Anti-virus Solution Pro - MBAM not detecting it(!)

View previous topic View next topic Go down

Anti-virus Solution Pro - MBAM not detecting it(!)

Post by yekkers on Thu 05 Aug 2010, 11:14 pm

Not sure what to think. My comp just recently got infected with Anti-Virus Solution Pro a couple days ago. I used System Restore and then ran Malware-Bytes Anti-Malware... but it didn't detect anything malicious. Soon after that, Anti-Virus Solution popped up in my lower icon tray. I think perhaps it's timed to come on or something. Much help is appreciated.

yekkers

Newbie Surfer
Newbie Surfer

Posts : 48
Joined : 2010-05-01

View user profile

Back to top Go down

Re: Anti-virus Solution Pro - MBAM not detecting it(!)

Post by Belahzur on Fri 06 Aug 2010, 7:37 am

Hello.

Download OTL by OldTimer to your Desktop.

  • Close all windows and double click OTL.exe
  • Click Run Scan and let the program run uninterrupted
  • It will produce two logs for you, one will pop up - OTL.txt, the other will be saved on your Desktop - Extras.txt. Post both logs in this thread.
  • You may need to use two posts to get it all.


@RealBelahzur - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur

Manager | Tech Officer
Manager | Tech Officer

Posts : 34917
Joined : 2008-08-04
Operating System : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Anti-virus Solution Pro - MBAM not detecting it(!)

Post by yekkers on Fri 06 Aug 2010, 8:43 am

Hey Belahzur,

This is the OTL.txt log.

OTL logfile created on: 05/08/2010 22:35:21 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Lou\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 59.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 137.57 Gb Total Space | 70.39 Gb Free Space | 51.16% Space Free | Partition Type: NTFS
Drive D: | 11.48 Gb Total Space | 2.08 Gb Free Space | 18.14% Space Free | Partition Type: NTFS
Drive E: | 7.73 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: LOU-PC
Current User Name: Lou
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/08/05 21:50:12 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Lou\Desktop\OTL.exe
PRC - [2010/01/26 18:46:50 | 002,633,976 | ---- | M] (Veoh Networks) -- C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
PRC - [2010/01/15 13:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2009/08/18 11:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2009/08/18 11:29:22 | 000,183,152 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2009/05/19 12:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2009/05/12 23:45:27 | 000,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2009/04/11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/04/11 07:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2009/03/29 22:59:31 | 000,039,408 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2009/02/26 15:24:50 | 000,097,680 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
PRC - [2008/02/21 23:02:53 | 000,238,968 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2008/01/19 08:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2008/01/04 13:27:08 | 000,587,096 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
PRC - [2007/10/04 00:45:02 | 000,358,936 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2007/10/04 00:44:58 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2007/06/07 16:19:40 | 000,202,280 | R--- | M] (SupportSoft, Inc.) -- C:\Program Files\O2\bin\sprtsvc.exe


========== Modules (SafeList) ==========

MOD - [2010/08/05 21:50:12 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Lou\Desktop\OTL.exe
MOD - [2009/04/11 07:21:38 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll
MOD - [2008/01/19 08:33:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - [2010/03/18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/01/15 13:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009/09/25 02:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009/08/18 11:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009/08/05 23:48:42 | 000,704,864 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2009/05/19 12:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2008/08/04 11:20:16 | 003,220,856 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE -- (LiveUpdate)
SRV - [2008/02/21 23:02:53 | 000,238,968 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe -- (Automatic LiveUpdate Scheduler)
SRV - [2008/01/19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008/01/04 13:27:08 | 000,587,096 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe -- (aawservice)
SRV - [2007/10/04 00:45:02 | 000,358,936 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2007/07/27 05:39:32 | 000,382,320 | ---- | M] (SupportSoft, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe -- (SupportSoft RemoteAssist)
SRV - [2007/06/07 16:19:40 | 000,202,280 | R--- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\O2\bin\sprtsvc.exe -- (sprtsvc_O2) SupportSoft Sprocket Service (O2)
SRV - [2007/03/05 19:30:06 | 000,110,592 | ---- | M] (Hewlett-Packard Development Company, L.P.) [On_Demand | Stopped] -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe -- (Com4Qlb)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\SymIM.sys -- (SymIMMP)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2009/08/05 23:48:42 | 000,054,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fssfltr.sys -- (fssfltr)
DRV - [2008/07/29 13:45:00 | 000,904,192 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athrusb.sys -- (athrusb)
DRV - [2008/07/22 08:42:58 | 000,051,200 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2008/02/27 06:26:04 | 000,201,728 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)
DRV - [2008/02/11 20:36:10 | 002,302,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx)
DRV - [2008/02/11 20:36:10 | 002,302,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\igdkmd32.sys -- (ialm)
DRV - [2007/11/01 09:51:26 | 000,985,600 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DPV.sys -- (HSF_DPV)
DRV - [2007/11/01 09:47:54 | 000,208,896 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWAZL.sys -- (HSXHWAZL)
DRV - [2007/11/01 09:47:08 | 000,661,504 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_CNXT.sys -- (winachsf)
DRV - [2007/10/29 11:38:38 | 000,162,088 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2007/10/18 07:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/10/11 12:17:56 | 000,176,640 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CHDART.sys -- (HdAudAddService)
DRV - [2007/09/30 08:03:12 | 000,308,248 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\iaStor.sys -- (iaStor)
DRV - [2007/06/19 02:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV - [2007/05/31 00:40:42 | 000,735,232 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2006/11/02 10:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 10:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 10:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 10:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 10:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2006/11/02 10:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 10:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 10:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 10:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 10:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 10:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 10:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2006/11/02 10:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 10:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 10:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2006/11/02 10:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 10:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 10:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 10:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 10:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2006/11/02 10:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 10:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 10:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 10:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 10:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 10:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 10:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 10:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 10:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 10:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 10:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2006/11/02 10:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2006/11/02 10:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2006/11/02 09:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 09:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 09:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 09:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 09:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 09:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 08:41:49 | 000,200,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VSTAZL3.SYS -- (HSFHWAZL)
DRV - [2006/11/02 08:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 08:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2006/11/02 08:30:53 | 000,464,384 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BCMWL6.SYS -- (BCM43XV)
DRV - [2006/06/28 19:54:00 | 000,009,472 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CPQBttn.sys -- (HBtnKey)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = [You must be registered and logged in to see this link.]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B0 22 F5 1E E3 31 CB 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Bing"
FF - prefs.js..browser.search.defaulturl: "http://www.bing.com/search?FORM=IEFM1&q="
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "google.com"
FF - prefs.js..extensions.enabledItems: [You must be registered and logged in to see this link.]:1.5.2
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100119091315
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100503
FF - prefs.js..keyword.URL: "http://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZJfox000&fl=0&ptb=BjZGF2FMESTW56WkCqVBcQ&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&st=kwd&searchfor="

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009/05/12 23:45:47 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\m3ffxtbr@mywebsearch.com: C:\Program Files\MyWebSearch\bar\firefox\
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/24 10:46:14 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/26 11:09:53 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 6 6.2\Extensions\\Components: C:\Program Files\Netscape\Netscape 6\Components [2009/11/27 13:03:59 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 6 6.2\Extensions\\Plugins: C:\Program Files\Netscape\Netscape 6\Plugins [2009/11/27 13:03:59 | 000,000,000 | ---D | M]

[2008/09/10 14:16:46 | 000,000,000 | ---D | M] -- C:\Users\Lou\AppData\Roaming\Mozilla\Extensions
[2010/08/05 13:12:20 | 000,000,000 | ---D | M] -- C:\Users\Lou\AppData\Roaming\Mozilla\Firefox\Profiles\i1isjn8p.default\extensions
[2010/05/13 10:24:34 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Lou\AppData\Roaming\Mozilla\Firefox\Profiles\i1isjn8p.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/03 09:39:54 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Lou\AppData\Roaming\Mozilla\Firefox\Profiles\i1isjn8p.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/05/13 10:24:34 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Lou\AppData\Roaming\Mozilla\Firefox\Profiles\i1isjn8p.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010/01/13 08:16:36 | 000,000,000 | ---D | M] -- C:\Users\Lou\AppData\Roaming\Mozilla\Firefox\Profiles\i1isjn8p.default\extensions\ChoiceGuard@Microsoft
[2010/02/17 02:26:42 | 000,000,000 | ---D | M] -- C:\Users\Lou\AppData\Roaming\Mozilla\Firefox\Profiles\i1isjn8p.default\extensions\searchrecs@veoh.com
[2010/01/11 12:09:41 | 000,002,171 | ---- | M] () -- C:\Users\Lou\AppData\Roaming\Mozilla\Firefox\Profiles\i1isjn8p.default\searchplugins\bing.xml
[2009/07/06 21:57:54 | 000,009,941 | ---- | M] () -- C:\Users\Lou\AppData\Roaming\Mozilla\Firefox\Profiles\i1isjn8p.default\searchplugins\mywebsearch.xml
[2010/03/23 00:36:20 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/06/25 16:49:27 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/06/25 16:49:27 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/06/25 16:49:27 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/06/25 16:49:27 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/05/03 10:59:25 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (AOL Toolbar Launcher) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [UCam_Menu] C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [VeohPlugin] C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks)
O4 - Startup: C:\Users\Lou\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &AOL Toolbar Search - c:\Program Files\AOL\AOL Toolbar 5.0\resources\en-GB\local\search.html ()
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: o2.co.uk ([*.broadband] http in Trusted sites)
O15 - HKCU\..Trusted Domains: o2.co.uk ([*.broadband] https in Trusted sites)
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} [You must be registered and logged in to see this link.] (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\Lou\Desktop\47053222prizpC_ph.jpg
O24 - Desktop BackupWallPaper: C:\Users\Lou\Desktop\47053222prizpC_ph.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/11/12 09:27:56 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2005/09/11 16:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ]
O33 - MountPoints2\{733838ce-7f0b-11df-bc94-001b38ea776b}\Shell\AutoRun\command - "" = F:\33r.exe -- File not found
O33 - MountPoints2\{733838ce-7f0b-11df-bc94-001b38ea776b}\Shell\open\Command - "" = F:\33r.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/08/05 21:50:04 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\Lou\Desktop\OTL.exe
[2010/07/24 10:48:00 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee Security Scan
[2010/07/24 10:48:00 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2010/07/24 10:47:59 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee Security Scan
[2010/07/23 01:55:34 | 000,066,048 | ---- | C] (Blog do Birungueta) -- C:\Users\Lou\AppData\Roaming\335128e3.exe
[2010/07/13 21:28:24 | 000,000,000 | ---D | C] -- C:\Users\Lou\Documents\Jobs
[2010/07/08 00:01:54 | 000,061,440 | ---- | C] (Gary's Hood) -- C:\Users\Lou\Desktop\rsclient.exe
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/08/05 22:35:20 | 004,718,592 | -HS- | M] () -- C:\Users\Lou\ntuser.dat
[2010/08/05 22:35:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/08/05 21:50:12 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Lou\Desktop\OTL.exe
[2010/08/05 21:13:00 | 000,000,414 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{A7F3F3D5-62F7-427C-B5D4-201B298E7C61}.job
[2010/08/05 21:12:00 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/08/05 18:55:23 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/08/05 18:55:23 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/08/05 17:36:00 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\At1.job
[2010/08/05 17:35:00 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/08/05 13:01:53 | 000,703,388 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/08/05 13:01:53 | 000,609,196 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/08/05 13:01:53 | 000,108,672 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/08/05 12:58:53 | 000,000,165 | ---- | M] () -- C:\Users\Public\Documents\hpqp.ini
[2010/08/05 12:55:27 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\At4.job
[2010/08/05 12:55:27 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/08/05 12:55:20 | 2137,022,464 | -HS- | M] () -- C:\hiberfil.sys
[2010/08/05 12:51:36 | 000,524,288 | -HS- | M] () -- C:\Users\Lou\ntuser.dat{c7a6e5ee-056a-11df-85ab-001b38ea776b}.TMContainer00000000000000000001.regtrans-ms
[2010/08/05 12:51:36 | 000,065,536 | -HS- | M] () -- C:\Users\Lou\ntuser.dat{c7a6e5ee-056a-11df-85ab-001b38ea776b}.TM.blf
[2010/08/04 17:12:10 | 000,005,972 | ---- | M] () -- C:\Users\Lou\AppData\Local\d3d9caps.dat
[2010/08/02 20:30:39 | 000,104,466 | ---- | M] () -- C:\Users\Lou\Documents\RuinTheory2.pdf
[2010/08/02 20:30:39 | 000,035,637 | ---- | M] () -- C:\Users\Lou\Documents\RuinTheory2.synctex.gz
[2010/08/02 20:30:39 | 000,000,907 | ---- | M] () -- C:\Users\Lou\Documents\RuinTheory2.aux
[2010/08/02 20:30:39 | 000,000,207 | ---- | M] () -- C:\Users\Lou\Documents\RuinTheory2.toc
[2010/08/02 20:30:38 | 000,011,802 | ---- | M] () -- C:\Users\Lou\Documents\RuinTheory2.tex
[2010/08/02 11:02:59 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\At3.job
[2010/08/01 23:23:59 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\At2.job
[2010/08/01 19:06:12 | 000,099,692 | ---- | M] () -- C:\Users\Lou\Documents\YuenGuoWu2001PoissonErlangProcesses.pdf
[2010/07/27 11:01:49 | 000,001,719 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2010/07/27 11:01:49 | 000,001,717 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2010/07/26 13:30:42 | 000,532,295 | ---- | M] () -- C:\Users\Lou\Documents\OnTheInverseOfSumOfMatrices.pdf
[2010/07/23 01:55:34 | 000,066,048 | ---- | M] (Blog do Birungueta) -- C:\Users\Lou\AppData\Roaming\335128e3.exe
[2010/07/16 18:52:42 | 000,036,201 | ---- | M] () -- C:\Users\Lou\Documents\tau.bib
[2010/07/16 18:30:05 | 000,001,314 | ---- | M] () -- C:\Users\Lou\Documents\ok_lets_test_again.bib
[2010/07/16 18:16:44 | 000,000,208 | ---- | M] () -- C:\Users\Lou\Documents\ok_lets_test.bib
[2010/07/16 18:03:13 | 000,000,390 | ---- | M] () -- C:\Users\Lou\Documents\RuinTheory2.blg
[2010/07/16 18:03:13 | 000,000,000 | ---- | M] () -- C:\Users\Lou\Documents\RuinTheory2.bbl
[2010/07/16 15:54:55 | 000,040,325 | ---- | M] () -- C:\Users\Lou\Documents\RuinTheory.pdf
[2010/07/16 15:54:55 | 000,002,255 | ---- | M] () -- C:\Users\Lou\Documents\RuinTheory.synctex.gz
[2010/07/16 15:54:55 | 000,000,489 | ---- | M] () -- C:\Users\Lou\Documents\RuinTheory.tex
[2010/07/16 15:54:55 | 000,000,311 | ---- | M] () -- C:\Users\Lou\Documents\RuinTheory.aux
[2010/07/16 15:54:55 | 000,000,110 | ---- | M] () -- C:\Users\Lou\Documents\RuinTheory.toc
[2010/07/14 02:33:01 | 000,153,167 | ---- | M] () -- C:\Users\Lou\Documents\PresentationOnRuinTheoryandDividendProblem3.pdf
[2010/07/14 02:33:01 | 000,036,569 | ---- | M] () -- C:\Users\Lou\Documents\PresentationOnRuinTheoryandDividendProblem3.synctex.gz
[2010/07/14 02:33:01 | 000,011,397 | ---- | M] () -- C:\Users\Lou\Documents\PresentationOnRuinTheoryandDividendProblem3.tex
[2010/07/14 02:33:01 | 000,000,009 | ---- | M] () -- C:\Users\Lou\Documents\PresentationOnRuinTheoryandDividendProblem3.aux
[2010/07/13 22:05:48 | 000,072,192 | ---- | M] () -- C:\Users\Lou\Documents\CV-B.doc
[2010/07/13 16:30:48 | 000,031,327 | ---- | M] () -- C:\Users\Lou\Documents\SurplusProcessExampleDiagrams.jpg
[2010/07/11 23:17:34 | 000,139,562 | ---- | M] () -- C:\Users\Lou\Documents\PresentationOnRuinTheoryandDividendProblem2.pdf
[2010/07/11 23:17:34 | 000,031,945 | ---- | M] () -- C:\Users\Lou\Documents\PresentationOnRuinTheoryandDividendProblem2.synctex.gz
[2010/07/11 23:17:34 | 000,000,009 | ---- | M] () -- C:\Users\Lou\Documents\PresentationOnRuinTheoryandDividendProblem2.aux
[2010/07/11 23:17:33 | 000,010,294 | ---- | M] () -- C:\Users\Lou\Documents\PresentationOnRuinTheoryandDividendProblem2.tex
[2010/07/08 00:00:51 | 000,061,440 | ---- | M] (Gary's Hood) -- C:\Users\Lou\Desktop\rsclient.exe
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/08/05 12:55:19 | 2137,022,464 | -HS- | C] () -- C:\hiberfil.sys
[2010/08/01 19:06:12 | 000,099,692 | ---- | C] () -- C:\Users\Lou\Documents\YuenGuoWu2001PoissonErlangProcesses.pdf
[2010/07/26 13:30:42 | 000,532,295 | ---- | C] () -- C:\Users\Lou\Documents\OnTheInverseOfSumOfMatrices.pdf
[2010/07/24 10:48:00 | 000,001,719 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2010/07/24 10:48:00 | 000,001,717 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2010/07/16 19:47:45 | 000,035,637 | ---- | C] () -- C:\Users\Lou\Documents\RuinTheory2.synctex.gz
[2010/07/16 18:52:42 | 000,036,201 | ---- | C] () -- C:\Users\Lou\Documents\tau.bib
[2010/07/16 18:30:05 | 000,001,314 | ---- | C] () -- C:\Users\Lou\Documents\ok_lets_test_again.bib
[2010/07/16 18:03:13 | 000,000,390 | ---- | C] () -- C:\Users\Lou\Documents\RuinTheory2.blg
[2010/07/16 18:03:13 | 000,000,000 | ---- | C] () -- C:\Users\Lou\Documents\RuinTheory2.bbl
[2010/07/16 18:00:53 | 000,000,208 | ---- | C] () -- C:\Users\Lou\Documents\ok_lets_test.bib
[2010/07/16 15:55:44 | 000,104,466 | ---- | C] () -- C:\Users\Lou\Documents\RuinTheory2.pdf
[2010/07/16 15:55:44 | 000,000,907 | ---- | C] () -- C:\Users\Lou\Documents\RuinTheory2.aux
[2010/07/16 15:55:44 | 000,000,207 | ---- | C] () -- C:\Users\Lou\Documents\RuinTheory2.toc
[2010/07/16 15:55:43 | 000,011,802 | ---- | C] () -- C:\Users\Lou\Documents\RuinTheory2.tex
[2010/07/16 15:53:24 | 000,002,255 | ---- | C] () -- C:\Users\Lou\Documents\RuinTheory.synctex.gz
[2010/07/12 13:42:30 | 000,153,167 | ---- | C] () -- C:\Users\Lou\Documents\PresentationOnRuinTheoryandDividendProblem3.pdf
[2010/07/12 13:42:30 | 000,000,009 | ---- | C] () -- C:\Users\Lou\Documents\PresentationOnRuinTheoryandDividendProblem3.aux
[2010/07/12 13:42:29 | 000,036,569 | ---- | C] () -- C:\Users\Lou\Documents\PresentationOnRuinTheoryandDividendProblem3.synctex.gz
[2010/07/12 01:50:15 | 000,011,397 | ---- | C] () -- C:\Users\Lou\Documents\PresentationOnRuinTheoryandDividendProblem3.tex
[2010/07/10 20:47:35 | 000,031,327 | ---- | C] () -- C:\Users\Lou\Documents\SurplusProcessExampleDiagrams.jpg
[2010/07/08 01:39:36 | 000,139,562 | ---- | C] () -- C:\Users\Lou\Documents\PresentationOnRuinTheoryandDividendProblem2.pdf
[2010/07/08 01:39:36 | 000,031,945 | ---- | C] () -- C:\Users\Lou\Documents\PresentationOnRuinTheoryandDividendProblem2.synctex.gz
[2010/07/08 01:39:36 | 000,000,009 | ---- | C] () -- C:\Users\Lou\Documents\PresentationOnRuinTheoryandDividendProblem2.aux
[2010/07/08 01:39:35 | 000,010,294 | ---- | C] () -- C:\Users\Lou\Documents\PresentationOnRuinTheoryandDividendProblem2.tex
[2010/05/02 01:07:21 | 000,000,028 | ---- | C] () -- C:\Windows\pdf995.ini
[2009/09/22 22:39:45 | 000,000,145 | ---- | C] () -- C:\Windows\BRVIDEO.INI
[2009/09/22 22:39:45 | 000,000,023 | ---- | C] () -- C:\Windows\Brownie.ini
[2009/09/22 22:39:45 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini
[2009/09/22 22:39:38 | 000,008,981 | ---- | C] () -- C:\Windows\HL-2030.INI
[2009/09/22 22:39:38 | 000,000,114 | ---- | C] () -- C:\Windows\System32\brlmw03a.ini
[2009/09/22 22:38:42 | 000,000,426 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2009/09/12 09:27:36 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/07/13 16:01:11 | 000,051,716 | ---- | C] () -- C:\Windows\System32\pdf995mon.dll
[2009/07/13 16:01:11 | 000,000,060 | ---- | C] () -- C:\Windows\wpd99.drv
[2009/07/13 15:47:56 | 000,176,235 | ---- | C] () -- C:\Windows\System32\Primomonnt.dll
[2009/05/12 23:47:57 | 000,000,025 | ---- | C] () -- C:\Windows\cdplayer.ini
[2009/01/19 12:06:37 | 000,000,030 | ---- | C] () -- C:\Windows\Q3version.ini
[2009/01/19 12:06:18 | 000,000,939 | ---- | C] () -- C:\Windows\Qiii.INI
[2008/07/24 13:14:28 | 000,000,728 | ---- | C] () -- C:\Windows\{4507868A-A9CD-4ECC-BD54-0EAB6EE81D42}_WiseFW.ini
[2008/07/23 17:50:52 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008/07/23 17:46:38 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll
[2008/06/10 23:56:03 | 000,408,576 | ---- | C] () -- C:\Windows\System32\Smab.dll
[2008/06/10 23:56:02 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2008/06/10 23:55:34 | 000,027,648 | -HS- | C] () -- C:\Windows\System32\Smab0.dll
[2008/06/10 23:03:52 | 003,345,408 | ---- | C] () -- C:\Windows\System32\avcodec-51.dll
[2008/06/10 23:03:52 | 000,448,512 | ---- | C] () -- C:\Windows\System32\avformat-50.dll
[2008/06/10 23:03:52 | 000,019,968 | ---- | C] () -- C:\Windows\System32\avutil-49.dll
[2008/02/11 20:55:18 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1437.dll
[2008/01/16 11:34:53 | 000,155,648 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll
[2008/01/02 16:57:36 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1409.dll
[2008/01/02 16:47:22 | 001,953,696 | ---- | C] () -- C:\Windows\System32\igklg400.dll
[2008/01/02 16:47:22 | 001,533,360 | ---- | C] () -- C:\Windows\System32\igklg450.dll
[2008/01/02 16:47:22 | 000,104,636 | ---- | C] () -- C:\Windows\System32\igmedcompkrn.dll
[2007/08/20 13:34:08 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1318.dll
[2007/08/20 13:25:00 | 000,910,720 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll
[2006/11/02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

========== Alternate Data Streams ==========

@Alternate Data Stream - 487 bytes -> C:\ProgramData\TEMP:05EE1EEF
< End of report >

yekkers

Newbie Surfer
Newbie Surfer

Posts : 48
Joined : 2010-05-01

View user profile

Back to top Go down

Re: Anti-virus Solution Pro - MBAM not detecting it(!)

Post by yekkers on Fri 06 Aug 2010, 8:46 am

And this is the Extras.Txt log.

OTL Extras logfile created on: 05/08/2010 22:35:21 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Lou\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 59.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 137.57 Gb Total Space | 70.39 Gb Free Space | 51.16% Space Free | Partition Type: NTFS
Drive D: | 11.48 Gb Total Space | 2.08 Gb Free Space | 18.14% Space Free | Partition Type: NTFS
Drive E: | 7.73 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: LOU-PC
Current User Name: Lou
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.exe [@ = exefile] -- Reg Error: Key error. File not found
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{024B8ED1-EF9A-4CB5-AD1E-42BC077A7187}" = rport=445 | protocol=6 | dir=out | app=system |
"{09C7C600-59FB-4DA4-AD80-5CBEE84E2C68}" = lport=138 | protocol=17 | dir=in | app=system |
"{10B95457-9D77-4970-9C8A-770BC98E5B7E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{20FA5693-FE6A-42CE-8C3A-5F281F34F1C3}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{4DE2B523-F523-4F5C-8FBE-104EF23F09AA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{5002D384-9C16-42C1-A43D-D66B66718C43}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{53953977-78A6-4DA4-8DE4-9FD8D6D9EE1B}" = lport=2869 | protocol=6 | dir=in | app=system |
"{62EE69AC-92DB-462B-8511-E81F4C8FF58D}" = lport=137 | protocol=17 | dir=in | app=system |
"{6716C858-74E7-4CB3-B61F-21044155A1A1}" = rport=137 | protocol=17 | dir=out | app=system |
"{6D6AB0E2-D0A9-4EC0-821A-66E0EA4B613F}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{7B491CCF-FD62-45BA-9F80-9D2C3CF512C5}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{8D6365F7-4E2F-4BA0-9BA1-B2C010C4FC9D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A7EF6E75-CF27-4164-AFF5-7D3EB4CF8971}" = lport=139 | protocol=6 | dir=in | app=system |
"{A9C8CE82-D728-49F3-A25E-BDFD41CE64C9}" = rport=138 | protocol=17 | dir=out | app=system |
"{AF465854-4C00-4BA8-A282-901700474A97}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{B2AB401C-BE00-4AB7-8094-B2A34B952E97}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{EE016140-0DA2-4F28-8A54-36CD71137F87}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{F1213E4D-8C65-43F4-8424-CA339CB1C6EB}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{F381E2BE-EF8C-4861-B77F-9EEE081E4524}" = lport=445 | protocol=6 | dir=in | app=system |
"{F565D36B-FD9D-4924-8629-989391CA685E}" = rport=139 | protocol=6 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1AB4DDE4-C2F6-49F6-95C6-F183774F29B5}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{21ABC2FD-7E61-4587-B5F6-B67550B578AB}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"{280E33EC-8C0D-465D-9D00-F96295BCC98E}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{2A6C48F8-9AFF-4ADD-AD41-8972C9BC939D}" = protocol=6 | dir=in | app=c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe |
"{31484121-A4E0-4134-B6EB-D2FBE2AC6FAA}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{374FD8E9-D048-4523-975C-DDB9F5FA0BAF}" = protocol=17 | dir=in | app=c:\program files\common files\supportsoft\bin\ssrc.exe |
"{385B464F-812A-4A64-9747-FE687C3FF104}" = protocol=17 | dir=in | app=c:\program files\o2\agent\bin\bcont_nm.exe |
"{42226D7E-5630-4918-B8FA-72C9F3F0F292}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{45168833-D196-4D2D-A55F-183C5A047A5B}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
"{495035A2-EB3D-4246-BCDB-1227DA234CE0}" = protocol=6 | dir=in | app=c:\program files\wolfram research\mathematica\7.0\math.exe |
"{4BB9A151-3941-4E8D-BC4F-79BCEAF0CDA1}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{4E4D8AE5-9C64-43E7-A515-394452D3D51E}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{503D3A1B-0411-4BF1-A7AA-D7F779895216}" = protocol=17 | dir=in | app=c:\program files\o2\bin\wificfg.exe |
"{511CDFEE-D1BA-46B7-B4C5-E8F0FFA3AD73}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{5DDCAE1E-17B8-4D12-85EB-144D0A714FAC}" = protocol=6 | dir=in | app=c:\program files\wolfram research\mathematica\7.0\mathkernel.exe |
"{5EE9A74E-63DE-4406-8B5E-1336CEC84D10}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{613E8549-ABC4-4610-9A67-69386DF97BE2}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{62D9B10A-42E7-4045-B689-10793FBB9F00}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{76178F65-8B88-40B2-98AA-46E1CB37863B}" = protocol=17 | dir=in | app=c:\program files\wolfram research\mathematica\7.0\mathkernel.exe |
"{7EC8964C-5860-4329-863C-05B3CBDC6A3B}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{7FCA66D4-20FB-4BF2-BA1A-A78F513F513B}" = protocol=6 | dir=in | app=c:\program files\o2\agent\bin\bcont_nm.exe |
"{87285330-CA68-4EB0-B8EC-361E5974464D}" = dir=in | app=c:\program files\hp\quickplay\qp.exe |
"{8FCF7966-602B-4553-898F-2AEF382F57C9}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{A00B64A9-8202-4221-A15D-97E5D4A1A726}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A3233521-5B3F-4AFD-B469-131C57C90727}" = protocol=17 | dir=in | app=c:\program files\wolfram research\mathematica\7.0\math.exe |
"{A9CE2DB7-9D04-475D-874D-D7C7721E4FAA}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{ADA262AF-2E2A-4F1D-AAAA-203B342BAC59}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{B8389873-A71F-4FD8-BE00-E03E3DA8E7FE}" = protocol=17 | dir=in | app=c:\program files\wolfram research\mathematica\7.0\mathematica.exe |
"{B9308A53-2DAD-4A36-A3DA-464A352FEAE6}" = protocol=17 | dir=in | app=c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe |
"{C427F778-A1DC-4A66-BBED-A6F3E43B2F35}" = protocol=6 | dir=in | app=c:\program files\common files\supportsoft\bin\ssrc.exe |
"{D21C72EA-E8F8-4CE2-83BE-DB6B82FC7B6E}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{D33DCE6F-6F1E-45A3-A3C7-F59AA5EBA2EC}" = protocol=17 | dir=in | app=c:\program files\o2\agent\bin\bcont.exe |
"{E119E6F4-69EC-46CC-86D7-3F6D5E9811E5}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{EB3A06D8-8EE8-4943-A09B-C69D2D52F6B8}" = protocol=6 | dir=in | app=c:\program files\o2\bin\wificfg.exe |
"{F174CFFC-D96D-43BD-8CB1-23ED2BB5BA29}" = protocol=6 | dir=in | app=c:\program files\wolfram research\mathematica\7.0\mathematica.exe |
"{FA0028B2-8F7D-4539-8635-AFF9876B8AA1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{FB245AA7-F82B-4E06-A784-9A0B47EE7729}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{FD6579B1-DBC3-434D-A23D-692C8E6AEFBA}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"{FDD0ACE2-0771-49F1-881B-5B6E9B24D3A3}" = protocol=6 | dir=in | app=c:\program files\o2\agent\bin\bcont.exe |
"{FEDF294A-4348-4B35-9B3C-E52C5EEEA5F0}" = dir=in | app=c:\program files\hp\quickplay\qpservice.exe |
"TCP Query User{08A279FD-9547-427C-9164-DC4B7824ACD1}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{0C9C9AC2-5A8D-476B-8055-2CE9EB0B59DE}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{2B16BBC0-FFAC-4B9A-A5A0-424D5BC14E8E}C:\program files\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"TCP Query User{3BCF54EC-67B8-4A34-A1E5-F1B3F56F50B0}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{7CF92FF1-B205-4852-BF30-89DD2113BA9D}C:\unrealtournament\system\unrealtournament.exe" = protocol=6 | dir=in | app=c:\unrealtournament\system\unrealtournament.exe |
"TCP Query User{7E00F817-EF93-4FE9-A78C-9AF9748EECA5}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{9098E129-7F77-49BC-8E8E-C0CA9B62468D}C:\q3ademo\quake3.exe" = protocol=6 | dir=in | app=c:\q3ademo\quake3.exe |
"TCP Query User{93533AFE-775E-4008-BD5C-20B8DB5FB947}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{C64FE249-C0AD-4076-B20C-F7DE9E4DD519}C:\quake iii arena\quake3\quake3.exe" = protocol=6 | dir=in | app=c:\quake iii arena\quake3\quake3.exe |
"UDP Query User{02D1A528-669B-4D4E-91D2-02C04779E1A1}C:\unrealtournament\system\unrealtournament.exe" = protocol=17 | dir=in | app=c:\unrealtournament\system\unrealtournament.exe |
"UDP Query User{2D74EC97-F624-4085-A41E-0D4D2807BAD1}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{3B6E903D-21D1-45E6-BC03-DA840A4A712F}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{4371B924-6E76-4C7D-9644-8C8E47542505}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{4B5EAC97-F71F-4281-8FE6-1EFE8430E76B}C:\program files\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"UDP Query User{821BF912-1205-4440-96AA-8D3E57791496}C:\q3ademo\quake3.exe" = protocol=17 | dir=in | app=c:\q3ademo\quake3.exe |
"UDP Query User{BB304B8B-3FCC-45AD-99AC-E5B49B34016C}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{DFCCFC89-E511-45AC-9F26-7C9E64E65871}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{E075CD96-8757-4880-99B7-72741B786D3A}C:\quake iii arena\quake3\quake3.exe" = protocol=17 | dir=in | app=c:\quake iii arena\quake3\quake3.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{11BB336F-0E58-4977-B866-F24FA334616B}" = HP Active Support Library
"{139E303E-1050-497F-98B1-9AE87B15C463}" = Windows Live Family Safety
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{174AE4F2-F8BD-483A-A158-B022183F46A6}" = Brother HL-2035
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}" = Adobe Shockwave Player
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = DVD Suite
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{250E9609-E830-43EB-B379-DAB7546A2422}" = muvee autoProducer 6.1
"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 13
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Driver Installation Program
"{28EDCE9C-3304-4331-8AB3-F3EBE94C35B4}" = HP Help and Support
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{341201D4-4F61-4ADB-987E-9CCE4D83A58D}" = Windows Live Toolbar Extension (Windows Live Toolbar)
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.30 E2
"{3AC54383-31D1-4907-961B-B12CBB1D0AE8}" = MobileMe Control Panel
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D5044A5-97B8-45C0-B956-BB2376569188}" = Windows Live Movie Maker
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{4507868A-A9CD-4ECC-BD54-0EAB6EE81D42}" = O2 Broadband Assistant
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP DVD Play 3.6
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6FD9FEEB-AED1-47B0-86B8-DCB5DE9156A3}" = Atheros USB WLAN Installer
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7745B7A9-F323-4BB9-9811-01BF57A028DA}" = Map Button (Windows Live Toolbar)
"{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}" = Windows Live Favorites for Windows Live Toolbar
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{865DB1C9-D5E4-408B-B37D-9927E605BD2D}" = ESU for Microsoft Vista
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
"{90BC5F99-9172-43B1-805F-77BCC800CAB7}" = Opera 10.60
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9885A11E-60E4-417C-B58B-8B31B21C0B8A}" = HP Easy Setup - Frontend
"{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Touch Pad Driver
"{A040AC77-C1AA-4CC9-8931-9F648AF178F6}" = VC 9.0 Runtime
"{A5C4AD72-25FE-4899-B6DF-6D8DF63C93CF}" = Highlight Viewer (Windows Live Toolbar)
"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.3
"{AC76BA86-7AD7-2448-0000-800000000003}" = Chinese Traditional Fonts Support For Adobe Reader 8
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{AE46ABD3-D625-467F-B5A7-8D3FFF077F0D}" = Realtek 8139 and 8139C+ Ethernet Network Card Driver for Windows Vista
"{b02df929-29a7-4fd2-9a70-81a644b635f7}" = HP Total Care Advisor
"{B128843A-F20A-46D3-80BC-5F0DC52C32B7}_is1" = Auto Mouse Click v1.1
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{BD0E2B92-3814-46F0-893B-4612EA010C7E}" = HP Customer Experience Enhancements
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C260343B-6282-42A2-939F-1FF7E503F608}" = Wolfram Notebook Indexer 2.0
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C8FD5BC1-92EF-4C15-92A9-F9AC7F61985F}" = HP Update
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CBAE4F50-9FC9-4557-AB36-9826DF3C103C}" = HP Wireless Assistant
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{D6E4E5D6-7693-4BB4-95BA-21F38FAFEE90}" = Safari
"{D7358B07-4F10-4014-9869-7999578BE8ED}" = HP User Guides 0093
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware 2007
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E80F62FF-5D3C-4A19-8409-9721F2928206}" = LiveUpdate (Symantec Corporation)
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F084395C-40FB-4DB3-981C-B51E74E1E83D}" = Smart Menus (Windows Live Toolbar)
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F5577101-33CC-4711-8235-3A95BCD49DB0}" = EA Link
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F7F3B252-E772-48AA-93EB-7964BC326067}" = MSCU for Microsoft Vista
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"CDBF - DBF Viewer and Editor_is1" = Version 1.55
"CNXT_AUDIO_HDA" = Conexant HD Audio
"Cute Knight Kingdom Demo_is1" = Cute Knight Kingdom Demo version 1.06
"Cute Knight Kingdom Fyrrion" = Cute Knight Kingdom Fyrrion
"Dev-C++" = Dev-C++ 5 beta 9 release (4.9.9.2)
"FIFA 2000 Demo" = FIFA 2000 Demo
"Game Maker 8.0" = Game Maker 8.0
"Google Chrome" = Google Chrome
"Graboid Video" = Graboid Video 1.65
"GtkDbfEditor" = GTK DBF Editor (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"MiKTeX 2.8" = MiKTeX 2.8
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"M-WIN-L 7.0.0 1148351_is1" = Wolfram Mathematica 7 (M-WIN-L 7.0.0 1148351)
"Pdf995" = Pdf995
"PdfEdit995" = PdfEdit995
"PsuedoLiveUpdate" = LiveUpdate (Symantec Corporation)
"RealPlayer 6.0" = RealPlayer
"Riva FLV Encoder 2.0_is1" = Riva FLV Encoder 2.0
"SlingMedia.QPSlingPlayer_is1" = QuickPlay SlingPlayer 0.4.4
"SUPER ©" = SUPER © Version 2008.bld.30 (Mar 22, 2008)
"SWF & FLV Toolbox_is1" = SWF & FLV Toolbox 3.5 (build 3.5.20.286)
"TVWiz" = Intel(R) TV Wizard
"Universal Document Converter_is1" = Universal Document Converter
"Veoh Web Player Beta" = Veoh Web Player
"ViewpointMediaPlayer" = Viewpoint Media Player
"VLC media player" = VideoLAN VLC media player 0.8.6d
"WildTangent hp Master Uninstall" = My HP Games
"WinGimp-2.0_is1" = GIMP 2.6.7
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"WinShell_is1" = WinShell

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 01/08/2010 05:51:17 | Computer Name = Lou-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 01/08/2010 06:35:05 | Computer Name = Lou-PC | Source = Google Update | ID = 20
Description =

Error - 01/08/2010 21:37:04 | Computer Name = Lou-PC | Source = Application Error | ID = 1000
Description = Faulting application extexport.exe, version 8.0.6001.18702, time stamp
0x49b3ad67, faulting module sqlite3.dll, version 3.6.22.0, time stamp 0x4c48c4ae,
exception code 0xc0000005, fault offset 0x0001072b, process id 0x1304, application
start time 0x01cb31e33590a440.

Error - 02/08/2010 15:04:23 | Computer Name = Lou-PC | Source = Application Hang | ID = 1002
Description = The program AcroRd32.exe version 8.1.0.137 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 1034 Start Time: 01cb3271acbecdb0 Termination Time: 68

Error - 03/08/2010 05:35:37 | Computer Name = Lou-PC | Source = Google Update | ID = 20
Description =

Error - 04/08/2010 12:05:36 | Computer Name = Lou-PC | Source = EventSystem | ID = 4609
Description =

Error - 04/08/2010 12:12:34 | Computer Name = Lou-PC | Source = System Restore | ID = 8209
Description =

Error - 04/08/2010 12:19:57 | Computer Name = Lou-PC | Source = EventSystem | ID = 4609
Description =

Error - 04/08/2010 12:35:06 | Computer Name = Lou-PC | Source = Google Update | ID = 20
Description =

Error - 05/08/2010 07:48:11 | Computer Name = Lou-PC | Source = EventSystem | ID = 4609
Description =

[ OSession Events ]
Error - 22/11/2009 22:26:45 | Computer Name = Lou-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 20043
seconds with 720 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 05/08/2010 07:48:50 | Computer Name = Lou-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 05/08/2010 07:48:50 | Computer Name = Lou-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 05/08/2010 07:48:50 | Computer Name = Lou-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 05/08/2010 07:48:50 | Computer Name = Lou-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 05/08/2010 07:48:51 | Computer Name = Lou-PC | Source = DCOM | ID = 10005
Description =

Error - 05/08/2010 07:48:51 | Computer Name = Lou-PC | Source = DCOM | ID = 10005
Description =

Error - 05/08/2010 07:48:53 | Computer Name = Lou-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 05/08/2010 07:49:12 | Computer Name = Lou-PC | Source = DCOM | ID = 10005
Description =

Error - 05/08/2010 07:51:52 | Computer Name = Lou-PC | Source = Microsoft-Windows-Kernel-General | ID = 5
Description =

Error - 05/08/2010 07:56:12 | Computer Name = Lou-PC | Source = WinDefend | ID = 2004
Description = %%827 has encountered an error trying to load signatures and will
attempt reverting back to a known-good set of signatures. Signatures Attempted: %%824

Error
Code: 0x8050a001 Error description: The program can't find definition files that
help detect unwanted software. Check for updates to the definition files, and then
try again. For information on installing updates, see Help and Support. Signatures
loading: %%825 Loading signature version: 1.87.836.0 Loading engine version: 1.1.6004.0


< End of report >

yekkers

Newbie Surfer
Newbie Surfer

Posts : 48
Joined : 2010-05-01

View user profile

Back to top Go down

Re: Anti-virus Solution Pro - MBAM not detecting it(!)

Post by Belahzur on Fri 06 Aug 2010, 10:06 am

Hello.

Please run OTL.exe.

  • Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):


    :OTL
    FF - prefs.js..keyword.URL: "http://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZJfox000&fl=0&ptb=BjZGF2FMESTW56WkCqVBcQ&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&st=kwd&searchfor="
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
    O33 - MountPoints2\{733838ce-7f0b-11df-bc94-001b38ea776b}\Shell\AutoRun\command - "" = F:\33r.exe -- File not found
    [2010/07/23 01:55:34 | 000,066,048 | ---- | C] (Blog do Birungueta) -- C:\Users\Lou\AppData\Roaming\335128e3.exe

    :files
    C:\Windows\tasks\At*.job


  • Return to OTL, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.

  • Click the red Run Fix button.
  • A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTL.exe
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.


@RealBelahzur - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur

Manager | Tech Officer
Manager | Tech Officer

Posts : 34917
Joined : 2008-08-04
Operating System : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Anti-virus Solution Pro - MBAM not detecting it(!)

Post by yekkers on Fri 06 Aug 2010, 11:13 am

========== OTL ==========
Prefs.js: "http://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZJfox000&fl=0&ptb=BjZGF2FMESTW56WkCqVBcQ&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&st=kwd&searchfor=" removed from keyword.URL
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{733838ce-7f0b-11df-bc94-001b38ea776b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{733838ce-7f0b-11df-bc94-001b38ea776b}\ not found.
File F:\33r.exe not found.
C:\Users\Lou\AppData\Roaming\335128e3.exe moved successfully.
========== FILES ==========
C:\Windows\tasks\At1.job moved successfully.
C:\Windows\tasks\At2.job moved successfully.
C:\Windows\tasks\At3.job moved successfully.
C:\Windows\tasks\At4.job moved successfully.

OTL by OldTimer - Version 3.2.9.1 log created on 08062010_011222

yekkers

Newbie Surfer
Newbie Surfer

Posts : 48
Joined : 2010-05-01

View user profile

Back to top Go down

Re: Anti-virus Solution Pro - MBAM not detecting it(!)

Post by Belahzur on Sat 07 Aug 2010, 6:46 am

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


@RealBelahzur - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur

Manager | Tech Officer
Manager | Tech Officer

Posts : 34917
Joined : 2008-08-04
Operating System : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Anti-virus Solution Pro - MBAM not detecting it(!)

Post by yekkers on Sat 07 Aug 2010, 12:34 pm

Malwarebytes' Anti-Malware 1.46
[You must be registered and logged in to see this link.]

Database version: 4401

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18928

07/08/2010 02:32:10
mbam-log-2010-08-07 (02-32-10).txt

Scan type: Quick scan
Objects scanned: 132528
Time elapsed: 8 minute(s), 25 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\7bde84a2-f58f-46ec-9eac-f1f90fead080 (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Users\Lou\AppData\Local\temp\F7E8.tmp (Trojan.Zbot) -> Quarantined and deleted successfully.
C:\Users\Lou\AppData\Local\temp\Fgv.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Lou\AppData\Local\temp\Fgw.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Users\Lou\AppData\Local\temp\Fgx.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Users\Lou\AppData\Local\temp\pdfupd.exe (Trojan.Zbot) -> Quarantined and deleted successfully.
C:\Windows\temp\TMP00000033CAC319232726C61F (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Lou\downloads\MurGee.Auto.Mouse.Click.v1.1.45289.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

yekkers

Newbie Surfer
Newbie Surfer

Posts : 48
Joined : 2010-05-01

View user profile

Back to top Go down

Re: Anti-virus Solution Pro - MBAM not detecting it(!)

Post by Belahzur on Sun 08 Aug 2010, 1:49 am

Hello.

  • Download combofix from here
    Link 1
1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to svchost as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

  • See HERE for how to disable your AV.
  • Double click on svchost.exe.
  • Follow the prompts. NOTE:
  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouse click combofix's window whilst it's running. That may cause it to stall.


@RealBelahzur - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur

Manager | Tech Officer
Manager | Tech Officer

Posts : 34917
Joined : 2008-08-04
Operating System : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Anti-virus Solution Pro - MBAM not detecting it(!)

Post by yekkers on Sun 08 Aug 2010, 3:32 am

ComboFix 10-08-06.03 - Lou 07/08/2010 17:02:05.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2037.1006 [GMT 1:00]
Running from: c:\users\Lou\Desktop\ComboFix.exe
AV: Norton 360 *On-access scanning enabled* (Updated) {A5F1BC7C-EA33-4247-961C-0217208396C4}
FW: Norton 360 *enabled* {371C0A40-5A0C-4AD2-A6E5-69C02037FBF3}
SP: Norton 360 *enabled* (Updated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: Windows Defender *disabled* (Outdated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2010-07-07 to 2010-08-07 )))))))))))))))))))))))))))))))
.

2010-08-07 16:11 . 2010-08-07 16:11 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-08-06 00:12 . 2010-08-06 00:12 -------- d-----w- C:\_OTL
2010-07-24 09:48 . 2010-08-05 11:54 -------- d-----w- c:\programdata\McAfee Security Scan
2010-07-24 09:48 . 2010-07-24 09:48 -------- d-----w- c:\programdata\McAfee
2010-07-24 09:47 . 2010-07-27 10:01 -------- d-----w- c:\program files\McAfee Security Scan
2010-07-15 21:42 . 2010-07-15 21:47 26682864 ----a-w- c:\users\Lou\AppData\Roaming\Real\Update\setup3.12\rp\RealPlayerSPGold.exe
2010-07-15 21:42 . 2010-07-15 21:42 220272 ----a-w- c:\users\Lou\AppData\Roaming\Real\Update\setup3.12\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
2010-07-15 21:42 . 2010-07-15 21:42 149000 ----a-w- c:\users\Lou\AppData\Roaming\Real\Update\setup3.12\chr_helper\LaunchHelper.exe
2010-07-15 21:42 . 2010-07-15 21:42 13407072 ----a-w- c:\users\Lou\AppData\Roaming\Real\Update\setup3.12\chr\ChromeInstaller.exe
2010-07-15 21:40 . 2010-07-15 21:40 79368 ----a-w- c:\users\Lou\AppData\Roaming\Real\Update\setup3.12\RUP\vista.exe
2010-07-15 21:40 . 2010-07-15 21:40 73344 ----a-w- c:\users\Lou\AppData\Roaming\Real\Update\setup3.12\RUP\inst_config\gtapi_v6.dll
2010-07-15 21:40 . 2010-07-15 21:40 64000 ----a-w- c:\users\Lou\AppData\Roaming\Real\Update\setup3.12\RUP\inst_config\gcapi_dll.dll
2010-07-15 21:40 . 2010-07-15 21:40 52288 ----a-w- c:\users\Lou\AppData\Roaming\Real\Update\setup3.12\RUP\inst_config\gtapi.dll
2010-07-15 21:40 . 2010-07-15 21:40 122880 ----a-w- c:\users\Lou\AppData\Roaming\Real\Update\setup3.12\RUP\inst_config\compat.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-07 16:06 . 2008-04-03 21:36 -------- d-----w- c:\users\Lou\AppData\Roaming\Skype
2010-08-07 15:07 . 2008-04-03 21:39 -------- d-----w- c:\users\Lou\AppData\Roaming\skypePM
2010-08-07 01:21 . 2010-03-22 22:58 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-06 11:18 . 2009-07-13 15:01 59 ----a-w- c:\windows\wpd99.drv
2010-08-06 11:18 . 2009-07-13 15:01 -------- d-----w- c:\programdata\pdf995
2010-08-04 16:12 . 2009-01-06 10:20 5972 ----a-w- c:\users\Lou\AppData\Local\d3d9caps.dat
2010-08-01 09:50 . 2010-07-07 22:15 452104 ----a-w- c:\users\Lou\AppData\Roaming\Real\Update\setup3.12\setup.exe
2010-07-14 11:43 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-07-03 15:26 . 2008-01-16 10:46 -------- d-----w- c:\programdata\CyberLink
2010-07-03 15:22 . 2010-07-03 15:22 -------- d-----w- c:\program files\Common Files\Skype
2010-07-02 11:41 . 2010-07-02 11:41 -------- d-----w- c:\program files\Auto Mouse Click
2010-07-01 18:55 . 2010-07-01 18:55 -------- d-----w- c:\program files\Opera
2010-06-26 02:02 . 2007-11-12 08:39 -------- d-----w- c:\program files\Microsoft.NET
2010-06-18 16:58 . 2010-06-18 16:58 -------- d-----w- c:\program files\GTK DBF Editor
2010-06-17 23:36 . 2010-06-17 23:36 -------- d-----w- c:\program files\CDBFW
2010-06-17 22:15 . 2009-02-10 17:13 510 ----a-w- c:\windows\eReg.dat
2010-06-12 02:26 . 2008-07-31 12:36 -------- d-----w- c:\users\Lou\AppData\Roaming\uTorrent
2010-06-12 02:10 . 2007-11-12 08:38 -------- d-----w- c:\programdata\Microsoft Help
2010-05-26 17:06 . 2010-06-11 11:44 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-26 14:47 . 2010-06-11 11:44 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-05-21 13:14 . 2010-05-02 21:28 221568 ------w- c:\windows\system32\MpSigStub.exe
2006-05-03 10:06 . 2008-06-10 22:55 163328 --sh--r- c:\windows\System32\flvDX.dll
2007-02-21 11:47 . 2008-06-10 22:55 31232 --sh--r- c:\windows\System32\msfDX.dll
2007-12-17 13:43 . 2008-06-10 22:55 27648 --sh--w- c:\windows\System32\Smab0.dll
2008-12-21 01:36 . 2008-12-11 09:55 82534432 --sha-w- c:\windows\System32\drivers\fidbox.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2007-10-02 1783136]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-29 39408]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2010-01-26 2633976]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-10-25 212992]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-10-01 181544]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-28 202032]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-09-14 222504]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-01 148888]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-11 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-11 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-11 133656]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-12 198160]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

c:\users\Lou\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):ac,57,38,9a,c0,34,ca,01

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1c9d35331ba1844;Google Update Service (gupdate1c9d35331ba1844);c:\program files\Google\Update\GoogleUpdate.exe [2009-05-12 133104]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S2 sprtsvc_O2;SupportSoft Sprocket Service (O2);c:\program files\O2\bin\sprtsvc.exe [2007-06-07 202280]
S3 athrusb;Atheros Wireless LAN USB device driver;c:\windows\system32\DRIVERS\athrusb.sys [2008-07-29 904192]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-12 22:44]

2010-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-12 22:44]

2010-08-06 c:\windows\Tasks\User_Feed_Synchronization-{A7F3F3D5-62F7-427C-B5D4-201B298E7C61}.job
- c:\windows\system32\msfeedssync.exe [2010-06-11 04:30]
.
.
------- Supplementary Scan -------
.
mStart Page = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = *.local
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-GB\local\search.html
IE: Add to Windows &Live Favorites - [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: o2.co.uk\*.broadband
FF - ProfilePath - c:\users\Lou\AppData\Roaming\Mozilla\Firefox\Profiles\i1isjn8p.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.startup.homepage - google.com
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2010-08-07 17:11
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(4480)
c:\program files\Hewlett-Packard\HP Advisor\Pillars\Market\MLDeskBand.dll
.
Completion time: 2010-08-07 17:16:41
ComboFix-quarantined-files.txt 2010-08-07 16:16
ComboFix2.txt 2010-05-03 10:08

Pre-Run: 75,548,463,104 bytes free
Post-Run: 75,835,088,896 bytes free

- - End Of File - - 57F1E5A80A5759F0468CFA8C0C738180

yekkers

Newbie Surfer
Newbie Surfer

Posts : 48
Joined : 2010-05-01

View user profile

Back to top Go down

Re: Anti-virus Solution Pro - MBAM not detecting it(!)

Post by Belahzur on Sun 08 Aug 2010, 4:32 am

Hello.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /uninstall

This will also reset your restore points.

Run ESET Online Scan
Please do an online scan with ESET Online Scanner. Please use Internet Explorer as it uses ActiveX.

  • Check (tick) this box: YES, I accept the Terms of Use.
  • Click on the Start button next to it.
  • When prompted to run ActiveX. click Yes.
  • You will be asked to install an ActiveX. Click Install.
  • Once installed, the scanner will be initialized.
  • After the scanner is initialized, click Start.
  • Check (tick) Remove found threats box.
  • Check (tick) Scan unwanted applications.
  • Click on Scan.
  • It will start scanning. Please be patient.
  • Once the scan is done, the log will be saved here: C:\Program Files\esetonlinescanner\log.txt.


@RealBelahzur - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur

Manager | Tech Officer
Manager | Tech Officer

Posts : 34917
Joined : 2008-08-04
Operating System : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Anti-virus Solution Pro - MBAM not detecting it(!)

Post by yekkers on Sun 08 Aug 2010, 8:33 am

Hi Belahzur,

Sorry about the hastle, but I stopped the scan shortly after I started it because I wasn't sure if the appropriate boxes were checked at the time.

I re-started the scan again, and I let it finish. It detected 3 threats. However, the log file saved in C:\Program Files\ESET\ESET Online Scanner looked like the log from when I prematurely stopped the scan, since it looked so short, but I may be mistaken though. Here is the log btw.

yekkers

Newbie Surfer
Newbie Surfer

Posts : 48
Joined : 2010-05-01

View user profile

Back to top Go down

Re: Anti-virus Solution Pro - MBAM not detecting it(!)

Post by yekkers on Sun 08 Aug 2010, 8:33 am

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
esets_scanner_update returned -1 esets_gle=53251
esets_scanner_update returned -1 esets_gle=53251

yekkers

Newbie Surfer
Newbie Surfer

Posts : 48
Joined : 2010-05-01

View user profile

Back to top Go down

Re: Anti-virus Solution Pro - MBAM not detecting it(!)

Post by Belahzur on Tue 10 Aug 2010, 10:51 am

How is the machine running now?


@RealBelahzur - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur

Manager | Tech Officer
Manager | Tech Officer

Posts : 34917
Joined : 2008-08-04
Operating System : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Anti-virus Solution Pro - MBAM not detecting it(!)

Post by yekkers on Thu 12 Aug 2010, 9:32 am

The Anti-virus Solution Pro malware hasn't reared its ugly head in the past few days. For now, it looks like the machine is running fine.

yekkers

Newbie Surfer
Newbie Surfer

Posts : 48
Joined : 2010-05-01

View user profile

Back to top Go down

Re: Anti-virus Solution Pro - MBAM not detecting it(!)

Post by Sponsored content Today at 1:05 am


Sponsored content


Back to top Go down

View previous topic View next topic Back to top


 
Permissions in this forum:
You cannot reply to topics in this forum