[Closed] Renos.IO issue Requesting Help

I somehow acquired an trojandownloader:win32/renos.IO virus/loophole in the Windows Vista 64 bit op system. I would greatly appreciate assistance with remedies on how to eliminate this threat. Thanks! In addition, whenever I use my firefox browser, I hear background clicking noises or random sound clips that play that have nothing to do with things I have open.

I went ahead and followed the steps from another thread suggested by Moderator: CatByte

Below are my Logs.

OTS logfile created on: 7/19/2009 5:51:58 PM - Run 1
OTS by OldTimer - Version 3.0.10.0	 Folder = C:\Users\Jon\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18783)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
4.00 Gb Total Physical Memory | 4.00 Gb Available Physical Memory | 100.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 596.17 Gb Total Space | 407.18 Gb Free Space | 68.30% Space Free | Partition Type: NTFS
Drive D: | 5.47 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: JON-PC
Current User Name: Jon
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: Off
File Age = 30 Days
 
[Processes - Safe List]
applemobiledeviceservice.exe -> C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -> [2009/06/05 11:48:14 | 00,144,712 | —- | M] (Apple Inc.)
b.exe -> C:\Users\Jon\AppData\Local\Temp\b.exe -> [2009/07/18 21:49:01 | 00,161,280 | —- | M] ()
btdna.exe -> C:\Users\Jon\Program Files (x86)\DNA\btdna.exe -> [2009/05/04 12:10:41 | 00,321,344 | —- | M] (BitTorrent, Inc.)
comrade.exe -> C:\Program Files (x86)\GameSpy\Comrade\Comrade.exe -> [2007/06/29 15:03:08 | 00,036,864 | —- | M] (IGN Entertainment Inc.)
ekrn.exe -> C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe -> [2009/04/09 15:19:08 | 00,731,840 | —- | M] (ESET)
firefox.exe -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe -> [2009/07/18 18:41:53 | 00,908,280 | —- | M] (Mozilla Corporation)
ipodservice.exe -> C:\Program Files (x86)\iPod\bin\iPodService.exe -> [2009/06/05 13:39:14 | 00,541,992 | —- | M] (Apple Inc.)
ituneshelper.exe -> C:\Program Files (x86)\iTunes\iTunesHelper.exe -> [2009/06/05 13:39:22 | 00,292,136 | —- | M] (Apple Inc.)
jusched.exe -> C:\Program Files (x86)\Java\jre6\bin\jusched.exe -> [2009/04/28 12:55:14 | 00,148,888 | —- | M] (Sun Microsystems, Inc.)
mdnsresponder.exe -> C:\Program Files (x86)\Bonjour\mDNSResponder.exe -> [2008/12/12 11:17:38 | 00,238,888 | —- | M] (Apple Inc.)
msa.exe -> C:\Windows\msa.exe -> [2009/07/18 21:49:03 | 00,151,040 | —- | M] ()
ots.exe -> C:\Users\Jon\Downloads\OTS.exe -> [2009/07/19 17:50:34 | 00,514,560 | —- | M] (OldTimer Tools)
pnkbstra.exe -> C:\Windows\SysWOW64\PnkBstrA.exe -> [2009/07/18 16:29:56 | 00,066,872 | —- | M] ()
setpoint32.exe -> C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe -> [2009/02/19 04:00:00 | 00,077,824 | —- | M] ()
 
[Win32 Services - Safe List]
64bit-(EhttpSrv) ESET HTTP Server [Win32_Own | On_Demand | Stopped] -> C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -> [2009/04/09 15:29:24 | 00,023,296 | —- | M] (ESET)
64bit-(ekrn) ESET Service [Win32_Own | Auto | Running] -> C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe -> [2009/04/09 15:19:08 | 00,731,840 | —- | M] (ESET)
64bit-(LBTServ) Logitech Bluetooth Service [Win32_Own | On_Demand | Stopped] -> C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -> [2009/02/19 00:39:26 | 00,160,784 | —- | M] (Logitech, Inc.)
64bit-(PDAgent) PDAgent [Win32_Own | Auto | Running] -> C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe -> [2009/06/08 12:32:56 | 01,487,624 | —- | M] (Raxco Software, Inc.)
64bit-(PDEngine) PDEngine [Win32_Own | On_Demand | Running] -> C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe -> [2009/06/08 12:32:58 | 01,481,992 | —- | M] (Raxco Software, Inc.)
64bit-(WinDefend) Windows Defender [Win32_Shared | Auto | Running] -> C:\Program Files\Windows Defender\mpsvc.dll -> [2008/01/20 22:47:32 | 00,383,544 | —- | M] (Microsoft Corporation)
64bit-(wlidsvc) Windows Live ID Sign-in Assistant [Win32_Own | Auto | Running] -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -> [2009/03/30 17:19:56 | 02,297,216 | —- | M] (Microsoft Corporation)
64bit-(WMPNetworkSvc) Windows Media Player Network Sharing Service [Win32_Own | On_Demand | Stopped] -> C:\Program Files\Windows Media Player\wmpnetwk.exe -> [2008/01/20 22:52:15 | 01,216,000 | —- | M] (Microsoft Corporation)
(Apple Mobile Device) Apple Mobile Device [Win32_Own | Auto | Running] -> C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -> [2009/06/05 11:48:14 | 00,144,712 | —- | M] (Apple Inc.)
(Bonjour Service) Bonjour Service [Win32_Own | Auto | Running] -> C:\Program Files (x86)\Bonjour\mDNSResponder.exe -> [2008/12/12 11:17:38 | 00,238,888 | —- | M] (Apple Inc.)
(clr_optimization_v2.0.50727_32) Microsoft .NET Framework NGEN v2.0.50727_X86 [Win32_Own | On_Demand | Stopped] -> C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -> [2008/07/27 14:03:13 | 00,069,632 | —- | M] (Microsoft Corporation)
(clr_optimization_v2.0.50727_64) Microsoft .NET Framework NGEN v2.0.50727_X64 [Win32_Own | On_Demand | Stopped] -> C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe -> [2008/07/27 14:01:49 | 00,093,184 | —- | M] (Microsoft Corporation)
(ehRecvr) Windows Media Center Receiver Service [Win32_Own | On_Demand | Stopped] -> C:\Windows\ehome\ehRecvr.exe -> [2008/01/20 22:51:36 | 00,344,064 | —- | M] (Microsoft Corporation)
(ehSched) Windows Media Center Scheduler Service [Win32_Own | On_Demand | Stopped] -> C:\Windows\ehome\ehsched.exe -> [2008/01/20 22:51:36 | 00,153,600 | —- | M] (Microsoft Corporation)
(ehstart) Windows Media Center Service Launcher [Win32_Shared | Auto | Stopped] -> C:\Windows\ehome\ehstart.dll -> [2006/11/02 11:03:48 | 00,015,360 | —- | M] (Microsoft Corporation)
(FontCache3.0.0.0) Windows Presentation Foundation Font Cache 3.0.0.0 [Win32_Own | On_Demand | Stopped] -> C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe -> [2008/06/19 21:17:12 | 00,046,104 | —- | M] (Microsoft Corporation)
(idsvc) Windows CardSpace [Win32_Shared | Unknown | Stopped] -> C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe -> [2008/06/19 21:16:53 | 00,859,648 | —- | M] (Microsoft Corporation)
(iPod Service) iPod Service [Win32_Own | On_Demand | Running] -> C:\Program Files (x86)\iPod\bin\iPodService.exe -> [2009/06/05 13:39:14 | 00,541,992 | —- | M] (Apple Inc.)
(KeyIso) CNG Key Isolation [Win32_Shared | On_Demand | Stopped] -> C:\Windows\SysWow64\keyiso.dll -> [2006/11/02 05:46:05 | 00,018,944 | —- | M] (Microsoft Corporation)
(Microsoft Office Groove Audit Service) Microsoft Office Groove Audit Service [Win32_Own | On_Demand | Stopped] -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe -> [2008/10/25 11:44:08 | 00,065,888 | —- | M] (Microsoft Corporation)
(MSDTC) Distributed Transaction Coordinator [Win32_Own | Unknown | Stopped] -> C:\Windows\SysWow64\Msdtc -> [2006/11/02 09:34:14 | 00,000,000 | —D | M]
(Netlogon) Netlogon [Win32_Shared | On_Demand | Stopped] -> C:\Windows\SysWow64\netlogon.dll -> [2008/01/20 22:48:28 | 00,592,384 | —- | M] (Microsoft Corporation)
(odserv) Microsoft Office Diagnostics Service [Win32_Own | On_Demand | Stopped] -> C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -> [2008/11/04 01:06:28 | 00,441,712 | —- | M] (Microsoft Corporation)
(ose) Office Source Engine [Win32_Own | On_Demand | Stopped] -> C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE -> [2006/10/26 14:03:08 | 00,145,184 | —- | M] (Microsoft Corporation)
(PnkBstrA) PnkBstrA [Win32_Own | Auto | Running] -> C:\Windows\SysWow64\PnkBstrA.exe -> [2009/07/18 16:29:56 | 00,066,872 | —- | M] ()
(vds) Virtual Disk [Win32_Own | On_Demand | Stopped] -> C:\Windows\SysWow64\Wbem\vds.mof -> [2006/11/02 02:35:15 | 00,060,994 | —- | M] ()
(VSS) Volume Shadow Copy [Win32_Own | On_Demand | Stopped] -> C:\Windows\SysWow64\Wbem\vss.mof -> [2006/11/02 02:35:15 | 00,055,846 | —- | M] ()
 
[Driver Services - Safe List]
64bit-(DefragFS) DefragFS [File_System | Auto | Running] -> C:\Windows\SysNative\drivers\DefragFs.sys -> [2009/06/08 10:00:58 | 00,100,880 | —- | M] ()
64bit-(eamon) eamon [File_System | Auto | Running] -> C:\Windows\SysNative\DRIVERS\eamon.sys -> [2009/04/09 15:10:34 | 00,142,776 | —- | M] ()
64bit-(ehdrv) ehdrv [Kernel | System | Running] -> C:\Windows\SysNative\DRIVERS\ehdrv.sys -> [2009/04/09 15:18:04 | 00,134,024 | —- | M] ()
64bit-(epfwwfpr) epfwwfpr [Kernel | Auto | Running] -> C:\Windows\SysNative\DRIVERS\epfwwfpr.sys -> [2009/04/09 15:21:38 | 00,121,152 | —- | M] ()
64bit-(GEARAspiWDM) GEAR ASPI Filter Driver [Kernel | On_Demand | Running] -> C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys -> [2009/03/19 16:34:18 | 00,029,544 | —- | M] ()
64bit-(HdAudAddService) Microsoft 1.1 UAA Function Driver for High Definition Audio Service [Kernel | On_Demand | Stopped] -> C:\Windows\SysNative\drivers\HdAudio.sys -> [2006/11/02 01:28:10 | 00,273,920 | —- | M] ()
64bit-(JRAID) JRAID [Kernel | Boot | Running] -> C:\Windows\SysNative\DRIVERS\jraid.sys -> [2008/10/01 02:32:22 | 00,095,584 | —- | M] ()
64bit-(L8042Kbd) SetPoint Keyboard Driver [Kernel | On_Demand | Running] -> C:\Windows\SysNative\DRIVERS\L8042Kbd.sys -> [2008/12/18 23:46:36 | 00,035,344 | —- | M] ()
64bit-(LHidFilt) Logitech SetPoint KMDF HID Filter Driver [Kernel | On_Demand | Running] -> C:\Windows\SysNative\DRIVERS\LHidFilt.Sys -> [2008/12/18 23:47:10 | 00,055,312 | —- | M] ()
64bit-(LMouFilt) Logitech SetPoint KMDF Mouse Filter Driver [Kernel | On_Demand | Running] -> C:\Windows\SysNative\DRIVERS\LMouFilt.Sys -> [2008/12/18 23:47:18 | 00,057,872 | —- | M] ()
64bit-(RTL8169) Realtek 8169 NT Driver [Kernel | On_Demand | Running] -> C:\Windows\SysNative\DRIVERS\Rtlh64.sys -> [2009/05/25 06:51:00 | 00,207,872 | —- | M] ()
(mpsdrv) Windows Firewall Authorization Driver [Kernel | On_Demand | Running] -> C:\Windows\SysWow64\Wbem\mpsdrv.mof -> [2006/09/18 17:35:23 | 00,001,088 | —- | M] ()
(Tcpip) TCP/IP Protocol Driver [Kernel | Boot | Running] -> C:\Windows\SysWow64\Wbem\tcpip.mof -> [2006/09/18 17:36:40 | 00,003,066 | —- | M] ()
 
[Registry - Safe List]
< 64bit-Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Page_URL" -> http://go.microsoft.com/fwlink/?LinkId=69157 -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Search_URL" -> http://go.microsoft.com/fwlink/?LinkId=54896 -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Secondary_Page_URL" ->  [binary data] -> 
HKEY_LOCAL_MACHINE\: Main\\"Extensions Off Page" -> about:NoAdd-ons -> 
HKEY_LOCAL_MACHINE\: Main\\"Local Page" -> C:\Windows\System32\blank.htm -> 
HKEY_LOCAL_MACHINE\: Main\\"Search Page" -> http://go.microsoft.com/fwlink/?LinkId=54896 -> 
HKEY_LOCAL_MACHINE\: Main\\"Security Risk Page" -> about:SecurityRisk -> 
HKEY_LOCAL_MACHINE\: Main\\"Start Page" -> http://go.microsoft.com/fwlink/?LinkId=69157 -> 
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Page_URL" -> http://go.microsoft.com/fwlink/?LinkId=69157 -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Search_URL" -> http://go.microsoft.com/fwlink/?LinkId=54896 -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Secondary_Page_URL" ->  [binary data] -> 
HKEY_LOCAL_MACHINE\: Main\\"Extensions Off Page" -> about:NoAdd-ons -> 
HKEY_LOCAL_MACHINE\: Main\\"Local Page" -> C:\Windows\SysWOW64\blank.htm -> 
HKEY_LOCAL_MACHINE\: Main\\"Search Page" -> http://go.microsoft.com/fwlink/?LinkId=54896 -> 
HKEY_LOCAL_MACHINE\: Main\\"Security Risk Page" -> about:SecurityRisk -> 
HKEY_LOCAL_MACHINE\: Main\\"Start Page" -> http://go.microsoft.com/fwlink/?LinkId=69157 -> 
< Internet Explorer Settings [HKEY_USERS\.DEFAULT\] > -> -> 
HKEY_USERS\.DEFAULT\: "ProxyEnable" -> 0 -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-18\] > -> -> 
HKEY_USERS\S-1-5-18\: "ProxyEnable" -> 0 -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-19\] > -> -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-20\] > -> -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-21-3821409649-224443633-3810417207-1000\] > -> -> 
HKEY_USERS\S-1-5-21-3821409649-224443633-3810417207-1000\: Main\\"Local Page" -> C:\Windows\system32\blank.htm -> 
HKEY_USERS\S-1-5-21-3821409649-224443633-3810417207-1000\: Main\\"Search Page" -> http://go.microsoft.com/fwlink/?LinkId=54896 -> 
HKEY_USERS\S-1-5-21-3821409649-224443633-3810417207-1000\: Main\\"Start Page" -> http://go.microsoft.com/fwlink/?LinkId=69157 -> 
HKEY_USERS\S-1-5-21-3821409649-224443633-3810417207-1000\: Main\\"StartPageCache" -> 1 -> 
HKEY_USERS\S-1-5-21-3821409649-224443633-3810417207-1000\: "ProxyEnable" -> 0 -> 
< FireFox Settings [Prefs.js] > -> C:\Users\Jon\AppData\Roaming\Mozilla\FireFox\Profiles\g6ccf1ns.default\prefs.js -> 
browser.startup.homepage -> "http://www.google.com/ig?hl=en&source=iglk" ->
extensions.enabledItems -> [removed]:0.3.0 ->
extensions.enabledItems -> {d5bc46d8-67c7-11dc-8c1d-0097498c2b7a}:1.0.0.1 ->
extensions.enabledItems -> {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13 ->
extensions.enabledItems -> {20a82645-c095-46ed-80e3-08825760534b}:1.1 ->
extensions.enabledItems -> [removed]:1.2.1 ->
extensions.enabledItems -> {B13721C7-F507-4982-B2E5-502A71474FED}:[removed] ->
extensions.enabledItems -> {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.1 ->
< FireFox Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla
HKLM\software\mozilla\Firefox\Extensions ->  -> 
HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b} -> C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION [C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION\] -> [2009/06/25 03:00:37 | 00,000,000 | —D | M]
HKLM\software\mozilla\Mozilla Firefox 3.5.1\extensions ->  -> 
HKLM\software\mozilla\Mozilla Firefox 3.5.1\extensions\\Components -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\COMPONENTS [C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\COMPONENTS] -> [2009/07/18 18:41:56 | 00,000,000 | —D | M]
HKLM\software\mozilla\Mozilla Firefox 3.5.1\extensions\\Plugins -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\PLUGINS [C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\PLUGINS] -> [2009/07/18 18:41:56 | 00,000,000 | —D | M]
HKLM\software\mozilla\Thunderbird\Extensions ->  -> 
HKLM\software\mozilla\Thunderbird\Extensions\\[removed] -> C:\PROGRAM FILES\ESET\ESET NOD32 ANTIVIRUS\MOZILLA THUNDERBIRD -> 
< FireFox Extensions [User Folders] > -> 
 -> C:\Users\Jon\AppData\Roaming\mozilla\Extensions -> [2009/04/23 23:11:33 | 00,000,000 | —D | M]
 -> C:\Users\Jon\AppData\Roaming\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} -> [2009/04/23 23:11:33 | 00,000,000 | —D | M]
 -> C:\Users\Jon\AppData\Roaming\mozilla\Firefox\Profiles\g6ccf1ns.default\extensions -> [2009/07/19 17:48:06 | 00,102,531 | —- | M] ()
 -> C:\Users\Jon\AppData\Roaming\mozilla\Firefox\Profiles\g6ccf1ns.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} -> [2009/07/19 17:48:06 | 00,102,531 | —- | M] ()
 -> C:\Users\Jon\AppData\Roaming\mozilla\Firefox\Profiles\g6ccf1ns.default\extensions\[removed] -> [2009/07/19 17:48:06 | 00,102,531 | —- | M] ()
 -> C:\Users\Jon\AppData\Roaming\mozilla\Firefox\Profiles\g6ccf1ns.default\extensions\[removed] -> [2009/07/19 17:48:06 | 00,102,531 | —- | M] ()
< FireFox Extensions [Program Folders] > -> 
 -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\extensions -> [2009/07/18 18:41:56 | 10,764,792 | —- | M] (Mozilla Foundation)
 -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} -> [2009/07/18 18:41:56 | 10,764,792 | —- | M] (Mozilla Foundation)
 -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\extensions\{B13721C7-F507-4982-B2E5-502A71474FED} -> [2009/07/18 18:41:56 | 10,764,792 | —- | M] (Mozilla Foundation)
 -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} -> [2009/07/18 18:41:56 | 10,764,792 | —- | M] (Mozilla Foundation)
< FireFox Components [Program Folders] > -> 
C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\components\ -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\components -> [2009/07/18 18:41:56 | 00,000,000 | —D | M]
browserdirprovider.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\components\browserdirprovider.dll -> [2009/07/18 18:41:53 | 00,023,544 | —- | M] (Mozilla Foundation)
brwsrcmp.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\components\brwsrcmp.dll -> [2009/07/18 18:41:53 | 00,137,208 | —- | M] (Mozilla Foundation)
< FireFox Plugins [Program Folders] > -> 
C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\ -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins -> [2009/07/18 18:41:56 | 00,000,000 | —D | M]
np-mswmp.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\np-mswmp.dll -> [2007/04/10 17:21:08 | 00,163,256 | —- | M] (Microsoft Corporation)
npbittorrent.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npbittorrent.dll -> [2008/09/03 20:11:24 | 00,054,600 | —- | M] (BitTorrent, Inc.)
npdeploytk.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npdeploytk.dll -> [2009/04/28 12:55:14 | 00,410,984 | —- | M] (Sun Microsystems, Inc.)
npnul32.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npnul32.dll -> [2009/07/18 18:41:53 | 00,065,016 | —- | M] (mozilla.org)
NPOFF12.DLL -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\NPOFF12.DLL -> [2006/10/26 20:12:16 | 00,016,192 | —- | M] (Microsoft Corporation)
nppdf32.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\nppdf32.dll -> [2009/02/27 12:13:42 | 00,103,792 | —- | M] (Adobe Systems Inc.)
npqtplugin.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npqtplugin.dll -> [2009/06/09 11:10:39 | 00,143,360 | —- | M] (Apple Inc.)
npqtplugin2.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npqtplugin2.dll -> [2009/06/09 11:10:39 | 00,143,360 | —- | M] (Apple Inc.)
npqtplugin3.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npqtplugin3.dll -> [2009/06/09 11:10:39 | 00,143,360 | —- | M] (Apple Inc.)
npqtplugin4.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npqtplugin4.dll -> [2009/06/09 11:10:39 | 00,143,360 | —- | M] (Apple Inc.)
npqtplugin5.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npqtplugin5.dll -> [2009/06/09 11:10:39 | 00,143,360 | —- | M] (Apple Inc.)
npqtplugin6.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npqtplugin6.dll -> [2009/06/09 11:10:40 | 00,143,360 | —- | M] (Apple Inc.)
npqtplugin7.dll -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\npqtplugin7.dll -> [2009/06/09 11:10:40 | 00,143,360 | —- | M] (Apple Inc.)
QuickTimePlugin.class -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\QuickTimePlugin.cla -> [2009/06/09 11:10:39 | 00,004,208 | —- | M] ()
WMP Firefox Plugin License.rtf -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\WMP Firefox Plugin License.rtf -> [2007/03/30 10:43:58 | 00,149,569 | —- | M] ()
WMP Firefox Plugin RelNotes.txt -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\plugins\WMP Firefox Plugin RelNotes.txt -> [2007/03/30 10:43:58 | 00,003,352 | —- | M] ()
< FireFox SearchPlugins [Program Folders] > -> 
C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\searchplugins\ -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\searchplugins -> [2009/07/16 19:07:06 | 00,000,000 | —D | M]
amazondotcom.xml -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\searchplugins\amazondotcom.xml -> [2009/06/24 07:27:00 | 00,001,394 | —- | M] ()
answers.xml -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\searchplugins\answers.xml -> [2009/06/24 07:27:00 | 00,002,193 | —- | M] ()
creativecommons.xml -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\searchplugins\creativecommons.xml -> [2009/06/24 07:27:00 | 00,001,534 | —- | M] ()
eBay.xml -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\searchplugins\eBay.xml -> [2009/06/24 07:27:00 | 00,002,344 | —- | M] ()
google.xml -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\searchplugins\google.xml -> [2009/06/24 07:27:00 | 00,002,371 | —- | M] ()
wikipedia.xml -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\searchplugins\wikipedia.xml -> [2009/06/24 07:27:00 | 00,001,178 | —- | M] ()
yahoo.xml -> C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\searchplugins\yahoo.xml -> [2009/06/24 07:27:00 | 00,000,792 | —- | M] ()
< HOSTS File > (761 bytes and 20 lines) -> C:\Windows\SysNative\Drivers\etc\hosts -> 
Reset Hosts
127.0.0.1	   localhost
::1			 localhost
< 64bit-BHO's [HKEY_LOCAL_MACHINE] > -> 64bit-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> 
{9030D464-4C02-4ABF-8ECC-5164760863C6} [HKLM] -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [Windows Live ID Sign-in Helper] -> [2009/03/30 17:23:30 | 00,531,840 | —- | M] (Microsoft Corporation)
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> 
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} [HKLM] -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [Adobe PDF Link Helper] -> [2009/02/27 12:07:26 | 00,075,128 | —- | M] (Adobe Systems Incorporated)
{5C255C8A-E604-49b4-9D64-90988571CECB} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} [HKLM] -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [Groove GFS Browser Helper] -> [2009/02/12 15:19:32 | 02,217,848 | —- | M] (Microsoft Corporation)
{9030D464-4C02-4ABF-8ECC-5164760863C6} [HKLM] -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [Windows Live ID Sign-in Helper] -> [2009/03/30 16:31:54 | 00,403,824 | —- | M] (Microsoft Corporation)
{DBC80044-A445-435b-BC74-9C25C1C588A9} [HKLM] -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [Java™ Plug-In 2 SSV Helper] -> [2009/04/28 12:55:14 | 00,035,840 | —- | M] (Sun Microsystems, Inc.)
< 64bit-Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"egui" -> C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe ["C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice] -> [2009/04/09 15:17:58 | 02,692,008 | —- | M] (ESET)
"Kernel and Hardware Abstraction Layer" -> C:\Windows\KHALMNPR.Exe [KHALMNPR.EXE] -> [2008/12/18 23:46:30 | 00,243,216 | —- | M] (Logitech, Inc.)
"NvCplDaemon" -> C:\Windows\SysNative\NvCpl.DLL [RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup] -> [2009/03/27 10:03:00 | 16,141,344 | —- | M] ()
"NvMediaCenter" -> C:\Windows\SysNative\NvMcTray.DLL [RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit] -> [2009/03/27 10:03:00 | 00,082,464 | —- | M] ()
"RtHDVCpl" -> C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe] -> [2008/11/25 20:44:00 | 06,936,096 | —- | M] (Realtek Semiconductor)
"Skytel" -> C:\Program Files\Realtek\Audio\HDA\Skytel.exe [C:\Program Files\Realtek\Audio\HDA\Skytel.exe] -> [2008/11/25 20:44:48 | 01,833,504 | —- | M] (Realtek Semiconductor Corp.)
"Windows Defender" -> C:\Program Files\Windows Defender\MSASCui.exe [%ProgramFiles%\Windows Defender\MSASCui.exe -hide] -> [2008/01/20 22:47:32 | 01,584,184 | —- | M] (Microsoft Corporation)
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"Adobe Reader Speed Launcher" -> C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe ["C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"] -> [2009/02/27 17:10:28 | 00,035,696 | —- | M] (Adobe Systems Incorporated)
"GrooveMonitor" -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe ["C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"] -> [2008/10/25 11:44:34 | 00,031,072 | —- | M] (Microsoft Corporation)
"iTunesHelper" -> C:\Program Files (x86)\iTunes\iTunesHelper.exe ["C:\Program Files (x86)\iTunes\iTunesHelper.exe"] -> [2009/06/05 13:39:22 | 00,292,136 | —- | M] (Apple Inc.)
"JMB36X IDE Setup" -> C:\Windows\RaidTool\xInsIDE.exe [C:\Windows\RaidTool\xInsIDE.exe] -> [2007/03/20 02:36:18 | 00,036,864 | R— | M] ()
"QuickTime Task" -> C:\Program Files (x86)\QuickTime\QTTask.exe ["C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime] -> [2009/05/26 17:18:30 | 00,413,696 | —- | M] (Apple Inc.)
"SunJavaUpdateSched" -> C:\Program Files (x86)\Java\jre6\bin\jusched.exe ["C:\Program Files (x86)\Java\jre6\bin\jusched.exe"] -> [2009/04/28 12:55:14 | 00,148,888 | —- | M] (Sun Microsystems, Inc.)
< Run [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"Sidebar" -> C:\Program Files (x86)\Windows Sidebar\Sidebar.exe [%ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem] -> [2008/01/20 22:47:33 | 01,233,920 | —- | M] (Microsoft Corporation)
"WindowsWelcomeCenter" -> C:\Windows\SysWow64\oobefldr.dll [rundll32.exe oobefldr.dll,ShowWelcomeCenter] -> [2008/01/20 22:47:52 | 02,153,472 | —- | M] (Microsoft Corporation)
< Run [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"Sidebar" -> C:\Program Files (x86)\Windows Sidebar\Sidebar.exe [%ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem] -> [2008/01/20 22:47:33 | 01,233,920 | —- | M] (Microsoft Corporation)
"WindowsWelcomeCenter" -> C:\Windows\SysWow64\oobefldr.dll [rundll32.exe oobefldr.dll,ShowWelcomeCenter] -> [2008/01/20 22:47:52 | 02,153,472 | —- | M] (Microsoft Corporation)
< Run [HKEY_USERS\S-1-5-21-3821409649-224443633-3810417207-1000\] > -> HKEY_USERS\S-1-5-21-3821409649-224443633-3810417207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"BitTorrent DNA" -> C:\Users\Jon\Program Files (x86)\DNA\btdna.exe ["C:\Users\Jon\Program Files (x86)\DNA\btdna.exe"] -> [2009/05/04 12:10:41 | 00,321,344 | —- | M] (BitTorrent, Inc.)
"Cognac" -> C:\Users\Jon\AppData\Local\Temp\b.exe [C:\Users\Jon\AppData\Local\Temp\b.exe] -> [2009/07/18 21:49:01 | 00,161,280 | —- | M] ()
"Comrade.exe" -> C:\Program Files (x86)\GameSpy\Comrade\Comrade.exe [C:\Program Files (x86)\GameSpy\Comrade\Comrade.exe] -> [2007/06/29 15:03:08 | 00,036,864 | —- | M] (IGN Entertainment Inc.)
"Sidebar" -> C:\Program Files\Windows Sidebar\sidebar.exe [C:\Program Files\Windows Sidebar\sidebar.exe /autoRun] -> [2008/01/20 22:47:57 | 01,555,968 | —- | M] (Microsoft Corporation)
< CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoActiveDesktop" ->  [1] -> File not found
\\"NoActiveDesktopChanges" ->  [1] -> File not found
\\"ForceActiveDesktopOn" ->  [0] -> File not found
< CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
\\"ConsentPromptBehaviorAdmin" ->  [2] -> File not found
\\"ConsentPromptBehaviorUser" ->  [1] -> File not found
\\"EnableInstallerDetection" ->  [1] -> File not found
\\"EnableLUA" ->  [1] -> File not found
\\"EnableSecureUIAPaths" ->  [1] -> File not found
\\"EnableVirtualization" ->  [1] -> File not found
\\"PromptOnSecureDesktop" ->  [1] -> File not found
\\"ValidateAdminCodeSignatures" ->  [0] -> File not found
\\"dontdisplaylastusername" ->  [0] -> File not found
\\"legalnoticecaption" ->  [] -> File not found
\\"legalnoticetext" ->  [] -> File not found
\\"scforceoption" ->  [0] -> File not found
\\"shutdownwithoutlogon" ->  [1] -> File not found
\\"undockwithoutlogon" ->  [1] -> File not found
\\"FilterAdministratorToken" ->  [0] -> File not found
\\"EnableUIADesktopToggle" ->  [0] -> File not found
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats
\UIPI\Clipboard\ExceptionFormats\\"CF_TEXT" ->  [1] -> File not found
\UIPI\Clipboard\ExceptionFormats\\"CF_BITMAP" ->  [2] -> File not found
\UIPI\Clipboard\ExceptionFormats\\"CF_OEMTEXT" ->  [7] -> File not found
\UIPI\Clipboard\ExceptionFormats\\"CF_DIB" ->  [8] -> File not found
\UIPI\Clipboard\ExceptionFormats\\"CF_PALETTE" ->  [9] -> File not found
\UIPI\Clipboard\ExceptionFormats\\"CF_UNICODETEXT" ->  [13] -> File not found
\UIPI\Clipboard\ExceptionFormats\\"CF_DIBV5" ->  [17] -> File not found
< 64bit-Internet Explorer Menu Extensions [HKEY_USERS\S-1-5-21-3821409649-224443633-3810417207-1000\] > -> HKEY_USERS\S-1-5-21-3821409649-224443633-3810417207-1000\Software\Microsoft\Internet Explorer\MenuExt\ -> 
E&xport to Microsoft Excel -> C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE [res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000] -> [2009/05/04 08:40:04 | 18,333,536 | —- | M] (Microsoft Corporation)
< Internet Explorer Menu Extensions [HKEY_USERS\S-1-5-21-3821409649-224443633-3810417207-1000\] > -> HKEY_USERS\S-1-5-21-3821409649-224443633-3810417207-1000\Software\Microsoft\Internet Explorer\MenuExt\ -> 
E&xport to Microsoft Excel -> C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE [res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000] -> [2009/05/04 08:40:04 | 18,333,536 | —- | M] (Microsoft Corporation)
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> 
{2670000A-7350-4f3c-8081-5663EE0C6C49}:{48E73304-E1D6-4330-914C-F5F514E3486C} [HKLM] -> C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll [Button: Send to OneNote] -> [2008/10/25 07:52:00 | 00,604,056 | —- | M] (Microsoft Corporation)
{2670000A-7350-4f3c-8081-5663EE0C6C49}:{48E73304-E1D6-4330-914C-F5F514E3486C} [HKLM] -> C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll [Menu: S&end to OneNote] -> [2008/10/25 07:52:00 | 00,604,056 | —- | M] (Microsoft Corporation)
{92780B25-18CC-41C8-B9BE-3C9C571A8263}:{FF059E31-CC5A-4E2E-BF3B-96E929D65503} [HKLM] -> C:\Program Files (x86)\Microsoft Office\Office12\REFIEBAR.DLL [Button: Research] -> [2009/03/06 04:04:56 | 00,039,464 | —- | M] (Microsoft Corporation)
< 64bit-Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
"" -> http://
< Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
"" -> http://
< 64bit-Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< 64bit-Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-21-3821409649-224443633-3810417207-1000\] > -> HKEY_USERS\S-1-5-21-3821409649-224443633-3810417207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-21-3821409649-224443633-3810417207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_USERS\S-1-5-21-3821409649-224443633-3810417207-1000\] > -> HKEY_USERS\S-1-5-21-3821409649-224443633-3810417207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-21-3821409649-224443633-3810417207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> 
{8AD9C840-044E-11D1-B3E9-00805F499D93} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab [Java Plug-in 1.6.0_13] -> 
{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab [Java Plug-in 1.6.0_13] -> 
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab [Java Plug-in 1.6.0_13] -> 
< Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ -> 
DhcpNameServer -> 192.168.1.1 -> 
< Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ -> 
{40D64182-13A0-4E3F-914A-6C0340BCBF49}\\DhcpNameServer -> 192.168.1.1   (Realtek PCIe GBE Family Controller) -> 
< 64bit-Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
64bit-*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 
explorer.exe -> C:\Windows\explorer.exe -> [2008/10/29 02:49:22 | 03,080,704 | —- | M] (Microsoft Corporation)
*MultiFile Done* -> -> 
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 
explorer.exe -> C:\Windows\SysWow64\explorer.exe -> [2008/10/29 02:29:41 | 02,927,104 | —- | M] (Microsoft Corporation)
*MultiFile Done* -> -> 
< ShellExecuteHooks [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks -> 
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" [HKLM] -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [Groove GFS Stub Execution Hook] -> [2009/02/12 15:19:32 | 02,217,848 | —- | M] (Microsoft Corporation)
< Vista Public Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications -> 
< Vista Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications -> 
64bit-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
\List\\"C:\Program Files (x86)\BitTorrent\bittorrent.exe" -> C:\Program Files (x86)\BitTorrent\bittorrent.exe [C:\Program Files (x86)\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent] -> [2009/04/08 15:37:48 | 00,637,232 | —- | M] (BitTorrent, Inc.)
< Vista Active Firewall Rules > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules -> 
{7855F352-6D65-4B37-9738-C544803A8CBF} -> lport=1900 | profile=public | protocol=17 | dir=in | action=allow | name=network discovery (ssdp-in) | app=c:\windows\system32\svchost.exe | svc=ssdpsrv | 
{C69E562F-9FB8-4CE3-8EC5-775D02A35882} -> lport=1900 | protocol=17 | dir=in | action=allow | name=windows live messenger (ssdp-in) | app=svchost.exe | svc=ssdpsrv | 
{D37E0C96-ABC8-4D64-AEC3-37528642F984} -> lport=6004 | profile=public | protocol=17 | dir=in | action=allow | name=microsoft office outlook | app=c:\program files (x86)\microsoft office\office12\outlook.exe | 
{F7CF9A1A-3010-42C8-8AD7-509A3BA70131} -> lport=2869 | protocol=6 | dir=in | action=allow | name=windows live messenger (upnp-in) | app=system | 
< Vista Active Application Exception Rules > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules -> 
{0A0A6053-66AF-4695-99A4-0F21F8C9C216} -> profile=private | protocol=17 | dir=in | action=allow | name=crysisdedicatedserver_32 | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysisdedicatedserver.exe | 
{0C2BBBF5-3A9F-4E06-9968-C97C3420AB69} -> profile=public | protocol=17 | dir=in | action=allow | name=bittorrent (udp-in) | app=c:\program files (x86)\bittorrent\bittorrent.exe | 
{173FB804-F923-45A2-9B34-3A754FE1B697} -> profile=private | protocol=17 | dir=in | action=allow | name=crysis_64 | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis.exe | 
{1A847317-C1B6-41F5-AEB5-3464B27FD30A} -> profile=public | protocol=17 | dir=in | action=allow | name=ventrilo.exe | app=c:\program files\ventrilo\ventrilo.exe | 
{1C849ACD-8C42-4154-93C7-CB590CCFF306} -> profile=public | protocol=6 | dir=in | action=allow | name=itunes | app=c:\program files (x86)\itunes\itunes.exe | 
{21C323C5-34E6-45ED-A28B-5553B0E853F3} -> profile=private | protocol=17 | dir=in | action=allow | name=crysisdedicatedserver_64 | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysisdedicatedserver.exe | 
{2DF450A5-61FA-42BD-BD73-1BF04A606DE4} -> profile=public | protocol=6 | dir=in | action=allow | name=ventrilo.exe | app=c:\program files\ventrilo\ventrilo.exe | 
{410EC64D-134B-4373-AB2B-0229C431EABD} -> dir=in | action=allow | name=skype | app=c:\program files (x86)\skype\phone\skype.exe | 
{681EA0B0-E022-44B1-8644-E7E31D32D9D2} -> profile=private | protocol=6 | dir=in | action=allow | name=crysis_64 | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis.exe | 
{6984BF68-91EE-4843-A2CB-D146E6809675} -> profile=public | protocol=6 | dir=in | action=allow | name=microsoft office groove | app=c:\program files (x86)\microsoft office\office12\groove.exe | 
{6A7382B1-C053-4D05-A193-758849E7E7AC} -> profile=private | protocol=17 | dir=in | action=allow | name=pnkbstra | app=c:\windows\syswow64\pnkbstra.exe | 
{76483C37-6A77-45C7-AB39-341DD6AFFBF2} -> profile=public | protocol=6 | dir=in | action=allow | name=bittorrent (tcp-in) | app=c:\program files (x86)\bittorrent\bittorrent.exe | 
{77274008-8C78-4E99-8108-FB3EFFCCBEAD} -> profile=private | protocol=6 | dir=in | action=allow | name=pnkbstra | app=c:\windows\syswow64\pnkbstra.exe | 
{77401464-2DBA-4368-9AB1-222C8A357432} -> profile=public | protocol=6 | dir=in | action=allow | name=dna (tcp-in) | app=c:\program files (x86)\dna\btdna.exe | 
{7C20060C-C72D-41A8-937D-567013B0310E} -> profile=public | protocol=17 | dir=in | action=allow | name=microsoft office groove | app=c:\program files (x86)\microsoft office\office12\groove.exe | 
{8148089C-E5EE-4E3C-97AB-51C1855DA5AE} -> profile=public | protocol=17 | dir=in | action=allow | name=itunes | app=c:\program files (x86)\itunes\itunes.exe | 
{8834251B-FE04-4C12-A2D2-191467195DEA} -> dir=in | action=allow | name=windows live call | app=c:\program files (x86)\windows live\messenger\wlcsdk.exe | 
{88474E37-EB28-415D-B889-2F1FB015202E} -> profile=public | protocol=17 | dir=in | action=allow | name=microsoft office onenote | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
{88B680AF-84AA-446F-9ECA-AA68D0BAFA84} -> profile=private | protocol=6 | dir=in | action=allow | name=crysisdedicatedserver_64 | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysisdedicatedserver.exe | 
{8D98F44E-8486-4C11-A3F8-9FDF0A66BC47} -> profile=public | protocol=17 | dir=in | action=allow | name=tversity media server | app=c:\program files (x86)\tversity\media server\mediaserver.exe | 
{A1F5D52E-F600-4B57-9EC5-A17A9B9DE886} -> profile=private | protocol=17 | dir=in | action=allow | name=crysis_32 | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysis.exe | 
{AD3B6104-C50D-4D24-9B4E-BE893D910796} -> profile=public | protocol=6 | dir=in | action=allow | name=tversity media server | app=c:\program files (x86)\tversity\media server\mediaserver.exe | 
{AD6CCE26-237B-4A3F-86EF-F7A0F57D5732} -> profile=private | protocol=6 | dir=in | action=allow | name=pnkbstrb | app=c:\windows\syswow64\pnkbstrb.exe | 
{BC946FED-8322-4865-AD5F-3828FBF38B6B} -> profile=private | protocol=6 | dir=in | action=allow | name=crysisdedicatedserver_32 | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysisdedicatedserver.exe | 
{C649C75F-E23F-4DE4-BC17-05879F7D7E16} -> profile=public | protocol=6 | dir=in | action=allow | name=microsoft office onenote | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
{DBFA79AC-2C7A-488F-8D5A-F73E04D2C296} -> profile=public | protocol=6 | dir=in | action=allow | name=bonjour | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
{EB6C977B-C3AF-49DA-9684-83599F6766D4} -> profile=private | protocol=17 | dir=in | action=allow | name=pnkbstrb | app=c:\windows\syswow64\pnkbstrb.exe | 
{EDB5B14E-D170-4CDA-95AA-F252E5462330} -> profile=public | protocol=17 | dir=in | action=allow | name=dna (udp-in) | app=c:\program files (x86)\dna\btdna.exe | 
{F18579CD-E4F7-462C-9F78-2DDE67AE88EC} -> dir=in | action=allow | name=windows live messenger | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
{F3F70CC7-A98A-4CB7-AB28-72323E6FDB95} -> profile=private | protocol=6 | dir=in | action=allow | name=crysis_32 | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysis.exe | 
{FAE39298-2EC3-4C91-B9C2-E0FE2E62D973} -> profile=public | protocol=17 | dir=in | action=allow | name=bonjour | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
{FDADE6E2-C662-416D-B150-0569A7C31662} -> dir=in | action=allow | name=skype | app=c:\program files (x86)\skype\phone\skype.exe | 
TCP Query User{13FDB6FB-2B21-4099-B88A-543C55D63E61}C:\users\jon\downloads\downloader_warcraft3_the_frozen_throne_enus.exe -> profile=private | protocol=6 | dir=in | action=allow | name=downloader_warcraft3_the_frozen_throne_enus.exe | app=c:\users\jon\downloads\downloader_warcraft3_the_frozen_throne_enus.exe | 
TCP Query User{26A34E07-6EE0-48B8-818E-F6B15C16051D}C:\games\warcraft iii\war3.exe -> profile=private | protocol=6 | dir=in | action=allow | name=warcraft iii | app=c:\games\warcraft iii\war3.exe | 
TCP Query User{33B95017-4DD1-4958-A48C-743E21BCC3B0}C:\users\jon\program files (x86)\dna\btdna.exe -> profile=private | protocol=6 | dir=in | action=allow | name=btdna.exe | app=c:\users\jon\program files (x86)\dna\btdna.exe | 
TCP Query User{48743E0E-2E87-4F9B-983B-99AB5D28CEA4}C:\program files (x86)\java\jre6\bin\java.exe -> profile=private | protocol=6 | dir=in | action=allow | name=java™ platform se binary | app=c:\program files (x86)\java\jre6\bin\java.exe | 
TCP Query User{6565B192-AE2F-4CEF-AA40-94D4D2C1CC00}C:\users\jon\program files (x86)\dna\btdna.exe -> profile=public | protocol=6 | dir=in | action=allow | name=btdna.exe | app=c:\users\jon\program files (x86)\dna\btdna.exe | 
TCP Query User{6567D18F-0ECC-48C8-8661-425ACBEC5DBB}C:\users\jon\downloads\downloader_warcraft3_reign_of_chaos_enus.exe -> profile=private | protocol=6 | dir=in | action=allow | name=downloader_warcraft3_reign_of_chaos_enus.exe | app=c:\users\jon\downloads\downloader_warcraft3_reign_of_chaos_enus.exe | 
TCP Query User{9398C26F-6195-4A53-8B0B-305FEA65E902}C:\program files (x86)\itunes\itunes.exe -> profile=private | protocol=6 | dir=in | action=allow | name=itunes | app=c:\program files (x86)\itunes\itunes.exe | 
TCP Query User{9DE5BB10-5A34-4586-BE68-F146D45E7E94}C:\program files (x86)\mozilla firefox\firefox.exe -> profile=public | protocol=6 | dir=in | action=block | name=firefox | app=c:\program files (x86)\mozilla firefox\firefox.exe | 
TCP Query User{AE76AB85-AA24-428B-ACAE-7957683D63E3}C:\games\world of warcraft\launcher.exe -> profile=public | protocol=6 | dir=in | action=allow | name=blizzard launcher | app=c:\games\world of warcraft\launcher.exe | 
TCP Query User{C099606F-6309-4B0F-A9AD-250B8AEC5898}C:\program files (x86)\bittorrent\bittorrent.exe -> profile=private | protocol=6 | dir=in | action=allow | name=bittorrent | app=c:\program files (x86)\bittorrent\bittorrent.exe | 
UDP Query User{07439F17-94DF-449A-9A96-24ADC9D2465D}C:\users\jon\program files (x86)\dna\btdna.exe -> profile=private | protocol=17 | dir=in | action=allow | name=btdna.exe | app=c:\users\jon\program files (x86)\dna\btdna.exe | 
UDP Query User{07E60B44-443B-4BD2-BD7B-8AA5752CE30A}C:\games\warcraft iii\war3.exe -> profile=private | protocol=17 | dir=in | action=allow | name=warcraft iii | app=c:\games\warcraft iii\war3.exe | 
UDP Query User{151875AA-617D-4FC2-ACEF-E1A425E4400B}C:\users\jon\downloads\downloader_warcraft3_reign_of_chaos_enus.exe -> profile=private | protocol=17 | dir=in | action=allow | name=downloader_warcraft3_reign_of_chaos_enus.exe | app=c:\users\jon\downloads\downloader_warcraft3_reign_of_chaos_enus.exe | 
UDP Query User{1F861E9F-022E-441B-B674-BCEFECAF2D1C}C:\program files (x86)\mozilla firefox\firefox.exe -> profile=public | protocol=17 | dir=in | action=block | name=firefox | app=c:\program files (x86)\mozilla firefox\firefox.exe | 
UDP Query User{400289CD-CE48-45A1-9ED9-0726D000ACBB}C:\users\jon\program files (x86)\dna\btdna.exe -> profile=public | protocol=17 | dir=in | action=allow | name=btdna.exe | app=c:\users\jon\program files (x86)\dna\btdna.exe | 
UDP Query User{6DD2A88D-3B60-4CA6-AC4F-A37967FE90F2}C:\program files (x86)\bittorrent\bittorrent.exe -> profile=private | protocol=17 | dir=in | action=allow | name=bittorrent | app=c:\program files (x86)\bittorrent\bittorrent.exe | 
UDP Query User{6E5BB5F5-6B37-4857-A192-75D4CD9659FC}C:\program files (x86)\java\jre6\bin\java.exe -> profile=private | protocol=17 | dir=in | action=allow | name=java™ platform se binary | app=c:\program files (x86)\java\jre6\bin\java.exe | 
UDP Query User{D84494D0-084D-4274-935C-BA8BF3FC1EEF}C:\games\world of warcraft\launcher.exe -> profile=public | protocol=17 | dir=in | action=allow | name=blizzard launcher | app=c:\games\world of warcraft\launcher.exe | 
UDP Query User{EE4250CD-67C9-4603-81E5-4F96A32F0E72}C:\program files (x86)\itunes\itunes.exe -> profile=private | protocol=17 | dir=in | action=allow | name=itunes | app=c:\program files (x86)\itunes\itunes.exe | 
UDP Query User{F3727B07-D9BE-4EC7-9AAE-D494D393FF28}C:\users\jon\downloads\downloader_warcraft3_the_frozen_throne_enus.exe -> profile=private | protocol=17 | dir=in | action=allow | name=downloader_warcraft3_the_frozen_throne_enus.exe | app=c:\users\jon\downloads\downloader_warcraft3_the_frozen_throne_enus.exe | 
< Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List -> 
"C:\Program Files (x86)\BitTorrent\bittorrent.exe" -> C:\Program Files (x86)\BitTorrent\bittorrent.exe [C:\Program Files (x86)\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent] -> [2009/04/08 15:37:48 | 00,637,232 | —- | M] (BitTorrent, Inc.)
< SafeBoot AlternateShell [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot -> 
"AlternateShell" -> cmd.exe -> 
< CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom ->
"AutoRun" -> 1 -> 
"DisplayName" -> CD-ROM Driver -> 
"ImagePath" -> C:\Windows\SysNative\DRIVERS\cdrom.sys [system32\DRIVERS\cdrom.sys] -> [2008/01/20 22:46:54 | 00,079,872 | —- | M] ()
< Drives with AutoRun files > ->  -> 
D:\autorun [] -> D:\autorun [ CDFS ] -> [2007/10/24 20:12:41 | 00,000,000 | —D | M]
D:\Autorun.inf [[autorun] | open=AutoRunCD.exe | icon=AutoRunCD.exe, 0 |  |  | ] -> D:\Autorun.inf [ CDFS ] -> [2007/07/19 10:53:44 | 00,000,058 | R— | M] ()
D:\AutoRunCD.exe [MZ | ] -> D:\AutoRunCD.exe [ CDFS ] -> [2007/10/24 18:11:40 | 04,318,432 | R— | M] (Crytek)
< MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 -> 
\{799038de-30eb-11de-8d03-806e6f6e6963}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{799038de-30eb-11de-8d03-806e6f6e6963}\shell
\{799038de-30eb-11de-8d03-806e6f6e6963}\shell\\"" ->  [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{799038de-30eb-11de-8d03-806e6f6e6963}\shell\AutoRun\command
\{799038de-30eb-11de-8d03-806e6f6e6963}\shell\AutoRun\command\\"" -> D:\AutoRunCD.exe [D:\AutoRunCD.exe] -> [2007/10/24 18:11:40 | 04,318,432 | R— | M] (Crytek)
 
[Registry - Additional Scans - Safe List]
< EventViewer Logs - Last 10 Errors > -> Event Information -> Description
Application [ Error ] 7/16/2009 3:09:37 AM Computer Name = Jon-PC | Source = WinMgmt | ID = 10 -> Description = 
Application [ Error ] 7/17/2009 8:02:20 PM Computer Name = Jon-PC | Source = WinMgmt | ID = 10 -> Description = 
Application [ Error ] 7/18/2009 4:29:51 PM Computer Name = Jon-PC | Source = System Restore | ID = 8193 -> Description = 
Application [ Error ] 7/18/2009 9:49:25 PM Computer Name = Jon-PC | Source = VSS | ID = 8194 -> Description = 
Application [ Error ] 7/19/2009 2:44:11 PM Computer Name = Jon-PC | Source = WinMgmt | ID = 10 -> Description = 
Application [ Error ] 7/19/2009 2:48:43 PM Computer Name = Jon-PC | Source = VSS | ID = 8194 -> Description = 
Application [ Error ] 7/19/2009 5:24:04 PM Computer Name = Jon-PC | Source = WinMgmt | ID = 10 -> Description = 
Application [ Error ] 7/19/2009 5:28:46 PM Computer Name = Jon-PC | Source = MsiInstaller | ID = 11730 -> Description = 
Application [ Error ] 7/19/2009 5:29:15 PM Computer Name = Jon-PC | Source = VSS | ID = 8194 -> Description = 
Application [ Error ] 7/19/2009 5:47:07 PM Computer Name = Jon-PC | Source = WinMgmt | ID = 10 -> Description = 
System [ Error ] 7/19/2009 5:25:31 PM Computer Name = Jon-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20 -> Description = 
System [ Error ] 7/19/2009 5:45:17 PM Computer Name = Jon-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 2 -> Description = 
System [ Error ] 7/19/2009 5:45:17 PM Computer Name = Jon-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 2 -> Description = 
System [ Error ] 7/19/2009 5:45:17 PM Computer Name = Jon-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 2 -> Description = 
System [ Error ] 7/19/2009 5:45:17 PM Computer Name = Jon-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 2 -> Description = 
System [ Error ] 7/19/2009 5:45:17 PM Computer Name = Jon-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 2 -> Description = 
System [ Error ] 7/19/2009 5:45:17 PM Computer Name = Jon-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 2 -> Description = 
System [ Error ] 7/19/2009 5:45:17 PM Computer Name = Jon-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 2 -> Description = 
System [ Error ] 7/19/2009 5:45:17 PM Computer Name = Jon-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 2 -> Description = 
System [ Error ] 7/19/2009 5:45:27 PM Computer Name = Jon-PC | Source = HTTP | ID = 15016 -> Description = 
 
[Files/Folders - Created Within 30 Days]
1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> 
msa.exe -> C:\Windows\msa.exe -> [2009/07/18 21:49:07 | 00,151,040 | —- | C] ()
{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job -> C:\Windows\tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job -> [2009/07/18 21:49:04 | 00,000,236 | -H– | C] ()
{783AF354-B514-42d6-970E-3E8BF0A5279C}.job -> C:\Windows\tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job -> [2009/07/18 21:49:02 | 00,000,226 | -H– | C] ()
msxml71.dll -> C:\Windows\SysWow64\msxml71.dll -> [2009/07/18 21:49:01 | 00,141,828 | —- | C] ()
My Games -> C:\Users\Jon\Documents\My Games -> [2009/07/18 18:48:40 | 00,000,000 | —D | C]
SecuROM -> C:\Users\Jon\AppData\Roaming\SecuROM -> [2009/07/18 18:48:01 | 00,000,000 | RH-D | C]
GameSpy -> C:\Users\Jon\AppData\Local\GameSpy -> [2009/07/18 18:45:45 | 00,000,000 | —D | C]
fusioncache.dat -> C:\Users\Jon\AppData\Local\fusioncache.dat -> [2009/07/18 18:45:41 | 00,000,091 | —- | C] ()
ApplicationHistory -> C:\Users\Jon\AppData\Local\ApplicationHistory -> [2009/07/18 18:45:40 | 00,000,000 | —D | C]
GameSpy Comrade.lnk -> C:\Users\Public\Desktop\GameSpy Comrade.lnk -> [2009/07/18 18:43:35 | 00,001,878 | —- | C] ()
GameSpy -> C:\Program Files (x86)\GameSpy -> [2009/07/18 18:43:25 | 00,000,000 | —D | C]
PerfStringBackup.INI -> C:\Windows\SysWow64\PerfStringBackup.INI -> [2009/07/18 18:42:49 | 00,721,356 | —- | C] ()
URTTEMP -> C:\Windows\SysWow64\URTTEMP -> [2009/07/18 18:42:28 | 00,000,000 | —D | C]
PnkBstrB.exe -> C:\Windows\SysWow64\PnkBstrB.exe -> [2009/07/18 16:29:57 | 00,103,736 | —- | C] ()
PnkBstrA.exe -> C:\Windows\SysWow64\PnkBstrA.exe -> [2009/07/18 16:29:56 | 00,066,872 | —- | C] ()
pbsvc.exe -> C:\Windows\SysWow64\pbsvc.exe -> [2009/07/18 16:29:55 | 00,669,184 | —- | C] ()
Media Center Programs -> C:\ProgramData\Media Center Programs -> [2009/07/18 16:29:08 | 00,000,000 | —D | C]
Electronic Arts -> C:\Program Files (x86)\Electronic Arts -> [2009/07/18 16:19:42 | 00,000,000 | —D | C]
atmfd.dll -> C:\Windows\SysNative\atmfd.dll -> [2009/07/15 05:25:20 | 00,366,080 | —- | C] ()
t2embed.dll -> C:\Windows\SysNative\t2embed.dll -> [2009/07/15 05:25:20 | 00,189,440 | —- | C] ()
t2embed.dll -> C:\Windows\SysWow64\t2embed.dll -> [2009/07/15 05:25:20 | 00,156,672 | —- | C] (Microsoft Corporation)
fontsub.dll -> C:\Windows\SysNative\fontsub.dll -> [2009/07/15 05:25:20 | 00,096,256 | —- | C] ()
fontsub.dll -> C:\Windows\SysWow64\fontsub.dll -> [2009/07/15 05:25:20 | 00,072,704 | —- | C] (Microsoft Corporation)
atmlib.dll -> C:\Windows\SysNative\atmlib.dll -> [2009/07/15 05:25:20 | 00,048,128 | —- | C] ()
dciman32.dll -> C:\Windows\SysWow64\dciman32.dll -> [2009/07/15 05:25:20 | 00,010,240 | —- | C] (Microsoft Corporation)
Music -> C:\Music -> [2009/07/14 21:07:23 | 00,000,000 | —D | C]
TweetDeck -> C:\Program Files (x86)\TweetDeck -> [2009/07/14 12:07:49 | 00,000,000 | —D | C]
n5742891_40649236_7657.jpg -> C:\Users\Jon\Desktop\n5742891_40649236_7657.jpg -> [2009/07/09 15:45:43 | 00,032,056 | —- | C] ()
.recently-used.xbel -> C:\Users\Jon\.recently-used.xbel -> [2009/07/09 02:35:39 | 00,000,218 | —- | C] ()
gtk-2.0 -> C:\Users\Jon\AppData\Roaming\gtk-2.0 -> [2009/07/08 19:38:09 | 00,000,000 | —D | C]
.purple -> C:\Users\Jon\AppData\Roaming\.purple -> [2009/07/08 19:37:35 | 00,000,000 | —D | C]
Aspell -> C:\Program Files (x86)\Aspell -> [2009/07/08 19:37:07 | 00,000,000 | —D | C]
Pidgin -> C:\Program Files (x86)\Pidgin -> [2009/07/08 19:36:25 | 00,000,000 | —D | C]
GTK -> C:\Program Files (x86)\Common Files\GTK -> [2009/07/08 19:36:23 | 00,000,000 | —D | C]
Sony -> C:\Users\Jon\AppData\Roaming\Sony -> [2009/07/07 01:42:34 | 00,000,000 | —D | C]
Publish Providers -> C:\Users\Jon\AppData\Roaming\Publish Providers -> [2009/07/06 18:53:38 | 00,000,000 | —D | C]
NetMedia Providers -> C:\Users\Jon\AppData\Roaming\NetMedia Providers -> [2009/07/06 18:53:38 | 00,000,000 | —D | C]
ACID Xpress 7.0 Projects -> C:\Users\Jon\Documents\ACID Xpress 7.0 Projects -> [2009/07/06 18:53:38 | 00,000,000 | —D | C]
Sony -> C:\Users\Jon\AppData\Local\Sony -> [2009/07/06 18:51:53 | 00,000,000 | —D | C]
MusicLoop -> C:\Users\Jon\Desktop\MusicLoop -> [2009/07/06 18:49:55 | 00,000,000 | —D | C]
Sony -> C:\Program Files (x86)\Sony -> [2009/07/06 18:48:57 | 00,000,000 | —D | C]
Sony Setup -> C:\Program Files (x86)\Sony Setup -> [2009/07/06 18:48:29 | 00,000,000 | —D | C]
Warcraft III - The Frozen Throne.lnk -> C:\Users\Public\Desktop\Warcraft III - The Frozen Throne.lnk -> [2009/07/04 00:06:55 | 00,000,775 | —- | C] ()
Film Pro -> C:\Users\Jon\Desktop\Film Pro -> [2009/07/03 23:58:21 | 00,000,000 | —D | C]
Warcraft III.lnk -> C:\Users\Public\Desktop\Warcraft III.lnk -> [2009/07/03 23:56:11 | 00,000,730 | —- | C] ()
DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> C:\Users\Jon\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> [2009/06/22 20:37:13 | 00,007,168 | —- | C] ()
HighAndes -> C:\Users\Jon\Documents\HighAndes -> [2009/06/22 20:37:09 | 00,000,000 | —D | C]
HighAndes -> C:\Users\Jon\AppData\Roaming\HighAndes -> [2009/06/22 20:37:09 | 00,000,000 | —D | C]
HighAndes -> C:\Users\Jon\AppData\Local\HighAndes -> [2009/06/22 20:37:09 | 00,000,000 | —D | C]
HighAndes -> C:\ProgramData\HighAndes -> [2009/06/22 20:37:09 | 00,000,000 | —D | C]
trakAxPC.lnk -> C:\Users\Public\Desktop\trakAxPC.lnk -> [2009/06/22 20:35:51 | 00,001,918 | —- | C] ()
HighAndes -> C:\Program Files (x86)\HighAndes -> [2009/06/22 20:35:50 | 00,000,000 | —D | C]
TweetDeck.lnk -> C:\Users\Public\Desktop\TweetDeck.lnk -> [2009/06/22 14:09:43 | 00,000,792 | —- | C] ()
CohUpdater_UI_Win.dll -> C:\Windows\SysWow64\CohUpdater_UI_Win.dll -> [2009/05/17 19:04:54 | 00,643,072 | —- | C] ()
{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini -> C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini -> [2009/04/23 22:46:20 | 00,000,262 | —- | C] ()
physxcudart_20.dll -> C:\Windows\SysWow64\physxcudart_20.dll -> [2008/10/07 09:13:30 | 00,197,912 | —- | C] ()
AgCPanelTraditionalChinese.dll -> C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll -> [2008/10/07 09:13:22 | 00,058,648 | —- | C] ()
AgCPanelSwedish.dll -> C:\Windows\SysWow64\AgCPanelSwedish.dll -> [2008/10/07 09:13:20 | 00,058,648 | —- | C] ()
AgCPanelSpanish.dll -> C:\Windows\SysWow64\AgCPanelSpanish.dll -> [2008/10/07 09:13:20 | 00,058,648 | —- | C] ()
AgCPanelSimplifiedChinese.dll -> C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll -> [2008/10/07 09:13:20 | 00,058,648 | —- | C] ()
AgCPanelPortugese.dll -> C:\Windows\SysWow64\AgCPanelPortugese.dll -> [2008/10/07 09:13:20 | 00,058,648 | —- | C] ()
AgCPanelKorean.dll -> C:\Windows\SysWow64\AgCPanelKorean.dll -> [2008/10/07 09:13:20 | 00,058,648 | —- | C] ()
AgCPanelJapanese.dll -> C:\Windows\SysWow64\AgCPanelJapanese.dll -> [2008/10/07 09:13:20 | 00,058,648 | —- | C] ()
AgCPanelGerman.dll -> C:\Windows\SysWow64\AgCPanelGerman.dll -> [2008/10/07 09:13:20 | 00,058,648 | —- | C] ()
AgCPanelFrench.dll -> C:\Windows\SysWow64\AgCPanelFrench.dll -> [2008/10/07 09:13:20 | 00,058,648 | —- | C] ()
tcpmon.ini -> C:\Windows\SysWow64\tcpmon.ini -> [2008/01/20 22:50:05 | 00,060,124 | —- | C] ()
msjetoledb40.dll -> C:\Windows\SysWow64\msjetoledb40.dll -> [2008/01/20 22:49:49 | 00,368,640 | —- | C] ()
win.ini -> C:\Windows\win.ini -> [2006/11/02 08:34:27 | 00,000,219 | —- | C] ()
system.ini -> C:\Windows\system.ini -> [2006/11/02 08:34:27 | 00,000,219 | —- | C] ()
 
[Files/Folders - Modified Within 30 Days]
1 C:\Users\Jon\*.tmp files -> C:\Users\Jon\*.tmp -> 
23 C:\Users\Jon\AppData\Local\Temp\*.tmp files -> C:\Users\Jon\AppData\Local\Temp\*.tmp -> 
231 C:\Windows\Temp\*.tmp files -> C:\Windows\Temp\*.tmp -> 
a.dat -> C:\Users\Jon\AppData\Local\Temp\a.dat -> [2009/07/19 17:53:08 | 00,076,740 | —- | M] ()
NTUSER.DAT -> C:\Users\Jon\NTUSER.DAT -> [2009/07/19 17:53:03 | 01,835,008 | -HS- | M] ()
PerfStringBackup.INI -> C:\Windows\SysNative\PerfStringBackup.INI -> [2009/07/19 17:51:31 | 00,704,434 | —- | M] ()
perfh009.dat -> C:\Windows\SysNative\perfh009.dat -> [2009/07/19 17:51:31 | 00,604,214 | —- | M] ()
perfc009.dat -> C:\Windows\SysNative\perfc009.dat -> [2009/07/19 17:51:31 | 00,105,170 | —- | M] ()
qmgr1.dat -> C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat -> [2009/07/19 17:48:41 | 04,194,304 | —- | M] ()
qmgr0.dat -> C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat -> [2009/07/19 17:48:40 | 04,194,304 | —- | M] ()
{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job -> C:\Windows\tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job -> [2009/07/19 17:45:32 | 00,000,236 | -H– | M] ()
{783AF354-B514-42d6-970E-3E8BF0A5279C}.job -> C:\Windows\tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job -> [2009/07/19 17:45:32 | 00,000,226 | -H– | M] ()
7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 -> C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 -> [2009/07/19 17:45:29 | 00,003,712 | -H– | M] ()
7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 -> C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 -> [2009/07/19 17:45:29 | 00,003,712 | -H– | M] ()
SA.DAT -> C:\Windows\tasks\SA.DAT -> [2009/07/19 17:45:27 | 00,000,006 | -H– | M] ()
bootstat.dat -> C:\Windows\bootstat.dat -> [2009/07/19 17:45:26 | 00,067,584 | –S- | M] ()
NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TMContainer00000000000000000001.regtrans-ms -> C:\Users\Jon\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TMContainer00000000000000000001.regtrans-ms -> [2009/07/19 17:40:57 | 00,524,288 | -HS- | M] ()
NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TM.blf -> C:\Users\Jon\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TM.blf -> [2009/07/19 17:40:57 | 00,065,536 | -HS- | M] ()
IconCache.db -> C:\Users\Jon\AppData\Local\IconCache.db -> [2009/07/19 17:40:53 | 02,000,011 | -H– | M] ()
PerfStringBackup.INI -> C:\Windows\SysWow64\PerfStringBackup.INI -> [2009/07/19 14:59:21 | 00,721,356 | —- | M] ()
irvhx6uc.dll -> C:\Users\Jon\AppData\Local\Temp\irvhx6uc.dll -> [2009/07/19 14:43:45 | 00,024,576 | —- | M] ( )
FNTCACHE.DAT -> C:\Windows\SysNative\FNTCACHE.DAT -> [2009/07/19 14:42:44 | 00,378,664 | —- | M] ()
User_Feed_Synchronization-{F2D9EA03-A21C-4359-9D88-8EC83FF4217B}.job -> C:\Windows\tasks\User_Feed_Synchronization-{F2D9EA03-A21C-4359-9D88-8EC83FF4217B}.job -> [2009/07/19 14:22:14 | 00,000,414 | -H– | M] ()
PublishedRacMonSWITable.DAT -> C:\ProgramData\Microsoft\RAC\PublishedData\PublishedRacMonSWITable.DAT -> [2009/07/19 14:21:35 | 00,074,408 | —- | M] ()
PublishedRacMonAFLTable.DAT -> C:\ProgramData\Microsoft\RAC\PublishedData\PublishedRacMonAFLTable.DAT -> [2009/07/19 14:21:35 | 00,003,312 | —- | M] ()
PublishedRacMonOSFTable.DAT -> C:\ProgramData\Microsoft\RAC\PublishedData\PublishedRacMonOSFTable.DAT -> [2009/07/19 14:21:35 | 00,000,828 | —- | M] ()
PublishedRacMonHFLTable.DAT -> C:\ProgramData\Microsoft\RAC\PublishedData\PublishedRacMonHFLTable.DAT -> [2009/07/19 14:21:35 | 00,000,000 | —- | M] ()
PublishedRacMonCLKTable.DAT -> C:\ProgramData\Microsoft\RAC\PublishedData\PublishedRacMonCLKTable.DAT -> [2009/07/19 14:21:35 | 00,000,000 | —- | M] ()
PublishedRacMonIndex.DAT -> C:\ProgramData\Microsoft\RAC\PublishedData\PublishedRacMonIndex.DAT -> [2009/07/19 14:21:34 | 00,002,040 | —- | M] ()
msa.exe -> C:\Windows\msa.exe -> [2009/07/18 21:49:03 | 00,151,040 | —- | M] ()
c.exe -> C:\Users\Jon\AppData\Local\Temp\c.exe -> [2009/07/18 21:49:03 | 00,151,040 | —- | M] ()
a.exe -> C:\Users\Jon\AppData\Local\Temp\a.exe -> [2009/07/18 21:49:01 | 00,187,396 | —- | M] ()
b.exe -> C:\Users\Jon\AppData\Local\Temp\b.exe -> [2009/07/18 21:49:01 | 00,161,280 | —- | M] ()
msxml71.dll -> C:\Windows\SysWow64\msxml71.dll -> [2009/07/18 21:49:01 | 00,141,828 | —- | M] ()
drm_dyndata_7340014.dll -> C:\Users\Jon\AppData\Local\Temp\drm_dyndata_7340014.dll -> [2009/07/18 18:48:01 | 00,208,896 | —- | M] (Sony DADC Austria AG)
GDIPFONTCACHEV1.DAT -> C:\Users\Jon\AppData\Local\GDIPFONTCACHEV1.DAT -> [2009/07/18 18:45:42 | 00,101,440 | —- | M] ()
fusioncache.dat -> C:\Users\Jon\AppData\Local\fusioncache.dat -> [2009/07/18 18:45:41 | 00,000,091 | —- | M] ()
GameSpy Comrade.lnk -> C:\Users\Public\Desktop\GameSpy Comrade.lnk -> [2009/07/18 18:43:35 | 00,001,878 | —- | M] ()
PnkBstrB.exe -> C:\Windows\SysWow64\PnkBstrB.exe -> [2009/07/18 16:30:01 | 00,103,736 | —- | M] ()
PnkBstrA.exe -> C:\Windows\SysWow64\PnkBstrA.exe -> [2009/07/18 16:29:56 | 00,066,872 | —- | M] ()
pbsvc.exe -> C:\Windows\SysWow64\pbsvc.exe -> [2009/07/18 16:29:55 | 00,669,184 | —- | M] ()
ISBEW64.exe -> C:\Users\Jon\AppData\Local\Temp\{67F067EF-7EF8-44A3-8F17-3ABFC5D023F8}\ISBEW64.exe -> [2009/07/18 16:29:10 | 00,120,240 | —- | M] (Macrovision Corporation)
Mozilla Firefox.lnk -> C:\Users\Public\Desktop\Mozilla Firefox.lnk -> [2009/07/16 19:07:07 | 00,001,778 | —- | M] ()
TweetDeck.lnk -> C:\Users\Public\Desktop\TweetDeck.lnk -> [2009/07/14 12:07:49 | 00,000,792 | —- | M] ()
n5742891_40649236_7657.jpg -> C:\Users\Jon\Desktop\n5742891_40649236_7657.jpg -> [2009/07/09 15:48:51 | 00,032,056 | —- | M] ()
.recently-used.xbel -> C:\Users\Jon\.recently-used.xbel -> [2009/07/09 02:35:39 | 00,000,218 | —- | M] ()
mrt.exe -> C:\Windows\SysNative\mrt.exe -> [2009/07/07 11:43:31 | 26,410,432 | —- | M] ()
Adobe Reader 9.lnk -> C:\Users\Public\Desktop\Adobe Reader 9.lnk -> [2009/07/06 21:02:04 | 00,001,917 | —- | M] ()
Warcraft III - The Frozen Throne.lnk -> C:\Users\Public\Desktop\Warcraft III - The Frozen Throne.lnk -> [2009/07/04 00:07:21 | 00,000,775 | —- | M] ()
Warcraft III.lnk -> C:\Users\Public\Desktop\Warcraft III.lnk -> [2009/07/03 23:56:27 | 00,000,730 | —- | M] ()
PD10ENp_x64.exe -> C:\Users\Jon\AppData\Local\Temp\PD10ENp_x64.exe -> [2009/06/29 11:52:27 | 13,629,224 | —- | M] (Raxco Software, Inc.										)
DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> C:\Users\Jon\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> [2009/06/22 20:37:26 | 00,007,168 | —- | M] ()
trakAxPC.lnk -> C:\Users\Public\Desktop\trakAxPC.lnk -> [2009/06/22 20:35:51 | 00,001,918 | —- | M] ()
opa12.dat -> C:\ProgramData\Microsoft\OFFICE\DATA\opa12.dat -> [2009/06/12 12:20:20 | 00,008,206 | —- | M] ()
res22-a.dat -> C:\Windows\Temp\res22-a.dat -> [2009/05/03 22:57:00 | 00,011,214 | —- | M] ()
Launcher.exe -> C:\Users\Jon\AppData\Local\Temp\Blizzard Launcher Temporary - 0df1a5b8\Launcher.exe -> [2009/04/24 01:11:17 | 03,798,624 | —- | M] (Blizzard Entertainment)
_Setup.dll -> C:\Users\Jon\AppData\Local\Temp\isp2043.tmp\_Setup.dll -> [2009/04/23 21:51:18 | 00,368,640 | —- | M] (Macrovision Corporation)
Jon.dat -> C:\ProgramData\Microsoft\User Account Pictures\Jon.dat -> [2009/04/23 09:25:44 | 00,000,000 | —- | M] ()
nvuninst.exe -> C:\Users\Jon\AppData\Local\Temp\{EF638800-6423-46DE-9C4D-677AEE900269}\{EFB7D050-CAD2-11D4-B34D-00105A1C23DD}\nvuninst.exe -> [2009/03/27 08:14:50 | 00,502,304 | —- | M] (NVIDIA Corporation)
AskInstallChecker.exe -> C:\Users\Jon\AppData\Local\Temp\AskInstallChecker.exe -> [2009/03/25 15:20:56 | 00,054,664 | —- | M] ()
nvuninst.exe -> C:\Users\Jon\AppData\Local\Temp\{7EB2BA4F-B1F4-4B77-8BD3-00F1A857EF9F}\{EFB7D050-CAD2-11D4-B34D-00105A1C23DD}\nvuninst.exe -> [2009/02/05 10:54:18 | 00,501,280 | —- | M] (NVIDIA Corporation)
ISSetup.dll -> C:\Users\Jon\AppData\Local\Temp\{3BE8165C-1502-4F38-BC90-1040292B7652}\ISSetup.dll -> [2008/08/06 04:25:54 | 00,492,164 | R— | M] (Macrovision Corporation)
_is39C8.exe -> C:\Users\Jon\AppData\Local\Temp\_is39C8.exe -> [2008/08/06 04:25:54 | 00,460,248 | R— | M] (Macrovision Corporation)
_Setup.dll -> C:\Users\Jon\AppData\Local\Temp\{3BE8165C-1502-4F38-BC90-1040292B7652}\_Setup.dll -> [2008/08/06 04:25:54 | 00,373,680 | R— | M] (Macrovision Corporation)
packmantrk.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\TRK\packmantrk.dll -> [2007/04/09 17:24:24 | 00,028,672 | —- | M] ()
packmantha.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\THA\packmantha.dll -> [2007/04/09 17:24:24 | 00,028,672 | —- | M] ()
packmansve.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\SVE\packmansve.dll -> [2007/04/09 17:24:24 | 00,028,672 | —- | M] ()
packmanslv.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\SLV\packmanslv.dll -> [2007/04/09 17:24:24 | 00,028,672 | —- | M] ()
packmansky.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\SKY\packmansky.dll -> [2007/04/09 17:24:24 | 00,028,672 | —- | M] ()
packmanhun.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\HUN\packmanhun.dll -> [2007/04/09 17:24:24 | 00,028,672 | —- | M] ()
packmanell.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\ELL\packmanell.dll -> [2007/04/09 17:24:24 | 00,028,672 | —- | M] ()
packmancsy.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\CSY\packmancsy.dll -> [2007/04/09 17:24:24 | 00,028,672 | —- | M] ()
packmanrus.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\RUS\packmanrus.dll -> [2007/04/09 17:24:22 | 00,028,672 | —- | M] ()
packmanptg.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\PTG\packmanptg.dll -> [2007/04/09 17:24:22 | 00,028,672 | —- | M] ()
packmanptb.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\PTB\packmanptb.dll -> [2007/04/09 17:24:22 | 00,028,672 | —- | M] ()
packmanplk.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\PLK\packmanplk.dll -> [2007/04/09 17:24:22 | 00,028,672 | —- | M] ()
packmannor.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\NOR\packmannor.dll -> [2007/04/09 17:24:22 | 00,028,672 | —- | M] ()
packmannld.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\NLD\packmannld.dll -> [2007/04/09 17:24:22 | 00,028,672 | —- | M] ()
packmankor.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\KOR\packmankor.dll -> [2007/04/09 17:24:22 | 00,028,672 | —- | M] ()
packmanjpn.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\JPN\packmanjpn.dll -> [2007/04/09 17:24:22 | 00,028,672 | —- | M] ()
packmanita.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\ITA\packmanita.dll -> [2007/04/09 17:24:20 | 00,028,672 | —- | M] ()
packmanheb.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\HEB\packmanheb.dll -> [2007/04/09 17:24:20 | 00,028,672 | —- | M] ()
packmanfra.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\FRA\packmanfra.dll -> [2007/04/09 17:24:20 | 00,028,672 | —- | M] ()
packmanfin.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\FIN\packmanfin.dll -> [2007/04/09 17:24:20 | 00,028,672 | —- | M] ()
packmanesp.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\ESP\packmanesp.dll -> [2007/04/09 17:24:20 | 00,028,672 | —- | M] ()
packmandeu.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\DEU\packmandeu.dll -> [2007/04/09 17:24:20 | 00,028,672 | —- | M] ()
packmandan.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\DAN\packmandan.dll -> [2007/04/09 17:24:20 | 00,028,672 | —- | M] ()
packmancht.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\CHT\packmancht.dll -> [2007/04/09 17:24:20 | 00,028,672 | —- | M] ()
packmanchs.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\CHS\packmanchs.dll -> [2007/04/09 17:24:20 | 00,028,672 | —- | M] ()
packmanenu.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\ENU\packmanenu.dll -> [2007/04/09 17:24:18 | 00,028,672 | —- | M] ()
packmanara.dll -> C:\Users\Jon\AppData\Local\Temp\IPMx3\Lang\PackMan\ARA\packmanara.dll -> [2007/04/09 17:24:18 | 00,028,672 | —- | M] ()
Au_.exe -> C:\Users\Jon\AppData\Local\Temp\~nsu.tmp\Au_.exe -> [2006/08/04 19:05:21 | 00,064,301 | R— | M] ()
 
[File - Lop Check]
Roaming -> C:\Users\Default\AppData\Roaming -> [2006/11/02 11:07:25 | 00,000,000 | —D | M]
Media Center Programs -> C:\Users\Default\AppData\Roaming\Media Center Programs -> [2006/11/02 11:07:25 | 00,000,000 | —D | M]
Roaming -> C:\Users\Default User\AppData\Roaming -> [2006/11/02 11:07:25 | 00,000,000 | —D | M]
Media Center Programs -> C:\Users\Default User\AppData\Roaming\Media Center Programs -> [2006/11/02 11:07:25 | 00,000,000 | —D | M]
Roaming -> C:\Users\Jon\AppData\Roaming -> [2009/07/18 18:48:01 | 00,000,000 | —D | M]
.purple -> C:\Users\Jon\AppData\Roaming\.purple -> [2009/07/10 01:57:10 | 00,000,000 | —D | M]
BitTorrent -> C:\Users\Jon\AppData\Roaming\BitTorrent -> [2009/07/14 21:41:56 | 00,000,000 | —D | M]
DNA -> C:\Users\Jon\AppData\Roaming\DNA -> [2009/07/19 17:45:50 | 00,000,000 | —D | M]
gtk-2.0 -> C:\Users\Jon\AppData\Roaming\gtk-2.0 -> [2009/07/08 19:38:09 | 00,000,000 | —D | M]
HighAndes -> C:\Users\Jon\AppData\Roaming\HighAndes -> [2009/06/22 20:37:09 | 00,000,000 | —D | M]
Media Center Programs -> C:\Users\Jon\AppData\Roaming\Media Center Programs -> [2006/11/02 11:07:25 | 00,000,000 | —D | M]
NetMedia Providers -> C:\Users\Jon\AppData\Roaming\NetMedia Providers -> [2009/07/06 18:53:38 | 00,000,000 | —D | M]
Publish Providers -> C:\Users\Jon\AppData\Roaming\Publish Providers -> [2009/07/06 18:53:38 | 00,000,000 | —D | M]
SecuROM -> C:\Users\Jon\AppData\Roaming\SecuROM -> [2009/07/18 18:48:01 | 00,000,000 | RH-D | M]
Sony -> C:\Users\Jon\AppData\Roaming\Sony -> [2009/07/07 01:42:34 | 00,000,000 | —D | M]
TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1 -> C:\Users\Jon\AppData\Roaming\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1 -> [2009/05/18 13:05:10 | 00,000,000 | —D | M]
Ventrilo -> C:\Users\Jon\AppData\Roaming\Ventrilo -> [2009/04/28 12:23:18 | 00,000,000 | —D | M]
C:\Windows\Tasks\ -> C:\Windows\Tasks -> [2009/07/19 17:45:30 | 00,000,000 | —D | M]
SA.DAT -> C:\Windows\Tasks\SA.DAT -> [2009/07/19 17:45:27 | 00,000,006 | -H– | M] ()
SCHEDLGU.TXT -> C:\Windows\Tasks\SCHEDLGU.TXT -> [2009/07/19 17:41:46 | 00,017,654 | —- | M] ()
User_Feed_Synchronization-{F2D9EA03-A21C-4359-9D88-8EC83FF4217B}.job -> C:\Windows\Tasks\User_Feed_Synchronization-{F2D9EA03-A21C-4359-9D88-8EC83FF4217B}.job -> [2009/07/19 14:22:14 | 00,000,414 | -H– | M] ()
{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job -> C:\Windows\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job -> [2009/07/19 17:45:32 | 00,000,236 | -H– | M] ()
{783AF354-B514-42d6-970E-3E8BF0A5279C}.job -> C:\Windows\Tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job -> [2009/07/19 17:45:32 | 00,000,226 | -H– | M] ()
 
[File - Purity Scan]
 
< End of report >

Hi,

Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.

• When done, DDS will open two (2) logs:
  • DDS.txt
  • Attach.txt
• Save both reports to your desktop. Post them back to your topic.

Download GMER here by clicking download exe -button and then saving it your desktop:

• Double-click .exe that you downloaded
• Click rootkit-tab and then scan.
• Don't check
  Show All
  box while scanning in progress!
• When scanning is ready, click Copy.
• This copies log to clipboard
• Post log in your reply.

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log