082A89}" = protocol=6 | dir=in | app=c:\program files (x86)\ventrilo\ventrilo.exe |

"{AC86F20F-ED64-4AC7-A8FF-F8A64D6D7971}" = protocol=6 | dir=in | app=c:\program files (x86)\lucasarts\star wars empire at war\gamedata\sweaw.exe |

"{AED685F0-0205-4CE8-BC73-E0050C24C09F}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |

"{AEF38BB3-A866-4B67-A2DD-06AC802E53A1}" = protocol=17 | dir=in | app=c:\program files (x86)\samsung\samsung new pc studio\npsvsvr.exe |

"{B7A4F3A0-2288-4DD6-88B2-9C7F67E5EA33}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\alien swarm\swarm.exe |

"{B7D2497F-9946-4EE3-B9B4-276A9ED007E7}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |

"{BB30EF3E-789C-4C40-B98D-990FDBA2F359}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\alien swarm\swarm.exe |

"{BF1503F1-96D7-4691-AC51-98D0EDB21273}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\moon base alpha\binaries\win32\moonbasealphagame.exe |

"{BF337A96-39D9-4F24-89C6-7F6F68AE98FD}" = protocol=6 | dir=in | app=c:\program files (x86)\samsung\samsung new pc studio\npsvsvr.exe |

"{C192777F-6BB1-46C4-8316-64FB2A855EF5}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |

"{C33F8701-EB69-4603-8B0A-D822F17FA2A9}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\trackmania nations forever\tmforeverlauncher.exe |

"{C42B3AD4-EB2C-4689-8BBA-61E77D68CAD9}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |

"{C5418618-6915-42E8-8871-B6B6D7158B76}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |

"{C59911EE-25A4-4FE6-A925-A78ACBB0DB4A}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |

"{C8CBFE82-EAAB-4E37-A63F-1BADC5C892E5}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |

"{CEBB5331-59B2-455C-9558-D9643DF2A873}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sixense truemotion sdk\sixensesteamlauncher.exe |

"{D171CCE9-8AA5-4527-8E21-51F96E9D8D83}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.1.1.9835-to-3.1.2.9901-enus-downloader.exe |

"{D8B98FED-4C29-4DBF-8991-D76BF4A8C6BC}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\r.u.s.e. beta\ruse.exe |

"{DA62A525-B41F-49C0-973E-484CF6D5F4DE}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\peggle extreme\peggleextreme.exe |

"{DDAA4CE5-1371-49D2-8FB2-1B7EBD2F61DB}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\james cameron's avatar - the game\bin\avatar.exe |

"{E4A7331D-1158-47F1-A70A-191B4709EC4B}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |

"{E4E07870-8AEF-4FFC-9839-3A9D226CFB8D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\peggle extreme\peggleextreme.exe |

"{E501132F-2588-4D34-ABAD-DABCF5719E77}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |

"{E7BA5B2A-CD37-4869-9FE9-EDA3A2407233}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\america's army 3\binaries\aa3game.exe |

"{E920890F-5F5C-447F-8010-7EECF0FF185A}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |

"{EAD681BE-BF1C-41CB-86F7-8DAA31FC85D4}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.8.9506-to-3.0.9.9551-enus-downloader.exe |

"{EDC7AC10-0B60-4545-8126-5F1CFFEAAA58}" = protocol=6 | dir=in | app=c:\program files (x86)\logitech touch mouse server\itouch-server-win.exe |

"{EE9DB89E-8157-45CB-8986-5CA33769CEA8}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |

"{EEA5D5A8-439D-4D1E-95C8-F467D8CB1E50}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\coil\coil.exe |

"{F1088DAB-7577-4F59-8815-CEFE057690CC}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\spacewar\steamworksexample.exe |

"{F3A6D70B-7A5A-4E94-AE56-0AAFC9359DDC}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\trackmania nations forever\tmforeverlauncher.exe |

"{F59C9C8B-AEE5-4014-87D3-51C2569721FF}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\wow-3.1.3.9947-to-3.2.0.10192-enus-downloader.exe |

"{F818C7A1-B998-4C8F-A7F3-9E7F2AD93435}" = protocol=17 | dir=in | app=c:\program files (x86)\samsung\samsung new pc studio\npsasvr.exe |

"{FEA824AD-69E8-4FF1-A386-FD8A4C9D2F8D}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |

"TCP Query User{0B7888CF-A8FE-4045-89F3-79A27AE0F4FF}C:\program files (x86)\steam\steamapps\common\america's army 3\binaries\aa3game.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\america's army 3\binaries\aa3game.exe |

"TCP Query User{1B892C35-5300-4215-95B3-65F2B83CE255}C:\program files (x86)\usarmy\america's army 2\system\armyops.exe" = protocol=6 | dir=in | app=c:\program files (x86)\usarmy\america's army 2\system\armyops.exe |

"TCP Query User{1ED14ED0-B296-43CB-9935-3D5F613428ED}C:\program files (x86)\xfire\xfire.exe" = protocol=6 | dir=in | app=c:\program files (x86)\xfire\xfire.exe |

"TCP Query User{31F2AED0-3C8F-4CE5-9CFD-99C03A8DE020}C:\program files (x86)\microsoft office\office14\groove.exe" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |

"TCP Query User{34CFDA31-650E-457D-B99A-081CD3046B95}C:\program files (x86)\starwarsgalaxies\testcenter\swgvoiceservice.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starwarsgalaxies\testcenter\swgvoiceservice.exe |

"TCP Query User{3FC90E3A-E0E7-4F48-98B0-A0A07C651E1A}C:\program files (x86)\realvnc\vnc4\winvnc4.exe" = protocol=6 | dir=in | app=c:\program files (x86)\realvnc\vnc4\winvnc4.exe |

"TCP Query User{4296E358-2623-4C45-8248-A06F3DD7DEA8}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |

"TCP Query User{4F239A96-C0D0-40DC-BE39-4561C14DB3B4}C:\users\public\games\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |

"TCP Query User{65AA50DD-05E3-4074-AAF3-C92FA11B2791}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |

"TCP Query User{6723EB8A-E783-44DD-8D9F-15631BDE00B1}C:\program files (x86)\udk\udk-2010-09\binaries\win32\udk.exe" = protocol=6 | dir=in | app=c:\program files (x86)\udk\udk-2010-09\binaries\win32\udk.exe |

"TCP Query User{738C87FE-0724-4F4C-8710-CD628B77B97F}C:\program files (x86)\udk\udk-2010-09\binaries\win64\udk.exe" = protocol=6 | dir=in | app=c:\program files (x86)\udk\udk-2010-09\binaries\win64\udk.exe |

"TCP Query User{7A77DDD6-3F53-4B3D-A686-C5A43C19993A}C:\program files (x86)\firefly studios\stronghold 2\stronghold2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\firefly studios\stronghold 2\stronghold2.exe |

"TCP Query User{8213F7EB-7AB5-4BFA-B11D-62448D9A8F67}G:\usbwebserver v8_en\apache\bin\httpd_usbwv8.exe" = protocol=6 | dir=in | app=g:\usbwebserver v8_en\apache\bin\httpd_usbwv8.exe |

"TCP Query User{83E6AE17-496D-4D5C-AE18-24AF564D44EB}C:\program files (x86)\usarmy\america's army 2\system\armyops.exe" = protocol=6 | dir=in | app=c:\program files (x86)\usarmy\america's army 2\system\armyops.exe |

"TCP Query User{84CB7B08-323F-4B55-9575-4DBF79134DD3}C:\program files (x86)\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\eadm\core.exe |

"TCP Query User{88AC6570-435D-48CA-AFB2-734B3757AA09}C:\program files (x86)\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |

"TCP Query User{9280A441-B13A-4E55-89D8-2A55BA177E6A}C:\program files (x86)\xfire\xfire.exe" = protocol=6 | dir=in | app=c:\program files (x86)\xfire\xfire.exe |

"TCP Query User{98FFB572-A682-4FCB-8C94-EF1F6A713A10}C:\program files (x86)\logitech touch mouse server\itouch-server-win.exe" = protocol=6 | dir=in | app=c:\program files (x86)\logitech touch mouse server\itouch-server-win.exe |

"TCP Query User{A2250807-B171-42D6-9316-531EAC42D6BE}G:\usbwebserver v8_en\mysql\bin\mysqld_usbwv8.exe" = protocol=6 | dir=in | app=g:\usbwebserver v8_en\mysql\bin\mysqld_usbwv8.exe |

"TCP Query User{BC2D422D-46CE-49C1-9506-FC54D197E451}C:\program files (x86)\starwarsgalaxies\swgvoiceservice.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starwarsgalaxies\swgvoiceservice.exe |

"TCP Query User{C9910FA8-78BB-471B-B8EB-C7F9FAACC9C9}C:\program files (x86)\electronic arts\medal of honor\allied assault\mohaa.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\medal of honor\allied assault\mohaa.exe |

"TCP Query User{D035E740-63C3-4923-A73D-F449D6EA37AD}C:\program files (x86)\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\eadm\core.exe |

"TCP Query User{D3E96E60-F44F-4B2C-8D76-F433BB080036}C:\program files (x86)\realvnc\vnc4\winvnc4.exe" = protocol=6 | dir=in | app=c:\program files (x86)\realvnc\vnc4\winvnc4.exe |

"TCP Query User{E2FE2B3D-1D5B-450D-9E8A-289C6F9291BD}C:\program files (x86)\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |

"TCP Query User{EF808E02-FEC6-40F6-BEB8-DD661584304B}C:\program files (x86)\byond\bin\byond.exe" = protocol=6 | dir=in | app=c:\program files (x86)\byond\bin\byond.exe |

"TCP Query User{FC6E290F-5DD7-4583-9AA2-B231F2C0B102}C:\program files (x86)\starwarsgalaxies\testcenter\swgvoiceservice.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starwarsgalaxies\testcenter\swgvoiceservice.exe |

"UDP Query User{03E4CD69-2640-4C90-998D-1841C20ADDE9}C:\program files (x86)\starwarsgalaxies\swgvoiceservice.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starwarsgalaxies\swgvoiceservice.exe |

"UDP Query User{07EED931-D306-437B-8542-D221316D2799}C:\program files (x86)\usarmy\america's army 2\system\armyops.exe" = protocol=17 | dir=in | app=c:\program files (x86)\usarmy\america's army 2\system\armyops.exe |

"UDP Query User{257535A7-0C75-467D-9812-412C0A73981D}C:\program files (x86)\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\eadm\core.exe |

"UDP Query User{2DB1F496-10A9-4147-B100-AF5BDDB384FE}C:\program files (x86)\itunes\itunes.exe" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |

"UDP Query User{2F311E6E-1241-48CE-9125-82529D474FFD}C:\program files (x86)\electronic arts\medal of honor\allied assault\mohaa.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\medal of honor\allied assault\mohaa.exe |

"UDP Query User{3EB7C8D2-5C12-4A17-899F-13EA5B3C8F4B}C:\program files (x86)\firefly studios\stronghold 2\stronghold2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\firefly studios\stronghold 2\stronghold2.exe |

"UDP Query User{42EA88DC-B596-41B6-AA66-37680675A92F}C:\program files (x86)\udk\udk-2010-09\binaries\win64\udk.exe" = protocol=17 | dir=in | app=c:\program files (x86)\udk\udk-2010-09\binaries\win64\udk.exe |

"UDP Query User{4B457F72-FB3E-4A59-8342-94C6E21D2D03}C:\program files (x86)\starwarsgalaxies\testcenter\swgvoiceservice.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starwarsgalaxies\testcenter\swgvoiceservice.exe |

"UDP Query User{513C0195-E2B1-4AB0-BA2D-13663F7F87D7}C:\program files (x86)\usarmy\america's army 2\system\armyops.exe" = protocol=17 | dir=in | app=c:\program files (x86)\usarmy\america's army 2\system\armyops.exe |

"UDP Query User{5D111AC9-8DBF-4147-9EB3-F02EA7A407DA}C:\program files (x86)\starwarsgalaxies\testcenter\swgvoiceservice.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starwarsgalaxies\testcenter\swgvoiceservice.exe |

"UDP Query User{77D79E85-04C9-45F9-811F-DE8B9706DEE2}C:\program files (x86)\itunes\itunes.exe" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |

"UDP Query User{87CA14A2-E8D9-4FBA-A0D1-7AE5FA336045}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |

"UDP Query User{952BD18E-ECAF-4BFE-8002-70CA5DC684AA}C:\program files (x86)\udk\udk-2010-09\binaries\win32\udk.exe" = protocol=17 | dir=in | app=c:\program files (x86)\udk\udk-2010-09\binaries\win32\udk.exe |

"UDP Query User{A0A14862-7DDB-41A4-B22B-83ABFBBF421E}C:\program files (x86)\realvnc\vnc4\winvnc4.exe" = protocol=17 | dir=in | app=c:\program files (x86)\realvnc\vnc4\winvnc4.exe |

"UDP Query User{A76438C4-BADC-4064-85F0-50DF4E336400}C:\program files (x86)\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\eadm\core.exe |

"UDP Query User{B4CBE381-B0E8-44D4-816A-3F938749A062}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |

"UDP Query User{B6977414-86EB-4608-8863-15F462E36ADB}C:\program files (x86)\byond\bin\byond.exe" = protocol=17 | dir=in | app=c:\program files (x86)\byond\bin\byond.exe |

"UDP Query User{BA0283BC-9C9A-4AFB-8F12-4084F004D32E}G:\usbwebserver v8_en\mysql\bin\mysqld_usbwv8.exe" = protocol=17 | dir=in | app=g:\usbwebserver v8_en\mysql\bin\mysqld_usbwv8.exe |

"UDP Query User{C3EDBDDA-B35C-49B8-8968-7BFF6DBC3D8B}C:\program files (x86)\xfire\xfire.exe" = protocol=17 | dir=in | app=c:\program files (x86)\xfire\xfire.exe |

"UDP Query User{C5140E9B-FB50-4433-9342-DD24891D1BBA}C:\program files (x86)\xfire\xfire.exe" = protocol=17 | dir=in | app=c:\program files (x86)\xfire\xfire.exe |

"UDP Query User{C62C0A0D-40AC-4E54-8DEC-71D6538071E6}G:\usbwebserver v8_en\apache\bin\httpd_usbwv8.exe" = protocol=17 | dir=in | app=g:\usbwebserver v8_en\apache\bin\httpd_usbwv8.exe |

"UDP Query User{C976D0F0-B043-469E-AAF3-0788F6ECA2FD}C:\program files (x86)\logitech touch mouse server\itouch-server-win.exe" = protocol=17 | dir=in | app=c:\program files (x86)\logitech touch mouse server\itouch-server-win.exe |

"UDP Query User{D9C037C5-7348-4526-8361-2E479014A26E}C:\users\public\games\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |

"UDP Query User{DA07F84D-6EDF-46A7-B219-D4ED9124B623}C:\program files (x86)\realvnc\vnc4\winvnc4.exe" = protocol=17 | dir=in | app=c:\program files (x86)\realvnc\vnc4\winvnc4.exe |

"UDP Query User{E6D5190B-969B-4CF3-94D9-BB931ACB5F3A}C:\program files (x86)\microsoft office\office14\groove.exe" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |

"UDP Query User{F02ECD62-14CF-4651-B3E0-92CA15694A4D}C:\program files (x86)\steam\steamapps\common\america's army 3\binaries\aa3game.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\america's army 3\binaries\aa3game.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{167F938F-5AD3-40e2-B05D-2B7C6F0FDE48}" = HP Deskjet D1500 Printer Driver 10.0 Rel .3

"{1686C4D1-B1FD-42E8-B7A8-FB4C4DBA5BA8}" = ASUS Power4Gear eXtreme

"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant

"{20140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010 (Beta)

"{20140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010 (Beta)

"{20140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Beta)

"{33EB1061-ABF1-4470-A540-32E97A610536}" = Apple Mobile Device Support

"{52A7C6A6-6B88-47D1-922E-9F8A7E089E6A}" = Intel® PROSet/Wireless WiFi Software

"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector

"{5F02C14D-A630-4771-8409-0BA89FCCA8D6}" = iTunes

"{70E8EBD5-78C9-4258-B20A-5098CCA000F0}" = Dolby Control Center

"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended

"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007

"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007

"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007

"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

"{B7588D45-AFDC-4C93-9E2E-A100F3554B64}" = Microsoft Fix it Center

"{B91110FB-33B4-468B-90C2-4D5E8AE3FAE1}" = Bonjour

"{BCA26999-EC22-3007-BB79-638913079C9A}" = Microsoft Visual Studio 2010 Express Prerequisites x64 - ENU

"{C98BBC25-490C-4F3F-81D8-5D12C11732DF}" = Panda Cloud Antivirus

"{c9920352-04e6-469d-bab8-e2b9c7c75415}.sdb" = Microsoft Automated Troubleshooting Services Shim

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}" = Microsoft SQL Server Compact 3.5 SP2 x64 ENU

"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"{FCADA26A-5672-31DD-BF0E-BA76ECF9B02D}" = Microsoft Help Viewer 1.0

"BC15EA930074932BB2C4B4493C9FD4EA95087D1A" = Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0)

"Defraggler" = Defraggler

"EPSON NX510 Series" = EPSON NX510 Series Printer Uninstall

"EPSON Printer and Utilities" = EPSON Printer Software

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended

"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0

"NVIDIA Display Control Panel" = NVIDIA Display Control Panel

"NVIDIA Drivers" = NVIDIA Drivers

"ProInst" = Intel PROSet Wireless

"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software

"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software

"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software

"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"UDK-bd663daf-5b07-44ea-87e9-7d65166f20c2" = Unreal Development Kit: 2010-09

"USB 2.0 1.3M UVC WebCam" = USB 2.0 1.3M UVC WebCam

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology

"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer

"{0DEA94ED-915A-4834-A87E-388D012C8E02}" = Medal of Honor Allied Assault

"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software 1.14.17.1

"{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox

"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up

"{139B0FFA-187E-4BA1-BCA6-6B56B2B6AB8C}" = ATK Media

"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works

"{1A59064A-12A9-469F-99F6-04BF118DBCFF}" = Kaspersky PURE

"{1C8521E5-5A7B-4A4E-A9CD-AD53116EAEE0}" = ASUS Data Security Manager

"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3

"{1E99F5D7-4262-4C7C-9135-F066E7485811}" = System Requirements Lab

"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update

"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions

"{20140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010 (Beta)

"{20140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010 (Beta)

"{20140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010 (Beta)

"{20140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010 (Beta)

"{20140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010 (Beta)

"{20140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010 (Beta)

"{20140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010 (Beta)

"{20140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010 (Beta)

"{20140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010 (Beta)

"{20140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010 (Beta)

"{20140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010 (Beta)

"{20140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010 (Beta)

"{20140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010 (Beta)

"{20140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010 (Beta)

"{20140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010 (Beta)

"{20140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010 (Beta)

"{20140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010 (Beta)

"{20140000-011A-0000-0000-0000000FF1CE}" = Microsoft Office Send-a-Smile

"{20c31435-2a0a-4580-be8b-ac06fc243ca4}" = Python 2.7

"{2447500B-22D7-47BD-9B13-1A927F43A267}" = Empire Earth

"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java 6 Update 18

"{2862A3C1-0CD9-4D8B-A28C-8C337D4DD5EB}" = Express Gate

"{2EEC2A94-7204-45C6-93BB-67EAEB19E4D6}" = Safari

"{305468A6-DE2D-43ba-A168-2F45A97A89DA}" = DJ_SF_03_D1500_Software_Min

"{32343DB6-9A52-40C9-87E4-5E7C79791C87}" = MSXML 4.0 SP2 and SOAP Toolkit 3.0

"{326957C7-83FD-4550-A59A-849B7B4297DE}" = Microsoft Easy Assist v2

"{3A9FC03D-C685-4831-94CF-4EDFD3749497}" = Microsoft SQL Server Compact 3.5 SP2 ENU

"{3B05F2FB-745B-4012-ADF2-439F36B2E70B}" = ATKOSD2

"{40580068-9B10-40B5-9548-536CE88AB23C}" = ITECIR

"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go

"{41785C66-90F2-40CE-8CB5-1C94BFC97280}" = Microsoft Chart Controls for Microsoft .NET Framework 3.5

"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth

"{46F8CF66-AB83-38A7-99B2-A5BE507EE472}" = Microsoft Visual C++ 2010 Express - ENU

"{48F22622-1CC2-4A83-9C1E-644DD96F832D}" = Epson Event Manager

"{49668BEE-D721-449C-82D3-C7561945F706}" = Station Launcher

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform

"{5A9FE525-8B8F-4701-A937-7F6745A4E9C7}" = RGSS-RTP Standard

"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI

"{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}" = NB Probe

"{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon

"{64F8B9AF-983F-48CE-ABBB-F62BEC02C5A0}" = System Requirements Lab

"{65761BAE-11E8-48FE-B30F-1F01011AB906}" = The Sims

[117]

My AV kept blocking Rootkit Unhooker saying it was installing malicious drivers.

[Elise]

Hi, no problem, Rootkit Unhooker will not run on a 64 bit system anyway.

Looks like there is some hard disk trouble here. Lets first concentrate on that.

Click Start > Programs > Accessories, right click on Command Prompt and select "run as administrator".

Type chkdsk /r and press enter. Type Y and press enter to schedule the disk check for next reboot.

Restart your computer and let the checkdisk run unhindered. Note - this may take a while.

When done, let me know how things are running.

[Elise]

Hi, are you still there?

[117]

Yeah, sorry, i've had a very busy week with lots of homework and all...

I tried using chkdsk /r with admin privileges , but it loaded windows normally, so am i doing anything wrong?

[Elise]

Did all other steps work? I.e. you got a confirmation that the scan would be scheduled for next startup?

[117]

Did all other steps work? I.e. you got a confirmation that the scan would be scheduled for next startup?

Yes, it did say that.

But, I think I found the cause of the BSoD, Every time I run a Kaspersky Full Scan it crashes.

What do I do now?

[Elise]

That can sometimes happen. What webroot software do you use? It is possible two security products fight each other for control and cause a BSOD.

UPDATE JAVA

------------------

Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

• Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  
• Look for "JDK 6 Update 22 (JDK or JRE)".
  
• Click the "Download JRE" button to the right.
  
• Select your Platform: "Windows".
  
• Select your Language: "Multi-language".
  
• Read the License Agreement, and then check the box that says: "Accept License Agreement".
  
• Click Continue and the page will refresh.
  
• Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
  
• Close any programs you may have running - especially your web browser.
  

Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.

• Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  
• Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  
• Repeat as many times as necessary to remove each Java versions.
  
• Reboot your computer once all Java components are removed.
  
• Then from your desktop double-click on jre-6u21-windows-i586.exe to install the newest version.
  
• If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
  
• When the Java Setup - Welcome window opens, click the Install > button.
  
• If offered to install a Toolbar, just uncheck the box before continuing unless you want it.
  

-- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.

-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.

Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.

[117]

Webroot Spysweeper

[Elise]

Uninstall that and see if kaspersky still crashes afterwards.

[117]

Uninstall that and see if kaspersky still crashes afterwards.

Actually, are there any alternatives to Kaspersky that use less resources, but work as well?

[Elise]

Yes, you can either try Avast or Avira. Both are free Antivirus applications and have a good detection rate. Best is to test them out for yourself to see which one suits you best.

Please let me know if you have any problem left.

[117]

I uninstalled Kaspersky and installed avast, and my computer is now working perfectly,

Thank you so much

[Elise]

I'm glad to hear that.

Please let me know if you have any other questions or if this topic can be closed.

[LDTate]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.