[Closed] Infected

• Close ALL OTHER PROGRAMS.
• Double-click on OTS.exe to start the program.
• Check the box that says Scan All Users
• Check the Radio button for Rootkit check YES
• Under Additional Scans check the following:
  • File - Lop Check
  • File - Purity Scan
  • Evnt - EventViewer Errors/Warnings (last 10)
• Now click the Run Scan button on the toolbar.
• Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
• Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

• Click Add Reply
• Under the reply panel is the Attachments Panel
• Browse for the attachment file you want to upload, then click the green Upload button
• Once it has uploaded, click the Manage Current Attachments drop down box
• Click on [external image: Posted Image] to insert the attachment into your post

OTS logfile created on: 04/06/2009 3:43:39 AM - Run 1
OTS by OldTimer - Version 3.0.3.0	 Folder = C:\Users\Matthew\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy
 
2.99 Gb Total Physical Memory | 1.39 Gb Available Physical Memory | 46.41% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 50.83 Gb Total Space | 5.17 Gb Free Space | 10.17% Space Free | Partition Type: NTFS
Drive D: | 115.83 Gb Total Space | 99.25 Gb Free Space | 85.69% Space Free | Partition Type: NTFS
Drive E: | 115.80 Gb Total Space | 115.69 Gb Free Space | 99.90% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: MATTHEW-PC
Current User Name: Matthew
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Whitelist: On
File Age = 30 Days
 
[Processes - Safe List]
applemobiledeviceservice.exe -> C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -> [2009/03/26 15:31:20 | 00,132,424 | —- | M] (Apple Inc.)
cec_main.exe -> C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe -> [2008/01/04 08:45:00 | 04,415,488 | —- | M] ()
cfsvcs.exe -> C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe -> [2007/12/25 18:07:14 | 00,040,960 | —- | M] (TOSHIBA CORPORATION)
ekrn.exe -> C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe -> [2009/02/06 14:23:36 | 00,727,720 | —- | M] (ESET)
firefox.exe -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe -> [2009/04/24 01:38:11 | 00,307,704 | —- | M] (Mozilla Corporation)
hpqbam08.exe -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe -> [2007/10/19 20:46:08 | 00,610,304 | —- | M] (Hewlett-Packard Co.)
hpqgpc01.exe -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe -> [2007/11/02 20:12:50 | 00,262,144 | —- | M] (Hewlett-Packard)
hpqste08.exe -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe -> [2007/10/19 20:46:08 | 00,184,320 | —- | M] (Hewlett-Packard Co.)
hpqtra08.exe -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe -> [2007/10/14 20:38:52 | 00,214,360 | —- | M] (Hewlett-Packard Co.)
hpwuschd2.exe -> C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe -> [2007/10/14 21:17:32 | 00,049,152 | —- | M] (Hewlett-Packard)
ipodservice.exe -> C:\Program Files (x86)\iPod\bin\iPodService.exe -> [2009/04/02 16:10:56 | 00,656,168 | —- | M] (Apple Inc.)
ituneshelper.exe -> C:\Program Files (x86)\iTunes\iTunesHelper.exe -> [2009/04/02 16:11:02 | 00,342,312 | —- | M] (Apple Inc.)
jusched.exe -> C:\Program Files (x86)\Java\jre6\bin\jusched.exe -> [2008/11/25 21:48:29 | 00,136,600 | —- | M] (Sun Microsystems, Inc.)
ltmoh.exe -> C:\Program Files\ltmoh\ltmoh.exe -> [2007/01/09 03:23:04 | 00,191,552 | —- | M] (Agere Systems)
mdnsresponder.exe -> C:\Program Files (x86)\Bonjour\mDNSResponder.exe -> [2008/12/12 11:17:38 | 00,238,888 | —- | M] (Apple Inc.)
ots.exe -> C:\Users\Matthew\Desktop\OTS.exe -> [2009/06/04 03:35:28 | 00,505,344 | —- | M] (OldTimer Tools)
seaport.exe -> C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -> [2009/05/19 11:36:18 | 00,240,512 | —- | M] (Microsoft Corporation)
tnavisrv.exe -> C:\Program Files (x86)\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe -> [2008/01/21 16:54:46 | 00,083,312 | —- | M] (TOSHIBA Corporation)
tosa2dp.exe -> C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe -> [2007/10/29 19:30:14 | 00,278,528 | —- | M] (TOSHIBA CORPORATION.)
tosavrc.exe -> C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe -> [2008/01/09 15:38:44 | 00,288,072 | —- | M] (TOSHIBA CORPORATION.)
tosbthid.exe -> C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe -> [2007/10/04 23:39:42 | 00,077,824 | —- | M] (TOSHIBA CORPORATION.)
tosbthsp.exe -> C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe -> [2008/01/23 01:13:08 | 00,288,072 | —- | M] (TOSHIBA CORPORATION.)
tosbtmng.exe -> C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe -> [2008/01/25 15:24:08 | 02,938,184 | —- | M] (TOSHIBA CORPORATION.)
traybar.exe -> C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe -> [2007/10/25 17:41:18 | 00,413,696 | —- | M] (Chicony)
ulcdrsvr.exe -> C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -> [2006/08/23 16:39:48 | 00,049,152 | —- | M] (Ulead Systems, Inc.)
 
[Win32 Services - Safe List]
(AcronisOSSReinstallSvc) Acronis OS Selector Reinstall Service [Win32_Own | Auto | Stopped] ->  -> File not found
(AgereModemAudio) Agere Modem Call Progress Audio [Win32_Own | Auto | Running] ->  -> File not found
(ALG) Application Layer Gateway Service [Win32_Own | On_Demand | Stopped] ->  -> File not found
(Apple Mobile Device) Apple Mobile Device [Win32_Own | Auto | Running] -> C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -> [2009/03/26 15:31:20 | 00,132,424 | —- | M] (Apple Inc.)
(Bonjour Service) Bonjour Service [Win32_Own | Auto | Running] -> C:\Program Files (x86)\Bonjour\mDNSResponder.exe -> [2008/12/12 11:17:38 | 00,238,888 | —- | M] (Apple Inc.)
(clr_optimization_v2.0.50727_32) Microsoft .NET Framework NGEN v2.0.50727_X86 [Win32_Own | On_Demand | Stopped] -> C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -> [2008/07/27 15:03:13 | 00,069,632 | —- | M] (Microsoft Corporation)
(clr_optimization_v2.0.50727_64) Microsoft .NET Framework NGEN v2.0.50727_X64 [Win32_Own | On_Demand | Stopped] -> C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe -> [2008/07/27 15:01:49 | 00,093,184 | —- | M] (Microsoft Corporation)
(ConfigFree Service) ConfigFree Service [Win32_Own | Auto | Running] -> C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe -> [2007/12/25 18:07:14 | 00,040,960 | —- | M] (TOSHIBA CORPORATION)
(DFSR) DFS Replication [Win32_Own | On_Demand | Stopped] ->  -> File not found
(ehRecvr) Windows Media Center Receiver Service [Win32_Own | On_Demand | Stopped] -> C:\Windows\ehome\ehRecvr.exe -> [2008/01/20 23:51:36 | 00,344,064 | —- | M] (Microsoft Corporation)
(ehSched) Windows Media Center Scheduler Service [Win32_Own | On_Demand | Stopped] -> C:\Windows\ehome\ehsched.exe -> [2008/01/20 23:51:36 | 00,153,600 | —- | M] (Microsoft Corporation)
(ehstart) Windows Media Center Service Launcher [Win32_Shared | Auto | Stopped] -> C:\Windows\ehome\ehstart.dll -> [2006/11/02 12:03:48 | 00,015,360 | —- | M] (Microsoft Corporation)
(EhttpSrv) ESET HTTP Server [Win32_Own | On_Demand | Stopped] -> C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -> [2009/02/06 14:27:10 | 00,023,296 | —- | M] (ESET)
(ekrn) ESET Service [Win32_Own | Auto | Running] -> C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe -> [2009/02/06 14:23:36 | 00,727,720 | —- | M] (ESET)
(FontCache3.0.0.0) Windows Presentation Foundation Font Cache 3.0.0.0 [Win32_Own | Auto | Running] -> C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe -> [2008/06/19 22:17:12 | 00,046,104 | —- | M] (Microsoft Corporation)
(fsssvc) Windows Live Family Safety [Win32_Own | On_Demand | Stopped] -> C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe -> [2009/02/06 19:08:58 | 00,533,360 | —- | M] (Microsoft Corporation)
(hpqcxs08) hpqcxs08 [Win32_Shared | On_Demand | Running] -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll -> [2007/11/06 21:16:54 | 00,217,088 | —- | M] (Hewlett-Packard Co.)
(hpqddsvc) HP CUE DeviceDiscovery Service [Win32_Shared | Auto | Running] -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll -> [2007/11/06 21:16:54 | 00,139,264 | —- | M] (Hewlett-Packard Co.)
(IDriverT) InstallDriver Table Manager [Win32_Own | On_Demand | Stopped] -> C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe -> [2004/10/22 03:24:18 | 00,073,728 | —- | M] (Macrovision Corporation)
(idsvc) Windows CardSpace [Win32_Shared | Unknown | Stopped] -> C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe -> [2008/06/19 22:16:53 | 00,859,648 | —- | M] (Microsoft Corporation)
(iPod Service) iPod Service [Win32_Own | On_Demand | Running] -> C:\Program Files (x86)\iPod\bin\iPodService.exe -> [2009/04/02 16:10:56 | 00,656,168 | —- | M] (Apple Inc.)
(KeyIso) CNG Key Isolation [Win32_Shared | On_Demand | Running] -> C:\Windows\SysWow64\keyiso.dll -> [2006/11/02 06:46:05 | 00,018,944 | —- | M] (Microsoft Corporation)
(MSDTC) Distributed Transaction Coordinator [Win32_Own | Unknown | Stopped] -> C:\Windows\SysWow64\Msdtc -> [2006/11/02 10:34:14 | 00,000,000 | —D | M]
(Netlogon) Netlogon [Win32_Shared | On_Demand | Stopped] -> C:\Windows\SysWow64\netlogon.dll -> [2008/01/20 23:48:28 | 00,592,384 | —- | M] (Microsoft Corporation)
(NetTcpPortSharing) Net.Tcp Port Sharing Service [Win32_Shared | Disabled | Stopped] -> C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe -> [2008/06/19 22:16:54 | 00,119,808 | —- | M] (Microsoft Corporation)
(ose) Office Source Engine [Win32_Own | On_Demand | Stopped] -> C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE -> [2003/07/28 12:28:22 | 00,089,136 | —- | M] (Microsoft Corporation)
(ProtectedStorage) Protected Storage [Win32_Shared | On_Demand | Stopped] ->  -> File not found
(RapiMgr) Windows Mobile-based device connectivity [Win32_Shared | Auto | Running] -> C:\Windows\WindowsMobile\rapimgr.dll -> [2008/01/20 23:47:00 | 00,211,968 | —- | M] (Microsoft Corporation)
(RpcLocator) Remote Procedure Call (RPC) Locator [Win32_Own | On_Demand | Stopped] ->  -> File not found
(SamSs) Security Accounts Manager [Win32_Shared | Auto | Running] ->  -> File not found
(SeaPort) SeaPort [Win32_Own | Auto | Running] -> C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -> [2009/05/19 11:36:18 | 00,240,512 | —- | M] (Microsoft Corporation)
(slsvc) Software Licensing [Win32_Own | Auto | Running] ->  -> File not found
(SNMPTRAP) SNMP Trap [Win32_Own | On_Demand | Stopped] ->  -> File not found
(Spooler) Print Spooler [Win32_Own | Auto | Running] ->  -> File not found
(SQLWriter) SQL Server VSS Writer [Win32_Own | On_Demand | Stopped] -> C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe -> [2006/04/14 16:58:16 | 00,153,376 | —- | M] (Microsoft Corporation)
(TNaviSrv) TOSHIBA Navi Support Service [Win32_Own | Auto | Running] -> C:\Program Files (x86)\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe -> [2008/01/21 16:54:46 | 00,083,312 | —- | M] (TOSHIBA Corporation)
(TODDSrv) TOSHIBA Optical Disc Drive Service [Win32_Own | Auto | Running] ->  -> File not found
(TosCoSrv) TOSHIBA Power Saver [Win32_Own | Auto | Running] -> C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -> [2008/01/17 16:29:48 | 00,434,016 | —- | M] (TOSHIBA Corporation)
(TOSHIBA Bluetooth Service) TOSHIBA Bluetooth Service [Win32_Own | Auto | Running] -> C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -> [2007/09/28 21:06:42 | 00,168,296 | —- | M] (TOSHIBA CORPORATION)
(TOSHIBA SMART Log Service) TOSHIBA SMART Log Service [Win32_Own | Auto | Running] -> C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe -> [2007/12/03 17:04:48 | 00,175,104 | —- | M] (TOSHIBA Corporation)
(UI0Detect) Interactive Services Detection [Win32_Own | On_Demand | Stopped] ->  -> File not found
(UleadBurningHelper) Ulead Burning Helper [Win32_Own | Auto | Running] -> C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -> [2006/08/23 16:39:48 | 00,049,152 | —- | M] (Ulead Systems, Inc.)
(vds) Virtual Disk [Win32_Own | On_Demand | Stopped] -> C:\Windows\SysWow64\Wbem\vds.mof -> [2006/11/02 03:35:15 | 00,060,994 | —- | M] ()
(VSS) Volume Shadow Copy [Win32_Own | On_Demand | Stopped] -> C:\Windows\SysWow64\Wbem\vss.mof -> [2006/11/02 03:35:15 | 00,055,846 | —- | M] ()
(WcesComm) Windows Mobile 2003-based device connectivity [Win32_Shared | Auto | Running] -> C:\Windows\WindowsMobile\wcescomm.dll -> [2008/01/20 23:47:00 | 00,428,544 | —- | M] (Microsoft Corporation)
(wmiApSrv) WMI Performance Adapter [Win32_Own | On_Demand | Stopped] ->  -> File not found
(WMPNetworkSvc) Windows Media Player Network Sharing Service [Win32_Own | Auto | Running] -> C:\Program Files\Windows Media Player\wmpnetwk.exe -> [2008/01/20 23:52:15 | 01,216,000 | —- | M] (Microsoft Corporation)
 
[Driver Services - Safe List]
(ACPI) Microsoft ACPI Driver [Kernel | Boot | Running] ->  -> File not found
(AFD) Ancilliary Function Driver for Winsock [Kernel | System | Running] ->  -> File not found
(AgereSoftModem) TOSHIBA Software Modem [Kernel | On_Demand | Running] ->  -> File not found
(atapi) IDE Channel [Kernel | Boot | Running] ->  -> File not found
(bowser) bowser [File_System | On_Demand | Running] ->  -> File not found
(cdfs) CD/DVD File System Reader [File_System | Disabled | Running] ->  -> File not found
(cdrom) CD-ROM Driver [Kernel | System | Running] ->  -> File not found
(CLFS) Common Log (CLFS) [Kernel | Unknown | Running] ->  -> File not found
(CmBatt) Microsoft ACPI Control Method Battery Driver [Kernel | On_Demand | Running] ->  -> File not found
(Compbatt) Microsoft Composite Battery Driver [Kernel | Boot | Running] ->  -> File not found
(crcdisk) Crcdisk Filter Driver [Kernel | Boot | Running] ->  -> File not found
(DfsC) DFS Namespace Client Driver [File_System | System | Running] ->  -> File not found
(disk) Disk Driver [Kernel | Boot | Running] ->  -> File not found
(DXGKrnl) LDDM Graphics Subsystem [Kernel | On_Demand | Running] ->  -> File not found
(eamon) eamon [File_System | Auto | Running] ->  -> File not found
(Ecache) ReadyBoost Caching Driver [Kernel | Boot | Running] ->  -> File not found
(ehdrv) ehdrv [Kernel | System | Running] ->  -> File not found
(epfwwfpr) epfwwfpr [Kernel | Auto | Running] ->  -> File not found
(fastfat) FAT12/16/32 File System Driver [File_System | On_Demand | Running] ->  -> File not found
(FileInfo) File Information FS MiniFilter [File_System | Boot | Running] ->  -> File not found
(FltMgr) FltMgr [File_System | Boot | Running] ->  -> File not found
(FwLnk) FwLnk Driver [Kernel | On_Demand | Running] ->  -> File not found
(GEARAspiWDM) GEAR ASPI Filter Driver [Kernel | On_Demand | Running] ->  -> File not found
(HDAudBus) Microsoft UAA Bus Driver for High Definition Audio [Kernel | On_Demand | Running] ->  -> File not found
(HTTP) HTTP [Kernel | On_Demand | Running] ->  -> File not found
(i8042prt) i8042 Keyboard and PS/2 Mouse Port Driver [Kernel | System | Running] ->  -> File not found
(iaStor) Intel AHCI Controller [Kernel | Boot | Running] ->  -> File not found
(igfx) igfx [Kernel | On_Demand | Running] ->  -> File not found
(IntcAzAudAddService) Service for Realtek HD Audio (WDM) [Kernel | On_Demand | Running] ->  -> File not found
(intelide) intelide [Kernel | Boot | Running] ->  -> File not found
(intelppm) Intel Processor Driver [Kernel | On_Demand | Running] ->  -> File not found
(iScsiPrt) iScsiPort Driver [Kernel | On_Demand | Running] ->  -> File not found
(kbdclass) Keyboard Class Driver [Kernel | System | Running] ->  -> File not found
(KSecDD) KSecDD [Kernel | Boot | Running] ->  -> File not found
(ksthunk) Kernel Streaming Thunks [Kernel | On_Demand | Running] ->  -> File not found
(lltdio) Link-Layer Topology Discovery Mapper I/O Driver [Kernel | Auto | Running] ->  -> File not found
(luafv) UAC File Virtualization [File_System | Auto | Running] ->  -> File not found
(Modem) Modem [Kernel | On_Demand | Running] ->  -> File not found
(monitor) Microsoft Monitor Class Function Driver Service [Kernel | On_Demand | Running] ->  -> File not found
(mouclass) Mouse Class Driver [Kernel | System | Running] ->  -> File not found
(MountMgr) Mount Point Manager [Kernel | Boot | Running] ->  -> File not found
(mpsdrv) Windows Firewall Authorization Driver [Kernel | On_Demand | Running] -> C:\Windows\SysWow64\Wbem\mpsdrv.mof -> [2006/09/18 18:35:23 | 00,001,088 | —- | M] ()
(MRxDAV) WebDav Client Redirector Driver [File_System | On_Demand | Running] ->  -> File not found
(mrxsmb) SMB MiniRedirector Wrapper and Engine [File_System | On_Demand | Running] ->  -> File not found
(mrxsmb10) SMB 1.x MiniRedirector [File_System | On_Demand | Running] ->  -> File not found
(mrxsmb20) SMB 2.0 MiniRedirector [File_System | On_Demand | Running] ->  -> File not found
(msahci) msahci [Kernel | Boot | Running] ->  -> File not found
(Msfs) Msfs [File_System | System | Running] ->  -> File not found
(msisadrv) ISA/EISA Class Driver [Kernel | Boot | Running] ->  -> File not found
(mssmbios) Microsoft System Management BIOS Driver [Kernel | On_Demand | Running] ->  -> File not found
(Mup) Mup [File_System | Boot | Running] ->  -> File not found
(NativeWifiP) NativeWiFi Filter [Kernel | On_Demand | Running] ->  -> File not found
(NDIS) NDIS System Driver [Kernel | Boot | Running] ->  -> File not found
(NdisTapi) Remote Access NDIS TAPI Driver [Kernel | On_Demand | Running] ->  -> File not found
(Ndisuio) NDIS Usermode I/O Protocol [Kernel | On_Demand | Running] ->  -> File not found
(NdisWan) Remote Access NDIS WAN Driver [Kernel | On_Demand | Running] ->  -> File not found
(NDProxy) NDIS Proxy [Kernel | On_Demand | Running] ->  -> File not found
(NetBIOS) NetBIOS Interface [File_System | System | Running] ->  -> File not found
(netbt) netbt [Kernel | System | Running] ->  -> File not found
(NETw5v64) Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit [Kernel | On_Demand | Running] ->  -> File not found
(Npfs) Npfs [File_System | System | Running] ->  -> File not found
(nsiproxy) NSI proxy service [Kernel | System | Running] ->  -> File not found
(Ntfs) Ntfs [File_System | On_Demand | Running] ->  -> File not found
(Null) Null [Kernel | System | Running] ->  -> File not found
(ohci1394) RICOH OHCI Compliant IEEE 1394 Host Controller [Kernel | On_Demand | Running] ->  -> File not found
(partmgr) Partition Manager [Kernel | Boot | Running] ->  -> File not found
(pci) PCI Bus Driver [Kernel | Boot | Running] ->  -> File not found
(PEAUTH) PEAUTH [Kernel | Auto | Running] ->  -> File not found
(PptpMiniport) WAN Miniport (PPTP) [Kernel | On_Demand | Running] ->  -> File not found
(PSched) QoS Packet Scheduler [Kernel | System | Running] ->  -> File not found
(RasAcd) Remote Access Auto Connection Driver [Kernel | System | Running] ->  -> File not found
(Rasl2tp) WAN Miniport (L2TP) [Kernel | On_Demand | Running] ->  -> File not found
(RasPppoe) Remote Access PPPOE Driver [Kernel | On_Demand | Running] ->  -> File not found
(RasSstp) WAN Miniport (SSTP) [Kernel | On_Demand | Running] ->  -> File not found
(rdbss) Redirected Buffering Sub Sysytem [File_System | System | Running] ->  -> File not found
(RDPCDD) RDPCDD [Kernel | System | Running] ->  -> File not found
(RDPENCDD) RDP Encoder Mirror Driver [Kernel | System | Running] ->  -> File not found
(rimmptsk) rimmptsk [Kernel | Auto | Running] ->  -> File not found
(rimsptsk) rimsptsk [Kernel | Auto | Running] ->  -> File not found
(rismxdp) Ricoh xD-Picture Card Driver [Kernel | Auto | Running] ->  -> File not found
(rspndr) Link-Layer Topology Discovery Responder [Kernel | Auto | Running] ->  -> File not found
(RTL8169) Realtek 8169 NT Driver [Kernel | On_Demand | Running] ->  -> File not found
(sdbus) sdbus [Kernel | On_Demand | Running] ->  -> File not found
(secdrv) Security Driver [Kernel | Auto | Running] ->  -> File not found
(Smb) Message-oriented TCP/IP and TCP/IPv6 Protocol (SMB session) [Kernel | System | Running] ->  -> File not found
(spldr) Security Processor Loader Driver [Kernel | Boot | Running] ->  -> File not found
(srv) srv [File_System | On_Demand | Running] ->  -> File not found
(srv2) srv2 [File_System | On_Demand | Running] ->  -> File not found
(srvnet) srvnet [File_System | On_Demand | Running] ->  -> File not found
(swenum) Software Bus Driver [Kernel | On_Demand | Running] ->  -> File not found
(SynTP) Synaptics TouchPad Driver [Kernel | On_Demand | Running] ->  -> File not found
(Tcpip) TCP/IP Protocol Driver [Kernel | Boot | Running] -> C:\Windows\SysWow64\Wbem\tcpip.mof -> [2006/09/18 18:36:40 | 00,003,066 | —- | M] ()
(tcpipreg) TCP/IP Registry Compatibility [Kernel | Auto | Running] ->  -> File not found
(tdcmdpst) TOSHIBA Writing Engine Filter Driver [Kernel | On_Demand | Running] ->  -> File not found
(tdx) NetIO Legacy TDI Support Driver [Kernel | System | Running] ->  -> File not found
(TermDD) Terminal Device Driver [Kernel | System | Running] ->  -> File not found
(tosporte) Bluetooth COM Port [Kernel | On_Demand | Running] ->  -> File not found
(tosrfbd) Bluetooth RFBUS [Kernel | On_Demand | Running] ->  -> File not found
(tosrfbnp) Bluetooth RFBNEP [Kernel | On_Demand | Running] ->  -> File not found
(Tosrfcom) Bluetooth RFCOMM [Kernel | System | Running] ->  -> File not found
(tosrfec) Bluetooth ACPI [Kernel | On_Demand | Running] ->  -> File not found
(Tosrfhid) Bluetooth RFHID [Kernel | On_Demand | Running] ->  -> File not found
(tosrfnds) Bluetooth Personal Area Network [Kernel | On_Demand | Running] ->  -> File not found
(Tosrfusb) Bluetooth USB Controller [Kernel | On_Demand | Running] ->  -> File not found
(tos_sps64) TOSHIBA tos_sps64 Service [Kernel | Boot | Running] ->  -> File not found
(tunmp) Microsoft Tun Miniport Adapter Driver [Kernel | On_Demand | Running] ->  -> File not found
(tunnel) Microsoft IPv6 Tunnel Miniport Adapter Driver [Kernel | On_Demand | Running] ->  -> File not found
(TVALZ) TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver [Kernel | Boot | Running] ->  -> File not found
(umbus) UMBus Enumerator Driver [Kernel | On_Demand | Running] ->  -> File not found
(usbccgp) Microsoft USB Generic Parent Driver [Kernel | On_Demand | Running] ->  -> File not found
(usbehci) Microsoft USB 2.0 Enhanced Host Controller Miniport Driver [Kernel | On_Demand | Running] ->  -> File not found
(usbhub) USB2 Enabled Hub [Kernel | On_Demand | Running] ->  -> File not found
(usbuhci) Microsoft USB Universal Host Controller Miniport Driver [Kernel | On_Demand | Running] ->  -> File not found
(usbvideo) Chicony USB 2.0 Camera [Kernel | On_Demand | Running] ->  -> File not found
(UVCFTR) UVCFTR [Kernel | On_Demand | Running] ->  -> File not found
(VgaSave) VgaSave [Kernel | System | Running] ->  -> File not found
(volmgr) Volume Manager Driver [Kernel | Boot | Running] ->  -> File not found
(volmgrx) Dynamic Volume Manager [Kernel | Boot | Running] ->  -> File not found
(volsnap) Storage volumes [Kernel | Boot | Running] ->  -> File not found
(Wanarpv6) Remote Access IPv6 ARP Driver [Kernel | System | Running] ->  -> File not found
(Wdf01000) Kernel Mode Driver Frameworks service [Kernel | Boot | Running] ->  -> File not found
(winusb) WinUSB Service [Kernel | On_Demand | Stopped] -> C:\Windows\SysWow64\winusb.dll -> [2008/01/20 23:49:57 | 00,016,384 | —- | M] (Microsoft Corporation)
 
[Registry - Safe List]
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Page_URL" -> http://go.microsoft.com/fwlink/?LinkId=69157 -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Search_URL" -> http://go.microsoft.com/fwlink/?LinkId=54896 -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Secondary_Page_URL" ->  [binary data] -> 
HKEY_LOCAL_MACHINE\: Main\\"Extensions Off Page" -> about:NoAdd-ons -> 
HKEY_LOCAL_MACHINE\: Main\\"Local Page" -> %SystemRoot%\system32\blank.htm -> 
HKEY_LOCAL_MACHINE\: Main\\"Search Page" -> http://go.microsoft.com/fwlink/?LinkId=54896 -> 
HKEY_LOCAL_MACHINE\: Main\\"Security Risk Page" -> about:SecurityRisk -> 
HKEY_LOCAL_MACHINE\: Main\\"Start Page" -> http://go.microsoft.com/fwlink/?LinkId=69157 -> 
< Internet Explorer Settings [HKEY_USERS\.DEFAULT\] > -> -> 
HKEY_USERS\.DEFAULT\: "ProxyEnable" -> 0 -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-18\] > -> -> 
HKEY_USERS\S-1-5-18\: "ProxyEnable" -> 0 -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-19\] > -> -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-20\] > -> -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\] > -> -> 
HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\: Main\\"Local Page" -> C:\Windows\system32\blank.htm -> 
HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\: Main\\"Page_Transitions" -> 1 -> 
HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\: Main\\"Search Page" -> http://go.microsoft.com/fwlink/?LinkId=54896 -> 
HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\: Main\\"Start Page" -> http://www.google.ca/ -> 
HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\: "ProxyEnable" -> 0 -> 
< FireFox Settings [Prefs.js] > -> C:\Users\Matthew\AppData\Roaming\Mozilla\FireFox\Profiles\1hi03486.default\prefs.js -> 
extensions.enabledItems -> {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07 ->
extensions.enabledItems -> {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}:6.0.10 ->
extensions.enabledItems -> {20a82645-c095-46ed-80e3-08825760534b}:1.0 ->
extensions.enabledItems -> {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.10 ->
< FireFox Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla
HKLM\software\mozilla\Firefox\Extensions ->  -> 
HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b} -> C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION [C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION\] -> [2009/04/16 01:42:46 | 00,000,000 | —D | M]
HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions ->  -> 
HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\COMPONENTS [C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\COMPONENTS] -> [2009/06/02 03:01:33 | 00,000,000 | —D | M]
HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\PLUGINS [C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\PLUGINS] -> [2009/06/02 03:00:47 | 00,000,000 | —D | M]
HKLM\software\mozilla\Thunderbird\Extensions ->  -> 
HKLM\software\mozilla\Thunderbird\Extensions\\[removed] -> C:\PROGRAM FILES\ESET\ESET NOD32 ANTIVIRUS\MOZILLA THUNDERBIRD -> 
< FireFox Extensions [User Folders] > -> 
 -> C:\Users\Matthew\AppData\Roaming\mozilla\Extensions -> [2009/06/02 03:01:34 | 00,000,000 | —D | M]
 -> C:\Users\Matthew\AppData\Roaming\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} -> [2009/06/02 03:01:34 | 00,000,000 | —D | M]
 -> C:\Users\Matthew\AppData\Roaming\mozilla\Extensions\[removed] -> [2009/06/02 03:01:34 | 00,000,000 | —D | M]
 -> C:\Users\Matthew\AppData\Roaming\mozilla\Firefox\Profiles\1hi03486.default\extensions -> [2009/06/02 03:01:43 | 00,096,775 | —- | M] ()
< FireFox Extensions [Program Folders] > -> 
 -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\extensions -> [2009/04/24 01:38:29 | 09,756,664 | —- | M] (Mozilla Foundation)
 -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} -> [2009/04/24 01:38:29 | 09,756,664 | —- | M] (Mozilla Foundation)
 -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} -> [2009/04/24 01:38:29 | 09,756,664 | —- | M] (Mozilla Foundation)
 -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} -> [2009/04/24 01:38:29 | 09,756,664 | —- | M] (Mozilla Foundation)
< FireFox Components [Program Folders] > -> 
C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\components\ -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\components -> [2009/06/02 03:01:33 | 00,000,000 | —D | M]
browserdirprovider.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\components\browserdirprovider.dll -> [2009/04/24 01:38:30 | 00,023,032 | —- | M] (Mozilla Foundation)
brwsrcmp.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\components\brwsrcmp.dll -> [2009/04/24 01:38:32 | 00,134,648 | —- | M] (Mozilla Foundation)
zuebxmpskurwilbkw.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\components\zuebxmpskurwilbkw.dll -> [2009/04/17 10:45:40 | 00,425,472 | —- | M] ()
< FireFox Plugins [Program Folders] > -> 
C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\ -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins -> [2009/06/02 03:00:47 | 00,000,000 | —D | M]
np32dsw.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\np32dsw.dll -> [2008/11/04 11:15:38 | 00,114,688 | —- | M] (Adobe Systems, Inc.)
npdeploytk.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npdeploytk.dll -> [2008/11/25 21:48:29 | 00,410,976 | —- | M] (Sun Microsystems, Inc.)
npdivx32.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npdivx32.dll -> [2008/11/06 13:33:48 | 01,332,224 | —- | M] (DivX,Inc.)
npdivx32.xpt -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npdivx32.xpt -> [2008/11/06 13:33:50 | 00,001,607 | —- | M] ()
npDivxPlayerPlugin.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npDivxPlayerPlugin.dll -> [2008/12/10 21:33:34 | 00,098,304 | —- | M] (DivX, Inc)
npnul32.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npnul32.dll -> [2009/04/24 01:38:33 | 00,065,528 | —- | M] (mozilla.org)
NPOFFICE.DLL -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\NPOFFICE.DLL -> [2007/03/22 20:23:30 | 00,017,248 | —- | M] (Microsoft Corporation)
nppdf32.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\nppdf32.dll -> [2008/10/14 22:33:30 | 00,095,600 | —- | M] (Adobe Systems Inc.)
npqtplugin.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npqtplugin.dll -> [2009/04/07 16:34:49 | 00,143,360 | —- | M] (Apple Inc.)
npqtplugin2.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npqtplugin2.dll -> [2009/04/07 16:34:49 | 00,143,360 | —- | M] (Apple Inc.)
npqtplugin3.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npqtplugin3.dll -> [2009/04/07 16:34:49 | 00,143,360 | —- | M] (Apple Inc.)
npqtplugin4.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npqtplugin4.dll -> [2009/04/07 16:34:49 | 00,143,360 | —- | M] (Apple Inc.)
npqtplugin5.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npqtplugin5.dll -> [2009/04/07 16:34:49 | 00,143,360 | —- | M] (Apple Inc.)
npqtplugin6.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npqtplugin6.dll -> [2009/04/07 16:34:50 | 00,143,360 | —- | M] (Apple Inc.)
npqtplugin7.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npqtplugin7.dll -> [2009/04/07 16:34:50 | 00,143,360 | —- | M] (Apple Inc.)
npViewpoint.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npViewpoint.dll -> [2007/04/16 14:07:12 | 00,180,293 | —- | M] ()
npViewpoint.xpt -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npViewpoint.xpt -> [2006/10/09 15:26:35 | 00,000,266 | —- | M] ()
nsIDivxPlayerPlugin.xpt -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\nsIDivxPlayerPlugin.xpt -> [2008/11/06 13:34:08 | 00,000,297 | —- | M] ()
QuickTimePlugin.class -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\QuickTimePlugin.cla -> [2009/04/07 16:34:48 | 00,004,208 | —- | M] ()
ShockwavePlugin.class -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\ShockwavePlugin.cla -> [2008/11/04 10:38:58 | 00,001,144 | —- | M] ()
< FireFox SearchPlugins [Program Folders] > -> 
C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\searchplugins\ -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\searchplugins -> [2009/06/02 03:00:50 | 00,000,000 | —D | M]
amazondotcom.xml -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\searchplugins\amazondotcom.xml -> [2009/04/23 21:39:08 | 00,001,394 | —- | M] ()
answers.xml -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\searchplugins\answers.xml -> [2009/04/23 21:39:08 | 00,002,193 | —- | M] ()
creativecommons.xml -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\searchplugins\creativecommons.xml -> [2009/04/23 21:39:08 | 00,001,534 | —- | M] ()
eBay.xml -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\searchplugins\eBay.xml -> [2009/04/23 21:39:08 | 00,002,343 | —- | M] ()
google.xml -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\searchplugins\google.xml -> [2009/04/23 21:39:08 | 00,001,706 | —- | M] ()
wikipedia.xml -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\searchplugins\wikipedia.xml -> [2009/04/23 21:39:08 | 00,001,178 | —- | M] ()
yahoo.xml -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\searchplugins\yahoo.xml -> [2009/04/23 21:39:08 | 00,000,792 | —- | M] ()
Hosts file not found -> -> 
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> 
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [Adobe PDF Reader Link Helper] -> [2006/10/23 00:08:42 | 00,062,080 | —- | M] (Adobe Systems Incorporated)
{290B8CD4-D371-251B-ADE4-CF9A5A7D72D7} [HKLM] -> C:\Windows\SysWow64\zuebxmpskurwilbkw.dll [thesuperads search enhancer] -> [2009/05/28 13:43:08 | 00,442,880 | —- | M] ()
{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} [HKLM] -> C:\Program Files (x86)\Windows Live\Family Safety\fssbho.dll [Windows Live Family Safety Browser Helper Class] -> [2009/02/06 19:08:44 | 00,061,808 | —- | M] (Microsoft Corporation)
{5C255C8A-E604-49b4-9D64-90988571CECB} [HKLM] -> C:\Program Files (x86)\Windows Live\Messenger\wlchtc.dll [Click-to-Call BHO] -> [2009/02/06 19:21:00 | 00,073,072 | —- | M] (Microsoft Corporation)
{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} [HKLM] -> C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [Search Helper] -> [2009/05/19 11:36:18 | 00,137,600 | —- | M] (Microsoft Corporation)
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] -> C:\Program Files (x86)\Java\jre6\bin\ssv.dll [Java™ Plug-In SSV Helper] -> [2008/11/25 21:48:29 | 00,320,920 | —- | M] (Sun Microsystems, Inc.)
{9030D464-4C02-4ABF-8ECC-5164760863C6} [HKLM] -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [Windows Live Sign-in Helper] -> [2009/01/22 16:41:30 | 00,408,448 | —- | M] (Microsoft Corporation)
{DBC80044-A445-435b-BC74-9C25C1C588A9} [HKLM] -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [Java™ Plug-In 2 SSV Helper] -> [2008/11/25 21:48:29 | 00,034,816 | —- | M] (Sun Microsystems, Inc.)
{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} [HKLM] -> C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll [Windows Live Toolbar Helper] -> [2009/02/06 19:17:46 | 01,068,904 | —- | M] (Microsoft Corporation)
{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} [HKLM] -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [HP Smart BHO Class] -> [2007/11/06 01:50:44 | 00,542,016 | —- | M] (Hewlett-Packard Co.)
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar -> 
"{21FA44EF-376D-4D53-9B0F-8A89D3229068}" [HKLM] -> C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll [&Windows Live Toolbar] -> [2009/02/06 19:17:46 | 01,068,904 | —- | M] (Microsoft Corporation)
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\] > -> HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\Software\Microsoft\Internet Explorer\Toolbar\ -> 
WebBrowser\\"{21FA44EF-376D-4D53-9B0F-8A89D3229068}" [HKLM] -> C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll [&Windows Live Toolbar] -> [2009/02/06 19:17:46 | 01,068,904 | —- | M] (Microsoft Corporation)
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"{40AC1DC0-9C39-3D41-A5F3-4EC032BCFAF2}" -> C:\windows\Setup_ver1.1777.2.exe ["C:\windows\Setup_ver1.1777.2.exe" /r] -> File not found
"Adobe Reader Speed Launcher" -> C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe ["C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"] -> [2008/10/15 02:04:34 | 00,039,792 | —- | M] (Adobe Systems Incorporated)
"AppleSyncNotifier" -> C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe ["C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe"] -> [2008/09/03 20:12:50 | 00,111,936 | —- | M] (Apple Inc.)
"Camera Assistant Software" ->  ["C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start] -> File not found
"HP Software Update" -> C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe ["C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe"] -> [2007/10/14 21:17:32 | 00,049,152 | —- | M] (Hewlett-Packard)
"hpqSRMon" -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe ["C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe"] -> [2007/08/22 16:31:16 | 00,080,896 | —- | M] (Hewlett-Packard)
"ITSecMng" ->  ["%ProgramFiles(x86)%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" /START] -> File not found
"iTunesHelper" -> C:\Program Files (x86)\iTunes\iTunesHelper.exe ["C:\Program Files (x86)\iTunes\iTunesHelper.exe"] -> [2009/04/02 16:11:02 | 00,342,312 | —- | M] (Apple Inc.)
"QuickTime Task" -> C:\Program Files (x86)\QuickTime\QTTask.exe ["C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime] -> [2009/01/05 16:18:48 | 00,413,696 | —- | M] (Apple Inc.)
"SunJavaUpdateSched" -> C:\Program Files (x86)\Java\jre6\bin\jusched.exe ["C:\Program Files (x86)\Java\jre6\bin\jusched.exe"] -> [2008/11/25 21:48:29 | 00,136,600 | —- | M] (Sun Microsystems, Inc.)
< Run [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"Sidebar" -> C:\Program Files (x86)\Windows Sidebar\Sidebar.exe [%ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem] -> [2008/01/20 23:47:33 | 01,233,920 | —- | M] (Microsoft Corporation)
"WindowsWelcomeCenter" -> C:\Windows\SysWow64\oobefldr.dll [rundll32.exe oobefldr.dll,ShowWelcomeCenter] -> [2008/01/20 23:47:52 | 02,153,472 | —- | M] (Microsoft Corporation)
< Run [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"Sidebar" -> C:\Program Files (x86)\Windows Sidebar\Sidebar.exe [%ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem] -> [2008/01/20 23:47:33 | 01,233,920 | —- | M] (Microsoft Corporation)
"WindowsWelcomeCenter" -> C:\Windows\SysWow64\oobefldr.dll [rundll32.exe oobefldr.dll,ShowWelcomeCenter] -> [2008/01/20 23:47:52 | 02,153,472 | —- | M] (Microsoft Corporation)
< Run [HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\] > -> HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"Aim6" -> C:\Program Files (x86)\AIM6\aim6.exe ["C:\Program Files (x86)\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp] -> [2009/05/19 02:23:16 | 00,049,968 | —- | M] (AOL LLC)
"Lsass Service" -> C:\Users\Matthew\AppData\Roaming\Microsoft\Windows\lsass.exe [C:\Users\Matthew\AppData\Roaming\Microsoft\Windows\lsass.exe] -> File not found
"MsnMsgr" -> C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe ["C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background] -> [2009/02/06 19:51:28 | 03,885,408 | —- | M] (Microsoft Corporation)
"TOSCDSPD" -> C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe ["C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe"] -> [2008/01/29 21:46:38 | 00,432,640 | —- | M] (TOSHIBA)
< Software Policy Settings [HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003] > -> HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\SOFTWARE\Policies\Microsoft\Internet Explorer -> 
HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\Software\Policies\Microsoft\Internet Explorer\Restrictions
\Restrictions\\"NoBrowserContextMenu" ->  [1] -> File not found
< CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoActiveDesktop" ->  [1] -> File not found
\\"ForceActiveDesktopOn" ->  [0] -> File not found
\\"NoActiveDesktopChanges" ->  [0] -> File not found
< CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
\\"ConsentPromptBehaviorAdmin" ->  [2] -> File not found
\\"ConsentPromptBehaviorUser" ->  [1] -> File not found
\\"EnableInstallerDetection" ->  [1] -> File not found
\\"EnableLUA" ->  [0] -> File not found
\\"EnableSecureUIAPaths" ->  [1] -> File not found
\\"EnableVirtualization" ->  [1] -> File not found
\\"PromptOnSecureDesktop" ->  [1] -> File not found
\\"ValidateAdminCodeSignatures" ->  [0] -> File not found
\\"dontdisplaylastusername" ->  [0] -> File not found
\\"legalnoticecaption" ->  [] -> File not found
\\"legalnoticetext" ->  [] -> File not found
\\"scforceoption" ->  [0] -> File not found
\\"shutdownwithoutlogon" ->  [1] -> File not found
\\"undockwithoutlogon" ->  [1] -> File not found
\\"FilterAdministratorToken" ->  [0] -> File not found
\\"EnableUIADesktopToggle" ->  [0] -> File not found
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats
\UIPI\Clipboard\ExceptionFormats\\"CF_TEXT" ->  [1] -> File not found
\UIPI\Clipboard\ExceptionFormats\\"CF_BITMAP" ->  [2] -> File not found
\UIPI\Clipboard\ExceptionFormats\\"CF_OEMTEXT" ->  [7] -> File not found
\UIPI\Clipboard\ExceptionFormats\\"CF_DIB" ->  [8] -> File not found
\UIPI\Clipboard\ExceptionFormats\\"CF_PALETTE" ->  [9] -> File not found
\UIPI\Clipboard\ExceptionFormats\\"CF_UNICODETEXT" ->  [13] -> File not found
\UIPI\Clipboard\ExceptionFormats\\"CF_DIBV5" ->  [17] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003] > -> HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" ->  [145] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003] > -> HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 
HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
\\"disableregistrytools" ->  [0] -> File not found
< Internet Explorer Menu Extensions [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\MenuExt\ -> 
E&xport to Microsoft Excel -> C:\Program Files (x86)\Microsoft Office\OFFICE11\EXCEL.EXE [res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000] -> [2009/03/02 15:09:56 | 10,351,440 | —- | M] (Microsoft Corporation)
< Internet Explorer Menu Extensions [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\MenuExt\ -> 
E&xport to Microsoft Excel -> C:\Program Files (x86)\Microsoft Office\OFFICE11\EXCEL.EXE [res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000] -> [2009/03/02 15:09:56 | 10,351,440 | —- | M] (Microsoft Corporation)
< Internet Explorer Menu Extensions [HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\] > -> HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\Software\Microsoft\Internet Explorer\MenuExt\ -> 
E&xport to Microsoft Excel -> C:\Program Files (x86)\Microsoft Office\OFFICE11\EXCEL.EXE [res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000] -> [2009/03/02 15:09:56 | 10,351,440 | —- | M] (Microsoft Corporation)
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> 
{219C3416-8CB2-491a-A3C7-D9FCDDC9D600}:{5F7B1267-94A9-47F5-98DB-E99415F33AEC} [HKLM] -> C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll [Button: Blog This] -> [2009/02/06 19:07:54 | 00,187,248 | —- | M] (Microsoft Corporation)
{219C3416-8CB2-491a-A3C7-D9FCDDC9D600}:{5F7B1267-94A9-47F5-98DB-E99415F33AEC} [HKLM] -> C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll [Menu: &Blog This in Windows Live Writer] -> [2009/02/06 19:07:54 | 00,187,248 | —- | M] (Microsoft Corporation)
{92780B25-18CC-41C8-B9BE-3C9C571A8263}:{FF059E31-CC5A-4E2E-BF3B-96E929D65503} [HKLM] -> C:\Program Files (x86)\Microsoft Office\OFFICE11\REFIEBAR.DLL [Button: Research] -> [2007/04/19 15:10:18 | 00,063,840 | —- | M] (Microsoft Corporation)
{DDE87865-83C5-48c4-8357-2F5B1AA84522}:{DDE87865-83C5-48c4-8357-2F5B1AA84522} [HKLM] -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [Button: HP Smart Select] -> [2007/11/06 01:50:44 | 00,542,016 | —- | M] (Hewlett-Packard Co.)
< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> 
PluginsPageFriendlyName -> Microsoft ActiveX Gallery -> 
PluginsPage -> http://activex.microsoft.com/controls/find.asp?ext=%s&mime=%s -> 
< Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
"" -> http://
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 5440 domain(s) found. -> 
48 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 36 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 5440 domain(s) found. -> 
48 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 36 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 5440 domain(s) found. -> 
48 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 36 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\] > -> HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 5440 domain(s) found. -> 
48 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\] > -> HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-21-251947550-3473295051-1067243124-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 36 range(s) found. -> 
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> 
{166B1BCA-3F9C-11CF-8075-444553540000} [HKLM] -> http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab [Shockwave ActiveX Control] -> 
{67DABFBF-D0AB-41FA-9C46-CC0F21721616} [HKLM] -> http://download.divx.com/player/DivXBrowserPlugin.cab [DivXBrowserPlugin Object] -> 
{8AD9C840-044E-11D1-B3E9-00805F499D93} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab [Java Plug-in 1.6.0_10] -> 
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab [Java Plug-in 1.6.0_03] -> 
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab [Java Plug-in 1.6.0_07] -> 
{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab [Java Plug-in 1.6.0_10] -> 
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab [Java Plug-in 1.6.0_10] -> 
{D27CDB6E-AE6D-11CF-96B8-444553540000} [HKLM] -> http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab [Shockwave Flash Object] -> 
< Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ -> 
DhcpNameServer -> 192.168.0.1 -> 
< Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ -> 
{34D9904D-2B12-458C-BBCA-FFFED43CAF1B}\\DhcpNameServer -> 192.168.0.1   (Realtek RTL8102/8103 Family PCI-E FE NIC) -> 
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 
explorer.exe -> C:\Windows\SysWow64\explorer.exe -> [2008/10/29 03:29:41 | 02,927,104 | —- | M] (Microsoft Corporation)
*MultiFile Done* -> -> 
< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ -> 
igfxcui -> Reg Error: Value error. -> File not found
< Vista Public Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications -> 
< Vista Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications -> 
< Vista Active Firewall Rules > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules -> 
{026B04D8-07F1-4155-B8C0-9C0E8C247260} -> rport=1900 | profile=domain | protocol=17 | dir=out | action=allow | name=@firewallapi.dll,-31273 | app=%systemroot%\system32\svchost.exe | svc=ssdpsrv | 
{09B14AA5-5888-421B-8211-108E7D7A2886} -> lport=138 | profile=public | protocol=17 | dir=in | action=allow | name=@firewallapi.dll,-28527 | app=system | 
{18F23E0C-0EE9-459B-A2DC-832A4951F094} -> rport=137 | profile=public | protocol=17 | dir=out | action=allow | name=@firewallapi.dll,-28523 | app=system | 
{24472D4B-6E6F-4D6C-82D4-BB23097EF589} -> lport=137 | profile=public | protocol=17 | dir=in | action=allow | name=@firewallapi.dll,-28519 | app=system | 
{5F2D4AC4-B935-42BD-B1FF-D71735E8D484} -> lport=10243 | profile=private | protocol=6 | dir=in | action=allow | name=@firewallapi.dll,-31285 | app=system | 
{625961B2-EA7E-44E2-ABD1-4EAA9F70F5C6} -> lport=1900 | protocol=17 | dir=in | action=allow | name=windows live messenger (ssdp-in) | app=svchost.exe | svc=ssdpsrv | 
{62C42D6A-185F-456B-A156-2411F2F62A68} -> lport=2177 | profile=private | protocol=17 | dir=in | action=allow | name=@firewallapi.dll,-31253 | app=%systemroot%\system32\svchost.exe | svc=qwave | 
{6661D2DE-C6C7-4756-8D3A-FE432D141264} -> rport=10243 | profile=private | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-31289 | app=system | 
{6C2F17BD-7726-40B0-BAA0-F72E8130E307} -> lport=2869 | profile=domain | protocol=6 | dir=in | action=allow | name=@firewallapi.dll,-31277 | app=system | 
{6C5B3528-2535-4565-AB3E-0DAD168CD072} -> lport=2869 | protocol=6 | dir=in | action=allow | name=windows live messenger (upnp-in) | app=system | 
{8421A86D-22F2-43B6-972F-C206C1BEB3CC} -> lport=rpc-epmap | profile=public | protocol=6 | dir=in | action=allow | name=@firewallapi.dll,-28539 | svc=rpcss | 
{9851AC7B-5795-482F-ADDC-9234F1D4E46A} -> rport=139 | profile=public | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-28507 | app=system | 
{98EF8ECB-8256-4A70-A528-2C2F9686284F} -> rport=445 | profile=public | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-28515 | app=system | 
{A5D00D51-BC7C-451F-925B-985B69C7AA72} -> lport=rpc | profile=public | protocol=6 | dir=in | action=allow | name=@firewallapi.dll,-28535 | app=%systemroot%\system32\spoolsv.exe | svc=spooler | 
{A6C1E6EE-4E4E-414D-9FC8-F6427C042D71} -> rport=2177 | profile=private | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-31265 | app=%systemroot%\system32\svchost.exe | svc=qwave | 
{C169CA21-EEC7-47EE-9A84-F4366861373D} -> lport=445 | profile=public | protocol=6 | dir=in | action=allow | name=@firewallapi.dll,-28511 | app=system | 
{C4D22F80-8007-4FC2-9EC5-42FAA2327AD0} -> rport=138 | profile=public | protocol=17 | dir=out | action=allow | name=@firewallapi.dll,-28531 | app=system | 
{C88FAB1C-240D-48D3-893C-8BBAED461476} -> lport=2177 | profile=private | protocol=6 | dir=in | action=allow | name=@firewallapi.dll,-31261 | app=%systemroot%\system32\svchost.exe | svc=qwave | 
{E893112B-5429-46BB-8509-46082CA4809B} -> lport=139 | profile=public | protocol=6 | dir=in | action=allow | name=@firewallapi.dll,-28503 | app=system | 
{EC02BFCB-0835-43E2-805E-700735B56830} -> lport=1900 | profile=domain | protocol=17 | dir=in | action=allow | name=@firewallapi.dll,-31269 | app=%systemroot%\system32\svchost.exe | svc=ssdpsrv | 
{F59B33AC-5339-4A58-AC9F-3F65BB290035} -> rport=2177 | profile=private | protocol=17 | dir=out | action=allow | name=@firewallapi.dll,-31257 | app=%systemroot%\system32\svchost.exe | svc=qwave | 
< Vista Active Application Exception Rules > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules -> 
{0FF2DDA3-9739-4962-B966-EF5E65F0A03D} -> profile=public | protocol=17 | dir=in | action=allow | name=limewire | app=c:\program files (x86)\limewire\limewire.exe | 
{12D38B7B-B683-4365-814A-6D18CB86179B} -> profile=public | protocol=6 | dir=in | action=allow | name=limewire | app=c:\program files (x86)\limewire\limewire.exe | 
{13729EE6-A8C1-4BAE-8EDE-D50238530C49} -> profile=domain | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-31281 | app=system | 
{1469AA26-A303-4A3A-9FFE-42D496A22561} -> profile=domain | protocol=17 | dir=out | action=allow | name=@firewallapi.dll,-31007 | app=%programfiles%\windows media player\wmplayer.exe | 
{17729AA0-0EAC-425A-9A40-B303F3E5DB8B} -> profile=private | protocol=17 | dir=out | action=allow | name=@firewallapi.dll,-31297 | app=%programfiles%\windows media player\wmplayer.exe | 
{1860C9A0-75B3-4A9A-9456-F7635E1A5F6B} -> profile=domain | protocol=17 | dir=in | action=allow | name=@firewallapi.dll,-31003 | app=%programfiles%\windows media player\wmplayer.exe | 
{1959F471-BB1F-42D9-AB02-9CB8F9769CEB} -> profile=domain | protocol=17 | dir=out | action=allow | name=@firewallapi.dll,-31024 | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
{22D57937-3E46-4CAD-9D81-E4200B97ED6A} -> profile=private | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-31325 | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
{23C235B4-2386-4E8F-9032-285CACB0CDAC} -> profile=private | protocol=6 | dir=in | action=allow | name=limewire | app=c:\program files (x86)\limewire\limewire.exe | 
{2D44B30A-17B8-4F02-8F0C-22CA53367554} -> profile=public | protocol=58 | dir=in | action=allow | name=@firewallapi.dll,-28545 | 
{314B7E78-9064-4BA1-B064-399B744DE164} -> profile=public | protocol=17 | dir=in | action=allow | name=frostwire | app=c:\program files (x86)\frostwire\frostwire.exe | 
{34AC08F2-7522-489B-BDFD-F1452D7494BC} -> profile=private | protocol=17 | dir=in | action=allow | name=@firewallapi.dll,-31293 | app=%programfiles%\windows media player\wmplayer.exe | 
{351BBDF7-D889-457D-AC7D-1080863C885A} -> profile=domain | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-31025 | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
{36B1EF47-9E1D-4713-A147-FB75A5AA698D} -> profile=private | protocol=17 | dir=out | action=allow | name=@firewallapi.dll,-31324 | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
{3F89811C-0EEE-4AE0-A7DA-84378B2D8E1B} -> profile=public | protocol=6 | dir=in | action=allow | name=bonjour | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
{497B5FA4-E09F-4EC0-A9B5-2082BB8BB009} -> profile=private | protocol=17 | dir=in | action=allow | name=@firewallapi.dll,-31323 | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
{4C5E2C13-7D73-455E-BD86-1949D7F0527F} -> profile=public | protocol=17 | dir=in | action=allow | name=itunes | app=c:\program files (x86)\itunes\itunes.exe | 
{53B0D293-4F4D-4122-BFCE-41A9D11A8C4D} -> profile=private | protocol=17 | dir=in | action=allow | name=@firewallapi.dll,-31305 | app=%programfiles%\windows media player\wmpnetwk.exe | 
{569F7401-36D5-4B99-A2AA-E8A38007729A} -> profile=public | protocol=58 | dir=out | action=allow | name=@firewallapi.dll,-28546 | 
{5F2CF640-F9C8-4FC3-8FFF-75A55B95AACE} -> profile=private | protocol=6 | dir=in | action=allow | name=aol loader | app=c:\program files (x86)\common files\aol\loader\aolload.exe | 
{61999A8A-325F-44A5-9C5A-AFA6CF529810} -> profile=private | protocol=17 | dir=out | action=allow | name=@firewallapi.dll,-31309 | app=%programfiles%\windows media player\wmpnetwk.exe | 
{69CBE225-BA0C-4CC1-A811-8A62EE638E31} -> profile=public | protocol=6 | dir=in | action=allow | name=frostwire | app=c:\program files (x86)\frostwire\frostwire.exe | 
{6B72B525-FBC5-45AE-A2D3-D2DD368DE950} -> profile=domain | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-31011 | app=%programfiles%\windows media player\wmplayer.exe | 
{6B747258-FC48-4B1F-B2CC-961591BD4BC6} -> profile=private | protocol=6 | dir=in | action=allow | name=bonjour | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
{832D7DCF-DCB4-4890-A294-C6A3E48D2C5B} -> profile=domain | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-31321 | app=%systemroot%\system32\svchost.exe | svc=upnphost | 
{874B1713-4142-454E-A0AB-71C482C206E0} -> dir=in | action=allow | name=windows live messenger | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
{8BAC637F-2285-4E81-A2D1-8ACEB2D92838} -> profile=private | protocol=6 | dir=in | action=allow | name=frostwire | app=c:\program files (x86)\frostwire\frostwire.exe | 
{8E6F4DB8-D0BB-4614-83BE-92F677A468E4} -> profile=public | protocol=17 | dir=in | action=allow | name=μtorrent (udp-in) | app=c:\program files (x86)\utorrent\utorrent.exe | 
{904CBEF0-4927-4869-AC21-9CF11B8D80CD} -> profile=private | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-31317 | app=%programfiles%\windows media player\wmpnetwk.exe | 
{9A293E5B-F310-43F4-8B05-19DB34C129EF} -> profile=domain | protocol=17 | dir=in | action=allow | name=@firewallapi.dll,-31023 | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
{9A686AC4-3414-453E-B7E9-0F029610AB75} -> profile=private | protocol=17 | dir=in | action=allow | name=bonjour | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
{9B711B43-5AD8-421E-82E9-30A90A8AE5B4} -> dir=in | action=allow | name=skype | app=c:\program files (x86)\skype\phone\skype.exe | 
{A2561A9F-976A-4A2E-8D9A-BCB486B7A47C} -> profile=private | protocol=17 | dir=in | action=allow | name=aim | app=c:\program files (x86)\aim6\aim6.exe | 
{A79600E0-0C4D-40D3-82ED-4AD2A47D0530} -> profile=private | protocol=6 | dir=in | action=allow | name=aim | app=c:\program files (x86)\aim6\aim6.exe | 
{AEC24A3F-E294-4593-9F74-D197B1911279} -> profile=public | protocol=1 | dir=out | action=allow | name=@firewallapi.dll,-28544 | 
{B18E3EE9-5180-4103-9DAC-AC409CC739BD} -> profile=public | protocol=1 | dir=in | action=allow | name=@firewallapi.dll,-28543 | 
{B389010B-C327-4A1D-AD47-7BBB09EF576E} -> profile=private | protocol=6 | dir=in | action=allow | name=itunes | app=c:\program files (x86)\itunes\itunes.exe | 
{C2BDB1A1-4561-41CC-84CF-B0616B5EA532} -> profile=private | protocol=17 | dir=in | action=allow | name=frostwire | app=c:\program files (x86)\frostwire\frostwire.exe | 
{CC308685-1AD0-4926-A1FF-2C1F1686FD9D} -> profile=public | protocol=17 | dir=in | action=allow | name=bonjour | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
{E1290CC4-3F56-4462-BBBE-AF48392092BD} -> dir=in | action=allow | name=windows live sync | app=c:\program files (x86)\windows live\sync\windowslivesync.exe | 
{E2ABD1DC-64D3-4EEB-8375-E3C4690CF880} -> profile=private | protocol=17 | dir=in | action=allow | name=aol loader | app=c:\program files (x86)\common files\aol\loader\aolload.exe | 
{E87C0CA8-67EB-4061-B9A0-2AF807DD7076} -> profile=private | protocol=6 | dir=in | action=allow | name=@firewallapi.dll,-31313 | app=%programfiles%\windows media player\wmpnetwk.exe | 
{E8A44A38-DF40-4689-9FE8-673958AFC83B} -> profile=public | protocol=6 | dir=in | action=allow | name=itunes | app=c:\program files (x86)\itunes\itunes.exe | 
{EAB60A60-1C50-4A5D-95EC-9C25B78A7556} -> profile=private | protocol=6 | dir=out | action=allow | name=@firewallapi.dll,-31301 | app=%programfiles%\windows media player\wmplayer.exe | 
{ECA4E29E-3448-4B01-A9E8-32FD89C85A4C} -> profile=private | protocol=17 | dir=in | action=allow | name=itunes | app=c:\program files (x86)\itunes\itunes.exe | 
{F3234326-E49B-4277-A71A-B111CF28224A} -> profile=private | protocol=17 | dir=in | action=allow | name=limewire | app=c:\program files (x86)\limewire\limewire.exe | 
{F7EA0F64-FB5D-4690-8637-3085D7BEED5E} -> profile=public | protocol=6 | dir=in | action=allow | name=μtorrent (tcp-in) | app=c:\program files (x86)\utorrent\utorrent.exe | 
TCP Query User{0A8D5ED1-4950-4245-AA19-57980AD8BAA7}C:\program files (x86)\mirc\mirc.exe -> profile=public | protocol=6 | dir=in | action=allow | name=mirc | app=c:\program files (x86)\mirc\mirc.exe | 
TCP Query User{2E879216-AF42-41F5-8DAA-3D2AAECD020E}C:\program files (x86)\utorrent\utorrent.exe -> profile=private | protocol=6 | dir=in | action=allow | name=μtorrent | app=c:\program files (x86)\utorrent\utorrent.exe | 
TCP Query User{406210D8-C038-4034-A995-F4A979867D20}C:\program files (x86)\mirc\mirc.exe -> profile=private | protocol=6 | dir=in | action=allow | name=mirc | app=c:\program files (x86)\mirc\mirc.exe | 
TCP Query User{63C901F2-50CC-4650-AC16-05B9C5B58C09}C:\program files (x86)\dc++\dcplusplus.exe -> profile=private | protocol=6 | dir=in | action=allow | name=dc++ | app=c:\program files (x86)\dc++\dcplusplus.exe | 
TCP Query User{6BED788D-93F2-4262-AD34-2EB1A0D4F305}C:\program files (x86)\internet explorer\iexplore.exe -> profile=private | protocol=6 | dir=in | action=allow | name=internet explorer | app=c:\program files (x86)\internet explorer\iexplore.exe | 
TCP Query User{81CC6FB2-BDEA-4AB3-A78D-53471307210A}C:\program files (x86)\dc++\dcplusplus.exe -> profile=public | protocol=6 | dir=in | action=allow | name=dc++ | app=c:\program files (x86)\dc++\dcplusplus.exe | 
UDP Query User{3F275E09-79F0-493F-942E-B56A7BC5471E}C:\program files (x86)\mirc\mirc.exe -> profile=private | protocol=17 | dir=in | action=allow | name=mirc | app=c:\program files (x86)\mirc\mirc.exe | 
UDP Query User{4FB32A46-A961-4446-8970-A7A8586E71A4}C:\program files (x86)\internet explorer\iexplore.exe -> profile=private | protocol=17 | dir=in | action=allow | name=internet explorer | app=c:\program files (x86)\internet explorer\iexplore.exe | 
UDP Query User{57524FD3-81EF-4B67-AE34-818673892A72}C:\program files (x86)\dc++\dcplusplus.exe -> profile=public | protocol=17 | dir=in | action=allow | name=dc++ | app=c:\program files (x86)\dc++\dcplusplus.exe | 
UDP Query User{B62643D3-07E3-4391-8B06-47E0FC6242AB}C:\program files (x86)\utorrent\utorrent.exe -> profile=private | protocol=17 | dir=in | action=allow | name=μtorrent | app=c:\program files (x86)\utorrent\utorrent.exe | 
UDP Query User{D614B21D-E8DC-48A6-8283-2D0F375DAF30}C:\program files (x86)\mirc\mirc.exe -> profile=public | protocol=17 | dir=in | action=allow | name=mirc | app=c:\program files (x86)\mirc\mirc.exe | 
UDP Query User{FDF31C35-DBD3-4C41-AE74-0C426E0234DA}C:\program files (x86)\dc++\dcplusplus.exe -> profile=private | protocol=17 | dir=in | action=allow | name=dc++ | app=c:\program files (x86)\dc++\dcplusplus.exe | 
< SafeBoot AlternateShell [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot -> 
"AlternateShell" -> cmd.exe -> 
< CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom ->
"AutoRun" -> 1 -> 
"DisplayName" -> CD-ROM Driver -> 
"ImagePath" -> C:\Windows\SysNative\DRIVERS\cdrom.sys [system32\DRIVERS\cdrom.sys] -> [2008/01/20 23:46:54 | 00,079,872 | —- | M] ()
< MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 -> 
\{a505efde-66d4-11dd-8e0e-001e33422a4f}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a505efde-66d4-11dd-8e0e-001e33422a4f}\shell
\{a505efde-66d4-11dd-8e0e-001e33422a4f}\shell\\"" ->  [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a505efde-66d4-11dd-8e0e-001e33422a4f}\shell\AutoRun\command
\{a505efde-66d4-11dd-8e0e-001e33422a4f}\shell\AutoRun\command\\"" -> G:\LaunchU3.exe [G:\LaunchU3.exe] -> File not found
 
[Registry - Additional Scans - Safe List]
< EventViewer Logs - Last 10 Errors > -> Event Information -> Description
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
[Files/Folders - Created Within 30 Days]
_OTS -> C:\_OTS -> [2009/06/04 03:40:01 | 00,000,000 | —D | C]
OTS.exe -> C:\Users\Matthew\Desktop\OTS.exe -> [2009/06/04 03:35:02 | 00,505,344 | —- | C] (OldTimer Tools)
HijackThis.lnk -> C:\Users\Matthew\Desktop\HijackThis.lnk -> [2009/06/02 16:33:34 | 00,001,939 | —- | C] ()
Trend Micro -> C:\Program Files (x86)\Trend Micro -> [2009/06/02 16:33:33 | 00,000,000 | —D | C]
~$ginner workout.doc -> C:\Users\Matthew\Documents\~$ginner workout.doc -> [2009/06/02 14:15:33 | 00,000,162 | -H– | C] ()
Mozilla Firefox.lnk -> C:\Users\Public\Desktop\Mozilla Firefox.lnk -> [2009/06/02 03:00:51 | 00,001,789 | —- | C] ()
zuebxmpskurwilbkw.dll-uninst.exe -> C:\Windows\SysWow64\zuebxmpskurwilbkw.dll-uninst.exe -> [2009/06/01 12:52:16 | 00,060,766 | —- | C] ()
ComboFix -> C:\ComboFix -> [2009/06/01 01:28:21 | 00,000,000 | —D | C]
CF4071.exe -> C:\Windows\SysWow64\CF4071.exe -> [2009/06/01 01:28:20 | 00,318,976 | —- | C] (Microsoft Corporation)
swsc.exe -> C:\Windows\SysWow64\swsc.exe -> [2009/06/01 01:28:15 | 00,031,744 | —- | C] (Microsoft Corporation)
Qoobox -> C:\Qoobox -> [2009/06/01 01:28:12 | 00,000,000 | —D | C]
cmd.execf -> C:\Windows\SysWow64\cmd.execf -> [2009/06/01 01:28:09 | 00,318,976 | —- | C] (Microsoft Corporation)
Malwarebytes -> C:\Users\Matthew\AppData\Roaming\Malwarebytes -> [2009/06/01 01:12:25 | 00,000,000 | —D | C]
Malwarebytes' Anti-Malware.lnk -> C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk -> [2009/06/01 01:12:21 | 00,000,859 | —- | C] ()
mbamswissarmy.sys -> C:\Windows\SysWow64\drivers\mbamswissarmy.sys -> [2009/06/01 01:12:18 | 00,040,160 | —- | C] (Malwarebytes Corporation)
Malwarebytes -> C:\ProgramData\Malwarebytes -> [2009/06/01 01:12:17 | 00,000,000 | —D | C]
Malwarebytes' Anti-Malware -> C:\Program Files (x86)\Malwarebytes' Anti-Malware -> [2009/06/01 01:12:16 | 00,000,000 | —D | C]
ESET -> C:\Users\Matthew\AppData\Local\ESET -> [2009/06/01 00:07:11 | 00,000,000 | —D | C]
ESET -> C:\ProgramData\ESET -> [2009/06/01 00:03:10 | 00,000,000 | —D | C]
aswBoot.exe -> C:\Windows\SysWow64\aswBoot.exe -> [2009/05/29 14:38:27 | 01,256,296 | —- | C] (ALWIL Software)
zuebxmpskurwilbkw.dll -> C:\Windows\SysWow64\zuebxmpskurwilbkw.dll -> [2009/05/28 13:43:08 | 00,442,880 | —- | C] ()
Beginner workout.doc -> C:\Users\Matthew\Documents\Beginner workout.doc -> [2009/05/28 02:41:25 | 00,025,600 | —- | C] ()
n508122880_91368_4168.jpg -> C:\Users\Matthew\Desktop\n508122880_91368_4168.jpg -> [2009/05/22 04:49:37 | 00,064,664 | —- | C] ()
n508122880_91350_9979.jpg -> C:\Users\Matthew\Desktop\n508122880_91350_9979.jpg -> [2009/05/22 04:48:55 | 00,064,022 | —- | C] ()
n508122880_91351_206.jpg -> C:\Users\Matthew\Desktop\n508122880_91351_206.jpg -> [2009/05/22 04:48:48 | 00,069,041 | —- | C] ()
n508122880_91353_664.jpg -> C:\Users\Matthew\Desktop\n508122880_91353_664.jpg -> [2009/05/22 04:48:37 | 00,056,171 | —- | C] ()
n501991489_298136_9682.jpg -> C:\Users\Matthew\Desktop\n501991489_298136_9682.jpg -> [2009/05/22 04:45:40 | 00,053,901 | —- | C] ()
n501991489_298156_4660.jpg -> C:\Users\Matthew\Desktop\n501991489_298156_4660.jpg -> [2009/05/22 04:45:17 | 00,067,062 | —- | C] ()
acccore -> C:\Users\Matthew\AppData\Roaming\acccore -> [2009/05/21 15:59:15 | 00,000,000 | —D | C]
AOL OCP -> C:\Users\Matthew\AppData\Local\AOL OCP -> [2009/05/21 15:59:06 | 00,000,000 | —D | C]
AOL -> C:\Users\Matthew\AppData\Local\AOL -> [2009/05/21 15:59:06 | 00,000,000 | —D | C]
Viewpoint -> C:\ProgramData\Viewpoint -> [2009/05/21 15:58:55 | 00,000,000 | —D | C]
Viewpoint -> C:\Program Files (x86)\Viewpoint -> [2009/05/21 15:58:55 | 00,000,000 | —D | C]
acccore -> C:\ProgramData\acccore -> [2009/05/21 15:58:54 | 00,000,000 | —D | C]
AIM 6.lnk -> C:\Users\Public\Desktop\AIM 6.lnk -> [2009/05/21 15:58:51 | 00,001,821 | —- | C] ()
AOL OCP -> C:\ProgramData\AOL OCP -> [2009/05/21 15:58:46 | 00,000,000 | —D | C]
AOL -> C:\ProgramData\AOL -> [2009/05/21 15:58:46 | 00,000,000 | —D | C]
AOL -> C:\Program Files (x86)\Common Files\AOL -> [2009/05/21 15:58:32 | 00,000,000 | —D | C]
AIM6 -> C:\Program Files (x86)\AIM6 -> [2009/05/21 15:58:18 | 00,000,000 | —D | C]
IPH.PH -> C:\IPH.PH -> [2009/05/21 15:58:15 | 00,000,365 | -H– | C] ()
LimeWire PRO 5.1.2.lnk -> C:\Users\Matthew\Desktop\LimeWire PRO 5.1.2.lnk -> [2009/05/18 13:41:05 | 00,001,773 | —- | C] ()
4161_81444159316_511309316_1811267_2652649_n.jpg -> C:\Users\Matthew\Desktop\4161_81444159316_511309316_1811267_2652649_n.jpg -> [2009/05/16 14:02:42 | 00,025,911 | —- | C] ()
RECYCLER -> C:\RECYCLER -> [2009/05/13 12:40:14 | 00,000,000 | RHSD | C]
mIRC.lnk -> C:\Users\Public\Desktop\mIRC.lnk -> [2009/05/12 11:17:32 | 00,000,801 | —- | C] ()
ezsidmv.dat -> C:\Windows\SysWow64\ezsidmv.dat -> [2009/05/08 03:34:24 | 00,000,056 | -H– | C] ()
skypePM -> C:\Users\Matthew\AppData\Roaming\skypePM -> [2009/05/08 03:34:23 | 00,000,000 | —D | C]
Skype -> C:\ProgramData\Skype -> [2009/05/05 23:52:30 | 00,000,000 | —D | C]
tosOBEX.INI -> C:\Windows\tosOBEX.INI -> [2008/12/25 03:28:01 | 00,000,000 | —- | C] ()
WirelessFTP.INI -> C:\Windows\WirelessFTP.INI -> [2008/12/25 03:20:17 | 00,000,097 | —- | C] ()
qt-dx331.dll -> C:\Windows\SysWow64\qt-dx331.dll -> [2008/11/06 13:37:32 | 03,596,288 | —- | C] ()
dtu100.dll.manifest -> C:\Windows\SysWow64\dtu100.dll.manifest -> [2008/11/06 13:34:00 | 00,000,416 | —- | C] ()
dpl100.dll.manifest -> C:\Windows\SysWow64\dpl100.dll.manifest -> [2008/11/06 13:34:00 | 00,000,416 | —- | C] ()
DivXWMPExtType.dll -> C:\Windows\SysWow64\DivXWMPExtType.dll -> [2008/11/06 13:33:02 | 00,012,288 | —- | C] ()
ODBC.INI -> C:\Windows\ODBC.INI -> [2008/08/10 17:14:19 | 00,000,376 | —- | C] ()
IVIresizeW7.dll -> C:\Windows\SysWow64\IVIresizeW7.dll -> [2008/08/09 04:03:13 | 00,204,800 | —- | C] ()
IVIresizeA6.dll -> C:\Windows\SysWow64\IVIresizeA6.dll -> [2008/08/09 04:03:13 | 00,200,704 | —- | C] ()
IVIresizeP6.dll -> C:\Windows\SysWow64\IVIresizeP6.dll -> [2008/08/09 04:03:13 | 00,192,512 | —- | C] ()
IVIresizeM6.dll -> C:\Windows\SysWow64\IVIresizeM6.dll -> [2008/08/09 04:03:13 | 00,192,512 | —- | C] ()
IVIresizePX.dll -> C:\Windows\SysWow64\IVIresizePX.dll -> [2008/08/09 04:03:13 | 00,188,416 | —- | C] ()
IVIresize.dll -> C:\Windows\SysWow64\IVIresize.dll -> [2008/08/09 04:03:13 | 00,020,480 | —- | C] ()
csellang.ini -> C:\Windows\SysWow64\csellang.ini -> [2008/08/09 03:41:49 | 00,128,113 | —- | C] ()
csellang.dll -> C:\Windows\SysWow64\csellang.dll -> [2008/08/09 03:41:49 | 00,045,056 | —- | C] ()
cseltbl.ini -> C:\Windows\SysWow64\cseltbl.ini -> [2008/08/09 03:41:49 | 00,007,671 | —- | C] ()
PerfStringBackup.INI -> C:\Windows\SysWow64\PerfStringBackup.INI -> [2008/02/18 19:51:55 | 00,700,730 | —- | C] ()
NDSTray.INI -> C:\Windows\NDSTray.INI -> [2008/02/18 19:34:25 | 00,000,000 | —- | C] ()
igmedkrn.dll -> C:\Windows\SysWow64\igmedkrn.dll -> [2008/02/11 21:56:03 | 01,238,832 | —- | C] ()
igmedcompkrn.dll -> C:\Windows\SysWow64\igmedcompkrn.dll -> [2008/02/11 21:56:03 | 00,104,636 | —- | C] ()
tcpmon.ini -> C:\Windows\SysWow64\tcpmon.ini -> [2008/01/20 23:50:05 | 00,060,124 | —- | C] ()
msjetoledb40.dll -> C:\Windows\SysWow64\msjetoledb40.dll -> [2008/01/20 23:49:49 | 00,368,640 | —- | C] ()
TosBtAcc.dll -> C:\Windows\SysWow64\TosBtAcc.dll -> [2007/12/21 21:46:32 | 00,118,784 | —- | C] ()
win.ini -> C:\Windows\win.ini -> [2006/11/02 09:34:27 | 00,000,387 | —- | C] ()
system.ini -> C:\Windows\system.ini -> [2006/11/02 09:34:27 | 00,000,219 | —- | C] ()
TosCommAPI.dll -> C:\Windows\SysWow64\TosCommAPI.dll -> [2005/07/23 02:30:18 | 00,065,536 | —- | C] ()
OUTLPERF.INI -> C:\Windows\SysWow64\OUTLPERF.INI -> [2003/01/07 15:05:08 | 00,002,695 | —- | C] ()
 
[Files/Folders - Modified Within 30 Days]
1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> 
NTUSER.DAT -> C:\Users\Matthew\NTUSER.DAT -> [2009/06/04 03:40:41 | 05,505,024 | -HS- | M] ()
qmgr1.dat -> C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat -> [2009/06/04 03:38:50 | 04,194,304 | —- | M] ()
qmgr0.dat -> C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat -> [2009/06/04 03:38:50 | 04,194,304 | —- | M] ()
OTS.exe -> C:\Users\Matthew\Desktop\OTS.exe -> [2009/06/04 03:35:28 | 00,505,344 | —- | M] (OldTimer Tools)
zuebxmpskurwilbkw.dll-uninst.exe -> C:\Windows\SysWow64\zuebxmpskurwilbkw.dll-uninst.exe -> [2009/06/04 03:26:43 | 00,060,766 | —- | M] ()
PublishedRacMonSWITable.DAT -> C:\ProgramData\Microsoft\RAC\PublishedData\PublishedRacMonSWITable.DAT -> [2009/06/04 00:11:04 | 00,172,388 | —- | M] ()
PublishedRacMonAFLTable.DAT -> C:\ProgramData\Microsoft\RAC\PublishedData\PublishedRacMonAFLTable.DAT -> [2009/06/04 00:11:04 | 00,062,928 | —- | M] ()
PublishedRacMonOSFTable.DAT -> C:\ProgramData\Microsoft\RAC\PublishedData\PublishedRacMonOSFTable.DAT -> [2009/06/04 00:11:04 | 00,011,316 | —- | M] ()
PublishedRacMonIndex.DAT -> C:\ProgramData\Microsoft\RAC\PublishedData\PublishedRacMonIndex.DAT -> [2009/06/04 00:11:04 | 00,007,176 | —- | M] ()
PublishedRacMonHFLTable.DAT -> C:\ProgramData\Microsoft\RAC\PublishedData\PublishedRacMonHFLTable.DAT -> [2009/06/04 00:11:04 | 00,000,000 | —- | M] ()
PublishedRacMonCLKTable.DAT -> C:\ProgramData\Microsoft\RAC\PublishedData\PublishedRacMonCLKTable.DAT -> [2009/06/04 00:11:04 | 00,000,000 | —- | M] ()
iTunes.lnk -> C:\Users\Public\Desktop\iTunes.lnk -> [2009/06/02 18:52:40 | 00,002,255 | —- | M] ()
HijackThis.lnk -> C:\Users\Matthew\Desktop\HijackThis.lnk -> [2009/06/02 16:33:34 | 00,001,939 | —- | M] ()
GlaryInitialize.job -> C:\Windows\tasks\GlaryInitialize.job -> [2009/06/02 16:22:40 | 00,000,328 | —- | M] ()
SA.DAT -> C:\Windows\tasks\SA.DAT -> [2009/06/02 15:55:06 | 00,000,006 | -H– | M] ()
bootstat.dat -> C:\Windows\bootstat.dat -> [2009/06/02 15:54:59 | 00,067,584 | –S- | M] ()
~$ginner workout.doc -> C:\Users\Matthew\Documents\~$ginner workout.doc -> [2009/06/02 14:15:33 | 00,000,162 | -H– | M] ()
Mozilla Firefox.lnk -> C:\Users\Public\Desktop\Mozilla Firefox.lnk -> [2009/06/02 03:00:51 | 00,001,789 | —- | M] ()
DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> C:\Users\Matthew\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> [2009/06/01 13:23:09 | 00,071,168 | —- | M] ()
MEMORY.DMP -> C:\Windows\MEMORY.DMP -> [2009/06/01 12:56:13 | 48,140,5099 | —- | M] ()
cmd.execf -> C:\Windows\SysWow64\cmd.execf -> [2009/06/01 01:28:09 | 00,318,976 | —- | M] (Microsoft Corporation)
CF4071.exe -> C:\Windows\SysWow64\CF4071.exe -> [2009/06/01 01:28:09 | 00,318,976 | —- | M] (Microsoft Corporation)
NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TMContainer00000000000000000001.regtrans-ms -> C:\Users\Matthew\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TMContainer00000000000000000001.regtrans-ms -> [2009/06/01 01:16:55 | 00,524,288 | -HS- | M] ()
NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TM.blf -> C:\Users\Matthew\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TM.blf -> [2009/06/01 01:16:55 | 00,065,536 | -HS- | M] ()
IconCache.db -> C:\Users\Matthew\AppData\Local\IconCache.db -> [2009/06/01 01:16:53 | 06,291,456 | -H– | M] ()
Malwarebytes' Anti-Malware.lnk -> C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk -> [2009/06/01 01:12:21 | 00,000,859 | —- | M] ()
config.nt -> C:\Windows\SysWow64\config.nt -> [2009/05/31 23:53:59 | 00,000,000 | —- | M] ()
setupeng.exe -> C:\Users\Matthew\AppData\Local\Temp\_av_inet.tm~a11084\setupeng.exe -> [2009/05/29 14:37:57 | 34,346,616 | —- | M] ()
zuebxmpskurwilbkw.dll -> C:\Windows\SysWow64\zuebxmpskurwilbkw.dll -> [2009/05/28 13:43:08 | 00,442,880 | —- | M] ()
Beginner workout.doc -> C:\Users\Matthew\Documents\Beginner workout.doc -> [2009/05/28 02:41:25 | 00,025,600 | —- | M] ()
mbamswissarmy.sys -> C:\Windows\SysWow64\drivers\mbamswissarmy.sys -> [2009/05/26 13:20:08 | 00,040,160 | —- | M] (Malwarebytes Corporation)
n508122880_91368_4168.jpg -> C:\Users\Matthew\Desktop\n508122880_91368_4168.jpg -> [2009/05/22 04:49:37 | 00,064,664 | —- | M] ()
n508122880_91350_9979.jpg -> C:\Users\Matthew\Desktop\n508122880_91350_9979.jpg -> [2009/05/22 04:48:55 | 00,064,022 | —- | M] ()
n508122880_91351_206.jpg -> C:\Users\Matthew\Desktop\n508122880_91351_206.jpg -> [2009/05/22 04:48:48 | 00,069,041 | —- | M] ()
n508122880_91353_664.jpg -> C:\Users\Matthew\Desktop\n508122880_91353_664.jpg -> [2009/05/22 04:48:37 | 00,056,171 | —- | M] ()
n501991489_298136_9682.jpg -> C:\Users\Matthew\Desktop\n501991489_298136_9682.jpg -> [2009/05/22 04:45:40 | 00,053,901 | —- | M] ()
n501991489_298156_4660.jpg -> C:\Users\Matthew\Desktop\n501991489_298156_4660.jpg -> [2009/05/22 04:45:18 | 00,067,062 | —- | M] ()
IPH.PH -> C:\IPH.PH -> [2009/05/21 15:59:06 | 00,000,365 | -H– | M] ()
AIM 6.lnk -> C:\Users\Public\Desktop\AIM 6.lnk -> [2009/05/21 15:58:51 | 00,001,821 | —- | M] ()
LimeWire PRO 5.1.2.lnk -> C:\Users\Matthew\Desktop\LimeWire PRO 5.1.2.lnk -> [2009/05/18 13:41:05 | 00,001,773 | —- | M] ()
4161_81444159316_511309316_1811267_2652649_n.jpg -> C:\Users\Matthew\Desktop\4161_81444159316_511309316_1811267_2652649_n.jpg -> [2009/05/16 14:02:45 | 00,025,911 | —- | M] ()
mIRC.lnk -> C:\Users\Public\Desktop\mIRC.lnk -> [2009/05/12 11:17:32 | 00,000,801 | —- | M] ()
ezsidmv.dat -> C:\Windows\SysWow64\ezsidmv.dat -> [2009/05/08 03:34:24 | 00,000,056 | -H– | M] ()
opa11.dat -> C:\ProgramData\Microsoft\OFFICE\DATA\opa11.dat -> [2008/08/10 17:46:15 | 00,008,206 | —- | M] ()
Matthew.dat -> C:\ProgramData\Microsoft\User Account Pictures\Matthew.dat -> [2008/08/09 03:38:10 | 00,000,000 | —- | M] ()
 
[File - Lop Check]
Roaming -> C:\Users\Default\AppData\Roaming -> [2006/11/02 12:07:25 | 00,000,000 | —D | M]
Media Center Programs -> C:\Users\Default\AppData\Roaming\Media Center Programs -> [2006/11/02 12:07:25 | 00,000,000 | —D | M]
Roaming -> C:\Users\Default User\AppData\Roaming -> [2006/11/02 12:07:25 | 00,000,000 | —D | M]
Media Center Programs -> C:\Users\Default User\AppData\Roaming\Media Center Programs -> [2006/11/02 12:07:25 | 00,000,000 | —D | M]
Roaming -> C:\Users\Matthew\AppData\Roaming -> [2009/06/01 01:12:25 | 00,000,000 | —D | M]
acccore -> C:\Users\Matthew\AppData\Roaming\acccore -> [2009/05/21 15:59:15 | 00,000,000 | —D | M]
DC++ -> C:\Users\Matthew\AppData\Roaming\DC++ -> [2009/05/05 22:46:27 | 00,000,000 | —D | M]
FrostWire -> C:\Users\Matthew\AppData\Roaming\FrostWire -> [2008/12/26 12:36:15 | 00,000,000 | —D | M]
GlarySoft -> C:\Users\Matthew\AppData\Roaming\GlarySoft -> [2008/08/10 13:58:54 | 00,000,000 | —D | M]
LimeWire -> C:\Users\Matthew\AppData\Roaming\LimeWire -> [2009/06/04 03:37:07 | 00,000,000 | —D | M]
Media Center Programs -> C:\Users\Matthew\AppData\Roaming\Media Center Programs -> [2006/11/02 12:07:25 | 00,000,000 | —D | M]
mIRC -> C:\Users\Matthew\AppData\Roaming\mIRC -> [2009/05/25 02:42:09 | 00,000,000 | —D | M]
MixMeister Technology -> C:\Users\Matthew\AppData\Roaming\MixMeister Technology -> [2008/09/19 15:50:02 | 00,000,000 | —D | M]
toshiba -> C:\Users\Matthew\AppData\Roaming\toshiba -> [2008/12/30 11:43:57 | 00,000,000 | —D | M]
Ulead Systems -> C:\Users\Matthew\AppData\Roaming\Ulead Systems -> [2008/08/10 11:25:58 | 00,000,000 | —D | M]
uTorrent -> C:\Users\Matthew\AppData\Roaming\uTorrent -> [2009/05/29 15:31:27 | 00,000,000 | —D | M]
C:\Windows\Tasks\ -> C:\Windows\Tasks -> [2009/04/17 03:59:32 | 00,000,000 | —D | M]
GlaryInitialize.job -> C:\Windows\Tasks\GlaryInitialize.job -> [2009/06/02 16:22:40 | 00,000,328 | —- | M] ()
SA.DAT -> C:\Windows\Tasks\SA.DAT -> [2009/06/02 15:55:06 | 00,000,006 | -H– | M] ()
SCHEDLGU.TXT -> C:\Windows\Tasks\SCHEDLGU.TXT -> [2009/06/01 01:17:04 | 00,032,626 | —- | M] ()
 
[File - Purity Scan]
 
< End of report >

[Kill Explorer]
[Unregister Dlls]
[Registry - Safe List]
< FireFox Components [Program Folders] > ->
YY -> zuebxmpskurwilbkw.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\components\zuebxmpskurwilbkw.dll
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YY -> {290B8CD4-D371-251B-ADE4-CF9A5A7D72D7} [HKLM] -> C:\Windows\SysWow64\zuebxmpskurwilbkw.dll [thesuperads search enhancer]
YN -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
[Files/Folders - Created Within 30 Days]
NY -> zuebxmpskurwilbkw.dll-uninst.exe -> C:\Windows\SysWow64\zuebxmpskurwilbkw.dll-uninst.exe
NY -> zuebxmpskurwilbkw.dll -> C:\Windows\SysWow64\zuebxmpskurwilbkw.dll
[Empty Temp Folders]
[Start Explorer]
[Reboot]

• Please open your MalwareBytes AntiMalware Program
• Click the Update Tab and search for updates
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected. <– very important
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

• Open the Kaspersky WebScanner
  page.
• Click on the 🖼Click to load external image (Posted Image) button on the main page.
• The program will launch and fill in the Information section on the left.
• Read the "Requirements and Limitations" then press the 🖼Click to load external image (Posted Image) button.
• The program will begin downloading the latest program and definition files. It may take a while so please be patient and let it finish.

• Under the Scan section on the left:
  Select My Computer
• The program will now start and scan your system. This will run for a while, be patient and let it finish.
• Once the scan is complete, click on View scan report
• Now, click on the Save Report as button.
• Save the file to your desktop.
• Copy and paste that information in your next post.