Hi Smokeycheech

I can't speak for OBUDan, but my symptoms sound exactly the same as his, so can I piggy back? All help most gratefully received.

Not sure of the etiquette - would I be better starting another thread?

Anyway, symptoms as above - my PC hangs intermittently, though with the mouse still working. If I'm watching a film or listening to online radio that will continue too.

As Dan said;
"It seems to go in cycles, works fine, no crashing for a couple of days. Then still operates but crashes after 30 minutes.

I'm not getting any blue screen of death etc. It just stops functioning. Everything goes to "Not Responding" but the mouse will still move around."

I have to just switch the PC on and off again.

I'm using Vista 64 Bit, my Hijack This log is as follows.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:49:12, on 12/10/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Program Files\TrueSuite Access Manager\usbnotify.exe
C:\Program Files\TrueSuite Access Manager\PwdBank.exe
C:\Program Files (x86)\Toshiba\TRCMan\TRCMan.exe
C:\Program Files (x86)\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files (x86)\AVG\AVG8\avgtray.exe
C:\Program Files (x86)\Common Files\aol\1241077087\ee\aolsoftware.exe
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\Program Files\Toshiba\HDMICtrlMan\HCMSoundChanger.exe
C:\Program Files (x86)\Toshiba\ConfigFree\CFSwMgr.exe
C:\Users\Steve\AppData\Local\Google\Chrome\Applica tion\chrome.exe
C:\Users\Steve\AppData\Local\Google\Chrome\Applica tion\chrome.exe
C:\Users\Steve\AppData\Local\Google\Chrome\Applica tion\chrome.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG8\Toolbar\IEToolbar.dll
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG8\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [cfFncEnabler.exe] cfFncEnabler.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~2\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [HostManager] "C:\Program Files (x86)\Common Files\AOL\1241077087\ee\AOLSoftware.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BlackBerryAutoUpdate] C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Steve\AppData\Local\Google\Update\Google Update.exe" /c
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: TOSHIBA Face Recognition Watcher.lnk = C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/Driver...reqlab_nvd.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Authentec memory manager service (Authentec memory manager) - Unknown owner - C:\Windows\system32\TAMSvr.exe (file missing)
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~2\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~2\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree Gadget Service - TOSHIBA CORPORATION - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: SmartFaceVWatchSrv - Toshiba - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files (x86)\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - Unknown owner - C:\Windows\system32\TODDSrv.exe (file missing)
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: TOSHIBA SMART Log Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11701 bytes



Many thanks for even just looking at this.

I'm sure there's other info I should put here, sorry for missing it off but I'm stupid.

Thanks,
Tomm0

This thread has been split off the other Tommo as you inadvertently hijacked another members thread.

Please click this link called Prework and follow the instructions, once done so a member of the Security Team will assist you.

Thanks Wolfeymole.

I think I may have solved my problem, though it did seem to come and go so may rear it's ugly head again.

Anyway, in case this may be of any help to anyone else...

One of the problems I had was that when the PC crashed I was unable to open Task Manager to see any obvious issues. As I have the brains of the rear end of a retarded sheep, it hadn't occurred to me to open the Task Manager in advance until I read the suggestion in another thread.

With the Task Manager open, before a crash I noticed that Google Chrome was using 30% of my CPU when as far as I could see it shouldn't have been doing anything. I googled "chrome CPU" and found something suggesting I update Chrome - it was several versions behind.

Having done that, I've had no more problems, though that could just be a coincidence, and they may well re-occur soon.

Hope this may be useful to someone.

Cheers

Tomm0

Hi Tomm0,

It sounds like you may still be infected. I strongly recommend you go through the steps in the prework link Wolfeymole posted we'll at the very least rule out any further Malware issues

Thanks Crush, and many thanks to anyone who even looks at this.

Sorry for the delay in replying - I've spent ages trying to do the first step for Vista 64 users, and failed miserably.

Despite right clicking 'Run As Administrator' to start SysProt, I keep getting the following error message when I click 'Create Log';

Failed to start service. SysProt Antirootkit needs to be run with Admin Privileges!

I've googled this error message extensively but haven't been able to get round it.




Using OTL as directed, I've cut and paste the OTL.txt file below, as it was slightly too large to attach, and attached the Extras.txt file.

I can't post the OTL.txt file in one go - assume it's too large?

So here's split in two (sorry if this is a pain and I'm doing it wrong);


OTL logfile created on: 20/10/2009 11:35:13 - Run 1
OTL by OldTimer - Version 3.0.21.0 Folder = C:\Users\Steve\Documents\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18828)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

4.00 Gb Total Physical Memory | 2.12 Gb Available Physical Memory | 52.94% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 360.97 Gb Total Space | 222.91 Gb Free Space | 61.75% Space Free | Partition Type: NTFS
Drive D: | 372.61 Gb Total Space | 372.51 Gb Free Space | 99.97% Space Free | Partition Type: NTFS
Drive E: | 4.35 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: STEVE-NOTEBOOK
Current User Name: Steve
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2009/10/20 11:23:30 | 00,521,216 | ---- | M] (OldTimer Tools) -- C:\Users\Steve\Documents\Downloads\OTL.exe
PRC - [2009/10/17 21:08:19 | 02,025,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG8\avgtray.exe
PRC - [2009/09/21 16:36:12 | 00,305,440 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe
PRC - [2009/08/29 08:45:46 | 00,693,016 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG8\avgcsrvx.exe
PRC - [2009/08/29 08:45:41 | 00,908,056 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG8\avgemc.exe
PRC - [2009/08/29 08:45:34 | 00,297,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG8\avgwdsvc.exe
PRC - [2009/08/17 22:54:54 | 12,957,536 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE
PRC - [2009/07/01 23:13:34 | 00,623,960 | ---- | M] (Research In Motion Limited) -- C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
PRC - [2009/06/25 15:12:42 | 01,414,144 | ---- | M] (Nokia) -- C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe
PRC - [2009/06/02 10:10:08 | 00,637,952 | ---- | M] (Nokia.) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
PRC - [2009/05/29 13:41:26 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2009/05/27 03:27:04 | 29,262,680 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
PRC - [2009/03/30 10:11:14 | 00,120,320 | ---- | M] (Nokia) -- C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe
PRC - [2009/03/08 12:34:00 | 00,115,712 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\IELowutil.exe
PRC - [2008/12/12 19:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Bonjour\mDNSResponder.exe
PRC - [2008/11/25 06:31:08 | 00,239,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
PRC - [2008/10/24 09:14:36 | 00,206,112 | ---- | M] (Macrovision Corporation) -- C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe
PRC - [2008/09/04 00:20:14 | 03,152,384 | ---- | M] (Arachnoid Biometrics Identification Group) -- C:\Program Files\TrueSuite Access Manager\PwdBank.exe
PRC - [2008/07/25 23:41:56 | 00,094,208 | ---- | M] () -- C:\Program Files\TrueSuite Access Manager\usbnotify.exe
PRC - [2008/07/11 01:58:40 | 00,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
PRC - [2008/07/11 01:57:30 | 00,634,880 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\Toshiba\ConfigFree\NDSTray.exe
PRC - [2008/06/28 02:46:06 | 00,036,864 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe
PRC - [2008/05/31 01:27:52 | 00,083,312 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files (x86)\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
PRC - [2008/04/17 18:39:02 | 00,667,648 | ---- | M] (TOSHIBA Corporation.) -- C:\Program Files\Toshiba\HDMICtrlMan\HCMSoundChanger.exe
PRC - [2008/04/17 08:19:16 | 00,405,504 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\Toshiba\ConfigFree\CFSwMgr.exe
PRC - [2008/04/11 03:56:22 | 00,692,224 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files (x86)\Toshiba\TRCMan\TRCMan.exe
PRC - [2007/01/18 12:04:04 | 00,067,056 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
PRC - [2006/11/14 15:01:21 | 00,050,736 | ---- | M] (America Online, Inc.) -- C:\Program Files (x86)\Common Files\aol\1241077087\ee\aolsoftware.exe
PRC - [2006/10/23 13:50:35 | 00,046,640 | R--- | M] (AOL LLC) -- C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2008/11/25 19:45:40 | 00,153,952 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter [Auto | Running])
SRV:64bit: - [2008/09/02 15:06:00 | 00,048,128 | ---- | M] () -- C:\Windows\SysNative\TAMSvr.exe -- (Authentec memory manager [Auto | Running])
SRV:64bit: - [2008/04/25 02:57:40 | 00,084,992 | ---- | M] (Toshiba) -- C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe -- (SmartFaceVWatchSrv [On_Demand | Running])
SRV:64bit: - [2008/02/06 21:50:18 | 00,434,016 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe -- (TosCoSrv [Auto | Running])
SRV:64bit: - [2008/01/21 03:52:15 | 01,216,000 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])
SRV:64bit: - [2008/01/21 03:47:32 | 00,383,544 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend [Auto | Running])
SRV:64bit: - [2007/12/04 01:04:48 | 00,175,104 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe -- (TOSHIBA SMART Log Service [Auto | Running])
SRV:64bit: - [2007/11/22 00:53:16 | 00,135,168 | ---- | M] () -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv [Auto | Running])
SRV:64bit: - [2006/11/02 12:16:35 | 00,051,200 | ---- | M] () -- C:\Windows\SysNative\bthserv.dll -- (BthServ [Auto | Running])
SRV - [2009/09/21 16:36:16 | 00,660,256 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\iPod\bin\iPodService.exe -- (iPod Service [On_Demand | Running])
SRV - [2009/08/29 08:45:41 | 00,908,056 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG8\avgemc.exe -- (avg8emc [Auto | Running])
SRV - [2009/08/29 08:45:34 | 00,297,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG8\avgwdsvc.exe -- (avg8wd [Auto | Running])
SRV - [2009/06/02 10:10:08 | 00,637,952 | ---- | M] (Nokia.) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer [On_Demand | Running])
SRV - [2009/05/29 13:41:26 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device [Auto | Running])
SRV - [2009/05/27 03:27:04 | 29,262,680 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$QOSMIOAVINDEXING [Auto | Running])
SRV - [2009/05/15 00:38:42 | 00,000,000 | ---D | M] -- C:\Windows\SysWow64\Msdtc -- (MSDTC [Unknown | Stopped])
SRV - [2009/04/11 14:17:46 | 00,313,840 | ---- | M] (Sonic Solutions) -- C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe -- (RoxLiveShare9 [Auto | Stopped])
SRV - [2009/04/11 14:17:44 | 00,170,480 | ---- | M] (Sonic Solutions) -- C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe -- (RoxWatch9 [Auto | Stopped])
SRV - [2009/04/11 14:17:26 | 01,108,464 | ---- | M] (Sonic Solutions) -- C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe -- (RoxMediaDB9 [On_Demand | Stopped])
SRV - [2008/12/12 19:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Bonjour\mDNSResponder.exe -- (Bonjour Service [Auto | Running])
SRV - [2008/11/25 06:31:08 | 00,239,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser [Auto | Running])
SRV - [2008/11/25 06:31:08 | 00,045,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper [Disabled | Stopped])
SRV - [2008/11/04 09:06:28 | 00,441,712 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv [On_Demand | Stopped])
SRV - [2008/10/25 19:44:08 | 00,065,888 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service [On_Demand | Stopped])
SRV - [2008/07/27 19:03:13 | 00,069,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\msco rsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2008/07/27 19:01:49 | 00,093,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ms corsvw.exe -- (clr_optimization_v2.0.50727_64 [On_Demand | Stopped])
SRV - [2008/07/11 01:58:40 | 00,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service [Auto | Running])
SRV - [2008/06/28 02:46:06 | 00,036,864 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe -- (ConfigFree Gadget Service [Auto | Running])
SRV - [2008/06/20 02:17:12 | 00,046,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\Pres entationFontCache.exe -- (FontCache3.0.0.0 [Auto | Running])
SRV - [2008/06/20 02:16:53 | 00,859,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped])
SRV - [2008/05/31 01:27:52 | 00,083,312 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files (x86)\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe -- (TNaviSrv [Auto | Running])
SRV - [2008/04/11 19:58:10 | 00,158,568 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service [Auto | Running])
SRV - [2008/01/21 03:51:36 | 00,344,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehRecvr.exe -- (ehRecvr [On_Demand | Running])
SRV - [2008/01/21 03:51:36 | 00,153,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehsched.exe -- (ehSched [On_Demand | Running])
SRV - [2008/01/21 03:48:28 | 00,592,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\netlogon.dll -- (Netlogon [On_Demand | Stopped])
SRV - [2007/12/06 23:20:56 | 00,088,560 | ---- | M] (Sonic Solutions) -- C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe -- (Roxio UPnP Renderer 9 [On_Demand | Stopped])
SRV - [2007/12/06 23:20:52 | 00,362,992 | ---- | M] (Sonic Solutions) -- C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUpnpService9.exe -- (Roxio Upnp Server 9 [Auto | Stopped])
SRV - [2007/01/18 12:04:04 | 00,067,056 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper [Auto | Running])
SRV - [2006/11/02 16:03:48 | 00,015,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehstart.dll -- (ehstart [Auto | Stopped])
SRV - [2006/11/02 10:46:05 | 00,018,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\keyiso.dll -- (KeyIso [On_Demand | Running])
SRV - [2006/11/02 07:35:15 | 00,060,994 | ---- | M] () -- C:\Windows\SysWow64\Wbem\vds.mof -- (vds [On_Demand | Stopped])
SRV - [2006/11/02 07:35:15 | 00,055,846 | ---- | M] () -- C:\Windows\SysWow64\Wbem\vss.mof -- (VSS [On_Demand | Stopped])
SRV - [2006/10/26 22:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2006/10/23 13:50:35 | 00,046,640 | R--- | M] (AOL LLC) -- C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe -- (AOL ACS [Auto | Running])
SRV - [2004/10/22 03:24:18 | 00,073,728 | ---- | M] (Macrovision Corporation) -- C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped])

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Bing
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = MSN.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Bing
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = MSN.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Bing
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = MSN.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C8 6B 96 A1 C0 4A CA 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG8\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igea red: C:\Program Files (x86)\AVG\AVG8\Toolbar\Firefox\avg@igeared [2009/07/08 20:41:29 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{20a8264 5-c095-46ed-80e3-08825760534b}: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/07/29 14:53:01 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\bkmrksyn c@nokia.com: C:\Program Files (x86)\Nokia\Nokia PC Suite 7\bkmrksync\ [2009/10/08 22:23:07 | 00,000,000 | ---D | M]

[2009/05/14 08:58:29 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\mozilla\Extensions
[2009/05/14 08:58:29 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\mozilla\Extensions\ {ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/08/18 08:20:09 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\mozilla\Firefox\Pro files\3afo0dxa.default\extensions
[2009/08/11 16:35:23 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\mozilla\Firefox\Pro files\3afo0dxa.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/08/11 16:35:25 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\mozilla\Firefox\Pro files\3afo0dxa.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
[2009/07/10 14:46:04 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\mozilla\Firefox\Pro files\3afo0dxa.default\extensions\firefox@tvunetwo rks.com
[2009/07/15 22:31:56 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\mozilla\Firefox\Pro files\3afo0dxa.default\extensions\foxyproxy@eric.h .jung
[2009/05/14 08:58:29 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\mozilla\Firefox\Pro files\7aringae.default\extensions
[2009/10/12 11:21:52 | 00,000,000 | ---D | M] -- C:\Program Files (x86)\mozilla firefox\extensions
[2009/07/10 17:18:47 | 00,000,000 | ---D | M] -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
[2009/08/16 13:29:05 | 00,000,000 | ---D | M] -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
[2009/08/16 13:28:54 | 00,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeploytk.dll
[2009/02/27 12:13:42 | 00,103,792 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll
[2009/09/23 18:43:12 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll
[2009/09/23 18:43:13 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll
[2009/09/23 18:43:13 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll
[2009/09/23 18:43:13 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll
[2009/09/23 18:43:13 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll
[2009/09/23 18:43:13 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll
[2009/09/23 18:43:13 | 00,159,744 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll
[2009/07/01 17:35:35 | 00,001,489 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg_igeared.xml

part 2... (OTL.txt)


O1 HOSTS File: (761 bytes) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG8\Toolbar\IEToolbar.dll ()
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG8\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG8\Toolbar\IEToolbar.dll ()
O4:64bit: - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [Camera Assistant Software] C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
O4:64bit: - HKLM..\Run: [cfFncEnabler.exe] File not found
O4:64bit: - HKLM..\Run: [FingerPrintNotifer] C:\Program Files\TrueSuite Access Manager\FpNotifier.exe (AuthenTec, Inc)
O4:64bit: - HKLM..\Run: [HDMICtrlMan] C:\Program Files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe (TOSHIBA Corporation.)
O4:64bit: - HKLM..\Run: [HSON] C:\Program Files\TOSHIBA\TBS\HSON.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [NDSTray.exe] File not found
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.DLL ()
O4:64bit: - HKLM..\Run: [NvMediaCenter] C:\Windows\SysNative\NvMcTray.DLL ()
O4:64bit: - HKLM..\Run: [PwdBank] C:\Program Files\TrueSuite Access Manager\PwdBank.exe (Arachnoid Biometrics Identification Group)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Skytel] C:\Windows\Skytel.exe (Realtek Semiconductor Corp.)
O4:64bit: - HKLM..\Run: [SmoothView] C:\Program Files\Toshiba\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4:64bit: - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
O4:64bit: - HKLM..\Run: [TosAutLk] C:\Program Files (x86)\TOSHIBA\WirelessKeyLogon\TosAutLk.exe ( TOSHIBA CORPORATION)
O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TRCMan] C:\Program Files (x86)\TOSHIBA\TRCMan\TRCMan.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [UsbMonitor] C:\Program Files\TrueSuite Access Manager\usbnotify.exe ()
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files (x86)\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BlackBerryAutoUpdate] C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe (Research In Motion Limited)
O4 - HKLM..\Run: [cfFncEnabler.exe] File not found
O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [HostManager] C:\Program Files (x86)\Common Files\AOL\1241077087\ee\AOLSoftware.exe (America Online, Inc.)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [NDSTray.exe] File not found
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files (x86)\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Google Update] C:\Users\Steve\AppData\Local\Google\Update\GoogleU pdate.exe (Google Inc.)
O4 - HKCU..\Run: [ISUSPM] C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKCU..\Run: [PC Suite Tray] C:\Program Files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
O4 - HKCU..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Skype] C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)
O4 - HKCU..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: ForceActiveDesktopOn = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: ConsentPromptBehaviorAdmin = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: ConsentPromptBehaviorUser = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: EnableLUA = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: DisableCAD = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files (x86)\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Windows\SysNative\wshbth.dll ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Windows\SysWow64\wshbth.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKCU\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/Driver...reqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_15)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 85.91.1.128 85.91.1.130
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18:64bit: - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (avgrssta.dll) - C:\Windows\SysNative\avgrssta.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{0d879a79-40f0-11de-a38c-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{0d879a79-40f0-11de-a38c-00038a000015}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found
O33 - MountPoints2\{0d879aa5-40f0-11de-a38c-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{0d879aa5-40f0-11de-a38c-00038a000015}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found
O33 - MountPoints2\{3780aabd-411f-11de-acb8-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{3780aabd-411f-11de-acb8-00038a000015}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found
O33 - MountPoints2\{3780aabf-411f-11de-acb8-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{3780aabf-411f-11de-acb8-00038a000015}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found
O33 - MountPoints2\{471bf964-35f0-11de-bc4b-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{471bf964-35f0-11de-bc4b-00038a000015}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found
O33 - MountPoints2\{541037e8-35a8-11de-8c3b-002318ea9642}\Shell - "" = AutoRun
O33 - MountPoints2\{541037e8-35a8-11de-8c3b-002318ea9642}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found
O33 - MountPoints2\{54103800-35a8-11de-8c3b-002318ea9642}\Shell - "" = AutoRun
O33 - MountPoints2\{54103800-35a8-11de-8c3b-002318ea9642}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found
O33 - MountPoints2\{a9c69281-7b4b-11de-9e4b-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{a9c69281-7b4b-11de-9e4b-806e6f6e6963}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found
O33 - MountPoints2\{a9c692b0-7b4b-11de-9e4b-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{a9c692b0-7b4b-11de-9e4b-00038a000015}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not found
O33 - MountPoints2\{b6b5b9ee-8508-11de-8f6a-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{b6b5b9ee-8508-11de-8f6a-00038a000015}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not found
O33 - MountPoints2\{cacf1cf0-36b0-11de-939f-00038a000015}\Shell\AutoRun\command - "" = isetup.exe
O33 - MountPoints2\{cacf1cf0-36b0-11de-939f-00038a000015}\Shell\explore\Command - "" = isetup.exe
O33 - MountPoints2\{cacf1cf0-36b0-11de-939f-00038a000015}\Shell\open\Command - "" = isetup.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not found
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\Windows\SysWow64\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
64bit: O35 - comfile [open] -- "%1" %* File not found
64bit: O35 - exefile [open] -- "%1" %* File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

NetSvcs:64bit: FastUserSwitchingCompatibility - Service key not found. File not found
NetSvcs:64bit: Ias - Service key not found. File not found
NetSvcs:64bit: Irmon - Service key not found. File not found
NetSvcs:64bit: Nla - Service key not found. File not found
NetSvcs:64bit: Ntmssvc - Service key not found. File not found
NetSvcs:64bit: NWCWorkstation - Service key not found. File not found
NetSvcs:64bit: Nwsapagent - Service key not found. File not found
NetSvcs:64bit: SRService - Service key not found. File not found
NetSvcs:64bit: Wmi - Service key not found. File not found
NetSvcs:64bit: WmdmPmSp - Service key not found. File not found
NetSvcs:64bit: LogonHours - Service key not found. File not found
NetSvcs:64bit: PCAudit - Service key not found. File not found
NetSvcs:64bit: helpsvc - Service key not found. File not found
NetSvcs:64bit: uploadmgr - Service key not found. File not found
NetSvcs: FastUserSwitchingCompatibility - Service key not found. File not found
NetSvcs: Ias - Service key not found. File not found
NetSvcs: Irmon - Service key not found. File not found
NetSvcs: Nla - Service key not found. File not found
NetSvcs: Ntmssvc - Service key not found. File not found
NetSvcs: NWCWorkstation - Service key not found. File not found
NetSvcs: Nwsapagent - Service key not found. File not found
NetSvcs: SRService - Service key not found. File not found
NetSvcs: Wmi - Service key not found. File not found
NetSvcs: WmdmPmSp - Service key not found. File not found
NetSvcs: LogonHours - Service key not found. File not found
NetSvcs: PCAudit - Service key not found. File not found
NetSvcs: helpsvc - Service key not found. File not found
NetSvcs: uploadmgr - Service key not found. File not found

========== Files/Folders - Created Within 14 Days ==========

[1 C:\Windows\*.tmp files]
[2009/10/08 22:17:58 | 00,000,000 | ---D | C] -- C:\ProgramData\Installations
[2009/10/09 11:21:25 | 00,000,000 | ---D | C] -- C:\ProgramData\InstallShield
[2009/10/08 22:23:47 | 00,000,000 | ---D | C] -- C:\ProgramData\PC Suite
[2009/10/09 11:17:14 | 00,000,000 | ---D | C] -- C:\ProgramData\Research In Motion
[2009/10/09 11:18:38 | 00,000,000 | ---D | C] -- C:\ProgramData\Roxio
[2009/10/09 11:21:06 | 00,000,000 | ---D | C] -- C:\ProgramData\Sonic
[2009/10/11 21:38:38 | 00,000,000 | ---D | C] -- C:\Users\Steve\AppData\Roaming\Blackberry Desktop
[2009/10/09 11:21:25 | 00,000,000 | ---D | C] -- C:\Users\Steve\AppData\Roaming\InstallShield
[2009/10/08 22:23:46 | 00,000,000 | ---D | C] -- C:\Users\Steve\AppData\Roaming\Nokia
[2009/10/08 22:23:48 | 00,000,000 | ---D | C] -- C:\Users\Steve\AppData\Roaming\PC Suite
[2009/10/09 11:33:54 | 00,000,000 | ---D | C] -- C:\Users\Steve\AppData\Roaming\Research In Motion
[2009/10/12 00:37:50 | 00,000,000 | ---D | C] -- C:\Users\Steve\AppData\Roaming\Roxio
[2009/10/08 22:23:06 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Nokia
[2009/10/08 22:23:07 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PCSuite
[2009/10/09 11:19:30 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PX Storage Engine
[2009/10/09 11:15:57 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Research In Motion
[2009/10/09 11:16:06 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Roxio Shared
[2009/10/09 11:18:38 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Sonic Shared
[2009/10/19 19:13:50 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe
[2009/10/08 22:18:43 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\Nokia
[2009/10/08 22:22:04 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\PC Connectivity Solution
[2009/10/09 11:15:53 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\Research In Motion
[2009/10/09 11:18:38 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\Roxio
[2009/10/12 22:48:51 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro
[2009/10/12 12:00:23 | 00,000,000 | ---D | C] -- C:\Program Files (x86)\VS Revo Group
[2009/10/09 11:21:30 | 00,000,000 | ---D | C] -- C:\Program Files\Roxio
[2009/10/14 11:23:01 | 00,000,000 | ---D | C] -- C:\Windows\SQLTools9_KB970892_ENU
[2009/10/14 11:21:34 | 00,000,000 | ---D | C] -- C:\Windows\SQL9_KB970892_ENU
[2009/10/14 11:18:03 | 00,000,000 | -HSD | C] -- C:\Config.Msi
[2009/10/12 23:30:40 | 00,000,000 | ---D | C] -- C:\Users\Steve\Desktop\SysProt

========== Files - Modified Within 14 Days ==========

[1 C:\Windows\*.tmp files]
[2009/10/20 11:31:18 | 00,063,488 | ---- | M] () -- C:\Users\Steve\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/10/20 11:27:51 | 00,000,434 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{7B690C10-4A58-46EF-B0F9-5014ACE2B04C}.job
[2009/10/20 11:11:49 | 43,331,111 | ---- | M] () -- C:\Windows\SysNative\drivers\Avg\incavi.avm
[2009/10/20 11:11:49 | 00,036,961 | ---- | M] () -- C:\Windows\SysNative\drivers\Avg\microavi.avg
[2009/10/20 10:56:00 | 00,000,906 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1873375889-306747526-2478702223-1003UA.job
[2009/10/20 10:42:06 | 00,070,975 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2009/10/20 10:42:06 | 00,070,975 | ---- | M] () -- C:\ProgramData\nvModes.001
[2009/10/20 09:53:57 | 00,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2009/10/20 00:22:11 | 00,003,344 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2009/10/20 00:22:11 | 00,003,344 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2009/10/19 19:13:55 | 00,001,928 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2009/10/19 11:56:00 | 00,000,854 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1873375889-306747526-2478702223-1003Core.job
[2009/10/19 10:22:15 | 00,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
[2009/10/19 10:22:13 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2009/10/19 01:41:47 | 00,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2009/10/19 01:41:30 | 05,397,557 | -H-- | M] () -- C:\Users\Steve\AppData\Local\IconCache.db
[2009/10/18 23:41:07 | 00,010,932 | ---- | M] () -- C:\Users\Steve\Documents\Ceiling Log.docx
[2009/10/18 22:51:10 | 00,000,837 | ---- | M] () -- C:\Users\Public\Desktop\GNU Backgammon CLI.lnk
[2009/10/18 22:51:10 | 00,000,813 | ---- | M] () -- C:\Users\Public\Desktop\GNU Backgammon.lnk
[2009/10/18 00:22:29 | 00,012,974 | ---- | M] () -- C:\Users\Steve\Documents\Boards letter.docx
[2009/10/14 11:22:28 | 00,704,734 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2009/10/14 11:22:28 | 00,636,790 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2009/10/14 11:22:28 | 00,120,096 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2009/10/13 13:57:53 | 00,002,053 | ---- | M] () -- C:\Users\Steve\Desktop\Google Chrome.lnk
[2009/10/12 22:48:52 | 00,001,939 | ---- | M] () -- C:\Users\Steve\Desktop\HijackThis.lnk
[2009/10/12 21:46:25 | 00,001,538 | ---- | M] () -- C:\Users\Steve\Documents\cc_20091012_214615.reg
[2009/10/12 12:00:24 | 00,001,110 | ---- | M] () -- C:\Users\Steve\Desktop\Revo Uninstaller.lnk
[2009/10/12 11:19:49 | 00,004,986 | ---- | M] () -- C:\Users\Steve\Documents\cc_20091012_111940.reg
[2009/10/11 21:43:03 | 00,569,908 | ---- | M] () -- C:\Users\Steve\Documents\LoaderBackup-(2009-10-11).ipd
[2009/10/11 21:38:48 | 00,761,144 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2009/10/09 11:26:57 | 00,127,872 | ---- | M] () -- C:\Users\Steve\AppData\Local\GDIPFONTCACHEV1.DAT
[2009/10/09 11:24:10 | 00,435,432 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2009/10/09 11:16:10 | 00,001,910 | ---- | M] () -- C:\Users\Public\Desktop\Desktop Manager.lnk
[2009/10/08 23:26:45 | 00,021,638 | ---- | M] () -- C:\Users\Steve\Documents\cc_20091008_232607.reg
[2009/10/08 23:23:34 | 00,001,735 | ---- | M] () -- C:\Users\Steve\Desktop\CCleaner.lnk
[2009/10/08 22:26:33 | 00,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_PCCSWpdDriv er_01_07_00.Wdf
[2009/10/08 22:23:09 | 00,001,956 | ---- | M] () -- C:\Users\Public\Desktop\Nokia PC Suite.lnk

========== Files - No Company Name ==========
[2009/10/19 19:13:55 | 00,001,928 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2009/10/18 22:51:10 | 00,000,837 | ---- | C] () -- C:\Users\Public\Desktop\GNU Backgammon CLI.lnk
[2009/10/18 22:51:10 | 00,000,813 | ---- | C] () -- C:\Users\Public\Desktop\GNU Backgammon.lnk
[2009/10/18 00:22:28 | 00,012,974 | ---- | C] () -- C:\Users\Steve\Documents\Boards letter.docx
[2009/10/16 19:26:07 | 00,010,932 | ---- | C] () -- C:\Users\Steve\Documents\Ceiling Log.docx
[2009/10/14 10:12:03 | 04,691,016 | ---- | C] () -- C:\Windows\SysNative\ntoskrnl.exe
[2009/10/14 10:11:54 | 00,558,592 | ---- | C] () -- C:\Windows\SysNative\EncDec.dll
[2009/10/14 10:11:54 | 00,289,792 | ---- | C] () -- C:\Windows\SysNative\psisrndr.ax
[2009/10/14 10:11:53 | 00,375,808 | ---- | C] () -- C:\Windows\SysNative\psisdecd.dll
[2009/10/14 10:11:53 | 00,227,328 | ---- | C] () -- C:\Windows\SysNative\mpg2splt.ax
[2009/10/14 10:11:53 | 00,101,376 | ---- | C] () -- C:\Windows\SysNative\MSNP.ax
[2009/10/14 10:11:49 | 00,818,688 | ---- | C] () -- C:\Windows\SysNative\WMSPDMOD.DLL
[2009/10/14 10:11:45 | 09,236,992 | ---- | C] () -- C:\Windows\SysNative\mshtml.dll
[2009/10/14 10:11:44 | 12,461,568 | ---- | C] () -- C:\Windows\SysNative\ieframe.dll
[2009/10/14 10:11:41 | 02,334,208 | ---- | C] () -- C:\Windows\SysNative\iertutil.dll
[2009/10/14 10:11:41 | 01,484,288 | ---- | C] () -- C:\Windows\SysNative\urlmon.dll
[2009/10/14 10:11:41 | 01,147,904 | ---- | C] () -- C:\Windows\SysNative\wininet.dll
[2009/10/14 10:11:41 | 00,459,776 | ---- | C] () -- C:\Windows\SysNative\iedkcs32.dll
[2009/10/14 10:11:40 | 01,538,560 | ---- | C] () -- C:\Windows\SysNative\inetcpl.cpl
[2009/10/14 10:11:40 | 00,700,928 | ---- | C] () -- C:\Windows\SysNative\msfeeds.dll
[2009/10/14 10:11:40 | 00,243,712 | ---- | C] () -- C:\Windows\SysNative\occache.dll
[2009/10/14 10:11:39 | 01,638,912 | ---- | C] () -- C:\Windows\SysNative\mshtml.tlb
[2009/10/14 10:11:39 | 00,252,416 | ---- | C] () -- C:\Windows\SysNative\iepeers.dll
[2009/10/14 10:11:39 | 00,219,136 | ---- | C] () -- C:\Windows\SysNative\ieui.dll
[2009/10/14 10:11:39 | 00,162,816 | ---- | C] () -- C:\Windows\SysNative\ieUnatt.exe
[2009/10/14 10:11:39 | 00,132,096 | ---- | C] () -- C:\Windows\SysNative\iesysprep.dll
[2009/10/14 10:11:39 | 00,077,312 | ---- | C] () -- C:\Windows\SysNative\iesetup.dll
[2009/10/14 10:11:39 | 00,072,192 | ---- | C] () -- C:\Windows\SysNative\iernonce.dll
[2009/10/14 10:11:39 | 00,071,680 | ---- | C] () -- C:\Windows\SysNative\msfeedsbs.dll
[2009/10/14 10:11:39 | 00,070,656 | ---- | C] () -- C:\Windows\SysNative\ie4uinit.exe
[2009/10/14 10:11:39 | 00,031,744 | ---- | C] () -- C:\Windows\SysNative\jsproxy.dll
[2009/10/14 10:11:39 | 00,012,288 | ---- | C] () -- C:\Windows\SysNative\msfeedssync.exe
[2009/10/14 10:11:33 | 00,268,800 | ---- | C] () -- C:\Windows\SysNative\msv1_0.dll
[2009/10/14 10:11:31 | 00,174,592 | ---- | C] () -- C:\Windows\SysNative\drivers\srv2.sys
[2009/10/14 10:11:30 | 00,082,944 | ---- | C] () -- C:\Windows\SysNative\msasn1.dll
[2009/10/12 22:48:52 | 00,001,939 | ---- | C] () -- C:\Users\Steve\Desktop\HijackThis.lnk
[2009/10/12 21:46:17 | 00,001,538 | ---- | C] () -- C:\Users\Steve\Documents\cc_20091012_214615.reg
[2009/10/12 12:00:24 | 00,001,110 | ---- | C] () -- C:\Users\Steve\Desktop\Revo Uninstaller.lnk
[2009/10/12 11:19:43 | 00,004,986 | ---- | C] () -- C:\Users\Steve\Documents\cc_20091012_111940.reg
[2009/10/11 21:43:03 | 00,569,908 | ---- | C] () -- C:\Users\Steve\Documents\LoaderBackup-(2009-10-11).ipd
[2009/10/09 11:21:20 | 00,052,856 | ---- | C] () -- C:\Windows\SysNative\drivers\PxHlpa64.sys
[2009/10/09 11:21:20 | 00,010,488 | ---- | C] () -- C:\Windows\SysNative\drivers\cdralw2k.sys
[2009/10/09 11:21:20 | 00,010,488 | ---- | C] () -- C:\Windows\SysNative\drivers\cdr4_xp.sys
[2009/10/09 11:20:40 | 00,000,006 | -HS- | C] () -- C:\Users\Steve\AppData\Roaming\desktop.ini
[2009/10/09 11:20:40 | 00,000,006 | -HS- | C] () -- C:\Users\Steve\AppData\Local\desktop.ini
[2009/10/09 11:16:36 | 00,031,744 | ---- | C] () -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys
[2009/10/09 11:16:09 | 00,001,910 | ---- | C] () -- C:\Users\Public\Desktop\Desktop Manager.lnk
[2009/10/08 23:26:18 | 00,021,638 | ---- | C] () -- C:\Users\Steve\Documents\cc_20091008_232607.reg
[2009/10/08 22:26:33 | 00,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_PCCSWpdDriv er_01_07_00.Wdf
[2009/10/08 22:23:09 | 00,001,956 | ---- | C] () -- C:\Users\Public\Desktop\Nokia PC Suite.lnk
[2009/10/08 22:22:59 | 00,025,600 | ---- | C] () -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys
[2009/10/08 22:18:43 | 00,067,584 | ---- | C] () -- C:\Windows\SysNative\nmwcdclsx64.dll
[2009/07/30 16:29:45 | 05,397,557 | -H-- | C] () -- C:\Users\Steve\AppData\Local\IconCache.db
[2009/07/08 01:22:12 | 00,000,680 | ---- | C] () -- C:\Users\Steve\AppData\Local\d3d9caps.dat
[2009/07/08 00:09:26 | 00,000,732 | ---- | C] () -- C:\Users\Steve\AppData\Local\d3d9caps64.dat
[2009/07/05 23:39:10 | 00,420,368 | ---- | C] () -- C:\Users\Steve\AppData\Local\dd_vcredistMSI336B.tx t
[2009/07/05 23:39:09 | 00,011,396 | ---- | C] () -- C:\Users\Steve\AppData\Local\dd_vcredistUI336B.txt
[2009/06/19 09:40:02 | 00,009,687 | ---- | C] () -- C:\Users\Steve\AppData\Roaming\Comma Separated Values (Windows).CAL
[2009/05/28 17:41:40 | 04,472,538 | ---- | C] () -- C:\Windows\SysWow64\libavcodec.dll
[2009/05/25 17:38:22 | 00,830,004 | ---- | C] () -- C:\Windows\SysWow64\ff_x264.dll
[2009/05/18 00:37:12 | 00,557,469 | ---- | C] () -- C:\Windows\SysWow64\libmplayer.dll
[2009/04/30 18:42:00 | 00,038,444 | ---- | C] () -- C:\Users\Steve\AppData\Roaming\Comma Separated Values (Windows).ADR
[2009/04/30 16:22:32 | 00,063,488 | ---- | C] () -- C:\Users\Steve\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/30 09:59:40 | 00,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009/04/30 00:22:50 | 00,127,872 | ---- | C] () -- C:\Users\Steve\AppData\Local\GDIPFONTCACHEV1.DAT
[2009/04/29 23:06:52 | 00,204,800 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeW7.dll
[2009/04/29 23:06:52 | 00,200,704 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeA6.dll
[2009/04/29 23:06:52 | 00,192,512 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeP6.dll
[2009/04/29 23:06:52 | 00,192,512 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeM6.dll
[2009/04/29 23:06:52 | 00,188,416 | ---- | C] () -- C:\Windows\SysWow64\IVIresizePX.dll
[2009/04/29 23:06:52 | 00,020,480 | ---- | C] () -- C:\Windows\SysWow64\IVIresize.dll
[2009/04/29 22:59:29 | 00,070,975 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009/04/29 22:59:16 | 00,070,975 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009/04/29 22:50:45 | 00,704,734 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2009/04/21 17:38:32 | 00,328,334 | ---- | C] () -- C:\Windows\SysWow64\ff_kernelDeint.dll
[2009/04/21 17:08:22 | 00,425,040 | ---- | C] () -- C:\Windows\SysWow64\TomsMoComp_ff.dll
[2009/04/21 16:54:54 | 00,146,098 | ---- | C] () -- C:\Windows\SysWow64\libmpeg2_ff.dll
[2009/04/21 16:52:08 | 00,828,029 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2009/04/02 15:23:32 | 00,098,304 | ---- | C] () -- C:\Windows\SysWow64\ff_wmv9.dll
[2009/04/02 15:21:50 | 00,084,480 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2009/03/02 17:19:36 | 00,183,296 | ---- | C] () -- C:\Windows\SysWow64\ff_samplerate.dll
[2009/03/02 17:19:30 | 00,178,688 | ---- | C] () -- C:\Windows\SysWow64\ff_libmad.dll
[2009/03/02 17:19:14 | 00,113,152 | ---- | C] () -- C:\Windows\SysWow64\ff_unrar.dll
[2009/03/02 17:18:46 | 00,146,944 | ---- | C] () -- C:\Windows\SysWow64\ff_tremor.dll
[2009/03/02 17:18:32 | 00,257,024 | ---- | C] () -- C:\Windows\SysWow64\ff_libdts.dll
[2009/03/02 17:18:28 | 00,142,848 | ---- | C] () -- C:\Windows\SysWow64\ff_liba52.dll
[2009/03/02 17:18:18 | 00,486,400 | ---- | C] () -- C:\Windows\SysWow64\ff_libfaad2.dll
[2009/01/10 23:17:32 | 00,163,840 | ---- | C] () -- C:\Windows\SysWow64\ts.dll
[2009/01/10 23:16:56 | 00,148,480 | ---- | C] () -- C:\Windows\SysWow64\mkx.dll
[2009/01/10 23:16:50 | 00,108,032 | ---- | C] () -- C:\Windows\SysWow64\avi.dll
[2009/01/10 23:16:14 | 00,141,312 | ---- | C] () -- C:\Windows\SysWow64\mp4.dll
[2009/01/10 23:15:54 | 00,120,832 | ---- | C] () -- C:\Windows\SysWow64\ogm.dll
[2009/01/10 23:15:44 | 00,159,744 | ---- | C] () -- C:\Windows\SysWow64\mmfinfo.dll
[2009/01/10 23:15:32 | 00,102,400 | ---- | C] () -- C:\Windows\SysWow64\avss.dll
[2009/01/10 23:15:28 | 00,246,784 | ---- | C] () -- C:\Windows\SysWow64\dxr.dll
[2009/01/10 23:15:12 | 00,097,280 | ---- | C] () -- C:\Windows\SysWow64\avs.dll
[2009/01/10 23:14:08 | 00,079,360 | ---- | C] () -- C:\Windows\SysWow64\mkzlib.dll
[2009/01/10 23:14:06 | 00,023,552 | ---- | C] () -- C:\Windows\SysWow64\mkunicode.dll
[2008/12/03 23:11:50 | 00,180,224 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2008/11/06 17:37:32 | 03,596,288 | ---- | C] () -- C:\Windows\SysWow64\qt-dx331.dll
[2008/11/06 17:34:00 | 00,000,416 | ---- | C] () -- C:\Windows\SysWow64\dtu100.dll.manifest
[2008/11/06 17:34:00 | 00,000,416 | ---- | C] () -- C:\Windows\SysWow64\dpl100.dll.manifest
[2008/05/14 02:54:07 | 00,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI
[2008/03/28 05:16:20 | 00,000,091 | ---- | C] () -- C:\Windows\SysWow64\HD_Demo.ini
[2008/01/21 03:50:05 | 00,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2008/01/21 03:49:49 | 00,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2007/12/22 00:46:32 | 00,118,784 | ---- | C] () -- C:\Windows\SysWow64\TosBtAcc.dll
[2007/10/13 10:30:20 | 00,000,137 | ---- | C] () -- C:\Windows\SysWow64\Registration.ini
[2007/07/10 18:10:12 | 00,000,547 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll.manifest
[2006/11/02 16:25:49 | 00,000,174 | -HS- | C] () -- C:\Program Files\desktop.ini
[2006/11/02 16:25:49 | 00,000,174 | -HS- | C] () -- C:\Program Files (x86)\desktop.ini
[2006/11/02 13:34:27 | 00,000,339 | ---- | C] () -- C:\Windows\win.ini
[2006/11/02 13:34:27 | 00,000,219 | ---- | C] () -- C:\Windows\system.ini
[2005/07/23 05:30:18 | 00,065,536 | ---- | C] () -- C:\Windows\SysWow64\TosCommAPI.dll

========== LOP Check ==========

[2009/10/12 00:37:50 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming
[2009/10/08 23:25:00 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\Azureus
[2009/07/06 21:24:18 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\BBCiPlayerDesktop.6 1DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
[2009/10/11 21:38:40 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\Blackberry Desktop
[2009/08/25 17:07:04 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\Magnet Entertainment
[2006/11/02 16:07:25 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\Media Center Programs
[2009/10/08 22:26:21 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\Nokia
[2009/10/08 22:26:29 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\PC Suite
[2009/10/09 11:33:54 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\Research In Motion
[2009/10/12 00:37:50 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\Roxio
[2009/07/08 01:17:55 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\Tor
[2009/06/08 19:47:57 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\TOSHIBA
[2009/07/09 01:23:01 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\U3
[2009/10/14 23:43:15 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\uTorrent
[2009/07/08 01:17:55 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\Vidalia
[2009/05/15 09:55:02 | 00,000,000 | ---D | M] -- C:\Users\Steve\AppData\Roaming\WinBatch
[2009/10/19 11:56:00 | 00,000,854 | ---- | M] () -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1873375889-306747526-2478702223-1003Core.job
[2009/10/20 10:56:00 | 00,000,906 | ---- | M] () -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1873375889-306747526-2478702223-1003UA.job
[2009/10/19 10:22:13 | 00,000,006 | -H-- | M] () -- C:\Windows\Tasks\SA.DAT
[2009/10/19 01:41:47 | 00,032,528 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2009/10/20 11:27:51 | 00,000,434 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{7B690C10-4A58-46EF-B0F9-5014ACE2B04C}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >
< End of report >