1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Windows Vista Virus

Discussion in 'Virus & Other Malware Removal' started by billybuxton, Jun 15, 2011.

Thread Status:
Not open for further replies.
Advertisement
  1. billybuxton

    billybuxton Thread Starter

    Joined:
    Jun 15, 2011
    Messages:
    22
    Hi all

    Im pretty sure i have got a virus on my computer
    sometimes the task bar at the bottom of the screen changes colour
    and my internet explorer does the same

    When i try to load a new web page just before it loads it will change to a random website

    My computer has also slowed down dramaticlly

    Any help or advive you can give me would be appreciated

    Im on a
    Acer Aspire M1610
    Vista Home Edition
    3g Ram

    I have already done scans with
    Ad-Aware
    Avast + Boot time scan
    Advanced System Care 4
    IObit Malware Fighter

    Finally i think the virus may be either
    iexplorer.exe or
    explorer.exe

    I Also Used Hijack This

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 05:37:10, on 14/06/2011
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16982)
    Boot mode: Normal
    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\System32\rundll32.exe
    C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    C:\Program Files\Real\RealPlayer\Update\realsched.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\IObit\Advanced SystemCare 4\ASCTray.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
    C:\Windows\system32\SearchFilterHost.exe
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: vShare Toolbar - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
    O2 - BHO: (no name) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - (no file)
    O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
    O3 - Toolbar: vShare Toolbar - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
    O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
    O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
    O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Real\RealPlayer\update\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [IObit Malware Fighter] "C:\Program Files\IObit\IObit Malware Fighter\IMF.exe" /autostart
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [Advanced SystemCare 4] "C:\Program Files\IObit\Advanced SystemCare 4\ASCTray.exe"
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'Default user')
    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    O4 - Global Startup: Empowering Technology Launcher.lnk = ?
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O18 - Protocol: vsharechrome - {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - C:\Program Files\vShare\vshare_toolbar.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
    O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
    O23 - Service: Advanced SystemCare Service (AdvancedSystemCareService) - IObit - C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe
    O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
    O23 - Service: IMF Service (IMFservice) - IObit - C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe
    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft Limited - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: NIHardwareService - Unknown owner - C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe (file missing)
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    --
    End of file - 6692 bytes
     
  2. Scolabar

    Scolabar Malware Specialist

    Joined:
    Apr 15, 2011
    Messages:
    289
    Hi billybuxton,

    Firstly, welcome to the TSG - Virus & Other Malware Removal Forum. :)
    My name is Scolabar, and I'll be helping you with your malware problems.
    Logs can take a while to research, so please be patient.

    I am currently working under the guidance of teachers, everything I post to you, will need to be reviewed by them.
    This additional review process can add some extra time to my responses, but hopefully not too much.
    ;)

    Please note the following important guidelines before proceeding:

    1. The instructions that will be provided are for YOUR computer and system only!
      Using these instructions on a different computer can cause damage to that computer and possibly render it inoperable
      !
    2. If you have any questions or do not understand something, please do not hesitate to ask, don't guess or assume.
    3. Only post your problem at One help site. Applying fixes from multiple help sites can cause problems.
    4. Only reply to this thread, do not start another. Please, continue responding, until I give you the All Clean.
      Absence of symptoms does not necessarily mean that everything is clear.
    5. DO NOT run any other fix or removal tools unless instructed to do so!
    6. DO NOT install any other software (or hardware) during the cleaning process. This adds more items to be researched.
    7. Print each set of instructions, if possible. Your Internet connection will not be available during some fix processes.
    8. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
    In light of this, it would be advisable for you to back up any important files and folders that you don't want to lose before we start.

    If you follow these guidelines, things should proceed smoothly. :)
    I am currently reviewing your log and will return, as soon as possible, with additional instructions.

    Thank you for your patience.

    Scolabar
     
  3. billybuxton

    billybuxton Thread Starter

    Joined:
    Jun 15, 2011
    Messages:
    22
    Thanks for taking the time to help
    its very much appriciated
     
  4. Scolabar

    Scolabar Malware Specialist

    Joined:
    Apr 15, 2011
    Messages:
    289
    Hi billybuxton,

    Thank you again for your patience. :)

    Please read these instructions carefully before executing and perform the steps, in the order given.
    lf, you have any questions about or problems with, executing these instructions, <STOP> do not proceed, post back with the question or problem before going any further.

    Before we proceed please make sure any open programs are closed.

    Step 1:
    Unsupported Operating System!

    I note that your computer is running an unsupported operating system:
    Windows Vista Home Edition with no service packs installed
    I refer you to the following topic:

    A requirement for continuing to cleanup any malware infections will be to install the service packs to bring the system fully up-to-date once the machine has been declared clean of infection.

    Step 2:
    Advisory - P2P Software Present!

    IMPORTANT There are signs of one or more P2P (Peer-to-Peer) File Sharing Programs installed on your computer.
    vShare Plugin
    P2P File Sharing Programs are used as a major conduit for spreading malware infection to computer systems these days.

    P2P programs open up access to the computer on which the program is installed. The computer's settings are more often than not changed in a manner that renders the computer insecure and access to the computer remains open even when the program is not in use. Consequently, the system's security is completely compromised.

    So be aware that it is not just what is downloaded that causes problems, just having a P2P program installed is like leaving all the doors to your house unlocked.

    I advise you take the time to read the following articles that explain the risk of installing these programs: I strongly recommend that you uninstall the P2P software as follows:

    Remove P2P Program(s)

    1. Click on Start > Control Panel and double-click on Programs and Features.
    2. Locate the following program:

      vShare Plugin
    3. Click on the Change/Remove button to uninstall it.
    4. Repeat instructions 2 and 3 for each of the programs listed.
    5. When the program(s) have been uninstalled Close the Programs and Features and Control Panel windows.
    Step 3:
    Registry Cleaners

    I see that you are using the IObit Advanced SystemCare 4 Registry Cleaner on this computer.

    I don't personally recommend the use of ANY registry cleaners.
    Here is an excerpt from a discussion on regcleaners:
    http://miekiemoes.blogspot.com/2008/02/registry-cleaners-and-system-tweaking_13.html
    http://forums.whatthetech.com/Regcleaner_t42862.html

    IOBit has a very poor reputation. See: IOBit Steals Malwarebytes' Intellectual Property
    As such, I also recommend uninstalling IObit Malware Fighter.

    In addition, Lavasoft's Ad-Aware is also deemed ineffective in today's fight against malware and so I also advise that that program is also removed.

    If you choose to do so, you can remove those programs using the instructions below:


    1. Click on Start > Control Panel and double-click on Programs and Features.
    2. Scroll down the list of installed programs and select each of the following programs:

      Ad-Aware
      IObit Advanced SystemCare 4
      IObit Malware Fighter
    3. Click on the Change/Remove button to uninstall it.
    4. Repeat insructions 2 and 3 for each of the programs listed.
    5. Close the Programs and Features and Control Panel windows when the removals have been completed.
    Step 4:
    MGA Diagnostics

    1. Please download this tool from Microsoft and Save it to your Desktop.
    2. Double-click on the MGADiag.exe icon to launch the program.
      Vista - W7 users: Right-click on MGADiag.exe and select "Run As Administrator" to launch the program. If you receive a UAC prompt, please allow it.
      If you receive an Open File Security Warning click on the Run button.
    3. Click on the Continue button to proceed.
    4. The program will now run. It will take a short while to complete its diagnosis, please be patient.
    5. When it has finished click on the Copy button.
    6. Open Notepad by clicking Start > Run, type in Notepad then click OK.
    7. Paste the copied contents into the new Notepad window and Save the file as mgadiag.txt to your Desktop.
    8. Click on the OK button to exit the MGA Diagnostics program.
    9. Then Copy and Paste the entire contents of mgadiag.txt into your next reply.
    Step 5:
    CKScanner

    1. Please download CKScanner and Save it to your Desktop.
      Make sure that CKScanner.exe is on your Desktop before running the application!
    2. Double-click on the CKScanner.exe icon to launch the program and then click on the Search For Files button.
      Vista - W7 users: Right-click on CKScanner.exe and select "Run As Administrator" to launch the program. If you receive a UAC prompt, please allow it.
    3. When the scan has finished (- the hourglass cursor will disappear when the scan has completed) click on the Save List To File button.
      A text file will be created on your desktop named ckfiles.txt.
    4. Click on the Exit button to close the program.
    5. Double-click on the ckfiles.txt file to open it.
    6. Then Copy and Paste the entire contents of the file into your next reply.
    Step 6:
    RSIT (Random's System Information Tool)

    1. Please download RSIT by random/random and save it to your Desktop.
    2. Double-click on RSIT.exe to run the program. Read the disclaimer and then click on the Continue button.
      Vista - W7 users: Right-click on RSIT.exe and select "Run As Administrator" to launch the program. If you receive a UAC prompt, please allow it.
    3. RSIT will start running.
    4. When the program has finished two logs files will automatically open in Notepad:
      • log.txt <-- Will be opened, maximized.
      • info.txt <-- Will be minimized on task bar.
    5. Please Copy and Paste the entire contents of both log.txt and info.txt files into your next reply.
      Note: These logs can be lengthy, so post 1 log per reply please.
    Step 7:
    Include in Next Post

    1. Did you have any problems carrying out the instructions?
    2. mgadiag.txt.
    3. ckfiles.txt.
    4. log.txt.
    5. info.txt.
    6. Do you have the original Windows installation media for your PC?

    Scolabar
     
  5. billybuxton

    billybuxton Thread Starter

    Joined:
    Jun 15, 2011
    Messages:
    22
    CKScanner - Additional Security Risks - These are not necessarily bad
    c:\program files\common files\native instruments\shared content\sounds\massive\crackle carl.ksd
    c:\program files\common files\native instruments\shared content\sounds\massive\digitoy crackle.ksd
    c:\program files\vstpluginsegg\vst plugins\vst effects\shapeshifter1.2\waves\standard\all\crackler.ssw
    c:\program files\waves\plug-ins\xcrackle.dll
    c:\program files\waves\plug-ins\plug-in settings\x-crackle settings.xps
    scanner sequence 3.EM.11
    ----- EOF -----
     
  6. billybuxton

    billybuxton Thread Starter

    Joined:
    Jun 15, 2011
    Messages:
    22
    info.txt logfile of random's system information tool 1.08 2011-06-16 20:07:21
    ======Uninstall list======
    Update for Microsoft Office 2007 (KB2508958)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}
    AAS - Swatches Sound Bank-->C:\Program Files\Applied Acoustics Systems\AAS Player\Uninstall Swatches.exe
    Acer Arcade Live Main Page-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}\setup.exe" -uninstall
    Acer DV Magician-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F6EFFB76-4A07-11DA-9D78-000129760D75}\setup.exe" -uninstall
    Acer DVDivine-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B145EC69-66F5-11D8-9D75-000129760D75}\setup.exe" -uninstall
    Acer HomeMedia Connect-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{132888AE-EF67-41C5-BCA2-7D5D2488AB63}\Setup.exe" -uninstall
    Acer HomeMedia-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AA4BF92B-2AAF-11DA-9D78-000129760D75}\Setup.exe" -uninstall
    Acer ScreenSaver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}\setup.exe" -l0x9 -removeonly
    Acer SlideShow DVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{41581EF5-45A7-11DA-9D78-000129760D75}\Setup.exe" -uninstall
    Acer Tour-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94389919-B0AA-4882-9BE8-9F0B004ECA35}\setup.exe" -l0x9 -removeonly
    Acer VideoMagician-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F79A208D-D929-11D9-9D77-000129760D75}\setup.exe" -uninstall
    Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
    Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\FlashUtil10l_ActiveX.exe -maintain activex
    Adobe Reader 7.0-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70000000000}
    AppCore-->MsiExec.exe /I{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}
    Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
    Artillery2 CM Edition-->C:\PROGRA~1\VSTPLU~1\SUGARB~1\ARTILL~1\UNWISE.EXE C:\PROGRA~1\VSTPLU~1\SUGARB~1\ARTILL~1\INSTALL.LOG
    ASIO4ALL-->C:\Program Files\ASIO4ALL v2\uninstall.exe
    Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"
    AV-->MsiExec.exe /I{F4DB525F-A986-4249-B98B-42A8066251CA}
    avast! Free Antivirus-->C:\Program Files\Alwil Software\Avast5\aswRunDll.exe "C:\Program Files\Alwil Software\Avast5\Setup\setiface.dll" RunSetup
    Camel Audio Alchemy-->C:\Program Files\Camel Audio\Alchemy\AlchemyUninstall.exe
    ccCommon-->MsiExec.exe /I{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}
    CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
    Elemental Audio Systems Inspector XL VST RTAS 1.0.1-->C:\PROGRA~1\VSTPLU~1\VSTPLU~2\ELEMEN~1.1-H\IXL\UNINST~1\UNWISE.EXE C:\PROGRA~1\VSTPLU~1\VSTPLU~2\ELEMEN~1.1-H\IXL\UNINST~1\INSTALL.LOG
    eSobi v2-->C:\Program Files\InstallShield Installation Information\{15D967B5-A4BE-42AE-9E84-64CD062B25AA}\setup.exe -runfromtemp -l0x0409
    FabFilter One 2.01-->C:\Program Files\FabFilter\One\Uninst.exe
    FabFilter Timeless VST RTAS v2.00-->"C:\Program Files\FabFilter\Timeless 2\Uninstall\unins000.exe"
    FabFilter TotalBundle VST RTAS v1.2-->"C:\Program Files\FabFilter\Uninstall\unins000.exe"
    Granite Demo-->"C:\Program Files\New Sonic Arts\Granite Demo\unins000.exe"
    HiJackThis-->MsiExec.exe /X{45A66726-69BC-466B-A7A4-12FCBA4883D7}
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
    IL Download Manager-->C:\Program Files\Image-Line\Downloader\uninstall.exe
    INSPECTOR-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0B5B98BE-B1A3-4AB4-A05E-B190E1FBA625}\Setup.exe" -l0x9
    K-Lite Codec Pack 6.5.0 (Basic)-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
    LAME v3.98.3 for Audacity-->"C:\Program Files\Lame For Audacity\unins000.exe"
    MagicDisc 2.7.106-->C:\PROGRA~1\MAGICD~1\UNWISE.EXE C:\PROGRA~1\MAGICD~1\INSTALL.LOG
    MeldaProduction MHarmonizerCM-->C:/Program Files/MeldaProduction/MHarmonizerCM/setup.exe
    Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
    Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
    Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
    Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
    Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
    Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
    Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
    Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
    Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
    Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
    Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
    Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
    Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
    Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
    Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
    Microsoft Visual C++ 2005 Redistributable - KB2467175-->MsiExec.exe /X{a0fe116e-9a8a-466f-aee0-625cb7c207e3}
    Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
    Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570-->MsiExec.exe /X{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
    Microsoft Visual C++ Run Time Lib Setup-->MsiExec.exe /X{AAF4238F-7C29-451D-9925-C753271A5728}
    Microsoft Works-->MsiExec.exe /I{6D52C408-B09A-4520-9B18-475B81D393F1}
    Minimal System Instruments Moogi Analogue Filter VST v2.50-->"C:\Program Files\Minimal System Instruments\Moogi\uninstall\unins000.exe"
    Miroslav Philharmonik-->C:\Program Files\InstallShield Installation Information\{BA0D0121-A3BA-487D-9C78-7AB0E676C722}\setup.exe -runfromtemp -l0x0009 uninstall -removeonly
    MixMeister BPM Analyzer 1.0-->"C:\Program Files\MixMeister BPM Analyzer\unins000.exe"
    MSRedist-->MsiExec.exe /I{B7C61755-DB48-4003-948F-3D34DB8EAF69}
    MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
    MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
    Native Instruments Massive-->"C:\ProgramData\{9162AE45-CC6F-42F1-BE92-73B32408698D}\Massive Setup PC.exe" REMOVE=TRUE MODIFY=FALSE
    Native Instruments Massive-->C:\ProgramData\{9162AE45-CC6F-42F1-BE92-73B32408698D}\Massive Setup PC.exe
    Native Instruments Reaktor 5-->"C:\ProgramData\{E6F7E8AE-5D26-4508-A961-B0231A24CCAE}\Reaktor 5 Setup PC.exe" REMOVE=TRUE MODIFY=FALSE
    Native Instruments Reaktor 5-->C:\ProgramData\{E6F7E8AE-5D26-4508-A961-B0231A24CCAE}\Reaktor 5 Setup PC.exe
    Native Instruments Service Center-->"C:\ProgramData\{A6DB2A6F-FF9D-453F-99D6-C1AA54BC0C14}\Service Center Setup PC.exe" REMOVE=TRUE MODIFY=FALSE
    Native Instruments Service Center-->C:\ProgramData\{A6DB2A6F-FF9D-453F-99D6-C1AA54BC0C14}\Service Center Setup PC.exe
    NETGEAR WPN111 Smart Wizard Wireless Utility-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{582E9125-32B6-4CBA-AB48-3E33CE3DB389}\Setup.exe"
    Norton AntiVirus-->MsiExec.exe /X{830D8CBD-C668-49e2-A969-C2C2106332E0}
    Norton Confidential Browser Component-->MsiExec.exe /I{4843B611-8FCB-4428-8C23-31D0A5EAE164}
    Norton Confidential Web Protection Component-->MsiExec.exe /I{D353CC51-430D-4C6F-9B7E-52003DA1E05A}
    Norton Internet Security (Symantec Corporation)-->"C:\Program Files\Common Files\Symantec Shared\SymSetup\{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}_10_1_0_26\{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}.exe" /X
    Norton Internet Security-->MsiExec.exe /I{3672B097-EA69-4bfe-B92F-29AE6D9D2B34}
    Norton Internet Security-->MsiExec.exe /I{48185814-A224-447A-81DA-71BD20580E1B}
    Norton Internet Security-->MsiExec.exe /I{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}
    Norton Internet Security-->MsiExec.exe /I{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}
    Norton Internet Security-->MsiExec.exe /I{E5EE9939-259F-4DE2-8023-5C49E16A4F43}
    Norton Protection Center-->MsiExec.exe /I{9A129ABC-A53A-4209-A21E-D5DEDFB7CCA8}
    NTI Backup NOW! 4.7-->"C:\Program Files\InstallShield Installation Information\{67ADE9AF-5CD9-4089-8825-55DE4B366799}\setup.exe" -removeonly
    NTI CD & DVD-Maker-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2} /l1033 CDM7
    NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI
    Ohm Force - Mobilohm VST2-->C:\Windows\unvise32.exe i:\vst plugins\ohm force\Ohm Force\Mobilohm VST2\uninstal.log
    Ohm Force - Ohmicide VST-->C:\Windows\unvise32.exe i:\vst plugins\Ohm Force\Ohmicide VST\uninstal.log
    Ohm Force - Quad Frohmage VST2-->C:\Windows\unvise32.exe i:\vst plugins\ohm force\Ohm Force\Quad Frohmage VST2\uninstal.log
    OhmForce Hematohm VST2-->C:\Windows\unvise32.exe i:\vst plugins\ohm force\Ohm Force\Hematohm VST2\uninstal.log
    OhmForce Ohmboyz VST2-->C:\Windows\unvise32.exe i:\vst plugins\ohm force\Ohm Force\Ohmboyz VST2\uninstal.log
    OhmForce Ohmygod VST2-->C:\Windows\unvise32.exe C:\PROGRAM FILES\VSTPLUGINS\VST PLUGINS\VST EFFECTS\OHMYGOD!\Ohm Force\Ohmygod VST2\uninstal.log
    OhmForce Predatohm VST2-->C:\Windows\unvise32.exe i:\vst plugins\Ohm Force\Predatohm VST2\uninstal.log
    PSP VintageWarmer2 2.5.1 32bit-->"C:\Program Files\PSPaudioware\PSP VintageWarmer2\uninstall.exe" "/U:C:\Program Files\PSPaudioware\PSP VintageWarmer2\irunin.xml"
    QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
    RealNetworks - Microsoft Visual C++ 2008 Runtime-->MsiExec.exe /X{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}
    RealPlayer-->C:\Program Files\Real\RealPlayer\Update\r1puninst.exe RealNetworks|RealPlayer|12.0
    Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe" -l0x9 -removeonly
    RealUpgrade 1.1-->MsiExec.exe /I{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}
    Roger Nichols Digital SIGNATURE Bundle VST RTAS v1.9.3-->"C:\Program Files\RNDigital\Uninstall\unins000.exe"
    Schaack Audio Technologies Transient Shaper VST v2.04-->"C:\Program Files\Schaack Audio\Transient Shaper\uninstall\unins000.exe"
    Security Update for 2007 Microsoft Office System (KB2288621)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5C497F0B-2061-4CC9-A61C-6B45B867354D}
    Security Update for 2007 Microsoft Office System (KB2288931)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {CD769337-C8AC-46DB-A7DC-643E50089263}
    Security Update for 2007 Microsoft Office System (KB2345043)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {536FB502-775F-4494-BACE-C02CC90B7A5B}
    Security Update for 2007 Microsoft Office System (KB2466156)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {CEF209AB-F96D-404F-B5CC-44057C057CA3}
    Security Update for 2007 Microsoft Office System (KB2509488)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {AD0DE453-0804-4495-9C91-33D0F9AA5463}
    Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
    Security Update for 2007 Microsoft Office System (KB976321)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7F207DCA-3399-40CB-A968-6E5991B1421A}
    Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
    Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
    Security Update for Microsoft Office Excel 2007 (KB2464583)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {151E2FEA-C3A6-4CB6-BE6B-16651FDF04BE}
    Security Update for Microsoft Office InfoPath 2007 (KB979441)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {8CCB781A-CF6B-4FCB-B6D8-59C64DF5C6DB}
    Security Update for Microsoft Office PowerPoint 2007 (KB2464594)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {E6B7C11E-21E9-4BA0-9677-29AD603B953C}
    Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {D75E6D0C-BADF-4F41-98B2-0C0F02C15062}
    Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
    Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
    Security Update for Microsoft Office Word 2007 (KB2344993)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7A5B74FA-7A92-4FC9-821A-2DD5D4E73E48}
    Sonnox Oxford R3 Dynamics Native VST v1.3.1-->"C:\Program Files\Sonnox\Uninstall\Sonnox Oxford R3 Dynamics Native VST\unins000.exe"
    Sony Noise Reduction Plug-In 2.0h-->MsiExec.exe /X{06A1BE8A-4CA4-4A39-B9E4-E815AA8FE05C}
    Sound Forge Pro 10.0-->MsiExec.exe /X{3F9170C9-A7C2-408F-A4D8-EC77250040BF}
    SPBBC 32bit-->MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
    Symantec Real Time Storage Protection Component-->MsiExec.exe /I{D6E6FA4A-5445-4850-8365-CF216C1CBB7A}
    SymNet-->MsiExec.exe /I{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}
    T-RackS 3 Deluxe-->C:\Program Files\InstallShield Installation Information\{423C4130-EBC3-410A-B3A0-37BBF9D607D5}\setup.exe -runfromtemp -l0x0009 uninstall -removeonly
    Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
    Update for Microsoft Office 2007 Help for Common Features (KB963673)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {AB365889-0395-4FAD-B702-CA5985D53D42}
    Update for Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {199DF7B6-169C-448C-B511-1054101BE9C9}
    Update for Microsoft Office OneNote 2007 (KB980729)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {329050A9-EF80-40F9-B633-74508F54C1FF}
    Update for Microsoft Office OneNote 2007 Help (KB963670)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2744EF05-38E1-4D5D-B333-E021EDAEA245}
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {397B1D4F-ED7B-4ACA-A637-43B670843876}
    Update for Microsoft Office Script Editor Help (KB963671)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {CD11C6A2-FFC6-4271-8EAB-79C3582F505C}
    Update for Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {80E762AA-C921-4839-9D7D-DB62A72C0726}
    URS Classic Console EQ Bundle VST Native-->"C:\Windows\URS Classic Console EQ Bundle VST Native\uninstall.exe" "/U:C:\Program Files\URS\Uninstall\uninstall.xml"
    VideoLAN VLC media player 0.8.6i-->C:\Program Files\VideoLAN\VLC\uninstall.exe
    Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
    Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\Windows\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
    Waves Diamond Bundle v5.0-->C:\PROGRA~1\Waves\UNINST~1\UNWISE.EXE C:\PROGRA~1\Waves\UNINST~1\INSTALL.LOG
    WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
    WOK XPhaser v1.0-->"C:\Program Files\WOK\XPhaser\uninstall\unins000.exe"
    ======Security center information======
    AV: avast! Antivirus
    AV: Norton Internet Security (outdated)
    FW: Norton Internet Security
    AS: Windows Defender
    AS: Norton Internet Security (outdated)
    AS: avast! Antivirus
    ======System event log======
    Computer Name: a-PC
    Event Code: 10016
    Message: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
    {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
    to the user a-PC\a SID (S-1-5-21-3158728496-2265304785-4267199015-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
    Record Number: 130172
    Source Name: Microsoft-Windows-DistributedCOM
    Time Written: 20110616155312.000000-000
    Event Type: Error
    User: a-PC\a
    Computer Name: a-PC
    Event Code: 7034
    Message: The Advanced SystemCare Service service terminated unexpectedly. It has done this 1 time(s).
    Record Number: 130179
    Source Name: Service Control Manager
    Time Written: 20110616155919.000000-000
    Event Type: Error
    User:
    Computer Name: a-PC
    Event Code: 7011
    Message: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the avast! Antivirus service.
    Record Number: 130184
    Source Name: Service Control Manager
    Time Written: 20110616161501.000000-000
    Event Type: Error
    User:
    Computer Name: a-PC
    Event Code: 3004
    Message: Windows Defender Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. Windows Defender can't undo changes that you allow.
    For more information please see the following:
    Not Applicable
    Scan ID: {4CED8922-A68A-48CC-BE83-C8740BBD7F8B}
    User: a-PC\a
    Name: Unknown
    ID:
    Severity ID:
    Category ID:
    Path Found: service:avastTestService
    Alert Type: Unclassified software
    Detection Type:
    Record Number: 130191
    Source Name: Microsoft-Windows-Windows Defender
    Time Written: 20110616163238.000000-000
    Event Type: Warning
    User:
    Computer Name: a-PC
    Event Code: 3004
    Message: Windows Defender Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. Windows Defender can't undo changes that you allow.
    For more information please see the following:
    Not Applicable
    Scan ID: {B1D30F0D-96E5-41A7-B2B9-3F61DF0CA429}
    User: a-PC\a
    Name: Unknown
    ID:
    Severity ID:
    Category ID:
    Path Found: driver:avastTestService
    Alert Type: Unclassified software
    Detection Type:
    Record Number: 130192
    Source Name: Microsoft-Windows-Windows Defender
    Time Written: 20110616163238.000000-000
    Event Type: Warning
    User:
    =====Application event log=====
    Computer Name: a-PC
    Event Code: 1000
    Message: Faulting application svchost.exe, version 6.0.6000.16386, time stamp 0x4549adc4, faulting module ntdll.dll, version 6.0.6000.16386, time stamp 0x4549bdc9, exception code 0xc000071b, fault offset 0x0008ac88, process id 0x16f8, application start time 0x01cc2c1a27127776.
    Record Number: 13883
    Source Name: Application Error
    Time Written: 20110616180022.000000-000
    Event Type: Error
    User:
    Computer Name: a-PC
    Event Code: 502
    Message: Certificate Services Client failed to register Group Policy notifications. Error code: 2147944153.
    Record Number: 13885
    Source Name: Microsoft-Windows-CertificateServicesClient
    Time Written: 20110616180554.371225-000
    Event Type: Warning
    User: a-PC\a
    Computer Name: a-PC
    Event Code: 502
    Message: Certificate Services Client failed to register Group Policy notifications. Error code: 2147944153.
    Record Number: 13886
    Source Name: Microsoft-Windows-CertificateServicesClient
    Time Written: 20110616180554.371225-000
    Event Type: Warning
    User: a-PC\a
    Computer Name: a-PC
    Event Code: 1000
    Message: Faulting application svchost.exe, version 6.0.6000.16386, time stamp 0x4549adc4, faulting module ntdll.dll, version 6.0.6000.16386, time stamp 0x4549bdc9, exception code 0xc000071b, fault offset 0x0008ac88, process id 0x3d30, application start time 0x01cc2c500472ed1e.
    Record Number: 13895
    Source Name: Application Error
    Time Written: 20110616182550.000000-000
    Event Type: Error
    User:
    Computer Name: a-PC
    Event Code: 6001
    Message: The winlogon notification subscriber <Sens> failed a notification event.
    Record Number: 13904
    Source Name: Microsoft-Windows-Winlogon
    Time Written: 20110616185524.000000-000
    Event Type: Warning
    User:
    =====Security event log=====
    Computer Name: a-PC
    Event Code: 4634
    Message: An account was logged off.
    Subject:
    Security ID: S-1-5-7
    Account Name: ANONYMOUS LOGON
    Account Domain: NT AUTHORITY
    Logon ID: 0xb17b67
    Logon Type: 3
    This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
    Record Number: 31927
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20110616182615.758225-000
    Event Type: Audit Success
    User:
    Computer Name: a-PC
    Event Code: 4648
    Message: A logon was attempted using explicit credentials.
    Subject:
    Security ID: S-1-5-18
    Account Name: A-PC$
    Account Domain: WORKGROUP
    Logon ID: 0x3e7
    Logon GUID: {00000000-0000-0000-0000-000000000000}
    Account Whose Credentials Were Used:
    Account Name: SYSTEM
    Account Domain: NT AUTHORITY
    Logon GUID: {00000000-0000-0000-0000-000000000000}
    Target Server:
    Target Server Name: localhost
    Additional Information: localhost
    Process Information:
    Process ID: 0x298
    Process Name: C:\Windows\System32\services.exe
    Network Information:
    Network Address: -
    Port: -
    This event is generated when a process attempts to log on an account by explicitly specifying that account&#8217;s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
    Record Number: 31928
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20110616182715.896225-000
    Event Type: Audit Success
    User:
    Computer Name: a-PC
    Event Code: 4624
    Message: An account was successfully logged on.
    Subject:
    Security ID: S-1-5-18
    Account Name: A-PC$
    Account Domain: WORKGROUP
    Logon ID: 0x3e7
    Logon Type: 5
    New Logon:
    Security ID: S-1-5-18
    Account Name: SYSTEM
    Account Domain: NT AUTHORITY
    Logon ID: 0x3e7
    Logon GUID: {00000000-0000-0000-0000-000000000000}
    Process Information:
    Process ID: 0x298
    Process Name: C:\Windows\System32\services.exe
    Network Information:
    Workstation Name:
    Source Network Address: -
    Source Port: -
    Detailed Authentication Information:
    Logon Process: Advapi
    Authentication Package: Negotiate
    Transited Services: -
    Package Name (NTLM only): -
    Key Length: 0
    This event is generated when a logon session is created. It is generated on the computer that was accessed.
    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
    The authentication information fields provide detailed information about this specific logon request.
    - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
    - Transited services indicate which intermediate services have participated in this logon request.
    - Package name indicates which sub-protocol was used among the NTLM protocols.
    - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
    Record Number: 31929
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20110616182715.896225-000
    Event Type: Audit Success
    User:
    Computer Name: a-PC
    Event Code: 4672
    Message: Special privileges assigned to new logon.
    Subject:
    Security ID: S-1-5-18
    Account Name: SYSTEM
    Account Domain: NT AUTHORITY
    Logon ID: 0x3e7
    Privileges: SeAssignPrimaryTokenPrivilege
    SeTcbPrivilege
    SeSecurityPrivilege
    SeTakeOwnershipPrivilege
    SeLoadDriverPrivilege
    SeBackupPrivilege
    SeRestorePrivilege
    SeDebugPrivilege
    SeAuditPrivilege
    SeSystemEnvironmentPrivilege
    SeImpersonatePrivilege
    Record Number: 31930
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20110616182715.896225-000
    Event Type: Audit Success
    User:
    Computer Name: a-PC
    Event Code: 5032
    Message: Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.
    Error Code: 2
    Record Number: 31931
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20110616190518.507625-000
    Event Type: Audit Failure
    User:
    ======Environment variables======
    "ComSpec"=%SystemRoot%\system32\cmd.exe
    "FP_NO_HOST_CHECK"=NO
    "OS"=Windows_NT
    "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Common Files\iZotope\Runtimes;C:\Program Files\QuickTime\QTSystem\
    "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
    "PROCESSOR_ARCHITECTURE"=x86
    "TEMP"=%SystemRoot%\TEMP
    "TMP"=%SystemRoot%\TEMP
    "USERNAME"=SYSTEM
    "windir"=%SystemRoot%
    "PROCESSOR_LEVEL"=6
    "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 2, GenuineIntel
    "PROCESSOR_REVISION"=0f02
    "NUMBER_OF_PROCESSORS"=2
    "CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
    "QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip
    "KMP_DUPLICATE_LIB_OK"=TRUE
    -----------------EOF-----------------
     
  7. billybuxton

    billybuxton Thread Starter

    Joined:
    Jun 15, 2011
    Messages:
    22
    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
    Validation Status: Genuine
    Validation Code: 0
    Cached Online Validation Code: N/A, hr = 0xc004f012
    Windows Product Key: *****-*****-XY9X3-JDXYP-6CJ97
    Windows Product Key Hash: xFQJU8srKsovk6p1Lk1yW93in4E=
    Windows Product ID: 89578-OEM-7332157-00211
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.0.6000.2.00010300.0.0.003
    ID: {606FDCB5-E65D-4FC1-9DDD-AF46C0EEF22A}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows Vista (TM) Home Premium
    Architecture: 0x00000000
    Build lab: 6000.vista_gdr.100218-0019
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A
    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002
    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002
    OGA Data-->
    Office Status: 102
    Microsoft Office Home and Student 2007 - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 77F760FE-153-80070002_7E90FEE8-175-80070002_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_B4D0AA8B-920-80070057
    Browser Data-->
    Proxy settings:
    User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
    Default Browser: C:\Program Files\Internet Explorer\IEXPLORE.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed
    File Scan Data-->
    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{606FDCB5-E65D-4FC1-9DDD-AF46C0EEF22A}</UGUID><Version>1.9.0027.0</Version><OS>6.0.6000.2.00010300.0.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-6CJ97</PKey><PID>89578-OEM-7332157-00211</PID><PIDType>2</PIDType><SID>S-1-5-21-3158728496-2265304785-4267199015</SID><SYSTEM><Manufacturer>Acer </Manufacturer><Model>Aspire M1610</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies, LTD</Manufacturer><Version>R01-A4</Version><SMBIOSVersion major="2" minor="4"/><Date>20070920000000.000000+000</Date></BIOS><HWID>C3313507018400FA</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>102</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><PidType>19</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>
    Spsys.log Content: 0x80070002
    Licensing Data-->
    Software licensing service version: 6.0.6000.16509
    Name: Windows(TM) Vista, HomePremium edition
    Description: Windows Operating System - Vista, OEM_SLP channel
    Activation ID: bffdc375-bbd5-499d-8ef1-4f37b61c895f
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 89578-00146-321-500211-02-1033-6000.0000-3502010
    Installation ID: 261851856131130926759326580686693101335241868434184675
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkId=57201
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkId=57203
    Use License URL: http://go.microsoft.com/fwlink/?LinkId=57205
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkId=57204
    Partial Product Key: 6CJ97
    License Status: Licensed
    Windows Activation Technologies-->
    N/A
    HWID Data-->
    HWID Hash Current: OgAAAAIABAABAAEAAgACAAAAAgABAAEAeqh+V9pqFT90HxqcvsEAoqSkCjvy9Hf24DhVeKxWN08qhQ==
    OEM Activation 1.0 Data-->
    N/A
    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20000
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
    ACPI Table Name OEMID Value OEMTableID Value
    APIC ACRSYS ACRPRDCT
    FACP ACRSYS ACRPRDCT
    HPET ACRSYS ACRPRDCT
    MCFG ACRSYS ACRPRDCT
    SLIC ACRSYS ACRPRDCT
    _WDT ACRSYS ACRPRDCT
    SSDT PmRef Cpu0Ist
    SSDT PmRef Cpu0Ist
     
  8. billybuxton

    billybuxton Thread Starter

    Joined:
    Jun 15, 2011
    Messages:
    22
    Logfile of random's system information tool 1.08 (written by random/random)
    Run by a at 2011-06-16 20:18:33
    Microsoft® Windows Vista&#8482; Home Premium
    System drive C: has 14 GB (20%) free of 71 GB
    Total RAM: 3071 MB (58% free)
    HijackThis download failed
    ======Scheduled tasks folder======
    C:\Windows\tasks\Ad-Aware Update (Weekly).job
    C:\Windows\tasks\Norton Internet Security - Run Full System Scan - a.job
    C:\Windows\tasks\User_Feed_Synchronization-{1D64C5CF-D827-419C-97D4-BFB3FEEEF77B}.job
    ======Registry dump======
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}]
    c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll [2006-11-21 96984]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
    RealPlayer Download and Record Plugin for Internet Explorer - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2011-02-13 381656]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96}]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {90222687-F593-4738-B738-FBEE9C7B26DF} - Show Norton Toolbar - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll [2006-11-21 565960]
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2007-09-14 1006264]
    "NvSvc"=C:\Windows\system32\nvsvc.dll [2007-07-06 86016]
    "NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2007-07-06 8466432]
    "NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2007-07-06 81920]
    "eRecoveryService"=C:\Acer\Empowering Technology\eRecovery\eRAgent.exe [2007-02-09 397312]
    "WarReg_PopUp"=C:\Acer\WR_PopUp\WarReg_PopUp.exe [2006-11-06 57344]
    "Acer Tour Reminder"=C:\Acer\AcerTour\Reminder.exe [2007-05-22 151552]
    "avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2011-01-13 3396624]
    "TkBellExe"=C:\Program Files\Real\RealPlayer\update\realsched.exe [2011-02-13 273544]
    "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-12-22 1232896]
    "ehTray.exe"=C:\Windows\ehome\ehTray.exe [2006-11-02 125440]
    "Acer Tour Reminder"= []
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
    c:\Program Files\Common Files\Symantec Shared\ccApp.exe [2006-11-21 107112]
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]
    c:\Program Files\Norton Internet Security\osCheck.exe [2006-11-21 22696]
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMMediaSharing]
    C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe [2007-06-22 204908]
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
    C:\Windows\RtHDVCpl.exe [2007-06-20 4493312]
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    C:\Program Files\Real\RealPlayer\update\realsched.exe [2011-02-13 273544]
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [2004-12-14 29696]
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^NETGEAR WPN111 Smart Wizard.lnk]
    C:\PROGRA~1\NETGEAR\WPN111~1\wpn111.exe [2005-01-25 491606]
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^a^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MagicDisc.lnk]
    C:\PROGRA~1\MAGICD~1\MAGICD~1.EXE [2009-02-24 576000]
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe
    C:\Users\a\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\permham]
    C:\Windows\system32\config\system [2011-06-16 27262976]
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "EnableLUA"=0
    "dontdisplaylastusername"=0
    "legalnoticecaption"=
    "legalnoticetext"=
    "shutdownwithoutlogon"=1
    "undockwithoutlogon"=1
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    ======File associations======
    .reg - open - "regedit.exe" "%1"
    ======List of files/folders created in the last 3 months======
    2011-06-16 20:07:19 ----D---- C:\rsit
    2011-06-16 17:05:20 ----D---- C:\MGADiagToolOutput
    2011-06-16 17:02:46 ----D---- C:\ProgramData\Office Genuine Advantage
    2011-06-16 16:55:50 ----SHD---- C:\Config.Msi
    2011-06-16 12:25:31 ----D---- C:\Users\a\AppData\Roaming\New Sonic Arts
    2011-06-16 12:25:21 ----D---- C:\ProgramData\New Sonic Arts
    2011-06-16 12:25:21 ----D---- C:\Program Files\New Sonic Arts
    2011-06-15 04:02:00 ----D---- C:\Users\a\AppData\Roaming\MeldaProduction MWaveShaper
    2011-06-14 05:24:42 ----D---- C:\Program Files\Trend Micro
    2011-06-14 04:49:25 ----ASH---- C:\hiberfil.sys
    2011-06-14 04:21:57 ----A---- C:\Windows\ntbtlog.txt
    2011-06-13 20:16:22 ----D---- C:\ProgramData\IObit
    2011-06-13 05:17:07 ----D---- C:\Program Files\Camel Audio
    2011-06-13 04:34:52 ----D---- C:\Program Files\Alchemy Player CM
    2011-06-12 14:36:28 ----D---- C:\Users\a\AppData\Roaming\IObit
    2011-06-12 14:36:26 ----D---- C:\Program Files\IObit
    2011-06-12 13:45:16 ----D---- C:\Program Files\McAfee Security Scan
    2011-06-12 13:45:14 ----D---- C:\ProgramData\McAfee
    2011-06-12 10:25:26 ----D---- C:\Users\a\AppData\Roaming\SUPERAntiSpyware.com
    2011-06-12 10:25:21 ----D---- C:\Program Files\SUPERAntiSpyware
    2011-06-11 11:11:39 ----D---- C:\Program Files\InterActual
    2011-06-11 11:00:07 ----D---- C:\ProgramData\Spybot - Search & Destroy
    2011-06-11 11:00:07 ----D---- C:\Program Files\Spybot - Search & Destroy
    2011-06-11 10:51:12 ----D---- C:\ProgramData\SUPERAntiSpyware.com
    2011-06-09 08:36:27 ----D---- C:\ProgramData\SpeedyPC
    2011-06-09 08:36:27 ----D---- C:\Program Files\SpeedyPC
    2011-06-09 08:10:04 ----D---- C:\Users\a\AppData\Roaming\Malwarebytes
    2011-06-09 08:09:59 ----D---- C:\ProgramData\Malwarebytes
    2011-06-09 08:09:56 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
    2011-06-09 00:56:15 ----D---- C:\Users\a\AppData\Roaming\MeldaProduction MAutopan
    2011-06-08 05:31:52 ----D---- C:\ProgramData\iCoolsoft Studio
    2011-06-08 05:31:42 ----D---- C:\Program Files\iCoolsoft Studio
    2011-06-08 04:46:06 ----D---- C:\Users\a\AppData\Roaming\DVDVideoSoft
    2011-06-08 04:46:04 ----D---- C:\Program Files\DVDVideoSoft
    2011-06-08 04:46:04 ----D---- C:\Program Files\Common Files\DVDVideoSoft
    2011-06-08 04:06:16 ----D---- C:\Users\a\AppData\Roaming\Apowersoft
    2011-06-03 10:44:55 ----D---- C:\Program Files\Minimal System Instruments
    2011-05-22 13:58:40 ----D---- C:\Program Files\Lame For Audacity
    2011-05-17 17:35:36 ----D---- C:\Program Files\WOK
    2011-05-15 20:38:43 ----D---- C:\Program Files\Common Files\Apple
    2011-05-15 20:38:32 ----D---- C:\ProgramData\Apple Computer
    2011-05-15 20:38:32 ----D---- C:\Program Files\QuickTime
    2011-05-15 20:37:46 ----D---- C:\ProgramData\Apple
    2011-05-15 20:37:46 ----D---- C:\Program Files\Apple Software Update
    2011-05-14 00:04:17 ----D---- C:\Program Files\Image-Line
    2011-05-12 22:47:15 ----HDC---- C:\ProgramData\{E6F7E8AE-5D26-4508-A961-B0231A24CCAE}
    2011-05-03 14:09:56 ----D---- C:\Program Files\Mozilla Firefox
    2011-05-02 23:07:51 ----D---- C:\Users\a\AppData\Roaming\MeldaProduction MPhaser
    2011-04-25 23:56:48 ----D---- C:\Program Files\CCleaner
    2011-04-24 17:26:43 ----D---- C:\Program Files\Sonnox
    2011-04-21 23:43:46 ----RASH---- C:\MSDOS.SYS
    2011-04-21 23:43:46 ----RASH---- C:\IO.SYS
    2011-04-20 19:30:19 ----D---- C:\Program Files\PSPaudioware
    2011-04-20 19:29:29 ----A---- C:\Windows\system32\PSP VintageWarmer2.dll
    2011-04-20 19:29:29 ----A---- C:\Windows\system32\PSP MicroWarmer.dll
    2011-04-20 19:29:28 ----A---- C:\Windows\system32\PSP VintageWarmer.dll
    2011-04-18 22:11:33 ----D---- C:\04c387722ee496241ee1019193
    2011-04-11 15:03:31 ----D---- C:\ProgramData\Steinberg
    2011-04-08 02:35:52 ----D---- C:\Program Files\MixMeister BPM Analyzer
    2011-04-04 14:53:11 ----D---- C:\Program Files\URS
    2011-04-04 14:53:03 ----D---- C:\Windows\URS Classic Console EQ Bundle VST Native
    2011-04-04 14:53:03 ----D---- C:\Program Files\Steinberg
    2011-03-19 20:48:38 ----D---- C:\Program Files\IK Multimedia
    2011-03-19 20:37:52 ----A---- C:\Windows\system32\msvcsv60.dll
    ======List of files/folders modified in the last 3 months======
    2011-06-16 20:18:31 ----D---- C:\Windows\Temp
    2011-06-16 20:11:20 ----RD---- C:\Program Files
    2011-06-16 20:07:19 ----D---- C:\Windows\Prefetch
    2011-06-16 19:57:05 ----D---- C:\Program Files\Reason 5
    2011-06-16 19:32:25 ----D---- C:\Windows\System32
    2011-06-16 19:32:25 ----D---- C:\Windows\inf
    2011-06-16 19:32:25 ----A---- C:\Windows\system32\PerfStringBackup.INI
    2011-06-16 17:02:46 ----HD---- C:\ProgramData
    2011-06-16 16:55:51 ----SHD---- C:\Windows\Installer
    2011-06-16 16:55:51 ----HDC---- C:\ProgramData\~0
    2011-06-16 16:55:45 ----DC---- C:\Windows\system32\DRVSTORE
    2011-06-16 16:55:45 ----D---- C:\Windows\system32\drivers
    2011-06-16 16:55:45 ----D---- C:\ProgramData\Lavasoft
    2011-06-16 16:51:39 ----D---- C:\Windows
    2011-06-16 12:21:08 ----D---- C:\Windows\Tasks
    2011-06-16 03:08:14 ----D---- C:\Windows\Minidump
    2011-06-14 19:53:06 ----SHD---- C:\System Volume Information
    2011-06-14 06:09:57 ----SD---- C:\Users\a\AppData\Roaming\Microsoft
    2011-06-13 05:16:59 ----D---- C:\Program Files\VstPlugins
    2011-06-13 05:15:55 ----D---- C:\Windows\system32\Tasks
    2011-06-13 01:28:39 ----D---- C:\Program Files\MagicDisc
    2011-06-12 17:52:01 ----D---- C:\Windows\system32\catroot2
    2011-06-12 17:50:36 ----D---- C:\Windows\system32\wbem
    2011-06-12 17:49:53 ----D---- C:\Windows\system32\config
    2011-06-12 17:49:33 ----D---- C:\Windows\system32\spool
    2011-06-12 17:49:33 ----D---- C:\Windows\system32\LogFiles
    2011-06-12 17:49:33 ----D---- C:\Windows\system32\drivers\etc
    2011-06-12 17:49:33 ----D---- C:\Windows\system32\CodeIntegrity
    2011-06-12 17:49:31 ----HD---- C:\Program Files\InstallShield Installation Information
    2011-06-12 17:49:26 ----D---- C:\Windows\registration
    2011-06-12 17:02:02 ----D---- C:\Program Files\Yahoo!
    2011-06-12 17:02:02 ----D---- C:\Program Files\Windows Media Player
    2011-06-12 04:28:57 ----D---- C:\Program Files\SPL Plug-Ins
    2011-06-11 08:50:40 ----RD---- C:\Windows\Offline Web Pages
    2011-06-09 14:06:07 ----D---- C:\ProgramData\Adobe
    2011-06-08 04:46:04 ----D---- C:\Program Files\Common Files
    2011-05-24 19:14:10 ----N---- C:\Windows\system32\MpSigStub.exe
    2011-05-15 20:39:27 ----D---- C:\Program Files\Internet Explorer
    2011-05-12 22:46:56 ----D---- C:\Program Files\Native Instruments
    2011-05-12 22:46:56 ----D---- C:\Program Files\Common Files\Native Instruments
    2011-05-12 19:24:37 ----HD---- C:\Program Files\Uninstall Information
    2011-05-02 12:28:51 ----D---- C:\Program Files\Microsoft Silverlight
    2011-04-26 00:01:01 ----D---- C:\Windows\Debug
    2011-04-19 00:29:50 ----D---- C:\Windows\winsxs
    2011-04-19 00:29:50 ----D---- C:\Windows\system32\en-US
    2011-04-19 00:29:50 ----D---- C:\Windows\system32\drivers\UMDF
    2011-04-19 00:29:43 ----D---- C:\Program Files\Windows Collaboration
    2011-04-19 00:26:56 ----D---- C:\Windows\tapi
    2011-04-19 00:26:56 ----D---- C:\Windows\system32\zh-TW
    2011-04-19 00:26:56 ----D---- C:\Windows\system32\zh-CN
    2011-04-19 00:26:56 ----D---- C:\Windows\system32\tr-TR
    2011-04-19 00:26:55 ----D---- C:\Windows\system32\sysprep
    2011-04-19 00:26:55 ----D---- C:\Windows\system32\sv-SE
    2011-04-19 00:26:55 ----D---- C:\Windows\system32\setup
    2011-04-19 00:26:55 ----D---- C:\Windows\system32\ru-RU
    2011-04-19 00:26:55 ----D---- C:\Windows\system32\RTCOM
    2011-04-19 00:26:55 ----D---- C:\Windows\system32\ro-RO
    2011-04-19 00:26:55 ----D---- C:\Windows\system32\pt-PT
    2011-04-19 00:26:55 ----D---- C:\Windows\system32\pt-BR
    2011-04-19 00:26:54 ----D---- C:\Windows\system32\pl-PL
    2011-04-19 00:26:54 ----D---- C:\Windows\system32\oobe
    2011-04-19 00:26:54 ----D---- C:\Windows\system32\nl-NL
    2011-04-19 00:26:54 ----D---- C:\Windows\system32\nb-NO
    2011-04-19 00:26:54 ----D---- C:\Windows\system32\migwiz
    2011-04-19 00:26:53 ----D---- C:\Windows\system32\migration
    2011-04-19 00:26:53 ----D---- C:\Windows\system32\ko-KR
    2011-04-19 00:26:52 ----D---- C:\Windows\system32\ja-JP
    2011-04-19 00:26:52 ----D---- C:\Windows\system32\it-IT
    2011-04-19 00:26:52 ----D---- C:\Windows\system32\ias
    2011-04-19 00:26:52 ----D---- C:\Windows\system32\hu-HU
    2011-04-19 00:26:52 ----D---- C:\Windows\system32\he-IL
    2011-04-19 00:26:52 ----D---- C:\Windows\system32\fr-FR
    2011-04-19 00:26:52 ----D---- C:\Windows\system32\fi-FI
    2011-04-19 00:26:52 ----D---- C:\Windows\system32\es-ES
    2011-04-19 00:26:52 ----D---- C:\Windows\system32\en
    2011-04-19 00:26:51 ----D---- C:\Windows\system32\el-GR
    2011-04-19 00:26:50 ----D---- C:\Windows\system32\drivers\en-US
    2011-04-19 00:26:50 ----D---- C:\Windows\system32\de-DE
    2011-04-19 00:26:50 ----D---- C:\Windows\system32\da-DK
    2011-04-19 00:26:50 ----D---- C:\Windows\system32\cs-CZ
    2011-04-19 00:26:50 ----D---- C:\Windows\system32\com
    2011-04-19 00:26:50 ----D---- C:\Windows\system32\Boot
    2011-04-19 00:26:49 ----D---- C:\Windows\system32\ar-SA
    2011-04-19 00:26:49 ----D---- C:\Windows\system32\AdvancedInstallers
    2011-04-19 00:26:49 ----D---- C:\Windows\servicing
    2011-04-19 00:26:39 ----D---- C:\Windows\rescache
    2011-04-19 00:26:39 ----D---- C:\Windows\PolicyDefinitions
    2011-04-19 00:26:39 ----D---- C:\Windows\MSAgent
    2011-04-19 00:26:38 ----D---- C:\Windows\L2Schemas
    2011-04-19 00:26:37 ----D---- C:\Windows\IME
    2011-04-19 00:26:37 ----D---- C:\Windows\ehome
    2011-04-19 00:26:37 ----D---- C:\Windows\DigitalLocker
    2011-04-19 00:26:35 ----RD---- C:\Users
    2011-04-19 00:26:35 ----D---- C:\Windows\AppPatch
    2011-04-19 00:26:35 ----D---- C:\Program Files\Windows Photo Gallery
    2011-04-19 00:26:28 ----D---- C:\Program Files\Windows Mail
    2011-04-19 00:26:28 ----D---- C:\Program Files\Windows Journal
    2011-04-19 00:26:28 ----D---- C:\Program Files\Windows Defender
    2011-04-19 00:26:28 ----D---- C:\Program Files\MSN
    2011-04-19 00:26:28 ----D---- C:\Program Files\Movie Maker
    2011-04-19 00:25:13 ----D---- C:\Program Files\Windows Sidebar
    2011-04-18 23:58:04 ----D---- C:\Windows\Microsoft.NET
    2011-04-18 23:57:57 ----RSD---- C:\Windows\assembly
    2011-04-18 23:33:55 ----D---- C:\Windows\system32\catroot
    2011-04-18 23:33:49 ----SHD---- C:\Boot
    2011-04-18 22:50:12 ----D---- C:\Windows\Boot
    2011-04-18 22:39:04 ----D---- C:\Windows\system32\WDI
    2011-04-18 21:36:46 ----A---- C:\Windows\system32\mrt.exe
    2011-04-18 21:14:01 ----D---- C:\ProgramData\Microsoft Help
    2011-04-04 14:55:12 ----D---- C:\Program Files\VstPluginsegg
    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
    R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2011-01-13 23632]
    R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2011-01-13 294608]
    R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2011-01-13 47440]
    R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2006-11-21 387432]
    R1 IDSvix86;Symantec Intrusion Prevention Driver; \??\C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys [2006-11-21 202872]
    R1 SRTSPX;SRTSPX; C:\Windows\System32\Drivers\SRTSPX.SYS [2006-11-21 24184]
    R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2011-01-13 17744]
    R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2011-01-13 51280]
    R2 int15;int15; \??\C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-08 76584]
    R2 MDC8021X;AEGIS Protocol (IEEE 802.1x) v2.3.1.10; C:\Windows\system32\DRIVERS\mdc8021x.sys [2010-12-23 15890]
    R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-06-22 1788056]
    R3 mcdbus;Driver for MagicISO SCSI Host Controller; C:\Windows\system32\DRIVERS\mcdbus.sys [2009-02-25 116736]
    R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2007-09-14 6144]
    R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2007-07-06 7568832]
    R3 usbaudio;USB Audio Driver (WDM); C:\Windows\system32\drivers\usbaudio.sys [2006-11-02 71552]
    R3 WPN111;Wireless USB 2.0 Adapter with RangeMax Service; C:\Windows\system32\DRIVERS\WPN111.sys [2005-01-07 286720]
    R4 RegFilter;RegFilter; \??\C:\Program Files\IObit\IObit Malware Fighter\drivers\wlh_x86\regfilter.sys []
    S3 ATHFMWDL;NETGEAR WPN111 Bootloader driver; C:\Windows\System32\Drivers\athwpn.sys [2004-10-15 43392]
    S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
    S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
    S3 Lavasoft Kernexplorer;Lavasoft helper driver; \??\C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys []
    S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
    S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
    S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
    S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
    S3 NAVENG;NAVENG; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20061106.064\NAVENG.SYS [2006-11-21 79240]
    S3 NAVEX15;NAVEX15; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20061106.064\NAVEX15.SYS [2006-11-21 831880]
    S3 NuidFltr;NUID filter driver; C:\Windows\system32\DRIVERS\NuidFltr.sys [2009-05-09 14736]
    S3 RTL85n86;Realtek 8180/8185 Extensible 802.11 Wireless Device Driver; C:\Windows\system32\DRIVERS\RTL85n86.sys [2006-11-02 311808]
    S3 SiS6350;SiS6350; C:\Windows\system32\DRIVERS\SISGRKMD.sys [2007-06-05 454520]
    S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver; C:\Windows\system32\DRIVERS\SiSGB6.sys [2007-01-22 46592]
    S3 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys [2006-11-21 406672]
    S3 SRTSP;SRTSP; C:\Windows\System32\Drivers\SRTSP.SYS [2006-11-21 245880]
    S3 SRTSPL;SRTSPL; C:\Windows\System32\Drivers\SRTSPL.SYS [2006-11-21 275576]
    S3 SYMDNS;SYMDNS; C:\Windows\System32\Drivers\SYMDNS.SYS [2006-11-21 11792]
    S3 SYMFW;SYMFW; C:\Windows\System32\Drivers\SYMFW.SYS [2006-11-21 144784]
    S3 SYMIDS;SYMIDS; C:\Windows\System32\Drivers\SYMIDS.SYS [2006-11-21 38928]
    S3 SYMNDISV;SYMNDISV; C:\Windows\System32\Drivers\SYMNDISV.SYS [2006-11-21 37008]
    S3 SYMREDRV;SYMREDRV; C:\Windows\System32\Drivers\SYMREDRV.SYS [2006-11-21 26384]
    S3 UMPass;Microsoft UMPass Driver; C:\Windows\system32\DRIVERS\umpass.sys [2006-11-02 7168]
    S3 usbvideo;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2006-11-02 132352]
    S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]
    S3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; C:\Windows\system32\DRIVERS\xusb21.sys [2009-04-08 56448]
    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
    R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service; C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2007-06-22 269448]
    R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2011-01-13 40384]
    R2 eRecoveryService;eRecovery Service; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [2007-07-03 53248]
    R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440]
    R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2006-07-19 262247]
    S2 NIHardwareService;NIHardwareService; C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe []
    S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
    S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
    S4 ccSetMgr;Symantec Settings Manager; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2006-11-21 107624]
    S4 CLTNetCnService;Symantec Lic NetConnect service; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2006-11-21 107624]
    S4 comHost;COM Host; c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe [2006-11-21 49296]
    S4 ISPwdSvc;Symantec IS Password Validation; c:\Program Files\Norton Internet Security\isPwdSvc.exe [2006-11-21 80552]
    S4 Symantec Core LC;Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [2007-09-14 1174152]
    S4 SymAppCore;Symantec AppCore Service; c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe [2006-11-21 46736]
    -----------------EOF-----------------
     
  9. billybuxton

    billybuxton Thread Starter

    Joined:
    Jun 15, 2011
    Messages:
    22
    Hi
    i remember i tryed to install windows vista service pack 1
    a few months ago but the internet would not work after i had installed so i did a system restore

    thanks you for your help
     
  10. Scolabar

    Scolabar Malware Specialist

    Joined:
    Apr 15, 2011
    Messages:
    289
    Hi billybuxton,

    You were not connected to the Internet when you ran the RSIT scan. Please make sure you are connected to the Internet when you run the RSIT tool. ;)

    Please can you run the RSIT tool again and post the new log in your next reply. :)

    Scolabar
     
  11. billybuxton

    billybuxton Thread Starter

    Joined:
    Jun 15, 2011
    Messages:
    22
    info.txt logfile of random's system information tool 1.08 2011-06-18 05:53:25
    ======Uninstall list======
    Update for Microsoft Office 2007 (KB2508958)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}
    AAS - Swatches Sound Bank-->C:\Program Files\Applied Acoustics Systems\AAS Player\Uninstall Swatches.exe
    Acer Arcade Live Main Page-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}\setup.exe" -uninstall
    Acer DV Magician-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F6EFFB76-4A07-11DA-9D78-000129760D75}\setup.exe" -uninstall
    Acer DVDivine-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B145EC69-66F5-11D8-9D75-000129760D75}\setup.exe" -uninstall
    Acer HomeMedia Connect-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{132888AE-EF67-41C5-BCA2-7D5D2488AB63}\Setup.exe" -uninstall
    Acer HomeMedia-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AA4BF92B-2AAF-11DA-9D78-000129760D75}\Setup.exe" -uninstall
    Acer ScreenSaver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}\setup.exe" -l0x9 -removeonly
    Acer SlideShow DVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{41581EF5-45A7-11DA-9D78-000129760D75}\Setup.exe" -uninstall
    Acer Tour-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94389919-B0AA-4882-9BE8-9F0B004ECA35}\setup.exe" -l0x9 -removeonly
    Acer VideoMagician-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F79A208D-D929-11D9-9D77-000129760D75}\setup.exe" -uninstall
    Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
    Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\FlashUtil10l_ActiveX.exe -maintain activex
    Adobe Reader 7.0-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70000000000}
    AppCore-->MsiExec.exe /I{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}
    Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
    Artillery2 CM Edition-->C:\PROGRA~1\VSTPLU~1\SUGARB~1\ARTILL~1\UNWISE.EXE C:\PROGRA~1\VSTPLU~1\SUGARB~1\ARTILL~1\INSTALL.LOG
    ASIO4ALL-->C:\Program Files\ASIO4ALL v2\uninstall.exe
    Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"
    AV-->MsiExec.exe /I{F4DB525F-A986-4249-B98B-42A8066251CA}
    avast! Free Antivirus-->C:\Program Files\Alwil Software\Avast5\aswRunDll.exe "C:\Program Files\Alwil Software\Avast5\Setup\setiface.dll" RunSetup
    Camel Audio Alchemy-->C:\Program Files\Camel Audio\Alchemy\AlchemyUninstall.exe
    ccCommon-->MsiExec.exe /I{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}
    CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
    Elemental Audio Systems Inspector XL VST RTAS 1.0.1-->C:\PROGRA~1\VSTPLU~1\VSTPLU~2\ELEMEN~1.1-H\IXL\UNINST~1\UNWISE.EXE C:\PROGRA~1\VSTPLU~1\VSTPLU~2\ELEMEN~1.1-H\IXL\UNINST~1\INSTALL.LOG
    eSobi v2-->C:\Program Files\InstallShield Installation Information\{15D967B5-A4BE-42AE-9E84-64CD062B25AA}\setup.exe -runfromtemp -l0x0409
    FabFilter One 2.01-->C:\Program Files\FabFilter\One\Uninst.exe
    FabFilter Timeless VST RTAS v2.00-->"C:\Program Files\FabFilter\Timeless 2\Uninstall\unins000.exe"
    FabFilter TotalBundle VST RTAS v1.2-->"C:\Program Files\FabFilter\Uninstall\unins000.exe"
    Granite Demo-->"C:\Program Files\New Sonic Arts\Granite Demo\unins000.exe"
    HiJackThis-->MsiExec.exe /X{45A66726-69BC-466B-A7A4-12FCBA4883D7}
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
    IL Download Manager-->C:\Program Files\Image-Line\Downloader\uninstall.exe
    INSPECTOR-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0B5B98BE-B1A3-4AB4-A05E-B190E1FBA625}\Setup.exe" -l0x9
    K-Lite Codec Pack 6.5.0 (Basic)-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
    LAME v3.98.3 for Audacity-->"C:\Program Files\Lame For Audacity\unins000.exe"
    MagicDisc 2.7.106-->C:\PROGRA~1\MAGICD~1\UNWISE.EXE C:\PROGRA~1\MAGICD~1\INSTALL.LOG
    MeldaProduction MHarmonizerCM-->C:/Program Files/MeldaProduction/MHarmonizerCM/setup.exe
    Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
    Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
    Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
    Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
    Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
    Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
    Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
    Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
    Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
    Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
    Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
    Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
    Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
    Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
    Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
    Microsoft Visual C++ 2005 Redistributable - KB2467175-->MsiExec.exe /X{a0fe116e-9a8a-466f-aee0-625cb7c207e3}
    Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
    Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570-->MsiExec.exe /X{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
    Microsoft Visual C++ Run Time Lib Setup-->MsiExec.exe /X{AAF4238F-7C29-451D-9925-C753271A5728}
    Microsoft Works-->MsiExec.exe /I{6D52C408-B09A-4520-9B18-475B81D393F1}
    Minimal System Instruments Moogi Analogue Filter VST v2.50-->"C:\Program Files\Minimal System Instruments\Moogi\uninstall\unins000.exe"
    Miroslav Philharmonik-->C:\Program Files\InstallShield Installation Information\{BA0D0121-A3BA-487D-9C78-7AB0E676C722}\setup.exe -runfromtemp -l0x0009 uninstall -removeonly
    MixMeister BPM Analyzer 1.0-->"C:\Program Files\MixMeister BPM Analyzer\unins000.exe"
    MSRedist-->MsiExec.exe /I{B7C61755-DB48-4003-948F-3D34DB8EAF69}
    MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
    MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
    Native Instruments Massive-->"C:\ProgramData\{9162AE45-CC6F-42F1-BE92-73B32408698D}\Massive Setup PC.exe" REMOVE=TRUE MODIFY=FALSE
    Native Instruments Massive-->C:\ProgramData\{9162AE45-CC6F-42F1-BE92-73B32408698D}\Massive Setup PC.exe
    Native Instruments Reaktor 5-->"C:\ProgramData\{E6F7E8AE-5D26-4508-A961-B0231A24CCAE}\Reaktor 5 Setup PC.exe" REMOVE=TRUE MODIFY=FALSE
    Native Instruments Reaktor 5-->C:\ProgramData\{E6F7E8AE-5D26-4508-A961-B0231A24CCAE}\Reaktor 5 Setup PC.exe
    Native Instruments Service Center-->"C:\ProgramData\{A6DB2A6F-FF9D-453F-99D6-C1AA54BC0C14}\Service Center Setup PC.exe" REMOVE=TRUE MODIFY=FALSE
    Native Instruments Service Center-->C:\ProgramData\{A6DB2A6F-FF9D-453F-99D6-C1AA54BC0C14}\Service Center Setup PC.exe
    NETGEAR WPN111 Smart Wizard Wireless Utility-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{582E9125-32B6-4CBA-AB48-3E33CE3DB389}\Setup.exe"
    Norton AntiVirus-->MsiExec.exe /X{830D8CBD-C668-49e2-A969-C2C2106332E0}
    Norton Confidential Browser Component-->MsiExec.exe /I{4843B611-8FCB-4428-8C23-31D0A5EAE164}
    Norton Confidential Web Protection Component-->MsiExec.exe /I{D353CC51-430D-4C6F-9B7E-52003DA1E05A}
    Norton Internet Security (Symantec Corporation)-->"C:\Program Files\Common Files\Symantec Shared\SymSetup\{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}_10_1_0_26\{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}.exe" /X
    Norton Internet Security-->MsiExec.exe /I{3672B097-EA69-4bfe-B92F-29AE6D9D2B34}
    Norton Internet Security-->MsiExec.exe /I{48185814-A224-447A-81DA-71BD20580E1B}
    Norton Internet Security-->MsiExec.exe /I{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}
    Norton Internet Security-->MsiExec.exe /I{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}
    Norton Internet Security-->MsiExec.exe /I{E5EE9939-259F-4DE2-8023-5C49E16A4F43}
    Norton Protection Center-->MsiExec.exe /I{9A129ABC-A53A-4209-A21E-D5DEDFB7CCA8}
    NTI Backup NOW! 4.7-->"C:\Program Files\InstallShield Installation Information\{67ADE9AF-5CD9-4089-8825-55DE4B366799}\setup.exe" -removeonly
    NTI CD & DVD-Maker-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2} /l1033 CDM7
    NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI
    Ohm Force - Mobilohm VST2-->C:\Windows\unvise32.exe i:\vst plugins\ohm force\Ohm Force\Mobilohm VST2\uninstal.log
    Ohm Force - Ohmicide VST-->C:\Windows\unvise32.exe i:\vst plugins\Ohm Force\Ohmicide VST\uninstal.log
    Ohm Force - Quad Frohmage VST2-->C:\Windows\unvise32.exe i:\vst plugins\ohm force\Ohm Force\Quad Frohmage VST2\uninstal.log
    OhmForce Hematohm VST2-->C:\Windows\unvise32.exe i:\vst plugins\ohm force\Ohm Force\Hematohm VST2\uninstal.log
    OhmForce Ohmboyz VST2-->C:\Windows\unvise32.exe i:\vst plugins\ohm force\Ohm Force\Ohmboyz VST2\uninstal.log
    OhmForce Ohmygod VST2-->C:\Windows\unvise32.exe C:\PROGRAM FILES\VSTPLUGINS\VST PLUGINS\VST EFFECTS\OHMYGOD!\Ohm Force\Ohmygod VST2\uninstal.log
    OhmForce Predatohm VST2-->C:\Windows\unvise32.exe i:\vst plugins\Ohm Force\Predatohm VST2\uninstal.log
    PSP VintageWarmer2 2.5.1 32bit-->"C:\Program Files\PSPaudioware\PSP VintageWarmer2\uninstall.exe" "/U:C:\Program Files\PSPaudioware\PSP VintageWarmer2\irunin.xml"
    QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
    RealNetworks - Microsoft Visual C++ 2008 Runtime-->MsiExec.exe /X{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}
    RealPlayer-->C:\Program Files\Real\RealPlayer\Update\r1puninst.exe RealNetworks|RealPlayer|12.0
    Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe" -l0x9 -removeonly
    RealUpgrade 1.1-->MsiExec.exe /I{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}
    Roger Nichols Digital SIGNATURE Bundle VST RTAS v1.9.3-->"C:\Program Files\RNDigital\Uninstall\unins000.exe"
    Schaack Audio Technologies Transient Shaper VST v2.04-->"C:\Program Files\Schaack Audio\Transient Shaper\uninstall\unins000.exe"
    Security Update for 2007 Microsoft Office System (KB2288621)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5C497F0B-2061-4CC9-A61C-6B45B867354D}
    Security Update for 2007 Microsoft Office System (KB2288931)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {CD769337-C8AC-46DB-A7DC-643E50089263}
    Security Update for 2007 Microsoft Office System (KB2345043)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {536FB502-775F-4494-BACE-C02CC90B7A5B}
    Security Update for 2007 Microsoft Office System (KB2466156)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {CEF209AB-F96D-404F-B5CC-44057C057CA3}
    Security Update for 2007 Microsoft Office System (KB2509488)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {AD0DE453-0804-4495-9C91-33D0F9AA5463}
    Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
    Security Update for 2007 Microsoft Office System (KB976321)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7F207DCA-3399-40CB-A968-6E5991B1421A}
    Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
    Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
    Security Update for Microsoft Office Excel 2007 (KB2464583)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {151E2FEA-C3A6-4CB6-BE6B-16651FDF04BE}
    Security Update for Microsoft Office InfoPath 2007 (KB979441)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {8CCB781A-CF6B-4FCB-B6D8-59C64DF5C6DB}
    Security Update for Microsoft Office PowerPoint 2007 (KB2464594)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {E6B7C11E-21E9-4BA0-9677-29AD603B953C}
    Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {D75E6D0C-BADF-4F41-98B2-0C0F02C15062}
    Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
    Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
    Security Update for Microsoft Office Word 2007 (KB2344993)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7A5B74FA-7A92-4FC9-821A-2DD5D4E73E48}
    Sonnox Oxford R3 Dynamics Native VST v1.3.1-->"C:\Program Files\Sonnox\Uninstall\Sonnox Oxford R3 Dynamics Native VST\unins000.exe"
    Sony Noise Reduction Plug-In 2.0h-->MsiExec.exe /X{06A1BE8A-4CA4-4A39-B9E4-E815AA8FE05C}
    Sound Forge Pro 10.0-->MsiExec.exe /X{3F9170C9-A7C2-408F-A4D8-EC77250040BF}
    SPBBC 32bit-->MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
    Symantec Real Time Storage Protection Component-->MsiExec.exe /I{D6E6FA4A-5445-4850-8365-CF216C1CBB7A}
    SymNet-->MsiExec.exe /I{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}
    T-RackS 3 Deluxe-->C:\Program Files\InstallShield Installation Information\{423C4130-EBC3-410A-B3A0-37BBF9D607D5}\setup.exe -runfromtemp -l0x0009 uninstall -removeonly
    Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
    Update for Microsoft Office 2007 Help for Common Features (KB963673)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {AB365889-0395-4FAD-B702-CA5985D53D42}
    Update for Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {199DF7B6-169C-448C-B511-1054101BE9C9}
    Update for Microsoft Office OneNote 2007 (KB980729)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {329050A9-EF80-40F9-B633-74508F54C1FF}
    Update for Microsoft Office OneNote 2007 Help (KB963670)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2744EF05-38E1-4D5D-B333-E021EDAEA245}
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {397B1D4F-ED7B-4ACA-A637-43B670843876}
    Update for Microsoft Office Script Editor Help (KB963671)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {CD11C6A2-FFC6-4271-8EAB-79C3582F505C}
    Update for Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {80E762AA-C921-4839-9D7D-DB62A72C0726}
    URS Classic Console EQ Bundle VST Native-->"C:\Windows\URS Classic Console EQ Bundle VST Native\uninstall.exe" "/U:C:\Program Files\URS\Uninstall\uninstall.xml"
    VideoLAN VLC media player 0.8.6i-->C:\Program Files\VideoLAN\VLC\uninstall.exe
    Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
    Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\Windows\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
    Waves Diamond Bundle v5.0-->C:\PROGRA~1\Waves\UNINST~1\UNWISE.EXE C:\PROGRA~1\Waves\UNINST~1\INSTALL.LOG
    WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
    WOK XPhaser v1.0-->"C:\Program Files\WOK\XPhaser\uninstall\unins000.exe"
    ======Security center information======
    AV: avast! Antivirus
    AV: Norton Internet Security (outdated)
    FW: Norton Internet Security
    AS: Windows Defender
    AS: Norton Internet Security (outdated)
    AS: avast! Antivirus
    ======System event log======
    Computer Name: a-PC
    Event Code: 49
    Message: Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
    Record Number: 130438
    Source Name: volmgr
    Time Written: 20110618041048.958441-000
    Event Type: Error
    User:
    Computer Name: a-PC
    Event Code: 49
    Message: Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
    Record Number: 130442
    Source Name: volmgr
    Time Written: 20110618041125.150673-000
    Event Type: Error
    User:
    Computer Name: a-PC
    Event Code: 1003
    Message:
    Record Number: 130447
    Source Name: Microsoft-Windows-Dhcp-Client
    Time Written: 20110618041137.000000-000
    Event Type: Warning
    User:
    Computer Name: a-PC
    Event Code: 1002
    Message: The IP address lease 192.168.0.5 for the Network Card with network address 00184D35F396 has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).
    Record Number: 130448
    Source Name: Microsoft-Windows-Dhcp-Client
    Time Written: 20110618041137.000000-000
    Event Type: Error
    User:
    Computer Name: a-PC
    Event Code: 7000
    Message: The NIHardwareService service failed to start due to the following error:
    The system cannot find the file specified.
    Record Number: 130488
    Source Name: Service Control Manager
    Time Written: 20110618041239.000000-000
    Event Type: Error
    User:
    =====Application event log=====
    Computer Name: a-PC
    Event Code: 6000
    Message: The winlogon notification subscriber <GPClient> was unavailable to handle a notification event.
    Record Number: 14054
    Source Name: Microsoft-Windows-Winlogon
    Time Written: 20110617194109.000000-000
    Event Type: Warning
    User:
    Computer Name: a-PC
    Event Code: 6001
    Message: The winlogon notification subscriber <GPClient> failed a notification event.
    Record Number: 14055
    Source Name: Microsoft-Windows-Winlogon
    Time Written: 20110617194109.000000-000
    Event Type: Warning
    User:
    Computer Name: a-PC
    Event Code: 1000
    Message: Faulting application svchost.exe, version 6.0.6000.16386, time stamp 0x4549adc4, faulting module ntdll.dll, version 6.0.6000.16386, time stamp 0x4549bdc9, exception code 0xc000071b, fault offset 0x0008ac88, process id 0x474, application start time 0x01cc2d6dcdb59017.
    Record Number: 14108
    Source Name: Application Error
    Time Written: 20110618043155.000000-000
    Event Type: Error
    User:
    Computer Name: a-PC
    Event Code: 502
    Message: Certificate Services Client failed to register Group Policy notifications. Error code: 2147944153.
    Record Number: 14111
    Source Name: Microsoft-Windows-CertificateServicesClient
    Time Written: 20110618043416.900333-000
    Event Type: Warning
    User: a-PC\a
    Computer Name: a-PC
    Event Code: 502
    Message: Certificate Services Client failed to register Group Policy notifications. Error code: 2147944153.
    Record Number: 14112
    Source Name: Microsoft-Windows-CertificateServicesClient
    Time Written: 20110618043416.900333-000
    Event Type: Warning
    User: a-PC\a
    =====Security event log=====
    Computer Name: a-PC
    Event Code: 4672
    Message: Special privileges assigned to new logon.
    Subject:
    Security ID: S-1-5-18
    Account Name: SYSTEM
    Account Domain: NT AUTHORITY
    Logon ID: 0x3e7
    Privileges: SeAssignPrimaryTokenPrivilege
    SeTcbPrivilege
    SeSecurityPrivilege
    SeTakeOwnershipPrivilege
    SeLoadDriverPrivilege
    SeBackupPrivilege
    SeRestorePrivilege
    SeDebugPrivilege
    SeAuditPrivilege
    SeSystemEnvironmentPrivilege
    SeImpersonatePrivilege
    Record Number: 32147
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20110618043415.324733-000
    Event Type: Audit Success
    User:
    Computer Name: a-PC
    Event Code: 4624
    Message: An account was successfully logged on.
    Subject:
    Security ID: S-1-0-0
    Account Name: -
    Account Domain: -
    Logon ID: 0x0
    Logon Type: 3
    New Logon:
    Security ID: S-1-5-7
    Account Name: ANONYMOUS LOGON
    Account Domain: NT AUTHORITY
    Logon ID: 0x1fad6e
    Logon GUID: {00000000-0000-0000-0000-000000000000}
    Process Information:
    Process ID: 0x0
    Process Name: -
    Network Information:
    Workstation Name:
    Source Network Address: -
    Source Port: -
    Detailed Authentication Information:
    Logon Process: NtLmSsp
    Authentication Package: NTLM
    Transited Services: -
    Package Name (NTLM only): NTLM V1
    Key Length: 0
    This event is generated when a logon session is created. It is generated on the computer that was accessed.
    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
    The authentication information fields provide detailed information about this specific logon request.
    - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
    - Transited services indicate which intermediate services have participated in this logon request.
    - Package name indicates which sub-protocol was used among the NTLM protocols.
    - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
    Record Number: 32148
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20110618043415.792733-000
    Event Type: Audit Success
    User:
    Computer Name: a-PC
    Event Code: 4648
    Message: A logon was attempted using explicit credentials.
    Subject:
    Security ID: S-1-5-18
    Account Name: A-PC$
    Account Domain: WORKGROUP
    Logon ID: 0x3e7
    Logon GUID: {00000000-0000-0000-0000-000000000000}
    Account Whose Credentials Were Used:
    Account Name: SYSTEM
    Account Domain: NT AUTHORITY
    Logon GUID: {00000000-0000-0000-0000-000000000000}
    Target Server:
    Target Server Name: localhost
    Additional Information: localhost
    Process Information:
    Process ID: 0x268
    Process Name: C:\Windows\System32\services.exe
    Network Information:
    Network Address: -
    Port: -
    This event is generated when a process attempts to log on an account by explicitly specifying that account&#8217;s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
    Record Number: 32149
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20110618044922.600133-000
    Event Type: Audit Success
    User:
    Computer Name: a-PC
    Event Code: 4624
    Message: An account was successfully logged on.
    Subject:
    Security ID: S-1-5-18
    Account Name: A-PC$
    Account Domain: WORKGROUP
    Logon ID: 0x3e7
    Logon Type: 5
    New Logon:
    Security ID: S-1-5-18
    Account Name: SYSTEM
    Account Domain: NT AUTHORITY
    Logon ID: 0x3e7
    Logon GUID: {00000000-0000-0000-0000-000000000000}
    Process Information:
    Process ID: 0x268
    Process Name: C:\Windows\System32\services.exe
    Network Information:
    Workstation Name:
    Source Network Address: -
    Source Port: -
    Detailed Authentication Information:
    Logon Process: Advapi
    Authentication Package: Negotiate
    Transited Services: -
    Package Name (NTLM only): -
    Key Length: 0
    This event is generated when a logon session is created. It is generated on the computer that was accessed.
    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
    The authentication information fields provide detailed information about this specific logon request.
    - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
    - Transited services indicate which intermediate services have participated in this logon request.
    - Package name indicates which sub-protocol was used among the NTLM protocols.
    - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
    Record Number: 32150
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20110618044922.600133-000
    Event Type: Audit Success
    User:
    Computer Name: a-PC
    Event Code: 4672
    Message: Special privileges assigned to new logon.
    Subject:
    Security ID: S-1-5-18
    Account Name: SYSTEM
    Account Domain: NT AUTHORITY
    Logon ID: 0x3e7
    Privileges: SeAssignPrimaryTokenPrivilege
    SeTcbPrivilege
    SeSecurityPrivilege
    SeTakeOwnershipPrivilege
    SeLoadDriverPrivilege
    SeBackupPrivilege
    SeRestorePrivilege
    SeDebugPrivilege
    SeAuditPrivilege
    SeSystemEnvironmentPrivilege
    SeImpersonatePrivilege
    Record Number: 32151
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20110618044922.600133-000
    Event Type: Audit Success
    User:
    ======Environment variables======
    "ComSpec"=%SystemRoot%\system32\cmd.exe
    "FP_NO_HOST_CHECK"=NO
    "OS"=Windows_NT
    "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Common Files\iZotope\Runtimes;C:\Program Files\QuickTime\QTSystem\
    "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
    "PROCESSOR_ARCHITECTURE"=x86
    "TEMP"=%SystemRoot%\TEMP
    "TMP"=%SystemRoot%\TEMP
    "USERNAME"=SYSTEM
    "windir"=%SystemRoot%
    "PROCESSOR_LEVEL"=6
    "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 2, GenuineIntel
    "PROCESSOR_REVISION"=0f02
    "NUMBER_OF_PROCESSORS"=2
    "CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
    "QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip
    "KMP_DUPLICATE_LIB_OK"=TRUE
    -----------------EOF-----------------
     
  12. billybuxton

    billybuxton Thread Starter

    Joined:
    Jun 15, 2011
    Messages:
    22
    Logfile of random's system information tool 1.08 (written by random/random)
    Run by a at 2011-06-18 05:53:10
    Microsoft® Windows Vista&#8482; Home Premium
    System drive C: has 27 GB (38%) free of 71 GB
    Total RAM: 3071 MB (38% free)
    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 05:53:21, on 18/06/2011
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16982)
    Boot mode: Normal
    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\System32\rundll32.exe
    C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
    C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehtray.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    C:\Windows\ehome\ehmsas.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Users\a\Desktop\Virus Protection\RSIT.exe
    C:\Program Files\trend micro\a.exe
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
    O2 - BHO: (no name) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - (no file)
    O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
    O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
    O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
    O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Real\RealPlayer\update\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil10l_ActiveX.exe -update activex (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil10l_ActiveX.exe -update activex (User 'Default user')
    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    O4 - Global Startup: Empowering Technology Launcher.lnk = ?
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O20 - Winlogon Notify: permham - C:\Windows\system32\config\systemprofile\AppData\Local\permham.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
    O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
    O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: NIHardwareService - Unknown owner - C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe (file missing)
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    --
    End of file - 5941 bytes
    ======Scheduled tasks folder======
    C:\Windows\tasks\Ad-Aware Update (Weekly).job
    C:\Windows\tasks\Norton Internet Security - Run Full System Scan - a.job
    C:\Windows\tasks\User_Feed_Synchronization-{1D64C5CF-D827-419C-97D4-BFB3FEEEF77B}.job
    ======Registry dump======
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}]
    c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll [2006-11-21 96984]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
    RealPlayer Download and Record Plugin for Internet Explorer - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2011-02-13 381656]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96}]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {90222687-F593-4738-B738-FBEE9C7B26DF} - Show Norton Toolbar - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll [2006-11-21 565960]
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2007-09-14 1006264]
    "NvSvc"=C:\Windows\system32\nvsvc.dll [2007-07-06 86016]
    "NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2007-07-06 8466432]
    "NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2007-07-06 81920]
    "eRecoveryService"=C:\Acer\Empowering Technology\eRecovery\eRAgent.exe [2007-02-09 397312]
    "WarReg_PopUp"=C:\Acer\WR_PopUp\WarReg_PopUp.exe [2006-11-06 57344]
    "Acer Tour Reminder"=C:\Acer\AcerTour\Reminder.exe [2007-05-22 151552]
    "avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2011-01-13 3396624]
    "TkBellExe"=C:\Program Files\Real\RealPlayer\update\realsched.exe [2011-02-13 273544]
    "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-12-22 1232896]
    "ehTray.exe"=C:\Windows\ehome\ehTray.exe [2006-11-02 125440]
    "Acer Tour Reminder"= []
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
    c:\Program Files\Common Files\Symantec Shared\ccApp.exe [2006-11-21 107112]
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]
    c:\Program Files\Norton Internet Security\osCheck.exe [2006-11-21 22696]
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMMediaSharing]
    C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe [2007-06-22 204908]
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
    C:\Windows\RtHDVCpl.exe [2007-06-20 4493312]
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    C:\Program Files\Real\RealPlayer\update\realsched.exe [2011-02-13 273544]
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [2004-12-14 29696]
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^NETGEAR WPN111 Smart Wizard.lnk]
    C:\PROGRA~1\NETGEAR\WPN111~1\wpn111.exe [2005-01-25 491606]
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^a^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MagicDisc.lnk]
    C:\PROGRA~1\MAGICD~1\MAGICD~1.EXE [2009-02-24 576000]
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe
    C:\Users\a\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\permham]
    C:\Windows\system32\config\system [2011-06-18 27262976]
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "EnableLUA"=0
    "dontdisplaylastusername"=0
    "legalnoticecaption"=
    "legalnoticetext"=
    "shutdownwithoutlogon"=1
    "undockwithoutlogon"=1
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    ======File associations======
    .reg - open - "regedit.exe" "%1"
    ======List of files/folders created in the last 3 months======
    2011-06-16 20:07:19 ----D---- C:\rsit
    2011-06-16 17:05:20 ----D---- C:\MGADiagToolOutput
    2011-06-16 17:02:46 ----D---- C:\ProgramData\Office Genuine Advantage
    2011-06-16 16:55:50 ----SHD---- C:\Config.Msi
    2011-06-16 12:25:31 ----D---- C:\Users\a\AppData\Roaming\New Sonic Arts
    2011-06-16 12:25:21 ----D---- C:\ProgramData\New Sonic Arts
    2011-06-16 12:25:21 ----D---- C:\Program Files\New Sonic Arts
    2011-06-15 04:02:00 ----D---- C:\Users\a\AppData\Roaming\MeldaProduction MWaveShaper
    2011-06-14 05:24:42 ----D---- C:\Program Files\Trend Micro
    2011-06-14 04:49:25 ----ASH---- C:\hiberfil.sys
    2011-06-14 04:21:57 ----A---- C:\Windows\ntbtlog.txt
    2011-06-13 20:16:22 ----D---- C:\ProgramData\IObit
    2011-06-13 05:17:07 ----D---- C:\Program Files\Camel Audio
    2011-06-13 04:34:52 ----D---- C:\Program Files\Alchemy Player CM
    2011-06-12 14:36:28 ----D---- C:\Users\a\AppData\Roaming\IObit
    2011-06-12 14:36:26 ----D---- C:\Program Files\IObit
    2011-06-12 13:45:16 ----D---- C:\Program Files\McAfee Security Scan
    2011-06-12 13:45:14 ----D---- C:\ProgramData\McAfee
    2011-06-12 10:25:26 ----D---- C:\Users\a\AppData\Roaming\SUPERAntiSpyware.com
    2011-06-12 10:25:21 ----D---- C:\Program Files\SUPERAntiSpyware
    2011-06-11 11:11:39 ----D---- C:\Program Files\InterActual
    2011-06-11 11:00:07 ----D---- C:\ProgramData\Spybot - Search & Destroy
    2011-06-11 11:00:07 ----D---- C:\Program Files\Spybot - Search & Destroy
    2011-06-11 10:51:12 ----D---- C:\ProgramData\SUPERAntiSpyware.com
    2011-06-09 08:36:27 ----D---- C:\ProgramData\SpeedyPC
    2011-06-09 08:36:27 ----D---- C:\Program Files\SpeedyPC
    2011-06-09 08:10:04 ----D---- C:\Users\a\AppData\Roaming\Malwarebytes
    2011-06-09 08:09:59 ----D---- C:\ProgramData\Malwarebytes
    2011-06-09 08:09:56 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
    2011-06-09 00:56:15 ----D---- C:\Users\a\AppData\Roaming\MeldaProduction MAutopan
    2011-06-08 05:31:52 ----D---- C:\ProgramData\iCoolsoft Studio
    2011-06-08 05:31:42 ----D---- C:\Program Files\iCoolsoft Studio
    2011-06-08 04:46:06 ----D---- C:\Users\a\AppData\Roaming\DVDVideoSoft
    2011-06-08 04:46:04 ----D---- C:\Program Files\DVDVideoSoft
    2011-06-08 04:46:04 ----D---- C:\Program Files\Common Files\DVDVideoSoft
    2011-06-08 04:06:16 ----D---- C:\Users\a\AppData\Roaming\Apowersoft
    2011-06-03 10:44:55 ----D---- C:\Program Files\Minimal System Instruments
    2011-05-22 13:58:40 ----D---- C:\Program Files\Lame For Audacity
    2011-05-17 17:35:36 ----D---- C:\Program Files\WOK
    2011-05-15 20:38:43 ----D---- C:\Program Files\Common Files\Apple
    2011-05-15 20:38:32 ----D---- C:\ProgramData\Apple Computer
    2011-05-15 20:38:32 ----D---- C:\Program Files\QuickTime
    2011-05-15 20:37:46 ----D---- C:\ProgramData\Apple
    2011-05-15 20:37:46 ----D---- C:\Program Files\Apple Software Update
    2011-05-14 00:04:17 ----D---- C:\Program Files\Image-Line
    2011-05-12 22:47:15 ----HDC---- C:\ProgramData\{E6F7E8AE-5D26-4508-A961-B0231A24CCAE}
    2011-05-03 14:09:56 ----D---- C:\Program Files\Mozilla Firefox
    2011-05-02 23:07:51 ----D---- C:\Users\a\AppData\Roaming\MeldaProduction MPhaser
    2011-04-25 23:56:48 ----D---- C:\Program Files\CCleaner
    2011-04-24 17:26:43 ----D---- C:\Program Files\Sonnox
    2011-04-21 23:43:46 ----RASH---- C:\MSDOS.SYS
    2011-04-21 23:43:46 ----RASH---- C:\IO.SYS
    2011-04-20 19:30:19 ----D---- C:\Program Files\PSPaudioware
    2011-04-20 19:29:29 ----A---- C:\Windows\system32\PSP VintageWarmer2.dll
    2011-04-20 19:29:29 ----A---- C:\Windows\system32\PSP MicroWarmer.dll
    2011-04-20 19:29:28 ----A---- C:\Windows\system32\PSP VintageWarmer.dll
    2011-04-18 22:11:33 ----D---- C:\04c387722ee496241ee1019193
    2011-04-11 15:03:31 ----D---- C:\ProgramData\Steinberg
    2011-04-08 02:35:52 ----D---- C:\Program Files\MixMeister BPM Analyzer
    2011-04-04 14:53:11 ----D---- C:\Program Files\URS
    2011-04-04 14:53:03 ----D---- C:\Windows\URS Classic Console EQ Bundle VST Native
    2011-04-04 14:53:03 ----D---- C:\Program Files\Steinberg
    2011-03-19 20:48:38 ----D---- C:\Program Files\IK Multimedia
    2011-03-19 20:37:52 ----A---- C:\Windows\system32\msvcsv60.dll
    ======List of files/folders modified in the last 3 months======
    2011-06-18 05:53:15 ----D---- C:\Windows\Temp
    2011-06-18 05:39:26 ----D---- C:\Windows\System32
    2011-06-18 05:39:26 ----A---- C:\Windows\system32\PerfStringBackup.INI
    2011-06-18 05:39:25 ----D---- C:\Windows\inf
    2011-06-18 05:12:28 ----D---- C:\Windows\system32\Tasks
    2011-06-18 05:12:08 ----D---- C:\ProgramData\Real
    2011-06-18 05:11:57 ----D---- C:\Users\a\AppData\Roaming\Real
    2011-06-17 22:15:25 ----D---- C:\Windows\Prefetch
    2011-06-17 08:11:42 ----SHD---- C:\System Volume Information
    2011-06-16 23:21:58 ----HD---- C:\ProgramData
    2011-06-16 20:11:20 ----RD---- C:\Program Files
    2011-06-16 19:57:05 ----D---- C:\Program Files\Reason 5
    2011-06-16 16:55:51 ----SHD---- C:\Windows\Installer
    2011-06-16 16:55:45 ----DC---- C:\Windows\system32\DRVSTORE
    2011-06-16 16:55:45 ----D---- C:\Windows\system32\drivers
    2011-06-16 16:55:45 ----D---- C:\ProgramData\Lavasoft
    2011-06-16 16:51:39 ----D---- C:\Windows
    2011-06-16 12:21:08 ----D---- C:\Windows\Tasks
    2011-06-16 03:08:14 ----D---- C:\Windows\Minidump
    2011-06-14 06:09:57 ----SD---- C:\Users\a\AppData\Roaming\Microsoft
    2011-06-13 05:16:59 ----D---- C:\Program Files\VstPlugins
    2011-06-13 01:28:39 ----D---- C:\Program Files\MagicDisc
    2011-06-12 17:52:01 ----D---- C:\Windows\system32\catroot2
    2011-06-12 17:50:36 ----D---- C:\Windows\system32\wbem
    2011-06-12 17:49:53 ----D---- C:\Windows\system32\config
    2011-06-12 17:49:33 ----D---- C:\Windows\system32\spool
    2011-06-12 17:49:33 ----D---- C:\Windows\system32\LogFiles
    2011-06-12 17:49:33 ----D---- C:\Windows\system32\drivers\etc
    2011-06-12 17:49:33 ----D---- C:\Windows\system32\CodeIntegrity
    2011-06-12 17:49:31 ----HD---- C:\Program Files\InstallShield Installation Information
    2011-06-12 17:49:26 ----D---- C:\Windows\registration
    2011-06-12 17:02:02 ----D---- C:\Program Files\Yahoo!
    2011-06-12 17:02:02 ----D---- C:\Program Files\Windows Media Player
    2011-06-12 04:28:57 ----D---- C:\Program Files\SPL Plug-Ins
    2011-06-11 08:50:40 ----RD---- C:\Windows\Offline Web Pages
    2011-06-09 14:06:07 ----D---- C:\ProgramData\Adobe
    2011-06-08 04:46:04 ----D---- C:\Program Files\Common Files
    2011-05-24 19:14:10 ----N---- C:\Windows\system32\MpSigStub.exe
    2011-05-15 20:39:27 ----D---- C:\Program Files\Internet Explorer
    2011-05-12 22:46:56 ----D---- C:\Program Files\Native Instruments
    2011-05-12 22:46:56 ----D---- C:\Program Files\Common Files\Native Instruments
    2011-05-12 19:24:37 ----HD---- C:\Program Files\Uninstall Information
    2011-05-02 12:28:51 ----D---- C:\Program Files\Microsoft Silverlight
    2011-04-26 00:01:01 ----D---- C:\Windows\Debug
    2011-04-19 00:29:50 ----D---- C:\Windows\winsxs
    2011-04-19 00:29:50 ----D---- C:\Windows\system32\en-US
    2011-04-19 00:29:50 ----D---- C:\Windows\system32\drivers\UMDF
    2011-04-19 00:29:43 ----D---- C:\Program Files\Windows Collaboration
    2011-04-19 00:26:56 ----D---- C:\Windows\tapi
    2011-04-19 00:26:56 ----D---- C:\Windows\system32\zh-TW
    2011-04-19 00:26:56 ----D---- C:\Windows\system32\zh-CN
    2011-04-19 00:26:56 ----D---- C:\Windows\system32\tr-TR
    2011-04-19 00:26:55 ----D---- C:\Windows\system32\sysprep
    2011-04-19 00:26:55 ----D---- C:\Windows\system32\sv-SE
    2011-04-19 00:26:55 ----D---- C:\Windows\system32\setup
    2011-04-19 00:26:55 ----D---- C:\Windows\system32\ru-RU
    2011-04-19 00:26:55 ----D---- C:\Windows\system32\RTCOM
    2011-04-19 00:26:55 ----D---- C:\Windows\system32\ro-RO
    2011-04-19 00:26:55 ----D---- C:\Windows\system32\pt-PT
    2011-04-19 00:26:55 ----D---- C:\Windows\system32\pt-BR
    2011-04-19 00:26:54 ----D---- C:\Windows\system32\pl-PL
    2011-04-19 00:26:54 ----D---- C:\Windows\system32\oobe
    2011-04-19 00:26:54 ----D---- C:\Windows\system32\nl-NL
    2011-04-19 00:26:54 ----D---- C:\Windows\system32\nb-NO
    2011-04-19 00:26:54 ----D---- C:\Windows\system32\migwiz
    2011-04-19 00:26:53 ----D---- C:\Windows\system32\migration
    2011-04-19 00:26:53 ----D---- C:\Windows\system32\ko-KR
    2011-04-19 00:26:52 ----D---- C:\Windows\system32\ja-JP
    2011-04-19 00:26:52 ----D---- C:\Windows\system32\it-IT
    2011-04-19 00:26:52 ----D---- C:\Windows\system32\ias
    2011-04-19 00:26:52 ----D---- C:\Windows\system32\hu-HU
    2011-04-19 00:26:52 ----D---- C:\Windows\system32\he-IL
    2011-04-19 00:26:52 ----D---- C:\Windows\system32\fr-FR
    2011-04-19 00:26:52 ----D---- C:\Windows\system32\fi-FI
    2011-04-19 00:26:52 ----D---- C:\Windows\system32\es-ES
    2011-04-19 00:26:52 ----D---- C:\Windows\system32\en
    2011-04-19 00:26:51 ----D---- C:\Windows\system32\el-GR
    2011-04-19 00:26:50 ----D---- C:\Windows\system32\drivers\en-US
    2011-04-19 00:26:50 ----D---- C:\Windows\system32\de-DE
    2011-04-19 00:26:50 ----D---- C:\Windows\system32\da-DK
    2011-04-19 00:26:50 ----D---- C:\Windows\system32\cs-CZ
    2011-04-19 00:26:50 ----D---- C:\Windows\system32\com
    2011-04-19 00:26:50 ----D---- C:\Windows\system32\Boot
    2011-04-19 00:26:49 ----D---- C:\Windows\system32\ar-SA
    2011-04-19 00:26:49 ----D---- C:\Windows\system32\AdvancedInstallers
    2011-04-19 00:26:49 ----D---- C:\Windows\servicing
    2011-04-19 00:26:39 ----D---- C:\Windows\rescache
    2011-04-19 00:26:39 ----D---- C:\Windows\PolicyDefinitions
    2011-04-19 00:26:39 ----D---- C:\Windows\MSAgent
    2011-04-19 00:26:38 ----D---- C:\Windows\L2Schemas
    2011-04-19 00:26:37 ----D---- C:\Windows\IME
    2011-04-19 00:26:37 ----D---- C:\Windows\ehome
    2011-04-19 00:26:37 ----D---- C:\Windows\DigitalLocker
    2011-04-19 00:26:35 ----RD---- C:\Users
    2011-04-19 00:26:35 ----D---- C:\Windows\AppPatch
    2011-04-19 00:26:35 ----D---- C:\Program Files\Windows Photo Gallery
    2011-04-19 00:26:28 ----D---- C:\Program Files\Windows Mail
    2011-04-19 00:26:28 ----D---- C:\Program Files\Windows Journal
    2011-04-19 00:26:28 ----D---- C:\Program Files\Windows Defender
    2011-04-19 00:26:28 ----D---- C:\Program Files\MSN
    2011-04-19 00:26:28 ----D---- C:\Program Files\Movie Maker
    2011-04-19 00:25:13 ----D---- C:\Program Files\Windows Sidebar
    2011-04-18 23:58:04 ----D---- C:\Windows\Microsoft.NET
    2011-04-18 23:57:57 ----RSD---- C:\Windows\assembly
    2011-04-18 23:33:55 ----D---- C:\Windows\system32\catroot
    2011-04-18 23:33:49 ----SHD---- C:\Boot
    2011-04-18 22:50:12 ----D---- C:\Windows\Boot
    2011-04-18 22:39:04 ----D---- C:\Windows\system32\WDI
    2011-04-18 21:36:46 ----A---- C:\Windows\system32\mrt.exe
    2011-04-18 21:14:01 ----D---- C:\ProgramData\Microsoft Help
    2011-04-04 14:55:12 ----D---- C:\Program Files\VstPluginsegg
    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
    R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2011-01-13 23632]
    R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2011-01-13 294608]
    R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2011-01-13 47440]
    R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2006-11-21 387432]
    R1 IDSvix86;Symantec Intrusion Prevention Driver; \??\C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys [2006-11-21 202872]
    R1 SRTSPX;SRTSPX; C:\Windows\System32\Drivers\SRTSPX.SYS [2006-11-21 24184]
    R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2011-01-13 17744]
    R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2011-01-13 51280]
    R2 int15;int15; \??\C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-08 76584]
    R2 MDC8021X;AEGIS Protocol (IEEE 802.1x) v2.3.1.10; C:\Windows\system32\DRIVERS\mdc8021x.sys [2010-12-23 15890]
    R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-06-22 1788056]
    R3 mcdbus;Driver for MagicISO SCSI Host Controller; C:\Windows\system32\DRIVERS\mcdbus.sys [2009-02-25 116736]
    R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2007-09-14 6144]
    R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2007-07-06 7568832]
    R3 WPN111;Wireless USB 2.0 Adapter with RangeMax Service; C:\Windows\system32\DRIVERS\WPN111.sys [2005-01-07 286720]
    S3 ATHFMWDL;NETGEAR WPN111 Bootloader driver; C:\Windows\System32\Drivers\athwpn.sys [2004-10-15 43392]
    S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
    S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
    S3 Lavasoft Kernexplorer;Lavasoft helper driver; \??\C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys []
    S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
    S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
    S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
    S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
    S3 NAVENG;NAVENG; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20061106.064\NAVENG.SYS [2006-11-21 79240]
    S3 NAVEX15;NAVEX15; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20061106.064\NAVEX15.SYS [2006-11-21 831880]
    S3 NuidFltr;NUID filter driver; C:\Windows\system32\DRIVERS\NuidFltr.sys [2009-05-09 14736]
    S3 RTL85n86;Realtek 8180/8185 Extensible 802.11 Wireless Device Driver; C:\Windows\system32\DRIVERS\RTL85n86.sys [2006-11-02 311808]
    S3 SiS6350;SiS6350; C:\Windows\system32\DRIVERS\SISGRKMD.sys [2007-06-05 454520]
    S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver; C:\Windows\system32\DRIVERS\SiSGB6.sys [2007-01-22 46592]
    S3 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys [2006-11-21 406672]
    S3 SRTSP;SRTSP; C:\Windows\System32\Drivers\SRTSP.SYS [2006-11-21 245880]
    S3 SRTSPL;SRTSPL; C:\Windows\System32\Drivers\SRTSPL.SYS [2006-11-21 275576]
    S3 SYMDNS;SYMDNS; C:\Windows\System32\Drivers\SYMDNS.SYS [2006-11-21 11792]
    S3 SYMFW;SYMFW; C:\Windows\System32\Drivers\SYMFW.SYS [2006-11-21 144784]
    S3 SYMIDS;SYMIDS; C:\Windows\System32\Drivers\SYMIDS.SYS [2006-11-21 38928]
    S3 SYMNDISV;SYMNDISV; C:\Windows\System32\Drivers\SYMNDISV.SYS [2006-11-21 37008]
    S3 SYMREDRV;SYMREDRV; C:\Windows\System32\Drivers\SYMREDRV.SYS [2006-11-21 26384]
    S3 UMPass;Microsoft UMPass Driver; C:\Windows\system32\DRIVERS\umpass.sys [2006-11-02 7168]
    S3 usbaudio;USB Audio Driver (WDM); C:\Windows\system32\drivers\usbaudio.sys [2006-11-02 71552]
    S3 usbvideo;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2006-11-02 132352]
    S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]
    S3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; C:\Windows\system32\DRIVERS\xusb21.sys [2009-04-08 56448]
    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
    R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service; C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2007-06-22 269448]
    R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2011-01-13 40384]
    R2 eRecoveryService;eRecovery Service; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [2007-07-03 53248]
    R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440]
    R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2006-07-19 262247]
    S2 NIHardwareService;NIHardwareService; C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe []
    S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
    S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
    S4 ccSetMgr;Symantec Settings Manager; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2006-11-21 107624]
    S4 CLTNetCnService;Symantec Lic NetConnect service; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2006-11-21 107624]
    S4 comHost;COM Host; c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe [2006-11-21 49296]
    S4 ISPwdSvc;Symantec IS Password Validation; c:\Program Files\Norton Internet Security\isPwdSvc.exe [2006-11-21 80552]
    S4 Symantec Core LC;Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [2007-09-14 1174152]
    S4 SymAppCore;Symantec AppCore Service; c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe [2006-11-21 46736]
    -----------------EOF-----------------

    I hope this is right
    Thanks
     
  13. Scolabar

    Scolabar Malware Specialist

    Joined:
    Apr 15, 2011
    Messages:
    289
    Hi billybuxton,

    Pirated Software !!

    :!: Your operating system did NOT pass the Microsoft Genuine Advantage test. :!:

    There is clear evidence that you are using a pirated copy of the Windows OS that has been activated illegally.
    This topic will be closed as we don't help with systems containing illegal/pirated software here at TSG.

    Scolabar
     
  14. TerryNet

    TerryNet Terry Moderator

    Joined:
    Mar 23, 2005
    Messages:
    69,556
    Closing, per above post.
     
  15. TerryNet

    TerryNet Terry Moderator

    Joined:
    Mar 23, 2005
    Messages:
    69,556
    I have reopened this because I think we misread the diagnostics. At least I and two other mods/admins cannot find convincing evidence that I was correct in closing it.

    I apologize for the inconvenience and delay my action has caused..
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1002383