IE pop-ups url.urtbk - Samzy

Comments

• Katana

  August 2009 edited August 2009

  Please note that all instructions given are customised for this computer only,
  the tools used may cause damage if used on a computer with different infections.
  
  If you think you have similar problems, please post a log in the HJT forum and wait for help.
  
  Hello and welcome to the forums
  
  My name is Katana and I will be helping you to remove any infection(s) that you may have.
  
  Please observe these rules while we work:

  1. Please Read All Instructions Carefully
  2. If you don't understand something, stop and ask! Don't keep going on.
  3. Please do not run any other tools or scans whilst I am helping you
  4. Failure to reply within 5 days will result in the topic being closed.
  5. Please continue to respond until I give you the "All Clear"
     (Just because you can't see a problem doesn't mean it isn't there)

  
  If you can do those few things, everything should go smoothly
  
  Some of the logs I request will be quite large, You may need to split them over a couple of replies.
  
  Please Note, your security programs may give warnings for some of the tools I will ask you to use.
  Be assured, any links I give are safe
  

  ---

  
  
  
  
  Malwarebytes' Anti-Malware
  
  Please download Malwarebytes' Anti-Malware to your desktop.
  
  

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to
    • Update Malwarebytes' Anti-Malware
    • and Launch Malwarebytes' Anti-Malware
  • then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform full scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. please copy and paste the log into your next reply
  • If requested, please reboot
    
    • If you accidently close it, the log file is saved here and will be named like this:
    • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

  
  
  Download and Run RSIT
  

  • Please download Random's System Information Tool by random/random from here and save it to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open:
    
    • log.txt will be opened maximized.
    • info.txt will be opened minimized.
  • Please post the contents of both log.txt and info.txt.
    ( They can also be found in the C:\RSIT folder )

  0
• samzy

  August 2009 edited August 2009

  Thanks for responding Katana. I think the anti malware fixed the problem. I'll still list all the files in case something is still wrong.
  
  Here is the anti malware file
  
  Malwarebytes' Anti-Malware 1.40
  Database version: 2551
  Windows 6.0.6000
  
  8/3/2009 8:30:19 PM
  mbam-log-2009-08-03 (20-30-19).txt
  
  Scan type: Full Scan (C:\|D:\|E:\|G:\|)
  Objects scanned: 476141
  Time elapsed: 3 hour(s), 53 minute(s), 8 second(s)
  
  Memory Processes Infected: 0
  Memory Modules Infected: 0
  Registry Keys Infected: 4
  Registry Values Infected: 2
  Registry Data Items Infected: 0
  Folders Infected: 0
  Files Infected: 3
  
  Memory Processes Infected:
  (No malicious items detected)
  
  Memory Modules Infected:
  (No malicious items detected)
  
  Registry Keys Infected:
  HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
  HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
  
  Registry Values Infected:
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm43c37af5 (Trojan.Agent) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pisigupidu (Trojan.Agent) -> Quarantined and deleted successfully.
  
  Registry Data Items Infected:
  (No malicious items detected)
  
  Folders Infected:
  (No malicious items detected)
  
  Files Infected:
  c:\ProgramData\jefiyila\jefiyila.dll (Trojan.BHO) -> Delete on reboot.
  C:\Users\Victor\Desktop\Ivan\comp\comp\Adobe Photoshop Extended CS3 Keygen\PhotoShop CS3 Extended Keygen + Activation.exe (Trojan.Horst) -> Quarantined and deleted successfully.
  C:\ProgramData\laripoke\laripoke.dll (Trojan.Agent) -> Delete on reboot.
  
  
  Here is the RSIT Log File
  
  Logfile of random's system information tool 1.06 (written by random/random)
  Run by Victor at 2009-08-04 22:10:45
  Microsoft® Windows Vista™ Home Premium
  System drive C: has 8 GB (8%) free of 104 GB
  Total RAM: 1917 MB (45% free)
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 10:12:16 PM, on 8/4/2009
  Platform: Windows Vista (WinNT 6.00.1904)
  MSIE: Internet Explorer v7.00 (7.00.6000.16890)
  Boot mode: Normal
  
  Running processes:
  C:\Windows\SYSTEM32\WISPTIS.EXE
  C:\Windows\system32\Dwm.exe
  C:\Windows\Explorer.EXE
  C:\Windows\system32\taskeng.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Windows\System32\WLTRAY.EXE
  C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
  C:\Program Files\McAfee\MSK\mskagent.exe
  C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
  C:\Program Files\Dell AIO Printer A920\DLBKbmgr.exe
  C:\Program Files\McAfee.com\Agent\mcagent.exe
  C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Java\jre6\bin\jusched.exe
  C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
  C:\Windows\ehome\ehtray.exe
  C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  C:\Program Files\Digital Line Detect\DLG.exe
  C:\Program Files\Logitech\SetPoint\SetPoint.exe
  C:\Program Files\Dell\QuickSet\quickset.exe
  C:\Program Files\SafeConnect\scClient.exe
  C:\Program Files\Samurize\Client.exe
  C:\Windows\ehome\ehmsas.exe
  C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
  C:\Windows\system32\WTablet\Wacom_TabletUser.exe
  C:\Program Files\McAfee\MPS\mpsevh.exe
  C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
  C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
  c:\PROGRA~1\mcafee\msc\mcuimgr.exe
  C:\Windows\system32\wuauclt.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Last.fm\LastFM.exe
  C:\Users\Victor\Desktop\Ivan\comp\comp\RSIT.exe
  C:\Windows\system32\SearchFilterHost.exe
  C:\Users\Victor\Desktop\Ivan\comp\comp\Victor.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
  O1 - Hosts: ::1 localhost
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
  O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
  O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
  O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
  O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
  O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
  O4 - HKLM\..\Run: [ECenter] c:\dell\E-Center\EULALauncher.exe
  O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
  O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
  O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Dell PC Fax\fm3032.exe" /s
  O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
  O4 - HKLM\..\Run: [dlbkbmgr.exe] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
  O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
  O4 - HKLM\..\Run: [MSConfig] "C:\Windows\System32\msconfig.exe" /auto
  O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
  O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
  O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
  O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
  O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Startup: Client Default.lnk = C:\Program Files\Samurize\Client.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
  O4 - Global Startup: Logitech SetPoint.lnk = ?
  O4 - Global Startup: QuickSet.lnk = ?
  O4 - Global Startup: SafeConnect.lnk = ?
  O4 - Global Startup: VPN Client.lnk = ?
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
  O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
  O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
  O13 - Gopher Prefix:
  O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
  O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
  O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
  O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
  O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
  O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
  O23 - Service: dlbk_device - - C:\Windows\system32\dlbkcoms.exe
  O23 - Service: dlcx_device - - C:\Windows\system32\dlcxcoms.exe
  O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
  O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
  O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
  O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
  O23 - Service: Google Update Service (gupdate1c9a076a48126cc) (gupdate1c9a076a48126cc) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
  O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
  O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
  O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
  O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
  O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
  O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
  O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
  O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
  O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
  O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
  O23 - Service: OpenCASE Media Agent - ExtendMedia Inc. - C:\Program Files\OpenCase\OpenCASE Media Agent\MediaAgent.exe
  O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
  O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
  O23 - Service: Remote Procedure Call (RPC) Net (Rpcnet) - Absolute Software Corp. - C:\Windows\SYSTEM32\Rpcnet.exe
  O23 - Service: SafeConnect Manager (SCManager) - Unknown owner - C:\Program Files\SafeConnect\scManager.sys servicestart (file missing)
  O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
  O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
  O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\Windows\system32\Wacom_Tablet.exe
  O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
  O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
  O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
  
  --
  End of file - 11991 bytes
  
  ======Scheduled tasks folder======
  
  C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
  C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
  C:\Windows\tasks\McDefragTask.job
  C:\Windows\tasks\McQcTask.job
  
  ======Registry dump======
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
  Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 63128]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
  scriptproxy - c:\program files\mcafee\virusscan\scriptcl.dll [2006-10-26 67136]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
  Google Toolbar Helper - c:\program files\google\googletoolbar2.dll [2007-05-12 2403392]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
  CBrowserHelperObject Object - C:\Program Files\BAE\BAE.dll [2006-11-17 98304]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
  Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-05-23 35840]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  {2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar2.dll [2007-05-12 2403392]
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2007-04-13 1006264]
  "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-11-20 815104]
  "ATICCC"=C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe [2006-07-11 90112]
  "Broadcom Wireless Manager UI"=C:\Windows\system32\WLTRAY.exe [2007-12-08 3444736]
  "ISUSScheduler"=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2006-10-03 81920]
  ""= []
  "MskAgentexe"=C:\Program Files\McAfee\MSK\MskAgent.exe [2006-11-03 161360]
  "ECenter"=c:\dell\E-Center\EULALauncher.exe [2006-11-17 17920]
  "ISUSPM Startup"=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2006-10-03 221184]
  "Dell AIO Printer A920"=C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe [2007-03-28 275952]
  "FaxCenterServer"=C:\Program Files\Dell PC Fax\fm3032.exe [2006-11-03 312200]
  "NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe []
  "dlbkbmgr.exe"=C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe [2007-03-28 275952]
  "mcagent_exe"=C:\Program Files\McAfee.com\Agent\mcagent.exe [2007-11-01 582992]
  "MSConfig"=C:\Windows\System32\msconfig.exe [2006-11-02 222208]
  "SigmatelSysTrayApp"=C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe [2007-09-13 405504]
  "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-01-05 413696]
  "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-01-06 290088]
  "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-05-23 148888]
  
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  "ehTray.exe"=C:\Windows\ehome\ehTray.exe [2006-11-02 125440]
  "swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [2007-05-12 171448]
  "Aim6"= []
  "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe ASO-616B5711-6DAE-4795-A05F-39A1E5104020 []
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
  C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2009-06-08 30192]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
  C:\Windows\KHALMNPR.EXE [2006-07-19 94208]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
  C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE [2006-07-19 94208]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
  C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
  C:\Program Files\QuickTime\QTTask.exe [2009-01-05 413696]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
  sttray.exe []
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^DRSpawner.lnk]
  C:\PROGRA~2\ASGvis\DRSPAW~1\DRSPAW~1.EXE [2008-12-17 2076672]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Victor^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MagicDisc.lnk]
  C:\PROGRA~1\MAGICD~1\MAGICD~1.EXE [2009-02-23 576000]
  
  C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
  Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe
  Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe
  QuickSet.lnk - C:\Windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe
  SafeConnect.lnk - C:\Program Files\SafeConnect\scClient.exe
  VPN Client.lnk - C:\Windows\Installer\{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}\Icon3E5562ED7.ico
  
  C:\Users\Victor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
  Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  Client Default.lnk - C:\Program Files\Samurize\Client.exe
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  "AppInit_DLLS"="C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL"
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
  "dontdisplaylastusername"=0
  "legalnoticecaption"=
  "legalnoticetext"=
  "shutdownwithoutlogon"=1
  "undockwithoutlogon"=1
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
  shell\AutoRun\command - H:\LaunchU3.exe -a
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1091d0df-7b98-11dd-bafd-0019b95fe863}]
  shell\Auto\command - msnmsgr_plus.exe
  shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL msnmsgr_plus.exe
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{13f1450b-80ce-11dc-8d43-0019b95fe863}]
  shell\Auto\command - msnmsgr_plus.exe
  shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL msnmsgr_plus.exe
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3fa9e3ee-1a64-11de-a68a-0019b95fe863}]
  shell\AutoRun\command - G:\LaunchU3.exe -a
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{56cd3065-02bc-11dd-a1e2-0019b95fe863}]
  shell\AutoRun\command - G:\LaunchU3.exe
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{70ddcc61-84d9-11dc-b4d9-0019b95fe863}]
  shell\Auto\command - MSOCache\doWTP_RESTORE.exe -autorun
  shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MSOCache\doWTP_RESTORE.exe -autorun
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{70ddcc70-84d9-11dc-b4d9-0019b95fe863}]
  shell\AutoRun\command - G:\LaunchU3.exe -a
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76faf0e5-a1d7-11dc-ba69-0019b95fe863}]
  shell\AutoRun\command - G:\LaunchU3.exe -a
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86b7c70c-bfe2-11dd-b7ba-0019b95fe863}]
  shell\AutoRun\command - RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\svchost.exe
  shell\open\command - RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\svchost.exe
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9be6432d-762c-11dc-bb3c-0019b95fe863}]
  shell\auto\command - Knight.exe open
  shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Knight.exe open
  shell\explore\command - Knight.exe open
  shell\find\command - Knight.exe open
  shell\install\command - Knight.exe open
  shell\open\command - Knight.exe open
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9db68331-84e4-11dd-a61e-0019b95fe863}]
  shell\AutoRun\command - G:\WDSetup.exe
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9db68358-84e4-11dd-a61e-0019b95fe863}]
  shell\AutoRun\command - G:\LaunchU3.exe -a
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9db6836b-84e4-11dd-a61e-0019b95fe863}]
  shell\AutoRun\command - F:\LaunchU3.exe -a
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af3dcf24-15b3-11dd-9533-0019b95fe863}]
  shell\AutoRun\command - RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\svchost.exe
  shell\open\command - RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\svchost.exe
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af3dcf29-15b3-11dd-9533-0019b95fe863}]
  shell\AutoRun\command - F:\LaunchU3.exe
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bedc55db-f514-11dc-a4dd-0019b95fe863}]
  shell\AutoRun\command - F:\LaunchU3.exe -a
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c2fc304c-dabe-11dc-a1c2-0019b95fe863}]
  shell\AutoRun\command - H:\Setup.exe
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c96ceb28-04db-11dd-ab40-0019b95fe863}]
  shell\Auto\command - msnmsgr_plus.exe
  shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL msnmsgr_plus.exe
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c96ceb2d-04db-11dd-ab40-0019b95fe863}]
  shell\AutoRun\command - G:\LaunchU3.exe -a
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e58533c1-39c2-11de-91ea-0019b95fe863}]
  shell\AutoRun\command - G:\LaunchU3.exe -a
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ed317274-6551-11dc-b349-0019b95fe863}]
  shell\Auto\command - msnmsgr_plus.exe
  shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL msnmsgr_plus.exe
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ed317277-6551-11dc-b349-0019b95fe863}]
  shell\AutoRun\command - H:\LaunchU3.exe -a
  
  
  ======File associations======
  
  .scr - open - "C:\Windows\system32\notepad.exe" "%1"
  .scr - install -
  .scr - config -
  
  ======List of files/folders created in the last 1 months======
  
  2009-08-04 22:10:45 ----D---- C:\rsit
  2009-08-03 16:25:23 ----D---- C:\Users\Victor\AppData\Roaming\Malwarebytes
  2009-08-03 16:25:08 ----D---- C:\ProgramData\Malwarebytes
  2009-08-03 16:25:06 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
  2009-08-03 16:19:41 ----D---- C:\ProgramData\jefiyila
  2009-08-03 04:19:20 ----D---- C:\ProgramData\majayude
  2009-08-02 17:11:20 ----D---- C:\Windows\pss
  2009-08-02 16:19:08 ----D---- C:\ProgramData\vehapofe
  2009-08-02 16:13:11 ----D---- C:\ProgramData\temeyuhu
  2009-08-02 16:13:11 ----D---- C:\ProgramData\laripoke
  2009-08-02 16:13:11 ----D---- C:\ProgramData\kedayila
  2009-07-31 19:26:12 ----D---- C:\Program Files\MagicDisc
  2009-07-31 15:55:19 ----D---- C:\Program Files\Virtual CD v9
  2009-07-28 14:14:17 ----A---- C:\Windows\system32\mshtml.dll
  2009-07-28 14:14:15 ----A---- C:\Windows\system32\ieframe.dll
  2009-07-28 14:14:14 ----A---- C:\Windows\system32\mstime.dll
  2009-07-28 14:14:12 ----A---- C:\Windows\system32\urlmon.dll
  2009-07-28 14:14:12 ----A---- C:\Windows\system32\ieapfltr.dll
  2009-07-28 14:14:11 ----A---- C:\Windows\system32\iedkcs32.dll
  2009-07-28 14:14:10 ----A---- C:\Windows\system32\wininet.dll
  2009-07-28 14:14:10 ----A---- C:\Windows\system32\iertutil.dll
  2009-07-28 14:14:10 ----A---- C:\Windows\system32\dxtmsft.dll
  2009-07-28 14:14:09 ----A---- C:\Windows\system32\occache.dll
  2009-07-28 14:14:09 ----A---- C:\Windows\system32\msfeeds.dll
  2009-07-28 14:14:08 ----A---- C:\Windows\system32\ieaksie.dll
  2009-07-28 14:14:07 ----A---- C:\Windows\system32\mshtmled.dll
  2009-07-28 14:14:07 ----A---- C:\Windows\system32\icardie.dll
  2009-07-28 14:14:06 ----A---- C:\Windows\system32\ieencode.dll
  2009-07-28 14:14:06 ----A---- C:\Windows\system32\dxtrans.dll
  2009-07-28 14:14:05 ----A---- C:\Windows\system32\jsproxy.dll
  2009-07-28 14:14:04 ----A---- C:\Windows\system32\advpack.dll
  2009-07-28 14:14:04 ----A---- C:\Windows\system32\admparse.dll
  2009-07-28 14:14:03 ----A---- C:\Windows\system32\ieui.dll
  2009-07-28 14:14:03 ----A---- C:\Windows\system32\iesetup.dll
  2009-07-28 14:14:02 ----A---- C:\Windows\system32\ieUnatt.exe
  2009-07-28 14:14:02 ----A---- C:\Windows\system32\iernonce.dll
  2009-07-28 14:14:02 ----A---- C:\Windows\system32\ie4uinit.exe
  2009-07-28 14:14:00 ----A---- C:\Windows\system32\pngfilt.dll
  2009-07-28 14:13:57 ----A---- C:\Windows\system32\mshtmler.dll
  2009-07-28 14:13:57 ----A---- C:\Windows\system32\ieakui.dll
  2009-07-24 13:48:39 ----D---- C:\usr
  2009-07-23 19:14:31 ----D---- C:\Users\Victor\AppData\Roaming\net.twitterlocal.onair.A589D10E991C524019173F7ADEB73C85B538C40C.1
  2009-07-23 19:14:17 ----D---- C:\Program Files\TwitterLocal
  2009-07-23 18:01:36 ----D---- C:\Program Files\DestroyTwitter
  2009-07-23 18:00:07 ----D---- C:\Program Files\SocialMediaPlayer
  2009-07-23 17:59:28 ----D---- C:\Users\Victor\AppData\Roaming\app.destroytwitter.23CA2F9B070E2FB8C4472F982F88B1A471F11AE2.1
  2009-07-23 17:58:55 ----D---- C:\Program Files\Common Files\Adobe AIR
  2009-07-21 13:29:15 ----D---- C:\Program Files\Citrix
  2009-07-15 02:27:25 ----A---- C:\Windows\system32\t2embed.dll
  2009-07-15 02:27:24 ----A---- C:\Windows\system32\fontsub.dll
  2009-07-15 02:27:22 ----A---- C:\Windows\system32\lpk.dll
  2009-07-15 02:27:22 ----A---- C:\Windows\system32\atmfd.dll
  2009-07-15 02:27:21 ----A---- C:\Windows\system32\dciman32.dll
  2009-07-15 02:27:21 ----A---- C:\Windows\system32\atmlib.dll
  
  ======List of files/folders modified in the last 1 months======
  
  2009-08-04 22:12:14 ----D---- C:\Windows\Temp
  2009-08-04 22:11:45 ----D---- C:\Windows\Prefetch
  2009-08-04 17:09:30 ----D---- C:\Users\Victor\AppData\Roaming\uTorrent
  2009-08-04 17:07:21 ----D---- C:\Program Files\Mozilla Firefox
  2009-08-04 16:13:49 ----D---- C:\Users\Victor\AppData\Roaming\WTablet
  2009-08-04 16:13:35 ----A---- C:\Windows\system32\Rpcnet.dll
  2009-08-04 08:17:11 ----SHD---- C:\Windows\Installer
  2009-08-04 08:17:04 ----D---- C:\Windows\winsxs
  2009-08-04 08:15:49 ----SHD---- C:\System Volume Information
  2009-08-04 02:17:17 ----D---- C:\Windows
  2009-08-04 02:16:42 ----SD---- C:\Windows\Downloaded Program Files
  2009-08-03 20:36:09 ----RD---- C:\Program Files
  2009-08-03 20:36:09 ----D---- C:\Windows\system32\drivers
  2009-08-03 16:25:08 ----HD---- C:\ProgramData
  2009-08-03 14:43:25 ----D---- C:\Windows\System32
  2009-08-03 14:43:25 ----D---- C:\Windows\inf
  2009-08-03 14:43:25 ----A---- C:\Windows\system32\PerfStringBackup.INI
  2009-08-02 19:33:21 ----D---- C:\Program Files\Microsoft Silverlight
  2009-08-01 00:05:26 ----D---- C:\ProgramData\ASGvis
  2009-08-01 00:05:14 ----HD---- C:\Program Files\InstallShield Installation Information
  2009-07-31 19:27:28 ----D---- C:\Windows\system32\catroot2
  2009-07-31 16:00:01 ----D---- C:\Windows\system32\catroot
  2009-07-31 01:19:19 ----D---- C:\Program Files\Rainmeter
  2009-07-31 01:18:33 ----D---- C:\Program Files\Rhinoceros 4.0
  2009-07-30 22:02:13 ----D---- C:\Users\Victor\AppData\Roaming\Skype
  2009-07-30 21:47:11 ----D---- C:\Users\Victor\AppData\Roaming\skypePM
  2009-07-29 03:11:51 ----D---- C:\Program Files\Internet Explorer
  2009-07-29 03:11:50 ----D---- C:\Windows\system32\migration
  2009-07-29 03:11:46 ----D---- C:\Windows\AppPatch
  2009-07-28 16:38:26 ----D---- C:\Windows\Microsoft.NET
  2009-07-28 16:38:25 ----RSD---- C:\Windows\assembly
  2009-07-28 15:02:47 ----D---- C:\Program Files\Virtual Earth 3D
  2009-07-25 00:05:06 ----SD---- C:\Users\Victor\AppData\Roaming\Microsoft
  2009-07-23 21:00:51 ----D---- C:\Program Files\Google
  2009-07-23 17:58:55 ----D---- C:\Program Files\Common Files
  2009-07-15 03:05:45 ----D---- C:\Program Files\Windows Mail
  2009-07-13 19:38:39 ----D---- C:\Users\Victor\AppData\Roaming\Spotify
  2009-07-07 10:10:56 ----A---- C:\Windows\system32\mrt.exe
  
  ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
  
  R1 MPFP;MPFP; C:\Windows\System32\Drivers\Mpfp.sys [2006-10-30 108120]
  R2 CVPNDRVA;Cisco Systems Inc. IPSec Driver; \??\C:\Windows\system32\Drivers\CVPNDRVA.sys [2007-04-03 306295]
  R2 dsunidrv;dsunidrv; \??\C:\Program Files\DellSupport\Drivers\dsunidrv.sys [2006-08-17 7424]
  R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-11-11 12672]
  R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2006-11-20 32256]
  R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2006-11-11 8192]
  R3 BCM43XX;Dell Wireless WLAN Card Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2007-12-06 1044984]
  R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\Windows\system32\DRIVERS\bcm4sbxp.sys [2006-11-02 45056]
  R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2007-11-04 14208]
  R3 DNE;Deterministic Network Enhancer Miniport; C:\Windows\system32\DRIVERS\dne2000.sys [2007-01-31 127376]
  R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
  R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2006-11-11 986624]
  R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2006-11-11 206848]
  R3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\Windows\system32\DRIVERS\L8042Kbd.sys [2006-07-19 13568]
  R3 LHidKe;SetPoint HID Mouse Filter Driver; C:\Windows\system32\DRIVERS\LHidKE.Sys [2006-07-19 27136]
  R3 LMouKE;SetPoint Mouse Filter Driver; C:\Windows\system32\DRIVERS\LMouKE.Sys [2006-07-19 71936]
  R3 mcdbus;Driver for MagicISO SCSI Host Controller; C:\Windows\system32\DRIVERS\mcdbus.sys [2009-02-24 116736]
  R3 mfeavfk;McAfee Inc.; C:\Windows\system32\drivers\mfeavfk.sys [2006-10-26 71496]
  R3 mfebopk;McAfee Inc.; C:\Windows\system32\drivers\mfebopk.sys [2006-10-26 34120]
  R3 mfehidk;McAfee Inc.; C:\Windows\system32\drivers\mfehidk.sys [2006-10-26 168392]
  R3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-25 2085888]
  R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2007-06-12 82432]
  R3 STHDA;SigmaTel High Definition Audio CODEC; C:\Windows\system32\drivers\stwrt.sys [2007-09-13 330240]
  R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2006-11-20 179256]
  R3 wacommousefilter;Wacom Mouse Filter Driver; C:\Windows\system32\DRIVERS\wacommousefilter.sys [2007-02-16 11312]
  R3 wacomvhid;Wacom Virtual Hid Driver; C:\Windows\system32\DRIVERS\wacomvhid.sys [2008-07-11 13352]
  R3 WacomVKHid;Virtual Keyboard Driver; C:\Windows\system32\DRIVERS\WacomVKHid.sys [2007-02-15 11440]
  R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2006-11-11 659968]
  R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2007-11-04 11264]
  S3 BCM42RLY;BCM42RLY; C:\Windows\system32\drivers\BCM42RLY.sys []
  S3 CVirtA;Cisco Systems VPN Adapter; C:\Windows\system32\DRIVERS\CVirtA.sys [2007-01-18 5275]
  S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
  S3 DSproct;DSproct; \??\C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys [2006-10-05 4736]
  S3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\Windows\system32\DRIVERS\e1e6032.sys [2006-11-02 200704]
  S3 FTDIBUS;USB Serial Converter Driver; C:\Windows\system32\drivers\ftdibus.sys [2004-04-20 24209]
  S3 FTSER2K;USB Serial Port Driver; C:\Windows\system32\drivers\ftser2k.sys [2004-04-20 57404]
  S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
  S3 LHidUsbK;SetPoint USB Receiver device driver; C:\Windows\System32\Drivers\LHidUsbK.Sys [2006-07-19 36736]
  S3 mferkdk;McAfee Inc.; C:\Windows\system32\drivers\mferkdk.sys [2006-10-26 31944]
  S3 mfesmfk;McAfee Inc.; C:\Windows\system32\drivers\mfesmfk.sys [2006-10-26 35048]
  S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
  S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
  S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
  S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
  S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\sscdbus.sys [2005-08-17 58352]
  S3 sscdmdfl;SAMSUNG CDMA Modem Filter; C:\Windows\system32\DRIVERS\sscdmdfl.sys [2005-08-17 8272]
  S3 sscdmdm;SAMSUNG CDMA Modem Drivers; C:\Windows\system32\DRIVERS\sscdmdm.sys [2005-08-17 93872]
  S3 sscdserd;SAMSUNG CDMA Modem Diagnostic Serial Port (WDM); C:\Windows\system32\DRIVERS\sscdserd.sys [2005-08-17 73696]
  S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2008-11-07 32000]
  S3 usbaudio;USB Audio Driver (WDM); C:\Windows\system32\drivers\usbaudio.sys [2006-11-02 71552]
  S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2006-11-02 35328]
  S3 usbvideo;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2006-11-02 132352]
  S3 wacmoumonitor;Wacom Mode Helper; C:\Windows\system32\DRIVERS\wacmoumonitor.sys [2008-10-06 15656]
  S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2006-11-02 39936]
  S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]
  S4 rimsptsk;rimsptsk; C:\Windows\system32\drivers\rimsptsk.sys [2006-11-20 43520]
  S4 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\drivers\rixdptsk.sys [2006-11-20 37376]
  
  ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
  
  R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
  R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2006-11-25 557056]
  R2 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2007-11-27 85096]
  R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
  R2 CCALib8;Canon Camera Access Library 8; C:\Program Files\Canon\CAL\CALMAIN.exe [2005-09-30 96341]
  R2 CVPND;Cisco Systems, Inc. VPN Service; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [2007-04-03 1516584]
  R2 dlbk_device;dlbk_device; C:\Windows\system32\dlbkcoms.exe [2007-06-25 537840]
  R2 dlcx_device;dlcx_device; C:\Windows\system32\dlcxcoms.exe [2006-11-03 537480]
  R2 McAfee HackerWatch Service;McAfee HackerWatch Service; C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe [2006-11-08 554600]
  R2 mcmscsvc;McAfee Services; C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe [2008-01-09 767976]
  R2 McNASvc;McAfee Network Agent; c:\program files\common files\mcafee\mna\mcnasvc.exe [2008-01-25 2458128]
  R2 McODS;McAfee Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [2006-10-30 362064]
  R2 McProxy;McAfee Proxy Service; c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [2006-11-10 349784]
  R2 McRedirector;McAfee Redirector Service; c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe [2006-11-02 239200]
  R2 McShield;McAfee Real-time Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [2006-10-26 144960]
  R2 MpfService;McAfee Personal Firewall Service; C:\Program Files\McAfee\MPF\MPFSrv.exe [2006-11-10 833064]
  R2 MPS9;McAfee Privacy Service; C:\PROGRA~1\McAfee\MPS\mps.exe [2006-12-11 894504]
  R2 MSK80Service;McAfee SpamKiller Service; C:\Program Files\McAfee\MSK\MskSrver.exe [2006-11-03 28752]
  R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2006-11-02 22016]
  R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2006-11-02 22016]
  R2 RoxWatch9;Roxio Hard Drive Watcher 9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe [2006-11-05 159744]
  R2 Rpcnet;Remote Procedure Call (RPC) Net; C:\Windows\SYSTEM32\Rpcnet.exe [2009-05-22 56680]
  R2 SCManager;SafeConnect Manager; C:\Program Files\SafeConnect\scManager.sys [2007-04-23 103968]
  R2 STacSV;SigmaTel Audio Service; C:\Windows\system32\STacSV.exe [2007-09-13 102400]
  R2 TabletServiceWacom;TabletServiceWacom; C:\Windows\system32\Wacom_Tablet.exe [2008-10-10 2749224]
  R2 Viewpoint Manager Service;Viewpoint Manager Service; C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
  R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\Windows\System32\WLTRYSVC.EXE [2007-12-08 24064]
  R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2006-11-11 386560]
  R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-01-06 536872]
  R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
  S2 gupdate1c9a076a48126cc;Google Update Service (gupdate1c9a076a48126cc); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-03-09 133104]
  S2 OpenCASE Media Agent;OpenCASE Media Agent; C:\Program Files\OpenCase\OpenCASE Media Agent\MediaAgent.exe [2008-08-03 835208]
  S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-09-05 72704]
  S3 DSBrokerService;DSBrokerService; C:\Program Files\DellSupport\brkrsvc.exe [2006-11-07 70656]
  S3 Emproxy;McAfee E-mail Proxy; C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe [2006-10-28 337488]
  S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-03-17 655624]
  S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2009-06-08 30192]
  S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-05-12 138168]
  S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
  S3 McSysmon;McAfee SystemGuards; C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe [2006-12-01 625232]
  S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
  S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
  S3 RoxMediaDB9;RoxMediaDB9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2006-11-05 880640]
  S3 stllssvr;stllssvr; C:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2006-09-14 73728]
  

  ---

  EOF

  ---

  0
• samzy

  August 2009 edited August 2009

  Here is the RSIT info file
  
  info.txt logfile of random's system information tool 1.06 2009-08-04 22:12:29
  
  ======Uninstall list======
  
  -->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
  -->MsiExec.exe /I{9A346205-EA92-4406-B1AB-50379DA3F057}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
  32 Bit HP CIO Components Installer-->MsiExec.exe /I{F7B0E599-C114-4493-BC4D-D8FC7CBBABBB}
  ABBYY FineReader 6.0 Sprint-->MsiExec.exe /X{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}
  Adobe AIR-->C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
  Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}
  Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
  Adobe Anchor Service CS4-->MsiExec.exe /I{1618734A-3957-4ADD-8199-F973763109A8}
  Adobe Asset Services CS3-->MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
  Adobe Audition 3.0-->msiexec /I {53C141BA-4F9E-43FB-B4F9-0C01BB716FA8}
  Adobe Bridge 1.0-->MsiExec.exe /I{B74D4E10-1033-0000-0000-000000000001}
  Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
  Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
  Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
  Adobe CMaps-->MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
  Adobe Color Common Settings-->C:\Program Files\Common Files\Adobe\Installers\6c8e2cb4fd241c55406016127a6ab2e\Setup.exe
  Adobe Color Common Settings-->MsiExec.exe /I{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}
  Adobe Color EU Extra Settings-->MsiExec.exe /I{51846830-E7B2-4218-8968-B77F0FF475B8}
  Adobe Color JA Extra Settings-->MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
  Adobe Color NA Recommended Settings-->MsiExec.exe /I{95655ED4-7CA5-46DF-907F-7144877A32E5}
  Adobe Common File Installer-->MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5B39}
  Adobe CS4 American English Speech Analysis Models-->MsiExec.exe /I{297190A1-4B0D-4CD6-8B9F-3907F15C3FD8}
  Adobe Default Language CS3-->MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
  Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
  Adobe Dynamiclink Support-->MsiExec.exe /I{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}
  Adobe ExtendScript Toolkit 2-->C:\Program Files\Common Files\Adobe\Installers\3e054d2218e7aa282c2369d939e58ff\Setup.exe
  Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}
  Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
  Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
  Adobe Fonts All-->MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
  Adobe Help Center 1.0-->MsiExec.exe /I{E9787678-1033-0000-8E67-000000000001}
  Adobe Help Viewer CS3-->MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
  Adobe Illustrator CS3-->C:\Program Files\Common Files\Adobe\Installers\a04a925a57548091300ada368235fc6\Setup.exe
  Adobe Illustrator CS3-->MsiExec.exe /I{F08E8D2E-F132-4742-9C87-D5FF223A016A}
  Adobe InDesign CS3 Icon Handler-->MsiExec.exe /I{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}
  Adobe InDesign CS3-->C:\Program Files\Common Files\Adobe\Installers\05ba3a63f36684fe0c5dde2ebe6f8f5\Setup.exe
  Adobe InDesign CS3-->MsiExec.exe /I{CB3F8375-B600-4B9F-83C9-238ED1E583FD}
  Adobe Linguistics CS3-->MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
  Adobe PDF Library Files-->MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
  Adobe Photoshop CS2-->msiexec /I {236BB7C4-4419-42FD-0409-1E257A25E34D}
  Adobe Reader 7.0.8-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70800000002}
  Adobe Setup-->MsiExec.exe /I{02383859-C71C-4AE0-80C9-12552ADA6B1E}
  Adobe Setup-->MsiExec.exe /I{4F3E17F8-F1C8-4A4B-9EB8-1EE2D190CDA9}
  Adobe Setup-->MsiExec.exe /I{56B8B892-317E-4FDE-9E4D-44B189848A27}
  Adobe Setup-->MsiExec.exe /I{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}
  Adobe Setup-->MsiExec.exe /I{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}
  Adobe SING CS3-->MsiExec.exe /I{3F9B2FD2-1C83-4401-9967-C3636638E958}
  Adobe Soundbooth CS4-->C:\Program Files\Common Files\Adobe\Installers\5a2cf0498f0f8a9d712b9c8926ae172\Setup.exe --uninstall=1
  Adobe Soundbooth CS4-->MsiExec.exe /I{14F70205-1940-4000-88C7-BE799A6B2CAD}
  Adobe Stock Photos 1.0-->MsiExec.exe /I{786C5747-1033-0000-B58E-000000000001}
  Adobe Stock Photos CS3-->MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
  Adobe Type Support-->MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
  Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
  Adobe Update Manager CS4-->MsiExec.exe /I{05308C4E-7285-4066-BAE3-6B50DA6ED755}
  Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
  Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
  Adobe XMP Panels CS3-->MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
  Adobe XMP Panels CS4-->MsiExec.exe /I{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}
  AIM 6-->C:\Program Files\AIM6\uninst.exe
  Aleks 3.8-->C:\Windows\unvise32.exe C:\Program Files\Aleks 3.8\uninstal.log
  AOL Install-->MsiExec.exe /I{2357B8BC-88C9-4A72-818C-050CC4EB0778}
  Apple Mobile Device Support-->MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}
  Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
  ArchiCAD 11 USA-->C:\Program Files\Graphisoft\ArchiCAD 11\Uninstall.AC\uninstaller.exe
  ArchiCAD Guide - Basic USA-->C:\Program Files\Graphisoft\ArchiCAD Basic Training Guide\Uninstall.TGBA\uninstaller.exe
  Arcv2CAD 4.0-->C:\ARCV2C~2\UNWISE.EXE C:\ARCV2C~2\INSTALL.LOG
  Arcv2CAD 5.0-->C:\ARCV2C~1\UNWISE.EXE C:\ARCV2C~1\INSTALL.LOG
  ATI Catalyst Control Center Ex-->MsiExec.exe /I{EAB9C426-6626-7B76-64F3-569FDCA9852D}
  ATI PCI Express (3GIO) Filter Driver-->C:\Program Files\InstallShield Installation Information\{E713653C-8312-4BC6-AFC9-ADE1F2F04AB9}\setup.exe -runfromtemp -l0x0009 -removeonly
  AutoCAD Architecture 2008-->C:\Program Files\AutoCAD Architecture 2008\Setup\Setup.exe /P {5783F2D7-6004-0409-0002-0060B0CE6BBA} /M ACAD
  Autodesk Design Review 2008-->MsiExec.exe /I{FACF203E-0F4D-489A-B80C-D185253C8FCB}
  Autodesk DWF Viewer 7-->MsiExec.exe /I{9A346205-EA92-4406-B1AB-50379DA3F057}
  Autodesk Student Community Download Tool-->"C:\Program Files\Autodesk Student Community Download Tool\unins000.exe"
  Backburner-->MsiExec.exe /I{3D347E6D-5A03-4342-B5BA-6A771885F379}
  Bing Maps 3D-->MsiExec.exe /I{2D87E961-577B-492B-AD54-1368680FB9A7}
  Bongo 1.0 Evaluation-->C:\PROGRA~1\BONGO1~1.0\UNWISE.EXE C:\PROGRA~1\BONGO1~1.0\INSTALL.LOG
  Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
  Broadcom Management Programs-->MsiExec.exe /I{C99C0593-3B48-41D9-B42F-6E035B320449}
  Canon Camera Access Library-->"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CAL\Uninst.ini"
  Canon Camera Support Core Library-->"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CSCLIB\Uninst.ini"
  Canon Camera Window DC_DV 5 for ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowDVC\Uninst.ini"
  Canon Camera Window DC_DV 6 for ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowDVC6\Uninst.ini"
  Canon Camera Window MC 6 for ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowMC\Uninst.ini"
  Canon RAW Image Task for ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\RAW Image Task\Uninst.ini"
  Canon RemoteCapture Task for ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\RemoteCaptureTask DC\Uninst.ini"
  Canon Utilities Digital Photo Professional 2.1-->"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\Digital Photo Professional\Uninst.ini"
  Canon Utilities EOS Utility-->"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\EOS Utility\Uninst.ini"
  Canon Utilities PhotoStitch-->"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\PhotoStitch\Uninst.ini"
  Canon Utilities ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX\Program\Uninst.ini"
  Cisco EAP-FAST Module-->MsiExec.exe /I{BF53252E-4AB2-4C7F-A0FD-6100755745E3}
  Cisco LEAP Module-->MsiExec.exe /I{76F9CF97-FC4B-4E20-B363-D127C888448F}
  Cisco PEAP Module-->MsiExec.exe /I{4E5386F5-C0F6-4532-A54A-374865AEAB71}
  Cisco Systems VPN Client 5.0.00.0340-->MsiExec.exe /X{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}
  Climate Consultant 4-->C:\Windows\UnGins.exe "C:\Program Files\Climate4\install.log"
  Combined Community Codec Pack 2008-01-24-->"C:\Program Files\Combined Community Codec Pack\unins001.exe"
  Conexant HDA D110 MDC V.92 Modem-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F100C3\HXFSETUP.EXE -U -IDellHDAz.inf
  Dell AIO Printer A920-->C:\Program Files\Dell AIO Printer A920\Install\x86\Uninst.exe
  Dell System Customization Wizard-->MsiExec.exe /I{13BA7B44-B712-4DEE-A7B8-1DD564F37AE5}
  Dell Wireless WLAN Card-->"C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Program Files\Dell\Dell Wireless WLAN Card"
  DellSupport-->MsiExec.exe /X{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}
  DestroyTwitter-->MsiExec.exe /X{13724A20-DD11-CD8A-AA15-234594862F13}
  Digital Line Detect-->C:\Program Files\InstallShield Installation Information\{E646DCF0-5A68-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x0009 -removeonly
  DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
  DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
  DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
  DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
  Documentation & Support Launcher-->MsiExec.exe /I{89CEAE14-DD0F-448E-9554-15781EC9DB24}
  doPDF 6.2 printer-->"C:\Program Files\Softland\doPDF 6\unins000.exe"
  EarthLink Setup Files-->MsiExec.exe /X{5E68BB65-4059-4FE5-AAC4-0CD1D79BBDE2}
  eQUEST 3.6-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FD056785-F890-47CE-922C-CE985D5ADBEF}\setup.exe"
  Fax Solutions-->C:\Program Files\Dell PC Fax\Install\x86\Uninst.exe
  Flamingo 2.0-->MsiExec.exe /I{C475527D-AB5C-47D8-8C25-85CA3E42B5A4}
  FTDI USB Serial Converter Drivers-->C:\Windows\system32\ftdiunin.exe C:\Windows\system32\ftdiun2k.ini
  Games, Music, & Photos Launcher-->MsiExec.exe /I{3E25E350-949F-4DB7-8288-2A60E018B4C1}
  Google Desktop-->C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
  Google Earth Plugin-->MsiExec.exe /I{B535B621-5559-11DE-A7A1-005056806466}
  Google Earth-->MsiExec.exe /X{CC016F21-3970-11DE-B878-005056806466}
  Google SketchUp 6 Exporters-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EB459C2F-41CA-4222-B9CA-F8EBA40B8DAB}\setup.exe" -l0x9 -removeonly
  Google SketchUp 6-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{98736A65-3C79-49EC-B7E9-A3C77774B0E6}\setup.exe" -l0x9 -removeonly
  Google SketchUp 7-->MsiExec.exe /I{E5D52570-5EF1-4576-A434-6CCD92268F0F}
  Google SketchUp LayOut 6-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C12D609B-EB71-411B-82C3-9BE6D40435D7}\setup.exe" -l0x9 -removeonly
  Google SketchUp Pro 6-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{12E75B98-8463-4C1F-8DDA-F6CF31566A55}\setup.exe" -l0x9 -removeonly
  Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
  Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar2.dll"
  Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
  HijackThis 2.0.2-->"C:\Users\Victor\Desktop\Ivan\comp\comp\HijackThis.exe" /uninstall
  Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
  Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
  Internet Service Offers Launcher-->MsiExec.exe /I{CCFF1E13-77A2-4032-8B12-7566982A27DF}
  iTunes-->MsiExec.exe /I{F5C63795-2708-4D15-BF18-5ABBFF7DFFC8}
  Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
  Java(TM) SE Runtime Environment 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000}
  KhalSetup-->MsiExec.exe /I{EE7B9A8D-19F0-450D-8E94-3E391E6044CD}
  Last.fm 1.5.4.24567-->"C:\Program Files\Last.fm\unins000.exe"
  LinuxCAD 2009 for Windows 7-->C:\usr\Uninstall-LinuxCAD2009forWindows.exe C:\usr\SSEun2.dat
  Logitech SetPoint-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}\setup.exe" -l0x9 -removeonly
  Magic ISO Maker v5.4 (build 0251)-->C:\PROGRA~1\MagicISO\UNWISE.EXE C:\PROGRA~1\MagicISO\INSTALL.LOG
  MagicDisc 2.7.106-->C:\PROGRA~1\MAGICD~1\UNWISE.EXE C:\PROGRA~1\MAGICD~1\INSTALL.LOG
  Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
  McAfee SecurityCenter-->C:\Program Files\McAfee\MSC\mcuninst.exe
  Microsoft .NET Framework 1.1 Hotfix (KB929729)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"
  Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
  Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
  Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
  Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
  Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
  Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
  Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
  Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
  Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
  Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
  Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
  Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
  Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
  Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
  Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
  Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
  Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
  Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
  Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
  Microsoft Visual C++ 8.0 Support DLLs-->MsiExec.exe /X{342F5437-C87D-4BB5-89B9-B23E16C6A395}
  Modem Diagnostic Tool-->MsiExec.exe /I{F63A3748-B93D-4360-9AD4-B064481A5C7B}
  Mozilla Firefox (3.0.13)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
  Mozilla Thunderbird (2.0.0.19)-->C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe
  MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
  MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
  MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
  MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
  MySpaceIM-->C:\Program Files\MySpace\IM\Uninstall.exe
  neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
  NetWaiting-->C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x0009 -removeonly
  NetZeroInstallers-->MsiExec.exe /X{352310C3-E46B-42D3-8F32-54721FDD72D9}
  novaPDF Lite Desktop 6.2 printer-->"C:\Program Files\Softland\novaPDF Lite Desktop 6\unins000.exe"
  OpenCASE Media Agent-->MsiExec.exe /I{1771FDC8-D846-4B77-996A-C80DAD42C03F}
  PDF Settings-->MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}
  Penguin 2.0-->C:\PROGRA~1\RHINOC~1.0\Plug-ins\PENGUI~1.0\UNWISE.EXE C:\PROGRA~1\RHINOC~1.0\Plug-ins\PENGUI~1.0\INSTALL.LOG
  QuickSet-->MsiExec.exe /I{7F0C4457-8E64-491B-8D7B-991504365D1E}
  QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
  Rhinoceros 4.0-->MsiExec.exe /I{5C2CBFFD-FC3B-4AA9-993B-CE2B8DA25B87}
  Roxio Creator Audio-->MsiExec.exe /I{83FFCFC7-88C6-41c6-8752-958A45325C82}
  Roxio Creator BDAV Plugin-->MsiExec.exe /I{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}
  Roxio Creator Copy-->MsiExec.exe /I{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}
  Roxio Creator Data-->MsiExec.exe /I{0D397393-9B50-4c52-84D5-77E344289F87}
  Roxio Creator DE-->MsiExec.exe /I{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}
  Roxio Creator Tools-->MsiExec.exe /I{0394CDC8-FABD-4ed8-B104-03393876DFDF}
  Roxio Express Labeler-->MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
  Roxio MyDVD DE-->MsiExec.exe /I{D639085F-4B6E-4105-9F37-A0DBB023E2FB}
  Roxio Update Manager-->MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
  SafeConnect-->"C:\Program Files\SafeConnect\UnInstall.exe"
  Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
  Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
  Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
  Security Update for 2007 Microsoft Office System (KB969679)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C66E4A6C-6E07-4C63-8CCD-2493B5087C73}
  Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
  Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
  Security Update for Microsoft Office Excel 2007 (KB969682)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C03803BD-745A-46F8-8557-817DED578780}
  Security Update for Microsoft Office OneNote 2007 (KB950130)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {F1B2401C-B610-4BF2-AA1C-52C55827A8F4}
  Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
  Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
  Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
  Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC5652656050}
  Security Update for Visio 2007 (KB947590)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41}
  Serious Samurize-->"C:\Program Files\Samurize\Uninstall.exe"
  SigmaTel Audio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}\setup.exe" -l0x9 -remove -removeonly
  Skypeâ„¢ 4.0-->MsiExec.exe /X{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}
  SocialMediaPlayer-->MsiExec.exe /X{1997A35D-EA4D-F539-5B8B-F96C556B5686}
  Sonic Activation Module-->MsiExec.exe /I{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}
  Spotify-->"C:\Program Files\Spotify\uninstall.exe"
  Style Master 4.6 Demo-->MsiExec.exe /I{C9012AA3-F07B-46F5-BB59-ED21E92021ED}
  SU2KT-->"C:\Program Files__PLEASE FIND SketchUp FOLDER___\unins000.exe"
  Suite Shared Configuration CS4-->MsiExec.exe /I{842B4B72-9E8F-4962-B3C1-1C422A5C4434}
  Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
  TAMUScan 1.0-->C:\Program Files\TAMUScan\uninst.exe
  TBS WMP Plug-in-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{13515135-48BB-4184-8C1F-2FAE0138E200}
  TwitterLocal-->MsiExec.exe /X{BF250D88-A8F1-B407-DA49-694C48DE0C06}
  Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
  Update for Microsoft Office 2007 Help for Common Features (KB963673)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {AB365889-0395-4FAD-B702-CA5985D53D42}
  Update for Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {199DF7B6-169C-448C-B511-1054101BE9C9}
  Update for Microsoft Office OneNote 2007 Help (KB963670)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2744EF05-38E1-4D5D-B333-E021EDAEA245}
  Update for Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {397B1D4F-ED7B-4ACA-A637-43B670843876}
  Update for Microsoft Office Script Editor Help (KB963671)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {CD11C6A2-FFC6-4271-8EAB-79C3582F505C}
  Update for Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {80E762AA-C921-4839-9D7D-DB62A72C0726}
  URL Assistant-->regsvr32 /u /s "C:\Program Files\BAE\BAE.dll"
  User's Guides-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}\setup.exe"
  VCRedistSetup-->MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
  VideoLAN VLC media player 0.8.6c-->C:\Program Files\VideoLAN\VLC\uninstall.exe
  Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Media Player\mtsAxInstaller.exe /u
  V-Ray for Rhinoceros-->"C:\Program Files\InstallShield Installation Information\{40625DE4-DCDB-44FE-84B5-E65F1365BF44}\setup.exe" -runfromtemp -l0x0009 -removeonly
  V-Ray for SketchUp-->"C:\Program Files\InstallShield Installation Information\{91FF4491-867D-4F39-AD5F-4292086D785C}\setup.exe" -runfromtemp -l0x0009 -removeonly
  Wacom Tablet-->C:\Program Files\Tablet\Wacom\Remove.exe /u
  WD Diagnostics-->MsiExec.exe /X{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}
  Windows Essentials Media Codec Pack 1.0-->C:\Program Files\Essentials Codec Pack\uninst.exe
  Windows Live Messenger-->MsiExec.exe /I{571700F0-DB9D-4B3A-B03D-35A14BB5939F}
  Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
  WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
  Xvid 1.1.3 final uninstall-->"C:\Program Files\Xvid\unins000.exe"
  Zapco DPN v1.40-->MsiExec.exe /X{B3D3D587-724E-485E-82F2-56749F14C859}
  
  ======Security center information======
  
  AV: McAfee VirusScan (outdated)
  FW: McAfee Personal Firewall
  AS: McAfee VirusScan
  AS: Windows Defender
  
  ======System event log======
  
  Computer Name: Victor-PC
  Event Code: 10016
  Message: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
  {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
  Record Number: 790085
  Source Name: Microsoft-Windows-DistributedCOM
  Time Written: 20090804230424.000000-000
  Event Type: Error
  User: NT AUTHORITY\NETWORK SERVICE
  
  Computer Name: Victor-PC
  Event Code: 10016
  Message: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
  {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
  Record Number: 790086
  Source Name: Microsoft-Windows-DistributedCOM
  Time Written: 20090804230425.000000-000
  Event Type: Error
  User: NT AUTHORITY\NETWORK SERVICE
  
  Computer Name: Victor-PC
  Event Code: 10016
  Message: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
  {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
  Record Number: 790087
  Source Name: Microsoft-Windows-DistributedCOM
  Time Written: 20090804230426.000000-000
  Event Type: Error
  User: NT AUTHORITY\NETWORK SERVICE
  
  Computer Name: Victor-PC
  Event Code: 10016
  Message: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
  {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
  Record Number: 790088
  Source Name: Microsoft-Windows-DistributedCOM
  Time Written: 20090804230427.000000-000
  Event Type: Error
  User: NT AUTHORITY\NETWORK SERVICE
  
  Computer Name: Victor-PC
  Event Code: 10016
  Message: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
  {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
  Record Number: 790089
  Source Name: Microsoft-Windows-DistributedCOM
  Time Written: 20090804230427.000000-000
  Event Type: Error
  User: NT AUTHORITY\NETWORK SERVICE
  
  =====Application event log=====
  
  Computer Name: Victor-PC
  Event Code: 1002
  Message: The program msnmsgr.exe version 8.1.178.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 4b8 Start Time: 01ca138b7e22578e Termination Time: 2602
  Record Number: 1017715
  Source Name: Application Hang
  Time Written: 20090802205258.000000-000
  Event Type: Error
  User:
  
  Computer Name: Victor-PC
  Event Code: 1000
  Message: Faulting application CALMAIN.exe, version 8.1.0.14, time stamp 0x433d11f9, faulting module CALMAIN.exe, version 8.1.0.14, time stamp 0x433d11f9, exception code 0xc0000005, fault offset 0x00001fc9, process id 0xe04, application start time 0x01ca14a42165adbf.
  Record Number: 1017877
  Source Name: Application Error
  Time Written: 20090804013731.000000-000
  Event Type: Error
  User:
  
  Computer Name: Victor-PC
  Event Code: 1000
  Message: Faulting application vlc.exe, version 0.8.6.0, time stamp 0x4675098d, faulting module ntdll.dll, version 6.0.6000.16386, time stamp 0x4549bdc9, exception code 0xc0000005, fault offset 0x00061ad5, process id 0xf20, application start time 0x01ca1543926eb444.
  Record Number: 1017928
  Source Name: Application Error
  Time Written: 20090804203935.000000-000
  Event Type: Error
  User:
  
  Computer Name: Victor-PC
  Event Code: 1000
  Message: Faulting application iTunes.exe, version 8.0.2.20, time stamp 0x4925c4fe, faulting module itw_scrobbler.dll_unloaded, version 0.0.0.0, time stamp 0x48b41b9c, exception code 0xc0000005, fault offset 0x0a1d99cc, process id 0x10dc, application start time 0x01ca1550ef127055.
  Record Number: 1017961
  Source Name: Application Error
  Time Written: 20090805031115.000000-000
  Event Type: Error
  User:
  
  Computer Name: Victor-PC
  Event Code: 1000
  Message: Faulting application iTunes.exe, version 8.0.2.20, time stamp 0x4925c4fe, faulting module itw_scrobbler.dll_unloaded, version 0.0.0.0, time stamp 0x48b41b9c, exception code 0xc0000005, fault offset 0x0a1b7322, process id 0x10dc, application start time 0x01ca1550ef127055.
  Record Number: 1017963
  Source Name: Application Error
  Time Written: 20090805031122.000000-000
  Event Type: Error
  User:
  
  =====Security event log=====
  
  Computer Name: Victor-PC
  Event Code: 4624
  Message: An account was successfully logged on.
  
  Subject:
  Security ID: S-1-5-18
  Account Name: VICTOR-PC$
  Account Domain: WORKGROUP
  Logon ID: 0x3e7
  
  Logon Type: 5
  
  New Logon:
  Security ID: S-1-5-18
  Account Name: SYSTEM
  Account Domain: NT AUTHORITY
  Logon ID: 0x3e7
  Logon GUID: {00000000-0000-0000-0000-000000000000}
  
  Process Information:
  Process ID: 0x238
  Process Name: C:\Windows\System32\services.exe
  
  Network Information:
  Workstation Name:
  Source Network Address: -
  Source Port: -
  
  Detailed Authentication Information:
  Logon Process: Advapi
  Authentication Package: Negotiate
  Transited Services: -
  Package Name (NTLM only): -
  Key Length: 0
  
  This event is generated when a logon session is created. It is generated on the computer that was accessed.
  
  The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
  
  The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
  
  The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
  
  The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
  
  The authentication information fields provide detailed information about this specific logon request.
  - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
  - Transited services indicate which intermediate services have participated in this logon request.
  - Package name indicates which sub-protocol was used among the NTLM protocols.
  - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
  Record Number: 208729
  Source Name: Microsoft-Windows-Security-Auditing
  Time Written: 20090804221452.537013-000
  Event Type: Audit Success
  User:
  
  Computer Name: Victor-PC
  Event Code: 4672
  Message: Special privileges assigned to new logon.
  
  Subject:
  Security ID: S-1-5-18
  Account Name: SYSTEM
  Account Domain: NT AUTHORITY
  Logon ID: 0x3e7
  
  Privileges: SeAssignPrimaryTokenPrivilege
  SeTcbPrivilege
  SeSecurityPrivilege
  SeTakeOwnershipPrivilege
  SeLoadDriverPrivilege
  SeBackupPrivilege
  SeRestorePrivilege
  SeDebugPrivilege
  SeAuditPrivilege
  SeSystemEnvironmentPrivilege
  SeImpersonatePrivilege
  Record Number: 208730
  Source Name: Microsoft-Windows-Security-Auditing
  Time Written: 20090804221452.537013-000
  Event Type: Audit Success
  User:
  
  Computer Name: Victor-PC
  Event Code: 4648
  Message: A logon was attempted using explicit credentials.
  
  Subject:
  Security ID: S-1-5-18
  Account Name: VICTOR-PC$
  Account Domain: WORKGROUP
  Logon ID: 0x3e7
  Logon GUID: {00000000-0000-0000-0000-000000000000}
  
  Account Whose Credentials Were Used:
  Account Name: SYSTEM
  Account Domain: NT AUTHORITY
  Logon GUID: {00000000-0000-0000-0000-000000000000}
  
  Target Server:
  Target Server Name: localhost
  Additional Information: localhost
  
  Process Information:
  Process ID: 0x238
  Process Name: C:\Windows\System32\services.exe
  
  Network Information:
  Network Address: -
  Port: -
  
  This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
  Record Number: 208731
  Source Name: Microsoft-Windows-Security-Auditing
  Time Written: 20090805014646.750595-000
  Event Type: Audit Success
  User:
  
  Computer Name: Victor-PC
  Event Code: 4624
  Message: An account was successfully logged on.
  
  Subject:
  Security ID: S-1-5-18
  Account Name: VICTOR-PC$
  Account Domain: WORKGROUP
  Logon ID: 0x3e7
  
  Logon Type: 5
  
  New Logon:
  Security ID: S-1-5-18
  Account Name: SYSTEM
  Account Domain: NT AUTHORITY
  Logon ID: 0x3e7
  Logon GUID: {00000000-0000-0000-0000-000000000000}
  
  Process Information:
  Process ID: 0x238
  Process Name: C:\Windows\System32\services.exe
  
  Network Information:
  Workstation Name:
  Source Network Address: -
  Source Port: -
  
  Detailed Authentication Information:
  Logon Process: Advapi
  Authentication Package: Negotiate
  Transited Services: -
  Package Name (NTLM only): -
  Key Length: 0
  
  This event is generated when a logon session is created. It is generated on the computer that was accessed.
  
  The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
  
  The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
  
  The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
  
  The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
  
  The authentication information fields provide detailed information about this specific logon request.
  - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
  - Transited services indicate which intermediate services have participated in this logon request.
  - Package name indicates which sub-protocol was used among the NTLM protocols.
  - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
  Record Number: 208732
  Source Name: Microsoft-Windows-Security-Auditing
  Time Written: 20090805014646.750595-000
  Event Type: Audit Success
  User:
  
  Computer Name: Victor-PC
  Event Code: 4672
  Message: Special privileges assigned to new logon.
  
  Subject:
  Security ID: S-1-5-18
  Account Name: SYSTEM
  Account Domain: NT AUTHORITY
  Logon ID: 0x3e7
  
  Privileges: SeAssignPrimaryTokenPrivilege
  SeTcbPrivilege
  SeSecurityPrivilege
  SeTakeOwnershipPrivilege
  SeLoadDriverPrivilege
  SeBackupPrivilege
  SeRestorePrivilege
  SeDebugPrivilege
  SeAuditPrivilege
  SeSystemEnvironmentPrivilege
  SeImpersonatePrivilege
  Record Number: 208733
  Source Name: Microsoft-Windows-Security-Auditing
  Time Written: 20090805014646.750595-000
  Event Type: Audit Success
  User:
  
  ======Environment variables======
  
  "ComSpec"=%SystemRoot%\system32\cmd.exe
  "FP_NO_HOST_CHECK"=NO
  "OS"=Windows_NT
  "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\;C:\Program Files\Common Files\Adobe\AGL;C:\Program Files\Common Files\Autodesk Shared\;C:\Program Files\Autodesk\backburner\;C:\Program Files\QuickTime\QTSystem\
  "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
  "PROCESSOR_ARCHITECTURE"=x86
  "TEMP"=%SystemRoot%\TEMP
  "TMP"=%SystemRoot%\TEMP
  "USERNAME"=SYSTEM
  "windir"=%SystemRoot%
  "PROCESSOR_LEVEL"=15
  "PROCESSOR_IDENTIFIER"=x86 Family 15 Model 72 Stepping 2, AuthenticAMD
  "PROCESSOR_REVISION"=4802
  "NUMBER_OF_PROCESSORS"=2
  "RoxioCentral"=C:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\
  "SamDir"=SINSTDIR
  "CLASSPATH"=.;C:\Program Files\Java\jre1.6.0\lib\ext\QTJava.zip
  "QTJAVA"=C:\Program Files\Java\jre1.6.0\lib\ext\QTJava.zip
  

  ---

  EOF

  ---

  0
• Katana

  August 2009 edited August 2009

  Information
  
  There are still some signs of infection.
  
  I don't provide help for those using any form of cracked software or Operating Systems.
  
  RE. PhotoShop CS3 Extended Keygen + Activation.exe
  
  In doing the crack, the 'cracker' has broken the 'End User Licence Agreement' (EULA) of the product.
  The distribution and use of cracked copies is illegal in almost every developed country.
  They are also one of the biggest causes of infection.
  
  This applies to Cracks, Keygens and Warez
  
  Since this file has been removed, I will continue to help you at this time
  BUT, if I see any evidence of other similar files/programs this topic will be locked
  
  In the future I strongly suggest you stay away from using cracks and/or Keygens.
  
  

  ---

  
  Step 1
  
  Disable resident protections (Antivirus...); you'll re-enable them after the scan
  
  Download Lop S&D < here
  
  Double-click Lop S&D.exe
  Choose the language, then choose Option 1 (Search)
  Wait till the end of the scan
  Post the log which is created: (%SystemDrive%\lopR.txt)
  

  ---

  
  Step 2
  
  
  Download and Run ComboFix (by sUBs)
  Please visit this webpage for instructions for downloading and running ComboFix:
  
  Bleeping Computer ComboFix Tutorial
  
  

  • You must download it to and run it from your Desktop
    
  • Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
    
  • Double click combofix.exe & follow the prompts.
    
  • When finished, it will produce a log. Please save that log to post in your next reply
    
  • Re-enable all the programs that were disabled during the running of ComboFix..

  
  
  
  A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
  This tool is not a toy and not for everyday use.
  ComboFix SHOULD NOT be used unless requested by a forum helper

  For instructions on how to disable your security programs, please see this topic
  How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

  
  

  ---

  
  Step 3
  
  Kaspersky Online Scanner .
  Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
  NOTE:- This scan is best done from IE (Internet Explorer)
  NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
  Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html
  
  Read the Requirements and limitations before you click Accept.
  Once the database has downloaded, click My Computer in the left pane
  Now go and put the kettle on !
  When the scan has completed, click Save Report As...
  Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
  Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.
  
  
  **Note**
  
  To optimize scanning time and produce a more sensible report for review:

  • Close any open programs.
  • Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

  
  Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.
  
  

  ---

  
  Logs/Information to Post in Reply
  Please post the following logs/Information in your reply
  Some of the logs I request will be quite large, You may need to split them over a couple of replies.
  

  • Lop S&D Log
  • Combofix Log
  • Kaspersky Log

  
  
  
  

  ---

  
  

  ---

  
  Additional Notes
  
  
  
  Your Adobe Acrobat Reader is out of date. Older versions have vulnerabilities that malware can use to infect your system.
  
  Adobe Reader is a large program and uses unnecessary space.
  If you prefer a smaller program you can get Foxit 3.0 from http://www.foxitsoftware.com/pdf/rd_intro.php << Recommended
  
  There is a newer version of Adobe Acrobat Reader available.
  

  • Please go to this link Adobe Acrobat Reader Download Link
  • Click Download
  • On the right Untick Adobe Phototshop Album Starter Edition if you do not wish to include this in the installation.
  • Click the Continue button
  • Click Run, and click Run again
  • Next click the Install Now button and follow the on screen prompts

  
  
  
  
  Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
  
  Please download Java SE Runtime Environment (JRE) . ( don't install it yet )
  

  • Scroll down to where it says "Java SE Runtime Environment (JRE)".
  • Click the "Download" button to the right.
  • • Platform = Windows
    • Language = Multi Language
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.

  
  
  Now download JavaRa and unzip it to your desktop.
  
  ***Please close any instances of Internet Explorer (or other web browser) before continuing!***
  
  

  • Double-click on JavaRa.exe to start the program.
  • From the drop-down menu, choose English and click on Select.
  • JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
  • Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
  • A logfile will pop up. Please save it to a convenient location.

  
  
  Now install the Java SE Runtime Environment (JRE) package you downloaded
  (it comes with a toolbar pre-selected, so make sure you uncheck the box)
  
  You can delete JavaRa (zip and exe)
  
  Remove Programs
  Now click Vista Icon---Control Panel. Double click Programs and Features. If any of the following programs are listed there,
  click on the program to highlight it, and click on remove.
  

  • Adobe Reader 7.0.8
    
    Java(TM) 6 Update 13
    Java(TM) SE Runtime Environment 6
    

  Now close the Control Panel.

  0
• samzy

  August 2009 edited August 2009

  It may take me a while to respond because I can't disable my mcafee virus and spyware protection. I'll try to disable it asap.

  0
• Katana

  August 2009 edited August 2009

  For instructions on how to disable your security programs, please see this topic
  How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

  0
• Katana

  August 2009 edited August 2009

  Whilst we appreciate that you may be busy, it has been several days since we heard from you. This topic is now closed.
  
  Infections can change and fresh instructions will now need to be given. If you wish to reopen your topic, please send a Private Message (PM) to Trogan with a link to your thread.
  
  If you are not the user who started this thread, you must start your own Thread instead

  0