# Blue screen after root kit, ati2dvag file damaged?



## shadowbird (Oct 9, 2012)

Appears to be a root kit. Thank you for your help! I am out of work and trying to get a business started to support my fam, but can't do it without this computer working, so I really appreciate it. Not exactly a beginner. Can understand and follow most instructions from tech. (Have used an online tech service before. Am more familiar with my PC than the average person. I also know how to do maintenance on my PC and am familiar with the most known antivirus programs).

Blue screen after root kit, ati2dvag file damaged, plus more...

I am in safemode. I can only work briefly in full windows mode. A month ago, PC started shutting down to a blue screen, at Microsoft page it said problem with ati2dvag file. It would not let me run or install antivirus programs. In safemode from a USB, I ran Malwarebytes and Spybot and VIPRE rescue. VIPRE found a root kit. I ran Eset online scanner which found and removed a trojan.
I followed instr from a web site for replacing the damanged ati2dvag file, but it would not allow the reset.

Also, windows firewall will not allow me to set it. I followed instr online to get it working, and then it worked. But after the next blue screen shut-down, it did not work again.

Thank you for your help! I am out of work and trying to get a business started to support my fam, but can't do it without this computer working, so I really appreciate it.

Here are the messages I receive:

FIREWALL Error Message: 
Due to an unidentified problem, Windows cannot display firewall settings.

After reboot from Blue Screen - message from WINDOWS ERROR REPORTING: 
Solve a problem with your video device driver
You received this message because a hardware device in your computer caused Windows to shut down unexpectedly and restart. This is a serious problem, commonly referred to as a "stop error" or "blue screen."

There are two things you can try to solve the problem. If the first option doesn't work, then try the second.

Install the most current device driver for your video card

Use Windows Update to check for and install updates. 

I updated driver, did not solve the problem. Then I removed the graphics card and am now using the onboard DVI card, and updated graphics driver, still same problem.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:16:05 PM, on 10/9/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG2013\avgrsx.exe
C:\Program Files\AVG\AVG2013\avgcsrvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG2013\avgidsagent.exe
C:\Program Files\AVG\AVG2013\avgwdsvc.exe
C:\Program Files\Bsecure\InetCtrl.exe
C:\Program Files\Bsecure\BsecAV.exe
C:\Program Files\AVG\AVG2013\avgnsx.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Bsecure\BSecAMX.exe
C:\Program Files\AVG\AVG2013\avgcsrvx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\KaraokeSer.exe
C:\WINDOWS\system32\NLSSRV32.EXE
C:\WINDOWS\system32\HPZipm12.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\AVG Secure Search\ScriptHelperInstaller\12.2.6\ScriptHelper.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Francie\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://nightsounds/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer, optimized for Bing and MSN
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe /installquiet
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: Copy to &Lightning Note - C:\Program Files\Corel\WordPerfect Lightning\Programs\WPLightningCopyToNote.hta
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
O8 - Extra context menu item: Open with WordPerfect - c:\Program Files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider '%programfiles%\bsecure\inetctrl57.dll' missing
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlcdnet.asus.com/pub/ASUS/mis...ex-2.2.5.0.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1294720102421
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: intu-help-qb3 - {C5E479EA-0A65-4B05-8C6C-2FC8CC682EB4} - C:\Program Files\Intuit\QuickBooks 2010\HelpAsyncPluggableProtocol.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.6\ViProtocol.dll
O20 - Winlogon Notify: TPSvc - TPSvc.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgidsagent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgwdsvc.exe
O23 - Service: CloudCare (Bsecure) - Bsecure Technologies, Inc. - C:\Program Files\Bsecure\InetCtrl.exe
O23 - Service: CloudCare AntiVirus (BsecureAV) - Bsecure Technologies, Inc. - C:\Program Files\Bsecure\BsecAV.exe
O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: VIA Karaoke digital mixer Service (KaraokeService) - VIA Technologies, Inc. - C:\WINDOWS\system32\KaraokeSer.exe
O23 - Service: Nalpeiron Licensing Service (nlsX86cc) - Nalpeiron Ltd. - C:\WINDOWS\system32\NLSSRV32.EXE
O23 - Service: NVIDIA Driver Helper Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: vToolbarUpdater12.2.6 - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe
--
End of file - 8920 bytes

.
DDS (Ver_2011-08-26.01) - NTFSx86 
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_30
Run by Francie at 19:19:13 on 2012-10-09
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2441 [GMT -4:00]
.
AV: ESET NOD32 Antivirus 5.2 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
============== Running Processes ===============
.
C:\PROGRA~1\AVG\AVG2013\avgrsx.exe
C:\Program Files\AVG\AVG2013\avgcsrvx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\AVG\AVG2013\avgidsagent.exe
C:\Program Files\AVG\AVG2013\avgwdsvc.exe
C:\Program Files\Bsecure\InetCtrl.exe
C:\Program Files\Bsecure\BsecAV.exe
C:\Program Files\AVG\AVG2013\avgnsx.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Bsecure\BSecAMX.exe
C:\Program Files\AVG\AVG2013\avgcsrvx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\KaraokeSer.exe
C:\WINDOWS\system32\NLSSRV32.EXE
C:\WINDOWS\system32\HPZipm12.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\AVG Secure Search\ScriptHelperInstaller\12.2.6\ScriptHelper.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Internet Explorer\iexplore.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://nightsounds/
uWindow Title = Internet Explorer, optimized for Bing and MSN
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\12.2.5.34\AVG Secure Search_toolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\12.2.5.34\AVG Secure Search_toolbar.dll
TB: {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [Carbonite Backup] c:\program files\carbonite\carbonite backup\CarboniteUI.exe
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: Copy to &Lightning Note - c:\program files\corel\wordperfect lightning\programs\WPLightningCopyToNote.hta
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: Open with WordPerfect - c:\program files\corel\wordperfect office x4\programs\WPLauncher.hta
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
LSP: %ProgramFiles%\Bsecure\InetCtrl57.dll
Trusted Zone: intuit.com\ttlc
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlcdnet.asus.com/pub/ASUS/misc/dlm-activex-2.2.5.0.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1294720102421
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 65.32.5.111 65.32.5.112
TCP: Interfaces\{1AD616B8-0534-4FB2-85E2-82645C155B2F} : DhcpNameServer = 65.32.5.111 65.32.5.112
Handler: g7ps - {9EACF0FB-4FC7-436E-989B-3197142AD979} - c:\program files\common files\g7ps\shared files\g7psdll\G7PS.dll
Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - c:\program files\intuit\quickbooks 2010\HelpAsyncPluggableProtocol.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\12.2.6\ViProtocol.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: TPSvc - TPSvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\francie\application data\mozilla\firefox\profiles\0tdbrp4t.default\
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=827316&p=
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=827316&p=
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrows errecordext.dll
FF - component: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrows errecordlegacyext.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim. dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\nos\bin\np_gp.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\Ext
FF - Ext: Java Quick Starter: [email protected] - c:\program files\java\jre6\lib\deploy\jqs\ff
.
---- FIREFOX POLICIES ----
FF - user.js: extentions.y2layers.installId - 0cb749d1-f74c-4bd5-9adf-4877091b9912
FF - user.js: extentions.y2layers.defaultEnableAppsList - Buzzdock,Buzzdock,
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: security.csp.enable - false
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2012-9-17 51936]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [2012-8-9 178656]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2012-8-10 35168]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2012-8-13 176096]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2012-8-10 19808]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2012-9-12 151648]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2012-9-14 89440]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2012-9-12 164704]
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2012-9-27 27496]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2012-6-28 101112]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2013\avgidsagent.exe [2012-8-20 5751928]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg2013\avgwdsvc.exe [2012-8-20 184304]
R2 Bsecure;CloudCare;c:\program files\bsecure\InetCtrl.exe [2012-4-2 66344]
R2 BsecureAV;CloudCare AntiVirus;c:\program files\bsecure\BsecAV.exe [2012-4-2 161776]
R2 KaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\KaraokeSer.exe [2012-8-26 88688]
R2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\system32\NLSSRV32.EXE [2012-4-12 69640]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia update core\daemonu.exe [2012-8-26 1262400]
R2 vToolbarUpdater12.2.6;vToolbarUpdater12.2.6;c:\program files\common files\avg secure search\vtoolbarupdater\12.2.6\ToolbarUpdater.exe [2012-9-27 722528]
R3 appliandMP;appliandMP;c:\windows\system32\drivers\appliand.sys [2011-9-5 28256]
R3 BSecACFltr;BSecACFltr;c:\windows\system32\drivers\BSecACFltr.sys [2012-4-2 21624]
R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [2012-8-26 43392]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2012-8-26 2551664]
S0 gbgrrpg;gbgrrpg;c:\windows\system32\drivers\hcvfg.sys --> c:\windows\system32\drivers\hcvfg.sys [?]
S0 nhrmdtgf;nhrmdtgf;c:\windows\system32\drivers\gqtbt.sys --> c:\windows\system32\drivers\gqtbt.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 appliand;Applian Network Service;c:\windows\system32\drivers\appliand.sys [2011-9-5 28256]
S3 hcw72ADFilter;WinTV HVR-950 USB Audio Filter Driver;c:\windows\system32\drivers\hcw72ADFilter.sys [2011-5-17 28928]
S3 hcw72ATV;WinTV HVR-950 NTSC;c:\windows\system32\drivers\hcw72ATV.sys [2011-5-17 1217920]
S3 hcw72DTV;WinTV HVR-950 ATSC/QAM;c:\windows\system32\drivers\hcw72DTV.sys [2011-5-17 1220224]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-9-5 22344]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2012-9-27 40776]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\system32\svchost.exe -k nosGetPlusHelper [2004-8-4 14336]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-6 34064]
S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [2012-8-26 13024]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v040 0.exe [2010-3-18 753504]
S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-2-12 136176]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-2-12 136176]
S4 HauppaugeTVServer;HauppaugeTVServer;c:\progra~1\wintv\tvserver\HAUPPA~1.EXE [2011-9-15 558592]
S4 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-9-5 655944]
.
=============== Created Last 30 ================
.
2012-10-09 18:48:13 -------- d--h--w- c:\windows\system32\GroupPolicy
2012-10-09 18:46:44 -------- d-----w- c:\documents and settings\francie\local settings\application data\Downloaded Installations
2012-10-02 17:47:25 205072 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2012-09-28 03:41:24 -------- d-----w- c:\documents and settings\francie\application data\AVG2013
2012-09-28 03:38:37 -------- d-----w- c:\documents and settings\francie\application data\TuneUp Software
2012-09-28 03:38:36 -------- d-----w- c:\documents and settings\francie\local settings\application data\AVG Secure Search
2012-09-28 03:38:30 -------- d-----w- c:\documents and settings\all users\application data\AVG Secure Search
2012-09-28 03:38:23 -------- d-----w- c:\documents and settings\francie\application data\AVG Secure Search
2012-09-28 03:38:21 27496 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
2012-09-28 03:38:19 -------- d-----w- c:\program files\common files\AVG Secure Search
2012-09-28 03:38:18 -------- d-----w- c:\program files\AVG Secure Search
2012-09-27 21:34:50 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2012-09-27 17:55:37 -------- d-----w- c:\windows\system32\wbem\repository\FS
2012-09-27 17:55:37 -------- d-----w- c:\windows\system32\wbem\Repository
2012-09-27 05:32:40 -------- d--h--w- C:\$AVG
2012-09-27 05:32:40 -------- d-----w- c:\documents and settings\all users\application data\AVG2013
2012-09-27 05:32:09 -------- d-----w- c:\program files\AVG
2012-09-27 03:32:34 -------- d-----w- c:\documents and settings\francie\local settings\application data\MFAData
2012-09-27 03:32:34 -------- d-----w- c:\documents and settings\francie\local settings\application data\Avg2013
2012-09-27 03:32:34 -------- d-----w- c:\documents and settings\all users\application data\MFAData
2012-09-27 03:22:06 -------- d-----w- c:\program files\PC Cleaners(2)
2012-09-27 03:14:00 -------- d-----w- c:\documents and settings\francie\application data\PC Cleaners
2012-09-27 03:13:46 -------- d-----w- c:\documents and settings\francie\application data\PCPro
2012-09-27 03:13:46 -------- d-----w- c:\documents and settings\all users\application data\PC1Data
2012-09-26 05:41:46 -------- d-----w- c:\documents and settings\francie\application data\GFI Software
2012-09-26 04:00:09 -------- d-----w- c:\documents and settings\all users\application data\RegAce
2012-09-26 03:54:20 302080 ----a-w- c:\windows\system32\ati2dvag.dll
2012-09-26 03:41:03 -------- d-----w- C:\AMD
2012-09-17 22:58:56 51936 ----a-w- c:\windows\system32\drivers\avgidshx.sys
2012-09-16 15:22:37 -------- d-sh--w- C:\found.000
2012-09-15 00:43:18 -------- d-----w- c:\program files\Microsoft(2).NET
2012-09-14 20:46:55 -------- d-----w- C:\dell
2012-09-14 20:45:30 -------- d-----w- c:\documents and settings\all users\application data\Tarma Installer
2012-09-14 20:00:05 -------- d-----w- C:\drivers
2012-09-14 19:03:38 -------- d-----w- c:\program files\Wondershare
2012-09-12 15:47:22 164704 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2012-09-12 15:47:04 151648 ----a-w- c:\windows\system32\drivers\avgldx86.sys
.
==================== Find3M ====================
.
2012-10-04 02:54:02 13024 ----a-w- c:\windows\system32\drivers\SWDUMon.sys
2012-09-30 20:13:13 1682 --sha-w- c:\documents and settings\all users\application data\KGyGaAvL.sys
2012-08-26 19:02:31 1074636 ----a-w- c:\windows\system32\nvdrsdb0.bin
2012-08-26 19:02:31 1 ----a-w- c:\windows\system32\nvdrssel.bin
2012-08-26 19:02:28 1074636 ----a-w- c:\windows\system32\nvdrsdb1.bin
2012-08-13 20:40:54 176096 ----a-w- c:\windows\system32\drivers\avgidsdriverx.sys
2012-08-10 08:52:28 19808 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys
2012-08-10 08:52:18 35168 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2012-08-09 17:56:44 178656 ----a-w- c:\windows\system32\drivers\avglogx.sys
.
============= FINISH: 19:25:44.50 ===============

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-10-10 11:05:31
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 SAMSUNG_HD322HJ rev.1AC01118
Running: 5w4ynd93.exe; Driver: C:\DOCUME~1\Francie\LOCALS~1\Temp\pxldyfob.sys
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwNotifyChangeKey [0xA6A4B118]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwNotifyChangeMultipleKeys [0xA6A4B1E8]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xA6A4AD4A]
SSDT \??\C:\WINDOWS\system32\drivers\avgtpx86.sys (AVG Technologies) ZwQueryValueKey [0xB81B9258]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwSuspendProcess [0xA6A4AF38]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwSuspendThread [0xA6A4AFCE]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xA6A4AE00]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xA6A4AE9C]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xA6A4B06A]
---- Kernel code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xB3067000, 0x288B98, 0xE8000020]
---- User code sections - GMER 1.0.15 ----
.text C:\Program Files\Internet Explorer\iexplore.exe[3836] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3836] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDAD4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3836] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E7207 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3836] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E7139 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3836] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E71A4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3836] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E700A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3836] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E706C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3836] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E726A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3836] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E70CE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4008] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4008] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9A65 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4008] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD0DD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4008] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDAD4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4008] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E25466C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4008] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E7207 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4008] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E7139 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4008] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E71A4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4008] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E700A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4008] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E706C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4008] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E726A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4008] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E70CE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4008] ole32.dll!CoCreateInstance 774FF1BC 5 Bytes JMP 3E2EDB30 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4008] ole32.dll!OleLoadFromStream 7752983B 5 Bytes JMP 3E3E756F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Program Files\Internet Explorer\iexplore.exe[4008] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Ntfs \Ntfs BsecFltr.sys (BSafeFil/BSafe Online)
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
---- Files - GMER 1.0.15 ----
File C:\Documents and Settings\Francie\Local Settings\Temporary Internet Files\Content.IE5\8WQCZZ4C\bullet[1] 3169 bytes
File C:\Documents and Settings\Francie\Local Settings\Temporary Internet Files\Content.IE5\QU8DBOFR\si[4].txt 0 bytes
File C:\Documents and Settings\Francie\Local Settings\Temporary Internet Files\Content.IE5\QU8DBOFR\sprite-client[1].png 11202 bytes
---- EOF - GMER 1.0.15 ----
Attached Files

attach.txt (20.6 KB, 0 views)


----------



## Cookiegal (Aug 27, 2003)

Please post the logs from the programs you ran before that found infections (specifically MalwareBytes and VIPRE so I can see what was detected and removed.


----------



## shadowbird (Oct 9, 2012)

There isn't one for Malwarebytes. Everytime I tried to run it, I got an error message. I think at one point I had it running from the flash drive but it didn't find anything at all.

Not sure VipreRescue has a log file, because it runs at DOS level. But I think I did a print screen when I saw something show up in red, so I'll try to find whatever I have on it.

Here's the one from Eset, and I'll have to search for ViperRescue and post it after this.

C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\0tdbrp4t.default\extensions\[email protected]\content\overlay.js Win32/Adware.Yontoo application cleaned by deleting - quarantined
C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions\[email protected]\content\overlay.js Win32/Adware.Yontoo application cleaned by deleting - quarantined
C:\Documents and Settings\Francie\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\niapdbllcanepiiimjjndipklodoedlc\1.0.1_0\background.html Win32/Adware.Yontoo.C application cleaned by deleting - quarantined
C:\Documents and Settings\Francie\Local Settings\Temp\jar_cache1691730362813628876.tmp Java/Exploit.CVE-2012-1723.BK trojan cleaned by deleting - quarantined
C:\Documents and Settings\Francie\Local Settings\Temp\YontooFFClient.xpi Win32/Adware.Yontoo application deleted - quarantined
C:\Documents and Settings\Francie\Local Settings\Temp\YontooLayers.crx Win32/Adware.Yontoo.C application deleted - quarantined
C:\Documents and Settings\Francie\Local Settings\Temp\ICReinstall\cnet2_Copy%20(10)%20of%20R152786_EXE[1].exe a variant of Win32/InstallCore.D application cleaned by deleting - quarantined
C:\Documents and Settings\Francie\Local Settings\Temp\YontooLayers\background.html Win32/Adware.Yontoo.C application cleaned by deleting - quarantined
C:\Documents and Settings\Francie\Local Settings\Temporary Internet Files\Content.IE5\3LKECXT3\regacesetup[1].exe multiple threats cleaned by deleting - quarantined


----------



## shadowbird (Oct 9, 2012)

Here's another Eset report I just found (still searching for Vipre Logs)

C:\Documents and Settings\Francie\Application Data\Sun\Java\Deployment\cache\6.0\63\6764cb7f-385e2a6c Java/Exploit.Agent.NCG trojan deleted - quarantined
C:\Documents and Settings\Francie\Local Settings\Application Data\{12557A13-BBAA-11E1-8270-B8AC6F996F26}\chrome\content\browser.xul JS/Redirector.NIQ trojan cleaned by deleting - quarantined
C:\Documents and Settings\Francie\My Documents\Downloads\reginout_setup.exe multiple threats cleaned by deleting - quarantined
C:\Documents and Settings\Francie\My Documents\Downloads\Unlocker1.9.1.exe a variant of Win32/Toolbar.Babylon application cleaned by deleting - quarantined


----------



## shadowbird (Oct 9, 2012)

This Eset is from 7/27, right about when things started getting weird:

protected file

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PPMediaGet.zip » ZIP » Documents and Settings/Francie/Local Settings/Application Data/Media Get LLC/MediaGet2/suggest/search_stop_word - error - password-protected file
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PPMediaGet.zip » ZIP » sbRecovery.ini - error - password-protected file
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PPMediaGet1.zip » ZIP » Documents and Settings/Francie/Local Settings/Application Data/MediaGet2/Firefox/install.rdf - error - password-protected file
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PPMediaGet1.zip » ZIP » Documents and Settings/Francie/Local Settings/Application Data/MediaGet2/Firefox/components/.autoreg - error - password-protected file
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PPMediaGet1.zip » ZIP » Documents and Settings/Francie/Local Settings/Application Data/MediaGet2/Firefox/components/img_ffext.xpt - error - password-protected file
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PPMediaGet1.zip » ZIP » Documents and Settings/Francie/Local Settings/Application Data/MediaGet2/Firefox/chrome/content/mg_ffext.js - error - password-protected file
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PPMediaGet1.zip » ZIP » Documents and Settings/Francie/Local Settings/Application Data/MediaGet2/Firefox/chrome/content/mg_ffext.xul - error - password-protected file
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\PPMediaGet1.zip » ZIP » sbRecovery.ini - error - password-protected file
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WiIQfraud.zip » ZIP » sbRecovery.reg - error - password-protected file
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WiIQfraud.zip » ZIP » sbRecovery.ini - error - password-protected file
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WiIQfraud1.zip » ZIP » sbRecovery.reg - error - password-protected file
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WiIQfraud1.zip » ZIP » sbRecovery.ini - error - password-protected file
C:\Documents and Settings\All Users\Documents\Annies Docs & Pics\Babysitting.eml » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\All Users\Documents\Annies Docs & Pics\Hi from Annie.eml » MIME - is OK (internal scanning not performed)


----------



## shadowbird (Oct 9, 2012)

This is from VipreRescue: 
[THREAT] Item: C:\Documents and Settings\All Users\Application Data\Tarma Installer\<889DF117-14D1-44EE-9F31-C5FB5D47F68B>\_Setupx.dll, ID: 4734384, Name Yontoo, Category: Adware, <General.


----------



## shadowbird (Oct 9, 2012)

This is from Malware Bytes log files. Beginning 9/14, Malwarebyes was unable to run, but I found log files which all look just like this, but different dates:

2012/09/14 02:02:07 -0400 FRANCIE-PC Francie MESSAGE Protection stopped
2012/09/14 09:44:17 -0400 FRANCIE-PC Francie MESSAGE Protection stopped
2012/09/14 15:58:49 -0400 FRANCIE-PC Francie MESSAGE Protection stopped
2012/09/14 16:41:42 -0400 FRANCIE-PC Francie MESSAGE Protection stopped
2012/09/14 20:25:01 -0400 FRANCIE-PC Francie MESSAGE Protection stopped


----------



## Cookiegal (Aug 27, 2003)

Please visit *Combofix Guide & Instructions * for instructions for installing the Recovery Console and downloading and running ComboFix.

The only thing different from the instructions there is that when downloading and saving the ComboFix.exe I would like you to rename it to puppy.exe please.

Post the log from ComboFix when you've accomplished that.

Important notes regarding ComboFix:

ComboFix may reset a number of Internet Explorer's settings, including making it the default browser. This can easily be changed once we're finished.

ComboFix also prevents autorun of ALL CDs, floppies and USB devices (don't worry, the keyboard and mouse will still function) to assist with malware removal & increase security. If this is an issue or makes it difficult for you, please let me know. This can be undone manually when we're finished. Read  *HERE * for an article written by dvk01 on why we disable autoruns.


----------



## shadowbird (Oct 9, 2012)

Thank you, Cookiegal. I ran the Combo fix. It indicated two antivirus programs open that were not showing up in my tray. Tried to disable them but it said they are still running, so I uninstalled them, then proceeded.

FYI: In case it helps, after the fix started, it gave me the following messages:

Data Execution Prevention - Microsoft Windows "To help protect your computer, windows has just closed this program. Data Execution Prevention helps protect against damage from viruses and other security threats. What should I do?

I ignored it and the fix continued to run, and that window disappeared. After Combofix rebooted the PC, another window popped up with this message:

"Inst Application has encountered an error and needs to close."

Since this is the type of message I was getting on my antivirus programs with the infection, I ignored it. That window disappeared and the fix continued.

Here is the log report:

ComboFix 12-10-15.01 - Francie 10/15/2012 22:31:49.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2532 [GMT -4:00]
Running from: c:\documents and settings\Francie\Desktop\ComboFix.exe
AV: AVG update module *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: ESET NOD32 Antivirus 5.2 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\Application Data\TEMP\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}\PostBuild.exe
c:\documents and settings\Francie\Application Data\PriceGong
c:\documents and settings\Francie\Application Data\PriceGong\Data\1.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\10.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\2121.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\2229.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\2637.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\2867.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\3003.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\3213.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\4002.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\4275.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\4471.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\5218.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\5259.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\5260.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\5352.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\5992.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\6781.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\898.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\946.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\a.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\b.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\c.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\d.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\e.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\f.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\g.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\h.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\i.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\j.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\k.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\l.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\m.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\Francie\Application Data\PriceGong\Data\n.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\o.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\p.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\q.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\r.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\s.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\t.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\u.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\v.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\w.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\wlu.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\x.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\y.txt
c:\documents and settings\Francie\Application Data\PriceGong\Data\z.txt
c:\documents and settings\Francie\g2mdlhlpx.exe
c:\documents and settings\Francie\My Documents\~WRL0036.tmp
c:\documents and settings\Francie\My Documents\~WRL0123.tmp
c:\documents and settings\Francie\My Documents\~WRL0358.tmp
c:\documents and settings\Francie\My Documents\~WRL0377.tmp
c:\documents and settings\Francie\My Documents\~WRL0818.tmp
c:\documents and settings\Francie\My Documents\~WRL0866.tmp
c:\documents and settings\Francie\My Documents\~WRL0938.tmp
c:\documents and settings\Francie\My Documents\~WRL0976.tmp
c:\documents and settings\Francie\My Documents\~WRL1294.tmp
c:\documents and settings\Francie\My Documents\~WRL1533.tmp
c:\documents and settings\Francie\My Documents\~WRL1710.tmp
c:\documents and settings\Francie\My Documents\~WRL1715.tmp
c:\documents and settings\Francie\My Documents\~WRL1756.tmp
c:\documents and settings\Francie\My Documents\~WRL2186.tmp
c:\documents and settings\Francie\My Documents\~WRL2241.tmp
c:\documents and settings\Francie\My Documents\~WRL2256.tmp
c:\documents and settings\Francie\My Documents\~WRL2555.tmp
c:\documents and settings\Francie\My Documents\~WRL2557.tmp
c:\documents and settings\Francie\My Documents\~WRL2764.tmp
c:\documents and settings\Francie\My Documents\~WRL2836.tmp
c:\documents and settings\Francie\My Documents\~WRL3133.tmp
c:\documents and settings\Francie\My Documents\~WRL3298.tmp
c:\documents and settings\Francie\My Documents\~WRL3536.tmp
c:\documents and settings\Francie\My Documents\~WRL3796.tmp
c:\documents and settings\Francie\My Documents\~WRL3800.tmp
c:\windows\system32\dllcache\dlimport.exe
c:\windows\system32\regobj.dll
c:\windows\system32\SET3E0.tmp
c:\windows\system32\SET3E4.tmp
c:\windows\system32\SET3EC.tmp
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\regtlib.exe
.
Infected copy of c:\windows\system32\ntdll.dll was found and disinfected 
Restored copy from - c:\windows\$hf_mig$\KB2393802\SP3QFE\ntdll.dll 
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NVSVC
-------\Service_nvsvc
.
.
((((((((((((((((((((((((( Files Created from 2012-09-16 to 2012-10-16 )))))))))))))))))))))))))))))))
.
.
2012-10-16 02:19 . 2012-10-16 02:19 -------- d-----w- c:\documents and settings\Francie\Local Settings\Application Data\Avg2013
2012-10-15 15:42 . 2012-10-15 15:42 -------- d-----w- c:\documents and settings\Default User\Application Data\TuneUp Software
2012-10-09 18:48 . 2012-10-09 18:48 -------- d--h--w- c:\windows\system32\GroupPolicy
2012-10-09 18:46 . 2012-10-09 18:46 -------- d-----w- c:\documents and settings\Francie\Local Settings\Application Data\Downloaded Installations
2012-10-02 17:47 . 2012-10-02 17:47 205072 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2012-09-28 03:38 . 2012-09-28 03:38 -------- d-----w- c:\documents and settings\Francie\Application Data\TuneUp Software
2012-09-27 21:34 . 2012-10-14 04:19 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2012-09-27 17:55 . 2012-09-27 17:55 -------- d-----w- c:\windows\system32\wbem\Repository
2012-09-27 17:51 . 2012-09-27 17:51 -------- d-----w- c:\program files\Microsoft.NET
2012-09-27 05:32 . 2012-10-16 02:22 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG2013
2012-09-27 05:32 . 2012-09-27 05:32 -------- d-----w- c:\program files\AVG
2012-09-27 03:32 . 2012-10-16 02:20 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2012-09-27 03:32 . 2012-09-27 03:32 -------- d-----w- c:\documents and settings\Francie\Local Settings\Application Data\MFAData
2012-09-27 03:22 . 2012-09-27 17:48 -------- d-----w- c:\program files\PC Cleaners(2)
2012-09-27 03:14 . 2012-09-27 03:14 -------- d-----w- c:\documents and settings\Francie\Application Data\PC Cleaners
2012-09-27 03:13 . 2012-09-27 03:22 -------- d-----w- c:\documents and settings\Francie\Application Data\PCPro
2012-09-27 03:13 . 2012-09-27 03:14 -------- d-----w- c:\documents and settings\All Users\Application Data\PC1Data
2012-09-26 05:41 . 2012-09-26 05:41 -------- d-----w- c:\documents and settings\Francie\Application Data\GFI Software
2012-09-26 04:00 . 2012-09-26 04:16 -------- d-----w- c:\documents and settings\All Users\Application Data\RegAce
2012-09-26 03:54 . 2010-11-26 02:54 302080 ----a-w- c:\windows\system32\ati2dvag.dll
2012-09-26 03:41 . 2012-09-26 03:41 -------- d-----w- C:\AMD
2012-09-16 15:22 . 2012-09-16 15:22 -------- d-----w- C:\found.000
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-10 23:49 . 2011-02-04 06:10 1682 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2012-10-04 02:54 . 2012-08-26 16:08 13024 ----a-w- c:\windows\system32\drivers\SWDUMon.sys
2012-06-14 22:20 . 2011-03-24 06:14 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2012-08-29 18:51 1014344 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2012-08-29 18:51 1014344 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2012-08-29 18:51 1014344 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-19 421888]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-05-15 15504192]
"NvMediaCenter"="NvMCTray.dll" [2012-05-15 108352]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2000-01-01 1634112]
"Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2012-08-29 1061960]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\Guest.FRANCIE-PC\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoStart IR.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AutoStart IR.lnk
backup=c:\windows\pss\AutoStart IR.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Qchex Tray Icon.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Qchex Tray Icon.lnk
backup=c:\windows\pss\Qchex Tray Icon.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinTV Recording Status..lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinTV Recording Status..lnk
backup=c:\windows\pss\WinTV Recording Status..lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Francie^Start Menu^Programs^Startup^CNET TechTracker.lnk]
path=c:\documents and settings\Francie\Start Menu\Programs\Startup\CNET TechTracker.lnk
backup=c:\windows\pss\CNET TechTracker.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Francie^Start Menu^Programs^Startup^Fanbase.lnk]
path=c:\documents and settings\Francie\Start Menu\Programs\Startup\Fanbase.lnk
backup=c:\windows\pss\Fanbase.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-07-27 20:51 919008 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2012-07-27 20:51 35768 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICustomerCare]
2010-05-04 21:05 311296 ----a-r- c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Carbonite Backup]
2012-08-29 18:51 1061960 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloudCare]
2011-06-25 16:59 96040 ----a-w- c:\program files\Bsecure\BsecTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriverMax]
2010-11-18 15:44 9221024 ----a-w- c:\program files\Innovative Solutions\DriverMax\devices.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
2007-02-26 06:01 437160 ----a-w- c:\progra~1\COMMON~1\MICROS~1\DW\DWTRIG20.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2011-07-28 20:59 136176 ----atw- c:\documents and settings\Francie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]
2000-01-01 00:00 41122448 ----a-w- c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2011-05-10 06:41 49208 ----a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Intuit SyncManager]
2010-10-19 10:58 1439496 ----a-w- c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-06-07 23:33 421776 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2012-05-15 09:40 15504192 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2012-05-15 09:40 108352 ----a-w- c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2000-01-01 00:00 1634112 ----a-w- c:\program files\NVIDIA Corporation\nView\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickFinder Scheduler]
2009-06-22 23:29 83232 ----a-w- c:\program files\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-19 02:16 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SlimDrivers]
2012-07-25 16:57 29357952 ----a-w- c:\program files\SlimDrivers\SlimDrivers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2010-11-26 02:32 98304 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-06-09 17:06 254696 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2011-02-04 16:06 273544 ----a-w- c:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
2010-07-04 19:51 17408 ----a-w- c:\program files\Unlocker\UnlockerAssistant.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VueMinder]
2012-02-11 14:25 7962624 ----a-w- c:\program files\VueSoft\VueMinder\VueMinder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
2004-03-18 13:33 892928 ----a-w- c:\program files\Logitech\iTouch\iTouch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"rpcapd"=3 (0x3)
"QBCFMonitorService"=2 (0x2)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
"Bonjour Service"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCPxpsp2res.dll,-22009
.
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [6/28/2012 6:33 PM 101112]
R2 Bsecure;CloudCare;c:\program files\Bsecure\InetCtrl.exe [4/2/2012 4:01 PM 66344]
R2 BsecureAV;CloudCare AntiVirus;c:\program files\Bsecure\BsecAV.exe [4/2/2012 4:01 PM 161776]
R2 KaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\KaraokeSer.exe [8/26/2012 12:11 PM 88688]
R2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\system32\NLSSRV32.EXE [4/12/2012 5:27 AM 69640]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [8/26/2012 3:03 PM 1262400]
R3 appliandMP;appliandMP;c:\windows\system32\drivers\appliand.sys [9/5/2011 11:41 PM 28256]
R3 BSecACFltr;BSecACFltr;c:\windows\system32\drivers\BSecACFltr.sys [4/2/2012 4:01 PM 21624]
R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [8/26/2012 12:36 PM 43392]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [8/26/2012 12:11 PM 2551664]
S0 gbgrrpg;gbgrrpg;c:\windows\system32\drivers\hcvfg.sys --> c:\windows\system32\drivers\hcvfg.sys [?]
S0 nhrmdtgf;nhrmdtgf;c:\windows\system32\drivers\gqtbt.sys --> c:\windows\system32\drivers\gqtbt.sys [?]
S3 appliand;Applian Network Service;c:\windows\system32\drivers\appliand.sys [9/5/2011 11:41 PM 28256]
S3 hcw72ADFilter;WinTV HVR-950 USB Audio Filter Driver;c:\windows\system32\drivers\hcw72ADFilter.sys [5/17/2011 10:43 AM 28928]
S3 hcw72ATV;WinTV HVR-950 NTSC;c:\windows\system32\drivers\hcw72ATV.sys [5/17/2011 10:43 AM 1217920]
S3 hcw72DTV;WinTV HVR-950 ATSC/QAM;c:\windows\system32\drivers\hcw72DTV.sys [5/17/2011 10:43 AM 1220224]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [9/5/2012 2:37 AM 22344]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [9/27/2012 5:34 PM 40776]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [8/4/2004 8:00 AM 14336]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [11/6/2007 4:22 PM 34064]
S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [8/26/2012 12:08 PM 13024]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/12/2011 5:44 PM 136176]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/12/2011 5:44 PM 136176]
S4 HauppaugeTVServer;HauppaugeTVServer;c:\progra~1\WinTV\TVServer\HAUPPA~1.EXE [9/15/2011 11:40 PM 558592]
S4 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [9/5/2012 2:37 AM 655944]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - BITS
*NewlyCreated* - WUAUSERV
*Deregistered* - BsecureFilter
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-06 c:\windows\Tasks\debutShakeIcon.job
- c:\program files\NCH Software\Debut\debut.exe [2011-04-03 14:08]
.
2012-09-28 c:\windows\Tasks\doxillionShakeIcon.job
- c:\program files\NCH Software\Doxillion\doxillion.exe [2011-01-12 21:59]
.
2012-10-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-12 21:44]
.
2012-10-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-12 21:44]
.
2012-10-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-616249376-839522115-1003Core.job
- c:\documents and settings\Francie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-08-29 20:59]
.
2012-10-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-616249376-839522115-1003UA.job
- c:\documents and settings\Francie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-08-29 20:59]
.
2012-07-25 c:\windows\Tasks\photostageShakeIcon.job
- c:\program files\NCH Software\PhotoStage\photostage.exe [2012-07-15 06:07]
.
2012-06-29 c:\windows\Tasks\prismDowngrade.job
- c:\program files\NCH Software\Prism\prism.exe [2011-09-19 16:51]
.
2011-12-22 c:\windows\Tasks\prismShakeIcon.job
- c:\program files\NCH Software\Prism\prism.exe [2011-09-19 16:51]
.
2012-10-16 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-10-16 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-10-16 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-10-16 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-10-16 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-09-12 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-09-22 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-10-10 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-01-20 c:\windows\Tasks\scribeSevenDaysInit.job
- c:\program files\NCH Swift Sound\Scribe\scribe.exe [2011-01-20 02:58]
.
2012-10-15 c:\windows\Tasks\scribeShakeIcon.job
- c:\program files\NCH Swift Sound\Scribe\scribe.exe [2011-01-20 02:58]
.
2012-10-15 c:\windows\Tasks\User_Feed_Synchronization-{259297A0-4E67-4E79-897A-4C8098A85E45}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 09:31]
.
2012-06-14 c:\windows\Tasks\videopadDowngrade.job
- c:\program files\NCH Software\VideoPad\videopad.exe [2011-09-19 16:52]
.
2012-05-16 c:\windows\Tasks\videopadShakeIcon.job
- c:\program files\NCH Software\VideoPad\videopad.exe [2011-09-19 16:52]
.
2011-10-06 c:\windows\Tasks\wavepadShakeIcon.job
- c:\program files\NCH Software\WavePad\wavepad.exe [2011-09-19 20:36]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: Copy to &Lightning Note - c:\program files\Corel\WordPerfect Lightning\Programs\WPLightningCopyToNote.hta
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: Open with WordPerfect - c:\program files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta
LSP: %ProgramFiles%\Bsecure\InetCtrl57.dll
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = 65.32.5.111 65.32.5.112
FF - ProfilePath - c:\documents and settings\Francie\Application Data\Mozilla\Firefox\Profiles\0tdbrp4t.default\
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=827316&p=
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=827316&p=
FF - prefs.js: network.proxy.type - 0
FF - user.js: extentions.y2layers.installId - 0cb749d1-f74c-4bd5-9adf-4877091b9912
FF - user.js: extentions.y2layers.defaultEnableAppsList - Buzzdock,Buzzdock,
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: security.csp.enable - false
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
Notify-TPSvc - TPSvc.dll
MSConfigStartUp-Ask and Record FLV Service - c:\program files\Replay Media Catcher\FLVSrvc.exe
MSConfigStartUp-AVG_UI - c:\program files\AVG\AVG2013\avgui.exe
MSConfigStartUp-BDRegion - c:\program files\Cyberlink\Shared files\brs.exe
MSConfigStartUp-Freecorder FLV Service - c:\program files\Freecorder\FLVSrvc.exe
MSConfigStartUp-MSC - c:\program files\Microsoft Security Client\msseces.exe
MSConfigStartUp-RemoteControl10 - c:\program files\CyberLink\PowerDVD10\PDVD10Serv.exe
MSConfigStartUp-ROC_ROC_NT - c:\program files\AVG Secure Search\ROC_ROC_NT.exe
MSConfigStartUp-SearchSettings - c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe
MSConfigStartUp-SelectRebates - c:\program files\SelectRebates\SelectRebates.exe
MSConfigStartUp-vProt - c:\program files\AVG Secure Search\vprot.exe
MSConfigStartUp-WMUTray - c:\program files\WakeMeUp\WMUTray.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-10-15 22:42
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1132)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
- - - - - - - > 'explorer.exe'(2440)
c:\windows\system32\WININET.dll
c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Carbonite\Carbonite Backup\carboniteservice.exe
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Bsecure\BSecAMX.exe
c:\windows\system32\devldr32.exe
.
**************************************************************************
.
Completion time: 2012-10-15 22:49:11 - machine was rebooted
ComboFix-quarantined-files.txt 2012-10-16 02:49
.
Pre-Run: 86,654,783,488 bytes free
Post-Run: 89,766,346,752 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - FA65D45B5088DC0D12AC37482566259E


----------



## shadowbird (Oct 9, 2012)

FYI: After running combofix yesterday, my backup system (Carbonite) is no longer running. I recall you said whatever it disables can be restored. Hopefully the backup system can be restored soon, so I won't lose important data in the process. Thank you again for your help. : )


----------



## shadowbird (Oct 9, 2012)

I tried to reinstall Carbonite backup system, and it still won't work. Also, my PC used to work for a short period without safe mode. After using that repair module, now it's so slow, I can hardly use it at all.


----------



## Cookiegal (Aug 27, 2003)

That's odd because ComboFix didn't delete anything related to Carbonite. In fact, it shows it's running.

Open Notepad and copy and paste the text in the code box below into it:


```
File::
c:\windows\system32\drivers\hcvfg.sys
c:\windows\system32\drivers\gqtbt.sys

Driver::
gbgrrpg
nhrmdtgf
```
Save the file to your desktop and name it CFScript.txt

Referring to the picture below, drag CFScript.txt into ComboFix.exe










This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.


----------



## shadowbird (Oct 9, 2012)

Thank you, Cookiegal. I did get an error message about exfiwyyu.dll missing, after it ran again, when Windows came back up. I see it's listed on the logfile as "orphan removed."

ComboFix 12-10-16.02 - Francie 10/16/2012 17:01:12.2.2 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2804 [GMT -4:00]
Running from: c:\documents and settings\Francie\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Francie\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 5.2 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
FILE ::
"c:\windows\system32\drivers\gqtbt.sys"
"c:\windows\system32\drivers\hcvfg.sys"
.
_ ADS - WINDOWS: deleted 192 bytes in 1 streams. _
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Francie\Local Settings\Application Data\Aiseesoft Studio\Adobe\exfiwyyu.dll
c:\windows\system32\msstdfmt.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gbgrrpg
-------\Service_nhrmdtgf
.
.
((((((((((((((((((((((((( Files Created from 2012-09-17 to 2012-10-17 )))))))))))))))))))))))))))))))
.
.
2012-10-16 02:19 . 2012-10-16 02:19 -------- d-----w- c:\documents and settings\Francie\Local Settings\Application Data\Avg2013
2012-10-15 15:42 . 2012-10-15 15:42 -------- d-----w- c:\documents and settings\Default User\Application Data\TuneUp Software
2012-10-09 18:48 . 2012-10-09 18:48 -------- d--h--w- c:\windows\system32\GroupPolicy
2012-10-09 18:46 . 2012-10-09 18:46 -------- d-----w- c:\documents and settings\Francie\Local Settings\Application Data\Downloaded Installations
2012-10-02 17:47 . 2012-10-02 17:47 205072 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2012-09-28 03:38 . 2012-09-28 03:38 -------- d-----w- c:\documents and settings\Francie\Application Data\TuneUp Software
2012-09-27 21:34 . 2012-10-14 04:19 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2012-09-27 17:55 . 2012-09-27 17:55 -------- d-----w- c:\windows\system32\wbem\Repository
2012-09-27 17:51 . 2012-09-27 17:51 -------- d-----w- c:\program files\Microsoft.NET
2012-09-27 05:32 . 2012-10-16 02:22 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG2013
2012-09-27 05:32 . 2012-09-27 05:32 -------- d-----w- c:\program files\AVG
2012-09-27 03:32 . 2012-10-16 02:20 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2012-09-27 03:32 . 2012-09-27 03:32 -------- d-----w- c:\documents and settings\Francie\Local Settings\Application Data\MFAData
2012-09-27 03:22 . 2012-09-27 17:48 -------- d-----w- c:\program files\PC Cleaners(2)
2012-09-27 03:14 . 2012-09-27 03:14 -------- d-----w- c:\documents and settings\Francie\Application Data\PC Cleaners
2012-09-27 03:13 . 2012-09-27 03:22 -------- d-----w- c:\documents and settings\Francie\Application Data\PCPro
2012-09-27 03:13 . 2012-09-27 03:14 -------- d-----w- c:\documents and settings\All Users\Application Data\PC1Data
2012-09-26 05:41 . 2012-09-26 05:41 -------- d-----w- c:\documents and settings\Francie\Application Data\GFI Software
2012-09-26 04:00 . 2012-09-26 04:16 -------- d-----w- c:\documents and settings\All Users\Application Data\RegAce
2012-09-26 03:54 . 2010-11-26 02:54 302080 ----a-w- c:\windows\system32\ati2dvag.dll
2012-09-26 03:41 . 2012-09-26 03:41 -------- d-----w- C:\AMD
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-10 23:49 . 2011-02-04 06:10 1682 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2012-10-04 02:54 . 2012-08-26 16:08 13024 ----a-w- c:\windows\system32\drivers\SWDUMon.sys
2012-08-28 15:14 . 2004-08-04 12:00 916992 ----a-w- c:\windows\system32\wininet.dll
2012-08-28 15:14 . 2004-08-04 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-08-28 15:14 . 2004-08-04 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07 . 2004-08-04 12:00 385024 ----a-w- c:\windows\system32\html.iec
2012-08-24 13:53 . 2004-08-04 12:00 177664 ----a-w- c:\windows\system32\wintrust.dll
2012-08-21 13:33 . 2004-08-04 12:00 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58 . 2004-08-03 22:59 2027520 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-06-14 22:20 . 2011-03-24 06:14 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2012-09-14 01:14 1014856 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2012-09-14 01:14 1014856 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2012-09-14 01:14 1014856 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-19 421888]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-05-15 15504192]
"NvMediaCenter"="NvMCTray.dll" [2012-05-15 108352]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2000-01-01 1634112]
"Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2012-09-14 1065032]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\Guest.FRANCIE-PC\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoStart IR.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AutoStart IR.lnk
backup=c:\windows\pss\AutoStart IR.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Qchex Tray Icon.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Qchex Tray Icon.lnk
backup=c:\windows\pss\Qchex Tray Icon.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinTV Recording Status..lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinTV Recording Status..lnk
backup=c:\windows\pss\WinTV Recording Status..lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Francie^Start Menu^Programs^Startup^CNET TechTracker.lnk]
path=c:\documents and settings\Francie\Start Menu\Programs\Startup\CNET TechTracker.lnk
backup=c:\windows\pss\CNET TechTracker.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Francie^Start Menu^Programs^Startup^Fanbase.lnk]
path=c:\documents and settings\Francie\Start Menu\Programs\Startup\Fanbase.lnk
backup=c:\windows\pss\Fanbase.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-07-27 20:51 919008 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2012-07-27 20:51 35768 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICustomerCare]
2010-05-04 21:05 311296 ----a-r- c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Carbonite Backup]
2012-09-14 01:14 1065032 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloudCare]
2011-06-25 16:59 96040 ----a-w- c:\program files\Bsecure\BsecTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriverMax]
2010-11-18 15:44 9221024 ----a-w- c:\program files\Innovative Solutions\DriverMax\devices.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
2007-02-26 06:01 437160 ----a-w- c:\progra~1\COMMON~1\MICROS~1\DW\DWTRIG20.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2011-07-28 20:59 136176 ----atw- c:\documents and settings\Francie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]
2000-01-01 00:00 41122448 ----a-w- c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2011-05-10 06:41 49208 ----a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Intuit SyncManager]
2010-10-19 10:58 1439496 ----a-w- c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-06-07 23:33 421776 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2012-05-15 09:40 15504192 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2012-05-15 09:40 108352 ----a-w- c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2000-01-01 00:00 1634112 ----a-w- c:\program files\NVIDIA Corporation\nView\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickFinder Scheduler]
2009-06-22 23:29 83232 ----a-w- c:\program files\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-19 02:16 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SlimDrivers]
2012-07-25 16:57 29357952 ----a-w- c:\program files\SlimDrivers\SlimDrivers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2010-11-26 02:32 98304 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-06-09 17:06 254696 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2011-02-04 16:06 273544 ----a-w- c:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
2010-07-04 19:51 17408 ----a-w- c:\program files\Unlocker\UnlockerAssistant.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VueMinder]
2012-02-11 14:25 7962624 ----a-w- c:\program files\VueSoft\VueMinder\VueMinder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
2004-03-18 13:33 892928 ----a-w- c:\program files\Logitech\iTouch\iTouch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"rpcapd"=3 (0x3)
"QBCFMonitorService"=2 (0x2)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
"Bonjour Service"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCPxpsp2res.dll,-22009
.
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [6/28/2012 6:33 PM 101112]
R2 Bsecure;CloudCare;c:\program files\Bsecure\InetCtrl.exe [4/2/2012 4:01 PM 66344]
R2 BsecureAV;CloudCare AntiVirus;c:\program files\Bsecure\BsecAV.exe [4/2/2012 4:01 PM 161776]
R2 KaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\KaraokeSer.exe [8/26/2012 12:11 PM 88688]
R2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\system32\NLSSRV32.EXE [4/12/2012 5:27 AM 69640]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [8/26/2012 3:03 PM 1262400]
R3 appliandMP;appliandMP;c:\windows\system32\drivers\appliand.sys [9/5/2011 11:41 PM 28256]
R3 BSecACFltr;BSecACFltr;c:\windows\system32\drivers\BSecACFltr.sys [4/2/2012 4:01 PM 21624]
R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [8/26/2012 12:36 PM 43392]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [8/26/2012 12:11 PM 2551664]
S3 appliand;Applian Network Service;c:\windows\system32\drivers\appliand.sys [9/5/2011 11:41 PM 28256]
S3 hcw72ADFilter;WinTV HVR-950 USB Audio Filter Driver;c:\windows\system32\drivers\hcw72ADFilter.sys [5/17/2011 10:43 AM 28928]
S3 hcw72ATV;WinTV HVR-950 NTSC;c:\windows\system32\drivers\hcw72ATV.sys [5/17/2011 10:43 AM 1217920]
S3 hcw72DTV;WinTV HVR-950 ATSC/QAM;c:\windows\system32\drivers\hcw72DTV.sys [5/17/2011 10:43 AM 1220224]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [9/5/2012 2:37 AM 22344]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [9/27/2012 5:34 PM 40776]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [8/4/2004 8:00 AM 14336]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [11/6/2007 4:22 PM 34064]
S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [8/26/2012 12:08 PM 13024]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/12/2011 5:44 PM 136176]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/12/2011 5:44 PM 136176]
S4 HauppaugeTVServer;HauppaugeTVServer;c:\progra~1\WinTV\TVServer\HAUPPA~1.EXE [9/15/2011 11:40 PM 558592]
S4 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [9/5/2012 2:37 AM 655944]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - BsecureFilter
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-06 c:\windows\Tasks\debutShakeIcon.job
- c:\program files\NCH Software\Debut\debut.exe [2011-04-03 14:08]
.
2012-09-28 c:\windows\Tasks\doxillionShakeIcon.job
- c:\program files\NCH Software\Doxillion\doxillion.exe [2011-01-12 21:59]
.
2012-10-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-12 21:44]
.
2012-10-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-12 21:44]
.
2012-10-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-616249376-839522115-1003Core.job
- c:\documents and settings\Francie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-08-29 20:59]
.
2012-10-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-616249376-839522115-1003UA.job
- c:\documents and settings\Francie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-08-29 20:59]
.
2012-07-25 c:\windows\Tasks\photostageShakeIcon.job
- c:\program files\NCH Software\PhotoStage\photostage.exe [2012-07-15 06:07]
.
2012-06-29 c:\windows\Tasks\prismDowngrade.job
- c:\program files\NCH Software\Prism\prism.exe [2011-09-19 16:51]
.
2011-12-22 c:\windows\Tasks\prismShakeIcon.job
- c:\program files\NCH Software\Prism\prism.exe [2011-09-19 16:51]
.
2012-10-17 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-10-17 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-10-17 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-10-17 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-10-17 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-09-12 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-09-22 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-10-10 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-01-20 c:\windows\Tasks\scribeSevenDaysInit.job
- c:\program files\NCH Swift Sound\Scribe\scribe.exe [2011-01-20 02:58]
.
2012-10-16 c:\windows\Tasks\scribeShakeIcon.job
- c:\program files\NCH Swift Sound\Scribe\scribe.exe [2011-01-20 02:58]
.
2012-10-16 c:\windows\Tasks\User_Feed_Synchronization-{259297A0-4E67-4E79-897A-4C8098A85E45}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 09:31]
.
2012-06-14 c:\windows\Tasks\videopadDowngrade.job
- c:\program files\NCH Software\VideoPad\videopad.exe [2011-09-19 16:52]
.
2012-05-16 c:\windows\Tasks\videopadShakeIcon.job
- c:\program files\NCH Software\VideoPad\videopad.exe [2011-09-19 16:52]
.
2011-10-06 c:\windows\Tasks\wavepadShakeIcon.job
- c:\program files\NCH Software\WavePad\wavepad.exe [2011-09-19 20:36]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: Copy to &Lightning Note - c:\program files\Corel\WordPerfect Lightning\Programs\WPLightningCopyToNote.hta
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: Open with WordPerfect - c:\program files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta
LSP: %ProgramFiles%\Bsecure\InetCtrl57.dll
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = 65.32.5.111 65.32.5.112
FF - ProfilePath - c:\documents and settings\Francie\Application Data\Mozilla\Firefox\Profiles\0tdbrp4t.default\
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=827316&p=
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=827316&p=
FF - prefs.js: network.proxy.type - 0
FF - user.js: extentions.y2layers.installId - 0cb749d1-f74c-4bd5-9adf-4877091b9912
FF - user.js: extentions.y2layers.defaultEnableAppsList - Buzzdock,Buzzdock,
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: security.csp.enable - false
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-Adobe - c:\documents and settings\Francie\Local Settings\Application Data\Aiseesoft Studio\Adobe\exfiwyyu.dll
HKU-Default-Run-Adobe - c:\documents and settings\Francie\Local Settings\Application Data\Aiseesoft Studio\Adobe\exfiwyyu.dll
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-10-17 04:44
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1124)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
- - - - - - - > 'lsass.exe'(1180)
c:\program files\Bsecure\InetCtrl57.dll
.
- - - - - - - > 'explorer.exe'(2880)
c:\windows\system32\WININET.dll
c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Carbonite\Carbonite Backup\carboniteservice.exe
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Bsecure\BSecAMX.exe
c:\windows\system32\devldr32.exe
c:\windows\System32\vssvc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\msdtc.exe
.
**************************************************************************
.
Completion time: 2012-10-17 04:48:32 - machine was rebooted
ComboFix-quarantined-files.txt 2012-10-17 08:48
ComboFix2.txt 2012-10-16 02:49
.
Pre-Run: 88,902,766,592 bytes free
Post-Run: 89,084,792,832 bytes free
.
- - End Of File - - 8C84F4AD95BA9B990AA6BFB1B1B53568


----------



## Cookiegal (Aug 27, 2003)

Please download aswMBR.exe and save it to your desktop.

Double click aswMBR.exe to start the tool (Vista/Windows 7 users - right click to run as administrator) and allow it to download the Avast database.

Click *Scan*.

Upon completion of the scan, click *Save log* then save it to your desktop and post that log in your next reply for review. 
*Note - do NOT attempt any Fix yet. *


----------



## shadowbird (Oct 9, 2012)

Downloading it now to run it. 

FYI: new error message upon bootup: BSecure (a security program for parents):
"inst.exe failed with 1073741819


----------



## shadowbird (Oct 9, 2012)

Here's the log. It was set on "Quickscan" so I left it there. I started a complete scan of C drive, but that will probably take all night, and maybe longer, in safe mode. Let me know if I need to keep that one going or not.

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-10-17 20:23:20
-----------------------------
20:23:20.968 OS Version: Windows 5.1.2600 Service Pack 3
20:23:20.968 Number of processors: 2 586 0x602
20:23:20.968 ComputerName: FRANCIE-PC UserName: Francie
20:23:21.546 Initialize success
20:31:04.109 AVAST engine defs: 12101701
21:04:00.687 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
21:04:00.718 Disk 0 Vendor: SAMSUNG_HD322HJ 1AC01118 Size: 305245MB BusType: 3
21:04:00.781 Disk 0 MBR read successfully
21:04:00.828 Disk 0 MBR scan
21:04:00.890 Disk 0 Windows XP default MBR code
21:04:00.937 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 305234 MB offset 63
21:04:00.984 Disk 0 scanning sectors +625121280
21:04:01.093 Disk 0 scanning C:\WINDOWS\system32\drivers
21:04:08.484 Service scanning
21:04:23.890 Modules scanning
21:04:27.171 Disk 0 trace - called modules:
21:04:27.281 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 
21:04:27.328 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8b43cab8]
21:04:27.375 3 CLASSPNP.SYS[f7637fd7] -> nt!IofCallDriver -> \Device\00000070[0x8b43f920]
21:04:27.468 5 ACPI.sys[f75ae620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8b43fd98]
21:04:28.078 AVAST engine scan C:\WINDOWS
21:04:35.046 AVAST engine scan C:\WINDOWS\system32
21:06:50.015 AVAST engine scan C:\WINDOWS\system32\drivers
21:07:04.921 AVAST engine scan C:\Documents and Settings\Francie
21:47:03.968 AVAST engine scan C:\Documents and Settings\All Users
21:50:09.125 Scan finished successfully
22:34:09.890 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Francie\Desktop\MBR.dat"
22:34:09.937 The log file has been saved successfully to "C:\Documents and Settings\Francie\Desktop\aswMBR.txt"


----------



## Cookiegal (Aug 27, 2003)

Download *OTS.exe * to your Desktop. 

Close any open browsers.
If your Real protection or Antivirus interferes with OTS, allow it to run.
Double-click on *OTS.exe* to start the program.
At the top put a check mark in the box beside "Scan All Users".
Under the *Additional Scans *section put a check in the box next to Disabled MS Config Items, NetSvcs and EventViewer logs (Last 10 errors)
Now click the *Run Scan *button on the toolbar.
Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Save that notepad file.
Use the *Reply* button, scroll down to the attachments section and attach the notepad file here.


----------



## shadowbird (Oct 9, 2012)

Okay, getting ready to do that. I received the message that Inst32.exe has to close again and copied the data, in case it helps:

Error signature
szAppName: Inst32.exe szAppVer: 1.0.k.1 szModName: Inst 32.exe
szModVer: 1.0.0.1 offset: 00001612

The following files will be included in this error report:
C\DOCUMEN~1\Francie\LOCALS~1\Temp\WERabc2.dir00\Inst32.exe.mdmp
C\DOCUMEN~1\Francie\LOCALS~1\Temp\WERabc2.dir00\appcompat.txt

Also error message for BSecure came up again


----------



## shadowbird (Oct 9, 2012)

I am concerned about using this program before reversing whatever Combofix did to my PC. I understood from you that we would reverse the things Combofix would be disabling (drivers?) afer using it. Ever since installing Combofix I no longer have printers installed, and there are other issues and probably issues I am not aware of. It has been much slower and popping up error message I've never seen before, 

I had read on the web site not to uninstall it until we are sure nothing needs to be undone that it caused. Please advise as to how to reverse the problems from Combofix before I delete it with this new tool.

Thanks!


----------



## Cookiegal (Aug 27, 2003)

Please navigate to this file and copy and paste the contents here so we can see what was deleted:

*C:\QooBox\ComboFix-quarantined-files.txt *


----------



## shadowbird (Oct 9, 2012)

Thank you. WHen you look at this, would you please tell me what Combofix deleted that was malware? 2012-10-17 08:47:21 . 2012-10-17 08:47:21 232 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKU-Default-Run-Adobe.reg.dat2012-10-17 08:47:19 . 2012-10-17 08:47:19 230 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKCU-Run-Adobe.reg.dat2012-10-16 21:06:32 . 2012-10-16 21:06:32 1,024 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Service_nhrmdtgf.reg.dat2012-10-16 21:06:32 . 2012-10-16 21:06:32 1,016 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Service_gbgrrpg.reg.dat2012-10-16 21:01:10 . 2012-10-16 21:01:10 0 ----a-w- C:\Qoobox\Quarantine\catchme.txt2012-10-16 16:48:24 . 2012-10-16 16:48:24 420,352 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Local Settings\Application Data\Aiseesoft Studio\Adobe\exfiwyyu.dll.vir2012-10-16 02:47:55 . 2012-10-16 02:47:55 586 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-WMUTray.reg.dat2012-10-16 02:47:55 . 2012-10-16 02:47:55 592 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-vProt.reg.dat2012-10-16 02:47:55 . 2012-10-16 02:47:55 624 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-SelectRebates.reg.dat2012-10-16 02:47:55 . 2012-10-16 02:47:55 686 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-SearchSettings.reg.dat2012-10-16 02:47:55 . 2012-10-16 02:47:55 670 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-ROC_ROC_NT.reg.dat2012-10-16 02:47:54 . 2012-10-16 02:47:54 640 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-RemoteControl10.reg.dat2012-10-16 02:47:54 . 2012-10-16 02:47:54 640 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-MSC.reg.dat2012-10-16 02:47:54 . 2012-10-16 02:47:54 630 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-Freecorder FLV Service.reg.dat2012-10-16 02:47:53 . 2012-10-16 02:47:53 594 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-BDRegion.reg.dat2012-10-16 02:47:53 . 2012-10-16 02:47:53 604 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-AVG_UI.reg.dat2012-10-16 02:47:53 . 2012-10-16 02:47:53 658 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-Ask and Record FLV Service.reg.dat2012-10-16 02:47:51 . 2012-10-16 02:47:51 484 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Notify-TPSvc.reg.dat2012-10-16 02:47:44 . 2012-10-16 02:47:44 249 ----a-w- C:\Qoobox\Quarantine\Registry_backups\WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}.reg.dat2012-10-16 02:47:44 . 2012-10-16 02:47:44 171 ----a-w- C:\Qoobox\Quarantine\Registry_backups\WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440}.reg.dat2012-10-16 02:35:18 . 2012-10-16 02:35:18 2,532 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Service_nvsvc.reg.dat2012-10-16 02:35:18 . 2012-10-16 02:35:18 1,048 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_NVSVC.reg.dat2012-10-16 02:35:08 . 2012-10-16 21:06:19 6,037 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg2012-10-16 02:34:26 . 2011-09-19 21:23:04 792 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\2\Launch Microsoft Outlook.lnk2012-10-16 02:34:26 . 2011-01-11 06:27:34 79 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\2\Show Desktop.scf2012-10-16 02:34:26 . 2011-02-04 06:39:09 800 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\2\Windows Media Player.lnk2012-10-16 02:34:26 . 2011-01-11 06:27:34 119 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\2\desktop.ini2012-10-16 02:34:26 . 2011-09-18 17:13:52 2,278 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\2\Google Chrome.lnk2012-10-16 02:34:26 . 2011-02-15 19:12:00 815 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\2\Launch Internet Explorer Browser.lnk2012-10-16 02:34:26 . 2012-05-25 07:11:06 1,854 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\2\Apple Safari.lnk2012-10-16 02:34:26 . 2011-08-29 22:33:42 1,638 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\2\Applian Director.lnk2012-10-16 02:34:26 . 2011-02-04 03:42:41 2,202 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect OfficeReady\Uninstall WordPerfect OfficeReady.lnk2012-10-16 02:34:26 . 2011-02-04 03:42:41 2,264 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect OfficeReady\WordPerfect OfficeReady Help.lnk2012-10-16 02:34:26 . 2011-02-04 03:42:41 1,708 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect OfficeReady\WordPerfect OfficeReady Templates Folder.lnk2012-10-16 02:34:26 . 2011-02-04 03:42:41 1,875 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect OfficeReady\Start WordPerfect OfficeReady.lnk2012-10-16 02:34:26 . 2011-02-04 03:42:41 2,248 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect OfficeReady\Corel Corporation Website.lnk2012-10-16 02:34:26 . 2011-02-04 03:42:41 2,266 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect OfficeReady\Readme for WordPerfect OfficeReady.lnk2012-10-16 02:34:26 . 2011-02-04 06:21:50 2,577 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Utilities\Pleading Expert.lnk2012-10-16 02:34:26 . 2011-02-04 06:21:32 2,639 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Utilities\QuickFinder Manager.lnk2012-10-16 02:34:26 . 2011-02-04 06:21:32 2,593 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Utilities\QuickFinder Searcher.lnk2012-10-16 02:34:26 . 2011-02-04 06:22:48 1,178 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Utilities\Spell Utility.lnk2012-10-16 02:34:26 . 2011-02-04 06:21:49 2,553 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Utilities\WordPerfect XML Project Designer.lnk2012-10-16 02:34:26 . 2011-02-04 06:21:32 2,635 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Utilities\Clipbook.lnk2012-10-16 02:34:26 . 2011-02-04 06:21:32 2,587 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Utilities\Conversion Utility.lnk2012-10-16 02:34:26 . 2011-02-04 06:21:32 2,587 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Utilities\PerfectScript.lnk2012-10-16 02:34:26 . 2011-02-04 06:22:48 1,265 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Support\Technical Support Online.lnk2012-10-16 02:34:26 . 2011-02-04 06:22:48 1,295 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Support\Technical Support Help.lnk2012-10-16 02:34:26 . 2012-06-07 08:26:39 2,639 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\WordPerfect X4.lnk2012-10-16 02:34:26 . 2011-02-04 06:22:48 1,128 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Support\Guidebook (.PDF).lnk2012-10-16 02:34:26 . 2011-02-04 06:22:48 1,379 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Support\Microsoft Office Compatibility.lnk2012-10-16 02:34:26 . 2011-02-04 06:10:42 2,717 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\WordPerfect Lightning.lnk2012-10-16 02:34:26 . 2012-03-25 07:24:29 2,595 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Quattro Pro X4.lnk2012-10-16 02:34:25 . 2011-02-04 06:22:01 1,135 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Presentations X4.lnk2012-10-16 02:34:25 . 2011-02-04 06:22:01 2,101 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Presentations Graphics X4.lnk2012-10-16 02:34:25 . 2011-09-14 04:03:12 704 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WinRAR\WinRAR.lnk2012-10-16 02:34:25 . 2011-02-04 06:21:32 2,083 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\New Project.lnk2012-10-16 02:34:25 . 2011-09-14 04:03:12 704 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WinRAR\WinRAR help.lnk2012-10-16 02:34:25 . 2011-09-14 04:03:12 685 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WinRAR\Console RAR manual.lnk2012-10-16 02:34:25 . 2011-08-29 22:33:22 49 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WinPcap\WinPcap Web Site.url2012-10-16 02:34:25 . 2011-08-29 22:33:22 680 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WinPcap\Uninstall WinPcap 4.0.2.lnk2012-10-16 02:34:25 . 2012-02-14 02:48:24 1,670 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\VueMinder Pro\VueMinder Pro.lnk2012-10-16 02:34:25 . 2012-02-14 02:48:24 1,777 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\VueMinder Pro\Help Documentation (Online).lnk2012-10-16 02:34:25 . 2011-01-15 17:31:43 47 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\VPedal Windows Media Player 11 64bit Plug-in\VPedal website on the Web.url2012-10-16 02:34:25 . 2011-01-15 17:31:44 862 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\VPedal Windows Media Player 11 64bit Plug-in\VPedal WMP11 Settings.lnk2012-10-16 02:34:25 . 2011-01-15 17:31:44 822 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\VPedal Windows Media Player 11 64bit Plug-in\Uninstall VPedal Windows Media Player Plug-in.lnk2012-10-16 02:34:25 . 2011-09-19 16:52:40 777 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Video Related Programs\VideoPad Video Editor.lnk2012-10-16 02:34:25 . 2011-09-19 16:52:40 821 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Video Related Programs\Video Tape to DVD Converter.lnk2012-10-16 02:34:24 . 2011-09-19 16:52:40 813 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Video Related Programs\Video Streaming Server.lnk2012-10-16 02:34:24 . 2011-09-19 16:52:40 807 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Video Related Programs\Video File Format Converter.lnk2012-10-16 02:34:24 . 2011-09-19 16:52:40 807 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Video Related Programs\Video Capture Software.lnk2012-10-16 02:34:24 . 2011-09-19 16:52:40 817 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Video Related Programs\Slideshow Creator Software.lnk2012-10-16 02:34:24 . 2011-11-25 05:29:06 849 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\VersaCheck 2003 Personal Premier\VersaCheck Update.lnk2012-10-16 02:34:24 . 2011-01-12 21:59:58 821 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Utilities\Typing Expander Software.lnk2012-10-16 02:34:24 . 2011-01-12 21:59:58 817 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Utilities\Uploader Software.lnk2012-10-16 02:34:24 . 2011-11-25 05:29:06 817 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\VersaCheck 2003 Personal Premier\VersaCheck 2003.lnk2012-10-16 02:34:24 . 2011-01-12 21:59:58 787 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Utilities\Doxillion Document Converter.lnk2012-10-16 02:34:24 . 2011-01-12 21:59:58 813 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Utilities\Encryption and Decryption Software.lnk2012-10-16 02:34:24 . 2011-01-12 21:59:58 821 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Utilities\Text-to-Speech Reader.lnk2012-10-16 02:34:24 . 2011-01-12 21:59:58 827 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Utilities\Classic FTP Software.lnk2012-10-16 02:34:24 . 2011-01-12 21:59:58 823 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Utilities\Backup Software.lnk2012-10-16 02:34:24 . 2011-01-12 21:59:58 829 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Utilities\CD, DVD, BluRay Burner.lnk2012-10-16 02:34:24 . 2011-10-18 07:35:52 2,417 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\TurboTax Business 2010\TurboTax Business 2010.lnk2012-10-16 02:34:24 . 2011-01-11 06:23:45 84 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Startup\desktop.ini2012-10-16 02:34:24 . 2011-09-13 00:32:01 1,730 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Startup\Microsoft Office.lnk2012-10-16 02:34:24 . 2011-10-18 06:42:27 2,459 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\TurboTax 2010\TurboTax 2010.lnk2012-10-16 02:34:24 . 2011-01-17 07:14:19 875 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Spybot - Search & Destroy\Update Spybot-S&D.lnk2012-10-16 02:34:24 . 2011-01-17 07:14:19 951 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Spybot - Search & Destroy\Tutorial.lnk2012-10-16 02:34:24 . 2011-01-17 07:14:19 961 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Spybot - Search & Destroy\Uninstall Spybot-S&D.lnk2012-10-16 02:34:24 . 2011-02-02 00:37:35 651 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Sony Player Plug-in for WMP\Readme.lnk2012-10-16 02:34:24 . 2011-01-17 07:14:19 945 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Spybot - Search & Destroy\Spybot - Search & Destroy.lnk2012-10-16 02:34:24 . 2011-01-21 04:56:19 1,708 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Security Task Manager\Manual.lnk2012-10-16 02:34:24 . 2011-01-21 04:56:19 992 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Security Task Manager\Purchase Security Task Manager Now!.lnk2012-10-16 02:34:24 . 2011-01-21 04:56:19 822 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Security Task Manager\Security Task Manager.lnk2012-10-16 02:34:24 . 2011-01-21 04:56:19 833 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Security Task Manager\Spy Protector.lnk2012-10-16 02:34:24 . 2011-01-21 04:56:19 805 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Security Task Manager\Uninstall.lnk2012-10-16 02:34:24 . 2012-05-15 06:05:18 933 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Shutterfly\Shutterfly Express Uploader.lnk2012-10-16 02:34:24 . 2011-01-21 04:56:19 1,706 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Security Task Manager\Help.lnk2012-10-16 02:34:24 . 2011-09-13 16:46:06 1,351 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Recuva\Uninstall Recuva.lnk2012-10-16 02:34:24 . 2011-02-04 16:06:27 792 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Real\RealPlayer Trimmer.lnk2012-10-16 02:34:24 . 2011-02-04 16:06:15 765 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Real\RealPlayer.lnk2012-10-16 02:34:24 . 2011-09-13 16:46:06 80 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Recuva\Recuva Homepage.url2012-10-16 02:34:24 . 2011-09-13 16:46:06 1,524 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Recuva\Recuva.lnk2012-10-16 02:34:24 . 2011-02-04 16:06:32 850 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Real\RealPlayer Converter.lnk2012-10-16 02:34:24 . 2012-05-25 07:09:45 1,812 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\QuickTime\PictureViewer.lnk2012-10-16 02:34:24 . 2012-05-25 07:09:45 1,802 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\QuickTime\QuickTime Player.lnk2012-10-16 02:34:24 . 2012-05-25 07:09:45 1,639 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\QuickTime\Uninstall QuickTime.lnk2012-10-16 02:34:24 . 2012-05-25 07:09:45 1,802 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\QuickTime\About QuickTime.lnk2012-10-16 02:34:23 . 2011-01-18 07:10:55 1,902 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\QuickBooks\QuickBooks Database Server Manager.lnk2012-10-16 02:34:23 . 2011-01-18 07:10:55 1,886 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\QuickBooks\QuickBooks Pro 2010.lnk2012-10-16 02:34:23 . 2011-01-18 07:10:55 2,009 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\QuickBooks\Web Connector.lnk2012-10-16 02:34:23 . 2011-01-18 07:11:17 1,573 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\QuickBooks\Install QuickBooks Timer.lnk2012-10-16 02:34:23 . 2011-11-25 05:29:06 1,909 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Qchex Check Messenger\Qchex Tray Icon.lnk2012-10-16 02:34:23 . 2011-11-25 05:29:06 1,928 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Qchex Check Messenger\Qchex Check Messenger.lnk2012-10-16 02:34:23 . 2011-01-19 21:22:17 49 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Phyxion.net\Driver Sweeper\Driver Sweeper on the Web.url2012-10-16 02:34:23 . 2011-08-04 20:07:53 729 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\Licenses\GPL License.lnk2012-10-16 02:34:23 . 2011-08-04 20:07:53 754 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\Licenses\FairPlay License.lnk2012-10-16 02:34:23 . 2011-08-04 20:07:53 734 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\Licenses\AFPL License.lnk2012-10-16 02:34:23 . 2011-08-04 20:07:54 829 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\Translation Tool.lnk2012-10-16 02:34:23 . 2011-08-04 20:07:53 1,592 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\PDFCreator.lnk2012-10-16 02:34:23 . 2011-08-04 20:07:54 1,415 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\PDFCreator on the Web.lnk2012-10-16 02:34:23 . 2011-08-04 20:07:54 758 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\PDFCreator Help.lnk2012-10-16 02:34:23 . 2011-08-04 20:07:53 701 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\History.lnk2012-10-16 02:34:23 . 2011-08-04 20:07:54 841 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\Images2PDF.lnk2012-10-16 02:34:23 . 2011-08-04 20:07:54 1,449 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\Donate PDFCreator.lnk2012-10-16 02:34:22 . 2011-03-23 04:58:18 282 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDF reDirect v2\Purchase PDF reDirect Pro.lnk2012-10-16 02:34:22 . 2011-03-23 04:58:18 727 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDF reDirect v2\Uninstall.lnk2012-10-16 02:34:22 . 2011-03-23 04:58:18 1,620 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDF reDirect v2\PDF reDirect.lnk2012-10-16 02:34:22 . 2011-03-23 04:58:18 545 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDF reDirect v2\PDF reDirect Help.lnk2012-10-16 02:34:22 . 2011-03-23 04:58:18 565 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDF reDirect v2\PDF reDirect Pro Help.lnk2012-10-16 02:34:22 . 2011-03-23 04:58:18 1,620 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDF reDirect v2\PDF reDirect Pro.lnk2012-10-16 02:34:22 . 2011-03-04 21:28:25 791 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\OpenOffice.org 3.3\OpenOffice.org Draw.lnk2012-10-16 02:34:22 . 2011-03-04 21:28:25 851 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\OpenOffice.org 3.3\OpenOffice.org Impress.lnk2012-10-16 02:34:22 . 2011-03-04 21:28:25 793 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\OpenOffice.org 3.3\OpenOffice.org Math.lnk2012-10-16 02:34:22 . 2011-03-04 21:28:25 865 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\OpenOffice.org 3.3\OpenOffice.org Writer.lnk2012-10-16 02:34:22 . 2011-03-04 21:28:25 897 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\OpenOffice.org 3.3\OpenOffice.org.lnk2012-10-16 02:34:22 . 2011-03-04 21:28:25 841 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\OpenOffice.org 3.3\OpenOffice.org Calc.lnk2012-10-16 02:34:22 . 2011-03-04 21:28:25 857 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\OpenOffice.org 3.3\OpenOffice.org Base.lnk2012-10-16 02:34:22 . 2011-03-04 21:28:56 114 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\OpenOffice.org 3.3\Desktop.ini2012-10-16 02:34:22 . 2011-09-19 20:36:58 763 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\WavePad Sound Editor.lnk2012-10-16 02:34:22 . 2011-09-19 20:36:58 793 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Video Capture Software.lnk2012-10-16 02:34:22 . 2011-09-19 20:36:58 799 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\VideoPad Video Editor.lnk2012-10-16 02:34:22 . 2011-09-19 20:36:58 795 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Switch Sound File Converter.lnk2012-10-16 02:34:22 . 2011-09-19 20:36:58 799 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\SoundTap Streaming Recorder.lnk2012-10-16 02:34:22 . 2011-09-19 20:36:58 801 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\RecordPad Sound Recorder.lnk2012-10-16 02:34:22 . 2011-09-19 20:36:58 793 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Prism Video File Format Converter.lnk2012-10-16 02:34:22 . 2011-09-19 20:36:58 795 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\MixPad MultiTrack Mixer.lnk2012-10-16 02:34:22 . 2011-09-19 20:36:58 811 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Invoicing Software.lnk2012-10-16 02:34:22 . 2011-09-19 20:36:58 801 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Graphics File Converter.lnk2012-10-16 02:34:21 . 2011-09-19 16:52:40 809 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Golden Records LP Converter.lnk2012-10-16 02:34:21 . 2011-09-19 20:36:58 803 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Express Zip File Compression.lnk2012-10-16 02:34:21 . 2011-09-19 16:52:40 805 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Express Talk Softphone.lnk2012-10-16 02:34:21 . 2011-09-19 20:36:58 789 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Express Rip CD Ripper.lnk2012-10-16 02:34:21 . 2011-09-19 20:36:58 797 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Express Dictate Recorder.lnk2012-10-16 02:34:21 . 2011-09-19 20:36:58 805 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Express Burn CD, DVD or Blu-Ray.lnk2012-10-16 02:34:21 . 2011-09-19 20:36:58 803 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Classic FTP Software.lnk2012-10-16 02:34:21 . 2011-09-19 20:36:58 801 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Doxillion Document Converter.lnk2012-10-16 02:34:21 . 2011-09-19 20:36:58 813 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Accounting Software.lnk2012-10-16 02:34:21 . 2012-06-01 06:57:13 1,986 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Silverlight\Microsoft Silverlight.lnk2012-10-16 02:34:21 . 2011-09-13 00:32:00 2,427 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office Tools\Microsoft Office XP Language Settings.lnk2012-10-16 02:34:21 . 2011-09-13 00:32:01 2,447 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office Tools\Save My Settings Wizard.lnk2012-10-16 02:34:21 . 2011-09-13 00:32:00 2,401 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office Tools\Microsoft Office Application Recovery.lnk2012-10-16 02:34:21 . 2011-09-13 00:32:00 2,683 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office Tools\Microsoft Office Document Imaging.lnk2012-10-16 02:34:21 . 2011-09-13 00:32:00 2,635 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office Tools\Microsoft Office Document Scanning.lnk2012-10-16 02:34:21 . 2011-09-13 00:32:00 2,527 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office Tools\Microsoft Clip Organizer.lnk2012-10-16 02:34:21 . 2011-09-13 00:32:01 2,359 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office Tools\Activate Product.lnk2012-10-16 02:34:21 . 2011-09-13 00:32:01 2,483 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office Tools\Microsoft Access Snapshot Viewer.lnk2012-10-16 02:34:21 . 2012-05-23 21:58:11 820 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Malwarebytes' Anti-Malware\Uninstall Malwarebytes Anti-Malware.lnk2012-10-16 02:34:21 . 2012-05-23 21:58:11 947 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Malwarebytes' Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk2012-10-16 02:34:21 . 2012-05-23 21:58:11 796 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware.lnk2012-10-16 02:34:20 . 2012-05-23 21:58:11 796 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware Help.lnk2012-10-16 02:34:20 . 2011-02-11 17:33:29 792 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Lavalys\EVEREST Home Edition\Uninstall EVEREST Home Edition.lnk2012-10-16 02:34:20 . 2011-02-11 17:33:29 785 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Lavalys\EVEREST Home Edition\EVEREST Home Edition.lnk2012-10-16 02:34:20 . 2011-02-11 17:33:29 601 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Lavalys\EVEREST Home Edition\EVEREST Home Edition on the Web.lnk2012-10-16 02:34:20 . 2011-02-11 17:33:29 785 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Lavalys\EVEREST Home Edition\EVEREST Home Edition Documentation.lnk2012-10-16 02:34:20 . 2012-05-11 08:54:24 1,554 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\iTunes\iTunes.lnk2012-10-16 02:34:20 . 2012-05-11 08:54:24 1,814 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\iTunes\About iTunes.lnk2012-10-16 02:34:20 . 2011-03-21 20:54:58 647 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\InqScribe\Uninstall InqScribe.lnk2012-10-16 02:34:20 . 2011-03-21 20:54:58 1,522 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\InqScribe\InqScribe.lnk2012-10-16 02:34:20 . 2011-03-21 20:54:58 736 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\InqScribe\InqScribe User Guide.lnk2012-10-16 02:34:19 . 2011-02-27 23:32:13 1,205 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\Photosmart All-In-One 2600 series\Uninstall.lnk2012-10-16 02:34:19 . 2011-02-27 23:32:12 800 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\Photosmart All-In-One 2600 series\Readme.lnk2012-10-16 02:34:19 . 2011-02-27 23:32:13 1,071 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\Photosmart All-In-One 2600 series\Product Support Website.lnk2012-10-16 02:34:19 . 2011-02-27 23:32:13 833 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\Photosmart All-In-One 2600 series\Image Transfer.lnk2012-10-16 02:34:19 . 2011-02-27 23:32:13 836 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\Photosmart All-In-One 2600 series\Product Registration.lnk2012-10-16 02:34:19 . 2011-02-27 23:32:12 870 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\Photosmart All-In-One 2600 series\Help.lnk2012-10-16 02:34:19 . 2011-02-27 23:31:11 910 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\Image Zone .lnk2012-10-16 02:34:19 . 2011-02-27 23:29:43 929 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\System Diagnostics.lnk2012-10-16 02:34:19 . 2011-02-27 23:29:47 1,798 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\HP Product Assistant.lnk2012-10-16 02:34:19 . 2011-09-29 20:45:58 1,828 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\HP Update.lnk2012-10-16 02:34:19 . 2011-02-27 23:30:20 864 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\HP Image Zone Tour.lnk2012-10-16 02:34:19 . 2011-02-27 23:30:41 1,822 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\HP Document Viewer.lnk2012-10-16 02:34:19 . 2011-02-27 23:29:23 816 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\HP Director.lnk2012-10-16 02:34:19 . 2011-09-16 03:41:23 1,638 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\Advanced Options\Open Recordings (only).lnk2012-10-16 02:34:19 . 2011-09-16 03:41:23 1,636 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\Advanced Options\Open Scheduler (only).lnk2012-10-16 02:34:19 . 2011-09-16 03:41:23 752 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\WinTV 7.lnk2012-10-16 02:34:19 . 2011-09-16 03:41:23 1,632 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\Advanced Options\Empty Channel Database.lnk2012-10-16 02:34:19 . 2011-09-16 03:41:23 1,710 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\Uninstall WinTV 7.lnk2012-10-16 02:34:19 . 2011-09-16 03:40:53 677 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\Stop IR.lnk2012-10-16 02:34:19 . 2011-09-16 03:40:47 1,731 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\Signal Monitor.lnk2012-10-16 02:34:19 . 2011-01-17 14:37:02 640 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\Amcap.lnk2012-10-16 02:34:19 . 2011-01-17 14:37:02 659 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\Prodinfo.lnk2012-10-16 02:34:19 . 2011-09-16 03:40:53 677 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\Restart IR.lnk2012-10-16 02:34:18 . 2011-11-17 22:16:12 1,707 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Google Earth\Uninstall Google Earth .lnk2012-10-16 02:34:18 . 2011-11-17 22:16:12 1,857 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Google Earth\Start Google Earth in OpenGL mode.lnk2012-10-16 02:34:18 . 2011-11-17 22:16:12 1,853 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Google Earth\Start Google Earth in DirectX mode.lnk2012-10-16 02:34:18 . 2011-11-17 22:16:12 1,925 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Google Earth\Google Earth.lnk2012-10-16 02:34:18 . 2012-01-21 02:16:20 778 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\GIMP\Uninstall.lnk2012-10-16 02:34:18 . 2012-01-21 02:16:20 804 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\GIMP\GIMP 2.lnk2012-10-16 02:34:18 . 2011-09-14 03:34:49 1,540 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\gBurner\gBurner Help.lnk2012-10-16 02:34:18 . 2011-09-14 03:34:49 1,540 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\gBurner\gBurner.lnk2012-10-16 02:34:18 . 2011-09-14 03:34:49 1,556 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\gBurner\Uninstall gBurner.lnk2012-10-16 02:34:18 . 2012-04-18 00:13:54 1,502 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Spider Solitaire.lnk2012-10-16 02:34:18 . 2011-01-11 06:21:10 885 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Pinball.lnk2012-10-16 02:34:18 . 2012-04-18 00:13:54 1,491 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Solitaire.lnk2012-10-16 02:34:18 . 2012-04-18 00:13:54 1,515 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Minesweeper.lnk2012-10-16 02:34:18 . 2011-01-21 21:19:12 913 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Internet Spades.lnk2012-10-16 02:34:18 . 2011-01-21 21:19:12 913 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Internet Hearts.lnk2012-10-16 02:34:18 . 2011-01-21 21:19:12 913 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Internet Reversi.lnk2012-10-16 02:34:18 . 2011-01-21 21:19:12 913 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Internet Checkers.lnk2012-10-16 02:34:18 . 2012-04-18 00:13:54 1,520 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Hearts.lnk2012-10-16 02:34:18 . 2011-01-21 21:19:12 913 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Internet Backgammon.lnk2012-10-16 02:34:18 . 2011-01-21 21:19:12 798 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\desktop.ini2012-10-16 02:34:18 . 2012-04-18 00:13:54 1,522 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Freecell.lnk2012-10-16 02:34:18 . 2011-08-29 22:06:33 1,727 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Freecorder\Uninstall Freecorder.lnk2012-10-16 02:34:18 . 2011-08-29 22:06:33 1,562 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Freecorder\Freecorder Converter.lnk2012-10-16 02:34:18 . 2011-08-29 22:06:33 1,592 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Freecorder\Freecorder Settings.lnk2012-10-16 02:34:18 . 2011-08-29 22:06:33 1,569 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Freecorder\Freecorder Video History.lnk2012-10-16 02:34:18 . 2011-08-29 22:06:33 1,585 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Freecorder\FLVPlayer.lnk2012-10-16 02:34:18 . 2011-08-29 21:44:33 1,749 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\FLV Player\Uninstall Applian FLV Player.lnk2012-10-16 02:34:18 . 2011-08-29 21:44:33 1,585 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\FLV Player\Applian FLV Player.lnk2012-10-16 02:34:18 . 2011-01-24 04:56:46 585 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\DriverMax\Other products by Innovative Solutions.lnk2012-10-16 02:34:18 . 2011-01-24 04:56:46 798 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\DriverMax\Uninstall.lnk2012-10-16 02:34:17 . 2011-01-24 04:56:46 791 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\DriverMax\DriverMax.lnk2012-10-16 02:34:17 . 2011-02-04 03:44:17 1,749 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Corel\Visual Intelligence\Visual Intelligence.lnk2012-10-16 02:34:17 . 2011-02-04 03:44:17 946 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Corel\Visual Intelligence\Visit the Corel website.lnk2012-10-16 02:34:17 . 2011-02-04 03:44:17 667 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Corel\Visual Intelligence\Uninstall Visual Intelligence.lnk2012-10-16 02:34:17 . 2011-03-21 21:08:21 1,816 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\Filters\VSFilter Configuration.lnk2012-10-16 02:34:17 . 2011-03-21 21:08:21 1,856 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\Filters\FFDShow VFW Codec Configuration.lnk2012-10-16 02:34:17 . 2011-03-21 21:08:21 1,850 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\Filters\FFDShow Video Decoder Configuration.lnk2012-10-16 02:34:17 . 2011-03-21 21:08:21 1,842 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\Filters\Haali Media Splitter Settings.lnk2012-10-16 02:34:17 . 2011-03-21 21:08:21 1,860 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\Filters\FFDShow Audio Decoder Configuration.lnk2012-10-16 02:34:17 . 2011-03-21 21:08:21 1,858 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\Filters\FFDShow DXVA Video Decoder Configuration.lnk2012-10-16 02:34:17 . 2011-03-21 21:08:20 54 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\CCCP Website.url2012-10-16 02:34:17 . 2011-03-21 21:08:21 897 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\Media Player Classic Home Cinema.lnk2012-10-16 02:34:17 . 2011-03-21 21:08:20 84 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\CCCP Playback FAQ.url2012-10-16 02:34:17 . 2011-03-21 21:08:20 889 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\CCCP Settings.lnk2012-10-16 02:34:17 . 2011-03-21 21:08:21 1,749 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\CCCP Uninstall.lnk2012-10-16 02:34:17 . 2012-04-18 00:19:13 82 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\CCleaner\CCleaner Homepage.url2012-10-16 02:34:17 . 2012-04-18 00:19:13 694 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\CCleaner\CCleaner.lnk2012-10-16 02:34:17 . 2012-04-18 00:19:13 682 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\CCleaner\Uninstall CCleaner.lnk2012-10-16 02:34:17 . 2011-01-18 04:30:08 1,791 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Catalyst Control Center\Help.lnk2012-10-16 02:34:17 . 2011-01-18 04:30:08 1,773 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Catalyst Control Center\Restart Runtime.lnk2012-10-16 02:34:17 . 2011-01-18 04:30:08 1,789 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Catalyst Control Center\CCC - Advanced.lnk2012-10-16 02:34:17 . 2011-01-18 04:30:08 1,783 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Catalyst Control Center\CCC - Wizard.lnk2012-10-16 02:34:17 . 2011-01-18 04:30:08 1,777 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Catalyst Control Center\CCC.lnk2012-10-16 02:34:17 . 2011-04-27 14:18:02 2,026 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Carbonite\Uninstall Carbonite.lnk2012-10-16 02:34:17 . 2012-04-02 20:01:15 1,647 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Bsecure Endpoint Security\Show Tray Icon.lnk2012-10-16 02:34:17 . 2012-04-02 20:01:15 1,624 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Bsecure Endpoint Security\Uninstall.lnk2012-10-16 02:34:17 . 2011-04-27 14:18:02 1,885 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Carbonite\Carbonite InfoCenter.lnk2012-10-16 02:34:17 . 2012-04-02 20:01:15 1,651 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Bsecure Endpoint Security\Bsecure Endpoint Security.lnk2012-10-16 02:34:17 . 2012-04-02 20:01:15 1,661 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Bsecure Endpoint Security\Help.lnk2012-10-16 02:34:17 . 2011-09-19 16:28:42 650 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\AVS4YOU\Help.lnk2012-10-16 02:34:17 . 2011-09-19 16:28:42 784 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\AVS4YOU\License Agreement.lnk2012-10-16 02:34:17 . 2011-09-19 16:28:42 842 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\AVS4YOU\Repair.lnk2012-10-16 02:34:17 . 2011-09-19 16:27:54 908 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\AVS4YOU\Video\AVS Video Converter.lnk2012-10-16 02:34:17 . 2011-09-19 16:28:29 1,021 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\AVS4YOU\Video\AVS Video Uploader.lnk2012-10-16 02:34:17 . 2011-09-19 16:28:41 655 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\AVS4YOU\Activation.lnk2012-10-16 02:34:17 . 2011-09-19 16:28:58 890 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\AVS4YOU\AVS Update Manager.lnk2012-10-16 02:34:17 . 2011-09-19 16:28:48 958 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\AVS4YOU\AVS4YOU Software Navigator.lnk2012-10-16 02:34:17 . 2011-09-19 20:36:58 801 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Streaming Audio Server.lnk2012-10-16 02:34:17 . 2011-09-19 20:36:58 797 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Text-to-Speech Reader.lnk2012-10-16 02:34:17 . 2011-09-19 20:36:58 799 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Streaming Audio Recorder.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 801 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Sound File Recorder.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 795 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Sound File Converter.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 763 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Sound File Editor.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 795 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Multitrack Mixer.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 795 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Record to CD or Mp3 Wizard.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 791 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\DJ Mixing Software.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 797 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Dictation Recorder.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 801 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Crescendo Music Notation.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 805 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\CD Audio Burn Recorder.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 789 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\CD Audio Rip Extractor.lnk2012-10-16 02:34:16 . 2011-08-29 22:29:58 1,801 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Applian Technologies\Uninstall Replay Converter 4.lnk2012-10-16 02:34:16 . 2011-08-29 22:33:43 1,761 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Applian Technologies\Uninstall Applian Director.lnk2012-10-16 02:34:16 . 2011-09-22 07:44:10 966 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Applian Technologies\Replay Media Catcher 4.lnk2012-10-16 02:34:16 . 2011-08-29 22:29:34 1,794 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Applian Technologies\Replay Player.lnk2012-10-16 02:34:16 . 2011-08-29 22:29:58 1,699 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Applian Technologies\Replay Converter.lnk2012-10-16 02:34:16 . 2011-08-29 22:29:58 1,720 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Applian Technologies\DisableDshowCodecs.lnk2012-10-16 02:34:16 . 2011-08-29 22:29:58 1,713 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Applian Technologies\EnableDshowCodecs.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:38 1,602 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Services.lnk2012-10-16 02:34:16 . 2011-08-29 22:33:42 1,632 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Applian Technologies\Applian Director.lnk2012-10-16 02:34:16 . 2011-02-27 23:28:38 1,107 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Microsoft .NET Framework 1.1 Configuration.lnk2012-10-16 02:34:16 . 2011-02-27 23:28:38 1,158 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Microsoft .NET Framework 1.1 Wizards.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:38 1,591 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Performance.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:38 1,590 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Local Security Policy.lnk2012-10-16 02:34:16 . 2011-01-11 06:23:45 545 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\desktop.ini2012-10-16 02:34:16 . 2012-04-18 00:13:38 1,592 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Event Viewer.lnk2012-10-16 02:34:16 . 2011-01-11 06:20:56 1,582 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Component Services.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:38 1,602 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Computer Management.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:38 1,596 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Data Sources (ODBC).lnk2012-10-16 02:34:16 . 2012-04-18 00:13:37 1,616 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\System Restore.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:37 1,591 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:37 1,753 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\Scheduled Tasks.lnk2012-10-16 02:34:16 . 2011-01-11 06:22:48 1,070 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\System Information.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:37 1,532 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\Disk Cleanup.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:37 1,572 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\Disk Defragmenter.lnk2012-10-16 02:34:16 . 2011-01-11 06:23:45 757 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\desktop.ini2012-10-16 02:34:16 . 2012-04-18 00:13:37 1,521 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\Character Map.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:37 1,532 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\Backup.lnk2012-10-16 02:34:15 . 2012-04-18 00:13:37 1,599 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\Activate Windows.lnk2012-10-16 02:34:15 . 2012-04-18 00:13:36 1,528 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Entertainment\Volume Control.lnk2012-10-16 02:34:15 . 2011-01-11 06:21:10 146 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Entertainment\desktop.ini2012-10-16 02:34:15 . 2012-04-18 00:13:36 1,528 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Entertainment\Sound Recorder.lnk2012-10-16 02:34:15 . 2012-04-18 00:13:36 1,656 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications\Wireless Network Setup Wizard.lnk2012-10-16 02:34:15 . 2012-04-18 00:13:36 1,646 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications\New Connection Wizard.lnk2012-10-16 02:34:15 . 2012-04-18 00:13:36 1,640 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications\Network Setup Wizard.lnk2012-10-16 02:34:15 . 2011-01-11 05:45:49 516 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications\desktop.ini2012-10-16 02:34:15 . 2011-01-11 06:21:10 786 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications\HyperTerminal.lnk2012-10-16 02:34:15 . 2012-04-18 00:13:36 1,757 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications\Network Connections.lnk2012-10-16 02:34:15 . 2011-01-11 06:21:10 90 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Accessibility\desktop.ini2012-10-16 02:34:15 . 2012-04-18 00:13:36 1,520 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Accessibility\Accessibility Wizard.lnk2012-10-16 02:34:15 . 2011-01-11 06:21:10 879 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\WordPad.lnk2012-10-16 02:34:15 . 2012-05-25 05:36:54 710 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Scanner and Camera Wizard.lnk2012-10-16 02:34:15 . 2012-04-18 00:13:36 1,585 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Remote Desktop Connection.lnk2012-10-16 02:34:15 . 2012-05-25 05:36:54 255 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\desktop.ini2012-10-16 02:34:15 . 2012-04-14 22:39:22 1,515 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Paint.lnk2012-10-16 02:34:15 . 2012-04-04 17:32:21 1,498 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Calculator.lnk2012-10-16 02:34:15 . 2011-09-19 20:36:56 789 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WavePad Sound Editor.lnk2012-10-16 02:34:15 . 2011-01-11 06:22:52 786 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Windows Movie Maker.lnk2012-10-16 02:34:15 . 2011-09-19 16:52:34 805 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\VideoPad Video Editor.lnk2012-10-16 02:34:15 . 2012-05-25 07:11:06 1,854 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Safari.lnk2012-10-16 02:34:15 . 2011-03-24 06:14:59 730 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Mozilla Firefox.lnk2012-10-16 02:34:15 . 2012-05-11 07:25:58 2,365 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Nitro Pro 7.lnk2012-10-16 02:34:15 . 2011-09-19 16:51:29 777 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Prism Video File Converter.lnk2012-10-16 02:34:15 . 2012-06-07 21:59:37 2,489 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Word.lnk2012-10-16 02:34:15 . 2011-09-13 00:32:01 2,531 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft PowerPoint.lnk2012-10-16 02:34:15 . 2012-05-07 06:51:25 2,487 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Excel.lnk2012-10-16 02:34:15 . 2011-09-19 21:15:45 2,513 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Outlook.lnk2012-10-16 02:34:15 . 2011-01-11 06:22:52 150 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\desktop.ini2012-10-16 02:34:15 . 2011-01-12 21:59:58 829 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Doxillion Document Converter.lnk2012-10-16 02:34:15 . 2011-03-16 02:58:22 782 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Express Scribe.lnk2012-10-16 02:34:15 . 2011-02-27 23:30:28 731 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\I.R.I.S. OCR Registration.lnk2012-10-16 02:34:15 . 2011-09-13 00:32:00 2,529 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Access.lnk2012-10-16 02:34:14 . 2011-02-04 03:44:17 1,737 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Corel Visual Intelligence.lnk2012-10-16 02:34:14 . 2011-04-03 14:08:24 781 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Debut Video Capture Software.lnk2012-10-16 02:34:14 . 2011-08-29 21:44:33 1,579 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Applian FLV Player.lnk2012-10-16 02:34:14 . 2012-05-17 06:16:37 2,315 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Adobe Reader X.lnk2012-10-16 02:34:14 . 2012-05-25 07:39:10 2,265 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Apple Software Update.lnk2012-10-16 02:34:14 . 2012-04-18 00:14:08 1,507 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Windows Update.lnk2012-10-16 02:34:14 . 2011-02-04 03:42:41 1,863 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\WordPerfect OfficeReady.lnk2012-10-16 02:34:14 . 2012-04-18 00:14:08 1,563 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Set Program Access and Defaults.lnk2012-10-16 02:34:14 . 2011-01-11 06:23:45 398 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Windows Catalog.lnk2012-10-16 02:34:14 . 2011-02-27 23:29:23  804 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\HP Director.lnk2012-10-16 02:34:14 . 2011-01-11 04:28:26 1,566 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Microsoft Update.lnk2012-10-16 02:34:14 . 2012-01-24 02:48:01 2,433 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\New Office Document.lnk2012-10-16 02:34:14 . 2012-01-24 02:49:32 2,443 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Open Office Document.lnk2012-10-16 02:34:14 . 2011-01-11 05:44:48 272 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\desktop.ini2012-10-16 02:34:14 . 2011-02-27 23:31:11 898 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\HP Image Zone.lnk2012-10-16 02:23:22 . 2012-10-16 21:00:18 133 ----a-w- C:\Qoobox\Quarantine\catchme.log2012-07-09 22:49:00 . 2012-07-09 22:49:00 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL0123.tmp.vir2012-07-09 22:49:00 . 2012-07-11 04:13:33 20,992 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL0377.tmp.vir2012-07-09 22:49:00 . 2012-07-10 04:35:47 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL0818.tmp.vir2012-07-09 22:49:00 . 2012-07-10 04:42:02 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL0976.tmp.vir2012-07-09 22:49:00 . 2012-07-10 04:41:08 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL1533.tmp.vir2012-07-09 22:49:00 . 2012-07-11 04:25:38 20,992 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL1715.tmp.vir2012-07-09 22:49:00 . 2012-07-11 04:13:40 20,992 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL1756.tmp.vir2012-07-09 22:49:00 . 2012-07-10 04:36:52 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL2186.tmp.vir2012-07-09 22:49:00 . 2012-07-09 22:49:05 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL2764.tmp.vir2012-07-09 22:49:00 . 2012-07-10 04:43:10 20,480 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL2836.tmp.vir2012-07-09 22:49:00 . 2012-07-11 04:13:45 20,992 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL3800.tmp.vir2012-06-25 19:34:11 . 2012-06-27 07:35:46 20,992 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL1294.tmp.vir2012-04-10 20:15:22 . 2012-04-10 20:15:22 60,304 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\g2mdlhlpx.exe.vir2011-12-11 08:13:15 . 2011-12-11 08:13:24 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL0358.tmp.vir2011-12-11 08:13:15 . 2011-12-11 08:50:50 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL0866.tmp.vir2011-12-11 08:13:15 . 2011-12-11 08:51:01 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL0938.tmp.vir2011-12-11 08:13:15 . 2011-12-11 08:46:42 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL1710.tmp.vir2011-12-11 08:13:15 . 2011-12-11 08:50:56 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL2241.tmp.vir2011-12-11 08:13:15 . 2011-12-11 08:51:12 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL2555.tmp.vir2011-12-11 08:13:15 . 2011-12-11 08:13:43 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL3133.tmp.vir2011-12-11 08:13:15 . 2011-12-11 08:13:15 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL3298.tmp.vir2011-12-11 08:13:15 . 2011-12-11 08:48:02 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL3536.tmp.vir2011-12-11 08:13:15 . 2011-12-11 08:13:36 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL3796.tmp.vir2011-09-04 18:52:44 . 2011-09-04 18:52:44 737 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\2121.txt.vir2011-09-04 06:17:55 . 2011-09-05 05:34:35 3,888 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\mru.xml.vir2011-09-03 04:47:19 . 2011-09-03 04:47:19 858 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\898.txt.vir2011-09-03 04:02:46 . 2011-09-03 04:02:46 658 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\2867.txt.vir2011-09-03 03:56:10 . 2011-09-03 03:56:10 489 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\5260.txt.vir2011-09-03 03:54:52 . 2011-09-03 03:54:52 714 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\5259.txt.vir2011-09-03 03:34:04 . 2011-09-03 03:34:04 665 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\5352.txt.vir2011-09-03 03:30:29 . 2011-09-03 03:30:29 517 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\4002.txt.vir2011-09-02 17:33:26 . 2011-09-02 17:33:26 332 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\4471.txt.vir2011-09-02 03:10:14 . 2011-09-02 03:10:14 328 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\946.txt.vir2011-09-01 17:50:29 . 2011-09-01 17:50:29 660 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\3213.txt.vir2011-09-01 17:49:49 . 2011-09-01 17:49:49 484 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\5992.txt.vir2011-09-01 05:53:00 . 2011-09-01 05:53:00 333 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\2637.txt.vir2011-09-01 05:52:36 . 2011-09-01 05:52:36 373 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\3003.txt.vir2011-08-31 23:54:17 . 2011-08-31 23:54:17 702 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\10.txt.vir2011-08-31 19:02:15 . 2011-08-31 19:02:15 374 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\4275.txt.vir2011-08-30 17:56:10 . 2011-08-30 17:56:10 2,176 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\5218.txt.vir2011-08-30 05:04:58 . 2011-08-30 05:04:58 310 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\6781.txt.vir2011-08-30 03:03:52 . 2011-08-30 03:03:52 2,001 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\2229.txt.vir2011-08-29 14:15:12 . 2011-08-29 14:15:12 21,628 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\wlu.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 2,227 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\1.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 10,157 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\a.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 10,630 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\b.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 12,106 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\c.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 7,067 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\d.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 7,675 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\e.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 4,707 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\f.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 5,267 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\g.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 3,928 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\h.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 3,922 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\i.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 2,102 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\j.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 2,656 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\k.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 5,737 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\l.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 8,433 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\m.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 2,824 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\n.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 3,269 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\o.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 7,699 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\p.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 421 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\q.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 3,142 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\r.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 14,364 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\s.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 8,036 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\t.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 1,414 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\u.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 2,247 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\v.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 2,868 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\w.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 298 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\x.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 763 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\y.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 907 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\z.txt.vir2011-02-04 19:08:32 . 2011-02-04 19:08:33 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL0036.tmp.vir2011-02-04 19:08:32 . 2011-02-06 06:43:06 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL2256.tmp.vir2011-02-04 19:08:32 . 2011-02-04 19:08:41 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL2557.tmp.vir2011-02-04 03:42:30 . 1997-06-25 20:24:16 40,448 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\regobj.dll.vir2009-01-31 01:34:14 . 2009-01-31 01:34:14 2,458,112 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\SET3EC.tmp.vir2009-01-31 01:34:08 . 2009-01-31 01:34:08 157,184 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\SET3E4.tmp.vir2009-01-31 01:34:06 . 2009-01-31 01:34:06 222,208 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\SET3E0.tmp.vir2008-04-14 00:12:17 . 2008-04-14 00:12:17 294,912 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\dllcache\dlimport.exe.vir2004-08-04 12:00:00 . 2010-12-09 15:15:09 718,336 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\ntdll.dll.vir2003-02-21 10:16:08 . 2003-02-21 10:16:08 49,152 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\URTTEMP\regtlib.exe.vir2000-05-24 02:45:58 . 2000-05-24 02:45:58 118,784 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\msstdfmt.dll.vir


----------



## shadowbird (Oct 9, 2012)

Thank you. When you look at this, would you please tell me what Combofix deleted that was malware? Here it is again. Hopefully it won't be a mess this time:2012-10-17 08:47:21 . 2012-10-17 08:47:21 232 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKU-Default-Run-Adobe.reg.dat2012-10-17 08:47:19 . 2012-10-17 08:47:19 230 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKCU-Run-Adobe.reg.dat2012-10-16 21:06:32 . 2012-10-16 21:06:32 1,024 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Service_nhrmdtgf.reg.dat2012-10-16 21:06:32 . 2012-10-16 21:06:32 1,016 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Service_gbgrrpg.reg.dat2012-10-16 21:01:10 . 2012-10-16 21:01:10 0 ----a-w- C:\Qoobox\Quarantine\catchme.txt2012-10-16 16:48:24 . 2012-10-16 16:48:24 420,352 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Local Settings\Application Data\Aiseesoft Studio\Adobe\exfiwyyu.dll.vir2012-10-16 02:47:55 . 2012-10-16 02:47:55 586 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-WMUTray.reg.dat2012-10-16 02:47:55 . 2012-10-16 02:47:55 592 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-vProt.reg.dat2012-10-16 02:47:55 . 2012-10-16 02:47:55 624 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-SelectRebates.reg.dat2012-10-16 02:47:55 . 2012-10-16 02:47:55 686 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-SearchSettings.reg.dat2012-10-16 02:47:55 . 2012-10-16 02:47:55 670 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-ROC_ROC_NT.reg.dat2012-10-16 02:47:54 . 2012-10-16 02:47:54 640 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-RemoteControl10.reg.dat2012-10-16 02:47:54 . 2012-10-16 02:47:54 640 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-MSC.reg.dat2012-10-16 02:47:54 . 2012-10-16 02:47:54 630 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-Freecorder FLV Service.reg.dat2012-10-16 02:47:53 . 2012-10-16 02:47:53 594 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-BDRegion.reg.dat2012-10-16 02:47:53 . 2012-10-16 02:47:53 604 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-AVG_UI.reg.dat2012-10-16 02:47:53 . 2012-10-16 02:47:53 658 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-Ask and Record FLV Service.reg.dat2012-10-16 02:47:51 . 2012-10-16 02:47:51 484 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Notify-TPSvc.reg.dat2012-10-16 02:47:44 . 2012-10-16 02:47:44 249 ----a-w- C:\Qoobox\Quarantine\Registry_backups\WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}.reg.dat2012-10-16 02:47:44 . 2012-10-16 02:47:44 171 ----a-w- C:\Qoobox\Quarantine\Registry_backups\WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440}.reg.dat2012-10-16 02:35:18 . 2012-10-16 02:35:18 2,532 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Service_nvsvc.reg.dat2012-10-16 02:35:18 . 2012-10-16 02:35:18 1,048 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_NVSVC.reg.dat2012-10-16 02:35:08 . 2012-10-16 21:06:19 6,037 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg2012-10-16 02:34:26 . 2011-09-19 21:23:04 792 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\2\Launch Microsoft Outlook.lnk2012-10-16 02:34:26 . 2011-01-11 06:27:34 79 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\2\Show Desktop.scf2012-10-16 02:34:26 . 2011-02-04 06:39:09 800 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\2\Windows Media Player.lnk2012-10-16 02:34:26 . 2011-01-11 06:27:34 119 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\2\desktop.ini2012-10-16 02:34:26 . 2011-09-18 17:13:52 2,278 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\2\Google Chrome.lnk2012-10-16 02:34:26 . 2011-02-15 19:12:00 815 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\2\Launch Internet Explorer Browser.lnk2012-10-16 02:34:26 . 2012-05-25 07:11:06 1,854 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\2\Apple Safari.lnk2012-10-16 02:34:26 . 2011-08-29 22:33:42 1,638 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\2\Applian Director.lnk2012-10-16 02:34:26 . 2011-02-04 03:42:41 2,202 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect OfficeReady\Uninstall WordPerfect OfficeReady.lnk2012-10-16 02:34:26 . 2011-02-04 03:42:41 2,264 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect OfficeReady\WordPerfect OfficeReady Help.lnk2012-10-16 02:34:26 . 2011-02-04 03:42:41 1,708 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect OfficeReady\WordPerfect OfficeReady Templates Folder.lnk2012-10-16 02:34:26 . 2011-02-04 03:42:41 1,875 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect OfficeReady\Start WordPerfect OfficeReady.lnk2012-10-16 02:34:26 . 2011-02-04 03:42:41 2,248 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect OfficeReady\Corel Corporation Website.lnk2012-10-16 02:34:26 . 2011-02-04 03:42:41 2,266 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect OfficeReady\Readme for WordPerfect OfficeReady.lnk2012-10-16 02:34:26 . 2011-02-04 06:21:50 2,577 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Utilities\Pleading Expert.lnk2012-10-16 02:34:26 . 2011-02-04 06:21:32 2,639 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Utilities\QuickFinder Manager.lnk2012-10-16 02:34:26 . 2011-02-04 06:21:32 2,593 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Utilities\QuickFinder Searcher.lnk2012-10-16 02:34:26 . 2011-02-04 06:22:48 1,178 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Utilities\Spell Utility.lnk2012-10-16 02:34:26 . 2011-02-04 06:21:49 2,553 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Utilities\WordPerfect XML Project Designer.lnk2012-10-16 02:34:26 . 2011-02-04 06:21:32 2,635 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Utilities\Clipbook.lnk2012-10-16 02:34:26 . 2011-02-04 06:21:32 2,587 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Utilities\Conversion Utility.lnk2012-10-16 02:34:26 . 2011-02-04 06:21:32 2,587 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Utilities\PerfectScript.lnk2012-10-16 02:34:26 . 2011-02-04 06:22:48 1,265 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Support\Technical Support Online.lnk2012-10-16 02:34:26 . 2011-02-04 06:22:48 1,295 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Support\Technical Support Help.lnk2012-10-16 02:34:26 . 2012-06-07 08:26:39 2,639 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\WordPerfect X4.lnk2012-10-16 02:34:26 . 2011-02-04 06:22:48 1,128 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Support\Guidebook (.PDF).lnk2012-10-16 02:34:26 . 2011-02-04 06:22:48 1,379 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Support\Microsoft Office Compatibility.lnk2012-10-16 02:34:26 . 2011-02-04 06:10:42 2,717 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\WordPerfect Lightning.lnk2012-10-16 02:34:26 . 2012-03-25 07:24:29 2,595 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Quattro Pro X4.lnk2012-10-16 02:34:25 . 2011-02-04 06:22:01 1,135 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Presentations X4.lnk2012-10-16 02:34:25 . 2011-02-04 06:22:01 2,101 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\Presentations Graphics X4.lnk2012-10-16 02:34:25 . 2011-09-14 04:03:12 704 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WinRAR\WinRAR.lnk2012-10-16 02:34:25 . 2011-02-04 06:21:32 2,083 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WordPerfect Office X4\New Project.lnk2012-10-16 02:34:25 . 2011-09-14 04:03:12 704 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WinRAR\WinRAR help.lnk2012-10-16 02:34:25 . 2011-09-14 04:03:12 685 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WinRAR\Console RAR manual.lnk2012-10-16 02:34:25 . 2011-08-29 22:33:22 49 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WinPcap\WinPcap Web Site.url2012-10-16 02:34:25 . 2011-08-29 22:33:22 680 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WinPcap\Uninstall WinPcap 4.0.2.lnk2012-10-16 02:34:25 . 2012-02-14 02:48:24 1,670 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\VueMinder Pro\VueMinder Pro.lnk2012-10-16 02:34:25 . 2012-02-14 02:48:24 1,777 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\VueMinder Pro\Help Documentation (Online).lnk2012-10-16 02:34:25 . 2011-01-15 17:31:43 47 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\VPedal Windows Media Player 11 64bit Plug-in\VPedal website on the Web.url2012-10-16 02:34:25 . 2011-01-15 17:31:44 862 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\VPedal Windows Media Player 11 64bit Plug-in\VPedal WMP11 Settings.lnk2012-10-16 02:34:25 . 2011-01-15 17:31:44 822 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\VPedal Windows Media Player 11 64bit Plug-in\Uninstall VPedal Windows Media Player Plug-in.lnk2012-10-16 02:34:25 . 2011-09-19 16:52:40 777 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Video Related Programs\VideoPad Video Editor.lnk2012-10-16 02:34:25 . 2011-09-19 16:52:40 821 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Video Related Programs\Video Tape to DVD Converter.lnk2012-10-16 02:34:24 . 2011-09-19 16:52:40 813 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Video Related Programs\Video Streaming Server.lnk2012-10-16 02:34:24 . 2011-09-19 16:52:40 807 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Video Related Programs\Video File Format Converter.lnk2012-10-16 02:34:24 . 2011-09-19 16:52:40 807 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Video Related Programs\Video Capture Software.lnk2012-10-16 02:34:24 . 2011-09-19 16:52:40 817 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Video Related Programs\Slideshow Creator Software.lnk2012-10-16 02:34:24 . 2011-11-25 05:29:06 849 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\VersaCheck 2003 Personal Premier\VersaCheck Update.lnk2012-10-16 02:34:24 . 2011-01-12 21:59:58 821 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Utilities\Typing Expander Software.lnk2012-10-16 02:34:24 . 2011-01-12 21:59:58 817 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Utilities\Uploader Software.lnk2012-10-16 02:34:24 . 2011-11-25 05:29:06 817 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\VersaCheck 2003 Personal Premier\VersaCheck 2003.lnk2012-10-16 02:34:24 . 2011-01-12 21:59:58 787 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Utilities\Doxillion Document Converter.lnk2012-10-16 02:34:24 . 2011-01-12 21:59:58 813 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Utilities\Encryption and Decryption Software.lnk2012-10-16 02:34:24 . 2011-01-12 21:59:58 821 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Utilities\Text-to-Speech Reader.lnk2012-10-16 02:34:24 . 2011-01-12 21:59:58 827 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Utilities\Classic FTP Software.lnk2012-10-16 02:34:24 . 2011-01-12 21:59:58 823 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Utilities\Backup Software.lnk2012-10-16 02:34:24 . 2011-01-12 21:59:58 829 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Utilities\CD, DVD, BluRay Burner.lnk2012-10-16 02:34:24 . 2011-10-18 07:35:52 2,417 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\TurboTax Business 2010\TurboTax Business 2010.lnk2012-10-16 02:34:24 . 2011-01-11 06:23:45 84 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Startup\desktop.ini2012-10-16 02:34:24 . 2011-09-13 00:32:01 1,730 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Startup\Microsoft Office.lnk2012-10-16 02:34:24 . 2011-10-18 06:42:27 2,459 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\TurboTax 2010\TurboTax 2010.lnk2012-10-16 02:34:24 . 2011-01-17 07:14:19 875 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Spybot - Search & Destroy\Update Spybot-S&D.lnk2012-10-16 02:34:24 . 2011-01-17 07:14:19 951 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Spybot - Search & Destroy\Tutorial.lnk2012-10-16 02:34:24 . 2011-01-17 07:14:19 961 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Spybot - Search & Destroy\Uninstall Spybot-S&D.lnk2012-10-16 02:34:24 . 2011-02-02 00:37:35 651 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Sony Player Plug-in for WMP\Readme.lnk2012-10-16 02:34:24 . 2011-01-17 07:14:19 945 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Spybot - Search & Destroy\Spybot - Search & Destroy.lnk2012-10-16 02:34:24 . 2011-01-21 04:56:19 1,708 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Security Task Manager\Manual.lnk2012-10-16 02:34:24 . 2011-01-21 04:56:19 992 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Security Task Manager\Purchase Security Task Manager Now!.lnk2012-10-16 02:34:24 . 2011-01-21 04:56:19 822 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Security Task Manager\Security Task Manager.lnk2012-10-16 02:34:24 . 2011-01-21 04:56:19 833 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Security Task Manager\Spy Protector.lnk2012-10-16 02:34:24 . 2011-01-21 04:56:19 805 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Security Task Manager\Uninstall.lnk2012-10-16 02:34:24 . 2012-05-15 06:05:18 933 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Shutterfly\Shutterfly Express Uploader.lnk2012-10-16 02:34:24 . 2011-01-21 04:56:19 1,706 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Security Task Manager\Help.lnk2012-10-16 02:34:24 . 2011-09-13 16:46:06 1,351 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Recuva\Uninstall Recuva.lnk2012-10-16 02:34:24 . 2011-02-04 16:06:27 792 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Real\RealPlayer Trimmer.lnk2012-10-16 02:34:24 . 2011-02-04 16:06:15 765 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Real\RealPlayer.lnk2012-10-16 02:34:24 . 2011-09-13 16:46:06 80 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Recuva\Recuva Homepage.url2012-10-16 02:34:24 . 2011-09-13 16:46:06 1,524 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Recuva\Recuva.lnk2012-10-16 02:34:24 . 2011-02-04 16:06:32 850 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Real\RealPlayer Converter.lnk2012-10-16 02:34:24 . 2012-05-25 07:09:45 1,812 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\QuickTime\PictureViewer.lnk2012-10-16 02:34:24 . 2012-05-25 07:09:45 1,802 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\QuickTime\QuickTime Player.lnk2012-10-16 02:34:24 . 2012-05-25 07:09:45 1,639 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\QuickTime\Uninstall QuickTime.lnk2012-10-16 02:34:24 . 2012-05-25 07:09:45 1,802 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\QuickTime\About QuickTime.lnk2012-10-16 02:34:23 . 2011-01-18 07:10:55 1,902 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\QuickBooks\QuickBooks Database Server Manager.lnk2012-10-16 02:34:23 . 2011-01-18 07:10:55 1,886 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\QuickBooks\QuickBooks Pro 2010.lnk2012-10-16 02:34:23 . 2011-01-18 07:10:55 2,009 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\QuickBooks\Web Connector.lnk2012-10-16 02:34:23 . 2011-01-18 07:11:17 1,573 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\QuickBooks\Install QuickBooks Timer.lnk2012-10-16 02:34:23 . 2011-11-25 05:29:06 1,909 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Qchex Check Messenger\Qchex Tray Icon.lnk2012-10-16 02:34:23 . 2011-11-25 05:29:06 1,928 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Qchex Check Messenger\Qchex Check Messenger.lnk2012-10-16 02:34:23 . 2011-01-19 21:22:17 49 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Phyxion.net\Driver Sweeper\Driver Sweeper on the Web.url2012-10-16 02:34:23 . 2011-08-04 20:07:53 729 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\Licenses\GPL License.lnk2012-10-16 02:34:23 . 2011-08-04 20:07:53 754 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\Licenses\FairPlay License.lnk2012-10-16 02:34:23 . 2011-08-04 20:07:53 734 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\Licenses\AFPL License.lnk2012-10-16 02:34:23 . 2011-08-04 20:07:54 829 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\Translation Tool.lnk2012-10-16 02:34:23 . 2011-08-04 20:07:53 1,592 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\PDFCreator.lnk2012-10-16 02:34:23 . 2011-08-04 20:07:54 1,415 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\PDFCreator on the Web.lnk2012-10-16 02:34:23 . 2011-08-04 20:07:54 758 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\PDFCreator Help.lnk2012-10-16 02:34:23 . 2011-08-04 20:07:53 701 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\History.lnk2012-10-16 02:34:23 . 2011-08-04 20:07:54 841 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\Images2PDF.lnk2012-10-16 02:34:23 . 2011-08-04 20:07:54 1,449 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDFCreator\Donate PDFCreator.lnk2012-10-16 02:34:22 . 2011-03-23 04:58:18 282 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDF reDirect v2\Purchase PDF reDirect Pro.lnk2012-10-16 02:34:22 . 2011-03-23 04:58:18 727 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDF reDirect v2\Uninstall.lnk2012-10-16 02:34:22 . 2011-03-23 04:58:18 1,620 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDF reDirect v2\PDF reDirect.lnk2012-10-16 02:34:22 . 2011-03-23 04:58:18 545 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDF reDirect v2\PDF reDirect Help.lnk2012-10-16 02:34:22 . 2011-03-23 04:58:18 565 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDF reDirect v2\PDF reDirect Pro Help.lnk2012-10-16 02:34:22 . 2011-03-23 04:58:18 1,620 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\PDF reDirect v2\PDF reDirect Pro.lnk2012-10-16 02:34:22 . 2011-03-04 21:28:25 791 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\OpenOffice.org 3.3\OpenOffice.org Draw.lnk2012-10-16 02:34:22 . 2011-03-04 21:28:25 851 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\OpenOffice.org 3.3\OpenOffice.org Impress.lnk2012-10-16 02:34:22 . 2011-03-04 21:28:25 793 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\OpenOffice.org 3.3\OpenOffice.org Math.lnk2012-10-16 02:34:22 . 2011-03-04 21:28:25 865 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\OpenOffice.org 3.3\OpenOffice.org Writer.lnk2012-10-16 02:34:22 . 2011-03-04 21:28:25 897 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\OpenOffice.org 3.3\OpenOffice.org.lnk2012-10-16 02:34:22 . 2011-03-04 21:28:25 841 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\OpenOffice.org 3.3\OpenOffice.org Calc.lnk2012-10-16 02:34:22 . 2011-03-04 21:28:25 857 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\OpenOffice.org 3.3\OpenOffice.org Base.lnk2012-10-16 02:34:22 . 2011-03-04 21:28:56 114 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\OpenOffice.org 3.3\Desktop.ini2012-10-16 02:34:22 . 2011-09-19 20:36:58 763 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\WavePad Sound Editor.lnk2012-10-16 02:34:22 . 2011-09-19 20:36:58 793 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Video Capture Software.lnk2012-10-16 02:34:22 . 2011-09-19 20:36:58 799 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\VideoPad Video Editor.lnk2012-10-16 02:34:22 . 2011-09-19 20:36:58 795 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Switch Sound File Converter.lnk2012-10-16 02:34:22 . 2011-09-19 20:36:58 799 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\SoundTap Streaming Recorder.lnk2012-10-16 02:34:22 . 2011-09-19 20:36:58 801 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\RecordPad Sound Recorder.lnk2012-10-16 02:34:22 . 2011-09-19 20:36:58 793 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Prism Video File Format Converter.lnk2012-10-16 02:34:22 . 2011-09-19 20:36:58 795 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\MixPad MultiTrack Mixer.lnk2012-10-16 02:34:22 . 2011-09-19 20:36:58 811 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Invoicing Software.lnk2012-10-16 02:34:22 . 2011-09-19 20:36:58 801 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Graphics File Converter.lnk2012-10-16 02:34:21 . 2011-09-19 16:52:40 809 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Golden Records LP Converter.lnk2012-10-16 02:34:21 . 2011-09-19 20:36:58 803 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Express Zip File Compression.lnk2012-10-16 02:34:21 . 2011-09-19 16:52:40 805 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Express Talk Softphone.lnk2012-10-16 02:34:21 . 2011-09-19 20:36:58 789 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Express Rip CD Ripper.lnk2012-10-16 02:34:21 . 2011-09-19 20:36:58 797 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Express Dictate Recorder.lnk2012-10-16 02:34:21 . 2011-09-19 20:36:58 805 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Express Burn CD, DVD or Blu-Ray.lnk2012-10-16 02:34:21 . 2011-09-19 20:36:58 803 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Classic FTP Software.lnk2012-10-16 02:34:21 . 2011-09-19 20:36:58 801 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Doxillion Document Converter.lnk2012-10-16 02:34:21 . 2011-09-19 20:36:58 813 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\NCH Software Suite\Accounting Software.lnk2012-10-16 02:34:21 . 2012-06-01 06:57:13 1,986 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Silverlight\Microsoft Silverlight.lnk2012-10-16 02:34:21 . 2011-09-13 00:32:00 2,427 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office Tools\Microsoft Office XP Language Settings.lnk2012-10-16 02:34:21 . 2011-09-13 00:32:01 2,447 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office Tools\Save My Settings Wizard.lnk2012-10-16 02:34:21 . 2011-09-13 00:32:00 2,401 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office Tools\Microsoft Office Application Recovery.lnk2012-10-16 02:34:21 . 2011-09-13 00:32:00 2,683 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office Tools\Microsoft Office Document Imaging.lnk2012-10-16 02:34:21 . 2011-09-13 00:32:00 2,635 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office Tools\Microsoft Office Document Scanning.lnk2012-10-16 02:34:21 . 2011-09-13 00:32:00 2,527 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office Tools\Microsoft Clip Organizer.lnk2012-10-16 02:34:21 . 2011-09-13 00:32:01 2,359 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office Tools\Activate Product.lnk2012-10-16 02:34:21 . 2011-09-13 00:32:01 2,483 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office Tools\Microsoft Access Snapshot Viewer.lnk2012-10-16 02:34:21 . 2012-05-23 21:58:11 820 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Malwarebytes' Anti-Malware\Uninstall Malwarebytes Anti-Malware.lnk2012-10-16 02:34:21 . 2012-05-23 21:58:11 947 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Malwarebytes' Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk2012-10-16 02:34:21 . 2012-05-23 21:58:11 796 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware.lnk2012-10-16 02:34:20 . 2012-05-23 21:58:11 796 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware Help.lnk2012-10-16 02:34:20 . 2011-02-11 17:33:29 792 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Lavalys\EVEREST Home Edition\Uninstall EVEREST Home Edition.lnk2012-10-16 02:34:20 . 2011-02-11 17:33:29 785 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Lavalys\EVEREST Home Edition\EVEREST Home Edition.lnk2012-10-16 02:34:20 . 2011-02-11 17:33:29 601 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Lavalys\EVEREST Home Edition\EVEREST Home Edition on the Web.lnk2012-10-16 02:34:20 . 2011-02-11 17:33:29 785 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Lavalys\EVEREST Home Edition\EVEREST Home Edition Documentation.lnk2012-10-16 02:34:20 . 2012-05-11 08:54:24 1,554 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\iTunes\iTunes.lnk2012-10-16 02:34:20 . 2012-05-11 08:54:24 1,814 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\iTunes\About iTunes.lnk2012-10-16 02:34:20 . 2011-03-21 20:54:58 647 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\InqScribe\Uninstall InqScribe.lnk2012-10-16 02:34:20 . 2011-03-21 20:54:58 1,522 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\InqScribe\InqScribe.lnk2012-10-16 02:34:20 . 2011-03-21 20:54:58 736 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\InqScribe\InqScribe User Guide.lnk2012-10-16 02:34:19 . 2011-02-27 23:32:13 1,205 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\Photosmart All-In-One 2600 series\Uninstall.lnk2012-10-16 02:34:19 . 2011-02-27 23:32:12 800 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\Photosmart All-In-One 2600 series\Readme.lnk2012-10-16 02:34:19 . 2011-02-27 23:32:13 1,071 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\Photosmart All-In-One 2600 series\Product Support Website.lnk2012-10-16 02:34:19 . 2011-02-27 23:32:13 833 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\Photosmart All-In-One 2600 series\Image Transfer.lnk2012-10-16 02:34:19 . 2011-02-27 23:32:13 836 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\Photosmart All-In-One 2600 series\Product Registration.lnk2012-10-16 02:34:19 . 2011-02-27 23:32:12 870 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\Photosmart All-In-One 2600 series\Help.lnk2012-10-16 02:34:19 . 2011-02-27 23:31:11 910 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\Image Zone .lnk2012-10-16 02:34:19 . 2011-02-27 23:29:43 929 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\System Diagnostics.lnk2012-10-16 02:34:19 . 2011-02-27 23:29:47 1,798 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\HP Product Assistant.lnk2012-10-16 02:34:19 . 2011-09-29 20:45:58 1,828 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\HP Update.lnk2012-10-16 02:34:19 . 2011-02-27 23:30:20 864 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\HP Image Zone Tour.lnk2012-10-16 02:34:19 . 2011-02-27 23:30:41 1,822 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\HP Document Viewer.lnk2012-10-16 02:34:19 . 2011-02-27 23:29:23 816 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\HP\HP Director.lnk2012-10-16 02:34:19 . 2011-09-16 03:41:23 1,638 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\Advanced Options\Open Recordings (only).lnk2012-10-16 02:34:19 . 2011-09-16 03:41:23 1,636 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\Advanced Options\Open Scheduler (only).lnk2012-10-16 02:34:19 . 2011-09-16 03:41:23 752 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\WinTV 7.lnk2012-10-16 02:34:19 . 2011-09-16 03:41:23 1,632 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\Advanced Options\Empty Channel Database.lnk2012-10-16 02:34:19 . 2011-09-16 03:41:23 1,710 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\Uninstall WinTV 7.lnk2012-10-16 02:34:19 . 2011-09-16 03:40:53 677 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\Stop IR.lnk2012-10-16 02:34:19 . 2011-09-16 03:40:47 1,731 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\Signal Monitor.lnk2012-10-16 02:34:19 . 2011-01-17 14:37:02 640 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\Amcap.lnk2012-10-16 02:34:19 . 2011-01-17 14:37:02 659 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\Prodinfo.lnk2012-10-16 02:34:19 . 2011-09-16 03:40:53 677 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Hauppauge WinTV\Restart IR.lnk2012-10-16 02:34:18 . 2011-11-17 22:16:12 1,707 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Google Earth\Uninstall Google Earth .lnk2012-10-16 02:34:18 . 2011-11-17 22:16:12 1,857 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Google Earth\Start Google Earth in OpenGL mode.lnk2012-10-16 02:34:18 . 2011-11-17 22:16:12 1,853 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Google Earth\Start Google Earth in DirectX mode.lnk2012-10-16 02:34:18 . 2011-11-17 22:16:12 1,925 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Google Earth\Google Earth.lnk2012-10-16 02:34:18 . 2012-01-21 02:16:20 778 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\GIMP\Uninstall.lnk2012-10-16 02:34:18 . 2012-01-21 02:16:20 804 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\GIMP\GIMP 2.lnk2012-10-16 02:34:18 . 2011-09-14 03:34:49 1,540 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\gBurner\gBurner Help.lnk2012-10-16 02:34:18 . 2011-09-14 03:34:49 1,540 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\gBurner\gBurner.lnk2012-10-16 02:34:18 . 2011-09-14 03:34:49 1,556 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\gBurner\Uninstall gBurner.lnk2012-10-16 02:34:18 . 2012-04-18 00:13:54 1,502 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Spider Solitaire.lnk2012-10-16 02:34:18 . 2011-01-11 06:21:10 885 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Pinball.lnk2012-10-16 02:34:18 . 2012-04-18 00:13:54 1,491 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Solitaire.lnk2012-10-16 02:34:18 . 2012-04-18 00:13:54 1,515 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Minesweeper.lnk2012-10-16 02:34:18 . 2011-01-21 21:19:12 913 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Internet Spades.lnk2012-10-16 02:34:18 . 2011-01-21 21:19:12 913 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Internet Hearts.lnk2012-10-16 02:34:18 . 2011-01-21 21:19:12 913 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Internet Reversi.lnk2012-10-16 02:34:18 . 2011-01-21 21:19:12 913 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Internet Checkers.lnk2012-10-16 02:34:18 . 2012-04-18 00:13:54 1,520 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Hearts.lnk2012-10-16 02:34:18 . 2011-01-21 21:19:12 913 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Internet Backgammon.lnk2012-10-16 02:34:18 . 2011-01-21 21:19:12 798 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\desktop.ini2012-10-16 02:34:18 . 2012-04-18 00:13:54 1,522 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Games\Freecell.lnk2012-10-16 02:34:18 . 2011-08-29 22:06:33 1,727 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Freecorder\Uninstall Freecorder.lnk2012-10-16 02:34:18 . 2011-08-29 22:06:33 1,562 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Freecorder\Freecorder Converter.lnk2012-10-16 02:34:18 . 2011-08-29 22:06:33 1,592 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Freecorder\Freecorder Settings.lnk2012-10-16 02:34:18 . 2011-08-29 22:06:33 1,569 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Freecorder\Freecorder Video History.lnk2012-10-16 02:34:18 . 2011-08-29 22:06:33 1,585 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Freecorder\FLVPlayer.lnk2012-10-16 02:34:18 . 2011-08-29 21:44:33 1,749 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\FLV Player\Uninstall Applian FLV Player.lnk2012-10-16 02:34:18 . 2011-08-29 21:44:33 1,585 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\FLV Player\Applian FLV Player.lnk2012-10-16 02:34:18 . 2011-01-24 04:56:46 585 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\DriverMax\Other products by Innovative Solutions.lnk2012-10-16 02:34:18 . 2011-01-24 04:56:46 798 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\DriverMax\Uninstall.lnk2012-10-16 02:34:17 . 2011-01-24 04:56:46 791 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\DriverMax\DriverMax.lnk2012-10-16 02:34:17 . 2011-02-04 03:44:17 1,749 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Corel\Visual Intelligence\Visual Intelligence.lnk2012-10-16 02:34:17 . 2011-02-04 03:44:17 946 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Corel\Visual Intelligence\Visit the Corel website.lnk2012-10-16 02:34:17 . 2011-02-04 03:44:17 667 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Corel\Visual Intelligence\Uninstall Visual Intelligence.lnk2012-10-16 02:34:17 . 2011-03-21 21:08:21 1,816 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\Filters\VSFilter Configuration.lnk2012-10-16 02:34:17 . 2011-03-21 21:08:21 1,856 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\Filters\FFDShow VFW Codec Configuration.lnk2012-10-16 02:34:17 . 2011-03-21 21:08:21 1,850 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\Filters\FFDShow Video Decoder Configuration.lnk2012-10-16 02:34:17 . 2011-03-21 21:08:21 1,842 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\Filters\Haali Media Splitter Settings.lnk2012-10-16 02:34:17 . 2011-03-21 21:08:21 1,860 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\Filters\FFDShow Audio Decoder Configuration.lnk2012-10-16 02:34:17 . 2011-03-21 21:08:21 1,858 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\Filters\FFDShow DXVA Video Decoder Configuration.lnk2012-10-16 02:34:17 . 2011-03-21 21:08:20 54 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\CCCP Website.url2012-10-16 02:34:17 . 2011-03-21 21:08:21 897 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\Media Player Classic Home Cinema.lnk2012-10-16 02:34:17 . 2011-03-21 21:08:20 84 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\CCCP Playback FAQ.url2012-10-16 02:34:17 . 2011-03-21 21:08:20 889 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\CCCP Settings.lnk2012-10-16 02:34:17 . 2011-03-21 21:08:21 1,749 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Combined Community Codec Pack\CCCP Uninstall.lnk2012-10-16 02:34:17 . 2012-04-18 00:19:13 82 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\CCleaner\CCleaner Homepage.url2012-10-16 02:34:17 . 2012-04-18 00:19:13 694 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\CCleaner\CCleaner.lnk2012-10-16 02:34:17 . 2012-04-18 00:19:13 682 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\CCleaner\Uninstall CCleaner.lnk2012-10-16 02:34:17 . 2011-01-18 04:30:08 1,791 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Catalyst Control Center\Help.lnk2012-10-16 02:34:17 . 2011-01-18 04:30:08 1,773 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Catalyst Control Center\Restart Runtime.lnk2012-10-16 02:34:17 . 2011-01-18 04:30:08 1,789 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Catalyst Control Center\CCC - Advanced.lnk2012-10-16 02:34:17 . 2011-01-18 04:30:08 1,783 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Catalyst Control Center\CCC - Wizard.lnk2012-10-16 02:34:17 . 2011-01-18 04:30:08 1,777 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Catalyst Control Center\CCC.lnk2012-10-16 02:34:17 . 2011-04-27 14:18:02 2,026 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Carbonite\Uninstall Carbonite.lnk2012-10-16 02:34:17 . 2012-04-02 20:01:15 1,647 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Bsecure Endpoint Security\Show Tray Icon.lnk2012-10-16 02:34:17 . 2012-04-02 20:01:15 1,624 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Bsecure Endpoint Security\Uninstall.lnk2012-10-16 02:34:17 . 2011-04-27 14:18:02 1,885 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Carbonite\Carbonite InfoCenter.lnk2012-10-16 02:34:17 . 2012-04-02 20:01:15 1,651 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Bsecure Endpoint Security\Bsecure Endpoint Security.lnk2012-10-16 02:34:17 . 2012-04-02 20:01:15 1,661 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Bsecure Endpoint Security\Help.lnk2012-10-16 02:34:17 . 2011-09-19 16:28:42 650 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\AVS4YOU\Help.lnk2012-10-16 02:34:17 . 2011-09-19 16:28:42 784 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\AVS4YOU\License Agreement.lnk2012-10-16 02:34:17 . 2011-09-19 16:28:42 842 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\AVS4YOU\Repair.lnk2012-10-16 02:34:17 . 2011-09-19 16:27:54 908 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\AVS4YOU\Video\AVS Video Converter.lnk2012-10-16 02:34:17 . 2011-09-19 16:28:29 1,021 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\AVS4YOU\Video\AVS Video Uploader.lnk2012-10-16 02:34:17 . 2011-09-19 16:28:41 655 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\AVS4YOU\Activation.lnk2012-10-16 02:34:17 . 2011-09-19 16:28:58 890 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\AVS4YOU\AVS Update Manager.lnk2012-10-16 02:34:17 . 2011-09-19 16:28:48 958 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\AVS4YOU\AVS4YOU Software Navigator.lnk2012-10-16 02:34:17 . 2011-09-19 20:36:58 801 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Streaming Audio Server.lnk2012-10-16 02:34:17 . 2011-09-19 20:36:58 797 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Text-to-Speech Reader.lnk2012-10-16 02:34:17 . 2011-09-19 20:36:58 799 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Streaming Audio Recorder.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 801 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Sound File Recorder.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 795 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Sound File Converter.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 763 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Sound File Editor.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 795 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Multitrack Mixer.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 795 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Record to CD or Mp3 Wizard.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 791 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\DJ Mixing Software.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 797 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Dictation Recorder.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 801 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\Crescendo Music Notation.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 805 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\CD Audio Burn Recorder.lnk2012-10-16 02:34:16 . 2011-09-19 20:36:58 789 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Audio Related Programs\CD Audio Rip Extractor.lnk2012-10-16 02:34:16 . 2011-08-29 22:29:58 1,801 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Applian Technologies\Uninstall Replay Converter 4.lnk2012-10-16 02:34:16 . 2011-08-29 22:33:43 1,761 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Applian Technologies\Uninstall Applian Director.lnk2012-10-16 02:34:16 . 2011-09-22 07:44:10 966 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Applian Technologies\Replay Media Catcher 4.lnk2012-10-16 02:34:16 . 2011-08-29 22:29:34 1,794 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Applian Technologies\Replay Player.lnk2012-10-16 02:34:16 . 2011-08-29 22:29:58 1,699 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Applian Technologies\Replay Converter.lnk2012-10-16 02:34:16 . 2011-08-29 22:29:58 1,720 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Applian Technologies\DisableDshowCodecs.lnk2012-10-16 02:34:16 . 2011-08-29 22:29:58 1,713 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Applian Technologies\EnableDshowCodecs.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:38 1,602 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Services.lnk2012-10-16 02:34:16 . 2011-08-29 22:33:42 1,632 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Applian Technologies\Applian Director.lnk2012-10-16 02:34:16 . 2011-02-27 23:28:38 1,107 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Microsoft .NET Framework 1.1 Configuration.lnk2012-10-16 02:34:16 . 2011-02-27 23:28:38 1,158 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Microsoft .NET Framework 1.1 Wizards.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:38 1,591 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Performance.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:38 1,590 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Local Security Policy.lnk2012-10-16 02:34:16 . 2011-01-11 06:23:45 545 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\desktop.ini2012-10-16 02:34:16 . 2012-04-18 00:13:38 1,592 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Event Viewer.lnk2012-10-16 02:34:16 . 2011-01-11 06:20:56 1,582 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Component Services.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:38 1,602 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Computer Management.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:38 1,596 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Data Sources (ODBC).lnk2012-10-16 02:34:16 . 2012-04-18 00:13:37 1,616 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\System Restore.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:37 1,591 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:37 1,753 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\Scheduled Tasks.lnk2012-10-16 02:34:16 . 2011-01-11 06:22:48 1,070 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\System Information.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:37 1,532 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\Disk Cleanup.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:37 1,572 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\Disk Defragmenter.lnk2012-10-16 02:34:16 . 2011-01-11 06:23:45 757 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\desktop.ini2012-10-16 02:34:16 . 2012-04-18 00:13:37 1,521 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\Character Map.lnk2012-10-16 02:34:16 . 2012-04-18 00:13:37 1,532 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\Backup.lnk2012-10-16 02:34:15 . 2012-04-18 00:13:37 1,599 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\Activate Windows.lnk2012-10-16 02:34:15 . 2012-04-18 00:13:36 1,528 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Entertainment\Volume Control.lnk2012-10-16 02:34:15 . 2011-01-11 06:21:10 146 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Entertainment\desktop.ini2012-10-16 02:34:15 . 2012-04-18 00:13:36 1,528 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Entertainment\Sound Recorder.lnk2012-10-16 02:34:15 . 2012-04-18 00:13:36 1,656 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications\Wireless Network Setup Wizard.lnk2012-10-16 02:34:15 . 2012-04-18 00:13:36 1,646 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications\New Connection Wizard.lnk2012-10-16 02:34:15 . 2012-04-18 00:13:36 1,640 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications\Network Setup Wizard.lnk2012-10-16 02:34:15 . 2011-01-11 05:45:49 516 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications\desktop.ini2012-10-16 02:34:15 . 2011-01-11 06:21:10 786 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications\HyperTerminal.lnk2012-10-16 02:34:15 . 2012-04-18 00:13:36 1,757 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications\Network Connections.lnk2012-10-16 02:34:15 . 2011-01-11 06:21:10 90 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Accessibility\desktop.ini2012-10-16 02:34:15 . 2012-04-18 00:13:36 1,520 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Accessibility\Accessibility Wizard.lnk2012-10-16 02:34:15 . 2011-01-11 06:21:10 879 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\WordPad.lnk2012-10-16 02:34:15 . 2012-05-25 05:36:54 710 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Scanner and Camera Wizard.lnk2012-10-16 02:34:15 . 2012-04-18 00:13:36 1,585 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Remote Desktop Connection.lnk2012-10-16 02:34:15 . 2012-05-25 05:36:54 255 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\desktop.ini2012-10-16 02:34:15 . 2012-04-14 22:39:22 1,515 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Paint.lnk2012-10-16 02:34:15 . 2012-04-04 17:32:21 1,498 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Calculator.lnk2012-10-16 02:34:15 . 2011-09-19 20:36:56 789 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\WavePad Sound Editor.lnk2012-10-16 02:34:15 . 2011-01-11 06:22:52 786 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Windows Movie Maker.lnk2012-10-16 02:34:15 . 2011-09-19 16:52:34 805 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\VideoPad Video Editor.lnk2012-10-16 02:34:15 . 2012-05-25 07:11:06 1,854 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Safari.lnk2012-10-16 02:34:15 . 2011-03-24 06:14:59 730 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Mozilla Firefox.lnk2012-10-16 02:34:15 . 2012-05-11 07:25:58 2,365 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Nitro Pro 7.lnk2012-10-16 02:34:15 . 2011-09-19 16:51:29 777 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Prism Video File Converter.lnk2012-10-16 02:34:15 . 2012-06-07 21:59:37 2,489 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Word.lnk2012-10-16 02:34:15 . 2011-09-13 00:32:01 2,531 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft PowerPoint.lnk2012-10-16 02:34:15 . 2012-05-07 06:51:25 2,487 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Excel.lnk2012-10-16 02:34:15 . 2011-09-19 21:15:45 2,513 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Outlook.lnk2012-10-16 02:34:15 . 2011-01-11 06:22:52 150 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\desktop.ini2012-10-16 02:34:15 . 2011-01-12 21:59:58 829 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Doxillion Document Converter.lnk2012-10-16 02:34:15 . 2011-03-16 02:58:22 782 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Express Scribe.lnk2012-10-16 02:34:15 . 2011-02-27 23:30:28 731 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\I.R.I.S. OCR Registration.lnk2012-10-16 02:34:15 . 2011-09-13 00:32:00 2,529 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Access.lnk2012-10-16 02:34:14 . 2011-02-04 03:44:17 1,737 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Corel Visual Intelligence.lnk2012-10-16 02:34:14 . 2011-04-03 14:08:24 781 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Debut Video Capture Software.lnk2012-10-16 02:34:14 . 2011-08-29 21:44:33 1,579 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Applian FLV Player.lnk2012-10-16 02:34:14 . 2012-05-17 06:16:37 2,315 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Adobe Reader X.lnk2012-10-16 02:34:14 . 2012-05-25 07:39:10 2,265 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Programs\Apple Software Update.lnk2012-10-16 02:34:14 . 2012-04-18 00:14:08 1,507 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Windows Update.lnk2012-10-16 02:34:14 . 2011-02-04 03:42:41 1,863 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\WordPerfect OfficeReady.lnk2012-10-16 02:34:14 . 2012-04-18 00:14:08 1,563 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Set Program Access and Defaults.lnk2012-10-16 02:34:14 . 2011-01-11 06:23:45 398 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Windows Catalog.lnk2012-10-16 02:34:14 . 2011-02-27 23:29:23 804 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\HP Director.lnk2012-10-16 02:34:14 . 2011-01-11 04:28:26 1,566 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Microsoft Update.lnk2012-10-16 02:34:14 . 2012-01-24 02:48:01 2,433 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\New Office Document.lnk2012-10-16 02:34:14 . 2012-01-24 02:49:32 2,443 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\Open Office Document.lnk2012-10-16 02:34:14 . 2011-01-11 05:44:48 272 --sha-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\desktop.ini2012-10-16 02:34:14 . 2011-02-27 23:31:11 898 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\Francie\LOCALS~1\Temp\smtmp\1\HP Image Zone.lnk2012-10-16 02:23:22 . 2012-10-16 21:00:18 133 ----a-w- C:\Qoobox\Quarantine\catchme.log2012-07-09 22:49:00 . 2012-07-09 22:49:00 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL0123.tmp.vir2012-07-09 22:49:00 . 2012-07-11 04:13:33 20,992 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL0377.tmp.vir2012-07-09 22:49:00 . 2012-07-10 04:35:47 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL0818.tmp.vir2012-07-09 22:49:00 . 2012-07-10 04:42:02 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL0976.tmp.vir2012-07-09 22:49:00 . 2012-07-10 04:41:08 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL1533.tmp.vir2012-07-09 22:49:00 . 2012-07-11 04:25:38 20,992 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL1715.tmp.vir2012-07-09 22:49:00 . 2012-07-11 04:13:40 20,992 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL1756.tmp.vir2012-07-09 22:49:00 . 2012-07-10 04:36:52 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL2186.tmp.vir2012-07-09 22:49:00 . 2012-07-09 22:49:05 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL2764.tmp.vir2012-07-09 22:49:00 . 2012-07-10 04:43:10 20,480 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL2836.tmp.vir2012-07-09 22:49:00 . 2012-07-11 04:13:45 20,992 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL3800.tmp.vir2012-06-25 19:34:11 . 2012-06-27 07:35:46 20,992 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL1294.tmp.vir2012-04-10 20:15:22 . 2012-04-10 20:15:22 60,304 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\g2mdlhlpx.exe.vir2011-12-11 08:13:15 . 2011-12-11 08:13:24 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL0358.tmp.vir2011-12-11 08:13:15 . 2011-12-11 08:50:50 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL0866.tmp.vir2011-12-11 08:13:15 . 2011-12-11 08:51:01 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL0938.tmp.vir2011-12-11 08:13:15 . 2011-12-11 08:46:42 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL1710.tmp.vir2011-12-11 08:13:15 . 2011-12-11 08:50:56 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL2241.tmp.vir2011-12-11 08:13:15 . 2011-12-11 08:51:12 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL2555.tmp.vir2011-12-11 08:13:15 . 2011-12-11 08:13:43 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL3133.tmp.vir2011-12-11 08:13:15 . 2011-12-11 08:13:15 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL3298.tmp.vir2011-12-11 08:13:15 . 2011-12-11 08:48:02 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL3536.tmp.vir2011-12-11 08:13:15 . 2011-12-11 08:13:36 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL3796.tmp.vir2011-09-04 18:52:44 . 2011-09-04 18:52:44 737 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\2121.txt.vir2011-09-04 06:17:55 . 2011-09-05 05:34:35 3,888 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\mru.xml.vir2011-09-03 04:47:19 . 2011-09-03 04:47:19 858 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\898.txt.vir2011-09-03 04:02:46 . 2011-09-03 04:02:46 658 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\2867.txt.vir2011-09-03 03:56:10 . 2011-09-03 03:56:10 489 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\5260.txt.vir2011-09-03 03:54:52 . 2011-09-03 03:54:52 714 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\5259.txt.vir2011-09-03 03:34:04 . 2011-09-03 03:34:04 665 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\5352.txt.vir2011-09-03 03:30:29 . 2011-09-03 03:30:29 517 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\4002.txt.vir2011-09-02 17:33:26 . 2011-09-02 17:33:26 332 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\4471.txt.vir2011-09-02 03:10:14 . 2011-09-02 03:10:14 328 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\946.txt.vir2011-09-01 17:50:29 . 2011-09-01 17:50:29 660 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\3213.txt.vir2011-09-01 17:49:49 . 2011-09-01 17:49:49 484 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\5992.txt.vir2011-09-01 05:53:00 . 2011-09-01 05:53:00 333 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\2637.txt.vir2011-09-01 05:52:36 . 2011-09-01 05:52:36 373 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\3003.txt.vir2011-08-31 23:54:17 . 2011-08-31 23:54:17 702 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\10.txt.vir2011-08-31 19:02:15 . 2011-08-31 19:02:15 374 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\4275.txt.vir2011-08-30 17:56:10 . 2011-08-30 17:56:10 2,176 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\5218.txt.vir2011-08-30 05:04:58 . 2011-08-30 05:04:58 310 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\6781.txt.vir2011-08-30 03:03:52 . 2011-08-30 03:03:52 2,001 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\2229.txt.vir2011-08-29 14:15:12 . 2011-08-29 14:15:12 21,628 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\wlu.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 2,227 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\1.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 10,157 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\a.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 10,630 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\b.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 12,106 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\c.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 7,067 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\d.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 7,675 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\e.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 4,707 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\f.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 5,267 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\g.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 3,928 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\h.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 3,922 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\i.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 2,102 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\j.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 2,656 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\k.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 5,737 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\l.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 8,433 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\m.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 2,824 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\n.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 3,269 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\o.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 7,699 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\p.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 421 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\q.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 3,142 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\r.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 14,364 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\s.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 8,036 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\t.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 1,414 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\u.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 2,247 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\v.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 2,868 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\w.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 298 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\x.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 763 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\y.txt.vir2011-07-18 05:16:10 . 2011-07-18 05:16:10 907 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\Application Data\PriceGong\Data\z.txt.vir2011-02-04 19:08:32 . 2011-02-04 19:08:33 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL0036.tmp.vir2011-02-04 19:08:32 . 2011-02-06 06:43:06 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL2256.tmp.vir2011-02-04 19:08:32 . 2011-02-04 19:08:41 19,968 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Francie\My Documents\~WRL2557.tmp.vir2011-02-04 03:42:30 . 1997-06-25 20:24:16 40,448 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\regobj.dll.vir2009-01-31 01:34:14 . 2009-01-31 01:34:14 2,458,112 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\SET3EC.tmp.vir2009-01-31 01:34:08 . 2009-01-31 01:34:08 157,184 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\SET3E4.tmp.vir2009-01-31 01:34:06 . 2009-01-31 01:34:06 222,208 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\SET3E0.tmp.vir2008-04-14 00:12:17 . 2008-04-14 00:12:17 294,912 -c--a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\dllcache\dlimport.exe.vir2004-08-04 12:00:00 . 2010-12-09 15:15:09 718,336 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\ntdll.dll.vir2003-02-21 10:16:08 . 2003-02-21 10:16:08 49,152 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\URTTEMP\regtlib.exe.vir2000-05-24 02:45:58 . 2000-05-24 02:45:58 118,784 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\msstdfmt.dll.vir


----------



## Cookiegal (Aug 27, 2003)

I'm checking into the possibility of a couple of false positives by ComboFix but for the most part, in response to your query, the following are malware-related:

Anything with these in them:

nhrmdtgf
gbgrrpg
exfiwyyu.dll

The entries in the "Temp\*smtmp*" folder (which is the majority of the log) are valid programs and files that were moved there by the malware. These should now be restored to their correct locations.

Some of the other entries are created by CF for backup purposes.

As for Carbonite, I see in the ComboFix log that was posted that it's been unchecked in msconfig. So please go to *Start *- *Run *- type in *msconfig *and click OK to open the System Configuration Utility. Then click on the startup tab and put a check beside the Carbonite entry then click "Apply" and OK. Let me know if it starts working after doing that. If not, a reboot may be necessary.


----------



## Cookiegal (Aug 27, 2003)

A couple of false positives have been confirmed by the developer of ComboFix so we'll use ComboFix to restore those files from the quarantine back to their proper locations.

Open Notepad and copy and paste the text in the code box below into it:


```
DEQUARANTINE::
C:\Qoobox\Quarantine\C\WINDOWS\system32\dllcache\dlimport.exe.vir
C:\Qoobox\Quarantine\C\WINDOWS\system32\msstdfmt.dll.vir
QUIT::
```
Save the file to your desktop and name it CFScript.txt

Referring to the picture below, drag CFScript.txt into Puppy.exe (ComboFix).










This will start ComboFix again but it will not do a full scan, it will merely restore the files and then it will stop when that process has been completed. It will generate a log named DeQuarantine.txt. Please copy and paste the contents of that log here.


----------



## shadowbird (Oct 9, 2012)

Hi Cookiegal:
I am using another computer, because I can no longer get to the Internet and there is one of two things that is causing it. Here&#8217;s the step-by-step update of today.
.
Before checking your newest post this evening, I decided to search a couple things on my computer (Forgetting that my anti virus programs were disabled/uninstalled in order to run Combofix), and apparently picked up malware which was redirecting my browser and preventing me from getting to this site.
.
None of the antivirus programs would run or install, so I used Eset online scanner which found and quarantined four infections (listed here): 
win32/TrojanDownloader.Tracur.P.Gen trojan
JS/Redirector.NCG Trojan
Win32/BHO.OEl Trojan
Win32/TrojanDownloader.Tracur.Gen Trojan
.
.
After that I was able to get online to see your post and run the Combofix Dequarantine (log listed here): could not paste since I'm on a diff computer, so it&#8217;s hand typed and triple checked:
C:\Qoobox\Quarantine\c\windows\system32\dllcache\dimport.exe.vir->
C:\Windows\system32\dllcache\dlimport.exe (294912 bytes)
C:\Qoobox\Quarantine\c\windows\system32\msstdfmt.dll.vir->
C:\Windows\system32\ msstdfmt.dll (118784 bytes)

But first, on my way back, before pasting the Dequarantine log, I had clicked on the wrong IE tab, and that tab might be for the web page that infected my computer with the items that Eset just quarantined. I am not sure of that, nor am I sure if that web page even loaded, because I moved to the correct tab to get to this forum so quickly that I didn&#8217;t see exactly what happened with the first tab.
.
It&#8217;s hard to believe I got reinfected from the same web page from the first infection, because it&#8217;s behaving differently this time. I wonder if the problem is with the Combofix Dequarantine?
.
But I cannot get online to run the Eset online scanner again. So I started the only thing that will run: VipreRescue (saw that it found something), but it&#8217;s going to take all night in safe mode, so here I am on a different computer to post this. 
.
Summary: Either that infection is keeping me from getting online again, or it has to do with the files that were dequarantined, because it happened immediately after.
.
If I can get online again, I can paste the logfile from VipreRescue. But if I can&#8217;t, then I could just type and post the quarantine file.
.
Thanks again for all you are doing to help. It is my hope that soon my computer will be working again and I can get back to work. : )


----------



## Cookiegal (Aug 27, 2003)

If you didn't re-enable your anti-virus protection then that's likely the cause. If you still can't connect to the Internet then you can transfer this via USB to the infected computer and run it.

Please go  here and download the *TDSSKiller.exe* to your desktop.

Double-click to TDSSKiller.exe on your desktop to run it.
Click on *Start Scan*
As we don't want to fix anything yet, if any malicious objects are detected, *do NOT select Cure* but select *Skip* instead.
It will produce a log once it finishes in the root drive which should look like this example:

C:\TDSSKiller.<version_date_time>log.txt

Please copy and paste the contents of that log in your next reply.


----------



## shadowbird (Oct 9, 2012)

I'm back online on my own PC. I had already run VipreRescue, and it found a threat. Below is the info from VipreRescue's logfile, and from TDSSKiller. Following that is an update on the error messages:

This was found during a brief look at one of the log files from this morning. I saw this phrase "rootkitthreat" in a few places:
ThreatEngineUtils::IsRootkitThreat: file=<C:\WINDOWS\security\Database\secedit.sdb> is excluded from scanning
FROM QUARANTINE FOLDER, CREATED FROM 102012 6:47AM SCAN:
<SBCSQuarantineRecordXML threatId="53430" name="EICAR (v)" level="4" category="Misc (General)" type="Misc" adviseType="3" canQuarantine="true" author="" optionalScan="0" quarantineId="{D52908AF-3A20-4DD4-90A1-BD68DD5F8BB0}" dateTimeStampUTC="2012-10-20T10:47:04" scanGUID="{23846A76-3189-4BE3-9B65-1814367227FC}" quarantineLocation="C:\VIPRERESCUE\Quarantine" Source="0" BufferOnly="false" threatDefinitionVersion="13224"><authorURL></authorURL><desc>Miscellaneous threats include applications that do not fit into other categories or that fall into multiple categories. Miscellaneous threats typically include some form of potentially objectionable functionality that may pose privacy or security risks to users and their PCs.</desc><threatAdviceDetails>This is a moderate risk and should be removed or quarantined as it may negatively impact your privacy and security or make unwanted changes to your computer's settings.</threatAdviceDetails><customData></customData><fixes><fix traceType="4" actionType="1" isTransient="false" dispValue="C:\Documents and Settings\Francie\Local Settings\temp\Av-test.txt"><originalAttributes><attr n="path" v="C:\Documents and Settings\Francie\Local Settings\temp\Av-test.txt"/><attr n="hidden" v="true"/><attr n="md5" v="1195B64D237F57E6289D3CD105228D93"/><attr n="detectionType" v="4"/></originalAttributes><quarantineAttributes><attr n="quarantineName" v="{FE5FD193-EC54-4369-88F1-7D188CBBA0AC}"/><attr n="isEncrypted" v="true"/></quarantineAttributes></fix></fixes></SBCSQuarantineRecordXML>
XML QUARANTINE DOC CREATED AT END OF SCAN 6:47AM:
- <SBCSThreatEngineResults version="4.0.3904">
- 
- <scannerResults>
<numThreats found="1" ignored="0" /> 
<numTracesScanned cookies="0" registry="66832" files="213068" folders="36734" processes="16" archives="0" procModule="907" procMemory="0" threads="0" sysModules="104" ssdt="284" ntdllExport="1316" ntosExport="1489" hookIAT="97" hookIDT="246" scanSysEnter="1" hookDevice="768" hookCodeSectionRing0="175" hookCodeSectionRing3="0" MBR="1" total="322038" /> 
<numTracesFound cookies="0" registry="0" files="1" folders="0" processes="0" archives="0" procModule="0" procMemory="0" threads="0" sysModules="0" ssdt="0" ntdllExport="0" ntosExport="0" hookIAT="0" hookIDT="0" scanSysEnter="0" hookDevice="0" hookCodeSectionRing0="0" hookCodeSectionRing3="0" MBR="0" total="1" /> 
<dateTimeStampUTC start="2012-10-20T05:13:25" end="2012-10-20T10:47:02" /> 
<errors /> 
</scannerResults>
- <cleanerResults>
<numThreats deleted="0" quarantined="1" ignored="0" reportonly="0" total="1" /> 
<dateTimeStampUTC start="2012-10-20T10:47:04" end="2012-10-20T10:47:04" /> 
<errors /> 
</cleanerResults>

- <scannerOptions scanAllLocalDrives="true" excludeRemovableDrives="true" scanFiles="true" scanCookies="false" scanProcesses="true" scanProcessThread="true" scanRegistry="true" scanProcessesDeep="true" suspendActiveThreats="true" scanAllUsers="true" useFileNameAndCRC8="true" dontCalcCRC8="false" scanCommonTactics="true" scanArchives="false" scanKnownFileTypes="false" recursiveFileScan="true" findLowRiskThreats="true" keepScanRecord="true" maxCheckFileLen="6291456" minCheckFileLen="0" scanVipreSuspicious="false" scanDerivatives="true" scanRootkits="true" scanProcessMemory="true" scanSystemModule="true" ssdt="true" ntdllExport="true" ntosExport="true" hookIAT="true" scanIDT="true" scanSysEnter="true" scanDevice="true" scanCodeSectionRing0="true" scanCodeSectionRing3="true" scanMBR="true">
<userIncludedPaths /> 
<userExcludedPaths /> 
<ignoredThreats /> 
</scannerOptions>
<cleanerOptions /> 
- <threats>
- <threat id="53430" name="EICAR (v)" level="4" category="Misc (General)" type="Misc" quarantineId="{D52908AF-3A20-4DD4-90A1-BD68DD5F8BB0}" adviseType="3" canQuarantine="true" author="" optionalScan="0" actionRequested="-1" cleanerResult="3">
<authorURL /> 
<desc>Miscellaneous threats include applications that do not fit into other categories or that fall into multiple categories. Miscellaneous threats typically include some form of potentially objectionable functionality that may pose privacy or security risks to users and their PCs.</desc> 
<threatAdviceDetails>This is a moderate risk and should be removed or quarantined as it may negatively impact your privacy and security or make unwanted changes to your computer's settings.</threatAdviceDetails> 
<customData /> 
- <traces>
- <trace type="4" dispValue="C:\Documents and Settings\Francie\Local Settings\temp\Av-test.txt">
<attr n="hidden" v="true" /> 
<attr n="path" v="C:\Documents and Settings\Francie\Local Settings\temp\Av-test.txt" /> 
<attr n="fileSize" v="72" /> 
<attr n="md5" v="1195B64D237F57E6289D3CD105228D93" /> 
<attr n="detectionType" v="4" /> 
</trace>
</traces>
</threat>
</threats>
</SBCSThreatEngineResults>


----------



## shadowbird (Oct 9, 2012)

Will post the TDSSKiller and error update soon.


----------



## shadowbird (Oct 9, 2012)

14:25:13.0593 1480 TDSS rootkit removing tool 2.8.13.0 Oct 12 2012 17:26:47
14:25:13.0859 1480 ============================================================
14:25:13.0859 1480 Current date / time: 2012/10/20 14:25:13.0859
14:25:13.0859 1480 SystemInfo:
14:25:13.0859 1480 
14:25:13.0859 1480 OS Version: 5.1.2600 ServicePack: 3.0
14:25:13.0859 1480 Product type: Workstation
14:25:13.0859 1480 ComputerName: FRANCIE-PC
14:25:13.0859 1480 UserName: Francie
14:25:13.0859 1480 Windows directory: C:\WINDOWS
14:25:13.0859 1480 System windows directory: C:\WINDOWS
14:25:13.0859 1480 Processor architecture: Intel x86
14:25:13.0859 1480 Number of processors: 2
14:25:13.0859 1480 Page size: 0x1000
14:25:13.0859 1480 Boot type: Safe boot with network
14:25:13.0859 1480 ============================================================
14:25:16.0765 1480 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
14:25:16.0796 1480 ============================================================
14:25:16.0796 1480 \Device\Harddisk0\DR0:
14:25:16.0796 1480 MBR partitions:
14:25:16.0796 1480 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x254297C1
14:25:16.0796 1480 ============================================================
14:25:16.0859 1480 C: <-> \Device\Harddisk0\DR0\Partition1
14:25:17.0187 1480 ============================================================
14:25:17.0187 1480 Initialize success
14:25:17.0187 1480 ============================================================
14:25:42.0703 0196 ============================================================
14:25:42.0703 0196 Scan started
14:25:42.0703 0196 Mode: Manual; 
14:25:42.0703 0196 ============================================================
14:25:49.0390 0196 ================ Scan system memory ========================
14:25:49.0390 0196 System memory - ok
14:25:49.0390 0196 ================ Scan services =============================
14:25:50.0062 0196 Abiosdsk - ok
14:25:50.0109 0196 abp480n5 - ok
14:25:50.0187 0196 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
14:25:50.0234 0196 ACPI - ok
14:25:50.0312 0196 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
14:25:50.0312 0196 ACPIEC - ok
14:25:50.0343 0196 adpu160m - ok
14:25:50.0453 0196 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
14:25:50.0484 0196 aec - ok
14:25:50.0609 0196 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
14:25:50.0640 0196 AFD - ok
14:25:50.0671 0196 Aha154x - ok
14:25:50.0734 0196 aic78u2 - ok
14:25:50.0765 0196 aic78xx - ok
14:25:50.0859 0196 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll
14:25:50.0875 0196 Alerter - ok
14:25:50.0921 0196 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe
14:25:50.0921 0196 ALG - ok
14:25:50.0968 0196 AliIde - ok
14:25:51.0000 0196 amsint - ok
14:25:51.0078 0196 [ 1BF91F352D746AD7469FA71783B5FAE8 ] APLMp50 C:\WINDOWS\system32\Drivers\APLMp50.sys
14:25:51.0093 0196 APLMp50 - ok
14:25:51.0437 0196 [ F401929EE0CC92BFE7F15161CA535383 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
14:25:51.0437 0196 Apple Mobile Device - ok
14:25:51.0500 0196 [ 69370F2E2827FFBA910D0BFA9E62E484 ] appliand C:\WINDOWS\system32\DRIVERS\appliand.sys
14:25:51.0515 0196 appliand - ok
14:25:51.0546 0196 [ 69370F2E2827FFBA910D0BFA9E62E484 ] appliandMP C:\WINDOWS\system32\DRIVERS\appliand.sys
14:25:51.0546 0196 appliandMP - ok
14:25:51.0640 0196 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll
14:25:51.0640 0196 AppMgmt - ok
14:25:51.0671 0196 asc - ok
14:25:51.0734 0196 asc3350p - ok
14:25:51.0765 0196 asc3550 - ok
14:25:51.0968 0196 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
14:25:52.0000 0196 aspnet_state - ok
14:25:52.0109 0196 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
14:25:52.0109 0196 AsyncMac - ok
14:25:52.0140 0196 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
14:25:52.0140 0196 atapi - ok
14:25:52.0187 0196 Atdisk - ok
14:25:52.0296 0196 [ 4ADE3F07DE5F5376E6030E16B945A5EF ] Ati HotKey Poller C:\WINDOWS\system32\Ati2evxx.exe
14:25:52.0312 0196 Ati HotKey Poller - ok
14:25:52.0859 0196 [ 3FFF73A29663EDA8EC7169A7CFDE29F4 ] ati2mtag C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
14:25:52.0953 0196 ati2mtag - ok
14:25:53.0093 0196 [ DC6957811FF95F2DD3004361B20D8D3F ] AtiHdmiService C:\WINDOWS\system32\drivers\AtiHdmi.sys
14:25:53.0109 0196 AtiHdmiService - ok
14:25:53.0156 0196 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
14:25:53.0156 0196 Atmarpc - ok
14:25:53.0234 0196 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
14:25:53.0234 0196 AudioSrv - ok
14:25:53.0312 0196 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
14:25:53.0343 0196 audstub - ok
14:25:53.0421 0196 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
14:25:53.0421 0196 Beep - ok
14:25:53.0500 0196 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll
14:25:53.0656 0196 BITS - ok
14:25:53.0859 0196 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
14:25:53.0875 0196 Bonjour Service - ok
14:25:53.0937 0196 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll
14:25:53.0937 0196 Browser - ok
14:25:54.0031 0196 [ C9AFF970593E598B896F22898D768105 ] BSecACFltr C:\WINDOWS\system32\DRIVERS\BSecACFltr.sys
14:25:54.0031 0196 BSecACFltr - ok
14:25:54.0093 0196 [ 80505B18392A04486C681FE3D659F2CC ] Bsecure C:\Program Files\Bsecure\InetCtrl.exe
14:25:54.0093 0196 Bsecure - ok
14:25:54.0156 0196 [ 986887D63B4DD32256A638AD964A5906 ] BsecureAV C:\Program Files\Bsecure\BsecAV.exe
14:25:54.0156 0196 BsecureAV - ok
14:25:54.0203 0196 [ 0A00FD8D22ECF4031964414F699B7BBD ] BsecureFilter C:\WINDOWS\system32\drivers\BsecFltr.sys
14:25:54.0203 0196 BsecureFilter - ok
14:25:54.0625 0196 [ ED92EF9E3ADB953B20C334E0FE23E712 ] CarboniteService C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
14:25:54.0671 0196 CarboniteService - ok
14:25:54.0953 0196 catchme - ok
14:25:55.0031 0196 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
14:25:55.0046 0196 cbidf2k - ok
14:25:55.0125 0196 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
14:25:55.0125 0196 CCDECODE - ok
14:25:55.0171 0196 cd20xrnt - ok
14:25:55.0234 0196 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
14:25:55.0265 0196 Cdaudio - ok
14:25:55.0328 0196 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
14:25:55.0359 0196 Cdfs - ok
14:25:55.0406 0196 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
14:25:55.0421 0196 Cdrom - ok
14:25:55.0453 0196 Changer - ok
14:25:55.0562 0196 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe
14:25:55.0593 0196 CiSvc - ok
14:25:55.0656 0196 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
14:25:55.0656 0196 ClipSrv - ok
14:25:55.0718 0196 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
14:25:55.0921 0196 clr_optimization_v2.0.50727_32 - ok
14:25:56.0062 0196 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
14:25:56.0093 0196 clr_optimization_v4.0.30319_32 - ok
14:25:56.0125 0196 CmdIde - ok
14:25:56.0187 0196 COMSysApp - ok
14:25:56.0296 0196 Cpqarray - ok
14:25:56.0390 0196 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
14:25:56.0421 0196 CryptSvc - ok
14:25:56.0484 0196 [ 71007BD2E1E26927FE3E4EB00C0BEEDF ] ctljystk C:\WINDOWS\system32\DRIVERS\ctljystk.sys
14:25:56.0500 0196 ctljystk - ok
14:25:56.0562 0196 dac2w2k - ok
14:25:56.0609 0196 dac960nt - ok
14:25:56.0812 0196 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
14:25:56.0859 0196 DcomLaunch - ok
14:25:56.0921 0196 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
14:25:56.0937 0196 Dhcp - ok
14:25:56.0984 0196 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
14:25:56.0984 0196 Disk - ok
14:25:57.0031 0196 dmadmin - ok
14:25:57.0140 0196 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
14:25:57.0171 0196 dmboot - ok
14:25:57.0203 0196 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys
14:25:57.0203 0196 dmio - ok
14:25:57.0281 0196 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
14:25:57.0281 0196 dmload - ok
14:25:57.0343 0196 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll
14:25:57.0375 0196 dmserver - ok
14:25:57.0421 0196 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
14:25:57.0453 0196 DMusic - ok
14:25:57.0515 0196 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
14:25:57.0531 0196 Dnscache - ok
14:25:57.0703 0196 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
14:25:57.0718 0196 Dot3svc - ok
14:25:57.0750 0196 dpti2o - ok
14:25:57.0828 0196 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
14:25:57.0843 0196 drmkaud - ok
14:25:57.0906 0196 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll
14:25:57.0937 0196 EapHost - ok
14:25:58.0109 0196 [ 01F83E1B5DCE05F5CB7D99113CA9E890 ] emu10k C:\WINDOWS\system32\drivers\emu10k1m.sys
14:25:58.0125 0196 emu10k - ok
14:25:58.0171 0196 [ 7FFA171CCE6A8BFC774862A578BA39A2 ] emu10k1 C:\WINDOWS\system32\drivers\ctlfacem.sys
14:25:58.0171 0196 emu10k1 - ok
14:25:58.0328 0196 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll
14:25:58.0328 0196 ERSvc - ok
14:25:58.0421 0196 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe
14:25:58.0421 0196 Eventlog - ok
14:25:58.0531 0196 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll
14:25:58.0546 0196 EventSystem - ok
14:25:58.0656 0196 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
14:25:58.0671 0196 Fastfat - ok
14:25:58.0734 0196 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
14:25:58.0734 0196 FastUserSwitchingCompatibility - ok
14:25:58.0796 0196 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys
14:25:58.0796 0196 Fdc - ok
14:25:58.0859 0196 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys
14:25:58.0875 0196 Fips - ok
14:25:58.0937 0196 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys
14:25:58.0937 0196 Flpydisk - ok
14:25:59.0015 0196 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys
14:25:59.0031 0196 FltMgr - ok
14:25:59.0218 0196 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
14:25:59.0281 0196 FontCache3.0.0.0 - ok
14:25:59.0343 0196 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
14:25:59.0343 0196 Fs_Rec - ok
14:25:59.0421 0196 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
14:25:59.0421 0196 Ftdisk - ok
14:25:59.0484 0196 [ 065639773D8B03F33577F6CDAEA21063 ] gameenum C:\WINDOWS\system32\DRIVERS\gameenum.sys
14:25:59.0484 0196 gameenum - ok
14:25:59.0562 0196 [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
14:25:59.0562 0196 GEARAspiWDM - ok
14:25:59.0593 0196 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
14:25:59.0593 0196 Gpc - ok
14:25:59.0703 0196 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe
14:25:59.0703 0196 gupdate - ok
14:25:59.0734 0196 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
14:25:59.0734 0196 gupdatem - ok
14:25:59.0875 0196 [ 662BA5623C7F686297E18E09A2E320BC ] HauppaugeTVServer C:\PROGRA~1\WinTV\TVServer\HAUPPA~1.EXE
14:25:59.0906 0196 HauppaugeTVServer - ok
14:25:59.0953 0196 [ 734C04113DB35D87F11A4D5807824353 ] hcw72ADFilter C:\WINDOWS\system32\DRIVERS\hcw72ADFilter.sys
14:25:59.0953 0196 hcw72ADFilter - ok
14:26:00.0031 0196 [ 3F25756B1EBD3700407B62971A3EA6B2 ] hcw72ATV C:\WINDOWS\system32\DRIVERS\hcw72ATV.sys
14:26:00.0046 0196 hcw72ATV - ok
14:26:00.0125 0196 [ 6E66C9E73B049AF78A047723A253032F ] hcw72DTV C:\WINDOWS\system32\DRIVERS\hcw72DTV.sys
14:26:00.0125 0196 hcw72DTV - ok
14:26:00.0312 0196 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
14:26:00.0312 0196 HDAudBus - ok
14:26:00.0421 0196 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
14:26:00.0421 0196 helpsvc - ok
14:26:00.0468 0196 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINDOWS\System32\hidserv.dll
14:26:00.0468 0196 HidServ - ok
14:26:00.0531 0196 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] hidusb C:\WINDOWS\system32\DRIVERS\hidusb.sys
14:26:00.0546 0196 hidusb - ok
14:26:00.0609 0196 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
14:26:00.0609 0196 hkmsvc - ok
14:26:00.0640 0196 hpn - ok
14:26:00.0703 0196 [ 9F1D80908658EB7F1BF70809E0B51470 ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys
14:26:00.0718 0196 HPZid412 - ok
14:26:00.0796 0196 [ F7E3E9D50F9CD3DE28085A8FDAA0A1C3 ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
14:26:00.0812 0196 HPZipr12 - ok
14:26:00.0875 0196 [ CF1B7951B4EC8D13F3C93B74BB2B461B ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys
14:26:00.0875 0196 HPZius12 - ok
14:26:01.0000 0196 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
14:26:01.0015 0196 HTTP - ok
14:26:01.0093 0196 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
14:26:01.0109 0196 HTTPFilter - ok
14:26:01.0140 0196 i2omgmt - ok
14:26:01.0171 0196 i2omp - ok
14:26:01.0265 0196 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
14:26:01.0265 0196 i8042prt - ok
14:26:01.0406 0196 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
14:26:01.0406 0196 idsvc - ok
14:26:01.0437 0196 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
14:26:01.0437 0196 Imapi - ok
14:26:01.0515 0196 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe
14:26:01.0515 0196 ImapiService - ok
14:26:01.0578 0196 ini910u - ok
14:26:01.0656 0196 IntelIde - ok
14:26:01.0796 0196 [ 3DC635B66DD7412E1C9C3A77B8D78F25 ] IntuitUpdateService C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
14:26:01.0828 0196 IntuitUpdateService - ok
14:26:01.0875 0196 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys
14:26:01.0906 0196 Ip6Fw - ok
14:26:01.0968 0196 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
14:26:01.0984 0196 IpFilterDriver - ok
14:26:02.0031 0196 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
14:26:02.0031 0196 IpInIp - ok
14:26:02.0093 0196 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
14:26:02.0109 0196 IpNat - ok
14:26:02.0171 0196 [ E6BE7A41A28D8F2DB174957454D32448 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
14:26:02.0171 0196 iPod Service - ok
14:26:02.0218 0196 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
14:26:02.0250 0196 IPSec - ok
14:26:02.0312 0196 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
14:26:02.0312 0196 IRENUM - ok
14:26:02.0390 0196 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
14:26:02.0406 0196 isapnp - ok
14:26:02.0625 0196 [ 9AA67569D5257462E230767510B0C815 ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe
14:26:02.0687 0196 JavaQuickStarterService - ok
14:26:02.0781 0196 [ 414E51CEC052227C581C9EAFE4499C14 ] KaraokeService C:\WINDOWS\system32\KaraokeSer.exe
14:26:02.0781 0196 KaraokeService - ok
14:26:02.0843 0196 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
14:26:02.0859 0196 Kbdclass - ok
14:26:02.0921 0196 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
14:26:02.0953 0196 kbdhid - ok
14:26:03.0046 0196 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
14:26:03.0078 0196 kmixer - ok
14:26:03.0140 0196 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
14:26:03.0156 0196 KSecDD - ok
14:26:03.0250 0196 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll
14:26:03.0281 0196 lanmanserver - ok
14:26:03.0390 0196 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
14:26:03.0421 0196 lanmanworkstation - ok
14:26:03.0453 0196 lbrtfdc - ok
14:26:03.0515 0196 [ FB5E7A5C86C0B58AA155487B141B8457 ] LCcfltr C:\WINDOWS\system32\drivers\lccfltr.sys
14:26:03.0515 0196 LCcfltr - ok
14:26:03.0640 0196 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
14:26:03.0640 0196 LmHosts - ok
14:26:03.0765 0196 [ 6DFE7F2E8E8A337263AA5C92A215F161 ] MBAMProtector C:\WINDOWS\system32\drivers\mbam.sys
14:26:03.0765 0196 MBAMProtector - ok
14:26:04.0015 0196 [ 43683E970F008C93C9429EF428147A54 ] MBAMService C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
14:26:04.0078 0196 MBAMService - ok
14:26:04.0140 0196 [ 0DB7527DB188C7D967A37BB51BBF3963 ] MBAMSwissArmy C:\WINDOWS\system32\drivers\mbamswissarmy.sys
14:26:04.0156 0196 MBAMSwissArmy - ok
14:26:04.0218 0196 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll
14:26:04.0234 0196 Messenger - ok
14:26:04.0296 0196 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
14:26:04.0328 0196 mnmdd - ok
14:26:04.0406 0196 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
14:26:04.0421 0196 mnmsrvc - ok
14:26:04.0484 0196 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
14:26:04.0484 0196 Modem - ok
14:26:04.0531 0196 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
14:26:04.0531 0196 Mouclass - ok
14:26:04.0625 0196 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
14:26:04.0625 0196 mouhid - ok
14:26:04.0671 0196 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
14:26:04.0671 0196 MountMgr - ok
14:26:04.0750 0196 [ C0F8E0C2C3C0437CF37C6781896DC3EC ] MPE C:\WINDOWS\system32\DRIVERS\MPE.sys
14:26:04.0750 0196 MPE - ok
14:26:04.0765 0196 mraid35x - ok
14:26:04.0890 0196 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
14:26:04.0921 0196 MRxDAV - ok
14:26:05.0140 0196 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
14:26:05.0171 0196 MRxSmb - ok
14:26:05.0250 0196 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe
14:26:05.0265 0196 MSDTC - ok
14:26:05.0390 0196 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
14:26:05.0421 0196 Msfs - ok
14:26:05.0453 0196 MSIServer - ok
14:26:05.0546 0196 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
14:26:05.0562 0196 MSKSSRV - ok
14:26:05.0609 0196 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
14:26:05.0609 0196 MSPCLOCK - ok
14:26:05.0671 0196 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
14:26:05.0671 0196 MSPQM - ok
14:26:05.0750 0196 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
14:26:05.0765 0196 mssmbios - ok
14:26:05.0843 0196 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys
14:26:05.0843 0196 MSTEE - ok
14:26:05.0890 0196 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
14:26:05.0906 0196 Mup - ok
14:26:05.0968 0196 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
14:26:06.0000 0196 NABTSFEC - ok
14:26:06.0109 0196 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll
14:26:06.0156 0196 napagent - ok
14:26:06.0234 0196 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
14:26:06.0250 0196 NDIS - ok
14:26:06.0312 0196 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys
14:26:06.0328 0196 NdisIP - ok
14:26:06.0421 0196 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
14:26:06.0453 0196 NdisTapi - ok
14:26:06.0484 0196 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
14:26:06.0500 0196 Ndisuio - ok
14:26:06.0546 0196 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
14:26:06.0578 0196 NdisWan - ok
14:26:06.0687 0196 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
14:26:06.0703 0196 NDProxy - ok
14:26:06.0765 0196 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
14:26:06.0796 0196 NetBIOS - ok
14:26:06.0843 0196 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
14:26:06.0843 0196 NetBT - ok
14:26:06.0921 0196 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe
14:26:06.0953 0196 NetDDE - ok
14:26:07.0000 0196 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
14:26:07.0000 0196 NetDDEdsdm - ok
14:26:07.0078 0196 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe
14:26:07.0093 0196 Netlogon - ok
14:26:07.0171 0196 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll
14:26:07.0203 0196 Netman - ok
14:26:07.0265 0196 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
14:26:07.0265 0196 NetTcpPortSharing - ok
14:26:07.0343 0196 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll
14:26:07.0390 0196 Nla - ok
14:26:07.0484 0196 [ 0543FA119CF3FD2203851FD71202FFE1 ] nlsX86cc C:\WINDOWS\system32\NLSSRV32.EXE
14:26:07.0500 0196 nlsX86cc - ok
14:26:07.0562 0196 [ 1E421A6BCF2203CC61B821ADA9DE878B ] nm C:\WINDOWS\system32\DRIVERS\NMnt.sys
14:26:07.0578 0196 nm - ok
14:26:07.0656 0196 [ 431ADA51E9D032F533548688CE5A2A24 ] nosGetPlusHelper C:\Program Files\NOS\bin\getPlus_Helper_3004.dll
14:26:07.0656 0196 nosGetPlusHelper - ok
14:26:07.0750 0196 [ 6623E51595C0076755C29C00846C4EB2 ] NPF C:\WINDOWS\system32\drivers\npf.sys
14:26:07.0750 0196 NPF - ok
14:26:07.0812 0196 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
14:26:07.0828 0196 Npfs - ok
14:26:08.0046 0196 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
14:26:08.0062 0196 Ntfs - ok
14:26:08.0109 0196 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
14:26:08.0109 0196 NtLmSsp - ok
14:26:08.0281 0196 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
14:26:08.0328 0196 NtmsSvc - ok
14:26:08.0375 0196 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
14:26:08.0406 0196 Null - ok
14:26:11.0390 0196 [ 7B5A17BD54BB9142843DBE99A1CAAED8 ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
14:26:14.0718 0196 nv - ok
14:26:15.0203 0196 [ 83E8AB7BB3C8956C53FEC071C94F0BBB ] nvUpdatusService C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
14:26:15.0312 0196 nvUpdatusService - ok
14:26:15.0359 0196 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
14:26:15.0375 0196 NwlnkFlt - ok
14:26:15.0406 0196 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
14:26:15.0406 0196 NwlnkFwd - ok
14:26:15.0515 0196 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys
14:26:15.0531 0196 Parport - ok
14:26:15.0593 0196 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
14:26:15.0640 0196 PartMgr - ok
14:26:15.0812 0196 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
14:26:15.0828 0196 ParVdm - ok
14:26:15.0875 0196 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
14:26:15.0890 0196 PCI - ok
14:26:15.0937 0196 PCIDump - ok
14:26:15.0968 0196 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
14:26:15.0968 0196 PCIIde - ok
14:26:16.0078 0196 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
14:26:16.0109 0196 Pcmcia - ok
14:26:16.0140 0196 PDCOMP - ok
14:26:16.0203 0196 PDFRAME - ok
14:26:16.0250 0196 PDRELI - ok
14:26:16.0312 0196 PDRFRAME - ok
14:26:16.0359 0196 perc2 - ok
14:26:16.0421 0196 perc2hib - ok
14:26:16.0593 0196 PfModNT - ok
14:26:16.0734 0196 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe
14:26:16.0734 0196 PlugPlay - ok
14:26:16.0812 0196 [ 9D84376931440F3679BEEF2A414FA493 ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.exe
14:26:16.0843 0196 Pml Driver HPZ12 - ok
14:26:16.0875 0196 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
14:26:16.0875 0196 PolicyAgent - ok
14:26:16.0984 0196 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
14:26:17.0000 0196 PptpMiniport - ok
14:26:17.0046 0196 [ A32BEBAF723557681BFC6BD93E98BD26 ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys
14:26:17.0046 0196 Processor - ok
14:26:17.0093 0196 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
14:26:17.0093 0196 ProtectedStorage - ok
14:26:17.0171 0196 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
14:26:17.0187 0196 PSched - ok
14:26:17.0312 0196 [ A6A7AD767BF5141665F5C675F671B3E1 ] PSI_SVC_2 c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
14:26:17.0359 0196 PSI_SVC_2 - ok
14:26:17.0421 0196 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
14:26:17.0437 0196 Ptilink - ok
14:26:17.0562 0196 [ EF24ECCDC534EED64B9380043DD1FD59 ] QBCFMonitorService C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
14:26:17.0562 0196 QBCFMonitorService - ok
14:26:17.0671 0196 [ 6BEE1814470DC12FA20C53DFC3C97EBB ] QBFCService C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
14:26:17.0703 0196 QBFCService - ok
14:26:17.0734 0196 ql1080 - ok
14:26:17.0781 0196 Ql10wnt - ok
14:26:17.0859 0196 ql12160 - ok
14:26:17.0906 0196 ql1240 - ok
14:26:17.0968 0196 ql1280 - ok
14:26:18.0062 0196 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
14:26:18.0093 0196 RasAcd - ok
14:26:18.0140 0196 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll
14:26:18.0156 0196 RasAuto - ok
14:26:18.0203 0196 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
14:26:18.0218 0196 Rasl2tp - ok
14:26:18.0312 0196 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll
14:26:18.0328 0196 RasMan - ok
14:26:18.0375 0196 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
14:26:18.0375 0196 RasPppoe - ok
14:26:18.0437 0196 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
14:26:18.0453 0196 Raspti - ok
14:26:18.0531 0196 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
14:26:18.0562 0196 Rdbss - ok
14:26:18.0609 0196 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
14:26:18.0625 0196 RDPCDD - ok
14:26:18.0750 0196 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
14:26:18.0765 0196 rdpdr - ok
14:26:18.0937 0196 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
14:26:18.0968 0196 RDPWD - ok
14:26:19.0015 0196 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
14:26:19.0046 0196 RDSessMgr - ok
14:26:19.0109 0196 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
14:26:19.0109 0196 redbook - ok
14:26:19.0171 0196 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
14:26:19.0187 0196 RemoteAccess - ok
14:26:19.0265 0196 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
14:26:19.0265 0196 RemoteRegistry - ok
14:26:19.0375 0196 [ F17713D108ACA124A139FDE877EEF68A ] RimUsb C:\WINDOWS\system32\Drivers\RimUsb.sys
14:26:19.0375 0196 RimUsb - ok
14:26:19.0468 0196 [ E51A8D02B4BD33EBA1F7A5B76C3766ED ] rpcapd C:\Program Files\WinPcap\rpcapd.exe
14:26:19.0484 0196 rpcapd - ok
14:26:19.0531 0196 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe
14:26:19.0531 0196 RpcLocator - ok
14:26:19.0812 0196 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll
14:26:19.0812 0196 RpcSs - ok
14:26:19.0875 0196 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe
14:26:19.0875 0196 RSVP - ok
14:26:19.0984 0196 [ CB9310A5A910648D359C99A857E22A54 ] RTLE8023xp C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
14:26:20.0000 0196 RTLE8023xp - ok
14:26:20.0062 0196 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe
14:26:20.0062 0196 SamSs - ok
14:26:20.0140 0196 [ 1FD538C4FEB36B793D2121F20BBDC16F ] SBRE C:\WINDOWS\system32\drivers\SBREdrv.sys
14:26:20.0171 0196 SBRE - ok
14:26:20.0250 0196 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
14:26:20.0265 0196 SCardSvr - ok
14:26:20.0375 0196 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll
14:26:20.0406 0196 Schedule - ok
14:26:20.0484 0196 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
14:26:20.0484 0196 Secdrv - ok
14:26:20.0546 0196 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll
14:26:20.0562 0196 seclogon - ok
14:26:20.0703 0196 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll
14:26:20.0718 0196 SENS - ok
14:26:20.0781 0196 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
14:26:20.0812 0196 serenum - ok
14:26:20.0890 0196 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
14:26:20.0890 0196 Serial - ok
14:26:21.0109 0196 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
14:26:21.0140 0196 Sfloppy - ok
14:26:21.0203 0196 [ 0B1A5E9CACB5CDD54A2815107BD7C772 ] sfman C:\WINDOWS\system32\drivers\sfmanm.sys
14:26:21.0218 0196 sfman - ok
14:26:21.0359 0196 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
14:26:21.0390 0196 SharedAccess - ok
14:26:21.0484 0196 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
14:26:21.0484 0196 ShellHWDetection - ok
14:26:21.0515 0196 Simbad - ok
14:26:21.0640 0196 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys
14:26:21.0640 0196 SLIP - ok
14:26:21.0718 0196 Sparrow - ok
14:26:21.0843 0196 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
14:26:21.0843 0196 splitter - ok
14:26:21.0921 0196 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
14:26:21.0921 0196 Spooler - ok
14:26:21.0984 0196 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
14:26:22.0000 0196 sr - ok
14:26:22.0140 0196 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll
14:26:22.0156 0196 srservice - ok
14:26:22.0296 0196 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
14:26:22.0359 0196 Srv - ok
14:26:22.0406 0196 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
14:26:22.0406 0196 SSDPSRV - ok
14:26:22.0546 0196 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll
14:26:22.0671 0196 stisvc - ok
14:26:22.0734 0196 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys
14:26:22.0734 0196 streamip - ok
14:26:22.0812 0196 [ 2AA2D356CB735CD3CCA9F671BD75C9B5 ] SWDUMon C:\WINDOWS\system32\DRIVERS\SWDUMon.sys
14:26:22.0828 0196 SWDUMon - ok
14:26:22.0890 0196 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
14:26:22.0921 0196 swenum - ok
14:26:22.0968 0196 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
14:26:22.0984 0196 swmidi - ok
14:26:23.0015 0196 SwPrv - ok
14:26:23.0093 0196 symc810 - ok
14:26:23.0156 0196 symc8xx - ok
14:26:23.0218 0196 sym_hi - ok
14:26:23.0281 0196 sym_u3 - ok
14:26:23.0359 0196 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
14:26:23.0359 0196 sysaudio - ok
14:26:23.0421 0196 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
14:26:23.0453 0196 SysmonLog - ok
14:26:23.0515 0196 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
14:26:23.0546 0196 TapiSrv - ok
14:26:23.0906 0196 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
14:26:23.0937 0196 Tcpip - ok
14:26:24.0031 0196 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
14:26:24.0046 0196 TDPIPE - ok
14:26:24.0093 0196 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
14:26:24.0109 0196 TDTCP - ok
14:26:24.0171 0196 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
14:26:24.0187 0196 TermDD - ok
14:26:24.0343 0196 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll
14:26:24.0375 0196 TermService - ok
14:26:24.0468 0196 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll
14:26:24.0468 0196 Themes - ok
14:26:24.0515 0196 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe
14:26:24.0546 0196 TlntSvr - ok
14:26:24.0578 0196 TosIde - ok
14:26:24.0687 0196 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll
14:26:24.0687 0196 TrkWks - ok
14:26:24.0781 0196 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
14:26:24.0812 0196 Udfs - ok
14:26:24.0843 0196 ultra - ok
14:26:24.0984 0196 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
14:26:25.0046 0196 Update - ok
14:26:25.0109 0196 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll
14:26:25.0125 0196 upnphost - ok
14:26:25.0187 0196 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe
14:26:25.0187 0196 UPS - ok
14:26:25.0265 0196 [ EAFE1E00739AFE6C51487A050E772E17 ] USBAAPL C:\WINDOWS\system32\Drivers\usbaapl.sys
14:26:25.0281 0196 USBAAPL - ok
14:26:25.0343 0196 [ E919708DB44ED8543A7C017953148330 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys
14:26:25.0359 0196 usbaudio - ok
14:26:25.0437 0196 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
14:26:25.0468 0196 usbccgp - ok
14:26:25.0531 0196 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
14:26:25.0546 0196 usbehci - ok
14:26:25.0625 0196 [ 280305FA17BE6021053F6E606C54DD60 ] usbfilter C:\WINDOWS\system32\DRIVERS\usbfilter.sys
14:26:25.0656 0196 usbfilter - ok
14:26:25.0750 0196 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
14:26:25.0750 0196 usbhub - ok
14:26:25.0812 0196 [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci C:\WINDOWS\system32\DRIVERS\usbohci.sys
14:26:25.0843 0196 usbohci - ok
14:26:25.0921 0196 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
14:26:25.0937 0196 usbprint - ok
14:26:26.0000 0196 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
14:26:26.0015 0196 usbscan - ok
14:26:26.0078 0196 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
14:26:26.0078 0196 USBSTOR - ok
14:26:26.0140 0196 [ 63BBFCA7F390F4C49ED4B96BFB1633E0 ] usbvideo C:\WINDOWS\system32\Drivers\usbvideo.sys
14:26:26.0156 0196 usbvideo - ok
14:26:26.0218 0196 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
14:26:26.0234 0196 VgaSave - ok
14:26:26.0828 0196 [ 024DDB73EE74929999D9C9292C92A499 ] VIAHdAudAddService C:\WINDOWS\system32\drivers\viahduaa.sys
14:26:26.0953 0196 VIAHdAudAddService - ok
14:26:27.0015 0196 ViaIde - ok
14:26:27.0093 0196 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
14:26:27.0093 0196 VolSnap - ok
14:26:27.0187 0196 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe
14:26:27.0203 0196 VSS - ok
14:26:27.0281 0196 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll
14:26:27.0281 0196 W32Time - ok
14:26:27.0375 0196 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
14:26:27.0375 0196 Wanarp - ok
14:26:27.0406 0196 WDICA - ok
14:26:27.0500 0196 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
14:26:27.0500 0196 wdmaud - ok
14:26:27.0546 0196 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll
14:26:27.0546 0196 WebClient - ok
14:26:27.0796 0196 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
14:26:27.0812 0196 winmgmt - ok
14:26:27.0953 0196 [ 051B1BDECD6DEE18C771B5D5EC7F044D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
14:26:27.0968 0196 WmdmPmSN - ok
14:26:28.0125 0196 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll
14:26:28.0171 0196 Wmi - ok
14:26:28.0234 0196 [ C42584FD66CE9E17403AEBCA199F7BDB ] WmiAcpi C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
14:26:28.0250 0196 WmiAcpi - ok
14:26:28.0375 0196 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
14:26:28.0375 0196 WmiApSrv - ok
14:26:28.0687 0196 [ 6BAB4DC65515A098505F8B3D01FB6FE5 ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe
14:26:28.0718 0196 WMPNetworkSvc - ok
14:26:28.0781 0196 [ C60DC16D4E406810FAD54B98DC92D5EC ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys
14:26:28.0781 0196 WpdUsb - ok
14:26:29.0093 0196 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
14:26:29.0156 0196 WPFFontCache_v0400 - ok
14:26:29.0234 0196 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys
14:26:29.0250 0196 WS2IFSL - ok
14:26:29.0328 0196 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll
14:26:29.0359 0196 wscsvc - ok
14:26:29.0421 0196 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
14:26:29.0437 0196 WSTCODEC - ok
14:26:29.0484 0196 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll
14:26:29.0515 0196 wuauserv - ok
14:26:29.0578 0196 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
14:26:29.0609 0196 WudfPf - ok
14:26:29.0640 0196 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
14:26:29.0640 0196 WudfRd - ok
14:26:29.0718 0196 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
14:26:29.0718 0196 WudfSvc - ok
14:26:29.0875 0196 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
14:26:29.0890 0196 WZCSVC - ok
14:26:29.0953 0196 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll
14:26:29.0968 0196 xmlprov - ok
14:26:30.0062 0196 ================ Scan global ===============================
14:26:30.0109 0196 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll
14:26:30.0203 0196 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll
14:26:30.0250 0196 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll
14:26:30.0265 0196 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe
14:26:30.0265 0196 [Global] - ok
14:26:30.0281 0196 ================ Scan MBR ==================================
14:26:30.0328 0196 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0
14:26:30.0500 0196 \Device\Harddisk0\DR0 - ok
14:26:30.0531 0196 ================ Scan VBR ==================================
14:26:30.0546 0196 [ C5948607D44ACCACDD4B981B63B1C421 ] \Device\Harddisk0\DR0\Partition1
14:26:30.0562 0196 \Device\Harddisk0\DR0\Partition1 - ok
14:26:30.0578 0196 ============================================================
14:26:30.0578 0196 Scan finished
14:26:30.0578 0196 ============================================================
14:26:30.0671 0220 Detected object count: 0
14:26:30.0671 0220 Actual detected object count: 0


----------



## shadowbird (Oct 9, 2012)

So you have the two log files above and before that, the two files were Dequarantined. Currently, the error messages are:

1) the Inst.exe file error that says "BSecure failed," which is an internet protection and monitoring software. 

2) Error loading c\documents and settings\Francie\local settings\Application Data\Cyberlink\Conduit ousdd.dll

As of last night, the ati2dvag file still glitches and goes to a blue screen. But I'm working without safemode right now, and it hasn't glitched yet.

Will check for your reply later. Thank you, Cookie


----------



## Cookiegal (Aug 27, 2003)

All I see in the Vipre log is that you've downloaded and run an EICAR test to test an anti-virus product.

Please run OTS per post no. 17.

It's also important that you don't do any more things on your own as it makes it more difficult to know what is going on with the system.


----------



## Cookiegal (Aug 27, 2003)

Is your Carbonite working now after checking it in msconfig?


----------



## Cookiegal (Aug 27, 2003)

Open HijackThis and click on the *Open Misc Tools section* button. Click on the *Open Uninstall Manager* button. Click the *Save List* button. Save the list then copy and paste it here.


----------



## shadowbird (Oct 9, 2012)

That was just the Vipre quarantine file. There are about three, super long logs that I did not post. Carbonite was not unchecked. I reinstalled it under the correct email address, and it's working now and I have all my backup files online intact. 

Also, my printers are back. In addition, I can now playback video, which is essential for my business and it would not work before, and Malwarebytes is now able to run, for the first time in at least a month or more. 

I'm still operating without safemode, and no blue screen yet. I wasn't aware we found anything. Did Combofix do all this?

I'll do the two things above and post it soon.

BTW, what antivirus program do you suggest?


----------



## shadowbird (Oct 9, 2012)

Attached is OTS.txt

Hijack this is next.


----------



## shadowbird (Oct 9, 2012)

Adobe AIR
Adobe AIR
Adobe Download Manager
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader X (10.1.4)
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Applian Director
Applian FLV Player
ATI Catalyst Registration
AVS4YOU Software Navigator 1.4
Bonjour
Carbonite
Catalyst Control Center - Branding
CCleaner
CloudCare
Combined Community Codec Pack 2010-10-10
Compatibility Pack for the 2007 Office system
Corel Visual Intelligence
Corel WordPerfect Office - iFilter
Data Transfer Utility 10
Debut Video Capture Software
Doxillion Document Converter
DriverMax 5
EVEREST Home Edition v2.20
Express Scribe
File Type Assistant
gBurner
GIMP 2.6.11
Google Earth
Google Update Helper
Hauppauge WinTV 7
High Definition Audio Driver Package - KB888111
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB2756822)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB981793)
HP Extended Capabilities 4.7
HP Image Zone 4.7
HP PSC & OfficeJet 4.7
HP Update
InqScribe 2.1
InstantShareAlert
iTunes
Java(TM) 6 Update 30
Logitech iTouch Software
Malwarebytes Anti-Malware version 1.65.1.1000
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2572067)
Microsoft .NET Framework 1.1 Security Update (KB2656370)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Client Profile
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office XP Professional
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Word Supplemental Macros
Mozilla Firefox 13.0.1 (x86 en-US)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
NVIDIA Graphics Driver 301.42
NVIDIA nView 136.27
NVIDIA nView Desktop Manager
NVIDIA PhysX
NVIDIA PhysX System Software 9.12.0213
NVIDIA Update 1.8.15
Office Password Recovery PRO v1.0 (remove only)
OpenOffice.org 3.3
PDF reDirect (remove only)
PDFCreator
PhotoStage Slideshow Producer
Prism Video File Converter
QuickBooks
QuickBooks Pro 2010
QuickTime
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
REALTEK GbE & FE Ethernet PCI-E NIC Driver
RealUpgrade 1.1
Recuva
Replay AV 8
Replay Converter 4
Replay Media Catcher 4 (4.3.2)
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2675157)
Security Update for Windows Internet Explorer 8 (KB2699988)
Security Update for Windows Internet Explorer 8 (KB2744842)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2647518)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2685939)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2695962)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2705219-v2)
Security Update for Windows XP (KB2707511)
Security Update for Windows XP (KB2709162)
Security Update for Windows XP (KB2712808)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB2723135-v2)
Security Update for Windows XP (KB2724197)
Security Update for Windows XP (KB2731847-v2)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982381)
Security Update for Windows XP (KB982665)
Shutterfly Express Uploader
Shutterfly Express Uploader
SlimDrivers
Smart PDF Converter 6.3.0.495
Sony Player Plug-in for Windows Media Player
Spybot - Search & Destroy
The Lord of the Rings FREE Trial 
TranscriptPro 4
TurboTax 2010
TurboTax 2010 wflcbpm
TurboTax 2010 WinBizFedFormset
TurboTax 2010 WinBizReleaseEngine
TurboTax 2010 WinBizTaxSupport
TurboTax 2010 WinPerFedFormset
TurboTax 2010 WinPerReleaseEngine
TurboTax 2010 WinPerTaxSupport
TurboTax 2010 wrapper
TurboTax 2010 wrapper
TurboTax Business 2010
Unlocker 1.9.1
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB2447568)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676-v2)
Update for Windows XP (KB2641690)
Update for Windows XP (KB2661254-v2)
Update for Windows XP (KB2718704)
Update for Windows XP (KB2736233)
Update for Windows XP (KB2749655)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VersaCheck 2003 Personal Premier
VIA Platform Device Manager
VideoPad Video Editor
VPedal Windows Media Player 11 64bit Plug-in
VueMinder Pro
WavePad Sound Editor
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Service Pack 3
WinPcap 4.0.2
WinRAR 4.01 (32-bit)
WM Recorder
WM Recorder 11.3
WordPerfect Lightning
WordPerfect Lightning - EN
WordPerfect Lightning - IPM
WordPerfect Lightning - Messages
WordPerfect Lightning - MSOM
WordPerfect Office X4
WordPerfect Office X4
WordPerfect Office X4 - Common
WordPerfect Office X4 - Content
WordPerfect Office X4 - EN
WordPerfect Office X4 - Filters
WordPerfect Office X4 - Graphics
WordPerfect Office X4 - ICA
WordPerfect Office X4 - IPM
WordPerfect Office X4 - IPM EN
WordPerfect Office X4 - Migration Manager
WordPerfect Office X4 - PerfectExperts
WordPerfect Office X4 - PR
WordPerfect Office X4 - QP
WordPerfect Office X4 - Skins
WordPerfect Office X4 - System
WordPerfect Office X4 - WP
WordPerfect OfficeReady


----------



## Cookiegal (Aug 27, 2003)

shadowbird said:


> That was just the Vipre quarantine file. There are about three, super long logs that I did not post. Carbonite was not unchecked. I reinstalled it under the correct email address, and it's working now and I have all my backup files online intact.
> 
> Also, my printers are back. In addition, I can now playback video, which is essential for my business and it would not work before, and Malwarebytes is now able to run, for the first time in at least a month or more.
> 
> ...


I'm glad Carbonite and the other things are working now. I believe one of those files that was deleted by mistake caused some problems and restoring it has eliminated some of the problems. Yes, we found malware and ComboFix took care of it.

I'll post further instructions for you after I've gone through the OTS log.


----------



## Cookiegal (Aug 27, 2003)

Did you install PC Cleaners and PCPro intentionally? I don't see them in the uninstall list. These programs sometimes get installed with other applications and may be considered rogue. If you have no objection, I will remove their directories in the fix that I will be posting.


----------



## shadowbird (Oct 9, 2012)

I installed PC Cleaners when I was trying to fix the problem, quite some time ago. I don't remember PCPro.

I the blue screen again. This time it didn't mention the file. It said to check the disk for errors.
.
*Stop (blue screen) error caused by a device or driver*

.
You received this message because a hardware device, its driver, or related software has caused a stop error, also called a _blue screen_ error. This type of error means the computer has shut down abruptly to protect itself from potential data corruption or loss. In this case, we were unable to detect the specific device or driver that caused the problem. 
.
The following troubleshooting steps might prevent the stop error from recurring. Try them in the order given. If one step does not solve the problem, then move on to the next one.
*Steps to solve this problem*

Download and install the latest updates and device drivers for your computer 

Use Windows Update to check for and install updates:

Click to go online to the Windows Update website

*Note*
If Microsoft Update is installed, you'll be taken to the Microsoft Update website. 
Click *Custom* to check for available updates.

In the left pane, under *Select by Type*, click each of the following links to view all available updates:
*High Priority*
*Software, Optional*
*Hardware, Optional*

Select the updates you want, click *Review and install updates*, and then click *Install Updates*.

If you recently added a new hardware device to your computer, go online to the manufacturer's website to see if a driver update is available. 
How do I find my computer manufacturer?
Click *Start*, click *Run*, type *msinfo32*, and then click *OK*. Your computer manufacturer is listed as the *System Manufacturer* in the right pane of the *System Information* window.
Click to go online to see contact info for most computer manufacturers

If you recently added a new program to your computer, go online to the manufacturer's website to see if an update is available. 
Scan your computer for viruses
Many blue screen errors can be caused by computer viruses or other types of malicious software. 
If you have an antivirus program installed on your computer, make sure it is up to date with the latest antivirus definitions and perform a complete scan of your system. Check your antivirus product's website for information on getting the latest updates.
If you do not have antivirus software installed on your computer, we recommend using a web-based scanner to check your computer for malware. Many of the top antivirus software providers offer this service free of charge on their websites. 
To see a list of Microsoft and third-party providers of antispyware, anti-malware, and antivirus software, go online to the following website:
Security software: Downloads and trials
To see a list of antivirus software vendors, go online to the following Knowledge Base article: 
List of antivirus software vendors








* Tip*
Consider scanning your computer using more than one web-based antivirus scanner, even if you have an antivirus program installed on your computer. This will help make sure that you are using the most up-to-date antivirus definitions and allows you to benefit from the different strengths of each antivirus software manufacturer. If you do run multiple antivirus products, make sure you run only one product at a time. Running multiple antivirus products simultaneously can produce incorrect results.

Check your hard disk for errors


----------



## shadowbird (Oct 9, 2012)

In answer to your question, I'm fine with removing those two.


----------



## Cookiegal (Aug 27, 2003)

Start *OTS*. Copy/Paste the information in the code box below into the pane where it says *"Paste fix here"* and then click the "Run Fix" button.

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the OK button and Notepad will open with a log of actions taken during the fix. Post that information back here please.


```
[Kill All Processes]
[Unregister Dlls]
[Registry - Safe List]
< FireFox Settings [Prefs.js] > -> C:\Documents and Settings\Francie\Application Data\Mozilla\FireFox\Profiles\tohrezx2.default\prefs.js
YN -> browser.search.defaultthis.engineName -> "Freecorder Customized Web Search"
YN -> browser.search.defaulturl -> "http://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&SearchSource=3&q={searchTerms}"
YN -> browser.search.selectedEngine -> "Freecorder Customized Web Search"
YN -> browser.startup.homepage -> "http://search.conduit.com/?ctid=CT1060933&SearchSource=13"
< FireFox Extensions [User Folders] > -> 
YY -> ~EmptyValue -> C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\0tdbrp4t.default\extensions\[email protected]
YY -> ~EmptyValue -> C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions\[email protected]
< FireFox SearchPlugins [User Folders] > -> 
YY ->  bing-zugo.xml -> C:\Documents and Settings\Francie\Application Data\Mozilla\FireFox\Profiles\tohrezx2.default\searchplugins\bing-zugo.xml
YY ->  conduit.xml -> C:\Documents and Settings\Francie\Application Data\Mozilla\FireFox\Profiles\tohrezx2.default\searchplugins\conduit.xml
< Run [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "Conduit" -> [rundll32.exe "C:\Documents and Settings\Francie\Local Settings\Application Data\Cyberlink\Conduit\ousdd.dll",fltInfoW]
< Run [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "Conduit" -> [rundll32.exe "C:\Documents and Settings\Francie\Local Settings\Application Data\Cyberlink\Conduit\ousdd.dll",fltInfoW]
< Run [HKEY_USERS\S-1-5-21-1614895754-616249376-839522115-1003\] > -> HKEY_USERS\S-1-5-21-1614895754-616249376-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "Conduit" -> [rundll32.exe "C:\Documents and Settings\Francie\Local Settings\Application Data\Cyberlink\Conduit\ousdd.dll",fltInfoW]
[Registry - Additional Scans - Safe List]
< Disabled MSConfig Folder Items [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\
YN -> C:^Documents and Settings^Francie^Start Menu^Programs^Startup^Fanbase.lnk -> 
[Files/Folders - Created Within 30 Days]
NY ->  PC Cleaners(2) -> C:\Program Files\PC Cleaners(2)
NY ->  PC Cleaners -> C:\Documents and Settings\Francie\Application Data\PC Cleaners
NY ->  PCPro -> C:\Documents and Settings\Francie\Application Data\PCPro
NY ->  PC1Data -> C:\Documents and Settings\All Users\Application Data\PC1Data
[Start Explorer]
[Reboot]
```


----------



## shadowbird (Oct 9, 2012)

All Processes Killed
[Registry - Safe List]
Prefs.js: "Freecorder Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "http://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Prefs.js: "Freecorder Customized Web Search" removed from browser.search.selectedEngine
Prefs.js: "http://search.conduit.com/?ctid=CT1060933&SearchSource=13" removed from browser.startup.homepage
C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\0tdbrp4t.default\extensions\[email protected]\skin folder moved successfully.
C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\0tdbrp4t.default\extensions\[email protected]\locale\en-US folder moved successfully.
C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\0tdbrp4t.default\extensions\[email protected]\locale folder moved successfully.
C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\0tdbrp4t.default\extensions\[email protected]\defaults\preferences folder moved successfully.
C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\0tdbrp4t.default\extensions\[email protected]\defaults folder moved successfully.
C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\0tdbrp4t.default\extensions\[email protected]\content folder moved successfully.
C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\0tdbrp4t.default\extensions\[email protected] folder moved successfully.
C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions\[email protected]\skin folder moved successfully.
C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions\[email protected]\locale\en-US folder moved successfully.
C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions\[email protected]\locale folder moved successfully.
C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions\[email protected]\defaults\preferences folder moved successfully.
C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions\[email protected]\defaults folder moved successfully.
C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions\[email protected]\content folder moved successfully.
C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions\[email protected] folder moved successfully.
C:\Documents and Settings\Francie\Application Data\Mozilla\FireFox\Profiles\tohrezx2.default\searchplugins\bing-zugo.xml moved successfully.
C:\Documents and Settings\Francie\Application Data\Mozilla\FireFox\Profiles\tohrezx2.default\searchplugins\conduit.xml moved successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Conduit deleted successfully.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Conduit not found.
Registry value HKEY_USERS\S-1-5-21-1614895754-616249376-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Conduit deleted successfully.
[Registry - Additional Scans - Safe List]
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^Francie^Start Menu^Programs^Startup^Fanbase.lnk\ deleted successfully.
File C:\WINDOWS\pss\anbase.lnk not found.
[Files/Folders - Created Within 30 Days]
C:\Program Files\PC Cleaners(2) folder moved successfully.
C:\Documents and Settings\Francie\Application Data\PC Cleaners folder moved successfully.
C:\Documents and Settings\Francie\Application Data\PCPro\phone folder moved successfully.
C:\Documents and Settings\Francie\Application Data\PCPro folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PC1Data\av\d folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PC1Data\av folder moved successfully.
C:\Documents and Settings\All Users\Application Data\PC1Data folder moved successfully.
< End of fix log >
OTS by OldTimer - Version 3.1.47.2 fix logfile created on 10212012_231609


----------



## shadowbird (Oct 9, 2012)

Got the ati2dvag.dll error message with the blue screen again.


----------



## shadowbird (Oct 9, 2012)

Thank you again, Cookiegal.

The latest is my graphics are not working correctly in regular mode. It seems to be fine in safe mode. Attaching a photo of my graphics (from print screen).


----------



## Cookiegal (Aug 27, 2003)

Please download *SystemLook* from one of the links below and save it to your Desktop.
*Download Mirror #1
Download Mirror #2*
Double-click *SystemLook.exe* to run it.
Copy the content of the following code box into the main text field:

```
:filefind
ati2dvag.dll
```

Click the *Look* button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
*Note:* The log can also be found on your Desktop entitled *SystemLook.txt*


----------



## shadowbird (Oct 9, 2012)

Okay, starting this. My husband thought it might be dust on the board. He did something but he didn't do any fixes or virus removals, but the graphics problem is gone. However, I still have the problem with that file and blue screen.


----------



## shadowbird (Oct 9, 2012)

SystemLook 30.07.11 by jpshortstuff
Log created at 23:01 on 22/10/2012 by Francie
Administrator - Elevation successful
========== filefind ==========
Searching for "ati2dvag.dll"
C:\WINDOWS\ServicePackFiles\i386\ati2dvag.dll --a---- 201728 bytes [00:11 14/04/2008] [00:11 14/04/2008] 20A00BD20152E0342BC9E46C30CC687A
C:\WINDOWS\system32\ati2dvag.dll --a---- 302080 bytes [03:54 26/09/2012] [02:54 26/11/2010] C99AF774673DD0A87A0371F65786C335
C:\WINDOWS\system32\dllcache\ati2dvag.dll --a--c- 201728 bytes [03:54 26/09/2012] [23:38 30/07/2010] 0985D4F25D526372440C62C8ADC3058A
C:\WINDOWS\system32\DRVSTORE\CX109805_A1B7D9DE5843C2570C5D77702FF14E59D209BC95\B109234\ati2dvag.dll --a--c- 189781 bytes [04:29 18/01/2011] [02:54 26/11/2010] D185158B37A8C08EC5265C46DD0B73F6
C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\B107327\ati2dvag.dll --a---- 301056 bytes [04:29 18/01/2011] [07:49 27/10/2010] 5C22B91C36B942B9E90F25C46FD3C3EC
-= EOF =-


----------



## Cookiegal (Aug 27, 2003)

The file in System32 is the correct one but the one in the dllcache looks suspect so let's check that out.

Please go to *VirusTotal* and upload the following file for scanning.

Click *Browse*
Copy and paste the contents of the following code box into the text box next to *File name:* then click *Open* 

```
C:\WINDOWS\system32\dllcache\ati2dvag.dll
```

Click *Send File*
If confronted with two options, choose *Reanalyse file now*
Wait for the scan to finish and then copy and paste the URL from your browser address bar in your next reply please.


----------



## shadowbird (Oct 9, 2012)

Thank you!

https://www.virustotal.com/file/2d0...1686b7afe224df3a1766af9e/analysis/1351041347/


----------



## Cookiegal (Aug 27, 2003)

That file checks out fine.

Please go to *Start *- *Run *- type in *dxdiag *and click OK. It's a Windows internal utility that takes less than a minute to run. When it's finished scanning click on "Save All Information..." and save the report on your desktop. Please open it up and copy and paste the contents here.


----------



## shadowbird (Oct 9, 2012)

As a reminder, I have a video card we removed because we thought it was the problem. After learning the blue screen and same error message was still there when using the onboard graphics card, we have not reinstalled my graphics card yet.

------------------
System Information
------------------
Time of this report: 10/24/2012, 22:38:51
Machine name: FRANCIE-PC
Operating System: Windows XP Professional (5.1, Build 2600) Service Pack 3 (2600.xpsp_sp3_gdr.120821-1629)
Language: English (Regional Setting: English)
System Manufacturer: System manufacturer
System Model: System Product Name
BIOS: BIOS Date: 09/10/09 21:46:36 Ver: 04.06
Processor: AMD Athlon(tm) II X2 240 Processor, MMX, 3DNow (2 CPUs), ~2.8GHz
Memory: 3328MB RAM
Page File: 282MB used, 4933MB available
Windows Dir: C:\WINDOWS
DirectX Version: DirectX 9.0c (4.09.0000.0904)
DX Setup Parameters: Not found
DxDiag Version: 5.03.2600.5512 32bit Unicode
------------
DxDiag Notes
------------
DirectX Files Tab: No problems found.
Display Tab 1: The system is using the generic video driver. Please install video driver provided by the hardware manufacturer. Direct3D functionality not available. You should verify that the driver is a final version from the hardware manufacturer.
Sound Tab 1: No sound card was found. If one is expected, you should install a sound driver provided by the hardware manufacturer.
Music Tab: No problems found.
Input Tab: No problems found.
Network Tab: No problems found.
--------------------
DirectX Debug Levels
--------------------
Direct3D: 0/4 (n/a)
DirectDraw: 0/4 (retail)
DirectInput: 0/5 (n/a)
DirectMusic: 0/5 (n/a)
DirectPlay: 0/9 (retail)
DirectSound: 0/5 (retail)
DirectShow: 0/6 (retail)
---------------
Display Devices
---------------
Card name: 
Manufacturer: 
Chip type: 
DAC type: 
Device Key: Enum\
Display Memory: n/a
Current Mode: 1152 x 864 (32 bit) (1Hz)
Monitor: 
Monitor Max Res: 
Driver Name: vga.dll
Driver Version: 5.01.2600.0000 (English)
DDI Version: unknown
Driver Attributes: Final Retail
Driver Date/Size: 8/4/2004 08:00:00, 9344 bytes
WHQL Logo'd: Yes
WHQL Date Stamp: n/a
VDD: n/a
Mini VDD: vga.sys
Mini VDD Date: 4/13/2008 14:44:40, 20992 bytes
Device Identifier: {D7B70EE0-4340-11CF-B063-282AAEC2C835}
Vendor ID: 0x0000
Device ID: 0x0000
SubSys ID: 0x00000000
Revision ID: 0x0000
Revision ID: 0x0000
Video Accel: 
Deinterlace Caps: n/a
Registry: OK
DDraw Status: Not Available
D3D Status: Not Available
AGP Status: Not Available
DDraw Test Result: Not run
D3D7 Test Result: Not run
D3D8 Test Result: Not run
D3D9 Test Result: Not run
-------------
Sound Devices
-------------
Description: 
Default Sound Playback: No
Default Voice Playback: No
Hardware ID: 
Manufacturer ID: 
Product ID: 
Type: 
Driver Name: 
Driver Version: 
Driver Attributes: 
WHQL Logo'd: 
Date and Size: 
Other Files: 
Driver Provider: 
HW Accel Level: Emulation Only
Cap Flags: 0x0
Min/Max Sample Rate: 0, 0
Static/Strm HW Mix Bufs: 0, 0
Static/Strm HW 3D Bufs: 0, 0
HW Memory: 0
Voice Management: No
EAX(tm) 2.0 Listen/Src: No, No
I3DL2(tm) Listen/Src: No, No
Sensaura(tm) ZoomFX(tm): No
Registry: OK
Sound Test Result: Not run
---------------------
Sound Capture Devices
---------------------
-----------
DirectMusic
-----------
DLS Path: C:\WINDOWS\SYSTEM32\drivers\GM.DLS
DLS Version: 1.00.0016.0002
Acceleration: n/a
Ports: Microsoft Synthesizer, Software (Not Kernel Mode), Output, DLS, Internal, Default Port
Registry: OK
Test Result: Not run
-------------------
DirectInput Devices
-------------------
Device Name: Mouse
Attached: 1
Controller ID: n/a
Vendor/Product ID: n/a
FF Driver: n/a
Device Name: Keyboard
Attached: 1
Controller ID: n/a
Vendor/Product ID: n/a
FF Driver: n/a
Device Name: Internet Keys USB
Attached: 1
Controller ID: 0x0
Vendor/Product ID: 0x046D, 0xC309
FF Driver: n/a
Device Name: Internet Keys USB
Attached: 1
Controller ID: 0x0
Vendor/Product ID: 0x046D, 0xC309
FF Driver: n/a
Poll w/ Interrupt: No
Registry: OK
-----------
USB Devices
-----------
+ USB Root Hub
| Vendor/Product ID: 0x1002, 0x4397
| Matching Device ID: usb\root_hub
| Service: usbhub
| Driver: usbhub.sys, 4/13/2008 14:45:37, 59520 bytes
| Driver: usbd.sys, 8/4/2004 08:00:00, 4736 bytes
----------------
Gameport Devices
----------------
------------
PS/2 Devices
------------
+ Logitech HID-Compliant Keyboard
| Vendor/Product ID: 0x046D, 0xC309
| Matching Device ID: hid\vid_046d&pid_c309&mi_00
| Service: kbdhid
| Driver: kbdhid.sys, 4/13/2008 13:39:48, 14592 bytes
| Driver: kbdclass.sys, 4/13/2008 13:39:48, 24576 bytes
| 
+ Terminal Server Keyboard Driver
| Matching Device ID: root\rdp_kbd
| Upper Filters: kbdclass
| Service: TermDD
| Driver: termdd.sys, 4/13/2008 20:13:20, 40840 bytes
| Driver: kbdclass.sys, 4/13/2008 13:39:48, 24576 bytes
| 
+ HID-compliant mouse
| Vendor/Product ID: 0x046D, 0xC309
| Matching Device ID: hid_device_system_mouse
| Service: mouhid
| Driver: mouclass.sys, 4/13/2008 14:39:47, 23040 bytes
| Driver: mouhid.sys, 8/4/2004 08:00:00, 12160 bytes
| 
+ HID-compliant mouse
| Vendor/Product ID: 0x15CA, 0x00C3
| Matching Device ID: hid_device_system_mouse
| Service: mouhid
| Driver: mouclass.sys, 4/13/2008 14:39:47, 23040 bytes
| Driver: mouhid.sys, 8/4/2004 08:00:00, 12160 bytes
| 
+ Terminal Server Mouse Driver
| Matching Device ID: root\rdp_mou
| Upper Filters: mouclass
| Service: TermDD
| Driver: termdd.sys, 4/13/2008 20:13:20, 40840 bytes
| Driver: mouclass.sys, 4/13/2008 14:39:47, 23040 bytes
----------------------------
DirectPlay Service Providers
----------------------------
DirectPlay8 Modem Service Provider - Registry: OK, File: dpnet.dll (5.03.2600.5512)
DirectPlay8 Serial Service Provider - Registry: OK, File: dpnet.dll (5.03.2600.5512)
DirectPlay8 IPX Service Provider - Registry: OK, File: dpnet.dll (5.03.2600.5512)
DirectPlay8 TCP/IP Service Provider - Registry: OK, File: dpnet.dll (5.03.2600.5512)
Internet TCP/IP Connection For DirectPlay - Registry: OK, File: dpwsockx.dll (5.03.2600.5512)
IPX Connection For DirectPlay - Registry: OK, File: dpwsockx.dll (5.03.2600.5512)
Modem Connection For DirectPlay - Registry: OK, File: dpmodemx.dll (5.03.2600.5512)
Serial Connection For DirectPlay - Registry: OK, File: dpmodemx.dll (5.03.2600.5512)
DirectPlay Voice Wizard Tests: Full Duplex: , Half Duplex: , Mic: 
DirectPlay Test Result: Not run
Registry: OK
-------------------
DirectPlay Adapters
-------------------
DirectPlay8 TCP/IP Service Provider: Local Area Connection - IPv4 - 
-----------------------
DirectPlay Voice Codecs
-----------------------
Voxware VR12 1.4kbit/s
Voxware SC06 6.4kbit/s
Voxware SC03 3.2kbit/s
MS-PCM 64 kbit/s
MS-ADPCM 32.8 kbit/s
Microsoft GSM 6.10 13 kbit/s
TrueSpeech(TM) 8.6 kbit/s
-------------------------
DirectPlay Lobbyable Apps
-------------------------
------------------------
Disk & DVD/CD-ROM Drives
------------------------
Drive: C:
Free Space: 84.3 GB
Total Space: 305.2 GB
File System: NTFS
Model: SAMSUNG HD322HJ
Drive: D:
Model: _NEC DVD+-RW ND-3530A
Driver: c:\windows\system32\drivers\cdrom.sys, 5.01.2600.5512 (English), 4/13/2008 14:40:46, 62976 bytes
--------------
System Devices
--------------
Name: Creative SBLive! Gameport
Device ID: PCI\VEN_1102&DEV_7002&SUBSYS_00201102&REV_06\4&2966AB86&0&31A4
Driver: C:\WINDOWS\system32\DRIVERS\gameenum.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:29, 10624 bytes
Driver: C:\WINDOWS\system32\drivers\ctljystk.sys, 5.01.2501.0000 (English), 8/17/2001 08:19:20, 3712 bytes
Name: Creative SB Live! Value (WDM)
Device ID: PCI\VEN_1102&DEV_0002&SUBSYS_80271102&REV_06\4&2966AB86&0&30A4
Driver: n/a
Name: Realtek PCIe GBE Family Controller
Device ID: PCI\VEN_10EC&DEV_8168&SUBSYS_83A31043&REV_03\4&37FD4B11&0&0050
Driver: n/a
Name: PCI standard PCI-to-PCI bridge
Device ID: PCI\VEN_1043&DEV_9602&SUBSYS_00000000&REV_00\3&267A616A&0&08
Driver: C:\WINDOWS\system32\DRIVERS\pci.sys, 5.01.2600.5512 (English), 4/13/2008 14:36:44, 68224 bytes
Name: PCI standard PCI-to-PCI bridge
Device ID: PCI\VEN_1022&DEV_9609&SUBSYS_00000000&REV_00\3&267A616A&0&50
Driver: C:\WINDOWS\system32\DRIVERS\pci.sys, 5.01.2600.5512 (English), 4/13/2008 14:36:44, 68224 bytes
Name: PCI standard host CPU bridge
Device ID: PCI\VEN_1022&DEV_9601&SUBSYS_00000000&REV_00\3&267A616A&0&00
Driver: n/a
Name: PCI standard host CPU bridge
Device ID: PCI\VEN_1022&DEV_1204&SUBSYS_00000000&REV_00\3&267A616A&0&C4
Driver: n/a
Name: PCI standard host CPU bridge
Device ID: PCI\VEN_1022&DEV_1203&SUBSYS_00000000&REV_00\3&267A616A&0&C3
Driver: n/a
Name: PCI standard host CPU bridge
Device ID: PCI\VEN_1022&DEV_1202&SUBSYS_00000000&REV_00\3&267A616A&0&C2
Driver: n/a
Name: PCI standard host CPU bridge
Device ID: PCI\VEN_1022&DEV_1201&SUBSYS_00000000&REV_00\3&267A616A&0&C1
Driver: n/a
Name: PCI standard host CPU bridge
Device ID: PCI\VEN_1022&DEV_1200&SUBSYS_00000000&REV_00\3&267A616A&0&C0
Driver: n/a
Name: ATI Radeon HD 4200
Device ID: PCI\VEN_1002&DEV_9710&SUBSYS_83A21043&REV_00\4&1FD4D60D&0&2808
Driver: C:\WINDOWS\system32\DRIVERS\ati2mtag.sys, 6.14.0010.7149 (English), 11/26/2010 00:17:40, 5555712 bytes
Driver: C:\WINDOWS\system32\DRIVERS\ati2erec.dll, 1.00.0000.0019 (English), 11/25/2010 22:39:40, 53248 bytes
Driver: C:\WINDOWS\system32\ati2dvag.dll, 6.14.0010.7149 (English), 11/25/2010 22:54:36, 302080 bytes
Driver: C:\WINDOWS\system32\ati2cqag.dll, 6.14.0010.0488 (English), 11/25/2010 22:18:16, 765952 bytes
Driver: C:\WINDOWS\system32\Ati2mdxx.exe, 6.14.0010.2495 (English), 11/25/2010 22:34:28, 26112 bytes
Driver: C:\WINDOWS\system32\ati3duag.dll, 6.14.0010.0798 (English), 11/25/2010 22:48:02, 3984864 bytes
Driver: C:\WINDOWS\system32\ativvaxx.dll, 6.14.0010.0288 (English), 11/25/2010 22:32:24, 2669696 bytes
Driver: C:\WINDOWS\system32\atiicdxx.dat, 9/28/2010 16:07:36, 224001 bytes
Driver: C:\WINDOWS\system32\ativva5x.dat, 11/25/2010 22:31:54, 3 bytes
Driver: C:\WINDOWS\system32\ativva6x.dat, 11/25/2010 22:31:54, 887724 bytes
Driver: C:\WINDOWS\system32\amdpcom32.dll, 6.14.0010.0023 (English), 11/25/2010 22:16:32, 64512 bytes
Driver: C:\WINDOWS\system32\atimpc32.dll, 6.14.0010.0023 (English), 11/25/2010 22:16:32, 64512 bytes
Driver: C:\WINDOWS\system32\atiadlxx.dll, 6.14.0010.1054 (English), 11/25/2010 22:24:46, 196608 bytes
Driver: C:\WINDOWS\system32\ativvaxx.cap, 11/25/2010 22:32:04, 539392 bytes
Driver: C:\WINDOWS\system32\atiapfxx.exe, 6.14.0010.1001 (English), 11/25/2010 22:30:30, 143360 bytes
Driver: C:\WINDOWS\system32\atiapfxx.blb, 11/25/2010 22:30:34, 121776 bytes
Driver: C:\WINDOWS\system32\ATIDDC.DLL, 6.14.0010.0008 (English), 11/25/2010 22:31:16, 53248 bytes
Driver: C:\WINDOWS\system32\atitvo32.dll, 6.14.0010.4200 (English), 11/25/2010 22:24:22, 17408 bytes
Driver: C:\WINDOWS\system32\ativcoxx.dll, 6.13.0010.0005 (English), 11/9/2001 12:01:04, 24064 bytes
Driver: C:\WINDOWS\system32\ati2evxx.exe, 6.14.0010.4247 (English), 11/25/2010 22:32:42, 614400 bytes
Driver: C:\WINDOWS\system32\ati2evxx.dll, 6.14.0010.4179 (English), 11/25/2010 22:34:10, 159744 bytes
Driver: C:\WINDOWS\system32\atipdlxx.dll, 6.14.0010.2563 (English), 11/25/2010 22:34:50, 212992 bytes
Driver: C:\WINDOWS\system32\Oemdspif.dll, 6.15.0006.0006 (English), 11/25/2010 22:34:38, 155648 bytes
Driver: C:\WINDOWS\system32\ati2edxx.dll, 6.14.0010.2514 (English), 11/25/2010 22:34:22, 43520 bytes
Driver: C:\WINDOWS\system32\atikvmag.dll, 6.14.0010.0146 (English), 11/25/2010 22:26:38, 651264 bytes
Driver: C:\WINDOWS\system32\ATIDEMGX.dll, 2.00.3981.39470 (English), 11/25/2010 22:55:42, 462848 bytes
Driver: C:\WINDOWS\system32\aticaldd.dll, 6.14.0010.0900 (English), 11/25/2010 23:06:14, 4489216 bytes
Driver: C:\WINDOWS\system32\aticalrt.dll, 6.14.0010.0900 (English), 11/25/2010 23:07:34, 57344 bytes
Driver: C:\WINDOWS\system32\aticalcl.dll, 6.14.0010.0900 (English), 11/25/2010 23:07:24, 53248 bytes
Driver: C:\WINDOWS\system32\atibtmon.exe, 2.00.0000.0000 (English), 5/11/2009 18:35:28, 118784 bytes
Driver: C:\WINDOWS\system32\atiok3x2.dll, 6.14.0010.10362 (English), 11/25/2010 23:23:36, 471040 bytes
Driver: C:\WINDOWS\system32\atioglxx.dll, 6.14.0010.10362 (English), 11/25/2010 23:57:20, 16748544 bytes
Driver: C:\WINDOWS\system32\atiiiexx.dll, 6.14.0010.4006 (English), 11/25/2010 23:12:42, 311296 bytes
Driver: C:\WINDOWS\atiogl.xml, 11/22/2010 22:06:30, 22305 bytes
Driver: C:\WINDOWS\system32\ATIODCLI.exe, 1.00.0000.0001 (English), 6/22/2009 12:34:18, 45056 bytes
Driver: C:\WINDOWS\system32\ATIODE.exe, 1.00.0000.0001 (English), 8/27/2010 15:32:08, 294912 bytes
Name: Microsoft UAA Bus Driver for High Definition Audio
Device ID: PCI\VEN_1002&DEV_970F&SUBSYS_83A21043&REV_00\4&1FD4D60D&0&2908
Driver: C:\WINDOWS\system32\DRIVERS\hdaudbus.sys, 5.10.0001.5013 (English), 4/13/2008 12:36:05, 144384 bytes
Name: PCI standard ISA bridge
Device ID: PCI\VEN_1002&DEV_439D&SUBSYS_00000000&REV_00\3&267A616A&0&A3
Driver: C:\WINDOWS\system32\DRIVERS\isapnp.sys, 5.01.2600.5512 (English), 4/13/2008 14:36:41, 37248 bytes
Name: Standard Dual Channel PCI IDE Controller
Device ID: PCI\VEN_1002&DEV_439C&SUBSYS_83891043&REV_00\3&267A616A&0&A1
Driver: C:\WINDOWS\system32\DRIVERS\pciidex.sys, 5.01.2600.5512 (English), 4/13/2008 14:40:29, 24960 bytes
Driver: C:\WINDOWS\system32\DRIVERS\atapi.sys, 5.01.2600.5512 (English), 4/13/2008 14:40:30, 96512 bytes
Driver: C:\WINDOWS\system32\DRIVERS\pciide.sys, 5.01.2600.0000 (English), 8/4/2004 08:00:00, 3328 bytes
Name: Standard OpenHCD USB Host Controller
Device ID: PCI\VEN_1002&DEV_4399&SUBSYS_83891043&REV_00\3&267A616A&0&A5
Driver: C:\WINDOWS\system32\drivers\usbohci.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:35, 17152 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 20:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:37, 59520 bytes
Name: Standard OpenHCD USB Host Controller
Device ID: PCI\VEN_1002&DEV_4398&SUBSYS_83891043&REV_00\3&267A616A&0&99
Driver: C:\WINDOWS\system32\drivers\usbohci.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:35, 17152 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 20:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:37, 59520 bytes
Name: Standard OpenHCD USB Host Controller
Device ID: PCI\VEN_1002&DEV_4398&SUBSYS_83891043&REV_00\3&267A616A&0&91
Driver: C:\WINDOWS\system32\drivers\usbohci.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:35, 17152 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 20:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:37, 59520 bytes
Name: Standard OpenHCD USB Host Controller
Device ID: PCI\VEN_1002&DEV_4397&SUBSYS_83891043&REV_00\3&267A616A&0&98
Driver: C:\WINDOWS\system32\drivers\usbohci.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:35, 17152 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 20:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:37, 59520 bytes
Name: Standard OpenHCD USB Host Controller
Device ID: PCI\VEN_1002&DEV_4397&SUBSYS_83891043&REV_00\3&267A616A&0&90
Driver: C:\WINDOWS\system32\drivers\usbohci.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:35, 17152 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 20:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:37, 59520 bytes
Name: Standard Enhanced PCI to USB Host Controller
Device ID: PCI\VEN_1002&DEV_4396&SUBSYS_83891043&REV_00\3&267A616A&0&9A
Driver: C:\WINDOWS\system32\drivers\usbehci.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:35, 30208 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 20:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:37, 59520 bytes
Driver: C:\WINDOWS\system32\hccoin.dll, 5.01.2600.5512 (English), 4/13/2008 20:11:54, 7168 bytes
Name: Standard Enhanced PCI to USB Host Controller
Device ID: PCI\VEN_1002&DEV_4396&SUBSYS_83891043&REV_00\3&267A616A&0&92
Driver: C:\WINDOWS\system32\drivers\usbehci.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:35, 30208 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 20:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 14:45:37, 59520 bytes
Driver: C:\WINDOWS\system32\hccoin.dll, 5.01.2600.5512 (English), 4/13/2008 20:11:54, 7168 bytes
Name: Standard Dual Channel PCI IDE Controller
Device ID: PCI\VEN_1002&DEV_4390&SUBSYS_83891043&REV_00\3&267A616A&0&88
Driver: C:\WINDOWS\system32\DRIVERS\pciidex.sys, 5.01.2600.5512 (English), 4/13/2008 14:40:29, 24960 bytes
Driver: C:\WINDOWS\system32\DRIVERS\atapi.sys, 5.01.2600.5512 (English), 4/13/2008 14:40:30, 96512 bytes
Driver: C:\WINDOWS\system32\DRIVERS\pciide.sys, 5.01.2600.0000 (English), 8/4/2004 08:00:00, 3328 bytes
Name: AMD SMBus
Device ID: PCI\VEN_1002&DEV_4385&SUBSYS_83891043&REV_3C\3&267A616A&0&A0
Driver: n/a
Name: PCI standard PCI-to-PCI bridge
Device ID: PCI\VEN_1002&DEV_4384&SUBSYS_00000000&REV_00\3&267A616A&0&A4
Driver: C:\WINDOWS\system32\DRIVERS\pci.sys, 5.01.2600.5512 (English), 4/13/2008 14:36:44, 68224 bytes
Name: Microsoft UAA Bus Driver for High Definition Audio
Device ID: PCI\VEN_1002&DEV_4383&SUBSYS_836C1043&REV_00\3&267A616A&0&A2
Driver: C:\WINDOWS\system32\DRIVERS\hdaudbus.sys, 5.10.0001.5013 (English), 4/13/2008 12:36:05, 144384 bytes
------------------
DirectX Components
------------------
ddraw.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:51 279552 bytes
ddrawex.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:51 27136 bytes
dxapi.sys: 5.01.2600.0000 English Final Retail 8/4/2004 08:00:00 10496 bytes
d3d8.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:51 1179648 bytes
d3d8thk.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:51 8192 bytes
d3d9.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:51 1689088 bytes
d3dim.dll: 5.01.2600.0000 English Final Retail 8/4/2004 08:00:00 436224 bytes
d3dim700.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:51 824320 bytes
d3dramp.dll: 5.01.2600.0000 English Final Retail 8/4/2004 08:00:00 590336 bytes
d3drm.dll: 5.01.2600.0000 English Final Retail 8/4/2004 08:00:00 350208 bytes
d3dxof.dll: 5.01.2600.0000 English Final Retail 8/4/2004 08:00:00 47616 bytes
d3dpmesh.dll: 5.01.2600.0000 English Final Retail 8/4/2004 08:00:00 34816 bytes
dplay.dll: 5.00.2134.0001 English Final Retail 8/4/2004 08:00:00 33040 bytes
dplayx.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 229888 bytes
dpmodemx.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 23552 bytes
dpwsock.dll: 5.00.2134.0001 English Final Retail 8/4/2004 08:00:00 42768 bytes
dpwsockx.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 57344 bytes
dplaysvr.exe: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:17 29696 bytes
dpnsvr.exe: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:17 17920 bytes
dpnet.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 375296 bytes
dpnlobby.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:09:20 3072 bytes
dpnaddr.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:09:19 3072 bytes
dpvoice.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 212480 bytes
dpvsetup.exe: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:18 83456 bytes
dpvvox.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 116736 bytes
dpvacm.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 21504 bytes
dpnhpast.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 35328 bytes
dpnhupnp.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 60928 bytes
dpserial.dll: 5.00.2134.0001 English Final Retail 8/4/2004 08:00:00 53520 bytes
dinput.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 158720 bytes
dinput8.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 181760 bytes
dimap.dll: 5.01.2600.0000 English Final Retail 8/4/2004 08:00:00 44032 bytes
diactfrm.dll: 5.01.2600.0000 English Final Retail 8/4/2004 08:00:00 394240 bytes
joy.cpl: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:41 68608 bytes
gcdef.dll: 5.01.2600.0000 English Final Retail 8/4/2004 08:00:00 76800 bytes
pid.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:02 35328 bytes
gameenum.sys: 5.01.2600.5512 English Final Retail 4/13/2008 14:45:29 10624 bytes
dsound.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 367616 bytes
dsound3d.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 1293824 bytes
dswave.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 19456 bytes
dsdmo.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 181248 bytes
dsdmoprp.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 71680 bytes
dmusic.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 104448 bytes
dmband.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 28672 bytes
dmcompos.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 61440 bytes
dmime.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 181248 bytes
dmloader.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 35840 bytes
dmstyle.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 105984 bytes
dmsynth.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 103424 bytes
dmscript.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 82432 bytes
system.dll: 1.01.4322.2490 English Final Retail 1/20/2012 02:57:59 1232896 bytes
dx7vb.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 619008 bytes
dx8vb.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 1227264 bytes
dxdiagn.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:52 2113536 bytes
mfc40.dll: 4.01.0000.6151 English Beta Retail 9/18/2010 02:53:25 954368 bytes
mfc42.dll: 6.02.8081.0000 English Final Retail 2/8/2011 09:33:55 978944 bytes
wsock32.dll: 5.01.2600.5512 English Final Retail 4/13/2008 20:12:10 22528 bytes
amstream.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:11:49 70656 bytes
devenum.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:11:51 59904 bytes
dxmasf.dll: 6.04.0009.1133 English Final Retail 4/13/2008 20:11:52 498742 bytes
mciqtz32.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:11:56 35328 bytes
mpg2splt.ax: 6.05.2600.5512 English Final Retail 4/13/2008 20:12:42 148992 bytes
msdmo.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:11:59 14336 bytes
encapi.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:11:53 20480 bytes
qasf.dll: 11.00.5721.5262 English Final Retail 1/30/2009 21:34:02 211456 bytes
qcap.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:12:03 192512 bytes
qdv.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:12:03 279040 bytes
qdvd.dll: 6.05.2600.6169 English Final Retail 11/3/2011 11:28:36 386048 bytes
qedit.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:12:03 562176 bytes
qedwipes.dll: 6.05.2600.5512 English Final Retail 4/13/2008 13:21:32 733696 bytes
quartz.dll: 6.05.2600.6169 English Final Retail 11/3/2011 11:28:36 1292288 bytes
strmdll.dll: 4.01.0000.3938 English Final Retail 8/26/2009 04:00:21 247326 bytes
iac25_32.ax: 2.00.0005.0053 English Final Retail 4/13/2008 20:12:42 199680 bytes
ir41_32.ax: 4.51.0016.0003 English Final Retail 4/13/2008 20:12:42 848384 bytes
ir41_qc.dll: 4.30.0062.0002 English Final Retail 4/13/2008 20:11:55 120320 bytes
ir41_qcx.dll: 4.30.0064.0001 English Final Retail 4/13/2008 20:11:55 338432 bytes
ir50_32.dll: 5.2562.0015.0055 English Final Retail 4/13/2008 20:11:55 755200 bytes
ir50_qc.dll: 5.00.0063.0048 English Final Retail 4/13/2008 20:11:55 200192 bytes
ir50_qcx.dll: 5.00.0064.0048 English Final Retail 4/13/2008 20:11:55 183808 bytes
ivfsrc.ax: 5.10.0002.0051 English Final Retail 4/13/2008 20:12:42 154624 bytes
mswebdvd.dll: 6.05.2600.5857 English Final Retail 8/5/2009 05:01:48 204800 bytes
ks.sys: 5.03.2600.5512 English Final Retail 4/13/2008 14:16:36 141056 bytes
ksproxy.ax: 5.03.2600.5512 English Final Retail 4/13/2008 19:12:42 129536 bytes
ksuser.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:56 4096 bytes
stream.sys: 5.03.2600.5512 English Final Retail 4/13/2008 13:45:16 49408 bytes
mspclock.sys: 5.03.2600.5512 English Final Retail 4/13/2008 14:39:50 5376 bytes
mspqm.sys: 5.01.2600.5512 English Final Retail 4/13/2008 14:39:51 4992 bytes
mskssrv.sys: 5.03.2600.5512 English Final Retail 4/13/2008 14:39:52 7552 bytes
swenum.sys: 5.03.2600.5512 English Final Retail 4/13/2008 14:39:53 4352 bytes
mstee.sys: 5.03.2600.5512 English Final Retail 4/13/2008 13:39:50 5504 bytes
bdaplgin.ax: 5.03.2600.5512 English Final Retail 4/13/2008 19:12:42 18432 bytes
bdasup.sys: 5.03.2600.5512 English Final Retail 4/13/2008 13:46:22 11776 bytes
msdvbnp.ax: 6.05.2600.5512 English Final Retail 4/13/2008 19:12:42 56832 bytes
psisdecd.dll: 6.05.2600.5512 English Final Retail 4/13/2008 19:12:04 363520 bytes
psisrndr.ax: 6.05.2600.5512 English Final Retail 4/13/2008 19:12:42 33280 bytes
ipsink.ax: 5.03.2600.5512 English Final Retail 4/13/2008 19:12:42 16384 bytes
mpeg2data.ax: 6.05.2600.5512 English Final Retail 4/13/2008 20:12:42 118272 bytes
ndisip.sys: 5.03.2600.5512 English Final Retail 4/13/2008 13:46:22 10880 bytes
mpe.sys: 5.03.2600.5512 English Final Retail 4/13/2008 13:46:22 15232 bytes
streamip.sys: 5.03.2600.5512 English Final Retail 4/13/2008 13:46:22 15232 bytes
msvidctl.dll: 6.05.2600.5512 English Final Retail 4/13/2008 20:12:01 1428992 bytes
slip.sys: 5.03.2600.5512 English Final Retail 4/13/2008 13:46:24 11136 bytes
nabtsfec.sys: 5.03.2600.5512 English Final Retail 4/13/2008 13:46:26 85248 bytes
ccdecode.sys: 5.03.2600.5512 English Final Retail 4/13/2008 13:46:24 17024 bytes
vbisurf.ax: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:42 30208 bytes
msyuv.dll: 5.03.2600.5908 English Final Retail 11/27/2009 13:11:44 17920 bytes
kstvtune.ax: 5.03.2600.5512 English Final Retail 4/13/2008 19:12:42 61952 bytes
ksxbar.ax: 5.03.2600.5512 English Final Retail 4/13/2008 19:12:42 43008 bytes
kswdmcap.ax: 5.03.2600.5512 English Final Retail 4/13/2008 19:12:42 91136 bytes
vfwwdm32.dll: 5.01.2600.5512 English Final Retail 4/13/2008 19:12:08 53760 bytes
wstcodec.sys: 5.03.2600.5512 English Final Retail 4/13/2008 13:46:24 19200 bytes
wstdecod.dll: 5.03.2600.5512 English Final Retail 4/13/2008 20:12:10 50688 bytes
------------------
DirectShow Filters
------------------
WDM Streaming VBI Codecs:
NABTS/FEC VBI Codec,0x00200000,2,1,,5.03.2600.5512
CC Decoder,0x00200000,2,1,,5.03.2600.5512
WST Codec,0x00200000,1,1,,5.03.2600.5512
DirectShow Filters:
WMAudio Decoder DMO,0x00800800,1,1,,
WMAPro over S/PDIF DMO,0x00600800,1,1,,
WMA Voice Decoder DMO,0x00600800,1,1,,
G2M Session Decoder,0x00600000,1,1,,
Mpeg4s Decoder DMO,0x00800001,1,1,,
WMV Screen decoder DMO,0x00800001,1,1,,
WMVideo Decoder DMO,0x00800001,1,1,,
Mpeg43 Decoder DMO,0x00800001,1,1,,
Mpeg4 Decoder DMO,0x00800001,1,1,,
Hauppauge Transport Filter,0x00200000,1,1,hcwtsfilter.ax,1.04.28117.0000
WMT MuxDeMux Filter,0x00200000,0,0,wmm2filt.dll,2.01.4026.0000
ffdshow Video Decoder,0xffff0000,2,1,ffdshow.ax,1.00.0005.1712
Full Screen Renderer,0x00200000,1,0,quartz.dll,6.05.2600.6169
CoreAVC Video Decoder,0x00600000,1,1,CoreAVC.ax,0.00.0000.0004
ffdshow DXVA Video Decoder,0xffff0000,2,1,ffdshow.ax,1.01.3611.0000
ffdshow raw video filter,0xffff0000,2,1,ffdshow.ax,1.00.0005.1712
RealPlayer Video Filter,0x00200000,1,1,rdsf3260.dll,12.00.0001.0633
Mpa Splitter,0x00600001,1,1,MpaSplitter.ax,1.00.0000.0002
ffdshow Audio Decoder,0xffff0000,1,1,ffdshow.ax,1.00.0005.1712
ATI Ticker,0x00200000,0,1,Ticker.ax,
DV Muxer,0x00400000,0,0,qdv.dll,6.05.2600.5512
MainConcept (HCW) MPEG-2 Video Decoder,0x00600000,2,2,HCW_mcm2vd.ax,7.05.0000.32871
Color Space Converter,0x00400001,1,1,quartz.dll,6.05.2600.6169
Hauppauge MPEG Layer-1/2 Audio Decoder,0x00400000,1,1,HaupMPEGBox.ax,5.00.0833.0000
iVAC Time Delay ,0x00400000,1,1,tmdly.ax,2.70.0000.0000
WM ASF Reader,0x00400000,0,0,qasf.dll,11.00.5721.5262
Screen Capture filter,0x00200000,0,1,wmpsrcwp.dll,11.00.5721.5262
AVI Splitter,0x00600000,1,1,quartz.dll,6.05.2600.6169
WMT AudioAnalyzer,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
VGA 16 Color Ditherer,0x00400000,1,1,quartz.dll,6.05.2600.6169
Indeo® video 5.10 Compression Filter,0x00200000,1,1,ir50_32.dll,5.2562.0015.0055
Hauppauge E-AC3 Decoder,0x00200000,1,1,HaupEAC3Codec.ax,1.00.0003.0000
Windows Media Audio Decoder,0x00800001,1,1,msadds32.ax,8.00.0000.4487
RealVideo Decoder,0x00400000,1,1,realmediasplitter.ax,1.00.0001.0001
ArcSoft RealMedia Splitter,0x00600000,1,1,ArcRealMediaSplitter.ax,1.00.0000.0005
AC3 Parser Filter,0x00600000,1,1,mpg2splt.ax,6.05.2600.5512
WMT Format Conversion,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
StreamBufferSink,0x00200000,0,0,sbe.dll,6.05.2600.6076
WMT Black Frame Generator,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
HP Frame Grabber Filter,0x00200000,1,1,hpqdsftr.ax,45.04.0157.0000
MJPEG Decompressor,0x00600000,1,1,quartz.dll,6.05.2600.6169
Indeo® video 5.10 Decompression Filter,0x00640000,1,1,ir50_32.dll,5.2562.0015.0055
WMT Screen Capture filter,0x00200000,0,1,wmm2filt.dll,2.01.4026.0000
Microsoft Screen Video Decompressor,0x00800000,1,1,msscds32.ax,8.00.0000.4487
MPEG-I Stream Splitter,0x00600000,1,2,quartz.dll,6.05.2600.6169
SAMI (CC) Parser,0x00400000,1,1,quartz.dll,6.05.2600.6169
VBI Codec,0x00600000,1,4,VBICodec.ax,6.05.2710.2732
MPEG Layer-3 Decoder,0x00810000,1,1,l3codecx.ax,1.06.0000.0052
MPV Decoder Filter,0x40000002,1,1,Mpeg2DecFilter.ax,1.00.0000.0003
MPEG-2 Splitter,0x005fffff,1,0,mpg2splt.ax,6.05.2600.5512
ArcSoft RealMedia Video Decoder,0x00600000,1,1,RealVideoDecoder.ax,1.00.0000.0005
MP4 Source,0xffff0000,0,0,MP4splitter.ax,1.00.0000.0002
Hauppauge Transport Subtitles,0x00200000,1,0,hcwTSSubtitles.ax,1.00.27173.0000
Pinnacle Image Scaler,0x00200000,1,1,pcleCSC.ax,2.04.0366.0000
ACELP.net Sipro Lab Audio Decoder,0x00800001,1,1,acelpdec.ax,1.04.0000.0000
MemoryStick Voice Decrypt Splitter,0x00600000,1,1,msvdec.ax,1.00.0007.8060
FLV Splitter,0xffff0000,1,1,FLVSplitter.ax,1.00.0000.0005
Internal Script Command Renderer,0x00800001,1,0,quartz.dll,6.05.2600.6169
AVS Video Out,0x00200000,0,1,AVSVideoOutFilter3.ax,1.00.0000.0248
MPEG Audio Decoder,0x03680001,1,1,quartz.dll,6.05.2600.6169
MMACE ProcAmp,0x00200000,0,2,MMACEFilters.dll,
WavPack Audio Decoder,0x00600000,1,1,WavPackDSDecoder.ax,1.00.0003.0431
File Source (Netshow URL),0x00400000,0,1,wmpasf.dll,11.00.5721.5262
WMT Import Filter,0x00200000,0,1,wmm2filt.dll,2.01.4026.0000
DV Splitter,0x00600000,1,2,qdv.dll,6.05.2600.5512
Bitmap Generate,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Windows Media Video Decoder,0x00800000,1,1,wmvds32.ax,8.00.0000.4487
Video Mixing Renderer 9,0x00200000,1,0,quartz.dll,
CoreFLAC Audio Source,0x00600000,0,0,CoreFLACDecoder.ax,0.04.0000.0046
Windows Media Video Decoder,0x00800000,1,1,wmv8ds32.ax,8.00.0000.4000
Pinnacle Video AntiJitter,0x00200000,1,1,pcleCSC.ax,2.04.0366.0000
Haali Media Splitter,0x00800001,0,1,splitter.ax,1.06.0338.0023
Haali Media Splitter (AR),0x00400000,1,1,splitter.ax,1.06.0338.0023
Hauppauge Transport Writer,0x00200000,1,0,HCWTSWriter.ax,1.03.28166.0000
WMT VIH2 Fix,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Mpa Source,0x00600001,0,0,MpaSplitter.ax,1.00.0000.0002
Record Queue,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
CoreFLAC Audio Decoder,0x00600000,1,1,CoreFLACDecoder.ax,0.04.0000.0046
Hauppauge VBI Slicer,0x00200000,1,4,hcwvbislicer.ax,1.00.27335.0000
MainConcept (HCW) Layer II Audio Encoder,0x00200000,1,1,hcw_mcl2ae.ax,7.03.0000.37081
MP4 Splitter,0xffff0000,1,1,MP4splitter.ax,1.00.0000.0002
Hauppauge Transport Teletext,0x00200000,1,0,hcwTSTeletext.dll,1.00.27352.0000
Windows Media Multiplexer,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
ASX file Parser,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
ASX v.2 file Parser,0x00600000,1,0,wmpasf.dll,11.00.5721.5262
NSC file Parser,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
Pinnacle Video Block Filter,0x00200000,1,1,pcleCSC.ax,2.04.0366.0000
Hauppauge Raw Sink,0x00200000,1,0,hcwRawSink.ax,
MainConcept (HCW) MPEG Multiplexer-Plus,0x00200000,1,1,hcw_mcmpeg2mux.ax,7.06.0000.37081
ACM Wrapper,0x00600000,1,1,quartz.dll,6.05.2600.6169
CoreAAC Audio Decoder,0x00800000,1,1,CoreAAC.ax,1.01.0000.0642
Windows Media source filter,0x00600000,0,2,wmpasf.dll,11.00.5721.5262
Video Renderer,0x00800001,1,0,quartz.dll,6.05.2600.6169
Frame Eater,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
MPEG-2 Video Stream Analyzer,0x00200000,0,0,sbe.dll,6.05.2600.6076
Ogg Source,0x00600001,0,0,OggSplitter.ax,1.00.0000.0000
Line 21 Decoder,0x00600000,1,1,qdvd.dll,6.05.2600.6169
Video Port Manager,0x00600000,2,1,quartz.dll,6.05.2600.6169
Pinnacle Image Converter,0x00200000,1,1,pcleCSC.ax,2.04.0366.0000
WST Decoder,0x00600000,1,1,wstdecod.dll,5.03.2600.5512
Video Renderer,0x00400000,1,0,quartz.dll,6.05.2600.6169
Haali Video Renderer,0x00200000,1,0,dxr.dll,
RealMedia Source,0x00600000,0,0,realmediasplitter.ax,1.00.0001.0001
LEAD MCMP/MJPEG Codec,0x00100000,1,1,LCodcCMP.dll,1.00.0000.0021
LEAD MCMP/MJPEG Decoder,0x00800000,1,1,LCodcCMP.dll,1.00.0000.0021
Hauppauge AC3 Decoder,0x00800000,1,1,HaupAC3Decoder.ax,1.00.0365.0000
Hauppauge CC Dump,0x00200000,1,0,HCWccdump.ax,1.00.27316.0001
MSV LPEC Splitter,0x00810000,1,1,lpecsp.ax,1.01.0009.8060
Sony LPEC Decoder,0x00810000,1,1,lpecde.ax,1.00.0008.8060
MSV LPEC Stereo Splitter,0x00810000,1,1,lcstsp.ax,1.00.0008.8060
Sony LPEC Stereo Decoder,0x00810000,1,1,lcstde.ax,1.01.0004.8060
MSV TRC Splitter,0x00610000,1,1,trcsp.ax,1.01.0008.8060
Sony TRC Decoder,0x00810000,1,1,trcde.ax,1.01.0008.8060
WM ASF Writer,0x00400000,0,0,qasf.dll,11.00.5721.5262
FLV4 Video Decoder,0x00400000,1,1,FLVSplitter.ax,1.00.0000.0005
WMT Sample Information Filter,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
VBI Surface Allocator,0x00600000,1,1,vbisurf.ax,5.03.2600.5512
MMACE SoftEmu,0x00200000,0,2,MMACEFilters.dll,
File writer,0x00200000,1,0,qcap.dll,6.05.2600.5512
RadLight MPC DirectShow Filter,0x00600000,0,1,RLMPCDec.ax,1.00.0000.0004
Haali Simple Media Splitter,0x00200000,0,1,splitter.ax,1.06.0338.0023
WMT Log Filter,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
WMT Virtual Renderer,0x00200000,1,0,wmm2filt.dll,2.01.4026.0000
DirectVobSub,0x00200000,2,1,VSFilter.dll,2.40.2677.0000
RealAudio Decoder,0x00400000,1,1,realmediasplitter.ax,1.00.0001.0001
Pinnacle Video Deinterlacer,0x00200000,1,1,pcleCSC.ax,2.04.0366.0000
Avi Splitter,0x00600001,1,1,AviSplitter.ax,1.00.0000.0007
DirectVobSub (auto-loading version),0x00800002,2,1,VSFilter.dll,2.40.2677.0000
WAV Dest,0x00000000,0,0,,
DVD Navigator,0x00200000,0,2,qdvd.dll,6.05.2600.6169
Hauppauge WinTV SnapShot,0x00200000,1,1,Hcwsnap.ax,1.12.21077.0000
MMACE DeInterlace,0x00200000,0,2,MMACEFilters.dll,
Ogg Splitter,0x00600001,1,1,OggSplitter.ax,1.00.0000.0000
Overlay Mixer2,0x00400000,1,1,qdvd.dll,6.05.2600.6169
Haali Matroska Muxer,0x00200000,1,0,splitter.ax,1.06.0338.0023
AC3Filter,0x40000000,1,1,ac3filter.ax,0.07.0000.0000
AVI Draw,0x00600064,9,1,quartz.dll,6.05.2600.6169
.RAM file Parser,0x00600000,1,0,wmpasf.dll,11.00.5721.5262
Hauppauge WinTV File Writer,0x00200000,1,0,,
MainConcept (HCW) MPEG-2 Video Encoder,0x00400000,2,1,hcw_mcm2ve.ax,7.04.0000.37081
Hauppauge Transport Reader,0x00200000,0,0,HCWTSReader.ax,1.00.29029.0000
WMT DirectX Transform Wrapper,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
G.711 Codec,0x00200000,1,1,g711codc.ax,5.01.2600.0000
MPEG-2 Demultiplexer,0x00600000,1,1,mpg2splt.ax,6.05.2600.5512
DV Video Decoder,0x00800000,1,1,qdv.dll,6.05.2600.5512
RealPlayer Transcode Filter,0x00600000,0,0,rdsf3260.dll,12.00.0001.0633
Indeo® audio software,0x00500000,1,1,iac25_32.ax,2.00.0005.0053
Windows Media Update Filter,0x00400000,1,0,wmpasf.dll,11.00.5721.5262
ffdshow Audio Processor,0xffff0000,1,1,ffdshow.ax,1.00.0005.1712
ASF DIB Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
ASF ACM Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
ASF ICM Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
ASF URL Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
ASF JPEG Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
ASF DJPEG Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
ASF embedded stuff Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
9x8Resize,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
WIA Stream Snapshot Filter,0x00200000,1,1,wiasf.ax,1.00.0000.0000
Allocator Fix,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
SampleGrabber,0x00200000,1,1,qedit.dll,6.05.2600.5512
Null Renderer,0x00200000,1,0,qedit.dll,6.05.2600.5512
WMT Virtual Source,0x00200000,0,1,wmm2filt.dll,2.01.4026.0000
Hauppauge Raw Source,0x00200000,0,1,hcwRawSource.ax,
MPEG-2 Sections and Tables,0x005fffff,1,0,Mpeg2Data.ax,6.05.2600.5512
WMT Interlacer,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
FLV Source,0x00600001,0,0,FLVSplitter.ax,1.00.0000.0005
StreamBufferSource,0x00200000,0,0,sbe.dll,6.05.2600.6076
Smart Tee,0x00200000,1,2,qcap.dll,6.05.2600.5512
Overlay Mixer,0x00200000,0,0,qdvd.dll,6.05.2600.6169
Avi Source,0x00600001,0,0,AviSplitter.ax,1.00.0000.0007
RealPlayer Audio Filter,0x00200000,1,1,rdsf3260.dll,12.00.0001.0633
AVI Decompressor,0x00600000,1,1,quartz.dll,6.05.2600.6169
Uncompressed Domain Shot Detection Filter,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
AVI/WAV File Source,0x00400000,0,2,quartz.dll,6.05.2600.6169
MPEG4 Video Splitter,0xffff0000,1,1,MP4splitter.ax,1.00.0000.0002
QuickTime Movie Parser,0x00600000,1,1,quartz.dll,6.05.2600.6169
Wave Parser,0x00400000,1,1,quartz.dll,6.05.2600.6169
MIDI Parser,0x00400000,1,1,quartz.dll,6.05.2600.6169
Multi-file Parser,0x00400000,1,1,quartz.dll,6.05.2600.6169
File stream renderer,0x00400000,1,1,quartz.dll,6.05.2600.6169
XML Playlist,0x00400000,1,0,wmpasf.dll,11.00.5721.5262
Hauppauge Transport Analog Teletext,0x00200000,1,1,hcwTSAnalogTxt.ax,1.00.27050.0000
ArcSoft MPEG Demux,0x00400000,1,2,ArcDemux.ax,1.00.0002.0146
Arcsoft AMRDecoder,0x00600000,1,1,AMRDecoder.ax,1.00.0000.0019
Hauppauge CC Inserter,0x00200000,1,1,hcwCCInserter.ax,1.00.27316.0000
Zoran Decompressor,0x00200000,1,1,nuvision.ax,2.00.0003.0002
WavPack Audio Splitter,0x00600000,1,1,WavPackDSSplitter.ax,1.00.0003.0277
ffdshow subtitles filter,0xffff0000,2,1,ffdshow.ax,1.01.3611.0000
Hauppauge PSI Parser,0x00200000,1,1,PsiParser.ax,4.00.28327.0000
RealMedia Splitter,0x00600000,1,1,realmediasplitter.ax,1.00.0001.0001
AVI Mux,0x00200000,1,0,qcap.dll,6.05.2600.5512
MPEG4 Video Source,0xffff0000,0,0,MP4splitter.ax,1.00.0000.0002
Line 21 Decoder 2,0x00600002,1,1,quartz.dll,6.05.2600.6169
iVAC USB Filter,0x00400000,0,1,usbsrc.ax,
File Source (Async.),0x00400000,0,1,quartz.dll,6.05.2600.6169
File Source (URL),0x00400000,0,1,quartz.dll,6.05.2600.6169
WMT DV Extract,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
WMT Switch Filter,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Hauppauge WinTV File Reader,0x00200000,0,1,hcwFread.ax,1.08.20168.0000
WMT Volume,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Haali Video Sink,0x00200000,1,0,splitter.ax,1.06.0338.0023
Stretch Video,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Infinite Pin Tee Filter,0x00200000,1,1,qcap.dll,6.05.2600.5512
Enhanced Video Renderer,0x00200000,1,0,evr.dll,6.00.6002.18084
BDA MPEG2 Transport Information Filter,0x00200000,1,0,PsisRndr.ax,6.05.2600.5512
QT Decompressor,0x00600000,1,1,quartz.dll,6.05.2600.6169
MPEG Video Decoder,0x40000001,1,1,quartz.dll,6.05.2600.6169
Pinnacle CSC,0x00200000,1,1,pcleCSC.ax,2.04.0366.0000
Indeo® video 4.4 Decompression Filter,0x00640000,1,1,ir41_32.ax,4.51.0016.0003
Indeo® video 4.4 Compression Filter,0x00200000,1,1,ir41_32.ax,4.51.0016.0003
WDM Streaming Tee/Splitter Devices:
Tee/Sink-to-Sink Converter,0x00200000,1,1,,5.03.2600.5512
Video Compressors:
WMVideo8 Encoder DMO,0x00600800,1,1,,
MSScreen encoder DMO,0x00600800,1,1,,
WMVideo9 Encoder DMO,0x00600800,1,1,,
MSScreen 9 encoder DMO,0x00600800,1,1,,
DV Video Encoder,0x00200000,0,0,qdv.dll,6.05.2600.5512
ffdshow video encoder,0x00100000,1,1,ffdshow.ax,1.00.0005.1712
Indeo® video 5.10 Compression Filter,0x00100000,1,1,ir50_32.dll,5.2562.0015.0055
LEAD MCMP/MJPEG Codec,0x00100000,1,1,LCodcCMP.dll,1.00.0000.0021
MainConcept (HCW) MPEG-2 Video Encoder,0x00400000,2,1,hcw_mcm2ve.ax,7.04.0000.37081
MJPEG Compressor,0x00200000,0,0,quartz.dll,6.05.2600.6169
Cinepak Codec by Radius,0x00200000,1,1,qcap.dll,6.05.2600.5512
ffdshow Video Codec,0x00200000,1,1,qcap.dll,6.05.2600.5512
Intel 4:2:0 Video V2.50,0x00200000,1,1,qcap.dll,6.05.2600.5512
Intel Indeo(R) Video R3.2,0x00200000,1,1,qcap.dll,6.05.2600.5512
Intel Indeo® Video 4.5,0x00200000,1,1,qcap.dll,6.05.2600.5512
Indeo® video 5.10,0x00200000,1,1,qcap.dll,6.05.2600.5512
Intel IYUV codec,0x00200000,1,1,qcap.dll,6.05.2600.5512
Microsoft H.261 Video Codec,0x00200000,1,1,qcap.dll,6.05.2600.5512
Microsoft H.263 Video Codec,0x00200000,1,1,qcap.dll,6.05.2600.5512
Microsoft RLE,0x00200000,1,1,qcap.dll,6.05.2600.5512
Microsoft Video 1,0x00200000,1,1,qcap.dll,6.05.2600.5512
Audio Compressors:
WMA Voice Encoder DMO,0x00600800,1,1,,
WM Speech Encoder DMO,0x00600800,1,1,,
WMAudio Encoder DMO,0x00600800,1,1,,
MainConcept (HCW) Layer II Audio Encoder,0x00800001,1,1,hcw_mcl2ae.ax,7.03.0000.37081
IAC2,0x00200000,1,1,quartz.dll,6.05.2600.6169
IMA ADPCM,0x00200000,1,1,quartz.dll,6.05.2600.6169
PCM,0x00200000,1,1,quartz.dll,6.05.2600.6169
Microsoft ADPCM,0x00200000,1,1,quartz.dll,6.05.2600.6169
ACELP.net,0x00200000,1,1,quartz.dll,6.05.2600.6169
DSP Group TrueSpeech(TM),0x00200000,1,1,quartz.dll,6.05.2600.6169
Windows Media Audio V1,0x00200000,1,1,quartz.dll,6.05.2600.6169
Windows Media Audio V2,0x00200000,1,1,quartz.dll,6.05.2600.6169
GSM 6.10,0x00200000,1,1,quartz.dll,6.05.2600.6169
Microsoft G.723.1,0x00200000,1,1,quartz.dll,6.05.2600.6169
CCITT A-Law,0x00200000,1,1,quartz.dll,6.05.2600.6169
CCITT u-Law,0x00200000,1,1,quartz.dll,6.05.2600.6169
MPEG Layer-3,0x00200000,1,1,quartz.dll,6.05.2600.6169
Midi Renderers:
Default MidiOut Device,0x00800000,1,0,quartz.dll,6.05.2600.6169
Pinnacle Auxiliary Filters:
Pinnacle CSC,0x00200000,1,1,pcleCSC.ax,2.04.0366.0000
Pinnacle Image Converter,0x00200000,1,1,pcleCSC.ax,2.04.0366.0000
Pinnacle Image Scaler,0x00200000,1,1,pcleCSC.ax,2.04.0366.0000
Pinnacle Video AntiJitter,0x00200000,1,1,pcleCSC.ax,2.04.0366.0000
Pinnacle Video Block Filter,0x00200000,1,1,pcleCSC.ax,2.04.0366.0000
Pinnacle Video Deinterlacer,0x00200000,1,1,pcleCSC.ax,2.04.0366.0000
BDA Rendering Filters:
BDA IP Sink,0x00200000,1,1,,5.03.2600.5512
BDA Network Providers:
Microsoft ATSC Network Provider,0x00200000,0,1,MsDvbNp.ax,6.05.2600.5512
Microsoft DVBC Network Provider,0x00200000,0,1,MsDvbNp.ax,6.05.2600.5512
Microsoft DVBS Network Provider,0x00200000,0,1,MsDvbNp.ax,6.05.2600.5512
Microsoft DVBT Network Provider,0x00200000,0,1,MsDvbNp.ax,6.05.2600.5512
Multi-Instance Capable VBI Codecs:
VBI Codec,0x00600000,1,4,VBICodec.ax,6.05.2710.2732
BDA Transport Information Renderers:
BDA MPEG2 Transport Information Filter,0x00600000,1,0,PsisRndr.ax,6.05.2600.5512
MPEG-2 Sections and Tables,0x00600000,1,0,Mpeg2Data.ax,6.05.2600.5512
BDA CP/CA Filters:
Decrypt/Tag,0x00600000,1,0,encdec.dll,6.05.2600.6161
Encrypt/Tag,0x00200000,0,0,encdec.dll,6.05.2600.6161
XDS Codec,0x00200000,0,0,encdec.dll,6.05.2600.6161
WDM Streaming Communication Transforms:
Tee/Sink-to-Sink Converter,0x00200000,1,1,,5.03.2600.5512
Audio Renderers:
Default DirectSound Device,0x00800000,1,0,quartz.dll,6.05.2600.6169
Default WaveOut Device,0x00200000,1,0,quartz.dll,6.05.2600.6169
BDA Receiver Component:
BDA Slip De-Framer,0x00600000,1,1,,5.03.2600.5512
BDA MPE Filter,0x00600000,1,1,,5.03.2600.5512


Thank you!


----------



## Cookiegal (Aug 27, 2003)

Please reinstall the video card and then run dxdiag again and post the new log.

Let's check for a minidump from the last blue screen. See if you have files that look like this:

c:\windows\minidump\minixxxxxx-01.dmp (where the Xs represent the date, i.e. 251012) and the 01 will incease with each dump file to 02, 03, 04, etc.

Please zip the file (right-click on it and select "Send To" and then "Compressed (zipped) Folder") and upload the zipped file as an attachment. This should tell us what driver is causing the blue screens.


----------



## shadowbird (Oct 9, 2012)

The minidump folder doesn't exactly match your description, so I've attached a screen shot of the minidump folder contents. Let me know if it's not clear enough, and I'll type them out or something.



Cookiegal said:


> Please reinstall the video card and then run dxdiag again and post the new log.
> 
> Let's check for a minidump from the last blue screen. See if you have files that look like this:
> 
> ...


----------



## shadowbird (Oct 9, 2012)

Cookiegal said:


> Please reinstall the video card and then run dxdiag again and post the new log.
> 
> Let's check for a minidump from the last blue screen. See if you have files that look like this:
> 
> ...


----------



## Cookiegal (Aug 27, 2003)

shadowbird said:


> The minidump folder doesn't exactly match your description, so I've attached a screen shot of the minidump folder contents. Let me know if it's not clear enough, and I'll type them out or something.


Actually, they exactly match my description. You're probably referring to the -01 part but if there is more than one dump on theh same date that will chagne to 02, 03, etc.

So the most recent one I see there is October 20th but I can't see all of them and assume there is a more recent one. Please zip and upload the most recent one.


----------



## shadowbird (Oct 9, 2012)

It was crashing every day a couple of times. 1020 is the most recent in that file, but maybe it's because I was shutting it down before it created a file.(?) I thought it was virus activity at first, so as soon as I saw the blue screen, I would press the button to shut it down before it could damage anything. I wasn't sure what the dump message was about on the blue screen.


----------



## shadowbird (Oct 9, 2012)

It hasn't crashed again since updating that driver. Now I just have an error message when I start up. It might stop if I reinstall the BSecure program.

I need to get my good sound card installed again and see if it still doesn't crash. That's the card I was using when the blue screen started. I hope to reinstall it before Monday.


----------



## Cookiegal (Aug 27, 2003)

OK. Please let me know when you've done that.


----------



## shadowbird (Oct 9, 2012)

I tried to reinstall the BSecure program to get rid of the inst.exe failure message. BSecure suggests reinstalling it over the current installation, rather than uninstalling it first. An error message popped up, blocking the installation. I wonder if there is another virus that we didn't find yet. I first received this error message on 10/17 (as noted in my replies). BSecure is also a virus protection software.


----------



## shadowbird (Oct 9, 2012)

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/27/2012
Time: 11:34:58 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application inst32.exe, version 1.0.0.1, faulting module inst32.exe, version 1.0.0.1, fault address 0x00001612.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 6e 73 ure ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 69 6e 73 74 33 in inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612
0050: 0d 0a


----------



## shadowbird (Oct 9, 2012)

I took screen shots of the error messages that just occurred when I tried to reinstall BSecure.


----------



## shadowbird (Oct 9, 2012)

Don't know if this applies or makes a difference, but just in case, I used System Look:

SystemLook 30.07.11 by jpshortstuff
Log created at 00:09 on 28/10/2012 by Francie
Administrator - Elevation successful
========== filefind ==========
Searching for "inst.exe"
No files found.
-= EOF =-


----------



## shadowbird (Oct 9, 2012)

Just up checking my PC, because I ran Panda Online scanner according to another page on this site that said the inst.exe is a trojan and Panda online scanner would remove it. THen learned that was years ago and it's not free anymore. 

Anyway, when I checked my PC, I saw that Microsoft Security quarantined this virus at 3:20am: trojan:32/sirefeflcfg Has not been deleted.

Should I delete it? Do I need to do anything else about it?

I don't know if this newly discovered trojan has anything to do with Inst.exe error, which started on the 17th.

Thanks, Cookiegal,
FMG


----------



## shadowbird (Oct 9, 2012)

Btw, Panda online scanner is still running. It is 22 % complete and has found 35 files infected, 1 suspicious file detected. I figure I'll let it run and see what it finds, even though it can't delete them.


----------



## shadowbird (Oct 9, 2012)

By now you've read my prior posts, and deleting that virus didn't fix anything. I just restarted my PC and still have the "Inst.exe" error.


----------



## Cookiegal (Aug 27, 2003)

shadowbird said:


> Just up checking my PC, because I ran Panda Online scanner according to another page on this site that said the inst.exe is a trojan and Panda online scanner would remove it. THen learned that was years ago and it's not free anymore.
> 
> Anyway, when I checked my PC, I saw that Microsoft Security quarantined this virus at 3:20am: trojan:32/sirefeflcfg Has not been deleted.
> 
> ...


You need to provide the name of the file detected (not just the name of the infection). It was likely something that's already been quarantined by one of the tools we've run.


----------



## Cookiegal (Aug 27, 2003)

shadowbird said:


> I tried to reinstall the BSecure program to get rid of the inst.exe failure message. BSecure suggests reinstalling it over the current installation, rather than uninstalling it first. An error message popped up, blocking the installation. I wonder if there is another virus that we didn't find yet. I first received this error message on 10/17 (as noted in my replies). BSecure is also a virus protection software.


Please run SystemLook again with the following script:

```
:filefind
*inst*
*nvsvc*
```


----------



## shadowbird (Oct 9, 2012)

Even though I deleted the one from this a.m., the quarantine is still showing two prior instances of the same virus. Below are the files and the dates. I'm typing them out, as MSE isn't allowing cut and paste. 

The results of the "look" attached as zipped, because it's very big. Looks like it included every instance of the words "install" and "uninstall."

Trojan:Win32/Sirefef!cfg 10/21/2012 12:07pm Quarantined
file:C:\windows\installer\{8d5fdb31-6d03-5661-4abc-defd2d498237}\@

Trojan:Win32/Sirefef!cfg 10/26/2012 10:42pm Quarantined
file:C:\windows\installer\{8d5fdb31-6d03-5661-4abc-defd2d498237}\@

Apparently the same file for both instances.


----------



## Cookiegal (Aug 27, 2003)

Please run SystemLook again with the following script:


```
:dir
8d5fdb31-6d03-5661-4abc-defd2d498237
```
Please run GMER again.

Double click the GMER .exe file on your desktop to run the tool and it will automatically do a quick scan.

If the tool warns of rootkit activity and asks if you want to run a full scan, click on No and make sure the following are *unchecked *on the right-hand side:

IAT/EAT
Any drive letter other than the primary system drive (which is generally C).

Click the *Scan *button and when the scan is finished, click *Save* and save the log in Notepad with the name ark.txt to your desktop.

*Note: It's important that all other windows be closed and that you don't touch the mouse or do anything with the computer during the scan as it may cause it to freeze. You should disable your screen saver as if it comes on it may cause the program to freeze.*

Open the ark.txt file and copy and paste the contents of the log here please.


----------



## shadowbird (Oct 9, 2012)

SystemLook 30.07.11 by jpshortstuff
Log created at 22:36 on 28/10/2012 by Francie
Administrator - Elevation successful
========== dir ==========
8d5fdb31-6d03-5661-4abc-defd2d498237 - Unable to find folder.
-= EOF =-


----------



## shadowbird (Oct 9, 2012)

Cookiegal said:


> Please run SystemLook again with the following script:
> 
> 
> ```
> ...


Do you want those items unchecked whether or not it warns of a root kit, or just if it warns of a root kit?


----------



## shadowbird (Oct 9, 2012)

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-10-29 03:45:53
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 SAMSUNG_HD322HJ rev.1AC01118
Running: 5w4ynd93.exe; Driver: C:\DOCUME~1\Francie\LOCALS~1\Temp\pxldyfob.sys

---- Kernel code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys  section is writeable [0xB2D01000, 0x1E2E6E, 0xE8000020]
---- User code sections - GMER 1.0.15 ----
.text C:\Program Files\Internet Explorer\iexplore.exe[2268] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2268] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9AB5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2268] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD12D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2268] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2268] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E25466C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2268] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E725F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2268] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E7191 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2268] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E71FC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2268] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E7062 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2268] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E70C4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2268] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E72C2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2268] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E7126 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2268] ole32.dll!CoCreateInstance 774FF1BC 5 Bytes JMP 3E2EDB80 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2268] ole32.dll!OleLoadFromStream 7752983B 5 Bytes JMP 3E3E75C7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3176] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3176] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3176] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E725F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3176] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E7191 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3176] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E71FC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3176] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E7062 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3176] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E70C4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3176] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E72C2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3176] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E7126 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Program Files\Internet Explorer\iexplore.exe[2268] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Ntfs \Ntfs BsecFltr.sys (BSafeFil/BSafe Online)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\[email protected] 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\[email protected] 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\[email protected] yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\[email protected] 
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\[email protected] 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\[email protected] 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\[email protected]_DLLs 1
---- EOF - GMER 1.0.15 ----


----------



## Cookiegal (Aug 27, 2003)

OK, thanks for those. GMER looks fine.

There are two registry keys that we need to restore from the ComboFix quarantine so please do the following:

Please go to *Start - Run* and copy and paste the following command then press Enter:


```
Regedit /s C:\Qoobox\Quarantine\Registry_backups\Service_nvsvc.reg.dat
```
Then do the same for the following command as well:


```
Regedit /s C:\Qoobox\Quarantine\Registry_backups\Legacy_NVSVC.reg.dat
```
Then reboot the computer and let me know the current status of any problems.

Also, have you reinstalled the sound card?


----------



## shadowbird (Oct 9, 2012)

If I said "sound card" before, I meant graphics card. No, I have not reinstalled the graphics card yet.

I rebooted and this is the error message and two files it gave me:

Inst app encountered a problem and needed to close

inst32.exe

C:\Docum~1\Francie\Locals~1\Tamp\WERdb32.dir00\Inst32.exe.mdmp

C:\Docum~1\Francie\Locals~1\Tamp\WERdb32.dir00\appcompat.txt


----------



## shadowbird (Oct 9, 2012)

I just rebooted and finally go this other, related error message written down completely before it disappeared. Looks like it reveals where the file is located:

C:\Program Files\BSecure\Inst.32.exe failed with 1073741819


----------



## shadowbird (Oct 9, 2012)

Apparently, the reason Bsecure says to re-install on top of the original is to preserve settings. I decided to uninstall it, just redo all the settings when I reinstall it. 

When I reinstalled it from the exe file already on my desktop, I still got a message saying installation failed and this:

C:\Docum~1\Francie\Locals~1\7zipsfx.000.inst32.1073741819


----------



## shadowbird (Oct 9, 2012)

CORRECTION: It's....

C:\Docum~1\Francie\Locals~1\Temp\7zipsfx.000\inst32 -| 1073741819


----------



## Cookiegal (Aug 27, 2003)

Please go to *Start *- *Run *- type in *eventvwr.msc* to open the event viewer. Look under both "Application" and "System" for recent (the last 48 hours or so) errors (shown in red) and if found, do this for each one.

Double-click the error to open it up and then click on the icon that looks like two pieces of paper. This will copy the full error. Then "paste" the error into Notepad. Do this for each one until you have them all listed in Notepad and then copy and paste the list in a reply here please.


----------



## shadowbird (Oct 9, 2012)

APPLICATION:
Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/29/2012
Time: 3:22:27 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application inst32.exe, version 1.0.0.1, faulting module inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 6e 73 ure ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 69 6e 73 74 33 in inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612
0050: 0d 0a ..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/29/2012
Time: 3:20:50 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application inst32.exe, version 1.0.0.1, faulting module inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 6e 73 ure ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 69 6e 73 74 33 in inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612
0050: 0d 0a ..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/29/2012
Time: 3:19:16 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application inst32.exe, version 1.0.0.1, faulting module inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 6e 73 ure ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 69 6e 73 74 33 in inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612
0050: 0d 0a ..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/29/2012
Time: 3:15:44 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application inst32.exe, version 1.0.0.1, faulting module inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 6e 73 ure ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 69 6e 73 74 33 in inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612
0050: 0d 0a ..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/29/2012
Time: 3:14:55 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application inst32.exe, version 1.0.0.1, faulting module inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 6e 73 ure ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 69 6e 73 74 33 in inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612
0050: 0d 0a ..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/29/2012
Time: 3:06:45 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application inst32.exe, version 1.0.0.1, faulting module inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 6e 73 ure ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 69 6e 73 74 33 in inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612
0050: 0d 0a ..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/29/2012
Time: 3:05:43 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application inst32.exe, version 1.0.0.1, faulting module inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 6e 73 ure ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 69 6e 73 74 33 in inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612
0050: 0d 0a ..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/29/2012
Time: 3:04:37 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application inst32.exe, version 1.0.0.1, faulting module inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 6e 73 ure ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 69 6e 73 74 33 in inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612
0050: 0d 0a ..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/29/2012
Time: 3:03:44 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application inst32.exe, version 1.0.0.1, faulting module inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 6e 73 ure ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 69 6e 73 74 33 in inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612
0050: 0d 0a .. 
Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/29/2012
Time: 3:01:47 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application inst32.exe, version 1.0.0.1, faulting module inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 6e 73 ure ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 69 6e 73 74 33 in inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612
0050: 0d 0a ..

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/29/2012
Time: 2:49:06 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application Inst32.exe, version 1.0.0.1, faulting module Inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 49 6e 73 ure Ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 49 6e 73 74 33 in Inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1001
Date: 10/29/2012
Time: 2:30:25 PM
User: N/A
Computer: FRANCIE-PC
Description:
Fault bucket -1776435319.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 42 75 63 6b 65 74 3a 20 Bucket: 
0008: 2d 31 37 37 36 34 33 35 -1776435
0010: 33 31 39 0d 0a 319..

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1004
Date: 10/29/2012
Time: 2:26:08 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application Inst32.exe, version 1.0.0.1, faulting module Inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 49 6e 73 ure Ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 49 6e 73 74 33 in Inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/29/2012
Time: 2:25:07 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application Inst32.exe, version 1.0.0.1, faulting module Inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 49 6e 73 ure Ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 49 6e 73 74 33 in Inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/29/2012
Time: 1:16:38 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application Inst32.exe, version 1.0.0.1, faulting module Inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 49 6e 73 ure Ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 49 6e 73 74 33 in Inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1004
Date: 10/29/2012
Time: 1:10:37 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application Inst32.exe, version 1.0.0.1, faulting module Inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 49 6e 73 ure Ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 49 6e 73 74 33 in Inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/29/2012
Time: 12:02:30 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application Inst32.exe, version 1.0.0.1, faulting module Inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 49 6e 73 ure Ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 49 6e 73 74 33 in Inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1004
Date: 10/28/2012
Time: 9:38:37 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application Inst32.exe, version 1.0.0.1, faulting module Inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 49 6e 73 ure Ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 49 6e 73 74 33 in Inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/28/2012
Time: 3:55:26 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application Inst32.exe, version 1.0.0.1, faulting module Inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 49 6e 73 ure Ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 49 6e 73 74 33 in Inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1004
Date: 10/28/2012
Time: 10:49:18 AM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application Inst32.exe, version 1.0.0.1, faulting module Inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 49 6e 73 ure Ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 49 6e 73 74 33 in Inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/28/2012
Time: 10:31:17 AM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application Inst32.exe, version 1.0.0.1, faulting module Inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 49 6e 73 ure Ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 49 6e 73 74 33 in Inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1001
Date: 10/27/2012
Time: 11:56:33 PM
User: N/A
Computer: FRANCIE-PC
Description:
Fault bucket -1776435319.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 42 75 63 6b 65 74 3a 20 Bucket: 
0008: 2d 31 37 37 36 34 33 35 -1776435
0010: 33 31 39 0d 0a 319..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/27/2012
Time: 11:55:23 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application inst32.exe, version 1.0.0.1, faulting module inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 6e 73 ure ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 69 6e 73 74 33 in inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612
0050: 0d 0a ..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/27/2012
Time: 11:34:58 PM
User: N/A
Computer: FRANCIE-PC
Description:
Faulting application inst32.exe, version 1.0.0.1, faulting module inst32.exe, version 1.0.0.1, fault address 0x00001612.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 6e 73 ure ins
0018: 74 33 32 2e 65 78 65 20 t32.exe 
0020: 31 2e 30 2e 30 2e 31 20 1.0.0.1 
0028: 69 6e 20 69 6e 73 74 33 in inst3
0030: 32 2e 65 78 65 20 31 2e 2.exe 1.
0038: 30 2e 30 2e 31 20 61 74 0.0.1 at
0040: 20 6f 66 66 73 65 74 20 offset 
0048: 30 30 30 30 31 36 31 32 00001612
0050: 0d 0a .. 
--------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------

SYSTEM:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 10/29/2012
Time: 12:02:25 PM
User: N/A
Computer: FRANCIE-PC
Description:
The PfModNT service failed to start due to the following error: 
The system cannot find the file specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/29/2012
Time: 2:39:00 AM
User: NT AUTHORITY\SYSTEM
Computer: FRANCIE-PC
Description:
DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service gupdate with arguments "/comsvc" in order to run the server:
{4EB61BAC-A3B6-4760-9581-655041EF4D69}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 3:03:57 PM
User: FRANCIE-PC\Francie
Computer: FRANCIE-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service CarboniteService with arguments "" in order to run the server:
{36471C67-6A93-4434-92CC-4C614CD06666}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 3:03:57 PM
User: FRANCIE-PC\Francie
Computer: FRANCIE-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service CarboniteService with arguments "" in order to run the server:
{36471C67-6A93-4434-92CC-4C614CD06666}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 3:03:57 PM
User: FRANCIE-PC\Francie
Computer: FRANCIE-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service CarboniteService with arguments "" in order to run the server:
{36471C67-6A93-4434-92CC-4C614CD06666}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 3:03:57 PM
User: FRANCIE-PC\Francie
Computer: FRANCIE-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service CarboniteService with arguments "" in order to run the server:
{36471C67-6A93-4434-92CC-4C614CD06666}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 3:03:57 PM
User: FRANCIE-PC\Francie
Computer: FRANCIE-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service CarboniteService with arguments "" in order to run the server:
{36471C67-6A93-4434-92CC-4C614CD06666}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 3:03:57 PM
User: FRANCIE-PC\Francie
Computer: FRANCIE-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service CarboniteService with arguments "" in order to run the server:
{36471C67-6A93-4434-92CC-4C614CD06666}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

****THERE ARE 50 instances exactly like this one (incl. same date and time):
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 3:03:45 PM
User: FRANCIE-PC\Francie
Computer: FRANCIE-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service CarboniteService with arguments "" in order to run the server:
{36471C67-6A93-4434-92CC-4C614CD06666}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

****THERE ARE 30 instances exactly like this one (incl. same date and time):
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 3:03:44 PM
User: FRANCIE-PC\Francie
Computer: FRANCIE-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service CarboniteService with arguments "" in order to run the server:
{36471C67-6A93-4434-92CC-4C614CD06666}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 10/28/2012
Time: 10:56:22 AM
User: N/A
Computer: FRANCIE-PC
Description:
The following boot-start or system-start driver(s) failed to load: 
Fips
MpFilter
pavboot
Processor
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 10:55:38 AM
User: NT AUTHORITY\SYSTEM
Computer: FRANCIE-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

****THERE ARE 18 instances exactly like this one (incl. same date and time):

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 10:55:32 AM
User: FRANCIE-PC\Francie
Computer: FRANCIE-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service CarboniteService with arguments "" in order to run the server:
{36471C67-6A93-4434-92CC-4C614CD06666}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
****THERE ARE 18 instances exactly like this one (incl. same date and time):
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 10:55:31 AM
User: FRANCIE-PC\Francie
Computer: FRANCIE-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service CarboniteService with arguments "" in order to run the server:
{36471C67-6A93-4434-92CC-4C614CD06666}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

****THERE ARE 96 instances exactly like this one (incl. same date and time):
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 10:55:30 AM
User: FRANCIE-PC\Francie
Computer: FRANCIE-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service CarboniteService with arguments "" in order to run the server:
{36471C67-6A93-4434-92CC-4C614CD06666}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 10:55:29 AM
User: FRANCIE-PC\Francie
Computer: FRANCIE-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service CarboniteService with arguments "" in order to run the server:
{36471C67-6A93-4434-92CC-4C614CD06666}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 10:55:30 AM
User: FRANCIE-PC\Francie
Computer: FRANCIE-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service CarboniteService with arguments "" in order to run the server:
{36471C67-6A93-4434-92CC-4C614CD06666}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Lost count on this one, but it was at least 195 occurrences:
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 10:55:29 AM
User: FRANCIE-PC\Francie
Computer: FRANCIE-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service CarboniteService with arguments "" in order to run the server:
{36471C67-6A93-4434-92CC-4C614CD06666}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 10:55:28 AM
User: FRANCIE-PC\Francie
Computer: FRANCIE-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service CarboniteService with arguments "" in order to run the server:
{36471C67-6A93-4434-92CC-4C614CD06666}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

****THERE ARE 18 instances exactly like this one (incl. same date and time):
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 10:55:28 AM
User: FRANCIE-PC\Francie
Computer: FRANCIE-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service CarboniteService with arguments "" in order to run the server:
{36471C67-6A93-4434-92CC-4C614CD06666}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
****THERE ARE 12 instances exactly like this one (incl. same date and time):
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 10:55:27 AM
User: FRANCIE-PC\Francie
Computer: FRANCIE-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service CarboniteService with arguments "" in order to run the server:
{36471C67-6A93-4434-92CC-4C614CD06666}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 10:39:00 AM
User: NT AUTHORITY\SYSTEM
Computer: FRANCIE-PC
Description:
DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service gupdate with arguments "/comsvc" in order to run the server:
{4EB61BAC-A3B6-4760-9581-655041EF4D69}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 10/28/2012
Time: 10:31:08 AM
User: N/A
Computer: FRANCIE-PC
Description:
The PfModNT service failed to start due to the following error: 
The system cannot find the file specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 10/28/2012
Time: 10:31:08 AM
User: N/A
Computer: FRANCIE-PC
Description:
The PfModNT service failed to start due to the following error: 
The system cannot find the file specified. 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/28/2012
Time: 12:39:00 AM
User: NT AUTHORITY\SYSTEM
Computer: FRANCIE-PC
Description:
DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service gupdate with arguments "/comsvc" in order to run the server:
{4EB61BAC-A3B6-4760-9581-655041EF4D69}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/27/2012
Time: 7:39:00 PM
User: NT AUTHORITY\SYSTEM
Computer: FRANCIE-PC
Description:
DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service gupdate with arguments "/comsvc" in order to run the server:
{4EB61BAC-A3B6-4760-9581-655041EF4D69}
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## Cookiegal (Aug 27, 2003)

How are you trying to reinstall BSecure? Do you have the installation CD?


----------



## shadowbird (Oct 9, 2012)

I reinstalled it from the exe file already on my desktop from the last time I installed it. I don't think there is a CD for it.


----------



## Cookiegal (Aug 27, 2003)

It may be corrupt. Where did you get it from? I don't believe that program is free. Did you purchase it from their web site?


----------



## shadowbird (Oct 9, 2012)

Yes, it was purchased.


----------



## shadowbird (Oct 9, 2012)

I just uninstalled it and deleted the .exe file from my desktop, then went online to start fresh. It would not download. So I went to safemode, in case there's a virus or something preventing it from installing. It went a little farther, at least downloading the .exe file this time, but it would not install.

I'm attaching a graphic of the first error message, when it was NOT in safe mode.

When it was in safe mode, it downloaded the exe file to my desktop. Then instead of installing, it gave me the same error message we have been receiving, the inst32.exe 7zipsfx message.


----------



## Cookiegal (Aug 27, 2003)

What browser are you using for the download?

Is it a zipped file that you have to extract to get the .exe file?


----------



## shadowbird (Oct 9, 2012)

I'm using IE. It's a download link from BSecure's web site. I download it to the desktop, then either "run" or open the Cloudcare.exe file on my desktop.


----------



## shadowbird (Oct 9, 2012)

When it's installing, that's when it creates that temp\7zipsfx\inst32.exe I watched it once - I deleted that file and tested it to see if the error would come up when I rebooted. Then I restored the file just in case it was needed, but when I reinstalled it again, it created a second copy of the same file.

When this program is completely uninstalled, there is no error message. It always worked before Combofix.


----------



## Cookiegal (Aug 27, 2003)

Try disabling all of your security programs before running the installation and see if it will complete.


----------



## shadowbird (Oct 9, 2012)

Okay, I turned off windows firewall and disabled the real time protection, and it didn't make a difference. When it's installing, it indicates what part is being installed. It says "updating registry" then "Installing Components," then when it gets to "installing filters" is when it throws the error message.


----------



## shadowbird (Oct 9, 2012)

I appreciate all your help. Thanks for continuing to work with me!


----------



## Cookiegal (Aug 27, 2003)

Go to *Start *- *Run *and copy and paste the following then click OK:

*regedit /e C:\look.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg"*

You won't see anything happen and it will only take a second. You will find the report it creates at C:\look.txt. Please open it in Notepad and then copy and paste the report here.


----------



## shadowbird (Oct 9, 2012)

Thank you...

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"=""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe ARM]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="AdobeARM"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe Reader Speed Launcher]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Reader_sl"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Reader_sl.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ATICustomerCare]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ATICustomerCare"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\ATI\\ATICustomerCare\\ATICustomerCare.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\CloudCare]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="BsecTray"
"hkey"="HKLM"
"command"="C:\\Program Files\\Bsecure\\BsecTray.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DriverMax]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="DriverMax"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Innovative Solutions\\DriverMax\\devices.exe\" -agent"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DWQueuedReporting]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="dwtrig20"
"hkey"="HKLM"
"command"="\"c:\\PROGRA~1\\COMMON~1\\MICROS~1\\DW\\dwtrig20.exe\" -t"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Google Update]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="GoogleUpdate"
"hkey"="HKCU"
"command"="\"C:\\Documents and Settings\\Francie\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe\" /c"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\HDAudDeck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="HDeck"
"hkey"="HKLM"
"command"="C:\\Program Files\\VIA\\VIAudioi\\HDADeck\\HDeck.exe 1"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\HP Software Update]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="HPWuSchd2"
"hkey"="HKLM"
"command"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Intuit SyncManager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="IntuitSyncManager"
"hkey"="HKLM"
"command"="C:\\Program Files\\Common Files\\Intuit\\Sync\\IntuitSyncManager.exe startup"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\KernelFaultCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="dumprep 0 -k"
"hkey"="HKLM"
"command"="%systemroot%\\system32\\dumprep 0 -k"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NvCplDaemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvCpl"
"hkey"="HKLM"
"command"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NvMediaCenter]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvMcTray"
"hkey"="HKLM"
"command"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\nwiz]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="nwiz"
"hkey"="HKLM"
"command"="C:\\Program Files\\NVIDIA Corporation\\nView\\nwiz.exe /installquiet"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickFinder Scheduler]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="QFSCHD140"
"hkey"="HKLM"
"command"="\"c:\\Program Files\\Corel\\WordPerfect Office X4\\Programs\\QFSCHD140.EXE\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SlimDrivers]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SlimDrivers"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\SlimDrivers\\SlimDrivers.exe\" -boot"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\StartCCC]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="CLIStart"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\Core-Static\\CLIStart.exe\" MSRun"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Java\\Java Update\\jusched.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="realsched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Real\\RealPlayer\\update\\realsched.exe\" -osboot"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\UnlockerAssistant]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="UnlockerAssistant"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Unlocker\\UnlockerAssistant.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\VueMinder]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="VueMinder"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\VueSoft\\VueMinder\\VueMinder.exe\" 1"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\zBrowser Launcher]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTouch"
"hkey"="HKLM"
"command"="C:\\Program Files\\Logitech\\iTouch\\iTouch.exe"
"inimapping"="0"


----------



## Cookiegal (Aug 27, 2003)

Please go to *Start *- *Run *- type in msconfig - click OK and click on the Startup tap. Scroll down to the following entry:

*BsecTray*

and place a tick mark beside it then click "Apply" and OK.

Then reboot the machine and see if the installation will complete please.


----------



## shadowbird (Oct 9, 2012)

The error message still comes up right when my PC restarts, and it still comes up when I try to install the BSecure program. I checked startup again. It's still ticked on the BsecTray.


----------



## Cookiegal (Aug 27, 2003)

Please run DDS again and post the log.


----------



## shadowbird (Oct 9, 2012)

DDS (Ver_2012-10-19.01) - NTFS_x86 
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_30
Run by Francie at 16:04:35 on 2012-10-31
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2177 [GMT -4:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: ESET NOD32 Antivirus 5.2 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
============== Running Processes ================
.
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\KaraokeSer.exe
C:\WINDOWS\system32\NLSSRV32.EXE
C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\WINDOWS\system32\HPZipm12.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\msdtc.exe
C:\Documents and Settings\Francie\Local Settings\Temporary Internet Files\Content.IE5\9K0CIH7C\Defogger[2].exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://forums.techguy.org/virus-other-malware-removal/1072157-blue-screen-after-root-kit-7.html
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSCONFIG.EXE /auto
mRun: [Carbonite Backup] c:\program files\carbonite\carbonite backup\CarboniteUI.exe
mRun: [KernelFaultCheck] c:\windows\system32\dumprep 0 -k
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [CloudCare] c:\program files\bsecure\BsecTray.exe
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:323
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
IE: Copy to &Lightning Note - c:\program files\corel\wordperfect lightning\programs\WPLightningCopyToNote.hta
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: Open with WordPerfect - c:\program files\corel\wordperfect office x4\programs\WPLauncher.hta
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
LSP: %ProgramFiles%\Bsecure\InetCtrl57.dll
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlcdnet.asus.com/pub/ASUS/misc/dlm-activex-2.2.5.0.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1294720102421
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 65.32.5.111 65.32.5.112
TCP: Interfaces\{1AD616B8-0534-4FB2-85E2-82645C155B2F} : DHCPNameServer = 65.32.5.111 65.32.5.112
Handler: g7ps - {9EACF0FB-4FC7-436E-989B-3197142AD979} - c:\program files\common files\g7ps\shared files\g7psdll\G7PS.dll
Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - c:\program files\intuit\quickbooks 2010\HelpAsyncPluggableProtocol.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - 
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\francie\application data\mozilla\firefox\profiles\tohrezx2.default\
FF - prefs.js: browser.search.defaulturl - 
FF - prefs.js: browser.search.selectedEngine - 
FF - prefs.js: browser.startup.homepage - 
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z149&form=ZGAADF&install_date=20110829&q=
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\documents and settings\francie\local settings\application data\google\update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\browser\nppdf32(2).dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPcol400.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\nos\bin\np_gp.dll
FF - ExtSQL: 2012-09-14 16:45; [email protected]; c:\documents and settings\francie\application data\mozilla\firefox\profiles\tohrezx2.default\extensions\[email protected]
FF - ExtSQL: !HIDDEN! 2010-01-17 08:54; [email protected]; c:\documents and settings\francie\application data\mozilla\firefox\profiles\tohrezx2.default\extensions\[email protected]
.
---- FIREFOX POLICIES ----
FF - user.js: extentions.y2layers.installId - 0cb749d1-f74c-4bd5-9adf-4877091b9912
FF - user.js: extentions.y2layers.defaultEnableAppsList - Buzzdock,Buzzdock,
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: security.csp.enable - false
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2012-8-30 193552]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2012-10-28 28552]
R1 MpKsl142df3aa;MpKsl142df3aa;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{1b4010e4-b309-4b6d-b323-09587f4043c4}\MpKsl142df3aa.sys [2012-10-31 29904]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2012-6-28 101112]
R2 KaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\KaraokeSer.exe [2012-8-26 88688]
R2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\system32\NLSSRV32.EXE [2012-4-12 69640]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia update core\daemonu.exe [2012-8-26 1262400]
R3 appliandMP;appliandMP;c:\windows\system32\drivers\appliand.sys [2011-9-5 28256]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [2012-10-25 103040]
R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [2012-8-26 43392]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2012-8-26 2551664]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 appliand;Applian Network Service;c:\windows\system32\drivers\appliand.sys [2011-9-5 28256]
S3 BSecACFltr;BSecACFltr;c:\windows\system32\drivers\BSecACFltr.sys [2012-10-31 21624]
S3 hcw72ADFilter;WinTV HVR-950 USB Audio Filter Driver;c:\windows\system32\drivers\hcw72ADFilter.sys [2011-5-17 28928]
S3 hcw72ATV;WinTV HVR-950 NTSC;c:\windows\system32\drivers\hcw72ATV.sys [2011-5-17 1217920]
S3 hcw72DTV;WinTV HVR-950 ATSC/QAM;c:\windows\system32\drivers\hcw72DTV.sys [2011-5-17 1220224]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-10-26 22856]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\system32\svchost.exe -k nosGetPlusHelper [2004-8-4 14336]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-6 34064]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 Bsecure;CloudCare;c:\program files\bsecure\InetCtrl.exe [2012-10-30 66344]
S4 BsecureAV;CloudCare AntiVirus;c:\program files\bsecure\BsecAV.exe [2012-10-30 161776]
S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-2-12 136176]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-2-12 136176]
S4 HauppaugeTVServer;HauppaugeTVServer;c:\progra~1\wintv\tvserver\HAUPPA~1.EXE [2011-9-15 558592]
S4 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-10-26 399432]
S4 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-10-26 676936]
.
=============== File Associations ===============
.
ShellExec: Corel Visual Intelligence.exe: Open="c:\program files\corel\visual intelligence\launch.exe" "%1"
ShellExec: doxillion.exe: Convert with Doxillion="c:\program files\nch software\doxillion\doxillion" "%L"
ShellExec: LightningViewer.exe: View="c:\program files\corel\wordperfect lightning\programs\LightningNavigator.exe" "-ViewDocument" "%1"
.
=============== Created Last 30 ================
.
2012-10-31 19:23:11 -------- d-----w- c:\program files\common files\Windows Microsoft Shared
2012-10-31 19:23:10 21624 ----a-w- c:\windows\system32\drivers\BSecACFltr.sys
2012-10-31 19:21:17 29904 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{1b4010e4-b309-4b6d-b323-09587f4043c4}\MpKsl142df3aa.sys
2012-10-31 16:42:32 6918632 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{1b4010e4-b309-4b6d-b323-09587f4043c4}\mpengine.dll
2012-10-31 05:18:58 6918632 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2012-10-30 15:41:57 49088 ----a-w- c:\windows\system32\drivers\BsecFltr.sys
2012-10-30 15:41:57 -------- d-----w- c:\program files\Bsecure
2012-10-28 04:27:11 28552 ----a-w- c:\windows\system32\drivers\pavboot.sys
2012-10-28 04:26:57 -------- d-----w- c:\program files\Panda Security
2012-10-27 02:09:17 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-10-26 00:01:27 103040 ----a-w- c:\windows\system32\drivers\AtihdXP3.sys
2012-10-22 03:16:09 -------- d-----w- C:\_OTS
2012-10-20 23:04:58 -------- d-----w- c:\program files\Microsoft Security Client
2012-10-20 22:18:05 -------- d-----w- C:\2736581aa66bb721b11a9a4ffcf53e12
2012-10-20 19:37:16 -------- d-----w- c:\program files\Carbonite
2012-10-20 19:37:16 -------- d-----w- c:\documents and settings\all users\application data\Carbonite
2012-10-20 04:31:40 -------- d-s---w- C:\ComboFix
2012-10-20 04:27:10 118784 ----a-w- c:\windows\system32\msstdfmt.dll
2012-10-20 04:27:09 294912 -c--a-w- c:\windows\system32\dllcache\dlimport.exe
2012-10-20 02:01:54 -------- d-----w- c:\program files\ESET
2012-10-16 02:25:14 -------- d-sha-r- C:\cmdcons
2012-10-16 02:23:26 98816 ----a-w- c:\windows\sed.exe
2012-10-16 02:23:26 256000 ----a-w- c:\windows\PEV.exe
2012-10-16 02:23:26 208896 ----a-w- c:\windows\MBR.exe
2012-10-16 02:19:40 -------- d-----w- c:\documents and settings\francie\local settings\application data\Avg2013
2012-10-09 18:48:13 -------- d--h--w- c:\windows\system32\GroupPolicy
2012-10-09 18:46:44 -------- d-----w- c:\documents and settings\francie\local settings\application data\Downloaded Installations
2012-10-02 17:47:25 205072 ----a-w- c:\windows\system32\drivers\tmcomm.sys
.
==================== Find3M ====================
.
2012-10-30 18:26:30 1682 --sha-w- c:\documents and settings\all users\application data\KGyGaAvL.sys
2012-08-31 02:03:50 193552 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2012-08-28 15:14:53 916992 ----a-w- c:\windows\system32\wininet.dll
2012-08-28 15:14:53 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-08-28 15:14:52 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07:15 385024 ----a-w- c:\windows\system32\html.iec
2012-08-26 19:02:31 1074636 ----a-w- c:\windows\system32\nvdrsdb0.bin
2012-08-26 19:02:31 1 ----a-w- c:\windows\system32\nvdrssel.bin
2012-08-26 19:02:28 1074636 ----a-w- c:\windows\system32\nvdrsdb1.bin
2012-08-24 13:53:22 177664 ----a-w- c:\windows\system32\wintrust.dll
2012-08-21 13:33:26 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58:09 2027520 ----a-w- c:\windows\system32\ntkrnlpa.exe
.
============= FINISH: 16:05:24.12 ===============


----------



## shadowbird (Oct 9, 2012)

I didn't remember DDS and could not find it on my desktop, so I found it on bleepingcomputer. I don't recall doing the "defogger" before, but I followed bleepings instructions and used defogger.


----------



## Cookiegal (Aug 27, 2003)

What is telling you that BSecure is not working? Because I see a lot of processes running and the driver is installed.


----------



## Cookiegal (Aug 27, 2003)

You also need to uninstall Nod32 as you already have MSE and that can cause conflicts.


----------



## shadowbird (Oct 9, 2012)

Cookiegal said:


> What is telling you that BSecure is not working? Because I see a lot of processes running and the driver is installed.


I can get into the console to see or adjust the settings, but it's not blocking any web sites or timeframes, which is the primary purpose of the program. I found this web page, but i don't know if it will help. It indicates McAfee is the cause of this error message, "whether or not it's running." I opened BSecure and see that McAfee is the virus protection they use in this BSecure program.

I don't know if stopping the script will make the program work again, though, or if it just stops an error message.

http://www.symantec.com/connect/forums/intermittent-failure-vbscript-returns-1073741819-w2k8-r2


----------



## shadowbird (Oct 9, 2012)

As for the NOD32, that's Eset, and I uninstalled it, but one of the programs you had me run said to stop all antivirus programs, so I did. But it kept saying it NOD32 was still installed after I uninstalled it. It wasn't showing up in add/remove programs anymore. But I just went to Eset's website, and it says to delete two folders after uninstalling, so I just did that. Hopefully that's it.



Cookiegal said:


> What is telling you that BSecure is not working? Because I see a lot of processes running and the driver is installed.


Maybe blocking the disable the SCRIPTSN.dll as indicated in that web page (in the message just prior to this) will enable it to reinstall all the way? If so, then I suspect the features will work again. I didn't want to do that without asking you about it.


----------



## shadowbird (Oct 9, 2012)

FYI: Since I deleted those folders for Eset, I disabled MSE and windows firewall and tried to reinstall the program again and it still gave me the error message and would not complete the installation.


----------



## shadowbird (Oct 9, 2012)

If Eset was actually still running during Combofix, could that have caused the error messages?


----------



## Cookiegal (Aug 27, 2003)

If you run DDS again we will see if Nod32 is still showing at the top. If it is, it's likely it's just a leftover in the WBEM that we can remove.

I don't know what to tell you about BSecure. I imagine the errors incurred the first time around were because the exe file on your desktop was too old. I read that they are time stamped and can't be used more than 7 days after the download. But then you downloaded a new one and still had problems. I think you may have to contact them for assistance with reinstalling it unfortunately.

Is that the only problem that remains?


----------



## shadowbird (Oct 9, 2012)

DDS (Ver_2012-10-19.01) - NTFS_x86 
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_30
Run by Francie at 12:55:19 on 2012-11-01
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2483 [GMT -4:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: ESET NOD32 Antivirus 5.2 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
============== Running Processes ================
.
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bsecure\InetCtrl.exe
C:\Program Files\Bsecure\BsecAV.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\KaraokeSer.exe
C:\WINDOWS\system32\NLSSRV32.EXE
C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\WINDOWS\system32\HPZipm12.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Bsecure\BSecAMX.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Bsecure\BsecTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\NCH Swift Sound\Scribe\scribe.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\msdtc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://forums.techguy.org/virus-other-malware-removal/1072157-blue-screen-after-root-kit-7.html
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSCONFIG.EXE /auto
mRun: [Carbonite Backup] c:\program files\carbonite\carbonite backup\CarboniteUI.exe
mRun: [KernelFaultCheck] c:\windows\system32\dumprep 0 -k
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [CloudCare] c:\program files\bsecure\BsecTray.exe
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:323
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
IE: Copy to &Lightning Note - c:\program files\corel\wordperfect lightning\programs\WPLightningCopyToNote.hta
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: Open with WordPerfect - c:\program files\corel\wordperfect office x4\programs\WPLauncher.hta
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
LSP: %ProgramFiles%\Bsecure\InetCtrl57.dll
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlcdnet.asus.com/pub/ASUS/misc/dlm-activex-2.2.5.0.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1294720102421
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 65.32.5.111 65.32.5.112
TCP: Interfaces\{1AD616B8-0534-4FB2-85E2-82645C155B2F} : DHCPNameServer = 65.32.5.111 65.32.5.112
Handler: g7ps - {9EACF0FB-4FC7-436E-989B-3197142AD979} - c:\program files\common files\g7ps\shared files\g7psdll\G7PS.dll
Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - c:\program files\intuit\quickbooks 2010\HelpAsyncPluggableProtocol.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - 
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\francie\application data\mozilla\firefox\profiles\tohrezx2.default\
FF - prefs.js: browser.search.defaulturl - 
FF - prefs.js: browser.search.selectedEngine - 
FF - prefs.js: browser.startup.homepage - 
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z149&form=ZGAADF&install_date=20110829&q=
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\documents and settings\francie\local settings\application data\google\update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\browser\nppdf32(2).dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPcol400.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\nos\bin\np_gp.dll
FF - ExtSQL: 2012-09-14 16:45; [email protected]; c:\documents and settings\francie\application data\mozilla\firefox\profiles\tohrezx2.default\extensions\[email protected]
FF - ExtSQL: !HIDDEN! 2010-01-17 08:54; [email protected]; c:\documents and settings\francie\application data\mozilla\firefox\profiles\tohrezx2.default\extensions\[email protected]
.
---- FIREFOX POLICIES ----
FF - user.js: extentions.y2layers.installId - 0cb749d1-f74c-4bd5-9adf-4877091b9912
FF - user.js: extentions.y2layers.defaultEnableAppsList - Buzzdock,Buzzdock,
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: security.csp.enable - false
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2012-8-30 193552]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2012-10-28 28552]
R1 MpKsl4ed77d50;MpKsl4ed77d50;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{56511086-9a1d-4ccc-946f-5b64b0e009d4}\MpKsl4ed77d50.sys [2012-11-1 29904]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2012-6-28 101112]
R2 KaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\KaraokeSer.exe [2012-8-26 88688]
R2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\system32\NLSSRV32.EXE [2012-4-12 69640]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia update core\daemonu.exe [2012-8-26 1262400]
R3 appliandMP;appliandMP;c:\windows\system32\drivers\appliand.sys [2011-9-5 28256]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [2012-10-25 103040]
R3 BSecACFltr;BSecACFltr;c:\windows\system32\drivers\BSecACFltr.sys [2012-10-31 21624]
R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [2012-8-26 43392]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2012-8-26 2551664]
R4 Bsecure;CloudCare;c:\program files\bsecure\InetCtrl.exe [2012-10-30 66344]
R4 BsecureAV;CloudCare AntiVirus;c:\program files\bsecure\BsecAV.exe [2012-10-30 161776]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 appliand;Applian Network Service;c:\windows\system32\drivers\appliand.sys [2011-9-5 28256]
S3 hcw72ADFilter;WinTV HVR-950 USB Audio Filter Driver;c:\windows\system32\drivers\hcw72ADFilter.sys [2011-5-17 28928]
S3 hcw72ATV;WinTV HVR-950 NTSC;c:\windows\system32\drivers\hcw72ATV.sys [2011-5-17 1217920]
S3 hcw72DTV;WinTV HVR-950 ATSC/QAM;c:\windows\system32\drivers\hcw72DTV.sys [2011-5-17 1220224]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-10-26 22856]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\system32\svchost.exe -k nosGetPlusHelper [2004-8-4 14336]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-6 34064]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-2-12 136176]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-2-12 136176]
S4 HauppaugeTVServer;HauppaugeTVServer;c:\progra~1\wintv\tvserver\HAUPPA~1.EXE [2011-9-15 558592]
S4 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-10-26 399432]
S4 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-10-26 676936]
.
=============== File Associations ===============
.
ShellExec: Corel Visual Intelligence.exe: Open="c:\program files\corel\visual intelligence\launch.exe" "%1"
ShellExec: doxillion.exe: Convert with Doxillion="c:\program files\nch software\doxillion\doxillion" "%L"
ShellExec: LightningViewer.exe: View="c:\program files\corel\wordperfect lightning\programs\LightningNavigator.exe" "-ViewDocument" "%1"
.
=============== Created Last 30 ================
.
2012-11-01 16:54:16 -------- d--h--w- c:\windows\PIF
2012-11-01 16:07:00 29904 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{56511086-9a1d-4ccc-946f-5b64b0e009d4}\MpKsl4ed77d50.sys
2012-11-01 00:28:14 6918632 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{56511086-9a1d-4ccc-946f-5b64b0e009d4}\mpengine.dll
2012-11-01 00:27:38 -------- d-----w- c:\program files\common files\Windows Microsoft Shared
2012-10-31 19:23:10 21624 ----a-w- c:\windows\system32\drivers\BSecACFltr.sys
2012-10-31 05:18:58 6918632 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2012-10-30 15:41:57 49088 ----a-w- c:\windows\system32\drivers\BsecFltr.sys
2012-10-30 15:41:57 -------- d-----w- c:\program files\Bsecure
2012-10-28 04:27:11 28552 ----a-w- c:\windows\system32\drivers\pavboot.sys
2012-10-28 04:26:57 -------- d-----w- c:\program files\Panda Security
2012-10-27 02:09:17 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-10-26 00:01:27 103040 ----a-w- c:\windows\system32\drivers\AtihdXP3.sys
2012-10-22 03:16:09 -------- d-----w- C:\_OTS
2012-10-20 23:04:58 -------- d-----w- c:\program files\Microsoft Security Client
2012-10-20 22:18:05 -------- d-----w- C:\2736581aa66bb721b11a9a4ffcf53e12
2012-10-20 19:37:16 -------- d-----w- c:\program files\Carbonite
2012-10-20 19:37:16 -------- d-----w- c:\documents and settings\all users\application data\Carbonite
2012-10-20 04:31:40 -------- d-s---w- C:\ComboFix
2012-10-20 04:27:10 118784 ----a-w- c:\windows\system32\msstdfmt.dll
2012-10-20 04:27:09 294912 -c--a-w- c:\windows\system32\dllcache\dlimport.exe
2012-10-16 02:25:14 -------- d-sha-r- C:\cmdcons
2012-10-16 02:23:26 98816 ----a-w- c:\windows\sed.exe
2012-10-16 02:23:26 256000 ----a-w- c:\windows\PEV.exe
2012-10-16 02:23:26 208896 ----a-w- c:\windows\MBR.exe
2012-10-16 02:19:40 -------- d-----w- c:\documents and settings\francie\local settings\application data\Avg2013
2012-10-09 18:48:13 -------- d--h--w- c:\windows\system32\GroupPolicy
2012-10-09 18:46:44 -------- d-----w- c:\documents and settings\francie\local settings\application data\Downloaded Installations
2012-10-02 17:47:25 205072 ----a-w- c:\windows\system32\drivers\tmcomm.sys
.
==================== Find3M ====================
.
2012-10-30 18:26:30 1682 --sha-w- c:\documents and settings\all users\application data\KGyGaAvL.sys
2012-08-31 02:03:50 193552 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2012-08-28 15:14:53 916992 ----a-w- c:\windows\system32\wininet.dll
2012-08-28 15:14:53 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-08-28 15:14:52 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07:15 385024 ----a-w- c:\windows\system32\html.iec
2012-08-26 19:02:31 1074636 ----a-w- c:\windows\system32\nvdrsdb0.bin
2012-08-26 19:02:31 1 ----a-w- c:\windows\system32\nvdrssel.bin
2012-08-26 19:02:28 1074636 ----a-w- c:\windows\system32\nvdrsdb1.bin
2012-08-24 13:53:22 177664 ----a-w- c:\windows\system32\wintrust.dll
2012-08-21 13:33:26 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58:09 2027520 ----a-w- c:\windows\system32\ntkrnlpa.exe
.
============= FINISH: 12:55:57.87 ===============


----------



## shadowbird (Oct 9, 2012)

I did contact them and didn't hear back, then I learned they were sold to AVG, then their customer service went downhill. I'll try to get a refund and use some other program. Did anything from that web page I sent sound like it might help?

Finally, I still need to reinstall my graphics card which is what I was using when all this started. I'll put it in today and see if it works okay.


----------



## Cookiegal (Aug 27, 2003)

I don't know about the SCRIPTSN.dll file. What is posted there pertains to a Windows server running McAfee. Even though BSecure uses McAfee, it may not be set up the same way. We can check to see if that file exists though.

Please run SystemLook again with the following script:


```
:filefind
SCRIPTSN.dll
```
Also, please drag ComboFix to the Recycle Bin and grab the latest version then run a new scan and post the new log.

Please visit *Combofix Guide & Instructions * for instructions for installing the Recovery Console and downloading and running ComboFix.

The only thing different from the instructions there is that when downloading and saving the ComboFix.exe I would like you to rename it to puppy.exe please.

Please go ahead and install the graphics card as well.


----------



## shadowbird (Oct 9, 2012)

System Look did not find it. I have to do some work on my PC then will run a new Combofix and install the graphics card.


----------



## Cookiegal (Aug 27, 2003)

OK, thanks.


----------



## shadowbird (Oct 9, 2012)

My graphics card is apparently fried. No response at all. I'm off to vote, and later today do the Combofix.


----------



## shadowbird (Oct 9, 2012)

When I walked away and returned, it had shut down the PC and then completed. It did say again that NOD32 was running.

ComboFix 12-11-08.01 - Francie 11/08/2012 21:48:00.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2409 [GMT -5:00]
Running from: c:\documents and settings\Francie\My Documents\Downloads\ComboFix.exe
AV: ESET NOD32 Antivirus 5.2 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\OLDB5.tmp
.
.
((((((((((((((((((((((((( Files Created from 2012-10-09 to 2012-11-09 )))))))))))))))))))))))))))))))
.
.
2012-11-08 19:14 . 2008-04-13 18:46	48128	-c--a-w-	c:\windows\system32\dllcache\61883.sys
2012-11-08 19:14 . 2001-08-17 19:55	38400	-c--a-w-	c:\windows\system32\dllcache\8514a.dll
2012-11-08 19:14 . 2008-04-13 18:40	12288	-c--a-w-	c:\windows\system32\dllcache\4mmdat.sys
2012-11-08 19:14 . 2001-08-17 19:55	689216	-c--a-w-	c:\windows\system32\dllcache\3dfxvs.dll
2012-11-08 19:14 . 2001-08-17 19:06	11264	-c--a-w-	c:\windows\system32\dllcache\1394vdbg.sys
2012-11-08 19:14 . 2001-08-17 18:28	762780	-c--a-w-	c:\windows\system32\dllcache\3cwmcru.sys
2012-11-08 19:14 . 2001-08-17 17:48	148352	-c--a-w-	c:\windows\system32\dllcache\3dfxvsm.sys
2012-11-08 19:14 . 2008-04-13 18:46	53376	-c--a-w-	c:\windows\system32\dllcache\1394bus.sys
2012-11-08 19:14 . 2001-08-17 19:56	66048	-c--a-w-	c:\windows\system32\dllcache\s3legacy.dll
2012-11-08 18:14 . 2012-11-09 02:29	--------	d-----w-	c:\documents and settings\Administrator.FRANCIE-PC
2012-11-08 17:19 . 2012-10-12 02:56	6918632	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4431CA82-3D29-4387-A936-07E57AAE69BA}\mpengine.dll
2012-11-07 16:40 . 2012-10-12 02:56	6918632	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-11-05 17:00 . 2012-11-05 17:00	--------	d-----w-	c:\program files\Common Files\Windows Microsoft Shared
2012-11-01 16:54 . 2012-11-01 16:54	--------	d--h--w-	c:\windows\PIF
2012-10-31 19:23 . 2010-02-05 17:40	21624	----a-w-	c:\windows\system32\drivers\BSecACFltr.sys
2012-10-31 16:31 . 2012-10-31 16:31	--------	d-----w-	c:\documents and settings\UpdatusUser\Local Settings\Application Data\Intuit
2012-10-30 15:41 . 2012-11-07 07:14	--------	d-----w-	c:\program files\Bsecure
2012-10-30 15:41 . 2010-04-26 19:23	49088	----a-w-	c:\windows\system32\drivers\BsecFltr.sys
2012-10-28 04:27 . 2009-06-30 14:37	28552	----a-w-	c:\windows\system32\drivers\pavboot.sys
2012-10-28 04:26 . 2012-10-28 04:26	--------	d-----w-	c:\program files\Panda Security
2012-10-27 02:09 . 2012-09-29 23:54	22856	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-10-26 00:15 . 2012-10-26 00:15	--------	d-----w-	c:\documents and settings\All Users\Application Data\ATI
2012-10-26 00:01 . 2012-05-14 06:12	103040	----a-w-	c:\windows\system32\drivers\AtihdXP3.sys
2012-10-22 03:16 . 2012-10-22 03:16	--------	d-----w-	C:\_OTS
2012-10-20 23:04 . 2012-10-21 04:58	--------	d-----w-	c:\program files\Microsoft Security Client
2012-10-20 22:18 . 2012-10-20 22:18	--------	d-----w-	C:\2736581aa66bb721b11a9a4ffcf53e12
2012-10-20 19:37 . 2012-10-20 19:37	--------	d-----w-	c:\program files\Carbonite
2012-10-20 19:37 . 2012-10-20 19:37	--------	d-----w-	c:\documents and settings\All Users\Application Data\Carbonite
2012-10-20 04:27 . 2012-10-20 04:27	118784	----a-w-	c:\windows\system32\msstdfmt.dll
2012-10-20 04:27 . 2012-10-20 04:27	294912	-c--a-w-	c:\windows\system32\dllcache\dlimport.exe
2012-10-16 02:19 . 2012-10-16 02:19	--------	d-----w-	c:\documents and settings\Francie\Local Settings\Application Data\Avg2013
2012-10-15 15:42 . 2012-10-15 15:42	--------	d-----w-	c:\documents and settings\Default User\Application Data\TuneUp Software
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-09 01:31 . 2011-02-04 06:10	1682	--sha-w-	c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2012-10-02 17:47 . 2012-10-02 17:47	205072	----a-w-	c:\windows\system32\drivers\tmcomm.sys
2012-08-31 02:03 . 2012-08-31 02:03	193552	----a-w-	c:\windows\system32\drivers\MpFilter.sys
2012-08-28 15:14 . 2004-08-04 12:00	916992	----a-w-	c:\windows\system32\wininet.dll
2012-08-28 15:14 . 2004-08-04 12:00	43520	----a-w-	c:\windows\system32\licmgr10.dll
2012-08-28 15:14 . 2004-08-04 12:00	1469440	----a-w-	c:\windows\system32\inetcpl.cpl
2012-08-28 12:07 . 2004-08-04 12:00	385024	----a-w-	c:\windows\system32\html.iec
2012-08-24 13:53 . 2004-08-04 12:00	177664	----a-w-	c:\windows\system32\wintrust.dll
2012-08-21 13:33 . 2004-08-04 12:00	2148864	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58 . 2004-08-03 22:59	2027520	----a-w-	c:\windows\system32\ntkrnlpa.exe
2012-06-14 22:20 . 2011-03-24 06:14	85472	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2012-09-14 01:14	1014856	----a-r-	c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2012-09-14 01:14	1014856	----a-r-	c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2012-09-14 01:14	1014856	----a-r-	c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-19 421888]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-05-15 15504192]
"NvMediaCenter"="NvMCTray.dll" [2012-05-15 108352]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2000-01-01 1634112]
"Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2012-09-14 1065032]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-07-04 98304]
"CloudCare"="c:\program files\Bsecure\BsecTray.exe" [2011-06-25 96040]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-02-04 273544]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\Guest.FRANCIE-PC\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoStart IR.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AutoStart IR.lnk
backup=c:\windows\pss\AutoStart IR.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Qchex Tray Icon.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Qchex Tray Icon.lnk
backup=c:\windows\pss\Qchex Tray Icon.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinTV Recording Status..lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinTV Recording Status..lnk
backup=c:\windows\pss\WinTV Recording Status..lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Francie^Start Menu^Programs^Startup^CNET TechTracker.lnk]
path=c:\documents and settings\Francie\Start Menu\Programs\Startup\CNET TechTracker.lnk
backup=c:\windows\pss\CNET TechTracker.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-07-27 20:51	919008	----a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2012-07-27 20:51	35768	----a-w-	c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICustomerCare]
2010-05-04 21:05	311296	----a-r-	c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriverMax]
2010-11-18 15:44	9221024	----a-w-	c:\program files\Innovative Solutions\DriverMax\devices.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
2007-02-26 06:01	437160	----a-w-	c:\progra~1\COMMON~1\MICROS~1\DW\DWTRIG20.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2011-07-28 20:59	136176	----atw-	c:\documents and settings\Francie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]
2000-01-01 00:00	41122448	----a-w-	c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2011-05-10 06:41	49208	----a-w-	c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Intuit SyncManager]
2010-10-19 10:58	1439496	----a-w-	c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-06-07 23:33	421776	----a-w-	c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2012-05-15 09:40	15504192	----a-w-	c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2012-05-15 09:40	108352	----a-w-	c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2000-01-01 00:00	1634112	----a-w-	c:\program files\NVIDIA Corporation\nView\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickFinder Scheduler]
2009-06-22 23:29	83232	----a-w-	c:\program files\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-19 02:16	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SlimDrivers]
2012-07-25 16:57	29357952	----a-w-	c:\program files\SlimDrivers\SlimDrivers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2012-07-04 03:48	98304	----a-w-	c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-06-09 17:06	254696	----a-w-	c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2011-02-04 16:06	273544	----a-w-	c:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
2010-07-04 19:51	17408	----a-w-	c:\program files\Unlocker\UnlockerAssistant.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VueMinder]
2012-02-11 14:25	7962624	----a-w-	c:\program files\VueSoft\VueMinder\VueMinder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
2004-03-18 13:33	892928	----a-w-	c:\program files\Logitech\iTouch\iTouch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"rpcapd"=3 (0x3)
"QBCFMonitorService"=2 (0x2)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
"Bonjour Service"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"MBAMScheduler"=2 (0x2)
"MBAMService"=2 (0x2)
"BsecureAV"=2 (0x2)
"Bsecure"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bsecure\\InetCtrl.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCPxpsp2res.dll,-22009
.
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [10/27/2012 11:27 PM 28552]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [6/28/2012 5:33 PM 101112]
R2 KaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\KaraokeSer.exe [8/26/2012 11:11 AM 88688]
R2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\system32\NLSSRV32.EXE [4/12/2012 4:27 AM 69640]
R3 appliandMP;appliandMP;c:\windows\system32\drivers\appliand.sys [9/5/2011 10:41 PM 28256]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [10/25/2012 7:01 PM 103040]
R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [8/26/2012 11:36 AM 43392]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [8/26/2012 11:11 AM 2551664]
S3 appliand;Applian Network Service;c:\windows\system32\drivers\appliand.sys [9/5/2011 10:41 PM 28256]
S3 BSecACFltr;BSecACFltr;c:\windows\system32\drivers\BSecACFltr.sys [10/31/2012 2:23 PM 21624]
S3 hcw72ADFilter;WinTV HVR-950 USB Audio Filter Driver;c:\windows\system32\drivers\hcw72ADFilter.sys [5/17/2011 9:43 AM 28928]
S3 hcw72ATV;WinTV HVR-950 NTSC;c:\windows\system32\drivers\hcw72ATV.sys [5/17/2011 9:43 AM 1217920]
S3 hcw72DTV;WinTV HVR-950 ATSC/QAM;c:\windows\system32\drivers\hcw72DTV.sys [5/17/2011 9:43 AM 1220224]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [10/26/2012 9:09 PM 22856]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [8/4/2004 7:00 AM 14336]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [11/6/2007 3:22 PM 34064]
S4 Bsecure;CloudCare;c:\program files\Bsecure\InetCtrl.exe [10/30/2012 10:41 AM 66344]
S4 BsecureAV;CloudCare AntiVirus;c:\program files\Bsecure\BsecAV.exe [10/30/2012 10:41 AM 161776]
S4 HauppaugeTVServer;HauppaugeTVServer;c:\progra~1\WinTV\TVServer\HAUPPA~1.EXE [9/15/2011 10:40 PM 558592]
S4 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [10/26/2012 9:09 PM 399432]
S4 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [10/26/2012 9:09 PM 676936]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - BsecureFilter
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper	REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-06 c:\windows\Tasks\debutShakeIcon.job
- c:\program files\NCH Software\Debut\debut.exe [2011-04-03 14:08]
.
2012-11-06 c:\windows\Tasks\doxillionShakeIcon.job
- c:\program files\NCH Software\Doxillion\doxillion.exe [2011-01-12 21:59]
.
2012-11-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-12 21:44]
.
2012-11-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-12 21:44]
.
2012-11-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-616249376-839522115-1003Core.job
- c:\documents and settings\Francie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-08-29 20:59]
.
2012-11-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-616249376-839522115-1003UA.job
- c:\documents and settings\Francie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-08-29 20:59]
.
2012-11-09 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-09-12 21:25]
.
2012-07-25 c:\windows\Tasks\photostageShakeIcon.job
- c:\program files\NCH Software\PhotoStage\photostage.exe [2012-07-15 06:07]
.
2012-11-06 c:\windows\Tasks\prismDowngrade.job
- c:\program files\NCH Software\Prism\prism.exe [2011-09-19 16:51]
.
2012-11-06 c:\windows\Tasks\prismShakeIcon.job
- c:\program files\NCH Software\Prism\prism.exe [2011-09-19 16:51]
.
2012-11-09 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-11-09 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-11-09 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-11-09 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-11-09 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-11-07 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-09-22 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-11-07 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-01-20 c:\windows\Tasks\scribeSevenDaysInit.job
- c:\program files\NCH Swift Sound\Scribe\scribe.exe [2011-01-20 02:58]
.
2012-11-06 c:\windows\Tasks\scribeShakeIcon.job
- c:\program files\NCH Swift Sound\Scribe\scribe.exe [2011-01-20 02:58]
.
2012-11-08 c:\windows\Tasks\User_Feed_Synchronization-{259297A0-4E67-4E79-897A-4C8098A85E45}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 09:31]
.
2012-06-14 c:\windows\Tasks\videopadDowngrade.job
- c:\program files\NCH Software\VideoPad\videopad.exe [2011-09-19 16:52]
.
2012-05-16 c:\windows\Tasks\videopadShakeIcon.job
- c:\program files\NCH Software\VideoPad\videopad.exe [2011-09-19 16:52]
.
2011-10-06 c:\windows\Tasks\wavepadShakeIcon.job
- c:\program files\NCH Software\WavePad\wavepad.exe [2011-09-19 20:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://forums.techguy.org/virus-other-malware-removal/1072157-blue-screen-after-root-kit-7.html
uInternet Settings,ProxyOverride = *.local
IE: Copy to &Lightning Note - c:\program files\Corel\WordPerfect Lightning\Programs\WPLightningCopyToNote.hta
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: Open with WordPerfect - c:\program files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta
LSP: %ProgramFiles%\Bsecure\InetCtrl57.dll
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = 65.32.5.111 65.32.5.112
FF - ProfilePath - c:\documents and settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\
FF - prefs.js: browser.search.defaulturl - 
FF - prefs.js: browser.search.selectedEngine - 
FF - prefs.js: browser.startup.homepage - 
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z149&form=ZGAADF&install_date=20110829&q=
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2012-09-14 16:45; [email protected]; c:\documents and settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions\[email protected]
FF - ExtSQL: !HIDDEN! 2010-01-17 08:54; [email protected]; c:\documents and settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions\[email protected]
FF - user.js: extentions.y2layers.installId - 0cb749d1-f74c-4bd5-9adf-4877091b9912
FF - user.js: extentions.y2layers.defaultEnableAppsList - Buzzdock,Buzzdock,
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: security.csp.enable - false
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-ESET Online Scanner - c:\program files\ESET\ESET Online Scanner\OnlineScannerUninstaller.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-09 02:03
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1140)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
- - - - - - - > 'explorer.exe'(3380)
c:\windows\system32\WININET.dll
c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\Carbonite\Carbonite Backup\carboniteservice.exe
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\msdtc.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\devldr32.exe
c:\windows\System32\vssvc.exe
c:\windows\system32\dllhost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
.
**************************************************************************
.
Completion time: 2012-11-09 02:08:17 - machine was rebooted
ComboFix-quarantined-files.txt 2012-11-09 07:08
ComboFix2.txt 2012-10-17 08:48
ComboFix3.txt 2012-10-16 02:49
.
Pre-Run: 83,801,776,128 bytes free
Post-Run: 83,775,066,112 bytes free
.
- - End Of File - - B310C77F6AFAA81E7D30C5EFF5AF03A7


----------



## shadowbird (Oct 9, 2012)

The techs at BSecure gave me instructions that might fix the inst32.exe, which requires the windows installation disk. I hope I can find it! This is what they said to do: 

Dear Francina,

Thank you for your e-mail.

We have analyzed this issue. This problem is connected to Windows itself. To solve this issue, please follow the steps below:

1. Please run the Command Prompt as administrator.
- Click the Start button
- In the search box, type command prompt.
- In the list of results, right-click Command Prompt, and then click Run as administrator. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
- Please type in the comman prompt: sfc /scannow
- Press &#8220;Enter&#8221; and let finish the process

* You might need Windows installation disk.

2. Once the process is finished, please try to install Bsecure again.


----------



## Cookiegal (Aug 27, 2003)

Open Notepad and copy and paste the text in the code box below into it:


```
SecCenter::
{E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

File::
c:\documents and settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions\[email protected]
c:\documents and settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions\[email protected]

Firefox::
FF - ProfilePath - c:\documents and settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\
FF - user.js: extentions.y2layers.installId - 0cb749d1-f74c-4bd5-9adf-4877091b9912
FF - user.js: extentions.y2layers.defaultEnableAppsList - Buzzdock,Buzzdock,
```
Save the file to your desktop and name it CFScript.txt

Referring to the picture below, drag CFScript.txt into ComboFix.exe










This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.


----------



## shadowbird (Oct 9, 2012)

ComboFix 12-11-09.02 - Francie 11/09/2012 18:12:45.5.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2564 [GMT -5:00]
Running from: c:\documents and settings\Francie\My Documents\Downloads\ComboFix.exe
Command switches used :: c:\documents and settings\Francie\Desktop\TECH GUY TOOLS\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
FILE ::
"c:\documents and settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions\[email protected]"
"c:\documents and settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions\[email protected]"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions\[email protected]
.
.
((((((((((((((((((((((((( Files Created from 2012-10-09 to 2012-11-09 )))))))))))))))))))))))))))))))
.
.
2012-11-09 08:23 . 2012-10-12 02:56	6918632	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4E4243D6-852D-46B9-BEEE-381035288C55}\mpengine.dll
2012-11-08 19:14 . 2008-04-13 18:46	48128	-c--a-w-	c:\windows\system32\dllcache\61883.sys
2012-11-08 19:14 . 2001-08-17 19:55	38400	-c--a-w-	c:\windows\system32\dllcache\8514a.dll
2012-11-08 19:14 . 2008-04-13 18:40	12288	-c--a-w-	c:\windows\system32\dllcache\4mmdat.sys
2012-11-08 19:14 . 2001-08-17 19:55	689216	-c--a-w-	c:\windows\system32\dllcache\3dfxvs.dll
2012-11-08 19:14 . 2001-08-17 19:06	11264	-c--a-w-	c:\windows\system32\dllcache\1394vdbg.sys
2012-11-08 19:14 . 2001-08-17 18:28	762780	-c--a-w-	c:\windows\system32\dllcache\3cwmcru.sys
2012-11-08 19:14 . 2001-08-17 17:48	148352	-c--a-w-	c:\windows\system32\dllcache\3dfxvsm.sys
2012-11-08 19:14 . 2008-04-13 18:46	53376	-c--a-w-	c:\windows\system32\dllcache\1394bus.sys
2012-11-08 19:14 . 2001-08-17 19:56	66048	-c--a-w-	c:\windows\system32\dllcache\s3legacy.dll
2012-11-08 18:14 . 2012-11-09 02:29	--------	d-----w-	c:\documents and settings\Administrator.FRANCIE-PC
2012-11-07 16:40 . 2012-10-12 02:56	6918632	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-11-05 17:00 . 2012-11-05 17:00	--------	d-----w-	c:\program files\Common Files\Windows Microsoft Shared
2012-11-01 16:54 . 2012-11-01 16:54	--------	d--h--w-	c:\windows\PIF
2012-10-31 19:23 . 2010-02-05 17:40	21624	----a-w-	c:\windows\system32\drivers\BSecACFltr.sys
2012-10-31 16:31 . 2012-10-31 16:31	--------	d-----w-	c:\documents and settings\UpdatusUser\Local Settings\Application Data\Intuit
2012-10-30 15:41 . 2012-11-07 07:14	--------	d-----w-	c:\program files\Bsecure
2012-10-30 15:41 . 2010-04-26 19:23	49088	----a-w-	c:\windows\system32\drivers\BsecFltr.sys
2012-10-28 04:27 . 2009-06-30 14:37	28552	----a-w-	c:\windows\system32\drivers\pavboot.sys
2012-10-28 04:26 . 2012-10-28 04:26	--------	d-----w-	c:\program files\Panda Security
2012-10-27 02:09 . 2012-09-29 23:54	22856	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-10-26 00:15 . 2012-10-26 00:15	--------	d-----w-	c:\documents and settings\All Users\Application Data\ATI
2012-10-26 00:01 . 2012-05-14 06:12	103040	----a-w-	c:\windows\system32\drivers\AtihdXP3.sys
2012-10-22 03:16 . 2012-10-22 03:16	--------	d-----w-	C:\_OTS
2012-10-20 23:04 . 2012-10-21 04:58	--------	d-----w-	c:\program files\Microsoft Security Client
2012-10-20 22:18 . 2012-10-20 22:18	--------	d-----w-	C:\2736581aa66bb721b11a9a4ffcf53e12
2012-10-20 19:37 . 2012-10-20 19:37	--------	d-----w-	c:\program files\Carbonite
2012-10-20 19:37 . 2012-10-20 19:37	--------	d-----w-	c:\documents and settings\All Users\Application Data\Carbonite
2012-10-20 04:27 . 2012-10-20 04:27	118784	----a-w-	c:\windows\system32\msstdfmt.dll
2012-10-20 04:27 . 2012-10-20 04:27	294912	-c--a-w-	c:\windows\system32\dllcache\dlimport.exe
2012-10-16 02:19 . 2012-10-16 02:19	--------	d-----w-	c:\documents and settings\Francie\Local Settings\Application Data\Avg2013
2012-10-15 15:42 . 2012-10-15 15:42	--------	d-----w-	c:\documents and settings\Default User\Application Data\TuneUp Software
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-09 01:31 . 2011-02-04 06:10	1682	--sha-w-	c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2012-10-02 17:47 . 2012-10-02 17:47	205072	----a-w-	c:\windows\system32\drivers\tmcomm.sys
2012-08-31 02:03 . 2012-08-31 02:03	193552	----a-w-	c:\windows\system32\drivers\MpFilter.sys
2012-08-28 15:14 . 2004-08-04 12:00	916992	----a-w-	c:\windows\system32\wininet.dll
2012-08-28 15:14 . 2004-08-04 12:00	43520	----a-w-	c:\windows\system32\licmgr10.dll
2012-08-28 15:14 . 2004-08-04 12:00	1469440	----a-w-	c:\windows\system32\inetcpl.cpl
2012-08-28 12:07 . 2004-08-04 12:00	385024	----a-w-	c:\windows\system32\html.iec
2012-08-24 13:53 . 2004-08-04 12:00	177664	----a-w-	c:\windows\system32\wintrust.dll
2012-08-21 13:33 . 2004-08-04 12:00	2148864	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58 . 2004-08-03 22:59	2027520	----a-w-	c:\windows\system32\ntkrnlpa.exe
2012-06-14 22:20 . 2011-03-24 06:14	85472	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2012-09-14 01:14	1014856	----a-r-	c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2012-09-14 01:14	1014856	----a-r-	c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2012-09-14 01:14	1014856	----a-r-	c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-19 421888]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-05-15 15504192]
"NvMediaCenter"="NvMCTray.dll" [2012-05-15 108352]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2000-01-01 1634112]
"Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2012-09-14 1065032]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-07-04 98304]
"CloudCare"="c:\program files\Bsecure\BsecTray.exe" [2011-06-25 96040]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-02-04 273544]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\Guest.FRANCIE-PC\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoStart IR.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AutoStart IR.lnk
backup=c:\windows\pss\AutoStart IR.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Qchex Tray Icon.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Qchex Tray Icon.lnk
backup=c:\windows\pss\Qchex Tray Icon.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinTV Recording Status..lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinTV Recording Status..lnk
backup=c:\windows\pss\WinTV Recording Status..lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Francie^Start Menu^Programs^Startup^CNET TechTracker.lnk]
path=c:\documents and settings\Francie\Start Menu\Programs\Startup\CNET TechTracker.lnk
backup=c:\windows\pss\CNET TechTracker.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-07-27 20:51	919008	----a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2012-07-27 20:51	35768	----a-w-	c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICustomerCare]
2010-05-04 21:05	311296	----a-r-	c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriverMax]
2010-11-18 15:44	9221024	----a-w-	c:\program files\Innovative Solutions\DriverMax\devices.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
2007-02-26 06:01	437160	----a-w-	c:\progra~1\COMMON~1\MICROS~1\DW\DWTRIG20.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2011-07-28 20:59	136176	----atw-	c:\documents and settings\Francie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]
2000-01-01 00:00	41122448	----a-w-	c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2011-05-10 06:41	49208	----a-w-	c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Intuit SyncManager]
2010-10-19 10:58	1439496	----a-w-	c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-06-07 23:33	421776	----a-w-	c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2012-05-15 09:40	15504192	----a-w-	c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2012-05-15 09:40	108352	----a-w-	c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2000-01-01 00:00	1634112	----a-w-	c:\program files\NVIDIA Corporation\nView\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickFinder Scheduler]
2009-06-22 23:29	83232	----a-w-	c:\program files\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-19 02:16	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SlimDrivers]
2012-07-25 16:57	29357952	----a-w-	c:\program files\SlimDrivers\SlimDrivers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2012-07-04 03:48	98304	----a-w-	c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-06-09 17:06	254696	----a-w-	c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2011-02-04 16:06	273544	----a-w-	c:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
2010-07-04 19:51	17408	----a-w-	c:\program files\Unlocker\UnlockerAssistant.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VueMinder]
2012-02-11 14:25	7962624	----a-w-	c:\program files\VueSoft\VueMinder\VueMinder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
2004-03-18 13:33	892928	----a-w-	c:\program files\Logitech\iTouch\iTouch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"rpcapd"=3 (0x3)
"QBCFMonitorService"=2 (0x2)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
"Bonjour Service"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"MBAMScheduler"=2 (0x2)
"MBAMService"=2 (0x2)
"BsecureAV"=2 (0x2)
"Bsecure"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bsecure\\InetCtrl.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCPxpsp2res.dll,-22009
.
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [10/27/2012 11:27 PM 28552]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [6/28/2012 5:33 PM 101112]
R2 KaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\KaraokeSer.exe [8/26/2012 11:11 AM 88688]
R2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\system32\NLSSRV32.EXE [4/12/2012 4:27 AM 69640]
R3 appliandMP;appliandMP;c:\windows\system32\drivers\appliand.sys [9/5/2011 10:41 PM 28256]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [10/25/2012 7:01 PM 103040]
R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [8/26/2012 11:36 AM 43392]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [8/26/2012 11:11 AM 2551664]
S3 appliand;Applian Network Service;c:\windows\system32\drivers\appliand.sys [9/5/2011 10:41 PM 28256]
S3 BSecACFltr;BSecACFltr;c:\windows\system32\drivers\BSecACFltr.sys [10/31/2012 2:23 PM 21624]
S3 hcw72ADFilter;WinTV HVR-950 USB Audio Filter Driver;c:\windows\system32\drivers\hcw72ADFilter.sys [5/17/2011 9:43 AM 28928]
S3 hcw72ATV;WinTV HVR-950 NTSC;c:\windows\system32\drivers\hcw72ATV.sys [5/17/2011 9:43 AM 1217920]
S3 hcw72DTV;WinTV HVR-950 ATSC/QAM;c:\windows\system32\drivers\hcw72DTV.sys [5/17/2011 9:43 AM 1220224]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [10/26/2012 9:09 PM 22856]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [8/4/2004 7:00 AM 14336]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [11/6/2007 3:22 PM 34064]
S4 Bsecure;CloudCare;c:\program files\Bsecure\InetCtrl.exe [10/30/2012 10:41 AM 66344]
S4 BsecureAV;CloudCare AntiVirus;c:\program files\Bsecure\BsecAV.exe [10/30/2012 10:41 AM 161776]
S4 HauppaugeTVServer;HauppaugeTVServer;c:\progra~1\WinTV\TVServer\HAUPPA~1.EXE [9/15/2011 10:40 PM 558592]
S4 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [10/26/2012 9:09 PM 399432]
S4 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [10/26/2012 9:09 PM 676936]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - BsecureFilter
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper	REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-06 c:\windows\Tasks\debutShakeIcon.job
- c:\program files\NCH Software\Debut\debut.exe [2011-04-03 14:08]
.
2012-11-06 c:\windows\Tasks\doxillionShakeIcon.job
- c:\program files\NCH Software\Doxillion\doxillion.exe [2011-01-12 21:59]
.
2012-11-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-12 21:44]
.
2012-11-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-12 21:44]
.
2012-11-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-616249376-839522115-1003Core.job
- c:\documents and settings\Francie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-08-29 20:59]
.
2012-11-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-616249376-839522115-1003UA.job
- c:\documents and settings\Francie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-08-29 20:59]
.
2012-11-09 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-09-12 21:25]
.
2012-07-25 c:\windows\Tasks\photostageShakeIcon.job
- c:\program files\NCH Software\PhotoStage\photostage.exe [2012-07-15 06:07]
.
2012-11-06 c:\windows\Tasks\prismDowngrade.job
- c:\program files\NCH Software\Prism\prism.exe [2011-09-19 16:51]
.
2012-11-06 c:\windows\Tasks\prismShakeIcon.job
- c:\program files\NCH Software\Prism\prism.exe [2011-09-19 16:51]
.
2012-11-09 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-11-09 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-11-09 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-11-09 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-11-09 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-11-07 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-09-22 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2012-11-07 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 19:25]
.
2011-01-20 c:\windows\Tasks\scribeSevenDaysInit.job
- c:\program files\NCH Swift Sound\Scribe\scribe.exe [2011-01-20 02:58]
.
2012-11-06 c:\windows\Tasks\scribeShakeIcon.job
- c:\program files\NCH Swift Sound\Scribe\scribe.exe [2011-01-20 02:58]
.
2012-11-09 c:\windows\Tasks\User_Feed_Synchronization-{259297A0-4E67-4E79-897A-4C8098A85E45}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 09:31]
.
2012-06-14 c:\windows\Tasks\videopadDowngrade.job
- c:\program files\NCH Software\VideoPad\videopad.exe [2011-09-19 16:52]
.
2012-05-16 c:\windows\Tasks\videopadShakeIcon.job
- c:\program files\NCH Software\VideoPad\videopad.exe [2011-09-19 16:52]
.
2011-10-06 c:\windows\Tasks\wavepadShakeIcon.job
- c:\program files\NCH Software\WavePad\wavepad.exe [2011-09-19 20:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://forums.techguy.org/virus-other-malware-removal/1072157-blue-screen-after-root-kit-7.html
uInternet Settings,ProxyOverride = *.local
IE: Copy to &Lightning Note - c:\program files\Corel\WordPerfect Lightning\Programs\WPLightningCopyToNote.hta
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: Open with WordPerfect - c:\program files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta
LSP: %ProgramFiles%\Bsecure\InetCtrl57.dll
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = 65.32.5.111 65.32.5.112
FF - ProfilePath - c:\documents and settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\
FF - prefs.js: browser.search.defaulturl - 
FF - prefs.js: browser.search.selectedEngine - 
FF - prefs.js: browser.startup.homepage - 
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z149&form=ZGAADF&install_date=20110829&q=
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2012-09-14 16:45; [email protected]; c:\documents and settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions\[email protected]
FF - ExtSQL: !HIDDEN! 2010-01-17 08:54; [email protected]; c:\documents and settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions\[email protected]
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: security.csp.enable - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-09 18:21
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1140)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
- - - - - - - > 'explorer.exe'(3948)
c:\windows\system32\WININET.dll
c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\Carbonite\Carbonite Backup\carboniteservice.exe
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\devldr32.exe
c:\program files\Bsecure\Setup.exe
c:\program files\Bsecure\Inst32.exe
c:\windows\system32\dwwin.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
.
**************************************************************************
.
Completion time: 2012-11-09 18:24:55 - machine was rebooted
ComboFix-quarantined-files.txt 2012-11-09 23:24
ComboFix2.txt 2012-11-09 07:08
ComboFix3.txt 2012-10-17 08:48
ComboFix4.txt 2012-10-16 02:49
.
Pre-Run: 84,278,874,112 bytes free
Post-Run: 84,347,629,568 bytes free
.
- - End Of File - - 2922581EC5145BAA07D1CA3E06659D3D


----------



## Cookiegal (Aug 27, 2003)

Please close your Firefox browser then restart it again. Then please run DDS again and post the new log. This will tell me if the hidden extensions were actually removed.


----------



## shadowbird (Oct 9, 2012)

I haven't used Firefox this year. I was using Google Chrome. I'll use IE and see if it makes a difference.


----------



## Cookiegal (Aug 27, 2003)

Pleast start up Firefox and then close it. Then run DDS and post the new log please.


----------



## shadowbird (Oct 9, 2012)

Thank you Cookiegal....

A friend who does tech work gave me a graphics card which I will attempt to install tonight.
.

DDS (Ver_2012-11-07.01) - NTFS_x86 
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_30
Run by Francie at 21:26:53 on 2012-11-11
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2560 [GMT -5:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
============== Running Processes ================
.
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\KaraokeSer.exe
C:\WINDOWS\system32\NLSSRV32.EXE
C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\WINDOWS\system32\HPZipm12.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Real\RealPlayer\update\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\msdtc.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\svchost.exe -k netsvcs
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://forums.techguy.org/virus-other-malware-removal/1072157-blue-screen-after-root-kit-7.html
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [Carbonite Backup] c:\program files\carbonite\carbonite backup\CarboniteUI.exe
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [CloudCare] c:\program files\bsecure\BsecTray.exe
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:323
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
IE: Copy to &Lightning Note - c:\program files\corel\wordperfect lightning\programs\WPLightningCopyToNote.hta
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: Open with WordPerfect - c:\program files\corel\wordperfect office x4\programs\WPLauncher.hta
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
LSP: %ProgramFiles%\Bsecure\InetCtrl57.dll
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlcdnet.asus.com/pub/ASUS/misc/dlm-activex-2.2.5.0.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1294720102421
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 65.32.5.111 65.32.5.112
TCP: Interfaces\{1AD616B8-0534-4FB2-85E2-82645C155B2F} : DHCPNameServer = 65.32.5.111 65.32.5.112
Handler: g7ps - {9EACF0FB-4FC7-436E-989B-3197142AD979} - c:\program files\common files\g7ps\shared files\g7psdll\G7PS.dll
Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - c:\program files\intuit\quickbooks 2010\HelpAsyncPluggableProtocol.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - 
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
Hosts: 127.0.0.1	www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\francie\application data\mozilla\firefox\profiles\tohrezx2.default\
FF - prefs.js: browser.search.defaulturl - 
FF - prefs.js: browser.search.selectedEngine - 
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z149&form=ZGAADF&install_date=20110829&q=
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\documents and settings\francie\local settings\application data\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\browser\nppdf32(2).dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPcol400.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\nos\bin\np_gp.dll
.
---- FIREFOX POLICIES ----
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: security.csp.enable - false
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2012-8-30 193552]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2012-10-27 28552]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2012-6-28 101112]
R2 KaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\KaraokeSer.exe [2012-8-26 88688]
R2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\system32\NLSSRV32.EXE [2012-4-12 69640]
R3 appliandMP;appliandMP;c:\windows\system32\drivers\appliand.sys [2011-9-5 28256]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [2012-10-25 103040]
R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [2012-8-26 43392]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2012-8-26 2551664]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 appliand;Applian Network Service;c:\windows\system32\drivers\appliand.sys [2011-9-5 28256]
S3 BSecACFltr;BSecACFltr;c:\windows\system32\drivers\BSecACFltr.sys [2012-10-31 21624]
S3 hcw72ADFilter;WinTV HVR-950 USB Audio Filter Driver;c:\windows\system32\drivers\hcw72ADFilter.sys [2011-5-17 28928]
S3 hcw72ATV;WinTV HVR-950 NTSC;c:\windows\system32\drivers\hcw72ATV.sys [2011-5-17 1217920]
S3 hcw72DTV;WinTV HVR-950 ATSC/QAM;c:\windows\system32\drivers\hcw72DTV.sys [2011-5-17 1220224]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-10-26 22856]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\system32\svchost.exe -k nosGetPlusHelper [2004-8-4 14336]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-6 34064]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 Bsecure;CloudCare;c:\program files\bsecure\InetCtrl.exe [2012-10-30 66344]
S4 BsecureAV;CloudCare AntiVirus;c:\program files\bsecure\BsecAV.exe [2012-10-30 161776]
S4 HauppaugeTVServer;HauppaugeTVServer;c:\progra~1\wintv\tvserver\HAUPPA~1.EXE [2011-9-15 558592]
S4 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-10-26 399432]
S4 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-10-26 676936]
.
=============== File Associations ===============
.
ShellExec: Corel Visual Intelligence.exe: Open="c:\program files\corel\visual intelligence\launch.exe" "%1"
ShellExec: doxillion.exe: Convert with Doxillion="c:\program files\nch software\doxillion\doxillion" "%L"
ShellExec: LightningViewer.exe: View="c:\program files\corel\wordperfect lightning\programs\LightningNavigator.exe" "-ViewDocument" "%1"
.
=============== Created Last 30 ================
.
2012-11-11 23:44:26	6918632	----a-w-	c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{dca981a5-8f24-4958-bfbd-0b8636328c51}\mpengine.dll
2012-11-10 00:21:26	6918632	----a-w-	c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2012-11-08 19:14:59	48128	-c--a-w-	c:\windows\system32\dllcache\61883.sys
2012-11-08 19:14:59	38400	-c--a-w-	c:\windows\system32\dllcache\8514a.dll
2012-11-08 19:14:58	762780	-c--a-w-	c:\windows\system32\dllcache\3cwmcru.sys
2012-11-08 19:14:58	689216	-c--a-w-	c:\windows\system32\dllcache\3dfxvs.dll
2012-11-08 19:14:58	148352	-c--a-w-	c:\windows\system32\dllcache\3dfxvsm.sys
2012-11-08 19:14:58	12288	-c--a-w-	c:\windows\system32\dllcache\4mmdat.sys
2012-11-08 19:14:58	11264	-c--a-w-	c:\windows\system32\dllcache\1394vdbg.sys
2012-11-08 19:14:57	53376	-c--a-w-	c:\windows\system32\dllcache\1394bus.sys
2012-11-08 19:14:33	66048	-c--a-w-	c:\windows\system32\dllcache\s3legacy.dll
2012-11-05 17:00:44	--------	d-----w-	c:\program files\common files\Windows Microsoft Shared
2012-11-01 16:54:16	--------	d--h--w-	c:\windows\PIF
2012-10-31 19:23:10	21624	----a-w-	c:\windows\system32\drivers\BSecACFltr.sys
2012-10-30 15:41:57	49088	----a-w-	c:\windows\system32\drivers\BsecFltr.sys
2012-10-30 15:41:57	--------	d-----w-	c:\program files\Bsecure
2012-10-28 04:27:11	28552	----a-w-	c:\windows\system32\drivers\pavboot.sys
2012-10-28 04:26:57	--------	d-----w-	c:\program files\Panda Security
2012-10-27 02:09:17	22856	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-10-26 00:01:27	103040	----a-w-	c:\windows\system32\drivers\AtihdXP3.sys
2012-10-22 03:16:09	--------	d-----w-	C:\_OTS
2012-10-20 23:04:58	--------	d-----w-	c:\program files\Microsoft Security Client
2012-10-20 22:18:05	--------	d-----w-	C:\2736581aa66bb721b11a9a4ffcf53e12
2012-10-20 19:37:16	--------	d-----w-	c:\program files\Carbonite
2012-10-20 19:37:16	--------	d-----w-	c:\documents and settings\all users\application data\Carbonite
2012-10-20 04:27:10	118784	----a-w-	c:\windows\system32\msstdfmt.dll
2012-10-20 04:27:09	294912	-c--a-w-	c:\windows\system32\dllcache\dlimport.exe
2012-10-16 02:25:14	--------	d-sha-r-	C:\cmdcons
2012-10-16 02:23:26	98816	----a-w-	c:\windows\sed.exe
2012-10-16 02:23:26	256000	----a-w-	c:\windows\PEV.exe
2012-10-16 02:23:26	208896	----a-w-	c:\windows\MBR.exe
2012-10-16 02:19:40	--------	d-----w-	c:\documents and settings\francie\local settings\application data\Avg2013
.
==================== Find3M ====================
.
2012-11-09 01:31:31	1682	--sha-w-	c:\documents and settings\all users\application data\KGyGaAvL.sys
2012-10-02 17:47:24	205072	----a-w-	c:\windows\system32\drivers\tmcomm.sys
2012-08-31 02:03:50	193552	----a-w-	c:\windows\system32\drivers\MpFilter.sys
2012-08-28 15:14:53	916992	----a-w-	c:\windows\system32\wininet.dll
2012-08-28 15:14:53	43520	----a-w-	c:\windows\system32\licmgr10.dll
2012-08-28 15:14:52	1469440	----a-w-	c:\windows\system32\inetcpl.cpl
2012-08-28 12:07:15	385024	----a-w-	c:\windows\system32\html.iec
2012-08-26 19:02:31	1074636	----a-w-	c:\windows\system32\nvdrsdb0.bin
2012-08-26 19:02:31	1	----a-w-	c:\windows\system32\nvdrssel.bin
2012-08-26 19:02:28	1074636	----a-w-	c:\windows\system32\nvdrsdb1.bin
2012-08-24 13:53:22	177664	----a-w-	c:\windows\system32\wintrust.dll
2012-08-21 13:33:26	2148864	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58:09	2027520	----a-w-	c:\windows\system32\ntkrnlpa.exe
.
============= FINISH: 21:27:27.62 ===============


----------



## shadowbird (Oct 9, 2012)

I have the graphics card in and it seems to be working fine.


----------



## Cookiegal (Aug 27, 2003)

That's great. 

Would you mind copying and pasting the attach.txt log from DDS in a reply please?


----------



## shadowbird (Oct 9, 2012)

Sure. Here it is:

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-07.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 1/11/2011 1:25:25 AM
System Uptime: 11/11/2012 6:33:02 PM (3 hours ago)
.
Motherboard: ASUSTeK Computer INC. | | M4A785-M
Processor: AMD Athlon(tm) II X2 240 Processor | AM2 | 2812/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 298 GiB total, 78.384 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: 
Description: 
Device ID: ACPI\ATK0110\1010110
Manufacturer: 
Name: 
PNP Device ID: ACPI\ATK0110\1010110
Service: 
.
==== System Restore Points ===================
.
RP870: 8/14/2012 2:50:45 PM - Restore Operation
RP871: 8/14/2012 3:00:05 PM - Restore Operation
RP872: 8/15/2012 1:29:32 AM - Installed iTunes
RP873: 8/15/2012 2:16:37 AM - Restore Operation
RP874: 8/15/2012 4:32:44 PM - Installed iTunes
RP875: 8/15/2012 5:12:05 PM - Removed Apple Mobile Device Support
RP876: 8/15/2012 5:12:47 PM - Removed Apple Software Update
RP877: 8/15/2012 5:13:19 PM - Removed Apple Application Support
RP878: 8/15/2012 5:16:35 PM - Removed iTunes
RP879: 8/16/2012 8:01:54 PM - System Checkpoint
RP880: 8/17/2012 10:38:51 PM - System Checkpoint
RP881: 8/19/2012 5:38:41 AM - System Checkpoint
RP882: 8/20/2012 7:26:11 AM - System Checkpoint
RP883: 8/20/2012 11:44:22 PM - Installed iTunes
RP884: 8/20/2012 11:47:12 PM - Removed iTunes
RP885: 8/20/2012 11:51:50 PM - Installed iTunes
RP886: 8/20/2012 11:53:52 PM - Removed iTunes
RP887: 8/20/2012 11:57:14 PM - Removed QuickTime
RP888: 8/20/2012 11:58:10 PM - Installed QuickTime
RP889: 8/21/2012 12:00:19 AM - Removed QuickTime
RP890: 8/21/2012 12:18:18 AM - Installed iTunes
RP891: 8/21/2012 1:55:20 AM - Installed iTunes
RP892: 8/26/2012 12:09:01 PM - SlimDrivers Installing Drivers
RP893: 8/26/2012 12:12:06 PM - Installed Platform
RP894: 8/26/2012 12:23:12 PM - SlimDrivers Installing Drivers
RP895: 8/26/2012 12:24:44 PM - SlimDrivers Installing Drivers
RP896: 8/26/2012 2:12:22 PM - SlimDrivers Installing Drivers
RP897: 8/26/2012 2:13:48 PM - SlimDrivers Installing Drivers
RP898: 8/26/2012 2:15:18 PM - SlimDrivers Installing Drivers
RP899: 9/10/2012 2:34:58 PM - System Checkpoint
RP900: 9/13/2012 4:08:20 PM - System Checkpoint
RP901: 9/13/2012 11:27:19 PM - Restore Operation
RP902: 9/14/2012 4:14:01 PM - SlimDrivers Installing Drivers
RP903: 9/14/2012 9:04:49 PM - Installed TurboTax 2011 wrapper
RP904: 9/15/2012 11:05:34 PM - Installed TurboTax 2011 wflcbpm
RP905: 9/23/2012 9:46:18 PM - System Checkpoint
RP906: 9/26/2012 11:49:51 PM - System Checkpoint
RP907: 9/27/2012 1:32:07 AM - Installed AVG 2013
RP908: 9/27/2012 1:32:27 AM - Installed AVG 2013
RP909: 9/27/2012 1:08:51 PM - Printer Driver hp officejet 5500 series fax Installed
RP910: 9/27/2012 1:47:45 PM - Restore Operation
RP911: 10/4/2012 12:46:18 PM - System Checkpoint
RP912: 10/5/2012 3:02:39 PM - System Checkpoint
RP913: 10/9/2012 6:47:38 PM - System Checkpoint
RP914: 10/12/2012 12:33:16 AM - System Checkpoint
RP915: 10/15/2012 2:08:55 PM - System Checkpoint
RP916: 10/15/2012 10:18:44 PM - Removed AVG 2013
RP917: 10/15/2012 10:19:55 PM - Removed AVG 2013
RP918: 10/16/2012 2:20:31 PM - Software Distribution Service 3.0
RP919: 10/19/2012 1:18:05 PM - System Checkpoint
RP920: 10/20/2012 4:21:41 PM - System Checkpoint
RP921: 10/21/2012 1:00:09 AM - Software Distribution Service 3.0
RP922: 10/22/2012 2:43:01 AM - Software Distribution Service 3.0
RP923: 10/23/2012 9:17:18 AM - Software Distribution Service 3.0
RP924: 10/24/2012 11:37:57 AM - Software Distribution Service 3.0
RP925: 10/25/2012 11:59:31 AM - Software Distribution Service 3.0
RP926: 10/25/2012 7:38:59 PM - Software Distribution Service 3.0
RP927: 10/25/2012 8:31:49 PM - Removed DriverUpdate
RP928: 10/26/2012 8:42:13 PM - System Checkpoint
RP929: 10/27/2012 9:17:05 AM - Software Distribution Service 3.0
RP930: 10/28/2012 2:06:24 AM - Software Distribution Service 3.0
RP931: 10/28/2012 9:17:03 AM - Software Distribution Service 3.0
RP932: 10/29/2012 12:13:06 PM - Software Distribution Service 3.0
RP933: 10/30/2012 12:18:45 PM - Software Distribution Service 3.0
RP934: 10/30/2012 2:02:29 PM - Printer Driver Amyuni Document Converter 400 Installed
RP935: 10/31/2012 12:42:28 PM - Software Distribution Service 3.0
RP936: 11/1/2012 5:33:57 PM - System Checkpoint
RP937: 11/2/2012 10:13:33 AM - Software Distribution Service 3.0
RP938: 11/3/2012 3:06:26 PM - Software Distribution Service 3.0
RP939: 11/4/2012 3:49:46 PM - System Checkpoint
RP940: 11/5/2012 10:40:51 AM - Software Distribution Service 3.0
RP941: 11/6/2012 11:29:33 AM - Software Distribution Service 3.0
RP942: 11/7/2012 11:40:52 AM - Software Distribution Service 3.0
RP943: 11/8/2012 12:19:45 PM - Software Distribution Service 3.0
RP944: 11/9/2012 3:13:01 PM - System Checkpoint
RP945: 11/9/2012 6:29:57 PM - Software Distribution Service 3.0
RP946: 11/10/2012 7:52:23 PM - System Checkpoint
RP947: 11/11/2012 6:44:21 PM - Software Distribution Service 3.0
.
==== Installed Programs ======================
.
2600
2600_Help
2600Trb
Adobe AIR
Adobe Download Manager
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader X (10.1.4)
AiO_Scan
AiOSoftware
AMD Catalyst Install Manager
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Applian Director
Applian FLV Player
ATI Catalyst Registration
AVS4YOU Software Navigator 1.4
Bonjour
BufferChm
Carbonite
Catalyst Control Center
Catalyst Control Center - Branding
Catalyst Control Center Graphics Previews Common
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-utility
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
CCleaner
CloudCare
CNET TechTracker
Combined Community Codec Pack 2010-10-10
Compatibility Pack for the 2007 Office system
Copy
Corel Visual Intelligence
Corel WordPerfect Office - iFilter
CP_AtenaShokunin1Config
cp_dwShrek2Albums1
cp_dwShrek2Cards1
CreativeProjects
CreativeProjectsTemplates
CueTour
Data Transfer Utility 10
Debut Video Capture Software
Destinations
Director
DocProc
DocumentViewer
Doxillion Document Converter
DriverMax 5
EVEREST Home Edition v2.20
Express Scribe
Fax
File Type Assistant
gBurner
GIMP 2.6.11
Google Chrome
Google Earth
Google Update Helper
GoToMeeting 5.1.0.880
Hauppauge WinTV 7
High Definition Audio Driver Package - KB888111
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB2756822)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB981793)
HP Extended Capabilities 4.7
HP Image Zone 4.7
HP Product Assistant
HP PSC & OfficeJet 4.7
HP Update
HPSystemDiagnostics
InqScribe 2.1
InstantShare
InstantShareAlert
iTunes
Java Auto Updater
Java(TM) 6 Update 30
Logitech iTouch Software
Malwarebytes Anti-Malware version 1.65.1.1000
MarketResearch
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2572067)
Microsoft .NET Framework 1.1 Security Update (KB2656370)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office XP Professional
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Word Supplemental Macros
Mozilla Firefox 13.0.1 (x86 en-US)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
NVIDIA Control Panel 301.42
NVIDIA Graphics Driver 301.42
NVIDIA Install Application
NVIDIA nView 136.27
NVIDIA nView Desktop Manager
NVIDIA PhysX
NVIDIA PhysX System Software 9.12.0213
NVIDIA Update 1.8.15
NVIDIA Update Components
Office Password Recovery PRO v1.0 (remove only)
OpenOffice.org 3.3
Panda ActiveScan 2.0
PanoStandAlone
PDF reDirect (remove only)
PDFCreator
PhotoGallery
PhotoStage Slideshow Producer
Platform
Prism Video File Converter
ProductContext
QFolder
QuickBooks
QuickBooks Pro 2010
QuickTime
Readme
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
REALTEK GbE & FE Ethernet PCI-E NIC Driver
RealUpgrade 1.1
Recuva
Replay AV 8
Replay Converter 4
Replay Media Catcher 4 (4.3.2)
Scan
ScannerCopy
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2675157)
Security Update for Windows Internet Explorer 8 (KB2699988)
Security Update for Windows Internet Explorer 8 (KB2744842)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2647518)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2685939)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2695962)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2705219-v2)
Security Update for Windows XP (KB2707511)
Security Update for Windows XP (KB2709162)
Security Update for Windows XP (KB2712808)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB2723135-v2)
Security Update for Windows XP (KB2724197)
Security Update for Windows XP (KB2731847-v2)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982381)
Security Update for Windows XP (KB982665)
Shutterfly Express Uploader
SkinsHP1
SlimDrivers
Smart PDF Converter 6.3.0.495
Sony Player Plug-in for Windows Media Player
Spybot - Search & Destroy
The Lord of the Rings FREE Trial 
TranscriptPro 4
TrayApp
TurboTax 2010
TurboTax 2010 wflcbpm
TurboTax 2010 WinBizFedFormset
TurboTax 2010 WinBizReleaseEngine
TurboTax 2010 WinBizTaxSupport
TurboTax 2010 WinPerFedFormset
TurboTax 2010 WinPerReleaseEngine
TurboTax 2010 WinPerTaxSupport
TurboTax 2010 wrapper
TurboTax Business 2010
Unload
Unlocker 1.9.1
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB2447568)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676-v2)
Update for Windows XP (KB2641690)
Update for Windows XP (KB2661254-v2)
Update for Windows XP (KB2718704)
Update for Windows XP (KB2736233)
Update for Windows XP (KB2749655)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VersaCheck 2003 Personal Premier
VIA Platform Device Manager
VideoPad Video Editor
VPedal Windows Media Player 11 64bit Plug-in
VueMinder Pro
WavePad Sound Editor
WebFldrs XP
WebReg
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinPcap 4.0.2
WinRAR 4.01 (32-bit)
WM Recorder
WM Recorder 11.3
WordPerfect Lightning
WordPerfect Lightning - EN
WordPerfect Lightning - IPM
WordPerfect Lightning - Messages
WordPerfect Lightning - MSOM
WordPerfect Office X4
WordPerfect Office X4 - Common
WordPerfect Office X4 - Content
WordPerfect Office X4 - EN
WordPerfect Office X4 - Filters
WordPerfect Office X4 - Graphics
WordPerfect Office X4 - ICA
WordPerfect Office X4 - IPM
WordPerfect Office X4 - IPM EN
WordPerfect Office X4 - Migration Manager
WordPerfect Office X4 - PerfectExperts
WordPerfect Office X4 - PR
WordPerfect Office X4 - QP
WordPerfect Office X4 - Skins
WordPerfect Office X4 - System
WordPerfect Office X4 - WP
WordPerfect OfficeReady
.
==== Event Viewer Messages From Past Week ========
.
11/7/2012 9:39:00 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service gupdate with arguments "/comsvc" in order to run the server: {4EB61BAC-A3B6-4760-9581-655041EF4D69}
11/7/2012 12:53:46 PM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the CarboniteService service, but this action failed with the following error: An instance of the service is already running.
11/7/2012 12:52:46 PM, error: Service Control Manager [7031] - The CarboniteService service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
11/7/2012 11:30:26 AM, error: Service Control Manager [7000] - The PfModNT service failed to start due to the following error: The system cannot find the file specified.
11/5/2012 11:37:06 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
11/10/2012 3:08:51 AM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer JAMIEG-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{1AD616B8-0534-4FB2. The master browser is stopping or an election is being forced.
.
==== End Of File ===========================


----------



## Cookiegal (Aug 27, 2003)

I see you have CNET TechTracker installed. It's my understanding that program is supposed to make sure you have the latest versions of software but it doesn't seem to be doing its job since all of these need to be updated (to patch security issues):

Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader X (10.1.4)
Java(TM) 6 Update 30


Other than that, are things stable on this machine now?


----------



## shadowbird (Oct 9, 2012)

I have had some notices about flash, but in the past I had trouble when I updated it, so I ignored it. I usually update Adobe, but I don't remember seeing that one. Java, not sure about if I had noticed on that one or not.

Yes, everything seems to be stable except the irritating messages about BSecure. I have to find the copy of windows that my son installed when he built my PC (not sure what he did with it after), then hopefully their instructions will fix that. 

I am very grateful for all that you have done to help me! I can't tell you how grateful I am! I don't have enough funds to donate right now, except just a little and I will. And then what I want to do is send a little each month, because we always donate each month, even though our monthly basic expenses exceed my income each month. Giving is important! So I will definitely be donating. You have helped me so that now I can start working on this new business and hopefully get my income back.


----------



## Cookiegal (Aug 27, 2003)

I'm sorry that happened with BSecure. I don't know what caused it and can't seem to figure out how to fix it. 

We appreciate and need donations for sure and yes, giving is important but if you don't have it to spare, please put what you do have to good use for something you or your family needs. 

It's important to keep programs like Adobe Flash/Reader and Java up to date because there security vulernabilities are discovered that need to be patched so you don't get infected.

For Adobe Flash, go to this link:

http://get.adobe.com/flashplayer/

*Be sure to uncheck any other download that's offered with it* (they always include something that you don't need and it varies. In my case it's offering the McAfee Security Scan but it could also be an uneeded toolbar).

If you're using a browser other than IE you need to visit that link with that browser as well in order to get the needed plugin. Internet Explorer requires the ActiveX version that will be downloaded when you visit the link with Internet Explorer.

For Adobe Reader, you can get the latest version here (the same applies for unchecking any unwanted download offered with it):

http://get.adobe.com/reader/

For Java:


Download the latest version of *Java Runtime Environment (JRE) 6 Update 37*.
Accept the License Agreement and then select the option to download the *Windows x86 Offline* version 
Save the executable file to your desktop.
Close any programs you may have running - especially your web browser.
Go to *Start* > *Control Panel*, double-click on *Add/Remove *programs and remove all older versions of Java.
Check any item with * Java Runtime Environment, JRE, J2SE or Java(TM)* in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on the download and follow the prompts to install the newest version.

****

Here are some final instructions for you.

As with any infection, I recommend that you change all passwords for logging into to sites that you use on your computer as a precaution.

*Follow these steps to uninstall Combofix and all of its files and components.*

 Click *START* then *RUN*
 Now type *ComboFix /uninstall* in the runbox and click *OK*. Note the *space* between the *X* and the */uninstall*, it needs to be there (the screenshot is just for illustration purposes but the actual command uses the entire word "uninstall" and not just the "u" as shown in the picture).










Please open OTS again and click on the button that says "CleanUp" at the top. This will remove most of the tools we've used and will also uninstall the OTS program itself.

Now you should turn system restore off to flush out all previous system restore points, then turn it back on and create a new restore point:

To turn off system restore, on the Desktop, right click on *My Computer* and click on *Properties.*
Click the *System Restore* tab.
Check *Turn off System Restore.*
Click Apply and then click OK.

Restart your computer, turn System Restore back on and create a restore point.

To create a new restore point, click on *Start*  *All Programs*  *Accessories*  *System Tools* and then select *System Restore*.

In the System Restore wizard, select *Create a restore point* and click the Next button.

Type a name for your new restore point then click on Create.


----------



## shadowbird (Oct 9, 2012)

I did all that. WHen I turned my PC back on, I got an "unexpected errors have happened to software you recently used" message. The report is on software that I am unfamiliar with:

EventType: visualstudio7.80 update P1: msiexec.exe P2: 1.0.1713.5056
P3: kb2698023 P4: 1033 P5: 643 P6: f P7: install
P8: x86 P9: 5.1.2600.23.0.256 P10: 0

This error repot includes: information regarding the condition of NDP1.1sp1-KB2698023-X86 when the problem occurred, the operating system version and computer hardware in use, and the Internet Protocal (IP) address of your computer.

Error Report Contents:
Error Report: C:\Documents and Settings\Francie\Local Settings\Application Data\PCHealth\ErrorRep\QSignoff\A9C69A.cab
The Error Report contains the following files:
NDP1.1sp1_KB2698023_X86_wrapper.log
version.txt


----------



## shadowbird (Oct 9, 2012)

After posting that, I ran the current windows update, and received this message:

Some Updates Could Not Be Installed:
The following updates were not installed:
Security Update for Microsoft .NET Framework 1.1 SP1 on Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2698023)


----------



## Cookiegal (Aug 27, 2003)

This is unrelated to previous issues. A lot of people are having trouble installing this particular .NET Framework update. The solution has been as follows:

1) Uninstall Microsoft .NET Framework 1.1 via Add or Remove Programs in the Control Panel

2) Reinstall Microsoft .NET Framework 1.1:
http://www.microsoft.com/en-us/download/details.aspx?id=26

3) Reapply SP1:
http://www.microsoft.com/en-us/download/details.aspx?id=33

4) Apply the failing update manually from the following link:
http://www.microsoft.com/en-us/download/details.aspx?id=35705

Let me know how that goes please.


----------



## shadowbird (Oct 9, 2012)

I completed those. Auto update keeps telling me I need to install it though, and then says it can't be installed.


----------



## shadowbird (Oct 9, 2012)

I just marked the box for "do not notify me of this download again."


----------



## Cookiegal (Aug 27, 2003)

That's not the best way to go since updates plug vulnerabilities. What was the exact error message you were getting?


----------



## shadowbird (Oct 9, 2012)

All I remember is it said the update could not be Installed. It's not asking me to install it anymore, so I don't know how to make that happen again.


----------



## Cookiegal (Aug 27, 2003)

Did you try to download the update manually?

You can visit MS updates and click on the left side to unhide hidden updates.

Open HijackThis and click on the *Open Misc Tools section* button. Click on the *Open Uninstall Manager* button. Click the *Save List* button. Save the list then copy and paste it here.


----------



## shadowbird (Oct 9, 2012)

Yes, I downloaded it manual as per your prior instructions.

Went to Microsoft Updates. Looks like it's installing the update again, but it said it was zero Kb. Here's the result of the install:

Initializing installation... done!
Installing Microsoft .NET Framework 1.1 Service Pack 1 (update 1 of 3)... failed!
Installing Security Update for Windows XP (KB2585542) (update 2 of 3)... done!
Installing Security Update for Windows XP (KB2661637) (update 3 of 3)... 

Some Updates were not Installed:
Microsoft.NET Framework 1.1 Service Pack 1

Here's the Save List:

Adobe AIR
Adobe AIR
Adobe Download Manager
Adobe Flash Player 10 Plugin
Adobe Flash Player 11 ActiveX
Adobe Reader XI
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Applian Director
Applian FLV Player
AVS4YOU Software Navigator 1.4
Bonjour
Carbonite
CCleaner
CloudCare
Combined Community Codec Pack 2010-10-10
Compatibility Pack for the 2007 Office system
Corel Visual Intelligence
Corel WordPerfect Office - iFilter
Data Transfer Utility 10
Debut Video Capture Software
Doxillion Document Converter
DriverMax 5
EVEREST Home Edition v2.20
Express Scribe
File Type Assistant
gBurner
GIMP 2.6.11
Google Earth
Google Update Helper
High Definition Audio Driver Package - KB888111
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB2756822)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB981793)
HP Extended Capabilities 4.7
HP Image Zone 4.7
HP PSC & OfficeJet 4.7
HP Update
InqScribe 2.1
InstantShareAlert
iTunes
Java(TM) 6 Update 37
Logitech iTouch Software
Malwarebytes Anti-Malware version 1.65.1.1000
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Client Profile
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office XP Professional
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Word Supplemental Macros
Mozilla Firefox 13.0.1 (x86 en-US)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
NVIDIA Graphics Driver 306.81
NVIDIA HD Audio Driver 1.3.18.0
NVIDIA nView 136.28
NVIDIA nView Desktop Manager
NVIDIA PhysX
NVIDIA PhysX System Software 9.12.0604
NVIDIA Update 1.10.8
Office Password Recovery PRO v1.0 (remove only)
OpenOffice.org 3.3
PDF reDirect (remove only)
PDFCreator
PhotoStage Slideshow Producer
Prism Video File Converter
QuickBooks
QuickBooks Pro 2010
QuickTime
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
REALTEK GbE & FE Ethernet PCI-E NIC Driver
RealUpgrade 1.1
Recuva
Replay AV 8
Replay Converter 4
Replay Media Catcher 4 (4.3.2)
Revo Uninstaller Pro 2.5.9
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2675157)
Security Update for Windows Internet Explorer 8 (KB2699988)
Security Update for Windows Internet Explorer 8 (KB2744842)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2647518)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2685939)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2695962)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2705219-v2)
Security Update for Windows XP (KB2707511)
Security Update for Windows XP (KB2709162)
Security Update for Windows XP (KB2712808)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB2723135-v2)
Security Update for Windows XP (KB2724197)
Security Update for Windows XP (KB2727528)
Security Update for Windows XP (KB2731847-v2)
Security Update for Windows XP (KB2761226)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982381)
Security Update for Windows XP (KB982665)
Shutterfly Express Uploader
Shutterfly Express Uploader
SlimDrivers
Smart PDF Converter 6.3.0.495
Sony Player Plug-in for Windows Media Player
Spybot - Search & Destroy
TranscriptPro 4
TurboTax 2010
TurboTax 2010 wflcbpm
TurboTax 2010 WinBizFedFormset
TurboTax 2010 WinBizReleaseEngine
TurboTax 2010 WinBizTaxSupport
TurboTax 2010 WinPerFedFormset
TurboTax 2010 WinPerReleaseEngine
TurboTax 2010 WinPerTaxSupport
TurboTax 2010 wrapper
TurboTax 2010 wrapper
TurboTax Business 2010
Unlocker 1.9.1
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB2447568)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676-v2)
Update for Windows XP (KB2641690)
Update for Windows XP (KB2661254-v2)
Update for Windows XP (KB2718704)
Update for Windows XP (KB2736233)
Update for Windows XP (KB2749655)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VersaCheck 2003 Personal Premier
VIA Platform Device Manager
VideoPad Video Editor
VPedal Windows Media Player 11 64bit Plug-in
VueMinder Pro
WavePad Sound Editor
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Service Pack 3
WinPcap 4.0.2
WinRAR 4.01 (32-bit)
WM Recorder
WM Recorder 11.3
WordPerfect Lightning
WordPerfect Lightning - EN
WordPerfect Lightning - IPM
WordPerfect Lightning - Messages
WordPerfect Lightning - MSOM
WordPerfect Office X4
WordPerfect Office X4
WordPerfect Office X4 - Common
WordPerfect Office X4 - Content
WordPerfect Office X4 - EN
WordPerfect Office X4 - Filters
WordPerfect Office X4 - Graphics
WordPerfect Office X4 - ICA
WordPerfect Office X4 - IPM
WordPerfect Office X4 - IPM EN
WordPerfect Office X4 - Migration Manager
WordPerfect Office X4 - PerfectExperts
WordPerfect Office X4 - PR
WordPerfect Office X4 - QP
WordPerfect Office X4 - Skins
WordPerfect Office X4 - System
WordPerfect Office X4 - WP
WordPerfect OfficeReady

Thank you, Cookiegal!


----------



## Cookiegal (Aug 27, 2003)

You are missing other updates for that version of .NET Framework so perhaps that's why it won't install.

Try installing these first:

http://www.microsoft.com/en-us/download/details.aspx?id=29364

http://www.microsoft.com/en-us/download/details.aspx?id=7351


----------



## shadowbird (Oct 9, 2012)

Okay, did that, but it failed again. The only updates I've chosen not to install is the ones for software that I don't have, i.e., Microsoft Office 2007.


----------



## Cookiegal (Aug 27, 2003)

Try clicking the FixIt button in method 1 in this MS article:

http://support.microsoft.com/kb/976982?wa=wsignin1.0#method1

Then after doing that, see if you can get the update to install manually.


----------



## shadowbird (Oct 9, 2012)

It downloaded a .diagcab file which windows says it cannot open.


----------



## Cookiegal (Aug 27, 2003)

I don't think we're going to be able to fix this here. I suggest you post on the Microsoft Answers Windows XP Updates forum for assistance:

http://answers.microsoft.com/en-us/windows/forum/windows_update?sort=LastReplyDate&dir=Desc


----------



## shadowbird (Oct 9, 2012)

Looks like the update might have finally taken. I'll check again when it reboots in the morning to be sure, but here's the latest: 

Installation Summary

Successful: 3 
Failed: 0 
Remaining: 0 

Successful Updates 
Microsoft Windows XP
Security Update for Microsoft .NET Framework 1.1 SP1 on Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2656370)
Security Update for Microsoft .NET Framework 1.1 SP1 on Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2698023)

Microsoft MS Security Essentials
Definition Update for Microsoft Security Essentials - KB2310138 (Definition 1.141.385.0)


----------



## shadowbird (Oct 9, 2012)

I'm not getting the message anymore. I'm going to create a new system restore point now. Do you have any suggestions for protecting my computer in the future? I was using Microsoft Security Essentials when I got those viruses. I switched to Google Chrome as per my son's suggestions - says he doesn't get viruses, but he also doesn't surf much. I do research.

Thanks, Cookiegal!


----------



## Cookiegal (Aug 27, 2003)

I'm glad it finally installed properly.

Microsoft Security Essentials is recommended by many Malware Removal Specialists so it should be adequate although I have no first-hand experience with it myself as of yet. If you want to pay for one then I'd go with Eset Smart Security or Kaspersky Internet Security.

I also haven't used Chrome but I use Firefox and with the NoScript add-on, it protects you from having unauthorized scripts running from web sites that aren't whitelisted or allowed because you trust them. You might also consider getting the WOT (Web Of Trust) add-on which rates how safe sites are. Kaspersky Internet Security also has this feature. Note that they rate whether sites are good or malicious based on known criteria so if a "good" site has had pages compromised (injected with malicious code) this would not be detected by those applications as they have no real-time capabilities. If a malicious script were to attempt to run then the real-time protection of your anti-virus/firewall may detect and block it but it may not, depending on whether or not the infection is recognized or gets picked up by heuristics (which is based on behaviour...it other words, it's acting like a virus so it could possibly be one).


----------



## shadowbird (Oct 9, 2012)

Thank you again for everything, Cookiegal, and I hope you enjoy a wonderful Christmas!


----------



## Cookiegal (Aug 27, 2003)

You're welcome and Happy Holidays to you too.


----------



## shadowbird (Oct 9, 2012)

Hi Cookiegal, my PC is freezing up a lot, especially when I'm using Outlook Express. I've run antivirus software and Spybot. No viruses found, but Spybot deleted some cookies and spyware. It all started right after I downloaded the updates from Microsoft online, that got rid of the Microsoft .NET Framework 1.1 SP1 issue.


----------



## Cookiegal (Aug 27, 2003)

What did SpyBot detect other than cookies?


----------



## shadowbird (Oct 9, 2012)

I didn't look close enough. I found the log report. Looks like just cookies:


--- Report generated: 2012-11-28 03:30 ---

Zedo: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


MediaPlex: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


DoubleClick: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


BurstMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


BurstMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


MediaPlex: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Zedo: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CoreMetrics: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


DoubleClick: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


MediaPlex: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


MediaPlex: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


MediaPlex: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


MediaPlex: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Zedo: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CoreMetrics: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CasaleMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


BurstMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


BurstMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


BurstMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


BurstMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CasaleMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CasaleMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Zedo: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Zedo: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Zedo: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


WebTrends live: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


DoubleClick: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


BurstMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CasaleMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


DoubleClick: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


DoubleClick: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


BurstMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CasaleMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Statcounter: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


FastClick: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


MediaPlex: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Zedo: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Zedo: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


BurstMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CasaleMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CasaleMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


Zedo: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CasaleMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


BurstMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CasaleMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CasaleMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CasaleMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CasaleMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


CasaleMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


DoubleClick: Tracking cookie (Chrome: Chrome) (Cookie, fixed)


BurstMedia: Tracking cookie (Chrome: Chrome) (Cookie, fixed)



--- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---

2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-03-05 TeaTimer.exe (1.6.6.32)
2012-07-27 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-11-04 advcheck.dll (1.6.5.20)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2009-01-26 Tools.dll (2.1.6.10)
2009-01-16 UninsSrv.dll (1.0.0.0)
2012-11-20 Includes\Adware.sbi (*)
2012-11-21 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2012-11-14 Includes\iPhone.sbi (*)
2012-11-14 Includes\Keyloggers.sbi (*)
2012-11-14 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2012-11-21 Includes\Malware.sbi (*)
2012-11-21 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2012-11-21 Includes\PUPSC.sbi (*)
2010-01-25 Includes\Revision.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2012-11-14 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2012-11-14 Includes\Spyware.sbi (*)
2012-11-14 Includes\SpywareC.sbi (*)
2012-11-19 Includes\Tracks.uti
2012-11-14 Includes\Trojans.sbi (*)
2012-11-14 Includes\TrojansC-02.sbi (*)
2012-11-21 Includes\TrojansC-03.sbi (*)
2012-11-14 Includes\TrojansC-04.sbi (*)
2012-11-14 Includes\TrojansC-05.sbi (*)
2012-11-14 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll


----------



## shadowbird (Oct 9, 2012)

I just deleted the Windows Live programs that came with the windows updates, and it's not freezing up anymore.


----------



## Cookiegal (Aug 27, 2003)

What Windows Live programs came with the updates?


----------



## shadowbird (Oct 9, 2012)

I didn't use them, so it's hard to recall except that they were optional and I only chose a few. One said something about a "writing tool." 

It's a lot better, but I've noticed it still freezes up when I try to do more than one thing.


----------



## shadowbird (Oct 9, 2012)

Okay, I remember now. It was a Windows Live package of some sort. It included the Windows live email but I didn't install that one.


----------



## shadowbird (Oct 9, 2012)

Hi Cookiegal, I went on to last night let you know that it's still freezing up, but it wa freezing up too much to get it posted! I ran a few programs which found nothing. Do you need a report or anything?


----------



## Cookiegal (Aug 27, 2003)

Sorry I didn't reply sooner. 

I've never seen Windows Live install automatically.

Yes, let's please run OTL again and post the new log.


----------



## shadowbird (Oct 9, 2012)

Thank you, Cookie!!

It didn't automatically download the Windows Live files. I selected about three of them. Here's the log:

OTL logfile created on: 12/3/2012 11:26:21 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Francie\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.39 Gb Available Physical Memory | 73.46% Memory free
5.09 Gb Paging File | 4.45 Gb Available in Paging File | 87.42% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298.08 Gb Total Space | 83.45 Gb Free Space | 28.00% Space Free | Partition Type: NTFS

Computer Name: FRANCIE-PC | User Name: Francie | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/12/03 23:25:37 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Francie\My Documents\Downloads\OTL.exe
PRC - [2012/11/27 22:43:18 | 001,242,728 | ---- | M] (Google Inc.) -- C:\Documents and Settings\Francie\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
PRC - [2012/09/23 09:28:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012/09/13 20:14:48 | 004,646,472 | R--- | M] (Carbonite, Inc. (www.carbonite.com)) -- C:\Program Files\Carbonite\Carbonite Backup\CarboniteService.exe
PRC - [2012/09/13 20:14:48 | 001,065,032 | R--- | M] (Carbonite, Inc.) -- C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
PRC - [2012/09/12 16:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2012/09/12 16:19:44 | 000,947,176 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2012/04/12 04:27:08 | 000,069,640 | ---- | M] (Nalpeiron Ltd.) -- C:\WINDOWS\system32\NLSSRV32.EXE
PRC - [2010/08/23 19:21:40 | 000,013,672 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/07/24 11:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
PRC - [2004/09/29 12:14:36 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe
PRC - [1999/12/31 19:00:00 | 000,088,688 | ---- | M] (VIA Technologies, Inc.) -- C:\WINDOWS\system32\KaraokeSer.exe

========== Modules (No Company Name) ==========

MOD - [2012/11/27 22:43:17 | 000,460,904 | ---- | M] () -- C:\Documents and Settings\Francie\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.95\ppgooglenaclpluginchrome.dll
MOD - [2012/11/27 22:43:16 | 012,456,040 | ---- | M] () -- C:\Documents and Settings\Francie\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.95\PepperFlash\pepflashplayer.dll
MOD - [2012/11/27 22:43:15 | 004,008,040 | ---- | M] () -- C:\Documents and Settings\Francie\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.95\pdf.dll
MOD - [2012/11/27 22:42:30 | 000,587,880 | ---- | M] () -- C:\Documents and Settings\Francie\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.95\libglesv2.dll
MOD - [2012/11/27 22:42:29 | 000,124,520 | ---- | M] () -- C:\Documents and Settings\Francie\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.95\libegl.dll
MOD - [2012/11/27 22:42:22 | 000,157,304 | ---- | M] () -- C:\Documents and Settings\Francie\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.95\avutil-51.dll
MOD - [2012/11/27 22:42:21 | 002,168,952 | ---- | M] () -- C:\Documents and Settings\Francie\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.95\avcodec-54.dll
MOD - [2012/11/27 22:42:21 | 000,275,576 | ---- | M] () -- C:\Documents and Settings\Francie\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.95\avformat-54.dll
MOD - [2012/11/24 19:16:08 | 003,194,880 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
MOD - [2012/11/24 19:16:05 | 002,933,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2012/11/24 19:16:04 | 000,425,984 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
MOD - [2012/11/24 19:15:54 | 000,630,784 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
MOD - [2012/11/24 19:15:53 | 000,303,104 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
MOD - [2012/11/24 19:15:51 | 000,258,048 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
MOD - [2012/11/24 19:15:49 | 000,261,632 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2012/11/24 19:15:48 | 002,048,000 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll
MOD - [2012/11/24 19:15:45 | 000,114,688 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
MOD - [2012/11/24 19:15:35 | 005,025,792 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
MOD - [2012/11/24 15:03:08 | 000,212,992 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\31b7eef43a23e7c6e93594be583f3d08\System.ServiceProcess.ni.dll
MOD - [2012/11/24 14:47:38 | 007,977,472 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\90ad0c96693527ae685ff40019bb33b0\System.ni.dll
MOD - [2012/11/24 14:47:33 | 011,492,352 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\3add69b075f3da012fb97ce00cd795c0\mscorlib.ni.dll
MOD - [2011/09/20 13:26:26 | 000,854,016 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Data.SQLite\1.0.61.0__db937bc2d44ff139\System.Data.SQLite.dll
MOD - [2011/09/20 13:26:25 | 000,476,520 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Map.Reporter\5.0.136.0__7ce6deabcb36a8ea\Intuit.Spc.Map.Reporter.dll
MOD - [2011/09/20 13:26:25 | 000,409,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Map.WindowsFirewallUtilities\5.0.136.0__7ce6deabcb36a8ea\Intuit.Spc.Map.WindowsFirewallUtilities.dll
MOD - [2011/09/20 13:26:23 | 000,046,952 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateServicePlugin\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateServicePlugin.dll
MOD - [2011/09/20 13:26:23 | 000,023,912 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateService\1.0.0.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateService.dll
MOD - [2011/09/20 13:26:23 | 000,018,792 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Ipc.Remoting.UpdateServiceWorker\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Ipc.Remoting.UpdateServiceWorker.dll
MOD - [2011/09/20 13:26:23 | 000,012,136 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateService.PluginContract\1.0.0.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateService.PluginContract.dll
MOD - [2011/09/20 13:26:22 | 000,421,224 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Api.Net\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Api.Net.dll
MOD - [2011/09/20 13:26:22 | 000,269,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Core\3.1.26.0__540d4816ead86321\Intuit.Spc.Esd.Core.dll
MOD - [2011/09/20 13:26:21 | 000,120,168 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.DataAccess\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.Client.DataAccess.dll
MOD - [2011/09/20 13:26:21 | 000,070,504 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.Common\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.Client.Common.dll
MOD - [2011/09/20 13:26:20 | 000,121,704 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.BusinessLogic\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.Client.BusinessLogic.dll
MOD - [2011/09/20 13:15:26 | 000,755,712 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Data.SQLite\1.0.56.0__28c9bcd4dddc48a1\System.Data.SQLite.dll
MOD - [2011/09/20 13:15:21 | 000,270,336 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\log4net\1.2.10.0__1b44e1d426115821\log4net.dll
MOD - [2011/09/20 13:15:19 | 001,058,304 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Map.WindowsFirewallUtilities\4.0.114.0__7ce6deabcb36a8ea\Intuit.Spc.Map.WindowsFirewallUtilities.dll
MOD - [2011/09/20 13:15:18 | 000,471,040 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Map.Reporter\4.0.114.0__7ce6deabcb36a8ea\Intuit.Spc.Map.Reporter.dll
MOD - [2011/09/20 13:15:16 | 000,458,752 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Foundations.Portability\3.1.2.2__540d4816ead86321\Intuit.Spc.Foundations.Portability.dll
MOD - [2011/09/20 13:15:16 | 000,065,536 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Foundations.Primary.ExceptionHandling\3.1.2.2__540d4816ead86321\Intuit.Spc.Foundations.Primary.ExceptionHandling.dll
MOD - [2011/09/20 13:15:16 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Foundations.Primary.Logging\3.1.2.2__540d4816ead86321\Intuit.Spc.Foundations.Primary.Logging.dll
MOD - [2011/09/20 13:15:12 | 000,073,728 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Foundations.Primary.Config\3.1.2.2__540d4816ead86321\Intuit.Spc.Foundations.Primary.Config.dll
MOD - [2011/09/20 13:15:11 | 000,402,208 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Api.Net\2.1.72.22__540d4816ead86321\Intuit.Spc.Esd.WinClient.Api.Net.dll
MOD - [2011/09/20 13:15:11 | 000,047,392 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateServicePlugin\2.1.72.22__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateServicePlugin.dll
MOD - [2011/09/20 13:15:11 | 000,018,720 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Ipc.Remoting.UpdateServiceWorker\2.1.72.22__540d4816ead86321\Intuit.Spc.Esd.WinClient.Ipc.Remoting.UpdateServiceWorker.dll
MOD - [2011/09/20 13:15:10 | 000,238,368 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Core\2.0.145.4__540d4816ead86321\Intuit.Spc.Esd.Core.dll
MOD - [2011/09/20 13:15:10 | 000,130,848 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.BusinessLogic\2.1.72.22__540d4816ead86321\Intuit.Spc.Esd.Client.BusinessLogic.dll
MOD - [2011/09/20 13:15:10 | 000,120,608 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.DataAccess\2.1.72.22__540d4816ead86321\Intuit.Spc.Esd.Client.DataAccess.dll
MOD - [2011/09/20 13:15:10 | 000,072,992 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.Common\2.1.72.22__540d4816ead86321\Intuit.Spc.Esd.Client.Common.dll
MOD - [2010/06/06 09:20:02 | 000,065,344 | ---- | M] () -- C:\WINDOWS\system32\PDFreDirectMonNT.dll
MOD - [2008/04/13 19:11:59 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2008/04/13 19:11:51 | 000,059,904 | ---- | M] () -- C:\WINDOWS\system32\devenum.dll
MOD - [2001/10/28 16:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll

========== Services (SafeList) ==========

SRV - [2012/11/15 11:04:36 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/09/29 18:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Disabled | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/09/29 18:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Disabled | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012/09/23 09:28:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012/09/13 20:14:48 | 004,646,472 | R--- | M] (Carbonite, Inc. (www.carbonite.com)) [Auto | Running] -- C:\Program Files\Carbonite\Carbonite Backup\CarboniteService.exe -- (CarboniteService)
SRV - [2012/09/12 16:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012/04/12 04:27:08 | 000,069,640 | ---- | M] (Nalpeiron Ltd.) [Auto | Running] -- C:\WINDOWS\system32\NLSSRV32.EXE -- (nlsX86cc)
SRV - [2012/02/04 07:40:44 | 000,045,056 | ---- | M] (Intuit) [Disabled | Stopped] -- C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe -- (QBCFMonitorService)
SRV - [2011/06/25 11:59:55 | 000,161,776 | ---- | M] (Bsecure Technologies, Inc.) [Disabled | Stopped] -- C:\Program Files\Bsecure\BsecAV.exe -- (BsecureAV)
SRV - [2011/06/25 11:59:34 | 000,066,344 | ---- | M] (Bsecure Technologies, Inc.) [Disabled | Stopped] -- C:\Program Files\Bsecure\InetCtrl.exe -- (Bsecure)
SRV - [2010/11/29 10:41:26 | 000,058,944 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper_3004.dll -- (nosGetPlusHelper)
SRV - [2010/08/23 19:21:40 | 000,013,672 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)
SRV - [2009/07/23 21:10:38 | 000,061,440 | ---- | M] (Intuit Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe -- (QBFCService)
SRV - [2007/11/06 15:22:26 | 000,092,792 | ---- | M] (CACE Technologies) [Disabled | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd)
SRV - [2007/07/24 11:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto | Running] -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2004/09/29 12:14:36 | 000,069,632 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [1999/12/31 19:00:00 | 000,088,688 | ---- | M] (VIA Technologies, Inc.) [Auto | Running] -- C:\WINDOWS\system32\KaraokeSer.exe -- (KaraokeService)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\PfModNT.sys -- (PfModNT)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\AtihdXP3.sys -- (AtiHDAudioService)
DRV - [2012/11/30 10:06:43 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2012/09/29 18:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012/07/04 01:54:32 | 007,874,560 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2012/07/03 10:25:19 | 000,124,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvhda32.sys -- (NVHDA)
DRV - [2012/01/12 08:26:20 | 000,101,112 | R--- | M] (GFI Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\SBREDrv.sys -- (SBRE)
DRV - [2011/06/25 19:56:44 | 000,028,256 | ---- | M] (Applian Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\appliand.sys -- (appliandMP)
DRV - [2011/06/25 19:56:44 | 000,028,256 | ---- | M] (Applian Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\appliand.sys -- (appliand)
DRV - [2010/07/06 03:13:10 | 000,234,392 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2010/04/26 14:23:50 | 000,049,088 | ---- | M] (BSafe Online) [File_System | Boot | Unknown] -- C:\WINDOWS\system32\drivers\BsecFltr.sys -- (BsecureFilter)
DRV - [2010/04/23 04:52:36 | 001,220,224 | R--- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hcw72DTV.sys -- (hcw72DTV)
DRV - [2010/04/23 04:48:42 | 001,217,920 | R--- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hcw72ATV.sys -- (hcw72ATV)
DRV - [2010/04/23 04:47:39 | 000,028,928 | R--- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hcw72ADFilter.sys -- (hcw72ADFilter)
DRV - [2010/02/05 12:40:12 | 000,021,624 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BSecACFltr.sys -- (BSecACFltr)
DRV - [2009/12/30 11:20:56 | 000,027,064 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\revoflt.sys -- (Revoflt)
DRV - [2008/04/13 13:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2008/04/13 13:45:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2008/04/13 12:46:22 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MPE.sys -- (MPE)
DRV - [2007/11/06 15:22:06 | 000,034,064 | ---- | M] (CACE Technologies) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\npf.sys -- (NPF)
DRV - [2007/07/20 18:40:10 | 000,084,992 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2007/04/16 21:46:00 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM)
DRV - [2006/11/29 00:46:24 | 000,028,224 | R--- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\APLMp50.sys -- (APLMp50)
DRV - [2001/08/17 07:19:34 | 000,036,480 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sfmanm.sys -- (sfman)
DRV - [2001/08/17 07:19:28 | 000,006,912 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctlfacem.sys -- (emu10k1)
DRV - [2001/08/17 07:19:26 | 000,283,904 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emu10k1m.sys -- (emu10k)
DRV - [2001/08/17 07:19:20 | 000,003,712 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctljystk.sys -- (ctljystk)
DRV - [1999/12/31 19:00:00 | 002,551,664 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV - [1999/12/31 19:00:00 | 000,043,392 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usbfilter.sys -- (usbfilter)
DRV - [1999/12/31 19:00:00 | 000,014,095 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LCcfltr.sys -- (LCcfltr)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={sea...putEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://forums.techguy.org/virus-other-malware-removal/1072157-blue-screen-after-root-kit-7.html
IE - HKCU\..\SearchScopes,DefaultScope = {0B3C8ACC-26EE-4A59-91B7-076916F5A9B4}
IE - HKCU\..\SearchScopes\{0B3C8ACC-26EE-4A59-91B7-076916F5A9B4}: "URL" = http://www.google.com/search?q={sea...ource}&ie={inputEncoding?}&oe={outputEncoding?}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.2
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..network.proxy.type: 0
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=827316&p="
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316"
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=827316&p="
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316"

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37: C:\WINDOWS\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nosltd.com/getPlus+(R),version=1.6.2.97: C:\Program Files\NOS\bin\np_gp.dll (NOS Microsystems Ltd.)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.6.14: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.6.14: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.6.14: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.6.14: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.6.14: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Francie\Local Settings\Application Data\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Francie\Local Settings\Application Data\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: c:\Program Files\Corel\WordPerfect Lightning\Programs\FirefoxExtension\ [2012/06/12 00:33:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0153E448-190B-4987-BDE1-F256CADA672F}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/11/28 04:13:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/08/20 23:17:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/11/28 04:13:39 | 000,000,000 | ---D | M]

[2011/03/24 01:15:44 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Francie\Application Data\Mozilla\Extensions
[2012/10/18 11:51:33 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\0tdbrp4t.default\extensions
[2011/02/24 16:47:56 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\0tdbrp4t.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}(2)
[2012/11/17 15:45:11 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions
[2004/08/04 07:00:00 | 000,004,804 | ---- | M] () (No name found) -- C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\0tdbrp4t.default\extensions\[email protected]
[2012/05/19 12:43:01 | 000,049,353 | ---- | M] () (No name found) -- C:\Documents and Settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\extensions\[email protected]
[2012/11/17 14:11:59 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/11/15 18:40:31 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}
[2012/11/17 14:12:00 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2012/06/14 17:20:49 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/08/19 23:50:03 | 000,466,944 | ---- | M] (Catalina Marketing Corporation) -- C:\Program Files\mozilla firefox\plugins\NPcol400.dll
[2012/11/28 04:13:00 | 000,129,176 | ---- | M] (RealPlayer) -- C:\Program Files\mozilla firefox\plugins\nprpplugin.dll
[2012/06/14 17:19:40 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010/01/01 03:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml.old
[2012/06/14 17:19:40 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://forums.techguy.org/virus-other-malware-removal/1072157-blue-screen-after-root-kit-8.html
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR - homepage: http://forums.techguy.org/virus-other-malware-removal/1072157-blue-screen-after-root-kit-8.html
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Francie\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.95\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.270.7 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U27 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\Francie\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.95\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\Francie\Local Settings\Application Data\Google\Chrome\Application\23.0.1271.95\pdf.dll
CHR - plugin: CouponNetwork Coupon Activator Netscape Plugin v. 5.0.0.0 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPcol400.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\Francie\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: getPlusPlus for Adobe 16297 (Enabled) = C:\Program Files\NOS\bin\np_gp.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Entanglement = C:\Documents and Settings\Francie\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd\2.7.9_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Documents and Settings\Francie\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: Poppit = C:\Documents and Settings\Francie\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi\2.2_0\

O1 HOSTS File: ([2012/11/28 01:04:25 | 000,444,086 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 15279 more lines...
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe (Carbonite, Inc.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe ()
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Copy to &Lightning Note - C:\Program Files\Corel\WordPerfect Lightning\Programs\WPLightningCopyToNote.hta ()
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Open with WordPerfect - c:\Program Files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Program Files\Bsecure\InetCtrl57.dll (Bsecure Technologies, Inc.)
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKCU\..Trusted Domains: localhost ([]* in Local intranet)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlcdnet.asus.com/pub/ASUS/misc/dlm-activex-2.2.5.0.cab (DLM Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1353389503625 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 65.32.5.111 65.32.5.112
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1AD616B8-0534-4FB2-85E2-82645C155B2F}: DhcpNameServer = 65.32.5.111 65.32.5.112
O18 - Protocol\Handler\g7ps {9EACF0FB-4FC7-436E-989B-3197142AD979} - C:\Program Files\Common Files\G7PS\Shared Files\G7PSDLL\G7PS.dll (G7 Productivity Systems, Inc.)
O18 - Protocol\Handler\intu-help-qb3 {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - C:\Program Files\Intuit\QuickBooks 2010\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Francie\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Francie\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/01/11 01:23:40 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/11/30 10:06:43 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/11/28 04:13:22 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\xing shared
[2012/11/28 04:13:07 | 000,198,864 | ---- | C] (RealNetworks, Inc.) -- C:\WINDOWS\System32\rmoc3260.dll
[2012/11/28 04:12:56 | 000,006,656 | ---- | C] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5016.dll
[2012/11/28 04:12:56 | 000,005,632 | ---- | C] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5032.dll
[2012/11/28 04:12:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\RealNetworks
[2012/11/28 03:34:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2012/11/28 03:34:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PC Tools
[2012/11/28 03:34:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Francie\Application Data\TestApp
[2012/11/24 19:16:45 | 000,000,000 | ---D | C] -- C:\f558eb6da702717e6660d59c629d
[2012/11/24 18:50:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\URTTemp
[2012/11/24 15:37:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office Live Add-in
[2012/11/24 14:58:33 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft
[2012/11/24 14:57:42 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_32.dll
[2012/11/24 14:55:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Francie\Application Data\Windows Search
[2012/11/24 14:35:25 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\WindowsPowerShell
[2012/11/24 14:35:24 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\winrm
[2012/11/24 14:35:21 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$968930Uinstall_KB968930$
[2012/11/24 14:33:21 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Desktop Search
[2012/11/24 14:31:57 | 000,098,304 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nlhtml.dll
[2012/11/24 14:31:57 | 000,029,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mimefilt.dll
[2012/11/24 14:31:56 | 000,192,000 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\offfilt.dll
[2012/11/19 16:52:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Francie\Local Settings\Application Data\VS Revo Group
[2012/11/19 16:52:05 | 000,027,064 | ---- | C] (VS Revo Group) -- C:\WINDOWS\System32\drivers\revoflt.sys
[2012/11/19 16:52:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Revo Uninstaller Pro
[2012/11/19 16:52:02 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2012/11/17 14:12:18 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2012/11/17 14:12:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Ask
[2012/11/17 14:11:58 | 000,157,680 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2012/11/17 14:11:58 | 000,149,488 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2012/11/17 14:11:58 | 000,149,488 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2012/11/15 22:31:51 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2012/11/15 18:40:29 | 000,477,168 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\npdeployJava1.dll
[2012/11/15 18:40:29 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2012/11/15 12:26:51 | 016,992,248 | ---- | C] (Sun Microsystems, Inc.) -- C:\Documents and Settings\Francie\Desktop\jre-6u34-windows-i586.exe
[2012/11/15 11:04:35 | 000,697,272 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/11/11 23:51:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NVIDIA Corporation
[2012/11/11 23:51:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NVIDIA
[2012/11/11 23:50:03 | 000,884,072 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvhdagenco3220103.dll
[2012/11/11 23:50:03 | 000,124,264 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\drivers\nvhda32.sys
[2012/11/11 23:50:03 | 000,028,008 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvhdap32.dll
[2012/11/11 23:50:02 | 005,947,392 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvopencl.dll
[2012/11/11 23:50:02 | 001,009,512 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvdispco32.dll
[2012/11/11 23:50:02 | 000,888,168 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvdispgenco32.dll
[2012/11/11 23:25:43 | 000,061,440 | ---- | C] (Khronos Group) -- C:\WINDOWS\System32\OpenCL.dll
[2012/11/11 23:25:42 | 019,103,744 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvoglnt.dll
[2012/11/11 23:25:42 | 007,446,528 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvcuda.dll
[2012/11/11 23:25:42 | 002,578,792 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvcuvid.dll
[2012/11/11 23:25:42 | 001,866,088 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvcuvenc.dll
[2012/11/11 23:25:42 | 000,941,160 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvdispco322090.dll
[2012/11/11 23:25:42 | 000,837,736 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvgenco322040.dll
[2012/11/11 23:25:41 | 017,551,360 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvcompiler.dll
[2012/11/11 23:25:41 | 002,376,704 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvapi.dll
[2012/11/11 23:16:19 | 012,557,728 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\dllcache\nv4_mini.sys
[2012/11/08 14:15:26 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\adpu160m.sys
[2012/11/08 14:15:25 | 000,046,112 | ---- | C] (Adaptec, Inc ) -- C:\WINDOWS\System32\dllcache\adptsf50.sys
[2012/11/08 14:15:04 | 000,747,392 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\adm8830.sys
[2012/11/08 14:15:04 | 000,010,880 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\admjoy.sys
[2012/11/08 14:15:03 | 000,584,448 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\adm8810.sys
[2012/11/08 14:15:03 | 000,553,984 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\adm8820.sys
[2012/11/08 14:15:03 | 000,020,160 | ---- | C] (ADMtek Incorporated) -- C:\WINDOWS\System32\dllcache\adm8511.sys
[2012/11/08 14:15:03 | 000,007,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\adicvls.sys
[2012/11/08 14:15:01 | 000,297,728 | ---- | C] (Silicon Integrated Systems Corp.) -- C:\WINDOWS\System32\dllcache\ac97sis.sys
[2012/11/08 14:15:01 | 000,084,480 | ---- | C] (VIA Technologies, Inc.) -- C:\WINDOWS\System32\dllcache\ac97via.sys
[2012/11/08 14:15:01 | 000,061,440 | ---- | C] (Color Flatbed Scanner) -- C:\WINDOWS\System32\dllcache\acerscad.dll
[2012/11/08 14:15:00 | 000,462,848 | ---- | C] (Aureal Inc.) -- C:\WINDOWS\System32\dllcache\a3dapi.dll
[2012/11/08 14:15:00 | 000,231,552 | ---- | C] (Acer Laboratories Inc.) -- C:\WINDOWS\System32\dllcache\ac97ali.sys
[2012/11/08 14:15:00 | 000,096,256 | ---- | C] (Intel Corporation) -- C:\WINDOWS\System32\dllcache\ac97intc.sys
[2012/11/08 14:15:00 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\abp480n5.sys
[2012/11/08 14:14:59 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\61883.sys
[2012/11/08 14:14:59 | 000,038,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\8514a.dll
[2012/11/08 14:14:58 | 000,762,780 | ---- | C] (3Com, Inc.) -- C:\WINDOWS\System32\dllcache\3cwmcru.sys
[2012/11/08 14:14:58 | 000,689,216 | ---- | C] (3dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\3dfxvs.dll
[2012/11/08 14:14:58 | 000,148,352 | ---- | C] (3dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\3dfxvsm.sys
[2012/11/08 14:14:58 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\4mmdat.sys
[2012/11/08 14:14:58 | 000,011,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\1394vdbg.sys
[2012/11/08 14:14:57 | 000,053,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\1394bus.sys
[2012/11/08 14:14:33 | 000,066,048 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\s3legacy.dll
[2012/11/05 12:00:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Bsecure Endpoint Security
[2012/11/05 12:00:44 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Windows Microsoft Shared
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/12/03 23:18:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/12/03 22:57:48 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\scribeShakeIcon.job
[2012/12/03 22:43:22 | 000,577,332 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/12/03 22:43:22 | 000,104,576 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/12/03 22:41:47 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/12/03 22:41:47 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/12/03 22:41:46 | 000,000,286 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1007.job
[2012/12/03 22:41:46 | 000,000,286 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1006.job
[2012/12/03 22:41:46 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1003.job
[2012/12/03 22:41:46 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1005.job
[2012/12/03 22:39:00 | 000,000,888 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/12/03 22:34:00 | 000,000,986 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-616249376-839522115-1003UA.job
[2012/12/03 22:32:57 | 000,000,384 | -H-- | M] () -- C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2012/12/03 22:22:48 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/12/03 21:51:41 | 000,000,426 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{259297A0-4E67-4E79-897A-4C8098A85E45}.job
[2012/12/03 18:14:22 | 000,001,682 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2012/12/03 17:34:00 | 000,000,934 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-616249376-839522115-1003Core.job
[2012/12/03 00:16:00 | 000,000,272 | ---- | M] () -- C:\WINDOWS\tasks\prismShakeIcon.job
[2012/12/01 03:28:00 | 000,000,294 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1006.job
[2012/11/30 10:06:43 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/11/29 23:36:16 | 000,002,278 | ---- | M] () -- C:\Documents and Settings\Francie\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/11/28 04:14:28 | 000,000,290 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1003.job
[2012/11/28 04:13:34 | 000,000,747 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\RealPlayer.lnk
[2012/11/28 04:13:07 | 000,198,864 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\rmoc3260.dll
[2012/11/28 04:12:56 | 000,006,656 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5016.dll
[2012/11/28 04:12:56 | 000,005,632 | ---- | M] (RealNetworks, Inc.) -- C:\WINDOWS\System32\pndx5032.dll
[2012/11/28 04:12:55 | 000,272,896 | ---- | M] (Progressive Networks) -- C:\WINDOWS\System32\pncrt.dll
[2012/11/28 01:04:25 | 000,444,086 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2012/11/28 01:04:07 | 000,444,086 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20121128-010425.backup
[2012/11/24 19:44:35 | 000,204,120 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/11/24 16:26:08 | 000,265,598 | ---- | M] () -- C:\Documents and Settings\Francie\Desktop\dotnetfx_cleanup_tool.zip
[2012/11/24 15:37:48 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/11/24 13:09:35 | 000,079,686 | ---- | M] () -- C:\Documents and Settings\Francie\Desktop\windowsupdate.diagcab
[2012/11/21 22:50:11 | 000,072,552 | ---- | M] () -- C:\Documents and Settings\Francie\Desktop\ducks562642386_n.jpg
[2012/11/21 17:16:00 | 000,000,294 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1007.job
[2012/11/21 11:54:00 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1005.job
[2012/11/20 00:20:45 | 000,000,272 | ---- | M] () -- C:\WINDOWS\tasks\prismDowngrade.job
[2012/11/19 16:52:07 | 000,000,925 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Revo Uninstaller Pro.lnk
[2012/11/17 15:47:42 | 000,038,193 | ---- | M] () -- C:\WINDOWS\Irremote.ini
[2012/11/15 12:26:53 | 016,992,248 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\Francie\Desktop\jre-6u34-windows-i586.exe
[2012/11/15 11:04:35 | 000,697,272 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/11/15 11:04:35 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/11/14 21:20:23 | 000,264,848 | ---- | M] () -- C:\Documents and Settings\Francie\Desktop\celeb16.com-grey-wide-strap-tea-length-pewter-satin-bridesmaid-dress-g101-30.png
[2012/11/11 23:50:35 | 001,101,436 | ---- | M] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2012/11/11 23:50:35 | 000,000,001 | ---- | M] () -- C:\WINDOWS\System32\nvdrssel.bin
[2012/11/11 23:50:33 | 001,101,436 | ---- | M] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2012/11/11 23:31:36 | 000,009,220 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/11/11 23:26:26 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\nvdrswr.lk
[2012/11/10 03:18:49 | 000,444,036 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20121128-010407.backup
[2012/11/09 18:21:50 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20121110-031849.backup
[2012/11/08 12:09:55 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2012/11/05 22:28:00 | 000,000,288 | ---- | M] () -- C:\WINDOWS\tasks\doxillionShakeIcon.job
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/12/03 22:57:48 | 000,000,282 | ---- | C] () -- C:\WINDOWS\tasks\scribeShakeIcon.job
[2012/11/28 04:13:34 | 000,000,747 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\RealPlayer.lnk
[2012/11/24 16:26:05 | 000,265,598 | ---- | C] () -- C:\Documents and Settings\Francie\Desktop\dotnetfx_cleanup_tool.zip
[2012/11/24 13:09:30 | 000,079,686 | ---- | C] () -- C:\Documents and Settings\Francie\Desktop\windowsupdate.diagcab
[2012/11/21 22:50:10 | 000,072,552 | ---- | C] () -- C:\Documents and Settings\Francie\Desktop\ducks562642386_n.jpg
[2012/11/19 16:52:07 | 000,000,925 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Revo Uninstaller Pro.lnk
[2012/11/15 11:07:55 | 000,002,315 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader XI.lnk
[2012/11/15 11:04:37 | 000,000,830 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/11/14 21:20:21 | 000,264,848 | ---- | C] () -- C:\Documents and Settings\Francie\Desktop\celeb16.com-grey-wide-strap-tea-length-pewter-satin-bridesmaid-dress-g101-30.png
[2012/11/11 23:50:02 | 002,811,988 | ---- | C] () -- C:\WINDOWS\System32\nvdata.data
[2012/11/11 23:26:29 | 001,101,436 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2012/11/11 23:26:26 | 001,101,436 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2012/11/11 23:26:26 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2012/11/11 23:26:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\nvdrswr.lk
[2012/11/11 23:25:42 | 002,293,138 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin
[2012/11/11 23:25:42 | 000,012,210 | ---- | C] () -- C:\WINDOWS\System32\nvinfo.pb
[2012/10/31 14:23:10 | 000,021,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\BSecACFltr.sys
[2012/10/15 21:10:52 | 000,000,036 | ---- | C] () -- C:\WINDOWS\avgui.INI
[2012/10/09 13:48:29 | 000,006,096 | RHS- | C] () -- C:\Documents and Settings\All Users\ntuser.pol
[2012/09/18 00:03:23 | 000,116,360 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2012/09/16 09:33:47 | 000,725,878 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1614895754-616249376-839522115-1003-0.dat
[2012/09/16 09:33:46 | 000,207,962 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2012/09/14 20:05:46 | 000,000,590 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Microsoft.SqlServer.Compact.400.32.bc
[2012/09/12 13:34:01 | 000,020,260 | ---- | C] () -- C:\Documents and Settings\Francie\.recently-used.xbel
[2012/08/29 12:48:48 | 000,541,404 | ---- | C] () -- C:\Documents and Settings\Francie\Francie 2012 Pic.jpg
[2012/02/14 21:40:47 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/01/26 03:42:35 | 000,001,202 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2012/01/09 01:49:41 | 000,000,000 | ---- | C] () -- C:\WINDOWS\hpqEmlSz.INI
[2011/11/04 01:25:57 | 000,007,312 | ---- | C] () -- C:\Program Files\TranscriptPro.pdf
[2011/10/12 16:42:28 | 000,000,067 | ---- | C] () -- C:\WINDOWS\iltwain.ini
[2011/09/22 18:00:47 | 000,144,418 | ---- | C] () -- C:\Documents and Settings\Francie\Application Data\VideoPad.dmp
[2011/08/17 18:22:41 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Francie\Local Settings\Application Data\SU0.MPG
[2011/08/17 17:01:39 | 000,080,480 | ---- | C] () -- C:\Documents and Settings\Francie\Local Settings\Application Data\Schedule8.dat
[2011/06/29 11:36:20 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Francie\SU0.MPG
[2011/06/19 12:47:17 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll
[2011/05/22 12:45:45 | 000,109,061 | ---- | C] () -- C:\Documents and Settings\Francie\Application Data\Scribe.dmp
[2011/05/17 09:46:14 | 000,038,193 | ---- | C] () -- C:\WINDOWS\Irremote.ini
[2011/05/17 09:45:52 | 000,142,337 | ---- | C] () -- C:\WINDOWS\System32\Wait.exe
[2011/05/17 09:44:20 | 000,008,082 | ---- | C] () -- C:\WINDOWS\HCWPNP.INI
[2011/05/17 09:43:09 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\PsisDecd.dll
[2011/02/27 20:51:43 | 000,000,130 | ---- | C] () -- C:\Documents and Settings\Francie\Local Settings\Application Data\fusioncache.dat
[2011/02/27 18:22:31 | 000,069,027 | ---- | C] () -- C:\WINDOWS\hpoins05.dat
[2011/02/27 18:22:31 | 000,019,696 | ---- | C] () -- C:\WINDOWS\hpomdl05.dat
[2011/02/24 16:00:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2011/02/09 19:54:58 | 003,973,120 | ---- | C] () -- C:\WINDOWS\System32\ffmpeg2.exe
[2011/02/04 01:10:44 | 000,001,682 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2011/02/01 19:37:35 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\dsp_trc.dll
[2011/01/20 09:56:09 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\rmc_rtspdl.dll
[2011/01/20 00:55:41 | 000,022,528 | ---- | C] () -- C:\Documents and Settings\Francie\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/19 16:45:07 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2011/01/18 02:06:58 | 000,000,090 | ---- | C] () -- C:\WINDOWS\QBChanUtil_Trigger.ini
[2011/01/17 23:29:23 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2011/01/17 23:29:22 | 000,618,823 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2011/01/17 23:29:22 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2011/01/17 21:25:23 | 000,009,220 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/01/17 09:37:01 | 000,009,206 | ---- | C] () -- C:\WINDOWS\NTTuner.ini
[2011/01/12 08:25:04 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Francie\jagex__preferences3.dat
[2011/01/11 13:35:15 | 000,000,483 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2011/01/11 02:09:20 | 000,080,416 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2011/01/11 02:08:29 | 000,001,769 | ---- | C] () -- C:\WINDOWS\Language_trs.ini
[2011/01/11 01:25:28 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011/01/11 01:21:09 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2011/01/10 17:11:37 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011/01/10 17:10:35 | 000,204,120 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/09/02 23:07:59 | 000,000,099 | ---- | C] () -- C:\Documents and Settings\Francie\jagex_runescape_preferences2.dat
[2010/09/02 23:06:37 | 000,000,046 | ---- | C] () -- C:\Documents and Settings\Francie\jagex_runescape_preferences.dat
[2010/01/01 22:09:57 | 000,000,288 | ---- | C] () -- C:\Documents and Settings\Francie\Application Data\MSKmisc.dat
[2010/01/01 22:09:56 | 000,000,288 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\PDF2XL-4-12.TrialData

========== ZeroAccess Check ==========

[2010/12/09 10:15:09 | 000,000,000 | -HSD | M] -- C:\WINDOWS\Installer\{8d5fdb31-6d03-5661-4abc-defd2d498237}\L
[2012/07/27 15:21:17 | 000,000,000 | -HSD | M] -- C:\WINDOWS\Installer\{8d5fdb31-6d03-5661-4abc-defd2d498237}\U
[2010/12/09 10:15:09 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Francie\Local Settings\Application Data\{8d5fdb31-6d03-5661-4abc-defd2d498237}\L
[2010/12/09 10:15:09 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Francie\Local Settings\Application Data\{8d5fdb31-6d03-5661-4abc-defd2d498237}\U
[2011/01/12 02:40:56 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/13 19:12:05 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 07:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/13 19:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
< End of report >


----------



## shadowbird (Oct 9, 2012)

OTL Extras logfile created on: 12/3/2012 11:26:21 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Francie\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.39 Gb Available Physical Memory | 73.46% Memory free
5.09 Gb Paging File | 4.45 Gb Available in Paging File | 87.42% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298.08 Gb Total Space | 83.45 Gb Free Space | 28.00% Space Free | Partition Type: NTFS

Computer Name: FRANCIE-PC | User Name: Francie | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabledxpsp2res.dll,-22009

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabledxpsp2res.dll,-22009
"5985:TCP" = 5985:TCP:*isabled:Windows Remote Management 
"80:TCP" = 80:TCP:*isabled:Windows Remote Management - Compatibility Mode (HTTP-In)

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Program Files\Bsecure\InetCtrl.exe" = C:\Program Files\Bsecure\InetCtrl.exe:*:Enabled:CloudCare -- (Bsecure Technologies, Inc.)
"C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe" = C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe:*:Enabledaemonu.exe -- (NVIDIA Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{DCDAB2ED-5741-4C30-A1A4-0FCB8A529001}" = WordPerfect Office X4
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{036AA4D4-6D32-11D4-9875-00105ACE7734}" = Logitech iTouch Software
"{05BDC796-3451-4F81-B91D-E98F7ADA76C2}" = TurboTax 2010 WinPerTaxSupport
"{069730C2-755A-485B-A205-27A1AAFA836A}" = InstantShareAlert
"{06A9E630-DBA6-4D92-9DE7-A235AA6496C7}" = QuickBooks
"{0700E22B-A422-40A5-BD20-04BF618CA0F9}" = QuickBooks Pro 2010
"{0DC86BEC-5CE3-413A-BB61-C40A3D186B24}" = Scan
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{14BEB6DF-A499-4A38-8E06-E173BCD5C087}" = ScannerCopy
"{17293791-C82E-476C-9997-9A0FF234A19B}" = HP Product Assistant
"{181821B7-82AA-44DA-9DAF-EF254CCB670A}" = Fax
"{1AD5F465-8282-4DAD-B957-E09C0B783D18}" = InstantShare
"{1B680FBA-E317-4E93-AF43-3B59798A4BE0}" = Copy
"{1DF03ECE-6AF4-414E-B118-C316F151A9A2}" = Corel WordPerfect Office - iFilter
"{1E91951D-0114-4692-8F55-F95E1B2F3542}" = SlimDrivers
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{20FBC0A0-3160-4F14-83ED-3A74BB6B8C31}" = TrayApp
"{26A24AE4-039D-4CA4-87B4-2F83216034FF}" = Java(TM) 6 Update 37
"{272EC8BA-5A08-4ea1-A189-684466A06B02}" = cp_dwShrek2Albums1
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2E8428AD-6CD2-4031-916A-3CF9BBF2DEC9}" = Unload
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{2FDD750F-49B7-40C1-9D5E-D2955BC0E2D8}" = NVIDIA PhysX
"{342C7C88-D335-4bc2-8CF1-281857629CE2}" = HP PSC & OfficeJet 4.7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3762DB2D-71BD-421F-9E55-C74DA7DF4D07}" = CueTour
"{3782EC09-4000-475E-8A59-9CABD6F03B4C}" = TurboTax 2010 WinPerFedFormset
"{391E18CE-7D3B-45E9-A8F0-34E77F14F47A}" = ProductContext
"{3B8E4062-F294-11D2-A432-00C04F756128}" = Microsoft Word Supplemental Macros
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D9892BB-A751-4E48-ADC8-E4289956CE1D}" = QuickTime
"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
"{442BE28B-782B-4DC0-B490-E70A403B1C69}" = Readme
"{4873CC58-69D8-490D-9E5C-001DC2EE2000}" = WordPerfect Lightning
"{4873CC58-69D8-490D-9E5C-001DC2EE2010}" = WordPerfect Lightning - Messages
"{4873CC58-69D8-490D-9E5C-001DC2EE2020}" = WordPerfect Lightning - IPM
"{4873CC58-69D8-490D-9E5C-001DC2EE2100}" = WordPerfect Lightning - EN
"{49C08D37-71A2-442B-B439-662F276498E3}" = 2600
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4F2FCCCF-29F3-44B9-886F-6D16F8417522}" = TurboTax 2010 wrapper
"{5866F83F-5347-4324-A15E-070502A65866}" = TurboTax 2010 WinBizReleaseEngine
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5E8D588F-307C-4250-B622-26969027319A}" = PanoStandAlone
"{614F4056-4E32-4FD4-A10E-9BAC4E1D7441}" = VersaCheck 2003 Personal Premier
"{6334BBB0-8A2E-4679-B845-9CE27E72DBDA}" = TurboTax 2010 WinBizTaxSupport
"{63688C0C-441B-B09B-97A3-B059D79A84F7}" = Shutterfly Express Uploader
"{644D04A2-C682-4FD5-977D-03B804C4B9C5}" = CreativeProjects
"{646A65DD-23FC-418E-B9F0-E0500FB42CB1}" = PhotoGallery
"{655CB07D-C944-40BE-B93F-55957CAC7625}" = AiO_Scan
"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.5.9
"{68963635-14A4-48D9-B431-DF3A74D1AAE1}" = Destinations
"{6AD9F5F3-5BD0-4000-BD9C-B536CF86D988}" = iTunes
"{6F146A80-8B4D-4248-B9F3-A182D988231C}" = 2600Trb
"{700A6597-3CE6-49C1-AA75-846B24CDA66D}" = BufferChm
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{724517BD-1DE1-4986-BFCA-C1DFD379E3BC}" = cp_dwShrek2Cards1
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{737D7CA8-D05C-46C7-AFED-A76616E8CA3B}" = WordPerfect OfficeReady
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7AD25C9F-9957-4D1C-95EF-9BCD09F6D31B}" = HPSystemDiagnostics
"{84449954-E321-4F81-8DFD-23A77C1FE13E}" = TurboTax 2010 wflcbpm
"{84CDF5A8-1D57-4B69-BAB6-1F11D8923375}" = SkinsHP1
"{85CFD253-38AE-4DB1-ACB7-F0F4C791990D}" = AiOSoftware
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{894DB184-DFD3-439B-99D5-90C841F9518C}" = TranscriptPro 4
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8BC3B99B-A6BE-4A0B-8535-B1B94BA4B1B1}" = DocProc
"{8F1ADE4D-EFAC-4F5A-B346-23C2687FAF50}" = Apple Mobile Device Support
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{91110409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{98EABC7F-B1A1-43A5-B505-5B4EC3908DCD}" = Microsoft Security Client
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A525E00B-6609-442E-9DCD-64453C233E8D}" = TurboTax 2010 WinPerReleaseEngine
"{A5B9D22C-755A-4AC6-9904-875E80838BB6}" = CP_AtenaShokunin1Config
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA1B9602-3120-4A28-913B-AAA59A2CEEEB}" = Sony Player Plug-in for Windows Media Player
"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 306.81
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 306.81
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 136.28
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.12.0604
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD Audio Driver 1.3.18.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B911B811-BA3E-46D4-90F8-6F3338359651}" = Director
"{BD29EBAC-AD7D-4b27-B727-4CC6AC52D36B}" = MarketResearch
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C3ADD937-FD5F-4CC6-AE15-AEDEE2A20165}" = TurboTax 2010 wrapper
"{C43A00F2-F6E7-4552-8CFC-62522239E3A4}" = 2600_Help
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDFCF124-115F-4976-8BF4-08C89187A146}" = WebReg
"{CE0C8CC5-E396-442B-A50E-D1D374A9E820}" = DocumentViewer
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D6346B4B-FDD6-C406-06FE-0CF77F561E78}" = AMD Catalyst Install Manager
"{D752C03F-ADD0-4A1F-93D5-7CBFA540E679}" = VueMinder Pro
"{D9C7FB0D-B233-1B2E-E9DC-543911F6D94A}" = Catalyst Control Center InstallProxy
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529000}" = WordPerfect Office X4
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529001}" = WordPerfect Office X4 - ICA
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529010}" = WordPerfect Office X4 - Common
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529011}" = WordPerfect Office X4 - WP
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529012}" = WordPerfect Office X4 - QP
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529013}" = WordPerfect Office X4 - PR
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529014}" = WordPerfect Office X4 - Content
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529016}" = WordPerfect Office X4 - Skins
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529017}" = WordPerfect Office X4 - Filters
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529018}" = WordPerfect Office X4 - Graphics
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529023}" = WordPerfect Office X4 - System
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529030}" = WordPerfect Office X4 - Migration Manager
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529040}" = WordPerfect Office X4 - IPM
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529041}" = WordPerfect Office X4 - IPM EN
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529050}" = WordPerfect Office X4 - PerfectExperts
"{DCDAB2ED-5741-4C30-A1A4-0FCB8A529100}" = WordPerfect Office X4 - EN
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E6C0F926-446B-4450-8D15-4405A9431EB7}" = TurboTax 2010 WinBizFedFormset
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F6EE49FD-B736-4888-A05A-115F3B1160FA}" = WordPerfect Lightning - MSOM
"{FC22D020-3005-4715-8DF9-F3EDE81DEB3D}" = CreativeProjectsTemplates
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Applian Director2.1" = Applian Director
"Applian FLV Player2.0.25" = Applian FLV Player
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
"Carbonite Backup" = Carbonite
"CCleaner" = CCleaner
"CloudCare" = CloudCare
"com.Shutterfly.ExpressUploader" = Shutterfly Express Uploader
"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2010-10-10
"Corel Visual Intelligence" = Corel Visual Intelligence
"Data Transfer Utility 10" = Data Transfer Utility 10
"Debut" = Debut Video Capture Software
"DMX5_is1" = DriverMax 5
"Doxillion" = Doxillion Document Converter
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"gBurner" = gBurner
"HP Photo & Imaging" = HP Image Zone 4.7
"HPExtendedCapabilities" = HP Extended Capabilities 4.7
"ie8" = Windows Internet Explorer 8
"InqScribe_is1" = InqScribe 2.1
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"InstallShield_{614F4056-4E32-4FD4-A10E-9BAC4E1D7441}" = VersaCheck 2003 Personal Premier
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.65.1.1000
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 13.0.1 (x86 en-US)" = Mozilla Firefox 13.0.1 (x86 en-US)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"Password Solutions - Office Password Recovery PRO" = Office Password Recovery PRO v1.0 (remove only)
"PDF reDirect" = PDF reDirect (remove only)
"PhotoStage" = PhotoStage Slideshow Producer
"Prism" = Prism Video File Converter
"RealPlayer 15.0" = RealPlayer
"Recuva" = Recuva
"Replay Converter 4" = Replay Converter 4
"Replay Media Catcher 4" = Replay Media Catcher 4 (4.3.2)
"Replay_AV_807" = Replay AV 8
"Scribe" = Express Scribe
"Smart PDF Converter_is1" = Smart PDF Converter 6.3.0.495
"Trusted Software Assistant_is1" = File Type Assistant
"TurboTax 2010" = TurboTax 2010
"TurboTax Business 2010" = TurboTax Business 2010
"Unlocker" = Unlocker 1.9.1
"VideoPad" = VideoPad Video Editor
"VPedal Windows Media Player 11 64bit Plug-in_is1" = VPedal Windows Media Player 11 64bit Plug-in
"WavePad" = WavePad Sound Editor
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinPcapInst" = WinPcap 4.0.2
"WinRAR archiver" = WinRAR 4.01 (32-bit)
"WM Recorder 11.3" = WM Recorder 11.3
"WM Recorder14.10" = WM Recorder
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"CNET TechTracker" = CNET TechTracker
"Google Chrome" = Google Chrome

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 11/27/2012 4:10:59 PM | Computer Name = FRANCIE-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 11/27/2012 4:14:09 PM | Computer Name = FRANCIE-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 11/27/2012 5:13:26 PM | Computer Name = FRANCIE-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 11/27/2012 10:37:28 PM | Computer Name = FRANCIE-PC | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks": Returning NULL QBWinInstance
Hand

Error - 11/27/2012 10:37:28 PM | Computer Name = FRANCIE-PC | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks": Returning NULL QBWinInstance
Hand

Error - 11/27/2012 10:37:28 PM | Computer Name = FRANCIE-PC | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks": Returning NULL QBWinInstance
Hand

Error - 11/27/2012 10:46:45 PM | Computer Name = FRANCIE-PC | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks Pro 2010": tlg file 
removal failed because the file was still ope

Error - 11/30/2012 2:21:07 AM | Computer Name = FRANCIE-PC | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks": Returning NULL QBWinInstance
Hand

Error - 11/30/2012 2:21:07 AM | Computer Name = FRANCIE-PC | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks": Returning NULL QBWinInstance
Hand

Error - 11/30/2012 2:21:07 AM | Computer Name = FRANCIE-PC | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks": Returning NULL QBWinInstance
Hand

[ System Events ]
Error - 12/3/2012 1:17:53 PM | Computer Name = FRANCIE-PC | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 12/3/2012 1:17:55 PM | Computer Name = FRANCIE-PC | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 12/3/2012 1:17:57 PM | Computer Name = FRANCIE-PC | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 12/3/2012 2:27:03 PM | Computer Name = FRANCIE-PC | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 12/3/2012 2:27:05 PM | Computer Name = FRANCIE-PC | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 12/3/2012 2:27:07 PM | Computer Name = FRANCIE-PC | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 12/3/2012 7:04:21 PM | Computer Name = FRANCIE-PC | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 12/3/2012 7:04:23 PM | Computer Name = FRANCIE-PC | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 12/3/2012 7:04:25 PM | Computer Name = FRANCIE-PC | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 12/3/2012 7:10:28 PM | Computer Name = FRANCIE-PC | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

< End of report >


----------



## Cookiegal (Aug 27, 2003)

If you still have ComboFix please delete it by dragging it to the Recycle Bin. We are going to redownload it:

Please visit *Combofix Guide & Instructions * for instructions for installing the Recovery Console and downloading and running ComboFix.

The only thing different from the instructions there is that when downloading and saving the ComboFix.exe I would like you to rename it to puppy.exe please.

Post the log from ComboFix when you've accomplished that.

Important notes regarding ComboFix:

ComboFix may reset a number of Internet Explorer's settings, including making it the default browser. This can easily be changed once we're finished.

ComboFix also prevents autorun of ALL CDs, floppies and USB devices (don't worry, the keyboard and mouse will still function) to assist with malware removal & increase security. If this is an issue or makes it difficult for you, please let me know. This can be undone manually when we're finished. Read  *HERE * for an article written by dvk01 on why we disable autoruns.


----------



## shadowbird (Oct 9, 2012)

ComboFix 12-12-07.01 - Francie 12/08/2012 1:58.6.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2442 [GMT -5:00]
Running from: c:\documents and settings\Francie\My Documents\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\windows\EventSystem.log
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
c:\windows\wininit.ini
.
.
((((((((((((((((((((((((( Files Created from 2012-11-08 to 2012-12-08 )))))))))))))))))))))))))))))))
.
.
2012-12-08 07:20 . 2012-11-08 18:00 6812136 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BDCC9DFE-807B-4E5F-9779-80734FFE670C}\mpengine.dll
2012-12-07 05:10 . 2012-11-08 18:00 6812136 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-11-28 09:13 . 2012-11-28 09:13 11776 ----a-w- c:\program files\Mozilla Firefox\plugins\nprjplug.dll
2012-11-28 09:13 . 2012-11-28 09:13 -------- d-----w- c:\program files\Common Files\xing shared
2012-11-28 09:13 . 2012-11-28 09:13 150736 ----a-w- c:\program files\Mozilla Firefox\plugins\nppl3260.dll
2012-11-28 09:13 . 2012-11-28 09:13 129176 ----a-w- c:\program files\Mozilla Firefox\plugins\nprpplugin.dll
2012-11-28 08:34 . 2012-11-28 08:34 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2012-11-28 08:34 . 2012-11-28 08:34 -------- d-----w- c:\documents and settings\Francie\Application Data\TestApp
2012-11-25 00:16 . 2012-11-25 00:17 -------- d-----w- C:\f558eb6da702717e6660d59c629d
2012-11-24 19:58 . 2012-11-24 20:37 -------- d-----w- c:\program files\Microsoft
2012-11-24 19:57 . 2006-11-29 18:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2012-11-24 19:55 . 2008-06-17 21:13 74520 ----a-w- c:\program files\Common Files\Windows Live\.cache\b53b6eca1cdca7d\DSETUP.dll
2012-11-24 19:55 . 2008-06-17 21:13 484632 ----a-w- c:\program files\Common Files\Windows Live\.cache\b53b6eca1cdca7d\DXSETUP.exe
2012-11-24 19:55 . 2008-06-17 21:13 1670936 ----a-w- c:\program files\Common Files\Windows Live\.cache\b53b6eca1cdca7d\dsetup32.dll
2012-11-24 19:55 . 2012-11-24 19:55 -------- d-----w- c:\documents and settings\Francie\Application Data\Windows Search
2012-11-24 19:55 . 2008-07-11 09:50 1013800 ----a-w- c:\program files\Common Files\Windows Live\.cache\a91412001cdca7d\WindowsXP-KB954708-x86-ENU.exe
2012-11-24 19:35 . 2012-11-24 19:35 -------- d-----w- c:\windows\system32\winrm
2012-11-24 19:35 . 2012-11-24 19:35 -------- dc-h--w- c:\windows\$968930Uinstall_KB968930$
2012-11-24 19:33 . 2012-11-29 03:23 -------- d-----w- c:\program files\Windows Desktop Search
2012-11-24 19:31 . 2008-03-07 17:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
2012-11-24 19:31 . 2008-03-07 17:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
2012-11-24 19:31 . 2008-03-07 17:02 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
2012-11-19 21:52 . 2012-11-19 21:52 -------- d-----w- c:\documents and settings\Francie\Local Settings\Application Data\VS Revo Group
2012-11-19 21:52 . 2009-12-30 16:20 27064 ----a-w- c:\windows\system32\drivers\revoflt.sys
2012-11-19 21:52 . 2012-11-19 21:52 -------- d-----w- c:\program files\VS Revo Group
2012-11-17 19:12 . 2012-11-17 19:12 -------- d-----w- c:\program files\Common Files\Java
2012-11-17 19:12 . 2012-11-17 19:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Ask
2012-11-15 23:40 . 2012-09-24 20:32 477168 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-11-15 23:40 . 2012-09-24 18:51 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-11-15 16:04 . 2012-11-15 16:04 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-11-12 04:51 . 2012-11-12 04:51 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2012-11-12 04:51 . 2012-11-12 04:51 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA
2012-11-12 04:51 . 2012-11-24 20:14 -------- d-----w- c:\documents and settings\UpdatusUser
2012-11-12 04:50 . 2012-07-03 15:25 28008 ----a-w- c:\windows\system32\nvhdap32.dll
2012-11-12 04:50 . 2012-07-03 15:25 124264 ----a-w- c:\windows\system32\drivers\nvhda32.sys
2012-11-12 04:50 . 2012-07-03 07:37 884072 ----a-w- c:\windows\system32\nvhdagenco3220103.dll
2012-11-12 04:50 . 2012-09-23 14:28 888168 ----a-w- c:\windows\system32\nvdispgenco32.dll
2012-11-12 04:50 . 2012-09-23 14:28 5947392 ----a-w- c:\windows\system32\nvopencl.dll
2012-11-12 04:50 . 2012-09-23 14:28 1009512 ----a-w- c:\windows\system32\nvdispco32.dll
2012-11-12 04:27 . 2012-11-12 04:27 -------- d-----w- c:\windows\B9DB4C7601A446D58910F7AA6376DBAF.TMP
2012-11-12 04:26 . 2012-11-12 04:50 1101436 ----a-w- c:\windows\system32\nvdrsdb0.bin
2012-11-12 04:26 . 2012-11-12 04:50 1 ----a-w- c:\windows\system32\nvdrssel.bin
2012-11-12 04:26 . 2012-11-12 04:50 1101436 ----a-w- c:\windows\system32\nvdrsdb1.bin
2012-11-12 04:25 . 2011-01-16 23:53 61440 ----a-w- c:\windows\system32\OpenCL.dll
2012-11-12 04:25 . 2012-09-23 14:28 7446528 ----a-w- c:\windows\system32\nvcuda.dll
2012-11-12 04:25 . 2012-09-23 14:28 2578792 ----a-w- c:\windows\system32\nvcuvid.dll
2012-11-12 04:25 . 2012-09-23 14:28 19103744 ----a-w- c:\windows\system32\nvoglnt.dll
2012-11-12 04:25 . 2012-09-23 14:28 1866088 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-11-12 04:25 . 2011-01-16 23:53 941160 ----a-w- c:\windows\system32\nvdispco322090.dll
2012-11-12 04:25 . 2011-01-16 23:53 837736 ----a-w- c:\windows\system32\nvgenco322040.dll
2012-11-12 04:25 . 2011-01-16 23:53 2293138 ----a-w- c:\windows\system32\nvdata.bin
2012-11-12 04:25 . 2012-09-23 14:28 2376704 ----a-w- c:\windows\system32\nvapi.dll
2012-11-12 04:25 . 2012-09-23 14:28 17551360 ----a-w- c:\windows\system32\nvcompiler.dll
2012-11-12 04:16 . 2012-09-23 14:28 12557728 -c--a-w- c:\windows\system32\dllcache\nv4_mini.sys
2012-11-12 04:16 . 2012-09-23 14:28 12557728 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2012-11-08 19:14 . 2008-04-13 18:46 48128 -c--a-w- c:\windows\system32\dllcache\61883.sys
2012-11-08 19:14 . 2001-08-17 19:55 38400 -c--a-w- c:\windows\system32\dllcache\8514a.dll
2012-11-08 19:14 . 2008-04-13 18:40 12288 -c--a-w- c:\windows\system32\dllcache\4mmdat.sys
2012-11-08 19:14 . 2001-08-17 19:55 689216 -c--a-w- c:\windows\system32\dllcache\3dfxvs.dll
2012-11-08 19:14 . 2001-08-17 19:06 11264 -c--a-w- c:\windows\system32\dllcache\1394vdbg.sys
2012-11-08 19:14 . 2001-08-17 18:28 762780 -c--a-w- c:\windows\system32\dllcache\3cwmcru.sys
2012-11-08 19:14 . 2001-08-17 17:48 148352 -c--a-w- c:\windows\system32\dllcache\3dfxvsm.sys
2012-11-08 19:14 . 2008-04-13 18:46 53376 -c--a-w- c:\windows\system32\dllcache\1394bus.sys
2012-11-08 19:14 . 2001-08-17 19:56 66048 -c--a-w- c:\windows\system32\dllcache\s3legacy.dll
2012-11-08 18:14 . 2012-11-09 02:29 -------- d-----w- c:\documents and settings\Administrator.FRANCIE-PC
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-05 07:07 . 2011-02-04 06:10 1682 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2012-11-28 09:12 . 2011-01-18 01:47 499712 ----a-w- c:\windows\system32\msvcp71.dll
2012-11-28 09:12 . 2011-01-18 01:47 348160 ----a-w- c:\windows\system32\msvcr71.dll
2012-11-15 16:04 . 2011-08-22 15:15 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-22 08:37 . 2004-08-04 12:00 1866368 ----a-w- c:\windows\system32\win32k.sys
2012-10-20 04:27 . 2012-10-20 04:27 118784 ----a-w- c:\windows\system32\msstdfmt.dll
2012-10-02 18:04 . 2004-08-04 12:00 58368 ----a-w- c:\windows\system32\synceng.dll
2012-10-02 17:47 . 2012-10-02 17:47 205072 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2012-09-29 23:54 . 2012-10-27 02:09 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-09-24 20:32 . 2011-02-17 19:08 473072 ----a-w- c:\windows\system32\deployJava1.dll
2012-09-23 14:28 . 2011-01-11 04:22 4494208 ----a-w- c:\windows\system32\nv4_disp.dll
2012-09-23 13:04 . 2011-01-16 21:33 54272 ----a-w- c:\windows\system32\nvwddi.dll
2012-09-23 13:04 . 2011-01-16 21:33 15512424 ----a-w- c:\windows\system32\nvcpl.dll
2012-09-23 13:04 . 2011-01-16 21:33 108392 ----a-w- c:\windows\system32\nvmctray.dll
2012-09-23 13:04 . 2011-01-16 21:33 164200 ----a-w- c:\windows\system32\nvsvc32.exe
2012-09-23 13:04 . 2011-01-16 21:33 143720 ----a-w- c:\windows\system32\nvcolor.exe
2012-06-14 22:20 . 2011-03-24 06:14 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2012-09-14 01:14 1014856 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2012-09-14 01:14 1014856 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2012-09-14 01:14 1014856 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-19 421888]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]
"Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2012-09-14 1065032]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-09-23 15512424]
"NvMediaCenter"="NvMCTray.dll" [2012-09-23 108392]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2012-09-23 1634112]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-09-24 926896]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2012-11-28 296096]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\Guest.FRANCIE-PC\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoStart IR.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AutoStart IR.lnk
backup=c:\windows\pss\AutoStart IR.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Qchex Tray Icon.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Qchex Tray Icon.lnk
backup=c:\windows\pss\Qchex Tray Icon.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinTV Recording Status..lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinTV Recording Status..lnk
backup=c:\windows\pss\WinTV Recording Status..lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Francie^Start Menu^Programs^Startup^CNET TechTracker.lnk]
path=c:\documents and settings\Francie\Start Menu\Programs\Startup\CNET TechTracker.lnk
backup=c:\windows\pss\CNET TechTracker.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-09-24 01:43 926896 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriverMax]
2010-11-18 15:44 9221024 ----a-w- c:\program files\Innovative Solutions\DriverMax\devices.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
2007-02-26 06:01 437160 ----a-w- c:\progra~1\COMMON~1\MICROS~1\DW\DWTRIG20.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2011-07-28 20:59 136176 ----atw- c:\documents and settings\Francie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]
2000-01-01 00:00 41122448 ----a-w- c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2011-05-10 06:41 49208 ----a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Intuit SyncManager]
2010-10-19 10:58 1439496 ----a-w- c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-06-07 23:33 421776 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2012-09-23 13:04 15512424 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2012-09-23 13:04 108392 ----a-w- c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2012-09-23 14:28 1634112 ----a-w- c:\program files\NVIDIA Corporation\nView\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickFinder Scheduler]
2009-06-22 23:29 83232 ----a-w- c:\program files\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-19 02:16 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SlimDrivers]
2012-07-25 16:57 29357952 ----a-w- c:\program files\SlimDrivers\SlimDrivers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-09-17 17:41 254896 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2012-11-28 09:12 296096 ----a-w- c:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
2010-07-04 19:51 17408 ----a-w- c:\program files\Unlocker\UnlockerAssistant.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VueMinder]
2012-02-11 14:25 7962624 ----a-w- c:\program files\VueSoft\VueMinder\VueMinder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
2004-03-18 13:33 892928 ----a-w- c:\program files\Logitech\iTouch\iTouch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"rpcapd"=3 (0x3)
"QBCFMonitorService"=2 (0x2)
"iPod Service"=3 (0x3)
"idsvc"=3 (0x3)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
"Bonjour Service"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"MBAMScheduler"=2 (0x2)
"MBAMService"=2 (0x2)
"BsecureAV"=2 (0x2)
"Bsecure"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bsecure\\InetCtrl.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCPxpsp2res.dll,-22009
"5985:TCP"= 5985:TCP:*isabled:Windows Remote Management 
.
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [6/28/2012 5:33 PM 101112]
R2 KaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\KaraokeSer.exe [8/26/2012 11:11 AM 88688]
R2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\system32\NLSSRV32.EXE [4/12/2012 4:27 AM 69640]
R3 appliandMP;appliandMP;c:\windows\system32\drivers\appliand.sys [9/5/2011 10:41 PM 28256]
R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [8/26/2012 11:36 AM 43392]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [8/26/2012 11:11 AM 2551664]
S3 appliand;Applian Network Service;c:\windows\system32\drivers\appliand.sys [9/5/2011 10:41 PM 28256]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys --> c:\windows\system32\drivers\AtihdXP3.sys [?]
S3 BSecACFltr;BSecACFltr;c:\windows\system32\drivers\BSecACFltr.sys [10/31/2012 2:23 PM 21624]
S3 hcw72ADFilter;WinTV HVR-950 USB Audio Filter Driver;c:\windows\system32\drivers\hcw72ADFilter.sys [5/17/2011 9:43 AM 28928]
S3 hcw72ATV;WinTV HVR-950 NTSC;c:\windows\system32\drivers\hcw72ATV.sys [5/17/2011 9:43 AM 1217920]
S3 hcw72DTV;WinTV HVR-950 ATSC/QAM;c:\windows\system32\drivers\hcw72DTV.sys [5/17/2011 9:43 AM 1220224]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [10/26/2012 9:09 PM 22856]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [8/4/2004 7:00 AM 14336]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [11/6/2007 3:22 PM 34064]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [11/19/2012 4:52 PM 27064]
S4 Bsecure;CloudCare;c:\program files\Bsecure\InetCtrl.exe [10/30/2012 10:41 AM 66344]
S4 BsecureAV;CloudCare AntiVirus;c:\program files\Bsecure\BsecAV.exe [10/30/2012 10:41 AM 161776]
S4 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [10/26/2012 9:09 PM 399432]
S4 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [10/26/2012 9:09 PM 676936]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - BsecureFilter
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2012-12-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-15 16:04]
.
2011-04-06 c:\windows\Tasks\debutShakeIcon.job
- c:\program files\NCH Software\Debut\debut.exe [2011-04-03 14:08]
.
2012-11-06 c:\windows\Tasks\doxillionShakeIcon.job
- c:\program files\NCH Software\Doxillion\doxillion.exe [2011-01-12 21:59]
.
2012-12-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-12 21:44]
.
2012-12-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-12 21:44]
.
2012-12-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-616249376-839522115-1003Core.job
- c:\documents and settings\Francie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-08-29 20:59]
.
2012-12-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-616249376-839522115-1003UA.job
- c:\documents and settings\Francie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-08-29 20:59]
.
2012-12-08 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-09-12 21:25]
.
2012-07-25 c:\windows\Tasks\photostageShakeIcon.job
- c:\program files\NCH Software\PhotoStage\photostage.exe [2012-07-15 06:07]
.
2012-11-20 c:\windows\Tasks\prismDowngrade.job
- c:\program files\NCH Software\Prism\prism.exe [2011-09-19 16:51]
.
2012-12-03 c:\windows\Tasks\prismShakeIcon.job
- c:\program files\NCH Software\Prism\prism.exe [2011-09-19 16:51]
.
2012-12-08 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 19:27]
.
2012-12-08 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 19:27]
.
2012-12-08 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 19:27]
.
2012-12-08 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-616249376-839522115-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 19:27]
.
2012-11-28 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 19:27]
.
2012-12-05 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 19:27]
.
2012-12-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 19:27]
.
2012-12-05 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-616249376-839522115-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 19:27]
.
2011-01-20 c:\windows\Tasks\scribeSevenDaysInit.job
- c:\program files\NCH Swift Sound\Scribe\scribe.exe [2011-01-20 02:58]
.
2012-12-08 c:\windows\Tasks\scribeShakeIcon.job
- c:\program files\NCH Swift Sound\Scribe\scribe.exe [2011-01-20 02:58]
.
2012-12-08 c:\windows\Tasks\User_Feed_Synchronization-{259297A0-4E67-4E79-897A-4C8098A85E45}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 09:31]
.
2012-06-14 c:\windows\Tasks\videopadDowngrade.job
- c:\program files\NCH Software\VideoPad\videopad.exe [2011-09-19 16:52]
.
2012-05-16 c:\windows\Tasks\videopadShakeIcon.job
- c:\program files\NCH Software\VideoPad\videopad.exe [2011-09-19 16:52]
.
2011-10-06 c:\windows\Tasks\wavepadShakeIcon.job
- c:\program files\NCH Software\WavePad\wavepad.exe [2011-09-19 20:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://forums.techguy.org/virus-other-malware-removal/1072157-blue-screen-after-root-kit-7.html
uInternet Settings,ProxyOverride = *.local
IE: Copy to &Lightning Note - c:\program files\Corel\WordPerfect Lightning\Programs\WPLightningCopyToNote.hta
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: Open with WordPerfect - c:\program files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = 65.32.5.111 65.32.5.112
FF - ProfilePath - c:\documents and settings\Francie\Application Data\Mozilla\Firefox\Profiles\tohrezx2.default\
FF - prefs.js: browser.search.defaulturl - 
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z149&form=ZGAADF&install_date=20110829&q=
FF - prefs.js: network.proxy.type - 0
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: security.csp.enable - false
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe
MSConfigStartUp-ATICustomerCare - c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe
MSConfigStartUp-StartCCC - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
AddRemove-RealPlayer 15.0 - c:\program files\real\realplayer\Update\r1puninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-12-08 03:37
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1124)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
- - - - - - - > 'explorer.exe'(3352)
c:\windows\system32\WININET.dll
c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\Carbonite\Carbonite Backup\carboniteservice.exe
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\msdtc.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\RunDLL32.exe
c:\windows\System32\vssvc.exe
c:\windows\system32\dllhost.exe
.
**************************************************************************
.
Completion time: 2012-12-08 03:41:48 - machine was rebooted
ComboFix-quarantined-files.txt 2012-12-08 08:41
.
Pre-Run: 89,039,679,488 bytes free
Post-Run: 89,126,797,312 bytes free
.
- - End Of File - - B03F55F72CEB8487348D3766F450D444


----------



## Cookiegal (Aug 27, 2003)

Were you ever able to get BSecure to work properly again?

event viewer. Look under both "Application" and "System" for recent (the last 48 hours or so) errors (shown in red) and if found, do this for each one.

Double-click the error to open it up and then click on the icon that looks like two pieces of paper. This will copy the full error. Then "paste" the error into Notepad. Do this for each one until you have them all listed in Notepad and then copy and paste the list in a reply here please.


----------



## shadowbird (Oct 9, 2012)

For BSecure, I still need to find the Windows XP disk in order to follow the tech instructions to get it working again. (Been looking)

APPLICATION

Event Type:	Error
Event Source:	Microsoft Management Console
Event Category:	None
Event ID:	1000
Date: 12/9/2012
Time: 3:31:34 PM
User: N/A
Computer:	FRANCIE-PC
Description:
The description for Event ID ( 1000 ) in Source ( Microsoft Management Console ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: mmc.exe, 5.2.3790.4136, ntdll.dll, 5.1.2600.6055, 000109d8.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 6d 6d 63 ure mmc
0018: 2e 65 78 65 20 35 2e 32 .exe 5.2
0020: 2e 33 37 39 30 2e 34 31 .3790.41
0028: 33 36 20 69 6e 20 6e 74 36 in nt
0030: 64 6c 6c 2e 64 6c 6c 20 dll.dll 
0038: 35 2e 31 2e 32 36 30 30 5.1.2600
0040: 2e 36 30 35 35 20 61 74 .6055 at
0048: 20 6f 66 66 73 65 74 20 offset 
0050: 30 30 30 31 30 39 64 38 000109d8
0058: 0d 0a ..

Event Type:	Error
Event Source:	crypt32
Event Category:	None
Event ID:	8
Date: 12/8/2012
Time: 2:04:27 AM
User: N/A
Computer:	FRANCIE-PC
Description:
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	crypt32
Event Category:	None
Event ID:	8
Date: 12/8/2012
Time: 2:04:27 AM
User: N/A
Computer:	FRANCIE-PC
Description:
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The server name or address could not be resolved

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	crypt32
Event Category:	None
Event ID:	8
Date: 12/8/2012
Time: 2:02:22 AM
User: N/A
Computer:	FRANCIE-PC
Description:
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The server name or address could not be resolved

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	crypt32
Event Category:	None
Event ID:	8
Date: 12/8/2012
Time: 2:01:48 AM
User: N/A
Computer:	FRANCIE-PC
Description:
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The server name or address could not be resolved

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	MPSampleSubmission
Event Category:	None
Event ID:	5000
Date: 12/8/2012
Time: 1:54:11 AM
User: N/A
Computer:	FRANCIE-PC
Description:
The description for Event ID ( 5000 ) in Source ( MPSampleSubmission ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: mptelemetry, unspecified, hardeningtelemetry, hardeningtelemetrydisablertp, 4.1.522.0, unspecified, unspecified, unspecified, NIL, NIL, NIL.
Data:
0000: 6d 00 70 00 74 00 65 00 m.p.t.e.
0008: 6c 00 65 00 6d 00 65 00 l.e.m.e.
0010: 74 00 72 00 79 00 2c 00 t.r.y.,.
0018: 20 00 75 00 6e 00 73 00 .u.n.s.
0020: 70 00 65 00 63 00 69 00 p.e.c.i.
0028: 66 00 69 00 65 00 64 00 f.i.e.d.
0030: 2c 00 20 00 68 00 61 00 ,. .h.a.
0038: 72 00 64 00 65 00 6e 00 r.d.e.n.
0040: 69 00 6e 00 67 00 74 00 i.n.g.t.
0048: 65 00 6c 00 65 00 6d 00 e.l.e.m.
0050: 65 00 74 00 72 00 79 00 e.t.r.y.
0058: 2c 00 20 00 68 00 61 00 ,. .h.a.
0060: 72 00 64 00 65 00 6e 00 r.d.e.n.
0068: 69 00 6e 00 67 00 74 00 i.n.g.t.
0070: 65 00 6c 00 65 00 6d 00 e.l.e.m.
0078: 65 00 74 00 72 00 79 00 e.t.r.y.
0080: 64 00 69 00 73 00 61 00 d.i.s.a.
0088: 62 00 6c 00 65 00 72 00 b.l.e.r.
0090: 74 00 70 00 2c 00 20 00 t.p.,. .
0098: 34 00 2e 00 31 00 2e 00 4...1...
00a0: 35 00 32 00 32 00 2e 00 5.2.2...
00a8: 30 00 2c 00 20 00 75 00 0.,. .u.
00b0: 6e 00 73 00 70 00 65 00 n.s.p.e.
00b8: 63 00 69 00 66 00 69 00 c.i.f.i.
00c0: 65 00 64 00 2c 00 20 00 e.d.,. .
00c8: 75 00 6e 00 73 00 70 00 u.n.s.p.
00d0: 65 00 63 00 69 00 66 00 e.c.i.f.
00d8: 69 00 65 00 64 00 2c 00 i.e.d.,.
00e0: 20 00 75 00 6e 00 73 00 .u.n.s.
00e8: 70 00 65 00 63 00 69 00 p.e.c.i.
00f0: 66 00 69 00 65 00 64 00 f.i.e.d.
00f8: 2c 00 20 00 4e 00 49 00 ,. .N.I.
0100: 4c 00 2c 00 20 00 4e 00 L.,. .N.
0108: 49 00 4c 00 20 00 4e 00 I.L. .N.
0110: 49 00 4c 00 0d 00 0a 00 I.L.....

SECURITY

None

SYSTEM

Event Type:	Error
Event Source:	Disk
Event Category:	None
Event ID:	7
Date: 12/9/2012
Time: 2:36:38 PM
User: N/A
Computer:	FRANCIE-PC
Description:
The device, \Device\Harddisk0\D, has a bad block.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 03 00 68 00 01 00 b6 00 ..h...¶.
0008: 00 00 00 00 07 00 04 c0 .......À
0010: 00 01 00 00 9c 00 00 c0 ......À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 2e 71 c2 00 00 00 00 ..qÂ....
0028: 83 56 04 00 00 00 00 00 V......
0030: ff ff ff ff 01 00 00 00 ÿÿÿÿ....
0038: 40 00 00 84 02 00 00 00 @......
0040: 00 20 0a 12 40 03 20 40 . [email protected] @
0048: 00 00 00 00 0a 00 00 00 ........
0050: 00 00 00 00 28 25 66 8a ....(%f
0058: 00 00 00 00 08 b8 67 8a .....¸g
0060: 02 00 00 00 97 38 61 00 ....8a.
0068: 28 00 00 61 38 97 00 00 (..a8..
0070: 08 00 00 00 00 00 00 00 ........
0078: f0 00 03 00 00 00 00 0b ð.......
0080: 00 00 00 00 00 00 00 00 ........
0088: 00 00 00 00 00 00 00 00 ........

Event Type:	Error
Event Source:	Disk
Event Category:	None
Event ID:	7
Date: 12/9/2012
Time: 2:35:56 PM
User: N/A
Computer:	FRANCIE-PC
Description:
The device, \Device\Harddisk0\D, has a bad block.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 03 00 68 00 01 00 b6 00 ..h...¶.
0008: 00 00 00 00 07 00 04 c0 .......À
0010: 00 01 00 00 9c 00 00 c0 ......À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 2e 71 c2 00 00 00 00 ..qÂ....
0028: 09 4c 04 00 00 00 00 00 .L......
0030: ff ff ff ff 01 00 00 00 ÿÿÿÿ....
0038: 40 00 00 84 02 00 00 00 @......
0040: 00 20 0a 12 40 03 20 40 . [email protected] @
0048: 00 00 00 00 0a 00 00 00 ........
0050: 00 00 00 00 78 7c 5c 8a ....x|\
0058: 00 00 00 00 48 7a 5c 8a ....Hz\
0060: 02 00 00 00 97 38 61 00 ....8a.
0068: 28 00 00 61 38 97 00 00 (..a8..
0070: 08 00 00 00 00 00 00 00 ........
0078: f0 00 03 00 00 00 00 0b ð.......
0080: 00 00 00 00 00 00 00 00 ........
0088: 00 00 00 00 00 00 00 00 ........

Event Type:	Error
Event Source:	Disk
Event Category:	None
Event ID:	7
Date: 12/9/2012
Time: 2:35:54 PM
User: N/A
Computer:	FRANCIE-PC
Description:
The device, \Device\Harddisk0\D, has a bad block.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 03 00 68 00 01 00 b6 00 ..h...¶.
0008: 00 00 00 00 07 00 04 c0 .......À
0010: 00 01 00 00 9c 00 00 c0 ......À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 2e 71 c2 00 00 00 00 ..qÂ....
0028: 8c 4b 04 00 00 00 00 00 K......
0030: ff ff ff ff 01 00 00 00 ÿÿÿÿ....
0038: 40 00 00 84 02 00 00 00  @......
0040: 00 20 0a 12 40 03 20 40 . [email protected] @
0048: 00 00 00 00 0a 00 00 00 ........
0050: 00 00 00 00 50 d9 9c 8a ....PÙ
0058: 00 00 00 00 e0 f4 88 8a ....àô
0060: 02 00 00 00 97 38 61 00 ....8a.
0068: 28 00 00 61 38 97 00 00 (..a8..
0070: 08 00 00 00 00 00 00 00 ........
0078: f0 00 03 00 00 00 00 0b ð.......
0080: 00 00 00 00 00 00 00 00 ........
0088: 00 00 00 00 00 00 00 00 ........

Event Type:	Error
Event Source:	Disk
Event Category:	None
Event ID:	7
Date: 12/9/2012
Time: 2:35:52 PM
User: N/A
Computer:	FRANCIE-PC
Description:
The device, \Device\Harddisk0\D, has a bad block.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 03 00 68 00 01 00 b6 00 ..h...¶.
0008: 00 00 00 00 07 00 04 c0 .......À
0010: 00 01 00 00 9c 00 00 c0 ......À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 2e 71 c2 00 00 00 00 ..qÂ....
0028: 0f 4b 04 00 00 00 00 00 .K......
0030: ff ff ff ff 01 00 00 00 ÿÿÿÿ....
0038: 40 00 00 84 02 00 00 00 @......
0040: 00 20 0a 12 40 03 20 40 . [email protected] @
0048: 00 00 00 00 0a 00 00 00 ........
0050: 00 00 00 00 50 d9 9c 8a ....PÙ
0058: 00 00 00 00 e0 f4 88 8a ....àô
0060: 02 00 00 00 97 38 61 00 ....8a.
0068: 28 00 00 61 38 97 00 00 (..a8..
0070: 08 00 00 00 00 00 00 00 ........
0078: f0 00 03 00 00 00 00 0b ð.......
0080: 00 00 00 00 00 00 00 00 ........
0088: 00 00 00 00 00 00 00 00 ........

Event Type:	Error
Event Source:	Disk
Event Category:	None
Event ID:	7
Date: 12/9/2012
Time: 2:35:50 PM
User: N/A
Computer:	FRANCIE-PC
Description:
The device, \Device\Harddisk0\D, has a bad block.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 03 00 68 00 01 00 b6 00 ..h...¶.
0008: 00 00 00 00 07 00 04 c0 .......À
0010: 00 01 00 00 9c 00 00 c0 ......À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 2e 71 c2 00 00 00 00 ..qÂ....
0028: 91 4a 04 00 00 00 00 00 J......
0030: ff ff ff ff 01 00 00 00 ÿÿÿÿ....
0038: 40 00 00 84 02 00 00 00 @......
0040: 00 20 0a 12 40 03 20 40 . [email protected] @
0048: 00 00 00 00 0a 00 00 00 ........
0050: 00 00 00 00 28 25 66 8a ....(%f
0058: 00 00 00 00 08 b8 67 8a .....¸g
0060: 02 00 00 00 97 38 61 00 ....8a.
0068: 28 00 00 61 38 97 00 00 (..a8..
0070: 08 00 00 00 00 00 00 00 ........
0078: f0 00 03 00 00 00 00 0b ð.......
0080: 00 00 00 00 00 00 00 00 ........
0088: 00 00 00 00 00 00 00 00 ........

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 12/9/2012
Time: 1:39:21 PM
User: NT AUTHORITY\SYSTEM
Computer:	FRANCIE-PC
Description:
DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service gupdate with arguments "/comsvc" in order to run the server:
{4EB61BAC-A3B6-4760-9581-655041EF4D69}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Disk
Event Category:	None
Event ID:	7
Date: 12/9/2012
Time: 1:31:33 PM
User: N/A
Computer:	FRANCIE-PC
Description:
The device, \Device\Harddisk0\D, has a bad block.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 03 00 68 00 01 00 b6 00 ..h...¶.
0008: 00 00 00 00 07 00 04 c0 .......À
0010: 00 01 00 00 9c 00 00 c0 ......À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 2e 71 c2 00 00 00 00 ..qÂ....
0028: 58 86 00 00 00 00 00 00 X......
0030: ff ff ff ff 01 00 00 00 ÿÿÿÿ....
0038: 40 00 00 84 02 00 00 00 @......
0040: 00 20 0a 12 40 03 20 40 . [email protected] @
0048: 00 00 00 00 0a 00 00 00 ........
0050: 00 00 00 00 d8 09 85 8a ....Ø.
0058: 00 00 00 00 a8 07 85 8a ....¨.
0060: 02 00 00 00 97 38 61 00 ....8a.
0068: 28 00 00 61 38 97 00 00 (..a8..
0070: 08 00 00 00 00 00 00 00 ........
0078: f0 00 03 00 00 00 00 0b ð.......
0080: 00 00 00 00 00 00 00 00 ........
0088: 00 00 00 00 00 00 00 00 ........

Event Type:	Error
Event Source:	Disk
Event Category:	None
Event ID:	7
Date: 12/9/2012
Time: 1:31:31 PM
User: N/A
Computer:	FRANCIE-PC
Description:
The device, \Device\Harddisk0\D, has a bad block.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 03 00 68 00 01 00 b6 00 ..h...¶.
0008: 00 00 00 00 07 00 04 c0 .......À
0010: 00 01 00 00 9c 00 00 c0 ......À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 2e 71 c2 00 00 00 00 ..qÂ....
0028: d0 85 00 00 00 00 00 00 Ð......
0030: ff ff ff ff 01 00 00 00 ÿÿÿÿ....
0038: 40 00 00 84 02 00 00 00 @......
0040: 00 20 0a 12 40 03 20 40 . [email protected] @
0048: 00 00 00 00 0a 00 00 00 ........
0050: 00 00 00 00 d8 09 85 8a ....Ø.
0058: 00 00 00 00 a8 07 85 8a ....¨.
0060: 02 00 00 00 97 38 61 00 ....8a.
0068: 28 00 00 61 38 97 00 00 (..a8..
0070: 08 00 00 00 00 00 00 00 ........
0078: f0 00 03 00 00 00 00 0b ð.......
0080: 00 00 00 00 00 00 00 00 ........
0088: 00 00 00 00 00 00 00 00 ........

Event Type:	Error
Event Source:	Disk
Event Category:	None
Event ID:	7
Date: 12/9/2012
Time: 1:31:29 PM
User: N/A
Computer:	FRANCIE-PC
Description:
The device, \Device\Harddisk0\D, has a bad block.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 03 00 68 00 01 00 b6 00 ..h...¶.
0008: 00 00 00 00 07 00 04 c0 .......À
0010: 00 01 00 00 9c 00 00 c0 ......À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 2e 71 c2 00 00 00 00 ..qÂ....
0028: 4e 85 00 00 00 00 00 00 N......
0030: ff ff ff ff 01 00 00 00 ÿÿÿÿ....
0038: 40 00 00 84 02 00 00 00 @......
0040: 00 20 0a 12 40 03 20 40 . [email protected] @
0048: 00 00 00 00 0a 00 00 00 ........
0050: 00 00 00 00 d8 09 85 8a ....Ø.
0058: 00 00 00 00 a8 07 85 8a ....¨.
0060: 02 00 00 00 97 38 61 00 ....8a.
0068: 28 00 00 61 38 97 00 00 (..a8..
0070: 08 00 00 00 00 00 00 00 ........
0078: f0 00 03 00 00 00 00 0b ð.......
0080: 00 00 00 00 00 00 00 00 ........
0088: 00 00 00 00 00 00 00 00 ........

There were 53 more, like above, all within 2 seconds of each other

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 12/9/2012
Time: 1:23:44 PM
User: N/A
Computer:	FRANCIE-PC
Description:
The PfModNT service failed to start due to the following error: 
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

THERE WERE 55 Errors listed on 12/8


----------



## Cookiegal (Aug 27, 2003)

This error:

The device, \Device\Harddisk0\D, has a bad block.

Means your hard drive may be failing.

Be sure you have everything important backed up to some external media like an external hard drive or CDs.

Go to *Sart *- *Run *- type in *dxdiag *and click OK. It will open a screen called DirectX Diagnostic Tool which will run for a minute to collect information from the system. Once it's finished, to the bottom right you will see a button called "Save All Information". Please click on that and save it to Notepad and then copy and paste the contents here.


----------



## shadowbird (Oct 9, 2012)

Thank you.

I have an online backup. Haven't ever figured out the software for the external drive, but I'll see about backing up to it as well.

------------------
System Information
------------------
Time of this report: 12/10/2012, 22:04:28
Machine name: FRANCIE-PC
Operating System: Windows XP Professional (5.1, Build 2600) Service Pack 3 (2600.xpsp_sp3_gdr.120821-1629)
Language: English (Regional Setting: English)
System Manufacturer: System manufacturer
System Model: System Product Name
BIOS: BIOS Date: 09/10/09 21:46:36 Ver: 04.06
Processor: AMD Athlon(tm) II X2 240 Processor, MMX, 3DNow (2 CPUs), ~2.8GHz
Memory: 3328MB RAM
Page File: 478MB used, 4732MB available
Windows Dir: C:\WINDOWS
DirectX Version: DirectX 9.0c (4.09.0000.0904)
DX Setup Parameters: Not found
DxDiag Version: 5.03.2600.5512 32bit Unicode
------------
DxDiag Notes
------------
DirectX Files Tab: No problems found.
Display Tab 1: The file nv4_disp.dll is not digitally signed, which means that it has not been tested by Microsoft's Windows Hardware Quality Labs (WHQL). You may be able to get a WHQL logo'd driver from the hardware manufacturer.
Sound Tab 1: The file viahduaa.sys is not digitally signed, which means that it has not been tested by Microsoft's Windows Hardware Quality Labs (WHQL). You may be able to get a WHQL logo'd driver from the hardware manufacturer.
Music Tab: No problems found.
Input Tab: No problems found.
Network Tab: No problems found.
--------------------
DirectX Debug Levels
--------------------
Direct3D: 0/4 (n/a)
DirectDraw: 0/4 (retail)
DirectInput: 0/5 (n/a)
DirectMusic: 0/5 (n/a)
DirectPlay: 0/9 (retail)
DirectSound: 0/5 (retail)
DirectShow: 0/6 (retail)
---------------
Display Devices
---------------
Card name: NVIDIA GeForce GTX 550 Ti
Manufacturer: NVIDIA
Chip type: GeForce GTX 550 Ti
DAC type: Integrated RAMDAC
Device Key: Enum\PCI\VEN_10DE&DEV_1244&SUBSYS_15563842&REV_A1
Display Memory: 1024.0 MB
Current Mode: 1600 x 900 (32 bit) (60Hz)
Monitor: SyncMaster 2033(SWPLUS/SWXPLUS) (Digital)
Monitor Max Res: 1600,900
Driver Name: nv4_disp.dll
Driver Version: 6.14.0013.0681 (English)
DDI Version: 9 (or higher)
Driver Attributes: Final Retail
Driver Date/Size: 9/23/2012 09:28:00, 4494208 bytes
WHQL Logo'd: No
WHQL Date Stamp: None
VDD: n/a
Mini VDD: nv4_mini.sys
Mini VDD Date: 9/23/2012 09:28:00, 12557728 bytes
Device Identifier: {D7B71E3E-5104-11CF-5B59-5B3500C2CB35}
Vendor ID: 0x10DE
Device ID: 0x1244
SubSys ID: 0x15563842
Revision ID: 0x00A1
Revision ID: 0x00A1
Video Accel: ModeMPEG2_C ModeMPEG2_D 
Deinterlace Caps: {6CB69578-7617-4637-91E5-1C02DB810285}: Format(In/Out)=(YUY2,YUY2) Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX VideoProcess_StretchY DeinterlaceTech_PixelAdaptive 
{335AA36E-7884-43A4-9C91-7F87FAF3E37E}: Format(In/Out)=(YUY2,YUY2) Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX VideoProcess_StretchY DeinterlaceTech_BOBVerticalStretch 
{6CB69578-7617-4637-91E5-1C02DB810285}: Format(In/Out)=(UYVY,YUY2) Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX VideoProcess_StretchY DeinterlaceTech_PixelAdaptive 
{335AA36E-7884-43A4-9C91-7F87FAF3E37E}: Format(In/Out)=(UYVY,YUY2) Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX VideoProcess_StretchY DeinterlaceTech_BOBVerticalStretch 
{6CB69578-7617-4637-91E5-1C02DB810285}: Format(In/Out)=(YV12,0x3231564e) Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX VideoProcess_StretchY DeinterlaceTech_PixelAdaptive 
{335AA36E-7884-43A4-9C91-7F87FAF3E37E}: Format(In/Out)=(YV12,0x3231564e) Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX VideoProcess_StretchY DeinterlaceTech_BOBVerticalStretch 
{6CB69578-7617-4637-91E5-1C02DB810285}: Format(In/Out)=(NV12,0x3231564e) Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX VideoProcess_StretchY DeinterlaceTech_PixelAdaptive 
{335AA36E-7884-43A4-9C91-7F87FAF3E37E}: Format(In/Out)=(NV12,0x3231564e) Frames(Prev/Fwd/Back)=(0,0,0) Caps=VideoProcess_YUV2RGB VideoProcess_StretchX VideoProcess_StretchY DeinterlaceTech_BOBVerticalStretch 
Registry: OK
DDraw Status: Enabled
D3D Status: Enabled
AGP Status: Enabled
DDraw Test Result: Not run
D3D7 Test Result: Not run
D3D8 Test Result: Not run
D3D9 Test Result: Not run
-------------
Sound Devices
-------------
Description: VIA HD Audio Output
Default Sound Playback: Yes
Default Voice Playback: Yes
Hardware ID: HDAUDIO\FUNC_01&VEN_1106&DEV_0397&SUBSYS_1043836C&REV_1000
Manufacturer ID: 1
Product ID: 100
Type: WDM
Driver Name: viahduaa.sys
Driver Version: 6.00.0001.10500 (English)
Driver Attributes: Final Retail
WHQL Logo'd: No
Date and Size: 12/31/1999 19:00:00, 2551664 bytes
Other Files: 
Driver Provider: VIA Technologies, Inc.
HW Accel Level: Full
Cap Flags: 0xF5F
Min/Max Sample Rate: 5000, 192000
Static/Strm HW Mix Bufs: 64, 63
Static/Strm HW 3D Bufs: 64, 63
HW Memory: 0
Voice Management: No
EAX(tm) 2.0 Listen/Src: Yes, Yes
I3DL2(tm) Listen/Src: Yes, Yes
Sensaura(tm) ZoomFX(tm): No
Registry: OK
Sound Test Result: Not run
---------------------
Sound Capture Devices
---------------------
Description: VIA HD Audio Input
Default Sound Capture: Yes
Default Voice Capture: Yes
Driver Name: viahduaa.sys
Driver Version: 6.00.0001.10500 (English)
Driver Attributes: Final Retail
Date and Size: 12/31/1999 19:00:00, 2551664 bytes
Cap Flags: 0x41
Format Flags: 0xCC0
-----------
DirectMusic
-----------
DLS Path: C:\WINDOWS\SYSTEM32\drivers\GM.DLS
DLS Version: 1.00.0016.0002
Acceleration: n/a
Ports: Microsoft Synthesizer, Software (Not Kernel Mode), Output, DLS, Internal, Default Port
Microsoft MIDI Mapper [Emulated], Hardware (Not Kernel Mode), Output, No DLS, Internal
Microsoft GS Wavetable SW Synth [Emulated], Hardware (Not Kernel Mode), Output, No DLS, Internal
Registry: OK
Test Result: Not run
-------------------
DirectInput Devices
-------------------
Device Name: Mouse
Attached: 1
Controller ID: n/a
Vendor/Product ID: n/a
FF Driver: n/a
Device Name: Keyboard
Attached: 1
Controller ID: n/a
Vendor/Product ID: n/a
FF Driver: n/a
Device Name: Internet Keys USB
Attached: 1
Controller ID: 0x0
Vendor/Product ID: 0x046D, 0xC309
FF Driver: n/a
Device Name: Internet Keys USB
Attached: 1
Controller ID: 0x0
Vendor/Product ID: 0x046D, 0xC309
FF Driver: n/a
Poll w/ Interrupt: No
Registry: OK
-----------
USB Devices
-----------
+ USB Root Hub
| Vendor/Product ID: 0x1002, 0x4397
| Matching Device ID: usb\root_hub
| Service: usbhub
| Driver: usbhub.sys, 4/13/2008 13:45:37, 59520 bytes
| Driver: usbd.sys, 8/4/2004 07:00:00, 4736 bytes
----------------
Gameport Devices
----------------
------------
PS/2 Devices
------------
+ Logitech HID-Compliant Keyboard
| Vendor/Product ID: 0x046D, 0xC309
| Matching Device ID: hid\vid_046d&pid_c309&mi_00
| Service: kbdhid
| Driver: kbdhid.sys, 4/13/2008 12:39:48, 14592 bytes
| Driver: kbdclass.sys, 4/13/2008 12:39:48, 24576 bytes
| 
+ Terminal Server Keyboard Driver
| Matching Device ID: root\rdp_kbd
| Upper Filters: kbdclass
| Service: TermDD
| Driver: termdd.sys, 4/13/2008 19:13:20, 40840 bytes
| Driver: kbdclass.sys, 4/13/2008 12:39:48, 24576 bytes
| 
+ HID-compliant mouse
| Vendor/Product ID: 0x046D, 0xC309
| Matching Device ID: hid_device_system_mouse
| Service: mouhid
| Driver: mouclass.sys, 4/13/2008 13:39:47, 23040 bytes
| Driver: mouhid.sys, 8/4/2004 07:00:00, 12160 bytes
| 
+ HID-compliant mouse
| Vendor/Product ID: 0x15CA, 0x00C3
| Matching Device ID: hid_device_system_mouse
| Service: mouhid
| Driver: mouclass.sys, 4/13/2008 13:39:47, 23040 bytes
| Driver: mouhid.sys, 8/4/2004 07:00:00, 12160 bytes
| 
+ Terminal Server Mouse Driver
| Matching Device ID: root\rdp_mou
| Upper Filters: mouclass
| Service: TermDD
| Driver: termdd.sys, 4/13/2008 19:13:20, 40840 bytes
| Driver: mouclass.sys, 4/13/2008 13:39:47, 23040 bytes
----------------------------
DirectPlay Service Providers
----------------------------
DirectPlay8 Modem Service Provider - Registry: OK, File: dpnet.dll (5.03.2600.5512)
DirectPlay8 Serial Service Provider - Registry: OK, File: dpnet.dll (5.03.2600.5512)
DirectPlay8 IPX Service Provider - Registry: OK, File: dpnet.dll (5.03.2600.5512)
DirectPlay8 TCP/IP Service Provider - Registry: OK, File: dpnet.dll (5.03.2600.5512)
Internet TCP/IP Connection For DirectPlay - Registry: OK, File: dpwsockx.dll (5.03.2600.5512)
IPX Connection For DirectPlay - Registry: OK, File: dpwsockx.dll (5.03.2600.5512)
Modem Connection For DirectPlay - Registry: OK, File: dpmodemx.dll (5.03.2600.5512)
Serial Connection For DirectPlay - Registry: OK, File: dpmodemx.dll (5.03.2600.5512)
DirectPlay Voice Wizard Tests: Full Duplex: Not run, Half Duplex: Not run, Mic: Not run
DirectPlay Test Result: Not run
Registry: OK
-------------------
DirectPlay Adapters
-------------------
DirectPlay8 Serial Service Provider: COM1
DirectPlay8 TCP/IP Service Provider: Local Area Connection - IPv4 - 
-----------------------
DirectPlay Voice Codecs
-----------------------
Voxware VR12 1.4kbit/s
Voxware SC06 6.4kbit/s
Voxware SC03 3.2kbit/s
MS-PCM 64 kbit/s
MS-ADPCM 32.8 kbit/s
Microsoft GSM 6.10 13 kbit/s
TrueSpeech(TM) 8.6 kbit/s
-------------------------
DirectPlay Lobbyable Apps
-------------------------
------------------------
Disk & DVD/CD-ROM Drives
------------------------
Drive: C:
Free Space: 84.9 GB
Total Space: 305.2 GB
File System: NTFS
Model: SAMSUNG HD322HJ
Drive: D:
Model: _NEC DVD+-RW ND-3530A
Driver: c:\windows\system32\drivers\cdrom.sys, 5.01.2600.5512 (English), 4/13/2008 13:40:46, 62976 bytes
--------------
System Devices
--------------
Name: Realtek PCIe GBE Family Controller
Device ID: PCI\VEN_10EC&DEV_8168&SUBSYS_83A31043&REV_03\4&37FD4B11&0&0050
Driver: n/a
Name: NVIDIA GeForce GTX 550 Ti
Device ID: PCI\VEN_10DE&DEV_1244&SUBSYS_15563842&REV_A1\4&92B7792&0&0010
Driver: C:\Program Files\NVIDIA Corporation\Drs\dbInstaller.exe, 6.14.0013.0681 (English), 9/23/2012 09:28:00, 182272 bytes
Driver: C:\Program Files\NVIDIA Corporation\Drs\nvdrsdb.bin, 9/23/2012 09:28:00, 1061768 bytes
Driver: C:\Program Files\NVIDIA Corporation\CPLInstallerCache\NvCplSetupEng.exe, 1.00.0001.0000 (English), 9/23/2012 09:28:00, 31308728 bytes
Driver: C:\Program Files\NVIDIA Corporation\license.txt, 9/23/2012 09:28:00, 21892 bytes
Driver: C:\Program Files\NVIDIA Corporation\OpenCL\OpenCL.dll, 1.00.0000.0000 (English), 9/23/2012 09:28:00, 65536 bytes
Driver: C:\WINDOWS\system32\DRIVERS\nv4_mini.sys, 6.14.0013.0681 (English), 9/23/2012 09:28:00, 12557728 bytes
Driver: C:\WINDOWS\system32\nv4_disp.dll, 6.14.0013.0681 (English), 9/23/2012 09:28:00, 4494208 bytes
Driver: C:\WINDOWS\system32\nvapi.dll, 6.14.0013.0681 (English), 9/23/2012 09:28:00, 2376704 bytes
Driver: C:\WINDOWS\system32\nvcompiler.dll, 6.14.0013.0681 (English), 9/23/2012 09:28:00, 17551360 bytes
Driver: C:\WINDOWS\system32\nvcuda.dll, 6.14.0013.0681 (English), 9/23/2012 09:28:00, 7446528 bytes
Driver: C:\WINDOWS\system32\nvcuvenc.dll, 6.14.0013.0681 (English), 9/23/2012 09:28:00, 1866088 bytes
Driver: C:\WINDOWS\system32\nvcuvid.dll, 6.14.0013.0681 (English), 9/23/2012 09:28:00, 2578792 bytes
Driver: C:\WINDOWS\system32\nvdata.data, 9/23/2012 09:28:00, 2811988 bytes
Driver: C:\WINDOWS\system32\nvinfo.pb, 9/23/2012 09:28:00, 12210 bytes
Driver: C:\WINDOWS\system32\nvoglnt.dll, 6.14.0013.0681 (English), 9/23/2012 09:28:00, 19103744 bytes
Driver: C:\WINDOWS\system32\nvopencl.dll, 6.14.0013.0681 (English), 9/23/2012 09:28:00, 5947392 bytes
Driver: C:\WINDOWS\system32\nvdispco32.dll, 2.00.0026.0004 (English), 9/23/2012 09:28:00, 1009512 bytes
Driver: C:\WINDOWS\system32\nvdispgenco32.dll, 2.00.0015.0002 (English), 9/23/2012 09:28:00, 888168 bytes
Name: Microsoft UAA Bus Driver for High Definition Audio
Device ID: PCI\VEN_10DE&DEV_0BEE&SUBSYS_15563842&REV_A1\4&92B7792&0&0110
Driver: C:\WINDOWS\system32\DRIVERS\hdaudbus.sys, 5.10.0001.5013 (English), 4/13/2008 11:36:05, 144384 bytes
Name: PCI standard PCI-to-PCI bridge
Device ID: PCI\VEN_1022&DEV_9609&SUBSYS_00000000&REV_00\3&267A616A&0&50
Driver: C:\WINDOWS\system32\DRIVERS\pci.sys, 5.01.2600.5512 (English), 4/13/2008 13:36:44, 68224 bytes
Name: PCI standard PCI-to-PCI bridge
Device ID: PCI\VEN_1022&DEV_9603&SUBSYS_00000000&REV_00\3&267A616A&0&10
Driver: C:\WINDOWS\system32\DRIVERS\pci.sys, 5.01.2600.5512 (English), 4/13/2008 13:36:44, 68224 bytes
Name: PCI standard host CPU bridge
Device ID: PCI\VEN_1022&DEV_9601&SUBSYS_00000000&REV_00\3&267A616A&0&00
Driver: n/a
Name: PCI standard host CPU bridge
Device ID: PCI\VEN_1022&DEV_1204&SUBSYS_00000000&REV_00\3&267A616A&0&C4
Driver: n/a
Name: PCI standard host CPU bridge
Device ID: PCI\VEN_1022&DEV_1203&SUBSYS_00000000&REV_00\3&267A616A&0&C3
Driver: n/a
Name: PCI standard host CPU bridge
Device ID: PCI\VEN_1022&DEV_1202&SUBSYS_00000000&REV_00\3&267A616A&0&C2
Driver: n/a
Name: PCI standard host CPU bridge
Device ID: PCI\VEN_1022&DEV_1201&SUBSYS_00000000&REV_00\3&267A616A&0&C1
Driver: n/a
Name: PCI standard host CPU bridge
Device ID: PCI\VEN_1022&DEV_1200&SUBSYS_00000000&REV_00\3&267A616A&0&C0
Driver: n/a
Name: PCI standard ISA bridge
Device ID: PCI\VEN_1002&DEV_439D&SUBSYS_00000000&REV_00\3&267A616A&0&A3
Driver: C:\WINDOWS\system32\DRIVERS\isapnp.sys, 5.01.2600.5512 (English), 4/13/2008 13:36:41, 37248 bytes
Name: Standard Dual Channel PCI IDE Controller
Device ID: PCI\VEN_1002&DEV_439C&SUBSYS_83891043&REV_00\3&267A616A&0&A1
Driver: C:\WINDOWS\system32\DRIVERS\pciidex.sys, 5.01.2600.5512 (English), 4/13/2008 13:40:29, 24960 bytes
Driver: C:\WINDOWS\system32\DRIVERS\atapi.sys, 5.01.2600.5512 (English), 4/13/2008 13:40:30, 96512 bytes
Driver: C:\WINDOWS\system32\DRIVERS\pciide.sys, 5.01.2600.0000 (English), 8/4/2004 07:00:00, 3328 bytes
Name: Standard OpenHCD USB Host Controller
Device ID: PCI\VEN_1002&DEV_4399&SUBSYS_83891043&REV_00\3&267A616A&0&A5
Driver: C:\WINDOWS\system32\drivers\usbohci.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:35, 17152 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 19:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:37, 59520 bytes
Name: Standard OpenHCD USB Host Controller
Device ID: PCI\VEN_1002&DEV_4398&SUBSYS_83891043&REV_00\3&267A616A&0&99
Driver: C:\WINDOWS\system32\drivers\usbohci.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:35, 17152 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 19:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:37, 59520 bytes
Name: Standard OpenHCD USB Host Controller
Device ID: PCI\VEN_1002&DEV_4398&SUBSYS_83891043&REV_00\3&267A616A&0&91
Driver: C:\WINDOWS\system32\drivers\usbohci.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:35, 17152 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 19:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:37, 59520 bytes
Name: Standard OpenHCD USB Host Controller
Device ID: PCI\VEN_1002&DEV_4397&SUBSYS_83891043&REV_00\3&267A616A&0&98
Driver: C:\WINDOWS\system32\drivers\usbohci.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:35, 17152 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 19:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:37, 59520 bytes
Name: Standard OpenHCD USB Host Controller
Device ID: PCI\VEN_1002&DEV_4397&SUBSYS_83891043&REV_00\3&267A616A&0&90
Driver: C:\WINDOWS\system32\drivers\usbohci.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:35, 17152 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 19:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:37, 59520 bytes
Name: Standard Enhanced PCI to USB Host Controller
Device ID: PCI\VEN_1002&DEV_4396&SUBSYS_83891043&REV_00\3&267A616A&0&9A
Driver: C:\WINDOWS\system32\drivers\usbehci.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:35, 30208 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 19:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:37, 59520 bytes
Driver: C:\WINDOWS\system32\hccoin.dll, 5.01.2600.5512 (English), 4/13/2008 19:11:54, 7168 bytes
Name: Standard Enhanced PCI to USB Host Controller
Device ID: PCI\VEN_1002&DEV_4396&SUBSYS_83891043&REV_00\3&267A616A&0&92
Driver: C:\WINDOWS\system32\drivers\usbehci.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:35, 30208 bytes
Driver: C:\WINDOWS\system32\drivers\usbport.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:36, 143872 bytes
Driver: C:\WINDOWS\system32\usbui.dll, 5.01.2600.5512 (English), 4/13/2008 19:12:08, 74240 bytes
Driver: C:\WINDOWS\system32\drivers\usbhub.sys, 5.01.2600.5512 (English), 4/13/2008 13:45:37, 59520 bytes
Driver: C:\WINDOWS\system32\hccoin.dll, 5.01.2600.5512 (English), 4/13/2008 19:11:54, 7168 bytes
Name: Standard Dual Channel PCI IDE Controller
Device ID: PCI\VEN_1002&DEV_4390&SUBSYS_83891043&REV_00\3&267A616A&0&88
Driver: C:\WINDOWS\system32\DRIVERS\pciidex.sys, 5.01.2600.5512 (English), 4/13/2008 13:40:29, 24960 bytes
Driver: C:\WINDOWS\system32\DRIVERS\atapi.sys, 5.01.2600.5512 (English), 4/13/2008 13:40:30, 96512 bytes
Driver: C:\WINDOWS\system32\DRIVERS\pciide.sys, 5.01.2600.0000 (English), 8/4/2004 07:00:00, 3328 bytes
Name: AMD SMBus
Device ID: PCI\VEN_1002&DEV_4385&SUBSYS_83891043&REV_3C\3&267A616A&0&A0
Driver: n/a
Name: PCI standard PCI-to-PCI bridge
Device ID: PCI\VEN_1002&DEV_4384&SUBSYS_00000000&REV_00\3&267A616A&0&A4
Driver: C:\WINDOWS\system32\DRIVERS\pci.sys, 5.01.2600.5512 (English), 4/13/2008 13:36:44, 68224 bytes
Name: Microsoft UAA Bus Driver for High Definition Audio
Device ID: PCI\VEN_1002&DEV_4383&SUBSYS_836C1043&REV_00\3&267A616A&0&A2
Driver: C:\WINDOWS\system32\DRIVERS\hdaudbus.sys, 5.10.0001.5013 (English), 4/13/2008 11:36:05, 144384 bytes
------------------
DirectX Components
------------------
ddraw.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:51 279552 bytes
ddrawex.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:51 27136 bytes
dxapi.sys: 5.01.2600.0000 English Final Retail 8/4/2004 07:00:00 10496 bytes
d3d8.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:51 1179648 bytes
d3d8thk.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:51 8192 bytes
d3d9.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:51 1689088 bytes
d3dim.dll: 5.01.2600.0000 English Final Retail 8/4/2004 07:00:00 436224 bytes
d3dim700.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:51 824320 bytes
d3dramp.dll: 5.01.2600.0000 English Final Retail 8/4/2004 07:00:00 590336 bytes
d3drm.dll: 5.01.2600.0000 English Final Retail 8/4/2004 07:00:00 350208 bytes
d3dxof.dll: 5.01.2600.0000 English Final Retail 8/4/2004 07:00:00 47616 bytes
d3dpmesh.dll: 5.01.2600.0000 English Final Retail 8/4/2004 07:00:00 34816 bytes
dplay.dll: 5.00.2134.0001 English Final Retail 8/4/2004 07:00:00 33040 bytes
dplayx.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 229888 bytes
dpmodemx.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 23552 bytes
dpwsock.dll: 5.00.2134.0001 English Final Retail 8/4/2004 07:00:00 42768 bytes
dpwsockx.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 57344 bytes
dplaysvr.exe: 5.03.2600.5512 English Final Retail 4/13/2008 19:12:17 29696 bytes
dpnsvr.exe: 5.03.2600.5512 English Final Retail 4/13/2008 19:12:17 17920 bytes
dpnet.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 375296 bytes
dpnlobby.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:09:20 3072 bytes
dpnaddr.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:09:19 3072 bytes
dpvoice.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 212480 bytes
dpvsetup.exe: 5.03.2600.5512 English Final Retail 4/13/2008 19:12:18 83456 bytes
dpvvox.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 116736 bytes
dpvacm.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 21504 bytes
dpnhpast.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 35328 bytes
dpnhupnp.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 60928 bytes
dpserial.dll: 5.00.2134.0001 English Final Retail 8/4/2004 07:00:00 53520 bytes
dinput.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 158720 bytes
dinput8.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 181760 bytes
dimap.dll: 5.01.2600.0000 English Final Retail 8/4/2004 07:00:00 44032 bytes
diactfrm.dll: 5.01.2600.0000 English Final Retail 8/4/2004 07:00:00 394240 bytes
joy.cpl: 5.03.2600.5512 English Final Retail 4/13/2008 19:12:41 68608 bytes
gcdef.dll: 5.01.2600.0000 English Final Retail 8/4/2004 07:00:00 76800 bytes
pid.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:12:02 35328 bytes
gameenum.sys: 5.01.2600.5512 English Final Retail 4/13/2008 13:45:30 10624 bytes
dsound.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 367616 bytes
dsound3d.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 1293824 bytes
dswave.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 19456 bytes
dsdmo.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 181248 bytes
dsdmoprp.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 71680 bytes
dmusic.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 104448 bytes
dmband.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 28672 bytes
dmcompos.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 61440 bytes
dmime.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 181248 bytes
dmloader.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 35840 bytes
dmstyle.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 105984 bytes
dmsynth.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 103424 bytes
dmscript.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 82432 bytes
system.dll: 1.01.4322.2500 English Final Retail 11/25/2012 00:16:26 1232896 bytes
dx7vb.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 619008 bytes
dx8vb.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 1227264 bytes
dxdiagn.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:52 2113536 bytes
mfc40.dll: 4.01.0000.6151 English Beta Retail 9/18/2010 01:53:25 954368 bytes
mfc42.dll: 6.02.8081.0000 English Final Retail 2/8/2011 08:33:55 978944 bytes
wsock32.dll: 5.01.2600.5512 English Final Retail 4/13/2008 19:12:10 22528 bytes
amstream.dll: 6.05.2600.5512 English Final Retail 4/13/2008 19:11:49 70656 bytes
devenum.dll: 6.05.2600.5512 English Final Retail 4/13/2008 19:11:51 59904 bytes
dxmasf.dll: 6.04.0009.1133 English Final Retail 4/13/2008 19:11:52 498742 bytes
mciqtz32.dll: 6.05.2600.5512 English Final Retail 4/13/2008 19:11:56 35328 bytes
mpg2splt.ax: 6.05.2600.5512 English Final Retail 4/13/2008 19:12:42 148992 bytes
msdmo.dll: 6.05.2600.5512 English Final Retail 4/13/2008 19:11:59 14336 bytes
encapi.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:53 20480 bytes
qasf.dll: 11.00.5721.5262 English Final Retail 1/30/2009 20:34:02 211456 bytes
qcap.dll: 6.05.2600.5512 English Final Retail 4/13/2008 19:12:03 192512 bytes
qdv.dll: 6.05.2600.5512 English Final Retail 4/13/2008 19:12:03 279040 bytes
qdvd.dll: 6.05.2600.6169 English Final Retail 11/3/2011 10:28:36 386048 bytes
qedit.dll: 6.05.2600.5512 English Final Retail 4/13/2008 19:12:03 562176 bytes
qedwipes.dll: 6.05.2600.5512 English Final Retail 4/13/2008 12:21:32 733696 bytes
quartz.dll: 6.05.2600.6169 English Final Retail 11/3/2011 10:28:36 1292288 bytes
strmdll.dll: 4.01.0000.3938 English Final Retail 8/26/2009 03:00:21 247326 bytes
iac25_32.ax: 2.00.0005.0053 English Final Retail 4/13/2008 19:12:42 199680 bytes
ir41_32.ax: 4.51.0016.0003 English Final Retail 4/13/2008 19:12:42 848384 bytes
ir41_qc.dll: 4.30.0062.0002 English Final Retail 4/13/2008 19:11:55 120320 bytes
ir41_qcx.dll: 4.30.0064.0001 English Final Retail 4/13/2008 19:11:55 338432 bytes
ir50_32.dll: 5.2562.0015.0055 English Final Retail 4/13/2008 19:11:55 755200 bytes
ir50_qc.dll: 5.00.0063.0048 English Final Retail 4/13/2008 19:11:55 200192 bytes
ir50_qcx.dll: 5.00.0064.0048 English Final Retail 4/13/2008 19:11:55 183808 bytes
ivfsrc.ax: 5.10.0002.0051 English Final Retail 4/13/2008 19:12:42 154624 bytes
mswebdvd.dll: 6.05.2600.5857 English Final Retail 8/5/2009 04:01:48 204800 bytes
ks.sys: 5.03.2600.5512 English Final Retail 4/13/2008 14:16:36 141056 bytes
ksproxy.ax: 5.03.2600.5512 English Final Retail 4/13/2008 19:12:42 129536 bytes
ksuser.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:11:56 4096 bytes
stream.sys: 5.03.2600.5512 English Final Retail 4/13/2008 13:45:16 49408 bytes
mspclock.sys: 5.03.2600.5512 English Final Retail 4/13/2008 13:39:50 5376 bytes
mspqm.sys: 5.01.2600.5512 English Final Retail 4/13/2008 13:39:51 4992 bytes
mskssrv.sys: 5.03.2600.5512 English Final Retail 4/13/2008 13:39:52 7552 bytes
swenum.sys: 5.03.2600.5512 English Final Retail 4/13/2008 13:39:53 4352 bytes
mstee.sys: 5.03.2600.5512 English Final Retail 4/13/2008 12:39:50 5504 bytes
bdaplgin.ax: 5.03.2600.5512 English Final Retail 4/13/2008 18:12:42 18432 bytes
bdasup.sys: 5.03.2600.5512 English Final Retail 4/13/2008 12:46:22 11776 bytes
msdvbnp.ax: 6.05.2600.5512 English Final Retail 4/13/2008 18:12:42 56832 bytes
psisdecd.dll: 6.05.2600.5512 English Final Retail 4/13/2008 18:12:04 363520 bytes
psisrndr.ax: 6.05.2600.5512 English Final Retail 4/13/2008 18:12:42 33280 bytes
ipsink.ax: 5.03.2600.5512 English Final Retail 4/13/2008 18:12:42 16384 bytes
mpeg2data.ax: 6.05.2600.5512 English Final Retail 4/13/2008 19:12:42 118272 bytes
ndisip.sys: 5.03.2600.5512 English Final Retail 4/13/2008 12:46:22 10880 bytes
mpe.sys: 5.03.2600.5512 English Final Retail 4/13/2008 12:46:22 15232 bytes
streamip.sys: 5.03.2600.5512 English Final Retail 4/13/2008 12:46:22 15232 bytes
msvidctl.dll: 6.05.2600.5512 English Final Retail 4/13/2008 19:12:01 1428992 bytes
slip.sys: 5.03.2600.5512 English Final Retail 4/13/2008 12:46:24 11136 bytes
nabtsfec.sys: 5.03.2600.5512 English Final Retail 4/13/2008 12:46:26 85248 bytes
ccdecode.sys: 5.03.2600.5512 English Final Retail 4/13/2008 12:46:24 17024 bytes
vbisurf.ax: 5.03.2600.5512 English Final Retail 4/13/2008 19:12:42 30208 bytes
msyuv.dll: 5.03.2600.5908 English Final Retail 11/27/2009 12:11:44 17920 bytes
kstvtune.ax: 5.03.2600.5512 English Final Retail 4/13/2008 18:12:42 61952 bytes
ksxbar.ax: 5.03.2600.5512 English Final Retail 4/13/2008 18:12:42 43008 bytes
kswdmcap.ax: 5.03.2600.5512 English Final Retail 4/13/2008 18:12:42 91136 bytes
vfwwdm32.dll: 5.01.2600.5512 English Final Retail 4/13/2008 18:12:08 53760 bytes
wstcodec.sys: 5.03.2600.5512 English Final Retail 4/13/2008 12:46:24 19200 bytes
wstdecod.dll: 5.03.2600.5512 English Final Retail 4/13/2008 19:12:10 50688 bytes
------------------
DirectShow Filters
------------------
WDM Streaming VBI Codecs:
NABTS/FEC VBI Codec,0x00200000,2,1,,5.03.2600.5512
CC Decoder,0x00200000,2,1,,5.03.2600.5512
WST Codec,0x00200000,1,1,,5.03.2600.5512
DirectShow Filters:
WMAudio Decoder DMO,0x00800800,1,1,,
WMAPro over S/PDIF DMO,0x00600800,1,1,,
WMA Voice Decoder DMO,0x00600800,1,1,,
Mpeg4s Decoder DMO,0x00800001,1,1,,
WMV Screen decoder DMO,0x00800001,1,1,,
WMVideo Decoder DMO,0x00800001,1,1,,
Mpeg43 Decoder DMO,0x00800001,1,1,,
Mpeg4 Decoder DMO,0x00800001,1,1,,
WMT MuxDeMux Filter,0x00200000,0,0,wmm2filt.dll,2.01.4026.0000
ffdshow Video Decoder,0xffff0000,2,1,ffdshow.ax,1.00.0005.1712
Full Screen Renderer,0x00200000,1,0,quartz.dll,6.05.2600.6169
CoreAVC Video Decoder,0x00600000,1,1,CoreAVC.ax,0.00.0000.0004
ffdshow DXVA Video Decoder,0xffff0000,2,1,ffdshow.ax,1.01.3611.0000
ffdshow raw video filter,0xffff0000,2,1,ffdshow.ax,1.00.0005.1712
RealPlayer Video Filter,0x00200000,1,1,rdsf3260.dll,15.00.0006.0014
Mpa Splitter,0x00600001,1,1,MpaSplitter.ax,1.00.0000.0002
ffdshow Audio Decoder,0xffff0000,1,1,ffdshow.ax,1.00.0005.1712
DV Muxer,0x00400000,0,0,qdv.dll,6.05.2600.5512
Color Space Converter,0x00400001,1,1,quartz.dll,6.05.2600.6169
iVAC Time Delay ,0x00400000,1,1,tmdly.ax,2.70.0000.0000
WM ASF Reader,0x00400000,0,0,qasf.dll,11.00.5721.5262
Screen Capture filter,0x00200000,0,1,wmpsrcwp.dll,11.00.5721.5262
AVI Splitter,0x00600000,1,1,quartz.dll,6.05.2600.6169
WMT AudioAnalyzer,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
VGA 16 Color Ditherer,0x00400000,1,1,quartz.dll,6.05.2600.6169
Indeo® video 5.10 Compression Filter,0x00200000,1,1,ir50_32.dll,5.2562.0015.0055
Windows Media Audio Decoder,0x00800001,1,1,msadds32.ax,8.00.0000.4487
RealVideo Decoder,0x00400000,1,1,realmediasplitter.ax,1.00.0001.0001
ArcSoft RealMedia Splitter,0x00600000,1,1,ArcRealMediaSplitter.ax,1.00.0000.0005
AC3 Parser Filter,0x00600000,1,1,mpg2splt.ax,6.05.2600.5512
WMT Format Conversion,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
StreamBufferSink,0x00200000,0,0,sbe.dll,6.05.2600.6076
WMT Black Frame Generator,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
HP Frame Grabber Filter,0x00200000,1,1,hpqdsftr.ax,45.04.0157.0000
MJPEG Decompressor,0x00600000,1,1,quartz.dll,6.05.2600.6169
Indeo® video 5.10 Decompression Filter,0x00640000,1,1,ir50_32.dll,5.2562.0015.0055
WMT Screen Capture filter,0x00200000,0,1,wmm2filt.dll,2.01.4026.0000
Microsoft Screen Video Decompressor,0x00800000,1,1,msscds32.ax,8.00.0000.4487
MPEG-I Stream Splitter,0x00600000,1,2,quartz.dll,6.05.2600.6169
SAMI (CC) Parser,0x00400000,1,1,quartz.dll,6.05.2600.6169
MPEG Layer-3 Decoder,0x00810000,1,1,l3codecx.ax,1.06.0000.0052
MPV Decoder Filter,0x40000002,1,1,Mpeg2DecFilter.ax,1.00.0000.0003
MPEG-2 Splitter,0x005fffff,1,0,mpg2splt.ax,6.05.2600.5512
ArcSoft RealMedia Video Decoder,0x00600000,1,1,RealVideoDecoder.ax,1.00.0000.0005
MP4 Source,0xffff0000,0,0,MP4splitter.ax,1.00.0000.0002
ACELP.net Sipro Lab Audio Decoder,0x00800001,1,1,acelpdec.ax,1.04.0000.0000
MemoryStick Voice Decrypt Splitter,0x00600000,1,1,msvdec.ax,1.00.0007.8060
FLV Splitter,0xffff0000,1,1,FLVSplitter.ax,1.00.0000.0005
Internal Script Command Renderer,0x00800001,1,0,quartz.dll,6.05.2600.6169
AVS Video Out,0x00200000,0,1,AVSVideoOutFilter3.ax,1.00.0000.0248
MPEG Audio Decoder,0x03680001,1,1,quartz.dll,6.05.2600.6169
WavPack Audio Decoder,0x00600000,1,1,WavPackDSDecoder.ax,1.00.0003.0431
File Source (Netshow URL),0x00400000,0,1,wmpasf.dll,11.00.5721.5262
WMT Import Filter,0x00200000,0,1,wmm2filt.dll,2.01.4026.0000
DV Splitter,0x00600000,1,2,qdv.dll,6.05.2600.5512
Bitmap Generate,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Windows Media Video Decoder,0x00800000,1,1,wmvds32.ax,8.00.0000.4487
Video Mixing Renderer 9,0x00200000,1,0,quartz.dll,
CoreFLAC Audio Source,0x00600000,0,0,CoreFLACDecoder.ax,0.04.0000.0046
Windows Media Video Decoder,0x00800000,1,1,wmv8ds32.ax,8.00.0000.4000
Haali Media Splitter,0x00800001,0,1,splitter.ax,1.06.0338.0023
Haali Media Splitter (AR),0x00400000,1,1,splitter.ax,1.06.0338.0023
WMT VIH2 Fix,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Mpa Source,0x00600001,0,0,MpaSplitter.ax,1.00.0000.0002
Record Queue,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
CoreFLAC Audio Decoder,0x00600000,1,1,CoreFLACDecoder.ax,0.04.0000.0046
MP4 Splitter,0xffff0000,1,1,MP4splitter.ax,1.00.0000.0002
Windows Media Multiplexer,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
ASX file Parser,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
ASX v.2 file Parser,0x00600000,1,0,wmpasf.dll,11.00.5721.5262
NSC file Parser,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
ACM Wrapper,0x00600000,1,1,quartz.dll,6.05.2600.6169
CoreAAC Audio Decoder,0x00800000,1,1,CoreAAC.ax,1.01.0000.0642
Windows Media source filter,0x00600000,0,2,wmpasf.dll,11.00.5721.5262
Video Renderer,0x00800001,1,0,quartz.dll,6.05.2600.6169
Frame Eater,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
MPEG-2 Video Stream Analyzer,0x00200000,0,0,sbe.dll,6.05.2600.6076
Ogg Source,0x00600001,0,0,OggSplitter.ax,1.00.0000.0000
Line 21 Decoder,0x00600000,1,1,qdvd.dll,6.05.2600.6169
Video Port Manager,0x00600000,2,1,quartz.dll,6.05.2600.6169
WST Decoder,0x00600000,1,1,wstdecod.dll,5.03.2600.5512
Video Renderer,0x00400000,1,0,quartz.dll,6.05.2600.6169
Haali Video Renderer,0x00200000,1,0,dxr.dll,
RealMedia Source,0x00600000,0,0,realmediasplitter.ax,1.00.0001.0001
LEAD MCMP/MJPEG Codec,0x00100000,1,1,LCodcCMP.dll,1.00.0000.0021
LEAD MCMP/MJPEG Decoder,0x00800000,1,1,LCodcCMP.dll,1.00.0000.0021
MSV LPEC Splitter,0x00810000,1,1,lpecsp.ax,1.01.0009.8060
Sony LPEC Decoder,0x00810000,1,1,lpecde.ax,1.00.0008.8060
MSV LPEC Stereo Splitter,0x00810000,1,1,lcstsp.ax,1.00.0008.8060
Sony LPEC Stereo Decoder,0x00810000,1,1,lcstde.ax,1.01.0004.8060
MSV TRC Splitter,0x00610000,1,1,trcsp.ax,1.01.0008.8060
Sony TRC Decoder,0x00810000,1,1,trcde.ax,1.01.0008.8060
WM ASF Writer,0x00400000,0,0,qasf.dll,11.00.5721.5262
FLV4 Video Decoder,0x00400000,1,1,FLVSplitter.ax,1.00.0000.0005
WMT Sample Information Filter,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
VBI Surface Allocator,0x00600000,1,1,vbisurf.ax,5.03.2600.5512
File writer,0x00200000,1,0,qcap.dll,6.05.2600.5512
RadLight MPC DirectShow Filter,0x00600000,0,1,RLMPCDec.ax,1.00.0000.0004
Haali Simple Media Splitter,0x00200000,0,1,splitter.ax,1.06.0338.0023
WMT Log Filter,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
WMT Virtual Renderer,0x00200000,1,0,wmm2filt.dll,2.01.4026.0000
DirectVobSub,0x00200000,2,1,VSFilter.dll,2.40.2677.0000
RealAudio Decoder,0x00400000,1,1,realmediasplitter.ax,1.00.0001.0001
Avi Splitter,0x00600001,1,1,AviSplitter.ax,1.00.0000.0007
DirectVobSub (auto-loading version),0x00800002,2,1,VSFilter.dll,2.40.2677.0000
WAV Dest,0x00000000,0,0,,
DVD Navigator,0x00200000,0,2,qdvd.dll,6.05.2600.6169
Hauppauge WinTV SnapShot,0x00200000,1,1,Hcwsnap.ax,1.12.21077.0000
Ogg Splitter,0x00600001,1,1,OggSplitter.ax,1.00.0000.0000
Overlay Mixer2,0x00400000,1,1,qdvd.dll,6.05.2600.6169
Haali Matroska Muxer,0x00200000,1,0,splitter.ax,1.06.0338.0023
AC3Filter,0x40000000,1,1,ac3filter.ax,0.07.0000.0000
AVI Draw,0x00600064,9,1,quartz.dll,6.05.2600.6169
.RAM file Parser,0x00600000,1,0,wmpasf.dll,11.00.5721.5262
Hauppauge WinTV File Writer,0x00200000,1,0,,
WMT DirectX Transform Wrapper,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
G.711 Codec,0x00200000,1,1,g711codc.ax,5.01.2600.0000
MPEG-2 Demultiplexer,0x00600000,1,1,mpg2splt.ax,6.05.2600.5512
DV Video Decoder,0x00800000,1,1,qdv.dll,6.05.2600.5512
RealPlayer Transcode Filter,0x00600000,0,0,rdsf3260.dll,15.00.0006.0014
Indeo® audio software,0x00500000,1,1,iac25_32.ax,2.00.0005.0053
Windows Media Update Filter,0x00400000,1,0,wmpasf.dll,11.00.5721.5262
ffdshow Audio Processor,0xffff0000,1,1,ffdshow.ax,1.00.0005.1712
ASF DIB Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
ASF ACM Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
ASF ICM Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
ASF URL Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
ASF JPEG Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
ASF DJPEG Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
ASF embedded stuff Handler,0x00600000,1,1,wmpasf.dll,11.00.5721.5262
9x8Resize,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
WIA Stream Snapshot Filter,0x00200000,1,1,wiasf.ax,1.00.0000.0000
Allocator Fix,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
SampleGrabber,0x00200000,1,1,qedit.dll,6.05.2600.5512
Null Renderer,0x00200000,1,0,qedit.dll,6.05.2600.5512
WMT Virtual Source,0x00200000,0,1,wmm2filt.dll,2.01.4026.0000
MPEG-2 Sections and Tables,0x005fffff,1,0,Mpeg2Data.ax,6.05.2600.5512
WMT Interlacer,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
FLV Source,0x00600001,0,0,FLVSplitter.ax,1.00.0000.0005
StreamBufferSource,0x00200000,0,0,sbe.dll,6.05.2600.6076
Smart Tee,0x00200000,1,2,qcap.dll,6.05.2600.5512
Overlay Mixer,0x00200000,0,0,qdvd.dll,6.05.2600.6169
Avi Source,0x00600001,0,0,AviSplitter.ax,1.00.0000.0007
RealPlayer Audio Filter,0x00200000,1,1,rdsf3260.dll,15.00.0006.0014
AVI Decompressor,0x00600000,1,1,quartz.dll,6.05.2600.6169
Uncompressed Domain Shot Detection Filter,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
AVI/WAV File Source,0x00400000,0,2,quartz.dll,6.05.2600.6169
MPEG4 Video Splitter,0xffff0000,1,1,MP4splitter.ax,1.00.0000.0002
QuickTime Movie Parser,0x00600000,1,1,quartz.dll,6.05.2600.6169
Wave Parser,0x00400000,1,1,quartz.dll,6.05.2600.6169
MIDI Parser,0x00400000,1,1,quartz.dll,6.05.2600.6169
Multi-file Parser,0x00400000,1,1,quartz.dll,6.05.2600.6169
File stream renderer,0x00400000,1,1,quartz.dll,6.05.2600.6169
XML Playlist,0x00400000,1,0,wmpasf.dll,11.00.5721.5262
Arcsoft AMRDecoder,0x00600000,1,1,AMRDecoder.ax,1.00.0000.0019
Zoran Decompressor,0x00200000,1,1,nuvision.ax,2.00.0003.0002
WavPack Audio Splitter,0x00600000,1,1,WavPackDSSplitter.ax,1.00.0003.0277
ffdshow subtitles filter,0xffff0000,2,1,ffdshow.ax,1.01.3611.0000
RealMedia Splitter,0x00600000,1,1,realmediasplitter.ax,1.00.0001.0001
AVI Mux,0x00200000,1,0,qcap.dll,6.05.2600.5512
MPEG4 Video Source,0xffff0000,0,0,MP4splitter.ax,1.00.0000.0002
Line 21 Decoder 2,0x00600002,1,1,quartz.dll,6.05.2600.6169
iVAC USB Filter,0x00400000,0,1,usbsrc.ax,
File Source (Async.),0x00400000,0,1,quartz.dll,6.05.2600.6169
File Source (URL),0x00400000,0,1,quartz.dll,6.05.2600.6169
WMT DV Extract,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
WMT Switch Filter,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Hauppauge WinTV File Reader,0x00200000,0,1,hcwFread.ax,1.08.20168.0000
WMT Volume,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Haali Video Sink,0x00200000,1,0,splitter.ax,1.06.0338.0023
Stretch Video,0x00200000,1,1,wmm2filt.dll,2.01.4026.0000
Infinite Pin Tee Filter,0x00200000,1,1,qcap.dll,6.05.2600.5512
Enhanced Video Renderer,0x00200000,1,0,evr.dll,6.00.6002.18084
BDA MPEG2 Transport Information Filter,0x00200000,1,0,PsisRndr.ax,6.05.2600.5512
QT Decompressor,0x00600000,1,1,quartz.dll,6.05.2600.6169
MPEG Video Decoder,0x40000001,1,1,quartz.dll,6.05.2600.6169
Indeo® video 4.4 Decompression Filter,0x00640000,1,1,ir41_32.ax,4.51.0016.0003
Indeo® video 4.4 Compression Filter,0x00200000,1,1,ir41_32.ax,4.51.0016.0003
WDM Streaming Tee/Splitter Devices:
Tee/Sink-to-Sink Converter,0x00200000,1,1,,5.03.2600.5512
WDM Streaming Data Transforms:
Microsoft Kernel Acoustic Echo Canceller,0x00000000,0,0,,
Microsoft Kernel GS Wavetable Synthesizer,0x00200000,1,1,,5.03.2600.5512
Microsoft Kernel DLS Synthesizer,0x00200000,1,1,,5.03.2600.5512
Microsoft Kernel DRM Audio Descrambler,0x00200000,1,1,,5.03.2600.5512
Video Compressors:
WMVideo8 Encoder DMO,0x00600800,1,1,,
MSScreen encoder DMO,0x00600800,1,1,,
WMVideo9 Encoder DMO,0x00600800,1,1,,
MSScreen 9 encoder DMO,0x00600800,1,1,,
DV Video Encoder,0x00200000,0,0,qdv.dll,6.05.2600.5512
ffdshow video encoder,0x00100000,1,1,ffdshow.ax,1.00.0005.1712
Indeo® video 5.10 Compression Filter,0x00100000,1,1,ir50_32.dll,5.2562.0015.0055
LEAD MCMP/MJPEG Codec,0x00100000,1,1,LCodcCMP.dll,1.00.0000.0021
MJPEG Compressor,0x00200000,0,0,quartz.dll,6.05.2600.6169
Cinepak Codec by Radius,0x00200000,1,1,qcap.dll,6.05.2600.5512
ffdshow Video Codec,0x00200000,1,1,qcap.dll,6.05.2600.5512
Intel 4:2:0 Video V2.50,0x00200000,1,1,qcap.dll,6.05.2600.5512
Intel Indeo(R) Video R3.2,0x00200000,1,1,qcap.dll,6.05.2600.5512
Intel Indeo® Video 4.5,0x00200000,1,1,qcap.dll,6.05.2600.5512
Indeo® video 5.10,0x00200000,1,1,qcap.dll,6.05.2600.5512
Intel IYUV codec,0x00200000,1,1,qcap.dll,6.05.2600.5512
Microsoft H.261 Video Codec,0x00200000,1,1,qcap.dll,6.05.2600.5512
Microsoft H.263 Video Codec,0x00200000,1,1,qcap.dll,6.05.2600.5512
Microsoft RLE,0x00200000,1,1,qcap.dll,6.05.2600.5512
Microsoft Video 1,0x00200000,1,1,qcap.dll,6.05.2600.5512
Audio Compressors:
WMA Voice Encoder DMO,0x00600800,1,1,,
WM Speech Encoder DMO,0x00600800,1,1,,
WMAudio Encoder DMO,0x00600800,1,1,,
IAC2,0x00200000,1,1,quartz.dll,6.05.2600.6169
IMA ADPCM,0x00200000,1,1,quartz.dll,6.05.2600.6169
PCM,0x00200000,1,1,quartz.dll,6.05.2600.6169
Microsoft ADPCM,0x00200000,1,1,quartz.dll,6.05.2600.6169
ACELP.net,0x00200000,1,1,quartz.dll,6.05.2600.6169
DSP Group TrueSpeech(TM),0x00200000,1,1,quartz.dll,6.05.2600.6169
Windows Media Audio V1,0x00200000,1,1,quartz.dll,6.05.2600.6169
Windows Media Audio V2,0x00200000,1,1,quartz.dll,6.05.2600.6169
GSM 6.10,0x00200000,1,1,quartz.dll,6.05.2600.6169
Microsoft G.723.1,0x00200000,1,1,quartz.dll,6.05.2600.6169
CCITT A-Law,0x00200000,1,1,quartz.dll,6.05.2600.6169
CCITT u-Law,0x00200000,1,1,quartz.dll,6.05.2600.6169
MPEG Layer-3,0x00200000,1,1,quartz.dll,6.05.2600.6169
Audio Capture Sources:
VIA HD Audio Input,0x00200000,0,0,qcap.dll,6.05.2600.5512
Midi Renderers:
Default MidiOut Device,0x00800000,1,0,quartz.dll,6.05.2600.6169
Microsoft GS Wavetable SW Synth,0x00200000,1,0,quartz.dll,6.05.2600.6169
WDM Streaming Capture Devices:
VIA HD Audio Input,0x00200000,1,1,,5.03.2600.5512
WDM Streaming Rendering Devices:
VIA HD Audio Output,0x00200000,2,1,,5.03.2600.5512
BDA Rendering Filters:
BDA IP Sink,0x00200000,1,1,,5.03.2600.5512
BDA Network Providers:
Microsoft ATSC Network Provider,0x00200000,0,1,MsDvbNp.ax,6.05.2600.5512
Microsoft DVBC Network Provider,0x00200000,0,1,MsDvbNp.ax,6.05.2600.5512
Microsoft DVBS Network Provider,0x00200000,0,1,MsDvbNp.ax,6.05.2600.5512
Microsoft DVBT Network Provider,0x00200000,0,1,MsDvbNp.ax,6.05.2600.5512
Multi-Instance Capable VBI Codecs:
VBI Codec,0x00600000,1,4,,
BDA Transport Information Renderers:
BDA MPEG2 Transport Information Filter,0x00600000,1,0,PsisRndr.ax,6.05.2600.5512
MPEG-2 Sections and Tables,0x00600000,1,0,Mpeg2Data.ax,6.05.2600.5512
WDM Streaming Mixer Devices:
Microsoft Kernel Wave Audio Mixer,0x00000000,0,0,,
BDA CP/CA Filters:
Decrypt/Tag,0x00600000,1,0,encdec.dll,6.05.2600.6161
Encrypt/Tag,0x00200000,0,0,encdec.dll,6.05.2600.6161
XDS Codec,0x00200000,0,0,encdec.dll,6.05.2600.6161
WDM Streaming Communication Transforms:
Tee/Sink-to-Sink Converter,0x00200000,1,1,,5.03.2600.5512
Audio Renderers:
VIA HD Audio Output,0x00200000,1,0,quartz.dll,6.05.2600.6169
Default DirectSound Device,0x00800000,1,0,quartz.dll,6.05.2600.6169
Default WaveOut Device,0x00200000,1,0,quartz.dll,6.05.2600.6169
DirectSound: VIA HD Audio Output,0x00200000,1,0,quartz.dll,6.05.2600.6169
WDM Streaming System Devices:
VIA HD Audio Input,0x00200000,10,2,,5.03.2600.5512
VIA HD Audio Output,0x00200000,1,1,,5.03.2600.5512
BDA Receiver Component:
BDA Slip De-Framer,0x00600000,1,1,,5.03.2600.5512
BDA MPE Filter,0x00600000,1,1,,5.03.2600.5512


----------



## Cookiegal (Aug 27, 2003)

What is the make and model of the computer?

It's important to have everything backed up before we proceed with any further diagnostics because tests on the hard drive will stress it and could cause an already fragile hard drive to fail so let me know when you've done that as we don't want you to lose any data or photos, etc.


----------



## shadowbird (Oct 9, 2012)

My son made it from Newegg components. I could look up the receipt if you want the names. Everything is backed up. I'm just thinking I should see if my son or husband has another harddrive sitting around that would make do, because I can't buy a new one yet.


----------



## shadowbird (Oct 9, 2012)

APEL PC-389-C Black Steel ATX Mid Tower Computer Case

Samsung Spinpoint F1 HD322HJ 320GB 7200 RPM SATA 3.0 Gb/s 3.5" Hard Drive-Bare Drive

AMD Athlon II X2 240 Regor 2.8 GHz Socket AM3 65W Dual-Core Processor ADX240OCGQBOX

G.SKILL 4GB (2 x 2 GB) 240-Pin DDR2 SDRAM DDR2 800 (PC2 6400) Dual Channel Kit Desktop Memory Model F2-6400CL5D-4GBNT 

Rosewell Green Series RC530-S12 530W Continuous @40 degrees C, 80 PLUS Certified, Single 12V Rail, Active PFC &#8220;Compatible with Core...

ASUS M4A785-M AM3/AM2+/AM2 AMD 785G HDMI Micro ATX AMD Motherboard


----------



## shadowbird (Oct 9, 2012)

It looks like my hard drive is still under warranty - just a couple more weeks. So if it's going to crash, hopefully it will it happen during the warranty! Let me know what I need to do next. Thanks, Cookiegal!!


----------



## Cookiegal (Aug 27, 2003)

I'm going to confer with some other people as hardware is not my specialty.


----------



## Cookiegal (Aug 27, 2003)

But we can do this in the meantime.

Try running chkdsk.

Click Start and My Computer. Right-click the hard drive you want to check, and click Properties. Select the Tools tab and click Check Now. Check both boxes. Click Start. You'll get a message that the computer must be rebooted to run a complete check. Click Yes and reboot. Chkdsk will take a while, so run it when you don't need to use the computer for something else.

To view results log:

Go to *Start *- *Run *and type in *eventvwr.msc*, and hit enter.
When Event Viewer opens, click on "Application", then scroll down to "Winlogon" and double-click on it to open it up. This is the log created after running chkdsk. Click on the icon that looks like two pieces of paper to copy it and then paste it here please.


----------



## shadowbird (Oct 9, 2012)

When I got back to my PC, it had restarted and was at the login screen. This is the log.

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1002
Date: 12/13/2012
Time: 12:20:51 AM
User: N/A
Computer: FRANCIE-PC
Description:
The shell stopped unexpectedly and Explorer.exe was restarted.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## shadowbird (Oct 9, 2012)

I think maybe there was an automatic update that interrupted it, so I'll run it again.


----------



## Triple6 (Dec 26, 2002)

You can use Seatools to test the drive from Windows: http://www.seagate.com/au/en/support/downloads/seatools/
You should run the "Long Drive Self Test" or "Long Generic" tests: http://knowledge.seagate.com/articles/en_US/FAQ/202435en


----------



## shadowbird (Oct 9, 2012)

Event Type: Information
Event Source: Winlogon
Event Category: None
Event ID: 1001
Date: 12/13/2012
Time: 4:34:32 AM
User: N/A
Computer: FRANCIE-PC
Description:
Checking file system on C:
The type of the file system is NTFS.
A disk check has been scheduled.
Windows will now check the disk. 
Read failure with status 0xc000009c at offset 0xc2700000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0xc270b000 for 0x1000 bytes.
File record segment 39980 is unreadable.
Read failure with status 0xc000009c at offset 0xc270b000 for 0x1000 bytes.
File record segment 39981 is unreadable.
Read failure with status 0xc000009c at offset 0xc270b000 for 0x1000 bytes.
File record segment 39982 is unreadable.
Read failure with status 0xc000009c at offset 0xc270b000 for 0x1000 bytes.
File record segment 39983 is unreadable.
Read failure with status 0xc000009c at offset 0xc270b800 for 0x400 bytes.
The object id index entry in file 0x19 points to file 0x9c2c
but the file has no object id in it.
Deleting an index entry from index $O of file 25.
The object id index entry in file 0x19 points to file 0x9c2d
but the file has no object id in it.
Deleting an index entry from index $O of file 25.
The object id index entry in file 0x19 points to file 0x9c2e
but the file has no object id in it.
Deleting an index entry from index $O of file 25.
The object id index entry in file 0x19 points to file 0x9c2f
but the file has no object id in it.
Deleting an index entry from index $O of file 25.
Cleaning up minor inconsistencies on the drive.
CHKDSK is recovering lost files.
Cleaning up 1199 unused index entries from index $SII of file 0x9.
Cleaning up 1199 unused index entries from index $SDH of file 0x9.
Cleaning up 1199 unused security descriptors.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.
Adding 1 bad clusters to the Bad Clusters File.
Correcting errors in the master file table's (MFT) DATA attribute.
Correcting errors in the master file table's (MFT) BITMAP attribute.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.
312560608 KB total disk space.
226276996 KB in 209000 files.
112832 KB in 37902 indexes.
4 KB in bad sectors.
421420 KB in use by the system.
65536 KB occupied by the log file.
85749356 KB available on disk.
4096 bytes in each allocation unit.
78140152 total allocation units on disk.
21437339 allocation units available on disk.
Internal Info:
30 b1 04 00 7d c4 03 00 a0 10 06 00 00 00 00 00 0...}...........
a5 d8 00 00 08 00 00 00 c1 09 00 00 00 00 00 00 ................
60 3f a7 1d 00 00 00 00 92 04 c4 08 01 00 00 00 `?..............
82 b9 51 22 00 00 00 00 3c 2c 55 d2 0b 00 00 00 ..Q"....<,U.....
18 36 d9 e4 02 00 00 00 10 ef 21 0b 10 00 00 00 .6........!.....
60 83 a1 a7 00 00 00 00 98 38 07 00 68 30 03 00 `........8..h0..
00 00 00 00 00 10 da f2 35 00 00 00 0e 94 00 00 ........5.......
Windows has finished checking your disk.
Please wait while your computer restarts.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## Cookiegal (Aug 27, 2003)

It's not looking good for the hard drive. 

Please perform the diagnostics recommended by Triple6 and post the results.


----------



## shadowbird (Oct 9, 2012)

--------------- SeaTools for Windows v1.2.0.8 ---------------
12/13/2012 9:38:14 PM
Model: HD322HJ
Serial Number: S17AJ9ASA37787
Firmware Revision: 1AC01118
Long Generic - Started 12/13/2012 9:38:14 PM
Long Generic - FAIL 12/13/2012 9:38:46 PM
SeaTools Test Code: 6C9AC2A4


Now is a good time to make sure you have a current backup of your important data.

Unfortunately, your Seagate product has failed an important diagnostic test, possibly caused by problem sectors which are difficult to read. Seagate recommends that you run SeaTools for DOS, which has the ability to repair most problem sectors. SeaTools for DOS may be able to save you from the inconvenience and down time of exchanging the drive. For more information on this subject see our online FAQ:


----------



## shadowbird (Oct 9, 2012)

Thank you VERY much for the Seatools page. I did the diagnostic and it also led me to the page to return the hard drive for another one, which should arrive in two days.

Do you know if there is an easy way to get all my info from this PC into that one without having to reinstall programs? Is there some kind of link cable or something like that?


----------



## Cookiegal (Aug 27, 2003)

That's great. So you're getting this new drive under warranty?

There is software that will allow you to take an image of the drive as it is with all programs installed and transfer that to the new drive but I really think it would be best to reload Windows and all programs because otherwise you will be transferring over whatever clutter is on there now and not needed when it's best to start fresh for optimum performance. But that means you must have the media to reinstall your XP operating system, MS Office and all other software that was installed. Would that be an option for you?


----------



## Triple6 (Dec 26, 2002)

You can use the Seatools Disc Wizard to make an exact and working copy of the old drive onto the new drive: http://www.seagate.com/support/downloads/discwizard/


----------



## Cookiegal (Aug 27, 2003)

Sorry, I didn't know Triple6 was posting at the same time. Personally, I'd prefer to start fresh but he knows WAY more about these things than I do.


----------



## shadowbird (Oct 9, 2012)

If I can find XP and all the other programs, I can start over.


----------



## Cookiegal (Aug 27, 2003)

If you do find it and choose to reinstall the operating system you will also need to load the drivers. Those would be on a separate CD. If you don't have those there's software that you can use to retrieve them from the system before reformatting. Again, Triple6 knows more about that than I do.


----------



## Triple6 (Dec 26, 2002)

A clean install is sometimes the best approach, you get the new computer performance and clear of any bugs. But if you can't find all the installations then the cloning may be the way to go.


----------



## shadowbird (Oct 9, 2012)

I have my CD Key for Windows XP. My son says that with that key, I can get Microsoft to allow a download from online. Do you know anything about that?


----------



## shadowbird (Oct 9, 2012)

What software would I need to use to retrieve all the drivers? I would search the net for one, but I'm concerned I might end up with something that has viruses.


----------



## Cookiegal (Aug 27, 2003)

These are a couple that a fellow moderator recommended to me when I asked the same question.

http://www.innovative-sol.com/drivermax/index.htm
http://sourceforge.net/projects/drvback/

Unfortunately, I can't help with how to use them as I haven't tried yet myself so if you need help please start a new thread for assistance with that.


----------



## Cookiegal (Aug 27, 2003)

You will be hard-pressed to find a legal download of Windows XP (I don't think there are any) because it's no longer sold and is out of mainstream support (it's in extended support until April 2014).

If you can borrow one from a friend you should be able to use that as long as you use your own valid license key to activate.


----------



## shadowbird (Oct 9, 2012)

Thank you, Cookiegal! I will see if I can find a copy of XP and use my key. The harddrive is supposed to be here Wed.


----------



## Cookiegal (Aug 27, 2003)

You're welcome. Please let us know how you get on with this.


----------



## shadowbird (Oct 9, 2012)

Hi CookieGal! I hope you've enjoyed the holiday. A friend who does tech work offered to take my PC and mirror the drive over for me. He surprised me by adding a terabyte drive as a Christmas present. I still haven't installed the replacement drive. Everything is good except I did have one blue screen that happened one time. I don't know what it means. Can you remind me how to read the errors to find out what that was about? Thanks!


----------



## shadowbird (Oct 9, 2012)

Oh, before I got the blue screen, it had been saying that I'm trying to install software that is not signed, but I wasn't trying to install anything. It says it's "Volume Snapshot."

If it helps, I could send you a list of what he did to install and cleanup the drive from an email he sent me, but I don't want to post it publicly.

Thanks, Cookiegal!


----------



## shadowbird (Oct 9, 2012)

Event Type:	Error
Event Source:	Application Error
Event Category:	None
Event ID:	1000
Date: 12/23/2012
Time: 12:20:23 AM
User: N/A
Computer:	FRANCIE-PC
Description:
Faulting application explorer.exe, version 6.0.2900.5512, faulting module tmdly.ax, version 2.70.0.0, fault address 0x00003edb.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 65 78 70 ure exp
0018: 6c 6f 72 65 72 2e 65 78 lorer.ex
0020: 65 20 36 2e 30 2e 32 39 e 6.0.29
0028: 30 30 2e 35 35 31 32 20 00.5512 
0030: 69 6e 20 74 6d 64 6c 79 in tmdly
0038: 2e 61 78 20 32 2e 37 30 .ax 2.70
0040: 2e 30 2e 30 20 61 74 20 .0.0 at 
0048: 6f 66 66 73 65 74 20 30 offset 0
0050: 30 30 30 33 65 64 62 0d 0003edb.
0058: 0a .

Event Type:	Error
Event Source:	Application Error
Event Category:	None
Event ID:	1000
Date: 12/23/2012
Time: 12:19:34 AM
User: N/A
Computer:	FRANCIE-PC
Description:
Faulting application explorer.exe, version 6.0.2900.5512, faulting module tmdly.ax, version 2.70.0.0, fault address 0x00003edb.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 65 78 70 ure exp
0018: 6c 6f 72 65 72 2e 65 78 lorer.ex
0020: 65 20 36 2e 30 2e 32 39 e 6.0.29
0028: 30 30 2e 35 35 31 32 20 00.5512 
0030: 69 6e 20 74 6d 64 6c 79 in tmdly
0038: 2e 61 78 20 32 2e 37 30 .ax 2.70
0040: 2e 30 2e 30 20 61 74 20 .0.0 at 
0048: 6f 66 66 73 65 74 20 30 offset 0
0050: 30 30 30 33 65 64 62 0d 0003edb.
0058: 0a .

Event Type:	Error
Event Source:	Application Error
Event Category:	None
Event ID:	1000
Date: 12/23/2012
Time: 12:18:24 AM
User: N/A
Computer:	FRANCIE-PC
Description:
Faulting application explorer.exe, version 6.0.2900.5512, faulting module tmdly.ax, version 2.70.0.0, fault address 0x00003edb.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 65 78 70 ure exp
0018: 6c 6f 72 65 72 2e 65 78 lorer.ex
0020: 65 20 36 2e 30 2e 32 39 e 6.0.29
0028: 30 30 2e 35 35 31 32 20 00.5512 
0030: 69 6e 20 74 6d 64 6c 79 in tmdly
0038: 2e 61 78 20 32 2e 37 30 .ax 2.70
0040: 2e 30 2e 30 20 61 74 20 .0.0 at 
0048: 6f 66 66 73 65 74 20 30 offset 0
0050: 30 30 30 33 65 64 62 0d 0003edb.
0058: 0a .


----------



## Cookiegal (Aug 27, 2003)

I'm not clear on what was done. You said you haven't installed the replacement drive yet.

Please do send me an e-mail or private message to let me know what was done.

You can click on my user name and get those options there.

Do you have something called WinTV from Hauppauge? Those errors appear to be related to that.


----------

