Recently (2 or 3 days ago) my computer has started freezing up for a few seconds in a row. Then it works alright and then it freezes up again. I have Avira AnitVir installed as my main antivirus program. When I started noticing problems, I downloaded Hotman Pro 2, but it got stuck on a few occasions, so it wasnt able to do a complete scan. I saw a few other threads here and other places and they suggested I place a HijackThis file. We'll, here it is:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:21:27, on 17-7-2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\WTablet\Wacom_TabletUser.exe
F:\Program Files\LogMeIn\x86\LogMeInSystray.exe
F:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Windows\System32\rundll32.exe
F:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
F:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
F:\Program Files\Logitech\QuickCam10.exe
C:\Windows\System32\CtHelper.exe
C:\Windows\System32\Ctxfihlp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\CTxfispi.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\AgentG15.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
F:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\explorer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
F:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
E:\downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Update Helper - {A4CC8907-3EA6-49EE-8B74-D09660120910} - C:\Program Files\Google\Update\1.2.121.9\GoopdateBho.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "F:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [PWRISOVM.EXE] F:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "F:\Program Files\Logitech\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [LogMeIn GUI] "F:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [ISTray] "F:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] f:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [DevconDefaultDB] C:\Windows\system32\READREG /SILENT /FAIL=1 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DevconDefaultDB] C:\Windows\system32\READREG /SILENT /FAIL=1 (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{B7920464-A7BB-4150-8E91-A07B2205D2E0}: NameServer = 192.168.1.1,192.168.1.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - F:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - F:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c8e2c7d1c68657) (gupdate1c8e2c7d1c68657) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HoudiniServer - Side Effects Software Inc. - C:\Windows\system32\hserver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - F:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - F:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - F:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - F:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\Windows\system32\Wacom_Tablet.exe

--
End of file - 9888 bytes

Hope you can help me. Any help is appreciated

Funny as it sounds, I joined this site just to reply to your issue. I'm not positive, but it seems that Spyware Doctor is your problem. I was recently using it and also used some Vista tweaking tools to make my computer faster, but instead my computer started freezing as soon as I logged in. I thought it was the tweaking tools, but then after trial and error (and a few system restores) I found out that most likely it was Spyware Doctor, which I see you also have installed. I hear we were not the only ones having problems with it, I'm assuming that you're using Windows Vista, and it seems Vista also seems to make it worse as I hear this problem was not a problem with Spyware Doctor on XP. I hear that another explaination may be that Spyware Doctor is actually finding and stopping "smart" spyware and/or viruses which freeze computers when they are stopped. Lastly, I don't because of Spyware clashing with anything which I originally thought, because I have AVG antivirus. I mention this because I hear that sometimes certain programs, such as virus protection, firewalls, etc. have issues and clash with each other, but since we have two different Virus Protection Programs, which most likely run differently, I would have to say one last time to to towards Spyware Doctor. Check and see if the problems started after installing or updating it. Also try googling or Yahooing it like I did. Hopefully my long winded reply is actually of some aid to you, and hopefully you get the problem solved. Good Luck!

The log looks clean, so it may not be malware. We can take a closer look at what's running to see if there's anything hidden form HijackThis:

Download Deckard's System Scanner to the desktop (the download link is in the centre, about 2/3rds of the way down the page). Run Dss.exe and post the log it generates.

I'll move this thread to the Malicious Code forum.

All the anti spyware and anti malware stuff was installed after my computer started freezing up, so that cant be the problem, might have made it worse but is not the cause. I got two notepad files when DSS.exe was completed so here they are:

Main.txt:

Deckard's System Scanner v20071014.68
Run by Snipes on 2008-07-18 11:59:55
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- Last 4 Restore Point(s) --
4: 2008-07-17 18:57:50 UTC - RP149 - Installed Battlefield 2 Patch v1.41
3: 2008-07-17 18:50:40 UTC - RP147 - Installed Battlefield 2™
2: 2008-07-17 17:35:05 UTC - RP145 - Installed Psychonauts
1: 2008-07-17 11:55:34 UTC - RP143 - Uniblue RegistryBooster


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Snipes.exe) ----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:00:36, on 18-7-2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Windows\system32\WTablet\Wacom_TabletUser.exe
C:\Windows\System32\rundll32.exe
F:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
F:\Program Files\Logitech\QuickCam10.exe
F:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Windows\System32\CtHelper.exe
C:\Windows\System32\Ctxfihlp.exe
F:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\CTxfispi.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\AgentG15.exe
F:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
F:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
F:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Snipes\Desktop\dss.exe
E:\DOWNLO~1\Snipes.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Update Helper - {A4CC8907-3EA6-49EE-8B74-D09660120910} - C:\Program Files\Google\Update\1.2.121.9\GoopdateBho.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "F:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [PWRISOVM.EXE] F:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "F:\Program Files\Logitech\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [LogMeIn GUI] "F:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [ISTray] "F:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] f:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [DevconDefaultDB] C:\Windows\system32\READREG /SILENT /FAIL=1 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DevconDefaultDB] C:\Windows\system32\READREG /SILENT /FAIL=1 (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{B7920464-A7BB-4150-8E91-A07B2205D2E0}: NameServer = 192.168.1.1,192.168.1.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - F:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - F:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c8e2c7d1c68657) (gupdate1c8e2c7d1c68657) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HoudiniServer - Side Effects Software Inc. - C:\Windows\system32\hserver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - F:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - F:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - F:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - F:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\Windows\system32\Wacom_Tablet.exe

--
End of file - 9718 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 SCDEmu - c:\windows\system32\drivers\scdemu.sys <Not Verified; PowerISO Computing, Inc.; scdemu>
R2 Haspnt - \??\c:\windows\system32\drivers\haspnt.sys
R2 Sentinel - c:\windows\system32\drivers\sentinel.sys <Not Verified; Rainbow Technologies, Inc.; Sentinel System Driver>

S2 DS1410D - \??\c:\windows\system32\drivers\ds1410d.sys
S3 Sntnlusb (Rainbow USB SuperPro) - c:\windows\system32\drivers\sntnlusb.sys <Not Verified; Rainbow Technologies Inc.; Rainbow Technologies USB Security Device Driver>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 AntiVirScheduler (Avira AntiVir Personal – Free Antivirus Scheduler) - "f:\program files\avira\antivir personaledition classic\sched.exe" <Not Verified; Avira GmbH; AntiVir Workstation>
R2 Bonjour Service (##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##) - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Computer, Inc.; Bonjour>
R2 CTAudSvcService (Creative Audio Service) - c:\program files\creative\shared files\ctaudsvc.exe <Not Verified; Creative Technology Ltd; Creative Audio Service>
R2 HoudiniServer - c:\windows\system32\hserver.exe <Not Verified; Side Effects Software Inc.; >

S3 FLEXnet Licensing Service - "c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)>


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks -------------------------------------------------------------

2008-07-18 11:39:56 296 --a------ C:\Windows\Tasks\GoogleUpdateTask.job


-- Files created between 2008-06-18 and 2008-07-18 -----------------------------

2008-07-17 20:13:28 118784 --a------ C:\Windows\system32\MSSTDFMT.DLL <Not Verified; Microsoft Corporation; MSSTDFMT Object Library>
2008-07-17 19:57:19 98304 --a------ C:\Windows\system32\CmdLineExt.dll <Not Verified; Sony DADC Austria AG.; >
2008-07-17 19:51:30 0 d-------- C:\Temp
2008-07-13 23:00:23 0 d-------- C:\Windows\keys
2008-07-13 23:00:04 2150400 --a------ C:\Windows\system32\hserver.exe <Not Verified; Side Effects Software Inc.; >
2008-07-13 14:27:06 0 d-------- C:\Windows\system32\QuickTime
2008-07-13 13:24:20 0 d-------- C:\Windows\system32\WTablet
2008-07-13 13:24:15 0 d-------- C:\Program Files\Tablet
2008-07-13 13:11:51 0 d-------- C:\Program Files\Bonjour
2008-07-13 13:07:48 0 d-------- C:\Program Files\Common Files\Macrovision Shared
2008-07-12 16:12:18 0 d-------- C:\Program Files\Virtual Earth 3D
2008-07-08 12:09:16 0 d-------- C:\Windows\pss
2008-07-06 17:43:35 669184 --a------ C:\Windows\system32\pbsvc.exe
2008-07-02 12:00:19 53248 -----n--- C:\Windows\Ctregrun.exe <Not Verified; Creative Technology Ltd; Creative Product Registration>
2008-06-30 18:35:15 0 d-------- C:\Windows\system32\Futuremark
2008-06-30 18:35:15 3972 --a------ C:\Windows\system32\drivers\PciBus.sys
2008-06-28 15:05:05 0 d-------- C:\PerfLogs
2008-06-27 10:55:23 0 d-------- C:\Program Files\Hewlett-Packard
2008-06-27 10:55:23 0 d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-06-27 10:54:58 0 d-------- C:\Program Files\Common Files\HP
2008-06-27 10:51:00 0 d-------- C:\Program Files\HP
2008-06-27 10:50:07 148933 --a------ C:\Windows\hpoins19.dat
2008-06-27 10:50:00 258048 --a------ C:\Windows\system32\hpzids01.dll <Not Verified; Hewlett-Packard; HP Installer>
2008-06-27 10:50:00 675840 --a------ C:\Windows\system32\hpowiav1.dll <Not Verified; Hewlett-Packard; hpowiav1.dll>
2008-06-27 10:50:00 303104 --a------ C:\Windows\system32\hpovst01.dll <Not Verified; Hewlett-Packard Co.; hp digital imaging - hp all-in-one series>
2008-06-27 10:50:00 897024 --a------ C:\Windows\system32\hpotiop1.dll <Not Verified; Hewlett-Packard Co.; hp digital imaging - hp all-in-one series>
2008-06-27 10:49:58 26952 --a------ C:\Windows\hpomdl19.dat
2008-06-23 19:55:27 0 d-------- C:\Program Files\Common Files\Steam
2008-06-22 21:10:24 715248 --a------ C:\Windows\system32\drivers\sptd.sys
2008-06-20 20:32:17 0 d-------- C:\Program Files\Electronic Arts
2008-06-20 20:32:00 1774 --a------ C:\Windows\system32\ealregsnapshot1.reg
2008-06-20 13:13:54 0 d-------- C:\Program Files\Google
2008-06-19 16:35:01 0 d-------- C:\Program Files\uTorrent
2008-06-18 20:04:45 0 d-------- C:\Program Files\Apple Software Update
2008-06-18 17:43:30 0 d-------- C:\Program Files\Skype
2008-06-18 17:43:30 0 d-------- C:\Program Files\Common Files\Skype


-- Find3M Report ---------------------------------------------------------------

2008-07-18 11:40:02 0 d-------- C:\Users\Snipes\AppData\Roaming\WTablet
2008-07-18 11:39:24 8405015 --a------ C:\Windows\TempFile
2008-07-17 20:50:53 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-07-17 20:19:34 0 d-------- C:\Users\Snipes\AppData\Roaming\Lavasoft
2008-07-17 20:15:27 0 d-------- C:\Users\Snipes\AppData\Roaming\PC Tools
2008-07-17 18:42:51 0 d-------- C:\Users\Snipes\AppData\Roaming\uTorrent
2008-07-17 13:54:13 0 d-------- C:\Users\Snipes\AppData\Roaming\Uniblue
2008-07-17 10:48:56 0 d-------- C:\Program Files\Java
2008-07-16 14:45:24 0 d-------- C:\Users\Snipes\AppData\Roaming\teamspeak2
2008-07-14 22:36:31 0 d-------- C:\Users\Snipes\AppData\Roaming\Adobe
2008-07-14 18:13:07 0 d-------- C:\Users\Snipes\AppData\Roaming\Winamp
2008-07-13 13:19:34 0 d-------- C:\Program Files\Common Files\Adobe
2008-07-13 13:07:48 0 d-------- C:\Program Files\Common Files
2008-07-10 12:03:36 0 d-------- C:\Program Files\Windows Mail
2008-07-07 14:52:20 0 d-------- C:\Users\Snipes\AppData\Roaming\EVEMon
2008-07-04 21:05:31 0 d-------- C:\Users\Snipes\AppData\Roaming\InstallShield
2008-07-02 12:03:52 0 d-------- C:\Users\Snipes\AppData\Roaming\Creative
2008-07-02 12:00:18 0 d-------- C:\Program Files\Creative
2008-07-02 11:56:18 110592 --a------ C:\Windows\system32\OpenAL32.dll <Not Verified; Portions © Creative Labs Inc. and NVIDIA Corp.; Standard OpenAL™ Library>
2008-06-28 17:38:04 174 --ahs---- C:\Program Files\desktop.ini
2008-06-28 15:06:34 0 d-------- C:\Program Files\Windows Sidebar
2008-06-28 15:06:34 0 d-------- C:\Program Files\Windows Calendar
2008-06-28 15:06:34 0 d-------- C:\Program Files\Movie Maker
2008-06-28 15:06:31 0 d-------- C:\Program Files\Windows Photo Gallery
2008-06-28 15:06:31 0 d-------- C:\Program Files\Windows Journal
2008-06-28 15:06:31 0 d-------- C:\Program Files\Windows Collaboration
2008-06-28 15:06:27 0 d-------- C:\Program Files\Windows Defender
2008-06-27 10:58:37 0 d-------- C:\Users\Snipes\AppData\Roaming\HP
2008-06-22 11:13:12 0 d-------- C:\Program Files\OpenAL
2008-06-20 20:34:46 0 d-------- C:\Users\Snipes\AppData\Roaming\SPORE Creature Creator
2008-06-20 13:14:38 0 d-------- C:\Users\Snipes\AppData\Roaming\Google
2008-06-19 09:50:35 0 d-------- C:\Users\Snipes\AppData\Roaming\Skype
2008-06-18 20:07:00 0 d-------- C:\Users\Snipes\AppData\Roaming\Autodesk
2008-06-18 17:45:32 0 d-------- C:\Users\Snipes\AppData\Roaming\skypePM
2008-06-18 16:18:23 0 d-------- C:\Users\Snipes\AppData\Roaming\vlc
2008-06-17 23:33:12 0 d-------- C:\Users\Snipes\AppData\Roaming\Mozilla
2008-06-17 01:15:24 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-06-17 01:14:37 0 d-------- C:\Program Files\MSXML 4.0
2008-06-15 21:12:43 0 d-------- C:\Program Files\Common Files\LogiShrd
2008-06-15 21:02:42 0 d-------- C:\Program Files\Logitech
2008-06-15 17:49:10 0 d-------- C:\Users\Snipes\AppData\Roaming\Yahoo!
2008-06-15 17:49:10 0 d-------- C:\Program Files\Yahoo!
2008-06-15 17:44:53 0 d-------- C:\Program Files\Microsoft Silverlight
2008-06-15 14:35:16 0 d-------- C:\Program Files\Windows Live
2008-06-15 14:34:55 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
2008-06-15 13:36:37 0 d-------- C:\Program Files\Autodesk
2008-06-15 13:35:28 0 d-------- C:\Program Files\Common Files\Alias Shared
2008-06-15 13:34:58 0 d-------- C:\Program Files\Common Files\Autodesk Shared
2008-06-15 13:34:37 6656 --a------ C:\Windows\system32\haspvdd.dll <Not Verified; Aladdin Knowledge Systems.; Windows NT HASP Virtual Device Driver>
2008-06-15 13:34:37 383 --a------ C:\Windows\system32\haspdos.sys
2008-06-15 13:34:20 0 -rahs---- C:\MSDOS.SYS
2008-06-15 13:34:20 0 -rahs---- C:\IO.SYS
2008-06-15 13:21:41 0 d-------- C:\Program Files\Common Files\InstallShield
2008-06-15 13:12:27 0 d-------- C:\Program Files\Microsoft.NET
2008-06-15 11:58:14 0 d-------- C:\Users\Snipes\AppData\Roaming\WinRAR
2008-06-15 11:54:57 0 d-------- C:\Users\Snipes\AppData\Roaming\Macromedia
2008-06-15 11:48:21 0 d-------- C:\Program Files\Sun
2008-06-15 11:46:23 0 d-------- C:\Program Files\Common Files\Java
2008-06-15 11:41:40 0 --a------ C:\Windows\nsreg.dat
2008-06-15 11:35:58 0 d-------- C:\Users\Snipes\AppData\Roaming\Identities


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A4CC8907-3EA6-49EE-8B74-D09660120910}]
16-07-2008 12:42 184816 --a----t- C:\Program Files\Google\Update\1.2.121.9\GoopdateBho.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [19-01-2008 09:38]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [10-06-2008 04:27]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [02-05-2008 22:46]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [02-05-2008 22:46]
"avgnt"="F:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [18-07-2008 11:45]
"PWRISOVM.EXE"="F:\Program Files\PowerISO\PWRISOVM.EXE" [15-03-2008 01:50]
"Launch LCDMon"="C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [13-12-2007 17:43]
"Launch LGDCore"="C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [13-12-2007 17:57]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [08-02-2007 01:12]
"LogitechQuickCamRibbon"="F:\Program Files\Logitech\QuickCam10.exe" [08-02-2007 01:13]
"LogMeIn GUI"="F:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [28-02-2008 15:31]
"CTHelper"="CTHELPER.EXE" [20-02-2008 20:58 C:\Windows\System32\CtHelper.exe]
"CTxfiHlp"="CTXFIHLP.EXE" [20-02-2008 20:58 C:\Windows\System32\Ctxfihlp.exe]
"ISTray"="F:\Program Files\Spyware Doctor\pctsTray.exe" [10-04-2008 15:14]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [19-01-2008 09:33]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [19-01-2008 09:33]
"Uniblue RegistryBooster 2"="f:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe" []

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DevconDefaultDB"=C:\Windows\system32\READREG /SILENT /FAIL=1

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=2 (0x2)
"EnableUIADesktopToggle"=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
@="SecurityDevices"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
F:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"F:\Program Files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService nsi lltdsvc SSDPSRV upnphost SCardSvr w32time EventSystem RemoteRegistry WinHttpAutoProxySvc lanmanworkstation TBS SLUINotify THREADORDER fdrespub netprofm fdphost wcncsvc QWAVE Mcx2Svc WebClient SstpSvc
HPZ12 Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt hpqcxs08 hpqddsvc


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
AutoRun\command- I:\PsychoLauncher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
AutoRun\command- K:\Launcher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc599113-4b3e-11dd-b5da-001e8ce0e1c3}]
Auto\command- tel.xls.exe
AutoRun\command- C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
C:\Windows\system32\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI



-- End of Deckard's System Scanner: finished at 2008-07-18 12:03:45 ------------

Extra.txt:

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft® Windows Vista™ Ultimate (build 6001) SP 1.0
Architecture: X86; Language: English

CPU 0: Intel® Core™2 Quad CPU Q9300 @ 2.50GHz
Percentage of Memory in Use: 38%
Physical Memory (total/avail): 2813.63 MiB / 1741.73 MiB
Pagefile Memory (total/avail): 5834.36 MiB / 4803.62 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1888.46 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 24.41 GiB total, 3.92 GiB free.
D: is Fixed (NTFS) - 19.53 GiB total, 10.73 GiB free.
E: is Fixed (NTFS) - 213.34 GiB total, 73.65 GiB free.
F: is Fixed (NTFS) - 103.58 GiB total, 91 GiB free.
G: is Fixed (NTFS) - 337.77 GiB total, 122.5 GiB free.
H: is CDROM (No Media)
I: is CDROM (No Media)
J: is Fixed (FAT32) - 153.34 GiB total, 139.44 GiB free.
K: is Fixed (NTFS) - 298.09 GiB total, 216.73 GiB free.

\\.\PHYSICALDRIVE0 - SAMSUNG SP2504C SCSI Disk Device - 232.88 GiB - 2 partitions
\PARTITION0 (bootable) - Installable File System - 19.53 GiB - D:
\PARTITION1 - Extended w/Extended Int 13 - 213.34 GiB - E:

\\.\PHYSICALDRIVE1 - ST350063 0AS SCSI Disk Device - 465.76 GiB - 3 partitions
\PARTITION0 (bootable) - Installable File System - 24.41 GiB - C:
\PARTITION1 - Extended w/Extended Int 13 - 103.58 GiB - F:
\PARTITION2 - Installable File System - 337.77 GiB - G:

\\.\PHYSICALDRIVE3 - HDS72251 6VLAT20 USB Device - 153.38 GiB - 1 partition
\PARTITION0 - Unknown - 153.38 GiB - J:

\\.\PHYSICALDRIVE2 - Seagate External Drive USB Device - 298.09 GiB - 1 partition
\PARTITION0 - Installable File System - 298.09 GiB - K:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

AV: Avira AntiVir PersonalEdition v8.0.1.18 (Avira GmbH)
AS: Spyware Doctor v5.5.1.322 (PC Tools)
AS: Windows Defender v1.1.1505.0 (Microsoft Corporation) Disabled

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Snipes\AppData\Roaming
CLASSPATH=.;C:\Program Files\Java\jre1.6.0_06\lib\ext\QTJava.zip
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=ARMOR
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Snipes
LOCALAPPDATA=C:\Users\Snipes\AppData\Local
LOGONSERVER=\\ARMOR
NUMBER_OF_PROCESSORS=4
OS=Windows_NT
Path=F:\Program Files\Autodesk\Maya8.5\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;F:\Program Files\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 23 Stepping 7, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=1707
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
PROMPT=$P$G
PUBLIC=C:\Users\Public
QTJAVA=C:\Program Files\Java\jre1.6.0_06\lib\ext\QTJava.zip
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Snipes\AppData\Local\Temp
TMP=C:\Users\Snipes\AppData\Local\Temp
USERDOMAIN=ARMOR
USERNAME=Snipes
USERPROFILE=C:\Users\Snipes
windir=C:\Windows


-- User Profiles ---------------------------------------------------------------

Snipes
LogMeInRemoteUser (admin)


-- Add/Remove Programs ---------------------------------------------------------

--> C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{17E96A7F-AFE3-4171-87B1-583E376319E8}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7AB55EC6-1158-41EF-B87D-90555A8F5C92}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7AB55EC6-1158-41EF-B87D-90555A8F5C92}\setup.exe" -l0x9 /remove
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-00BA-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0114-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
32 Bit HP CIO Components Installer --> MsiExec.exe /I{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}
Ad-Aware SE Personal --> F:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE F:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG
Add or Remove Adobe Creative Suite 3 Master Collection --> C:\Program Files\Common Files\Adobe\Installers\8bb24e071e5922899698c2105557bd2\Setup.exe
Adobe After Effects CS3 Presets --> MsiExec.exe /I{185D0A67-E066-44AE-926D-F6305813301C}
Adobe Anchor Service CS3 --> MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3 --> MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3 --> MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting --> MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe BridgeTalk Plugin CS3 --> MsiExec.exe /I{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}
Adobe Camera Raw 4.0 --> MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps --> MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color - Photoshop Specific --> MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings --> MsiExec.exe /I{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}
Adobe Color EU Extra Settings --> MsiExec.exe /I{51846830-E7B2-4218-8968-B77F0FF475B8}
Adobe Color JA Extra Settings --> MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
Adobe Color NA Recommended Settings --> MsiExec.exe /I{95655ED4-7CA5-46DF-907F-7144877A32E5}
Adobe Creative Suite 3 Master Collection --> MsiExec.exe /I{7162AC2C-733F-4127-ACAD-C5F0F27D123D}
Adobe Default Language CS3 --> MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3 --> MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe ExtendScript Toolkit 2 --> MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}
Adobe Extension Manager CS3 --> MsiExec.exe /I{BE5F3842-8309-4754-92D5-83E02E6077A3}
Adobe Flash Player 9 ActiveX --> MsiExec.exe /X{BC4F8E84-5E29-49EC-B4E7-E6F9CB50986C}
Adobe Flash Player 9 Plugin --> MsiExec.exe /X{88D422DB-E9C7-4E16-9D80-2999F4FD6AD9}
Adobe Flash Player Plugin --> C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Fonts All --> MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Viewer CS3 --> MsiExec.exe /I{7ACFB90E-8FD0-4397-AD3A-5195412623A3}
Adobe Illustrator CS3 --> MsiExec.exe /I{F08E8D2E-F132-4742-9C87-D5FF223A016A}
Adobe InDesign CS3 Icon Handler --> MsiExec.exe /I{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}
Adobe Linguistics CS3 --> MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe MotionPicture Color Files --> MsiExec.exe /I{6B708481-748A-4EB4-97C1-CD386244FF77}
Adobe PDF Library Files --> MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS3 --> MsiExec.exe /I{0046FA01-C5B9-4985-BACB-398DC480FC05}
Adobe Reader 8.1.2 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Adobe Setup --> MsiExec.exe /I{9BA4F9C5-7CB4-492C-9B97-89E36AFA0AB9}
Adobe SING CS3 --> MsiExec.exe /I{B671CBFD-4109-4D35-9252-3062D3CCB7B2}
Adobe Stock Photos CS3 --> MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe Type Support --> MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3 --> MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client --> MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe Video Profiles --> MsiExec.exe /I{845A8DB9-8802-4FD3-9FE3-938A6C46A2EC}
Adobe WAS CS3 --> MsiExec.exe /I{C5BD220A-EFE8-48A5-B70E-9503D535FACE}
Adobe WinSoft Linguistics Plugin --> MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP DVA Panels CS3 --> MsiExec.exe /I{0224CACC-994D-45F8-B973-D65056EA9C2F}
Adobe XMP Panels CS3 --> MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
AHV content for Acrobat and Flash --> MsiExec.exe /I{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}
Apple Software Update --> MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F}
µTorrent --> "C:\Program Files\uTorrent\uTorrent.exe" /UNINSTALL
Autodesk DirectConnect 2.0 --> MsiExec.exe /I{28C74612-2C48-4421-BF67-3949CD90748E}
Avira AntiVir Personal - Free Antivirus --> F:\Program Files\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
Battlefield 2™ --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}\setup.exe" -l0x9 -removeonly
Call of Duty® 4 - Modern Warfare™ --> C:\Program Files\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\setup.exe -runfromtemp -l0x0409
Call of Duty® 4 - Modern Warfare™ 1.6 Patch --> C:\Program Files\InstallShield Installation Information\{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}\setup.exe -runfromtemp -l0x0409
Call of Duty® 4 - Modern Warfare™ 1.7 Patch --> C:\Program Files\InstallShield Installation Information\{931C37FC-594D-43A9-B10F-A2F2B1F03498}\setup.exe -runfromtemp -l0x0409
CCleaner (remove only) --> "F:\Program Files\CCleaner\uninst.exe"
Creative Audio Console --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{17E96A7F-AFE3-4171-87B1-583E376319E8}\setup.exe" -l0x9 /remove
Crysis® --> MsiExec.exe /I{000E79B7-E725-4F01-870A-C12942B7F8E4}
EA Download Manager --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{EF7E931D-DC84-471B-8DB6-A83358095474} /l1043
EVE-ONLINE (remove only) --> G:\Program Files\CCP\EVE\Uninstall.exe
GLOBEtrotter FLEXid Drivers --> C:\Windows\IsUninst.exe -f"C:\Program Files\GLOBEtrotter Software Inc.\GLOBEtrotter FLEXid Drivers\Uninst.isu"
Google Earth --> MsiExec.exe /I{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}
Google Update --> MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Updater --> "C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
GRID --> "C:\Program Files\InstallShield Installation Information\{5A0B7BA5-4682-4273-81C2-69B17E649103}\setup.exe" -runfromtemp -l0x0009 -removeonly
Half-Life 2 --> "G:\Program Files\Steam\steam.exe" steam://uninstall/220
Half-Life 2: Deathmatch --> "G:\Program Files\Steam\steam.exe" steam://uninstall/320
Half-Life 2: Episode One --> "G:\Program Files\Steam\steam.exe" steam://uninstall/380
Half-Life 2: Episode Two --> "G:\Program Files\Steam\steam.exe" steam://uninstall/420
HijackThis 2.0.2 --> "E:\downloads\HijackThis.exe" /uninstall
Hitman Pro --> "F:\Program Files\Hitman Pro\unins000.exe"
Houdini 9.5.156 --> F:\Program Files\Side Effects Software\Houdini 9.5.156\Uninstall.exe
HP Imaging Device Functions 8.0 --> F:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP OCR Software 8.0 --> F:\Program Files\HP\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat
HP Photosmart Essential --> MsiExec.exe /X{EB21A812-671B-4D08-B974-2A347F0D8F70}
HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B --> F:\Program Files\HP\Digital Imaging\{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}\setup\hpzscr01.exe -datfile hposcr19.dat -onestop -showdisconnect -forcereboot
HP Solution Center 8.0 --> F:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
HP Update --> MsiExec.exe /X{8C6027FD-53DC-446D-BB75-CACD7028A134}
Java™ 6 Update 6 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160060}
Java™ 6 Update 7 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Lively by Google --> MsiExec.exe /X{DE78E060-9EE8-45B1-8C31-8BBA2B6CB01B}
Logitech Audio Echo Cancellation Component --> MsiExec.exe /X{BEF726DD-4037-4214-8C6A-E625C02D2870}
Logitech GamePanel Software 2.02 --> MsiExec.exe /X{0523EAF4-402C-4435-A0DA-13C40193D811}
Logitech QuickCam --> MsiExec.exe /X{7D2370AC-D8E6-4996-986A-19824F8A167C}
Logitech Video Enumerator --> MsiExec.exe /X{EA516024-D84D-41F1-814F-83175A6188F2}
Logitech® Camera-stuurprogramma --> "C:\Program Files\Common Files\LogiShrd\QCDRV\BIN\SETUP.EXE" UNINSTALL REMOVEPROMPT
LogMeIn --> MsiExec.exe /I{ED0042CA-CBEA-4ADF-B262-FE0518AF2221}
Maya 8.5 --> MsiExec.exe /I{A1E0E88A-F5E9-4414-A0D7-31940E965EC5}
Maya 8.5 Documentation (en_US) --> MsiExec.exe /I{81525B87-9344-4834-883C-C6A9D78EA1DF}
Messenger Plus! Live --> "F:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft Office Access MUI (English) 2007 --> MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Enterprise 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007 --> MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007 --> MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2007 --> MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
Microsoft Office Groove Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007 --> MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007 --> MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007 --> MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007 --> MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007 --> MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007 --> MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007 --> MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007 --> MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007 --> MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007 --> MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Silverlight --> MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (3.0) --> F:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181) --> MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833) --> MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 Parser and SDK --> MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
MVision --> MsiExec.exe /I{35725FBC-A136-4A46-9F29-091759D9BB93}
NVIDIA Drivers --> C:\Windows\system32\NVUNINST.EXE UninstallGUI
OpenAL --> "C:\Program Files\OpenAL\OALInst.exe" /U
OpenOffice.org Installer 1.0 --> MsiExec.exe /X{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}
PDF Settings --> MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}
PowerISO --> "F:\Program Files\PowerISO\uninstall.exe"
PSP Video 9 2.25 --> F:\Program Files\Red Kawa\Video Converter\uninstaller.exe
Psychonauts --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A129D1F2-CAC4-4AD7-B26D-3C6411B87DCC}\setup.exe" -l0x9 -removeonly
PunkBuster Services --> C:\Windows\system32\pbsvc.exe -u
QuickTime --> MsiExec.exe /I{08CA9554-B5FE-4313-938F-D4A417B81175}
Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Excel 2007 (KB946974) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {85E83E2E-AF9B-439B-B4F9-EB9B7EF6A00E}
Security Update for Microsoft Office Publisher 2007 (KB950114) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
Security Update for Microsoft Office system 2007 (KB951808) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {8F375E11-4FD6-4B89-9E2B-A76D48B51E00}
Security Update for Microsoft Office Word 2007 (KB950113) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9}
Security Update for Office 2007 (KB947801) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {02B5A17B-01BE-4BA6-95F1-1CBB46EBC76E}
Sentinel System Driver --> C:\WINDOWS\SYSTEM32\RNBOSENT\SETUPX86.EXE /U /q
Skype™ 3.8 --> MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
SpeechRedist --> MsiExec.exe /X{8795CBED-55E2-4693-9F14-84EC446935BE}
SPORE™ Creature Creator Demo Versie --> "C:\Program Files\InstallShield Installation Information\{ECEE0279-785F-4CB3-9F28-E69813234BF8}\setup.exe" -runfromtemp -l0x0013 -removeonly
Spybot - Search & Destroy 1.4 --> "F:\Program Files\Spybot - Search & Destroy\unins000.exe"
Spyware Doctor 5.5 --> F:\Program Files\Spyware Doctor\unins000.exe /LOG
TeamSpeak 2 RC2 --> "F:\Program Files\Teamspeak2_RC2\unins000.exe"
Tom Clancy's Rainbow Six Vegas 2 --> "C:\Program Files\InstallShield Installation Information\{FD416706-875C-4B0B-A23A-9E740DAE029E}\setup.exe" -runfromtemp -l0x0009 -removeonly
Unreal Tournament 2004 --> G:\UT2004\System\Setup.exe uninstall "UT2004"
Update for Microsoft Office Outlook 2007 (KB952142) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
Update for Office 2007 (KB946691) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Outlook 2007 Junk Email Filter (kb953463) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {1B78D541-9FF1-4330-ADD8-CED14F0C1E8E}
VideoLAN VLC media player 0.8.6h --> F:\Program Files\VideoLAN\VLC\uninstall.exe
VideoMach 4.0.4 --> F:\Program Files\VideoMach-4.0.4\uninstall.exe
Virtual Earth 3D (Beta) --> MsiExec.exe /I{39CE3C17-846D-4D9B-8B3E-C01A4B90FB73}
Wacom Tablet --> C:\Program Files\Tablet\Wacom\Remove.exe /u
Winamp --> "F:\Program Files\Winamp\UninstWA.exe"
Windows Live installer --> MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
Windows Live Messenger --> MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
Windows Live Sign-in Assistant --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
World in Conflict --> C:\Program Files\InstallShield Installation Information\{F11ADC64-C89E-47F4-A0B3-3665FF859397}\setup.exe -runfromtemp -l0x0009 -removeonly
WVS 0.30.14 for Winamp --> F:\Program Files\Winamp\Plugins\wvs\uninst.exe
Yahoo! Browser Services --> C:\PROGRA~1\Yahoo!\Common\UNIN_Y~1.EXE /S
Yahoo! Install Manager --> C:\Windows\system32\regsvr32 /u C:\PROGRA~1\Yahoo!\Common\YINSTH~1.DLL
Yahoo! Internet Mail --> C:\Windows\system32\regsvr32 /u /s C:\PROGRA~1\Yahoo!\Common\YMMAPI.dll
Yahoo! Messenger --> C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
Yahoo! ¤u¨ã¦C --> C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE


-- Application Event Log -------------------------------------------------------

Event Record #/Type6246 / Error
Event Submitted/Written: 07/18/2008 11:50:26 AM
Event ID/Source: 1000 / Application Error
Event Description:
Faulting application avnotify.exe, version 8.0.9.0, time stamp 0x47cd0d1e, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code 0xc0000005, fault offset 0x00000000,
process id 0x11c8, application start time 0xavnotify.exe0.

Event Record #/Type6235 / Success
Event Submitted/Written: 07/18/2008 11:39:59 AM
Event ID/Source: 5617 / WinMgmt
Event Description:


Event Record #/Type6234 / Success
Event Submitted/Written: 07/18/2008 11:39:58 AM
Event ID/Source: 5615 / WinMgmt
Event Description:


Event Record #/Type6224 / Success
Event Submitted/Written: 07/18/2008 11:39:16 AM
Event ID/Source: 902 / Software Licensing Service
Event Description:
The Software Licensing service has started.

Event Record #/Type6194 / Success
Event Submitted/Written: 07/17/2008 09:11:20 PM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type16753 / Warning
Event Submitted/Written: 07/18/2008 00:01:06 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%ARMOR27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %ARMOR27 can't undo changes that you allow.

For more information please see the following:
%ARMOR275

here is the rest of the file:

Scan ID: {6A4B46E7-2660-453A-AD7C-876C431E4040}

User: ARMOR\Snipes

Name: %ARMOR271

ID: %ARMOR272

Severity ID: %ARMOR273

Category ID: %ARMOR274

Path Found: %ARMOR276

Alert Type: %ARMOR278

Detection Type: 1.1.1600.02

Event Record #/Type16752 / Warning
Event Submitted/Written: 07/18/2008 00:01:06 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%ARMOR27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %ARMOR27 can't undo changes that you allow.

For more information please see the following:
%ARMOR275

Scan ID: {6DD10CE8-DD7A-428E-AA5B-ECB1083BD1A6}

User: ARMOR\Snipes

Name: %ARMOR271

ID: %ARMOR272

Severity ID: %ARMOR273

Category ID: %ARMOR274

Path Found: %ARMOR276

Alert Type: %ARMOR278

Detection Type: 1.1.1600.02

Event Record #/Type16751 / Warning
Event Submitted/Written: 07/18/2008 00:01:06 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%ARMOR27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %ARMOR27 can't undo changes that you allow.

For more information please see the following:
%ARMOR275

Scan ID: {CB084DF0-0720-4477-A168-081D82C914D5}

User: ARMOR\Snipes

Name: %ARMOR271

ID: %ARMOR272

Severity ID: %ARMOR273

Category ID: %ARMOR274

Path Found: %ARMOR276

Alert Type: %ARMOR278

Detection Type: 1.1.1600.02

Event Record #/Type16750 / Warning
Event Submitted/Written: 07/18/2008 00:01:03 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%ARMOR27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %ARMOR27 can't undo changes that you allow.

For more information please see the following:
%ARMOR275

Scan ID: {B1FA3547-9846-4CEC-83A7-5BA5D59689E4}

User: ARMOR\Snipes

Name: %ARMOR271

ID: %ARMOR272

Severity ID: %ARMOR273

Category ID: %ARMOR274

Path Found: %ARMOR276

Alert Type: %ARMOR278

Detection Type: 1.1.1600.02

Event Record #/Type16749 / Warning
Event Submitted/Written: 07/18/2008 00:01:03 PM
Event ID/Source: 3004 / WinDefend
Event Description:
%ARMOR27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %ARMOR27 can't undo changes that you allow.

For more information please see the following:
%ARMOR275

Scan ID: {6ED65F98-FCA1-40A6-B171-B557854C7DB5}

User: ARMOR\Snipes

Name: %ARMOR271

ID: %ARMOR272

Severity ID: %ARMOR273

Category ID: %ARMOR274

Path Found: %ARMOR276

Alert Type: %ARMOR278

Detection Type: 1.1.1600.02



-- End of Deckard's System Scanner: finished at 2008-07-18 12:03:45 ------------

Thank you in advance for helping out It is very much appreciated

Nothing malicious showing.

You do seem to be a little low on disk space:

C: is Fixed (NTFS) - 24.41 GiB total, 3.92 GiB free.

Nearly 4GB would seem like a lot of space, but you seem to be using a lot of virtual memory. This can take large chunks out of available disk space and cause Windows to choke.

Does Windows manage the page file, or have you set a fixed one? Bring up System Properties > Advanced tab > Performance Settings > Advanced tab > Virtual Memory to check.

Yea, I know 4 GB is a little low :S but its been lower and still worked fine. hmmmm. The virtual memory is set at 3113 MB for all drives. It's also set for best performance of programs and not background services, dunno if that makes a difference.

Something else I've noticed is that my antivir wont start up. What I mean is that I can see the icon in the quick select portion on the right side of the startup bar, but the icon shows a closed umbrella, whereas when it is working, it should show an open umbrella. I've updated, run the scan multiple times, but the umbrella stays closed, so its not actively looking for viruses all the time, if you know what I mean.

I'm really stuck :S I'm contemplating reinstalling windows or "downgrading" back to XP (which would probably be upgrading at this point but that's beside the point). That of course is a last resort cause i don't wanna wast a whole day with reinstalling stuff but if it needs to happen, so be it.

Hi Snipes-nl. HKEd has gone on holiday so I am helping out while he is away. As Ed said, there are no malicious processes showing however there is a registry entry showing that was created by a flash drive infector. The file may be long gone but we need to check this out.

Go here and download Flash_Disinfector.exe and save it to your desktop.

Doubleclick on Flash_Disinfector.exe to run it and follow the prompts. Wait until it has finished scanning and then exit the program.

The utility may ask you to insert your flash drive and/or other removable drives. Please do so and allow the utility to clean up those drives as well.

Next download the latest version of Combofix.exe from here and save it to your Desktop. Note: You must be logged onto an account with administrator privileges.

Doublecheck that combofix.exe is on your Desktop and open an elevated command prompt. To do this, click on the Start button and type cmd.exe in the Start Search box. Rightclick on it and choose "Run as Administrator". Copy and paste the below string after the prompt>.

"%userprofile%\desktop\combofix.exe" /NoOrphans

The scan will start and when it completes, a text window with your log will open. Please copy and paste that log back here.

A caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.

NB Please disable your antivirus program as it may interfere with ComboFix's routines.

thanks for taking over here's the file you requested:

ComboFix 08-07-19.1 - Snipes 2008-07-20 11:15:05.1 - NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1252.1.1033.18.1769 [GMT 2:00]
Running from: C:\Users\Snipes\Desktop\ComboFix.exe
Command switches used :: /NoOrphans
.

((((((((((((((((((((((((( Files Created from 2008-06-20 to 2008-07-20 )))))))))))))))))))))))))))))))
.

2008-07-19 14:48 . 2008-07-19 14:48 <DIR> d-------- C:\Users\Snipes\AppData\Roaming\Avira
2008-07-19 13:23 . 2008-07-19 15:11 <DIR> d-------- C:\WTablet
2008-07-19 13:13 . 2008-07-19 13:14 <DIR> d-------- C:\ProgramData\Avira
2008-07-19 13:12 . 2008-07-19 13:12 <DIR> d-------- C:\ProgramData\Avg8
2008-07-19 01:04 . 2008-07-19 01:04 <DIR> d--h----- C:\$AVG8.VAULT$
2008-07-18 16:58 . 2007-11-17 23:22 3,636 --a------ C:\Windows\System32\drivers\nvphy.bin
2008-07-18 16:56 . 2008-03-12 22:21 678,408 --a------ C:\Windows\System32\gpprefcl.dll
2008-07-18 14:40 . 2008-07-18 14:41 248,888,265 --a------ C:\Windows\MEMORY.DMP
2008-07-18 11:59 . 2008-07-18 11:59 <DIR> d-------- C:\Deckard
2008-07-17 20:19 . 2008-07-18 21:52 <DIR> d-------- C:\Users\Snipes\AppData\Roaming\Lavasoft
2008-07-17 20:15 . 2008-07-17 20:15 <DIR> d-------- C:\Users\Snipes\AppData\Roaming\PC Tools
2008-07-17 20:15 . 2008-07-20 09:27 <DIR> d-a------ C:\ProgramData\TEMP
2008-07-17 20:15 . 2007-12-10 13:53 81,288 --a------ C:\Windows\System32\drivers\iksyssec.sys
2008-07-17 20:15 . 2007-12-10 13:53 66,952 --a------ C:\Windows\System32\drivers\iksysflt.sys
2008-07-17 20:15 . 2008-02-01 11:55 42,376 --a------ C:\Windows\System32\drivers\ikfilesec.sys
2008-07-17 20:15 . 2007-12-10 13:53 29,576 --a------ C:\Windows\System32\drivers\kcom.sys
2008-07-17 20:14 . 2008-07-17 22:17 <DIR> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-07-17 20:13 . 2005-08-25 18:18 118,784 --a------ C:\Windows\System32\MSSTDFMT.DLL
2008-07-17 20:13 . 2005-08-25 18:19 115,920 --a------ C:\Windows\System32\MSINET.OCX
2008-07-17 19:57 . 2008-07-17 19:57 98,304 --a------ C:\Windows\System32\CmdLineExt.dll
2008-07-17 19:51 . 2008-07-17 21:38 <DIR> d-------- C:\Temp
2008-07-17 19:51 . 2008-07-17 19:51 <DIR> d-------- C:\ProgramData\Prevx
2008-07-17 13:54 . 2008-07-17 13:54 <DIR> d-------- C:\Users\Snipes\AppData\Roaming\Uniblue
2008-07-16 14:45 . 2008-07-16 14:45 <DIR> d-------- C:\Users\Snipes\AppData\Roaming\teamspeak2
2008-07-16 14:45 . 2008-07-16 14:45 34,064 --a------ C:\Windows\System32\lhacm.acm
2008-07-14 21:27 . 2008-06-26 03:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll
2008-07-14 21:27 . 2008-06-26 03:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll
2008-07-14 21:27 . 2008-06-26 05:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll
2008-07-13 23:00 . 2008-07-13 23:00 <DIR> d-------- C:\Windows\keys
2008-07-13 23:00 . 2008-07-04 07:43 2,150,400 --a------ C:\Windows\System32\hserver.exe
2008-07-13 23:00 . 2008-07-04 07:55 5,012 --a------ C:\Windows\System32\hserver.ini
2008-07-13 14:27 . 2008-07-13 14:27 <DIR> d-------- C:\Windows\System32\QuickTime
2008-07-13 13:27 . 2008-07-13 13:27 <DIR> d-------- C:\ProgramData\AppData
2008-07-13 13:26 . 2008-07-20 09:26 <DIR> d-------- C:\Users\Snipes\AppData\Roaming\WTablet
2008-07-13 13:25 . 2007-09-07 11:31 3,499,304 --a------ C:\Windows\System32\WacomTablet.cpl
2008-07-13 13:25 . 2007-09-05 14:30 1,910,035 --a------ C:\Windows\System32\WacomTablet.znc
2008-07-13 13:25 . 2007-02-15 16:11 11,440 --a------ C:\Windows\System32\drivers\WacomVKHid.sys
2008-07-13 13:24 . 2008-07-13 13:24 <DIR> d-------- C:\Windows\System32\WTablet
2008-07-13 13:24 . 2008-07-13 13:25 <DIR> d-------- C:\Program Files\Tablet
2008-07-13 13:24 . 2007-09-07 11:40 1,373,480 --a------ C:\Windows\System32\Wacom_Tablet.exe
2008-07-13 13:24 . 2007-09-07 11:20 181,544 --a------ C:\Windows\System32\Wintab32.dll
2008-07-13 13:24 . 2007-09-07 11:33 128,296 --a------ C:\Windows\System32\Wacom_Tablet.dll
2008-07-13 13:24 . 2007-02-16 10:30 12,848 --a------ C:\Windows\System32\drivers\wacomvhid.sys
2008-07-13 13:24 . 2007-02-16 11:12 11,312 --a------ C:\Windows\System32\drivers\wacommousefilter.sys
2008-07-13 13:17 . 2008-07-13 13:17 <DIR> d-------- C:\ProgramData\ALM
2008-07-13 13:11 . 2008-07-13 13:11 <DIR> d-------- C:\Program Files\Bonjour
2008-07-13 13:07 . 2008-07-13 13:07 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-07-13 12:33 . 2008-07-13 12:33 <DIR> d-------- C:\ProgramData\FLEXnet
2008-07-13 12:29 . 2007-02-20 16:04 2,463,976 --a------ C:\Windows\System32\NPSWF32.dll
2008-07-13 12:29 . 2007-02-20 16:04 190,696 --a------ C:\Windows\System32\NPSWF32_FlashUtil.exe
2008-07-12 16:12 . 2008-07-12 16:12 <DIR> d-------- C:\Program Files\Virtual Earth 3D
2008-07-06 17:44 . 2008-07-06 17:44 <DIR> d-------- C:\ProgramData\Ubisoft
2008-07-06 17:43 . 2008-07-14 17:48 669,184 --a------ C:\Windows\System32\pbsvc.exe
2008-07-04 21:09 . 2008-07-14 17:47 <DIR> d-------- C:\ProgramData\Media Center Programs
2008-07-04 21:05 . 2008-07-04 21:05 <DIR> d-------- C:\Users\Snipes\AppData\Roaming\InstallShield
2008-07-04 19:30 . 2008-07-04 19:30 <DIR> dr------- C:\Users\Public\Music
2008-07-04 19:30 . 2008-07-13 13:19 <DIR> dr------- C:\Users\Public\Documents
2008-07-04 19:29 . 2008-07-04 19:29 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-07-02 18:47 . 2008-07-19 15:08 54,928 --a------ C:\Windows\System32\BMXStateBkp-{00000009-00000000-00000007-00001102-00000005-002C1102}.rfx
2008-07-02 18:47 . 2008-07-19 15:08 54,928 --a------ C:\Windows\System32\BMXState-{00000009-00000000-00000007-00001102-00000005-002C1102}.rfx
2008-07-02 18:47 . 2008-07-02 18:47 1,080 --a------ C:\Windows\System32\settingsbkup.sfm
2008-07-02 18:47 . 2008-07-02 18:47 1,080 --a------ C:\Windows\System32\settings.sfm
2008-07-02 18:47 . 2008-07-19 15:08 788 --a------ C:\Windows\System32\DVCState-{00000009-00000000-00000007-00001102-00000005-002C1102}.rfx
2008-07-02 12:03 . 2008-07-02 12:03 <DIR> d-------- C:\Users\Snipes\AppData\Roaming\Creative
2008-07-02 12:03 . 2008-07-02 12:03 <DIR> d-------- C:\ProgramData\Creative Labs
2008-07-02 12:00 . 2000-05-22 16:58 647,872 --------- C:\Windows\System32\Mscomct2.ocx
2008-07-02 12:00 . 2006-10-06 14:17 53,248 --------- C:\Windows\Ctregrun.exe
2008-07-02 11:51 . 2007-02-26 15:24 94,208 --a------ C:\Windows\System32\cttele32.dll
2008-06-30 18:35 . 2008-06-30 18:35 <DIR> d-------- C:\Windows\System32\Futuremark
2008-06-30 18:35 . 2007-09-07 14:55 27,672 --a------ C:\Windows\System32\drivers\Entech.sys
2008-06-30 18:35 . 2007-09-07 14:55 12,744 --a------ C:\Windows\System32\drivers\Entech64.sys
2008-06-30 18:35 . 2007-09-07 14:55 6,173 --a------ C:\Windows\System32\drivers\Entech.vxd
2008-06-30 18:35 . 2001-11-19 20:05 3,972 --a------ C:\Windows\System32\drivers\PciBus.sys
2008-06-29 23:10 . 2008-06-29 23:10 <DIR> dr------- C:\Windows\System32\config\systemprofile\Videos
2008-06-29 23:10 . 2008-06-29 23:10 <DIR> dr------- C:\Windows\System32\config\systemprofile\Searches
2008-06-29 23:10 . 2008-06-29 23:10 <DIR> dr------- C:\Windows\System32\config\systemprofile\Saved Games
2008-06-29 23:10 . 2008-06-29 23:10 <DIR> dr------- C:\Windows\System32\config\systemprofile\Pictures
2008-06-29 23:10 . 2008-06-29 23:10 <DIR> dr------- C:\Windows\System32\config\systemprofile\Music
2008-06-29 23:10 . 2008-06-29 23:10 <DIR> dr------- C:\Windows\System32\config\systemprofile\Links
2008-06-29 23:10 . 2008-06-29 23:10 <DIR> dr------- C:\Windows\System32\config\systemprofile\Downloads
2008-06-29 23:10 . 2008-06-29 23:10 <DIR> dr------- C:\Windows\System32\config\systemprofile\Documents
2008-06-28 15:05 . 2008-06-28 15:05 <DIR> d-------- C:\PerfLogs
2008-06-27 10:58 . 2008-06-27 10:58 <DIR> d-------- C:\ProgramData\WEBREG
2008-06-27 10:55 . 2008-06-27 10:55 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-06-27 10:55 . 2008-06-27 10:55 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-06-27 10:54 . 2008-06-27 10:57 <DIR> d-------- C:\Program Files\Common Files\HP
2008-06-27 10:51 . 2008-06-27 10:56 <DIR> d-------- C:\Program Files\HP
2008-06-27 10:50 . 2008-06-27 10:56 <DIR> d-------- C:\ProgramData\HP
2008-06-27 10:50 . 2006-12-16 08:19 897,024 --a------ C:\Windows\System32\hpotiop1.dll
2008-06-27 10:50 . 2006-12-16 08:19 675,840 --a------ C:\Windows\System32\hpowiav1.dll
2008-06-27 10:50 . 2006-12-16 08:19 303,104 --a------ C:\Windows\System32\hpovst01.dll
2008-06-27 10:50 . 2006-11-20 23:36 258,048 --a------ C:\Windows\System32\hpzids01.dll
2008-06-27 10:50 . 2008-06-27 10:58 148,933 --a------ C:\Windows\hpoins19.dat
2008-06-27 10:49 . 2007-03-13 21:24 26,952 --a------ C:\Windows\hpomdl19.dat
2008-06-27 10:38 . 2008-06-27 10:58 <DIR> d-------- C:\Users\Snipes\AppData\Roaming\HP
2008-06-26 10:48 . 2008-01-19 09:33 2,623,488 --a------ C:\Windows\System32\SLsvc.exe
2008-06-26 10:48 . 2008-01-19 09:36 1,541,120 --a------ C:\Windows\System32\onex.dll
2008-06-26 10:46 . 2008-01-19 09:35 9,847,296 --a------ C:\Windows\System32\NlsData000a.dll
2008-06-26 10:45 . 2008-01-19 09:33 8,139,264 --a------ C:\Windows\System32\ssBranded.scr
2008-06-26 10:44 . 2008-01-19 08:06 8,147,456 --a------ C:\Windows\System32\wmploc.DLL
2008-06-23 19:55 . 2008-06-23 19:55 <DIR> d-------- C:\Program Files\Common Files\Steam
2008-06-23 18:22 . 2008-04-28 15:53 805,400 -ra------ C:\Windows\System32\tmpE228.tmp
2008-06-23 18:22 . 2008-04-28 15:53 805,400 -ra------ C:\Windows\System32\tmpE13D.tmp
2008-06-22 21:10 . 2008-06-22 21:10 715,248 --a------ C:\Windows\System32\drivers\sptd.sys
2008-06-22 11:13 . 2008-06-23 18:25 <DIR> d-------- C:\ProgramData\Codemasters
2008-06-22 11:13 . 2008-04-28 12:29 805,400 -ra------ C:\Windows\System32\tmpC4C0.tmp
2008-06-22 11:13 . 2008-04-28 12:29 805,400 -ra------ C:\Windows\System32\tmpC368.tmp
2008-06-20 20:34 . 2008-06-20 20:34 <DIR> d-------- C:\Users\Snipes\AppData\Roaming\SPORE Creature Creator
2008-06-20 20:32 . 2008-06-20 20:32 <DIR> d-------- C:\Program Files\Electronic Arts
2008-06-20 20:32 . 2008-06-20 20:33 1,774 --a------ C:\Windows\System32\ealregsnapshot1.reg
2008-06-20 13:13 . 2008-07-19 13:09 <DIR> d-------- C:\ProgramData\Google Updater
2008-06-20 13:13 . 2008-07-10 22:02 <DIR> d-------- C:\Program Files\Google

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-19 19:57 136,888 ----a-w C:\Windows\system32\drivers\PnkBstrK.sys
2008-07-19 19:56 111,928 ----a-w C:\Windows\System32\PnkBstrB.exe
2008-07-18 23:06 --------- d-----w C:\Users\Snipes\AppData\Roaming\uTorrent
2008-07-18 19:46 --------- d-----w C:\ProgramData\NVIDIA
2008-07-17 18:50 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-17 08:48 --------- d-----w C:\Program Files\Java
2008-07-14 19:30 --------- d-----w C:\ProgramData\Microsoft Help
2008-07-14 16:13 --------- d-----w C:\Users\Snipes\AppData\Roaming\Winamp
2008-07-14 15:48 66,872 ----a-w C:\Windows\System32\PnkBstrA.exe
2008-07-14 15:48 22,328 ----a-w C:\Users\Snipes\AppData\Roaming\PnkBstrK.sys
2008-07-13 11:19 --------- d-----w C:\Program Files\Common Files\Adobe
2008-07-10 10:03 --------- d-----w C:\Program Files\Windows Mail
2008-07-07 12:52 --------- d-----w C:\Users\Snipes\AppData\Roaming\EVEMon
2008-07-02 10:48 --------- d-----w C:\ProgramData\Creative
2008-07-02 10:00 --------- d-----w C:\Program Files\Creative
2008-07-02 09:56 110,592 ----a-w C:\Windows\System32\OpenAL32.dll
2008-06-28 15:38 174 --sha-w C:\Program Files\desktop.ini
2008-06-28 13:06 --------- d-----w C:\Program Files\Windows Sidebar
2008-06-28 13:06 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-06-28 13:06 --------- d-----w C:\Program Files\Windows Journal
2008-06-28 13:06 --------- d-----w C:\Program Files\Windows Defender
2008-06-28 13:06 --------- d-----w C:\Program Files\Windows Collaboration
2008-06-28 13:06 --------- d-----w C:\Program Files\Windows Calendar
2008-06-28 12:26 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-06-28 12:25 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-06-23 16:22 444,952 ----a-w C:\Windows\System32\wrap_oal.dll
2008-06-22 09:13 --------- d-----w C:\Program Files\OpenAL
2008-06-19 14:35 --------- d-----w C:\Program Files\uTorrent
2008-06-19 07:50 --------- d-----w C:\Users\Snipes\AppData\Roaming\Skype
2008-06-18 18:07 --------- d-----w C:\Users\Snipes\AppData\Roaming\Autodesk
2008-06-18 18:05 --------- d-----w C:\ProgramData\Apple Computer
2008-06-18 18:04 --------- d-----w C:\ProgramData\Apple
2008-06-18 18:04 --------- d-----w C:\Program Files\Apple Software Update
2008-06-18 15:45 56 ---ha-w C:\ProgramData\ezsidmv.dat
2008-06-18 15:45 --------- d-----w C:\Users\Snipes\AppData\Roaming\skypePM
2008-06-18 15:43 --------- d-----w C:\ProgramData\Skype
2008-06-18 15:43 --------- d-----w C:\Program Files\Skype
2008-06-18 15:43 --------- d-----w C:\Program Files\Common Files\Skype
2008-06-18 14:18 --------- d-----w C:\Users\Snipes\AppData\Roaming\vlc
2008-06-16 23:15 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-06-16 23:14 --------- d-----w C:\Program Files\MSXML 4.0
2008-06-16 15:26 --------- d-----w C:\ProgramData\Messenger Plus!
2008-06-15 21:04 --------- d-----w C:\ProgramData\LogMeIn
2008-06-15 19:12 --------- d-----w C:\Program Files\Common Files\LogiShrd
2008-06-15 19:03 --------- d-----w C:\ProgramData\Logitech
2008-06-15 19:03 --------- d-----w C:\ProgramData\Logishrd
2008-06-15 19:02 --------- d-----w C:\Program Files\Logitech
2008-06-15 17:24 --------- d-----w C:\ProgramData\Yahoo! Companion
2008-06-15 15:49 --------- d-----w C:\Users\Snipes\AppData\Roaming\Yahoo!
2008-06-15 15:49 --------- d-----w C:\ProgramData\Yahoo!
2008-06-15 15:49 --------- d-----w C:\Program Files\Yahoo!
2008-06-15 15:44 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-06-15 12:35 --------- d-----w C:\Program Files\Windows Live
2008-06-15 12:34 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-06-15 12:27 --------- d-----w C:\ProgramData\WLInstaller
2008-06-15 11:45 --------- d-----w C:\ProgramData\CCP
2008-06-15 11:36 --------- d-----w C:\Program Files\Autodesk
2008-06-15 11:35 --------- d-----w C:\Program Files\Common Files\Alias Shared
2008-06-15 11:34 6,656 ----a-w C:\Windows\System32\haspvdd.dll
2008-06-15 11:34 47,616 ----a-w C:\Windows\system32\drivers\Haspnt.sys
2008-06-15 11:34 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2008-06-15 11:21 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-15 11:12 --------- d-----w C:\Program Files\Microsoft.NET
2008-06-15 10:02 988,216 ----a-w C:\Windows\System32\winload.exe
2008-06-15 10:02 927,288 ----a-w C:\Windows\System32\winresume.exe
2008-06-15 10:02 615,992 ----a-w C:\Windows\System32\ci.dll
2008-06-15 10:02 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-06-15 10:02 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll
2008-06-15 10:02 40,960 ----a-w C:\Windows\System32\srclient.dll
2008-06-15 10:02 378,368 ----a-w C:\Windows\System32\srcore.dll
2008-06-15 10:02 318,464 ----a-w C:\Windows\System32\rstrui.exe
2008-06-15 10:02 19,000 ----a-w C:\Windows\System32\kd1394.dll
2008-06-15 10:02 14,848 ----a-w C:\Windows\System32\srdelayed.exe
2008-06-15 10:01 295,936 ----a-w C:\Windows\System32\gdi32.dll
2008-06-15 10:01 2,032,128 ----a-w C:\Windows\System32\win32k.sys
2008-06-15 10:01 14,848 ----a-w C:\Windows\System32\wshrm.dll
2008-06-15 10:01 113,664 ----a-w C:\Windows\system32\drivers\rmcast.sys
2008-06-15 10:00 540,672 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-06-15 10:00 458,752 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-06-15 10:00 4,240,384 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
2008-06-15 10:00 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-06-15 10:00 2,153,984 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-06-15 10:00 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-06-15 10:00 1,695,744 ----a-w C:\Windows\System32\gameux.dll
2008-06-15 10:00 1,314,816 ----a-w C:\Windows\System32\quartz.dll
2008-06-15 09:59 428,544 ----a-w C:\Windows\System32\EncDec.dll
2008-06-15 09:59 293,376 ----a-w C:\Windows\System32\psisdecd.dll
2008-06-15 09:57 826,880 ----a-w C:\Windows\System32\wininet.dll
2008-06-15 09:48 --------- d-----w C:\Program Files\Sun
2008-06-15 09:46 --------- d-----w C:\Program Files\Common Files\Java
2008-05-30 12:19 507,400 ----a-w C:\Windows\System32\XAudio2_1.dll
2008-05-30 12:18 238,088 ----a-w C:\Windows\System32\xactengine3_1.dll
2008-05-30 12:17 65,032 ----a-w C:\Windows\System32\XAPOFX1_0.dll
2008-05-30 12:17 25,608 ----a-w C:\Windows\System32\X3DAudio1_4.dll
2008-05-30 12:11 467,984 ----a-w C:\Windows\System32\d3dx10_38.dll
2008-05-30 12:11 3,850,760 ----a-w C:\Windows\System32\D3DX9_38.dll
2008-05-30 12:11 1,491,992 ----a-w C:\Windows\System32\D3DCompiler_38.dll
2008-05-28 10:33 83,288 ----a-w C:\Windows\System32\LMIRfsClientNP.dll
2008-05-28 10:33 24,608 ----a-w C:\Windows\System32\LMIport.dll
2008-05-28 10:32 87,352 ----a-w C:\Windows\System32\LMIinit.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A4CC8907-3EA6-49EE-8B74-D09660120910}]
2008-07-16 12:42 184816 --a----t- C:\Program Files\Google\Update\1.2.121.9\GoopdateBho.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 09:33 1233920]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 09:33 202240]
"Uniblue RegistryBooster 2"="f:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe" [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-05-02 22:46 13535776]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-05-02 22:46 92704]
"PWRISOVM.EXE"="F:\Program Files\PowerISO\PWRISOVM.EXE" [2008-03-15 01:50 233472]
"Launch LCDMon"="C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-12-13 17:43 2051096]
"Launch LGDCore"="C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-12-13 17:57 2095640]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 01:12 488984]
"LogitechQuickCamRibbon"="F:\Program Files\Logitech\QuickCam10.exe" [2007-02-08 01:13 774168]
"LogMeIn GUI"="F:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [2008-02-28 15:31 63048]
"ISTray"="F:\Program Files\Spyware Doctor\pctsTray.exe" [2008-04-10 15:14 1107848]
"avgnt"="F:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-07-19 13:17 266497]
"CTHelper"="CTHELPER.EXE" [2008-02-20 20:58 19456 C:\Windows\System32\CtHelper.exe]
"CTxfiHlp"="CTXFIHLP.EXE" [2008-02-20 20:58 19968 C:\Windows\System32\Ctxfihlp.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DevconDefaultDB"="C:\Windows\system32\READREG" [X]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"SENTINEL"= snti386.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 F:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2006-12-10 21:52 49152 F:\Program Files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-05-27 10:50 413696 F:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{6C9E2321-DE1F-436E-BC69-5ACD2A7C33BC}F:\\program files\\autodesk\\maya8.5\\bin\\maya.exe"= UDP:F:\program files\autodesk\maya8.5\bin\maya.exe:Maya
"UDP Query User{FA2F63BD-12DD-42E7-8DD3-1BD648AAA682}F:\\program files\\autodesk\\maya8.5\\bin\\maya.exe"= TCP:F:\program files\autodesk\maya8.5\bin\maya.exe:Maya
"TCP Query User{18BAC503-8D27-4454-B3E1-A5300C844998}G:\\program files\\ccp\\eve\\bin\\exefile.exe"= UDP:G:\program files\ccp\eve\bin\exefile.exe:CCP ExeFile
"UDP Query User{68ECA5FF-9729-4FF6-9609-F3FE1AF05D6C}G:\\program files\\ccp\\eve\\bin\\exefile.exe"= TCP:G:\program files\ccp\eve\bin\exefile.exe:CCP ExeFile
"{416C0A39-FCF4-4D4F-8490-896A31793307}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{F78BCA9A-8B89-46CA-B61F-54511A3B99D2}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{263AFC24-C521-4B6B-9277-6849DFC4FC20}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{1BFE4C69-A213-44FA-98F4-3CD9202D1000}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{55705C75-503B-4478-93F7-F8051B25A2ED}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{E2D4E86D-07A2-4690-B35C-B9E43BD6C706}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{78A9410F-2BAB-4C59-8392-78F00F16BE60}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{344913BF-8139-45D9-A85B-AD209AB07912}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{8DCDB31A-0EF6-4E76-913F-784DCD31AE5B}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{A1C81836-0D97-42A9-871E-9EC092CAFD23}"= C:\Program Files\Skype\Phone\Skype.exe:Skype
"TCP Query User{5A71A7B2-1F94-4BEC-9CF4-6C869185541B}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{4ED3A8FC-00B8-42A3-AF79-3973A1510932}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{6BF482DD-1556-4CBA-9258-D51EDA9ACC6D}F:\\program files\\mozilla firefox\\firefox.exe"= UDP:F:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{CB278D87-D337-4B3A-8143-B0ADD36861E0}F:\\program files\\mozilla firefox\\firefox.exe"= TCP:F:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{CE89723A-985D-418E-AA7E-D102FCC3B96B}C:\\program files\\electronic arts\\eadm\\core.exe"= UDP:C:\program files\electronic arts\eadm\core.exe:EA Download Manager
"UDP Query User{17B24BE4-332E-45E6-9380-6ADF30E78F90}C:\\program files\\electronic arts\\eadm\\core.exe"= TCP:C:\program files\electronic arts\eadm\core.exe:EA Download Manager
"{540C8967-96DF-4AEF-94E2-67422952D799}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{EE154C98-2E67-45D9-9D71-1A2E8D4A8651}"= UDP:G:\Program Files\Codemasters\GRID\GRID.exe:GRID
"{FC3893E3-AEF1-4FB3-A7A2-1AB284F574F1}"= TCP:G:\Program Files\Codemasters\GRID\GRID.exe:GRID
"TCP Query User{1D3688CE-3169-4867-94FE-55FB5F2B51D4}G:\\ut2004\\system\\ut2004.exe"= UDP:G:\ut2004\system\ut2004.exe:UT2004
"UDP Query User{2D73D964-9A1A-4FB3-8718-53F650B36AFC}G:\\ut2004\\system\\ut2004.exe"= TCP:G:\ut2004\system\ut2004.exe:UT2004
"{C6FA3035-3395-4382-8950-56829BB0B51B}"= UDP:G:\Program Files\Sierra Entertainment\World in Conflict\wic.exe:World in Conflict
"{009CCB1D-EC8A-4A13-AB6F-702357E1D65B}"= TCP:G:\Program Files\Sierra Entertainment\World in Conflict\wic.exe:World in Conflict
"{C1E73370-8573-4C3C-8304-F854AAE82523}"= UDP:G:\Program Files\Sierra Entertainment\World in Conflict\wic_online.exe:World in Conflict - Online Only
"{C8301AB8-910D-4AD5-8BE4-E82243518EE8}"= TCP:G:\Program Files\Sierra Entertainment\World in Conflict\wic_online.exe:World in Conflict - Online Only
"{97D4B3E2-0DA0-44EF-8DDC-888D9C37B298}"= UDP:G:\Program Files\Sierra Entertainment\World in Conflict\wic_ds.exe:World in Conflict - Dedicated Server
"{515589B2-C316-4421-ADB3-7B6B451DC9E9}"= TCP:G:\Program Files\Sierra Entertainment\World in Conflict\wic_ds.exe:World in Conflict - Dedicated Server
"{EAFE6CD1-F629-42E4-807A-0711040CCF1B}"= UDP:G:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty® 4 - Modern Warfare™
"{E453732F-0714-4051-9874-3772430D0C7A}"= TCP:G:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty® 4 - Modern Warfare™
"{61BC9AFF-10C6-4F12-9097-35B34FB9EB50}"= UDP:G:\Program Files\Ubisoft\Tom Clancy's Rainbow Six Vegas 2\Binaries\R6Vegas2_Game.exe:Tom Clancy's Rainbow Six Vegas 2
"{13FF2DCC-A174-4006-936D-1E30A21D5608}"= TCP:G:\Program Files\Ubisoft\Tom Clancy's Rainbow Six Vegas 2\Binaries\R6Vegas2_Game.exe:Tom Clancy's Rainbow Six Vegas 2
"{02A4908A-3E5E-4339-A027-F72AD95FF036}"= UDP:G:\Program Files\Ubisoft\Tom Clancy's Rainbow Six Vegas 2\Binaries\R6Vegas2_Launcher.exe:Tom Clancy's Rainbow Six Vegas 2 Update
"{B0F87DE1-9589-46F3-AC02-1346EEE44044}"= TCP:G:\Program Files\Ubisoft\Tom Clancy's Rainbow Six Vegas 2\Binaries\R6Vegas2_Launcher.exe:Tom Clancy's Rainbow Six Vegas 2 Update
"TCP Query User{8E9AA064-BFF4-4491-9702-BA90BB16215C}F:\\program files\\side effects software\\houdini 9.5.156\\bin\\hmaster.exe"= UDP:F:\program files\side effects software\houdini 9.5.156\bin\hmaster.exe:hmaster
"UDP Query User{6EAA0735-422D-4C95-8A0A-5EB05DADEDC8}F:\\program files\\side effects software\\houdini 9.5.156\\bin\\hmaster.exe"= TCP:F:\program files\side effects software\houdini 9.5.156\bin\hmaster.exe:hmaster
"{80111C59-06C4-4277-AEEC-19946D988BC0}"= UDP:G:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{0A4CE8F6-6A2E-46C4-A173-04E853E8C31E}"= TCP:G:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{50C2198B-4CBF-437C-96F8-27D2F0920F55}"= UDP:G:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{C95A2EBA-6A6C-431A-99F1-74C6B2B92129}"= TCP:G:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"TCP Query User{E7BDCC58-3504-4133-B9E0-C14A894423AB}F:\\program files\\hitman pro\\wget.exe"= UDP:F:\program files\hitman pro\wget.exe:wget
"UDP Query User{55A14320-FDD7-4E87-BD24-FC8A41E2ECCF}F:\\program files\\hitman pro\\wget.exe"= TCP:F:\program files\hitman pro\wget.exe:wget
"{BE2DC951-C2D5-4127-AFE4-4FB785FF7A8B}"= UDP:G:\Program Files\EA GAMES\Battlefield 2\BF2.exe:Battlefield 2
"{33D6EAA4-1456-418F-8B22-864E3B1AC46A}"= TCP:G:\Program Files\EA GAMES\Battlefield 2\BF2.exe:Battlefield 2

R2 AntiVirMailService;Avira AntiVir Premium MailGuard;F:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe [2008-07-19 13:17]
R2 antivirwebservice;Avira AntiVir Premium WebGuard;F:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE [2008-07-19 13:17]
R2 AVEService;Avira AntiVir Premium MailGuard helper service;F:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe [2008-07-19 13: