[Resolved] Google Redirect/Adware popup rootkit major

!!!
GMER still would not run, even in safe mode. Same deal, it would get to \Device\Harddisk\VolumeShadowCopy1 and then just crash out
I deleted it and re-downloaded it and everything

I ran OTL, followed all instructions to the letter

OTL.txt

OTL logfile created on: 26/02/2010 12:28:35 PM - Run 1
OTL by OldTimer - Version 3.1.30.3 Folder = C:\Users\April\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18783)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 64.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.48 Gb Total Space | 39.59 Gb Free Space | 13.72% Space Free | Partition Type: NTFS
Drive D: | 9.61 Gb Total Space | 1.32 Gb Free Space | 13.71% Space Free | Partition Type: NTFS
Drive E: | 298.09 Gb Total Space | 122.60 Gb Free Space | 41.13% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YESLOITERING
Current User Name: April
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\April\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\April\AppData\Local\TheWeatherNetwork\WeatherEye\WeatherEye.exe (Pelmorex Media Inc.)
PRC - C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
PRC - C:\Program Files\Electronic Arts\EADM\Core.exe (Electronic Arts)
PRC - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files\Portrait Displays\Pivot Software\Floater.exe ()
PRC - C:\Program Files\Portrait Displays\Pivot Software\wpCtrl.exe ()
PRC - C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe (Portrait Displays, Inc.)
PRC - C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
PRC - C:\Windows\System32\jureg.exe (Sun Microsystems, Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
PRC - C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation)
PRC - C:\Program Files\Portrait Displays\HP My Display\dthtml.exe (Portrait Displays, Inc)
PRC - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe ()
PRC - C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe (Portrait Displays Inc.)
PRC - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
PRC - C:\Program Files\Winamp\winampa.exe ()
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\Citrus Alarm Clock\Citrus Alarm Clock.exe (Orangeline Interactive)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple, Inc.)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Windows\System32\drivers\XAudio.exe (Conexant Systems, Inc.)
PRC - c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe (Hewlett-Packard)
PRC - C:\Program Files\Razer\DeathAdder\razerhid.exe ()
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files\Microsoft Works\WkCalRem.exe (Microsoft® Corporation)
PRC - C:\Program Files\CyberLink\PCM4Everio\EverioService.exe (CyberLink Corp.)
PRC - C:\hp\KBD\kbd.exe (Hewlett-Packard Company)
PRC - C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
PRC - C:\Program Files\Razer\DeathAdder\razerofa.exe (Razer Inc.)
PRC - C:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
PRC - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)
PRC - C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
PRC - C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe (Nuance Communications, Inc.)
PRC - C:\Program Files\CyberLink\Shared Files\RichVideo.exe ()
PRC - C:\Program Files\Razer\DeathAdder\razertra.exe ()
PRC - C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Windows\System32\WUDFHost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\wbem\unsecapp.exe (Microsoft Corporation)
PRC - C:\Windows\System32\schtasks.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe (Logitech Inc.)
PRC - C:\Windows\vsnpstd.exe ()


========== Modules (SafeList) ==========

MOD - C:\Users\April\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Portrait Displays\Pivot Software\Winphook.dll ()
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (NRONOPDCKS) – File not found
SRV - (DRJJMK) – File not found
SRV - (LiveTurbineMessageService) – C:\Program Files\Turbine\Turbine Download Manager\TurbineMessageService.exe (Turbine, Inc.)
SRV - (LiveTurbineNetworkService) – C:\Program Files\Turbine\Turbine Download Manager\TurbineNetworkService.exe (Turbine, Inc.)
SRV - (Stereo Service) – C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (PdiService) – C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe (Portrait Displays, Inc.)
SRV - (ASKUpgrade) – C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe ()
SRV - (ASKService) – C:\Program Files\AskBarDis\bar\bin\AskService.exe ()
SRV - (GameConsoleService) – C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (gusvc) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (LightScribeService) – C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (gupdate1c95c992cc15830) Google Update Service (gupdate1c95c992cc15830) – C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (odserv) – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (nvsvc) – C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation)
SRV - (DTSRVC) – C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe ()
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple, Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (XAudioService) – C:\Windows\System32\drivers\XAudio.exe (Conexant Systems, Inc.)
SRV - (HP Health Check Service) – c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe (Hewlett-Packard)
SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (Adobe Version Cue CS3) – C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe (Adobe Systems Incorporated)
SRV - (RichVideo) Cyberlink RichVideo Service(CRVS) – C:\Program Files\CyberLink\Shared Files\RichVideo.exe ()
SRV - (ehstart) – C:\Windows\ehome\ehstart.dll (Microsoft Corporation)
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)


========== Driver Services (SafeList) ==========

DRV - (Avgfwfd) – C:\Windows\System32\drivers\avgfwd6x.sys (AVG Technologies CZ, s.r.o.)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (PdiPorts) – C:\Windows\System32\drivers\PdiPorts.sys (Portrait Displays, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (HSXHWBS2) – C:\Windows\System32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\Windows\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) – C:\Windows\System32\drivers\HSX_DP.sys (Conexant Systems, Inc.)
DRV - (sptd) – C:\Windows\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (GEARAspiWDM) – C:\Windows\System32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (nvstor32) – C:\Windows\system32\DRIVERS\nvstor32.sys ()
DRV - (XAudio) – C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (xcbdaNtsc) ViXS Tuner Card (NTSC) – C:\Windows\System32\drivers\xcbda.sys (ViXS Systems Inc.)
DRV - (DAdderFltr) – C:\Windows\System32\drivers\dadder.sys (Razer (Asia-Pacific) Pte Ltd)
DRV - (motmodem) – C:\Windows\System32\drivers\motmodem.sys (Motorola)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Avc) – C:\Windows\System32\drivers\avc.sys (Microsoft Corporation)
DRV - (61883) – C:\Windows\System32\drivers\61883.sys (Microsoft Corporation)
DRV - (MSTAPE) – C:\Windows\System32\drivers\mstape.sys (Microsoft Corporation)
DRV - (AVCSTRM) – C:\Windows\System32\drivers\avcstrm.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (secdrv) – C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (mdmxsdk) – C:\Windows\System32\drivers\mdmxsdk.sys (Conexant)
DRV - (snpstd) – C:\Windows\System32\drivers\snpstd.sys ()
DRV - (Ps2) – C:\Windows\System32\drivers\PS2.sys (Hewlett-Packard Company)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.facebook.com/index.php?lh=2f821592ff46f387c6487e03e19d50db&"

FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/16 11:59:02 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/02/16 11:59:01 | 000,000,000 | —D | M]

[2008/09/12 14:47:52 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\Mozilla\Extensions
[2010/02/25 19:54:09 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\Mozilla\Firefox\Profiles\4rhpbiwa.default\extensions
[2009/02/25 02:07:29 | 000,000,000 | —D | M] (Greasemonkey) – C:\Users\April\AppData\Roaming\Mozilla\Firefox\Profiles\4rhpbiwa.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2009/08/27 09:06:37 | 000,000,000 | —D | M] (No name found) – C:\Users\April\AppData\Roaming\Mozilla\Firefox\Profiles\4rhpbiwa.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2010/02/25 19:54:09 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/03/24 09:27:52 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2008/08/28 20:15:51 | 000,221,184 | —- | M] (CNN) – C:\Program Files\Mozilla Firefox\plugins\NPTURNMED.dll

O1 HOSTS File: ([2006/09/18 15:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()
O2 - BHO: (StumbleUpon Launcher) - {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll (stumbleupon.com)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (StumbleUpon Toolbar) - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll (stumbleupon.com)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe_ID0EYTHM] C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3Tray.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe ()
O4 - HKLM..\Run: [DT HPW] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe ()
O4 - HKLM..\Run: [EverioService] C:\Program Files\CyberLink\PCM4Everio\EverioService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [HP Health Check Scheduler] File not found
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
O4 - HKLM..\Run: [Launch LCDMon] C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe File not found
O4 - HKLM..\Run: [Launch LGDCore] C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe (Logitech Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
O4 - HKLM..\Run: [PivotSoftware] C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe ()
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [snpstd] C:\Windows\vsnpstd.exe ()
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateReg] C:\Windows\System32\jureg.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [BitTorrent DNA] C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe (Electronic Arts)
O4 - HKCU..\Run: [WeatherEye] C:\Users\April\AppData\Local\TheWeatherNetwork\WeatherEye\WeatherEye.exe (Pelmorex Media Inc.)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - Startup: C:\Users\April\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wkcalrem.LNK = C:\Program Files\Microsoft Works\WkCalRem.exe (Microsoft® Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O8 - Extra context menu item: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Users\April\Pictures\Photo-a-go-go\hundy thou\acidgreen.jpg
O24 - Desktop BackupWallPaper: C:\Users\April\Pictures\Photo-a-go-go\hundy thou\acidgreen.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/11/23 06:41:34 | 000,000,074 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{4b58a471-de63-11de-97af-001e8cb6dd45}\Shell - "" = AutoRun
O33 - MountPoints2\{4b58a471-de63-11de-97af-001e8cb6dd45}\Shell\AutoRun\command - "" = L:\HPLauncher.exe – File not found
O33 - MountPoints2\{749fa1f6-2032-11de-9789-001e8cb6dd45}\Shell\AutoRun\command - "" = F:\setup.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias [2006/11/02 05:18:47 | 000,000,000 | —D | M]
NetSvcs: Irmon - C:\Windows\System32\irmon.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/02/26 12:25:30 | 000,549,888 | —- | C] (OldTimer Tools) – C:\Users\April\Desktop\OTL.exe
[2010/02/25 22:04:28 | 000,024,856 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgfwd6x.sys
[2010/02/25 21:54:14 | 000,000,000 | —D | C] – C:\Users\April\AppData\Roaming\AVG8
[2010/02/25 04:49:45 | 000,000,000 | —D | C] – C:\Users\April\AppData\Local\Adobe
[2010/02/25 04:39:35 | 000,000,000 | —D | C] – C:\Users\April\AppData\Roaming\Malwarebytes
[2010/02/25 04:39:31 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/02/25 04:39:30 | 000,019,160 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/02/25 04:39:30 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/02/25 04:39:30 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/02/25 04:37:49 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/02/25 04:36:46 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2010/02/25 04:34:39 | 000,791,393 | —- | C] (Lars Hederer ) – C:\Users\April\Desktop\erunt_setup.exe
[2010/02/25 04:31:39 | 000,021,504 | —- | C] (Doug Knox) – C:\Users\April\Desktop\SysRestorePoint.exe
[2010/02/25 03:33:29 | 000,334,720 | —- | C] (Sysinternals - www.sysinternals.com) – C:\Users\April\Desktop\RootkitRevealer.exe
[2010/02/25 02:52:56 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2010/02/25 02:49:59 | 000,000,000 | —D | C] – C:\Users\April\AppData\Roaming\SUPERAntiSpyware.com
[2010/02/25 02:49:59 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2010/02/15 23:57:51 | 000,000,000 | —D | C] – C:\32788R22FWJFW
[2010/02/14 15:33:10 | 000,000,000 | —D | C] – C:\Users\April\AppData\Local\temp(142)
[2010/02/14 15:33:10 | 000,000,000 | —D | C] – C:\Windows\temp
[2010/02/14 15:09:36 | 000,000,000 | —D | C] – C:\ComboFix
[2010/02/14 15:08:56 | 000,000,000 | —D | C] – C:\Qoobox
[2010/02/14 13:18:59 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/02/14 12:30:51 | 000,000,000 | -H-D | C] – C:\ProgramData\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
[2010/02/14 12:30:25 | 000,000,000 | —D | C] – C:\ProgramData\Lavasoft
[2010/02/14 12:30:25 | 000,000,000 | —D | C] – C:\Program Files\Lavasoft
[2010/02/09 05:02:47 | 000,000,000 | —D | C] – C:\Users\April\Documents\FONTS
[2010/02/05 10:13:11 | 000,000,000 | —D | C] – C:\$AVG
[2010/02/05 10:11:47 | 000,000,000 | —D | C] – C:\ProgramData\avg9
[2010/02/02 23:20:08 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DivX Shared
[2008/12/07 02:56:38 | 000,061,440 | —- | C] ( ) – C:\Windows\System32\rsnpstd.dll
[2005/04/20 23:16:28 | 000,036,864 | —- | C] ( ) – C:\Windows\System32\vsnpstd.dll
[2004/02/16 19:59:50 | 000,061,440 | —- | C] ( ) – C:\Windows\System32\csnpstd.dll

========== Files - Modified Within 30 Days ==========

[2010/02/26 12:27:55 | 004,194,304 | -HS- | M] () – C:\Users\April\NTUSER.DAT
[2010/02/26 12:25:30 | 000,549,888 | —- | M] (OldTimer Tools) – C:\Users\April\Desktop\OTL.exe
[2010/02/26 12:24:57 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2010/02/26 12:22:12 | 000,054,156 | -H– | M] () – C:\Windows\QTFont.qfn
[2010/02/26 12:22:00 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/02/26 12:21:58 | 000,003,472 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/02/26 12:21:58 | 000,003,472 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/02/26 12:21:57 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/02/26 12:21:53 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/02/26 12:21:47 | 3219,644,416 | -HS- | M] () – C:\hiberfil.sys
[2010/02/26 11:32:15 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/02/26 10:37:54 | 000,293,376 | —- | M] () – C:\Users\April\Desktop\cqpgucjv.exe
[2010/02/26 10:30:26 | 000,000,020 | —- | M] () – C:\Users\April\defogger_reenable
[2010/02/25 23:41:07 | 000,112,128 | —- | M] () – C:\Users\April\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/25 22:04:28 | 000,024,856 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgfwd6x.sys
[2010/02/25 19:11:07 | 000,000,793 | —- | M] () – C:\Users\Public\Desktop\World of Warcraft.lnk
[2010/02/25 19:06:27 | 000,000,418 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{232F54BC-E566-4F1D-BD15-2E58324827BC}.job
[2010/02/25 05:23:24 | 000,050,477 | —- | M] () – C:\Users\April\Desktop\Defogger.exe
[2010/02/25 04:39:34 | 000,000,820 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/25 04:36:50 | 000,000,735 | —- | M] () – C:\Users\April\Desktop\NTREGOPT.lnk
[2010/02/25 04:36:49 | 000,000,716 | —- | M] () – C:\Users\April\Desktop\ERUNT.lnk
[2010/02/25 04:34:41 | 000,791,393 | —- | M] (Lars Hederer ) – C:\Users\April\Desktop\erunt_setup.exe
[2010/02/25 04:31:39 | 000,021,504 | —- | M] (Doug Knox) – C:\Users\April\Desktop\SysRestorePoint.exe
[2010/02/25 02:50:02 | 000,000,904 | —- | M] () – C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk
[2010/02/18 14:35:43 | 000,729,436 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/02/18 14:35:43 | 000,631,234 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/02/18 14:35:43 | 000,111,812 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/02/16 11:59:03 | 000,001,726 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010/02/16 00:59:53 | 000,001,876 | —- | M] () – C:\Users\April\Desktop\HijackThis.lnk
[2010/02/16 00:20:26 | 004,194,304 | -HS- | M] () – C:\Users\April\ntuser.dat_previous
[2010/02/09 09:11:53 | 000,001,266 | —- | M] () – C:\Users\April\Desktop\DivX Movies.lnk
[2010/02/06 21:59:13 | 000,002,075 | —- | M] () – C:\Users\Public\Desktop\Google Earth.lnk

========== Files Created - No Company Name ==========

[2010/02/26 12:21:47 | 3219,644,416 | -HS- | C] () – C:\hiberfil.sys
[2010/02/26 10:37:54 | 000,293,376 | —- | C] () – C:\Users\April\Desktop\cqpgucjv.exe
[2010/02/26 10:30:10 | 000,000,020 | —- | C] () – C:\Users\April\defogger_reenable
[2010/02/25 05:17:24 | 000,050,477 | —- | C] () – C:\Users\April\Desktop\Defogger.exe
[2010/02/25 04:39:34 | 000,000,820 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/25 04:36:50 | 000,000,735 | —- | C] () – C:\Users\April\Desktop\NTREGOPT.lnk
[2010/02/25 04:36:49 | 000,000,716 | —- | C] () – C:\Users\April\Desktop\ERUNT.lnk
[2010/02/25 03:33:29 | 000,102,160 | —- | C] () – C:\Users\April\Desktop\RootkitRevealer.chm
[2010/02/25 02:50:02 | 000,000,904 | —- | C] () – C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk
[2010/02/16 00:59:53 | 000,001,876 | —- | C] () – C:\Users\April\Desktop\HijackThis.lnk
[2010/02/06 21:59:13 | 000,002,075 | —- | C] () – C:\Users\Public\Desktop\Google Earth.lnk
[2010/02/05 14:14:59 | 367,262,412 | —- | C] () – C:\Users\April\Desktop\Lost.S05E09.HDTV.XviD-NoTV.avi
[2010/02/05 12:47:29 | 367,862,124 | —- | C] () – C:\Users\April\Desktop\Lost.S05E08.HDTV.XviD-XOR.avi
[2010/02/05 12:03:56 | 367,273,454 | —- | C] () – C:\Users\April\Desktop\Lost.S05E06 - 316.avi
[2010/02/05 11:08:21 | 367,116,288 | —- | C] () – C:\Users\April\Desktop\Lost.S05E05 - This Place is Death.avi
[2010/02/05 10:25:31 | 367,084,004 | —- | C] () – C:\Users\April\Desktop\Lost.S05E02 - The Lie.avi
[2010/02/05 09:41:54 | 367,797,282 | —- | C] () – C:\Users\April\Desktop\Lost.S05E03 - Jughead.avi
[2010/02/05 07:32:55 | 367,214,354 | —- | C] () – C:\Users\April\Desktop\lost.S05E14.hdtv.xvid-notv.avi
[2010/02/05 07:32:25 | 367,248,890 | —- | C] () – C:\Users\April\Desktop\lost.S05E15.hdtv.xvid-notv.avi
[2010/02/05 05:38:34 | 733,678,316 | —- | C] () – C:\Users\April\Desktop\lost.s05e16-e17.hdtv.xvid-fqm.avi
[2010/02/02 23:19:48 | 000,001,266 | —- | C] () – C:\Users\April\Desktop\DivX Movies.lnk
[2010/01/20 16:22:11 | 000,000,093 | —- | C] () – C:\Users\April\AppData\Local\fusioncache.dat
[2009/10/29 01:53:47 | 000,147,301 | —- | C] () – C:\Program Files\irc.jar
[2009/10/29 01:53:47 | 000,133,627 | —- | C] () – C:\Program Files\irc-unsigned.jar
[2009/10/29 01:53:47 | 000,086,969 | —- | C] () – C:\Program Files\irc.cab
[2009/10/29 01:53:47 | 000,070,487 | —- | C] () – C:\Program Files\pixx.jar
[2009/10/29 01:53:47 | 000,051,629 | —- | C] () – C:\Program Files\pixx.cab
[2009/10/29 01:53:47 | 000,025,978 | —- | C] () – C:\Program Files\readme_1.txt
[2009/10/29 01:53:47 | 000,017,718 | —- | C] () – C:\Program Files\license.txt
[2009/10/29 01:53:47 | 000,017,704 | —- | C] () – C:\Program Files\background.gif
[2009/10/29 01:53:47 | 000,011,047 | —- | C] () – C:\Program Files\pixx-readme.txt
[2009/10/29 01:53:47 | 000,009,430 | —- | C] () – C:\Program Files\versions.txt
[2009/10/29 01:53:47 | 000,007,788 | —- | C] () – C:\Program Files\securedirc.cab
[2009/10/29 01:53:47 | 000,003,989 | —- | C] () – C:\Program Files\french.lng
[2009/10/29 01:53:47 | 000,003,843 | —- | C] () – C:\Program Files\english.lng
[2009/10/29 01:53:47 | 000,003,158 | —- | C] () – C:\Program Files\IRCApplet.class
[2009/10/29 01:53:47 | 000,002,840 | —- | C] () – C:\Program Files\pixx-french.lng
[2009/10/29 01:53:47 | 000,002,633 | —- | C] () – C:\Program Files\pixx-english.lng
[2009/10/29 01:53:47 | 000,002,495 | —- | C] () – C:\Program Files\HeavyApplet.html
[2009/10/29 01:53:47 | 000,002,131 | —- | C] () – C:\Program Files\AppletWithJS.html
[2009/10/29 01:53:47 | 000,002,083 | —- | C] () – C:\Program Files\NormalApplet.html
[2009/10/29 01:53:47 | 000,001,748 | —- | C] () – C:\Program Files\securedirc-unsigned.cab
[2009/10/29 01:53:47 | 000,000,734 | —- | C] () – C:\Program Files\thanks.txt
[2009/10/29 01:53:47 | 000,000,730 | —- | C] () – C:\Program Files\pjirc.cfg
[2009/10/29 01:53:47 | 000,000,531 | —- | C] () – C:\Program Files\SimpleApplet.html
[2009/10/21 22:53:13 | 000,495,104 | —- | C] () – C:\Program Files\STOIK_Capturer.msi
[2009/10/21 22:53:13 | 000,001,871 | —- | C] () – C:\Program Files\readme.txt
[2009/05/14 19:21:00 | 000,000,262 | —- | C] () – C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2009/04/08 20:13:48 | 000,020,992 | —- | C] () – C:\Windows\jestertb.dll
[2008/11/02 18:37:01 | 000,499,200 | —- | C] () – C:\Windows\System32\WZDPlay.dll
[2008/08/22 22:14:47 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2008/06/10 18:07:20 | 003,596,288 | —- | C] () – C:\Windows\System32\qt-dx331.dll
[2008/06/10 18:03:26 | 000,000,416 | —- | C] () – C:\Windows\System32\dtu100.dll.manifest
[2008/06/10 18:03:26 | 000,000,416 | —- | C] () – C:\Windows\System32\dpl100.dll.manifest
[2008/05/22 16:18:54 | 000,012,288 | —- | C] () – C:\Windows\System32\DivXWMPExtType.dll
[2008/04/12 16:56:24 | 002,463,976 | —- | C] () – C:\Windows\System32\NPSWF32.dll
[2008/04/12 00:08:34 | 000,001,356 | —- | C] () – C:\Users\April\AppData\Local\d3d9caps.dat
[2008/04/02 01:36:12 | 000,000,412 | —- | C] () – C:\Windows\MAXLINK.INI
[2008/03/30 01:57:08 | 000,007,432 | —- | C] () – C:\Windows\System32\Machnm32.sys
[2008/03/30 00:29:42 | 000,002,164 | —- | C] () – C:\Users\April\AppData\Roaming\wklnhst.dat
[2008/03/29 22:18:56 | 000,112,128 | —- | C] () – C:\Users\April\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/11/23 06:34:23 | 000,000,342 | —- | C] () – C:\ProgramData\hpzinstall.log
[2007/11/23 06:28:39 | 000,110,624 | —- | C] () – C:\Windows\System32\drivers\nvstor32.sys
[2007/11/23 06:16:23 | 000,327,680 | —- | C] () – C:\Windows\System32\pythoncom25.dll
[2007/11/23 06:16:23 | 000,102,400 | —- | C] () – C:\Windows\System32\pywintypes25.dll
[2006/11/02 06:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 01:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/05/03 21:40:42 | 000,390,784 | —- | C] () – C:\Windows\System32\drivers\snpstd.sys
[2003/01/17 23:34:40 | 000,015,541 | —- | C] () – C:\Windows\snpstd.ini

========== LOP Check ==========

[2009/02/07 08:11:45 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\Acreon
[2010/02/17 01:04:23 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\Azureus
[2010/02/25 03:27:09 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\BitTorrent
[2008/04/02 02:04:52 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\Canon
[2008/04/12 00:05:43 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\DAEMON Tools
[2008/03/30 02:02:02 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\DisplayTune
[2010/02/26 12:22:12 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\DNA
[2008/07/19 19:10:48 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\ImgBurn
[2008/11/01 21:26:12 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\iWin
[2008/12/31 03:57:07 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\LimeWire
[2009/12/21 19:26:55 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\Mumble
[2008/12/08 03:09:09 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\Mushroom Age
[2009/03/24 09:36:06 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\Mysteryville2
[2008/05/04 05:46:51 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\Orangeline Interactive
[2008/04/02 01:36:05 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\ScanSoft
[2008/08/19 23:32:09 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\SecondLife
[2008/03/28 18:25:34 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\Snapfish
[2009/10/18 16:03:20 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\SPORE Creature Creator
[2009/10/21 22:54:38 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\STOIK
[2010/02/24 15:13:33 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\StumbleUpon
[2008/03/30 00:29:43 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\Template
[2008/03/28 18:29:10 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\WildTangent
[2009/03/18 03:47:49 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\WinBatch
[2010/02/26 12:15:19 | 000,032,628 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/02/25 19:06:27 | 000,000,418 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{232F54BC-E566-4F1D-BD15-2E58324827BC}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2006/11/02 03:49:52 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 – C:\Windows\System32\drivers\AGP440.sys
[2006/11/02 03:49:52 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >
[2006/11/02 03:49:36 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008/01/18 23:06:48 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\System32\drivers\atapi.sys
[2008/01/18 23:06:48 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008/01/18 23:06:48 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008/01/18 22:33:23 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 03:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\System32\cngaudit.dll
[2006/11/02 03:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: EVENTLOG.DLL >
[2007/01/13 00:30:08 | 000,007,216 | —- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 – C:\Program Files\CyberLink\PowerDirector\EventLog.dll

< MD5 for: IASTORV.SYS >
[2006/11/02 03:51:25 | 000,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\drivers\iaStorV.sys
[2006/11/02 03:51:25 | 000,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2006/11/02 03:46:11 | 000,559,616 | —- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B – C:\Windows\System32\netlogon.dll
[2006/11/02 03:46:11 | 000,559,616 | —- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2006/11/02 03:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\drivers\nvstor.sys
[2006/11/02 03:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

< MD5 for: NVSTOR32.SYS >
[2007/10/26 05:51:22 | 000,110,624 | —- | M] (NVIDIA Corporation) MD5=63B7838E9C272BAAA7B33A0CA4EBB748 – C:\hp\DRIVERS\nvidia_storage\nvstor32.sys
[2007/10/26 05:51:22 | 000,110,624 | —- | M] (NVIDIA Corporation) MD5=63B7838E9C272BAAA7B33A0CA4EBB748 – C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_b4609a34\nvstor32.sys
[2007/10/26 05:51:22 | 000,110,624 | —- | M] () Unable to obtain MD5 – C:\Windows\System32\drivers\nvstor32.sys

< MD5 for: SCECLI.DLL >
[2006/11/02 03:46:12 | 000,176,640 | —- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 – C:\Windows\System32\scecli.dll
[2006/11/02 03:46:12 | 000,176,640 | —- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/03/08 05:31:42 | 000,348,160 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\dxtmsft.dll
[2009/03/08 05:31:37 | 000,216,064 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\dxtrans.dll
[2006/11/02 03:47:18 | 000,228,968 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\rsaenh.dll
[2007/11/23 05:51:07 | 000,223,232 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\SLC.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2007/10/26 05:51:22 | 000,110,624 | —- | M] () Unable to obtain MD5 – C:\Windows\System32\drivers\nvstor32.sys

< %systemroot%\System32\config\*.sav >
[2006/11/02 04:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 04:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 04:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 04:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 04:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

========== Alternate Data Streams ==========

@Alternate Data Stream - 64 bytes -> C:\Users\April\Desktop\jrhillplace.avi:TOC.WMV
< End of report >

Extras.txt

OTL Extras logfile created on: 26/02/2010 12:28:35 PM - Run 1
OTL by OldTimer - Version 3.1.30.3 Folder = C:\Users\April\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18783)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 64.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.48 Gb Total Space | 39.59 Gb Free Space | 13.72% Space Free | Partition Type: NTFS
Drive D: | 9.61 Gb Total Space | 1.32 Gb Free Space | 13.71% Space Free | Partition Type: NTFS
Drive E: | 298.09 Gb Total Space | 122.60 Gb Free Space | 41.13% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YESLOITERING
Current User Name: April
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [+ Add to separate archive(s)] – "C:\Program Files\PeaZip\PEAZIP.EXE" "-add2archive" "%1" (Giorgio Tani)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink – (EarthLink, Inc.)
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent – File not found


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0CC3A545-2D2F-4040-B4E7-59EB23ADE6BD}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{1B5190C6-DAE1-4C39-9659-DFB2C9CE5CD3}" = lport=138 | protocol=17 | dir=in | app=system |
"{3E2867C2-A467-4B58-8BC6-63FBE103E301}" = rport=137 | protocol=17 | dir=out | app=system |
"{55EE81E2-E0D3-432A-9686-0088B554370E}" = lport=445 | protocol=6 | dir=in | app=system |
"{71C09CC6-0CE4-4FC2-8178-0A0C58C87D5B}" = lport=50900 | protocol=6 | dir=in | name=adobe version cue cs3 server |
"{73736D60-1EEE-418F-B1A6-5A29584D79C4}" = rport=139 | protocol=6 | dir=out | app=system |
"{7FA373AE-D730-4A7D-96B5-3A9FA2264D37}" = lport=3703 | protocol=6 | dir=in | name=adobe version cue cs3 server |
"{811935AD-68B3-4890-A80D-5BE9C3D40945}" = lport=137 | protocol=17 | dir=in | app=system |
"{8AB0E59D-1FC9-4F20-BD4D-77E65B468093}" = lport=50901 | protocol=6 | dir=in | name=adobe version cue cs3 server |
"{8D089FED-6DC5-4462-B015-14F0AB5301D2}" = lport=139 | protocol=6 | dir=in | app=system |
"{96932795-8F1B-43F2-91B5-50E00A338114}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{9D6D2473-E79E-413D-A3B5-47CD53129522}" = lport=3704 | protocol=6 | dir=in | name=adobe version cue cs3 server |
"{B58A8946-BEDA-486E-8EAC-B5F9AC135FDE}" = rport=445 | protocol=6 | dir=out | app=system |
"{E829BE76-386B-44A4-8369-4FA061C6FB69}" = rport=138 | protocol=17 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0187EBDA-6D60-4A07-B26C-69DBBD9BF50E}" = protocol=6 | dir=in | app=c:\users\april\program files\bittorrent\bittorrent.exe |
"{06C18BFB-4A57-441A-9121-BE0EFA6E9268}" = protocol=6 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{0B5FB11C-81EF-4126-A342-88720689E5EA}" = protocol=17 | dir=in | app=c:\program files\turbine\turbine download manager\turbinemessageservice.exe |
"{0F60EC64-1A84-4F3C-AB1D-8592F47A2367}" = protocol=6 | dir=in | app=c:\program files\turbine\turbine download manager\turbinenetworkservice.exe |
"{1418C36D-E7AF-4644-8DAB-4AB3199010BF}" = protocol=17 | dir=in | app=c:\program files\turbine\turbine download manager\turbinenetworkservice.exe |
"{1EC26C89-3F91-472A-803B-80CF6AD711D3}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{2122B199-6A36-47AA-9546-7D2A89CA1BD3}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{27214D2B-D518-4485-A077-1320D3EA5079}" = protocol=6 | dir=in | app=c:\program files\turbine\turbine download manager\turbinemessageservice.exe |
"{27290F27-96A8-4521-85B1-0814C443A28F}" = dir=in | app=c:\program files\cyberlink\powerdirector express\pdx.exe |
"{3CFFB335-C92A-4016-A689-84E52F941151}" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"{42A653CA-3897-4110-928C-5034C6E5139A}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{499AB45E-F332-4B45-B681-5FC9DAA8BF83}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{4D82F51E-69B8-4296-87EC-D9EE0E804E74}" = protocol=6 | dir=in | app=c:\program files\dna\btdna.exe |
"{552CB696-976A-4194-AD87-EA6BF3BA796B}" = protocol=17 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{5B45CCBA-7587-480E-AFA2-E7E51B1409F9}" = protocol=17 | dir=in | app=c:\program files\dna\btdna.exe |
"{61C121F2-5780-43B4-BFF6-535DC0D00C03}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6547E779-E153-4C90-AA05-DBBC9440DDC1}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
"{65A4E17D-24A5-4C55-B0AB-37D0C25CCA2C}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{66698540-E30F-488A-9A18-0DBE0E61EF33}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{6A98BBD5-DEA9-4E71-A6FD-63EC640B46F8}" = dir=in | app=c:\program files\myspace\im\myspaceim.exe |
"{6AA9DC93-6EDF-42FC-A04E-C21EEFD2F6A1}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{6B8B28D6-3B0A-4E89-AD6C-F3C6F960B8EF}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{6DDB5C88-5BF6-4446-BEC3-FDD4725B4BFF}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{73030E36-03EF-4375-BEFD-A2EA2DA41C22}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{934F04E1-910F-4EF0-A6E3-DD9D05F2FB27}" = protocol=17 | dir=in | app=c:\program files\dna\btdna.exe |
"{A1F97695-9264-4941-A047-B8AE5D01D951}" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{A339EC18-B08B-4EEA-BDFA-9265E7363F23}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{A90CFBB5-90ED-4D2A-A933-8C370668898E}" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"{B0208F4C-9218-4DCD-858F-680A8DCB6D80}" = protocol=17 | dir=in | app=c:\program files\common files\adobe\adobe version cue cs3\server\bin\versioncuecs3.exe |
"{B0A13605-843B-4BC6-8277-368403E55BF1}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{BB8555C0-4DE7-4E53-802E-E30028B2E098}" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{BF69F4CD-D12A-4839-839D-F0E58264A676}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{BF6E0C8A-770D-4E21-BED7-D7D603BCB08B}" = protocol=6 | dir=in | app=c:\program files\common files\adobe\adobe version cue cs3\server\bin\versioncuecs3.exe |
"{C70AF538-A979-46A4-8B5D-A4A9DA998A58}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{DA214B0B-4804-4B9A-BD1E-DEFB1487447A}" = protocol=17 | dir=in | app=c:\users\april\program files\bittorrent\bittorrent.exe |
"{DA6ADB15-4C15-4748-BD7D-45423C862610}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{DDAB686E-87A1-4FF2-A190-C972EF986EB1}" = protocol=17 | dir=in | app=c:\users\april\program files\bittorrent\bittorrent.exe |
"{E50AD1B3-2BBE-4B3F-ABC5-F479F8FDADB0}" = protocol=6 | dir=in | app=c:\users\april\program files\bittorrent\bittorrent.exe |
"{F3F141DA-A090-4445-8375-E7F7DF45B4E5}" = protocol=6 | dir=in | app=c:\program files\dna\btdna.exe |
"{FCEEB441-FBD8-459F-9A90-29F2F244E826}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"TCP Query User{84028524-841A-4F16-A903-B2F63CED02B6}C:\users\april\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\april\program files\dna\btdna.exe |
"TCP Query User{B560C5A4-9E37-4060-A547-C1FEF2590478}C:\program files\azureus\azureus.exe" = protocol=6 | dir=in | app=c:\program files\azureus\azureus.exe |
"TCP Query User{FD4B789C-39D8-4C65-B21B-2F7585EF3612}C:\users\april\appdata\local\temp\blizzard launcher temporary - df3b0a38\launcher.exe" = protocol=6 | dir=in | app=c:\users\april\appdata\local\temp\blizzard launcher temporary - df3b0a38\launcher.exe |
"UDP Query User{16BC26AA-B1F0-4D67-AA41-216E8E0BC649}C:\program files\azureus\azureus.exe" = protocol=17 | dir=in | app=c:\program files\azureus\azureus.exe |
"UDP Query User{5ED2B7FE-E7D7-4134-9623-B51DE1F49719}C:\users\april\appdata\local\temp\blizzard launcher temporary - df3b0a38\launcher.exe" = protocol=17 | dir=in | app=c:\users\april\appdata\local\temp\blizzard launcher temporary - df3b0a38\launcher.exe |
"UDP Query User{F42E9DE9-3489-4ECB-9F92-EAD14579C5CE}C:\users\april\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\april\program files\dna\btdna.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0046FA01-C5B9-4985-BACB-398DC480FC05}" = Adobe Photoshop CS3
"{0217E1D1-BCEF-4A61-AF6D-F7740F65A066}" = Pivot Software
"{0224CACC-994D-45F8-B973-D65056EA9C2F}" = Adobe XMP DVA Panels CS3
"{029B5901-1F27-4347-9923-E8ACC8F54E15}" = Snapfish Picture Mover
"{0327FA9D-975C-448C-A086-577D57BB25B8}" = Adobe Soundbooth CS3 Codecs
"{0684EECC-380C-4B97-8C51-5BDB9E4D679C}" = ArcSoft Software Suite
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{0A2C5854-557E-48C8-835A-3B9F074BDCAA}" = Python 2.5
"{0DEA342C-15CB-4F52-97B6-06A9C4B9C06F}" = SDK
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP210_series" = Canon MP210 series
"{11BB336F-0E58-4977-B866-F24FA334616B}" = HP Active Support Library
"{12A76360-388E-4B27-ABEB-D5FC5378DD2A}" = HPPhotoSmartPhotobookWebPack1
"{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in
"{15733AD1-1CEF-459A-9245-0924FC63BDD5}" = HP My Display
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD}" = QuickTime
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{193EAFD0-1BAF-4FB4-B18F-79D5D6A4B285}" = Adobe After Effects CS3 Presets
"{1D58229F-C505-45CA-8223-F35F3A34B963}" = Adobe Version Cue CS3 Server
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"{209CDA54-D390-46A2-A97C-7BF61734418D}" = WeatherBug Gadget
"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java™ 6 Update 11
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2EAF7E61-068E-11DF-953C-005056806466}" = Google Earth
"{2EFFFC71-1E66-454E-A6E6-CEEC800B96D2}" = Adobe Flash Video Encoder
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java™ SE Runtime Environment 6 Update 1
"{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE
"{39CEE1F2-12B6-4C50-9131-04BFCA110578}" = PowerCinema NE for Everio
"{3EBA6E7C-3DF6-48AE-B87B-4CAFB2C1C3F7}" = LightScribe Template Labeler
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{4458C442-7376-4CF9-AF58-E8CEA6722363}" = Adobe Setup
"{44734179-8A79-4DEE-BB08-73037F065543}" = Apple Mobile Device Support
"{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}" = Bonjour
"{485ACF57-F364-440A-8496-E1E81C8FA1AA}" = Adobe Premiere Pro CS3 Third Party Content
"{4CACFCD9-F71B-413A-8DF5-1A6419D5CDC6}" = Cards_Calendar_OrderGift_DoMorePlugout
"{50F102CA-4BE2-41A9-9810-5BB05EB91B9A}" = Adobe Premiere Pro CS3 Functional Content
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{54B2EAD9-A110-43F7-B010-2859A1BD2AFE}" = Adobe Encore CS3
"{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}" = HP Picasso Media Center Add-In
"{57383270-6F61-4DC8-A9B8-C1745FC29F38}" = USB PC Camera (SN9C102)
"{585776BC-4BD6-4BD2-A19A-1D6CB44A403B}" = iTunes
"{58DCEEE5-532E-44F4-B1D7-A146EF9E9FDA}" = Adobe Premiere Pro CS3
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.8
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6B52140A-F189-4945-BFFC-DB3F00B8C589}" = Adobe Flash CS3
"{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files
"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{714A8115-89BE-44E9-89A5-768405B0BB97}" = Motorola Phone Tools
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{77A1C7DD-E4F6-4057-92FC-710219215987}" = Logitech G11 Keyboard Software 1.03
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{7ACFB90E-8FD0-4397-AD3A-5195412623A3}" = Adobe Help Viewer CS3
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7C10F5C7-F00F-4BD3-A110-C7D240D2DD25}" = Adobe Dreamweaver CS3
"{7DFC1012-D346-46CE-B03E-FF79125AE029}" = Adobe Fireworks CS3
"{7F10292C-A190-4176-A665-A1ED3478DF86}" = LightScribe System Software
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{845A8DB9-8802-4FD3-9FE3-938A6C46A2EC}" = Adobe Video Profiles
"{870815CA-6B60-47B6-88DD-A67F42D2F03E}" = GPL MPEG-1/2 DirectShow Decoder Filter
"{8718DC03-D066-4957-94E5-50C3C5042E8E}" = Adobe Creative Suite 3 Master Collection
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{9885A11E-60E4-417C-B58B-8B31B21C0B8A}" = HP Easy Setup - Frontend
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{9DBA770F-BF73-4D39-B1DF-6035D95268FC}" = HP Customer Feedback
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A6B23EFA-6590-482C-A11F-5ACE1B91F5B9}" = Adobe Soundbooth CS3
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-1033-0000-7760-000000000003}" = Adobe Acrobat 8 Professional
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AFAD41A9-9687-48A3-848F-693C11451433}" = HP Customer Experience Enhancements
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}" = Adobe BridgeTalk Plugin CS3
"{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}" = Apple Software Update
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{B8B7A4D8-80E1-4DAE-BD33-7FD535BA3931}" = Adobe Encore CS3 Codecs
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5
"{BAD8CA9C-77C0-4663-B00B-A8D3B13C341B}" = Motorola Phone Tools
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CB3F8375-B600-4B9F-83C9-238ED1E583FD}" = Adobe InDesign CS3
"{CD7F9976-33AE-4C07-BAE5-FCB50CA6E371}" = STOIK Capturer
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Professional
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D5A31AB1-345D-47C7-A87B-036A669F6DF1}" = Adobe XMP Panels CS3
"{D6A1E429-CCE1-4140-A615-710B806D12BA}" = Motorola Driver Installation 3.2.0
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DEE88727-779B-47A9-ACEF-F87CA5F92A65}" = ScanSoft OmniPage SE 4
"{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01
"{E40CE517-0D42-4198-96B4-C8232B257EB5}" = Data Lifeguard Diagnostic for Windows
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E8C2622C-9FF1-4F60-8008-A0208154F9F3}" = muvee autoProducer 6.1
"{e96b3d28-47d6-43cc-98fd-7069eeab6b11}" = HP Total Care Advisor
"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler
"{EB0202F7-016A-410C-ADE4-40F848CCC661}" = Adobe After Effects CS3
"{EB1B8449-CD8F-485B-ADB6-02FBCFE180D3}" = Razer DeathAdder™ Mouse
"{ECEE0279-785F-4CB3-9F28-E69813234BF8}" = SPORE™ Creature Creator Trial Edition
"{EDE721EC-870A-11D8-9D75-000129760D75}" = PowerDirector Express
"{F08E8D2E-F132-4742-9C87-D5FF223A016A}" = Adobe Illustrator CS3
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FC9E08AA-CD59-4C59-BEF9-87E05B9E37D7}" = Adobe Contribute CS3
"{FE57DE70-95DE-4B64-9266-84DA811053DB}" = HP Update
"15b35190-c6f9-11d9-9669-0800200c9a66_is1" = Dungeons & Dragons Online - Eberron Unlimited™
"62289540-dc30-11dc-95ff-0800200c9a66_is1" = Turbine Download Manager
"8461-7759-5462-8226" = Vuze
"AC3Filter" = AC3Filter (remove only)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Acrobat 8 Professional" = Adobe Acrobat 8.1.3 Professional
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_4dcfd9b7e901b57f81f667144603236" = Add or Remove Adobe Creative Suite 3 Master Collection
"Ask Toolbar_is1" = Vuze Toolbar
"AviSynth" = AviSynth 2.5
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"Citrus Alarm Clock_is1" = Citrus Alarm Clock 2.0
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1" = Soft Data Fax Modem with SmartCP
"EADM" = EA Download Manager
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"eMusic Promotion" = eMusic - 50 Free MP3 offer
"ERUNT_is1" = ERUNT 1.1j
"Google Chrome" = Google Chrome
"Google Updater" = Google Updater
"HijackThis" = HijackThis 2.0.2
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Photosmart Essential" = HP Photosmart Essential 2.5
"ImgBurn" = ImgBurn
"InstallShield_{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"LimeWire" = LimeWire 4.16.7
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"MP Navigator EX 1.0" = Canon MP Navigator EX 1.0
"Mumble" = Mumble and Murmur
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"OsdMaestro" = HP On-Screen Cap/Num/Scroll Lock Indicator
"PC-Doctor 5 for Windows" = Hardware Diagnostic Tools
"PeaZip_is1" = PeaZip 2.1
"Peggle World of Warcraft Edition" = Peggle World of Warcraft Edition
"RealArcade" = RealArcade
"Risk WarZone Client" = Risk WarZone Client
"SecondLife" = SecondLife (remove only)
"Soulseek" = SoulSeek Client 156c
"StumbleUponIEToolbar" = StumbleUpon IE Toolbar
"The Rosetta Stone" = The Rosetta Stone
"VLC media player" = VideoLAN VLC media player 0.8.6i
"Warcraft III" = Warcraft III
"WarZone Client v1.0.41" = WarZone Client v1.0.41
"WildTangent hp Master Uninstall" = HP Games
"Winamp" = Winamp
"WinRAR archiver" = WinRAR archiver
"World of Warcraft" = World of Warcraft
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Toolbar" = Yahoo! Toolbar

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent" = BitTorrent
"BitTorrent DNA" = DNA
"WeatherEye" = WeatherEye

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 26/02/2010 12:48:17 PM | Computer Name = YesLoitering | Source = Google Update | ID = 20
Description =

Error - 26/02/2010 12:54:35 PM | Computer Name = YesLoitering | Source = Google Update | ID = 20
Description =

Error - 26/02/2010 1:06:49 PM | Computer Name = YesLoitering | Source = Google Update | ID = 20
Description =

Error - 26/02/2010 1:32:15 PM | Computer Name = YesLoitering | Source = Google Update | ID = 20
Description =

Error - 26/02/2010 1:44:00 PM | Computer Name = YesLoitering | Source = Google Update | ID = 20
Description =

Error - 26/02/2010 1:52:23 PM | Computer Name = YesLoitering | Source = Google Update | ID = 20
Description =

Error - 26/02/2010 2:13:12 PM | Computer Name = YesLoitering | Source = Google Update | ID = 20
Description =

Error - 26/02/2010 2:17:57 PM | Computer Name = YesLoitering | Source = EventSystem | ID = 4609
Description =

Error - 26/02/2010 2:20:11 PM | Computer Name = YesLoitering | Source = Application Error | ID = 1000
Description = Faulting application cqpgucjv.exe, version 1.0.15.15281, time stamp
0x4b2763f0, faulting module cqpgucjv.exe, version 1.0.15.15281, time stamp 0x4b2763f0,
exception code 0xc0000005, fault offset 0x0000c4b1, process id 0x7ec, application
start time 0x01cab71041f67843.

Error - 26/02/2010 2:23:12 PM | Computer Name = YesLoitering | Source = Google Update | ID = 20
Description =

[ System Events ]
Error - 20/01/2009 5:25:01 AM | Computer Name = YesLoitering | Source = Service Control Manager | ID = 7000
Description =

Error - 05/02/2009 11:55:05 PM | Computer Name = YesLoitering | Source = BROWSER | ID = 8007
Description =

Error - 08/02/2009 3:24:45 PM | Computer Name = YesLoitering | Source = Service Control Manager | ID = 7000
Description =

Error - 10/02/2009 12:36:05 AM | Computer Name = YesLoitering | Source = EventLog | ID = 6008
Description = The previous system shutdown at 10:33:09 PM on 09/02/2009 was unexpected.

Error - 10/02/2009 12:37:26 AM | Computer Name = YesLoitering | Source = Service Control Manager | ID = 7000
Description =

Error - 25/02/2009 2:04:38 AM | Computer Name = YesLoitering | Source = Service Control Manager | ID = 7000
Description =

Error - 28/02/2009 5:48:57 AM | Computer Name = YesLoitering | Source = EventLog | ID = 6008
Description = The previous system shutdown at 3:46:51 AM on 28/02/2009 was unexpected.

Error - 28/02/2009 5:50:14 AM | Computer Name = YesLoitering | Source = Service Control Manager | ID = 7000
Description =

Error - 03/03/2009 1:33:45 AM | Computer Name = YesLoitering | Source = EventLog | ID = 6008
Description = The previous system shutdown at 11:30:50 PM on 02/03/2009 was unexpected.

Error - 14/03/2009 6:31:16 AM | Computer Name = YesLoitering | Source = Service Control Manager | ID = 7000
Description =


< End of report >

Hi Aprilizer,

I see you ran combofix. It should not be used without supervision as it could cause some unexpected results. Please look for a log Located at C:\combofix.txt

LimeWire and Vuze

You have LimeWire, BitTorrent, DNA, and Vuze, P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx

http://www.internetworldstats.com/articles…cles/art053.htm

I would recommend that you uninstall LimeWire, BitTorrent, DNA, and Vuze, however that choice is up to you. If you choose to remove these programs, you can do so via

Click on the Start button > Control Panel

Depending on your setings, either

• click on the Uninstall a program option under the Programs category.
• If you are using the Classic View of the Control Panel, then you would double-click on the Programs and Features icon instead.

Uninstall the following program

If you wish to keep it, please do not use it until your computer is cleaned.



Download this file & extract TDSSKiller.exe onto your Desktop

Then create this batch file to be placed next to TDSSKiller

—-

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

@ECHO OFF
START /WAIT TDSSKILLER.exe -l Logit.txt -v
START Logit.txt
del %0

In the notepad

• Click File, Save as…, and set the Save in to your Desktop
• In the filename box, type (including quotation marks) as the filename: "fix.bat"
• Click save

It should look like this: [external image: Posted Image]
Right click on fix.bat and select "Run as Administrator" & allow it to run

Post back with the Logit.txt and the combofix log.

Thanks

I ran Combofix a few weeks ago after some bad advice, and ran a full system restore after I noticed that it messed things up.
I'll post the log but everything it notgood up seemed to be fixed by the system restore. I will post the log anyway.

Also, I'm very certain I got this virus from streaming a video on ninjavideo.net, AVG caught it coming in and then it bugged out AVG.

AVG normally catches everything in an incoming torrent; you may be confused to see that it is not running on my system, that is because when I was still trying to run GMER, certain elements of AVG kept running in the background, so I uninstalled it. So far I have been unable to reinstall, possibly because of this virus.

Here is the combofix log, I will post the Logit.txt in a few minutes

ComboFix 10-02-12.01 - April 14/02/2010 15:17:17.1.4 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.2.1033.18.3070.1549 [GMT -6:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *disabled* (Outdated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-1958320015-496371201-3427726256-500
c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\$recycle.bin\S-1-5-21-3594879199-1419891237-889456722-500
c:\programdata\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
c:\users\April\AppData\Roaming\WeatherDPA
c:\users\April\AppData\Roaming\WeatherDPA\Weather\WeatherStartup.xml
c:\windows\jestertb.dll
c:\windows\system32\spool\prtprocs\w32x86\00002163.tmp
c:\windows\system32\twain_32.dll
c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
c:\windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job

.
((((((((((((((((((((((((( Files Created from 2010-01-14 to 2010-02-14 )))))))))))))))))))))))))))))))
.

2010-02-14 21:28 . 2010-02-14 21:29 ——– d—–w- c:\users\April\AppData\Local\temp
2010-02-14 21:28 . 2010-02-14 21:28 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-02-14 19:18 . 2010-02-14 19:18 ——– d—–w- c:\program files\Trend Micro
2010-02-14 18:31 . 2010-02-14 18:31 3803208 —-a-w- c:\programdata\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-02-14 18:31 . 2010-02-14 18:31 816784 —-a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-02-14 18:31 . 2010-02-14 18:31 823928 —-a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-02-14 18:31 . 2010-02-14 18:31 1643272 —-a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-02-14 18:31 . 2010-02-14 18:31 788880 —-a-w- c:\programdata\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-02-14 18:31 . 2010-02-14 18:31 1181328 —-a-w- c:\programdata\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-02-14 18:30 . 2010-02-14 18:31 ——– dc-h–w- c:\programdata\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-02-14 18:30 . 2009-12-07 14:10 2953352 -c–a-w- c:\programdata\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}\Ad-AwareInstallation.exe
2010-02-14 18:30 . 2010-02-14 18:32 ——– d—–w- c:\programdata\Lavasoft
2010-02-14 18:30 . 2010-02-14 18:30 ——– d—–w- c:\program files\Lavasoft
2010-02-14 02:42 . 2009-11-25 19:01 1230080 —-a-w- c:\programdata\AVG Security Toolbar\IEToolbar.dll
2010-02-06 14:42 . 2010-02-05 16:12 1260800 —-a-w- c:\programdata\avg9\update\backup\avgfrw.exe
2010-02-06 14:42 . 2010-02-05 16:12 3777280 —-a-w- c:\programdata\avg9\update\backup\setup.exe
2010-02-05 18:47 . 2010-02-05 18:47 ——– d—–w- c:\users\April\AppData\Local\AVG Security Toolbar
2010-02-05 16:13 . 2010-02-05 20:47 ——– d—–w- C:\$AVG
2010-02-05 16:12 . 2010-02-14 02:42 ——– d—–w- c:\programdata\AVG Security Toolbar
2010-02-05 16:11 . 2010-02-05 16:11 ——– d—–w- c:\programdata\avg9
2010-02-03 05:20 . 2010-02-03 05:20 ——– d—–w- c:\program files\Common Files\DivX Shared
2010-01-20 22:22 . 2010-01-20 22:22 93 —-a-w- c:\users\April\AppData\Local\fusioncache.dat
2010-01-20 22:22 . 2010-01-20 22:22 ——– d—–w- c:\users\April\AppData\Local\Turbine
2010-01-20 22:08 . 2010-01-20 22:08 ——– d—–w- c:\users\April\AppData\Local\Turbine,_Inc
2010-01-20 22:07 . 2010-01-20 22:07 ——– d—–w- c:\programdata\Turbine
2010-01-20 22:07 . 2010-01-21 00:22 ——– d—–w- c:\program files\Turbine
2010-01-20 22:06 . 2010-01-20 23:59 ——– d—–w- c:\users\April\AppData\Local\ApplicationHistory
2010-01-20 22:04 . 2010-01-20 22:04 ——– d—–w- c:\windows\system32\URTTEMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-14 21:14 . 2007-11-23 12:33 ——– d—–w- c:\programdata\NVIDIA
2010-02-14 21:11 . 2008-04-08 07:16 ——– d—–w- c:\users\April\AppData\Roaming\DNA
2010-02-14 20:49 . 2008-04-08 07:16 ——– d—–w- c:\program files\DNA
2010-02-14 18:32 . 2010-02-14 18:32 862040 —-a-w- c:\programdata\Lavasoft\Ad-Aware\Update\threatwork.exe
2010-02-14 18:32 . 2010-02-14 18:32 206944 —-a-w- c:\programdata\Lavasoft\Ad-Aware\Update\lavamessage.dll
2010-02-14 18:32 . 2010-02-14 18:32 15880 —-a-w- c:\programdata\Lavasoft\Ad-Aware\Update\lsdelete.exe
2010-02-14 18:32 . 2010-02-14 18:32 390288 —-a-w- c:\programdata\Lavasoft\Ad-Aware\Update\lavalicense.dll
2010-02-14 18:32 . 2010-02-14 18:32 537576 —-a-w- c:\programdata\Lavasoft\Ad-Aware\Update\aawapi.dll
2010-02-14 18:32 . 2010-02-14 18:32 389784 —-a-w- c:\programdata\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-02-14 18:32 . 2010-02-14 18:32 163728 —-a-w- c:\programdata\Lavasoft\Ad-Aware\Update\ShellExt.dll
2010-02-14 18:32 . 2010-02-14 18:32 6296864 —-a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Resources.dll
2010-02-14 18:32 . 2010-02-14 18:32 327000 —-a-w- c:\programdata\Lavasoft\Ad-Aware\Update\RPAPI.dll
2010-02-14 18:32 . 2010-02-14 18:32 87496 —-a-w- c:\programdata\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2010-02-14 18:32 . 2010-02-14 18:31 933120 —-a-w- c:\programdata\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-02-14 02:46 . 2008-04-08 04:29 ——– d—–w- c:\users\April\AppData\Roaming\StumbleUpon
2010-02-14 00:53 . 2008-12-07 14:31 ——– d—–w- c:\programdata\Google Updater
2010-02-12 20:49 . 2007-11-23 12:19 ——– d—–w- c:\program files\Hewlett-Packard
2010-02-11 19:28 . 2008-04-08 07:17 ——– d—–w- c:\users\April\AppData\Roaming\BitTorrent
2010-02-09 15:11 . 2008-04-08 10:52 ——– d—–w- c:\program files\DivX
2010-02-07 03:58 . 2008-12-07 14:31 ——– d—–w- c:\program files\Google
2010-02-05 16:12 . 2009-02-06 04:11 360584 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-02-05 16:12 . 2009-02-06 04:11 333192 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-02-05 16:12 . 2009-02-06 04:11 28424 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-02-05 16:12 . 2009-02-06 04:11 12464 —-a-w- c:\windows\system32\avgrsstx.dll
2010-02-05 16:11 . 2009-02-06 04:11 ——– d—–w- c:\program files\AVG
2010-02-05 09:34 . 2008-11-16 06:16 ——– d—–w- c:\program files\Microsoft Silverlight
2010-01-05 09:44 . 2008-12-31 17:30 ——– d—–w- c:\program files\Common Files\Blizzard Entertainment
2009-12-25 18:24 . 2008-04-08 07:16 ——– d—–w- c:\program files\BitTorrent
2009-12-22 01:26 . 2009-12-22 01:17 ——– d—–w- c:\users\April\AppData\Roaming\Mumble
2009-12-22 01:18 . 2009-12-22 01:18 17080 —-a-w- c:\users\April\AppData\Roaming\Mumble\Plugins\wow.dll
2009-12-22 01:18 . 2009-12-22 01:18 17592 —-a-w- c:\users\April\AppData\Roaming\Mumble\Plugins\tf2.dll
2009-12-22 01:18 . 2009-12-22 01:18 17592 —-a-w- c:\users\April\AppData\Roaming\Mumble\Plugins\dods.dll
2009-12-22 01:17 . 2009-12-22 01:17 ——– d—–w- c:\program files\Mumble
2009-12-02 13:19 . 2010-02-14 18:32 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2004-11-30 01:08 . 2009-10-29 07:53 70487 ——w- c:\program files\pixx.jar
2004-11-30 01:08 . 2009-10-29 07:53 51629 ——w- c:\program files\pixx.cab
2004-11-30 01:08 . 2009-10-29 07:53 2840 ——w- c:\program files\pixx-french.lng
2004-11-30 01:08 . 2009-10-29 07:53 2633 ——w- c:\program files\pixx-english.lng
2004-11-30 01:08 . 2009-10-29 07:53 86969 ——w- c:\program files\irc.cab
2004-11-30 01:08 . 2009-10-29 07:53 7788 ——w- c:\program files\securedirc.cab
2004-11-30 01:08 . 2009-10-29 07:53 3989 ——w- c:\program files\french.lng
2004-11-30 01:08 . 2009-10-29 07:53 3843 ——w- c:\program files\english.lng
2004-11-30 01:08 . 2009-10-29 07:53 3158 ——w- c:\program files\IRCApplet.class
2004-11-30 01:08 . 2009-10-29 07:53 1748 ——w- c:\program files\securedirc-unsigned.cab
2004-11-30 01:08 . 2009-10-29 07:53 147301 ——w- c:\program files\irc.jar
2004-11-30 01:08 . 2009-10-29 07:53 133627 ——w- c:\program files\irc-unsigned.jar
2004-11-30 01:05 . 2009-10-29 07:53 9430 ——w- c:\program files\versions.txt
2004-11-23 01:14 . 2009-10-29 07:53 25978 ——w- c:\program files\readme_1.txt
2004-11-17 00:30 . 2009-10-29 07:53 531 ——w- c:\program files\SimpleApplet.html
2004-11-12 04:47 . 2009-10-29 07:53 2083 ——w- c:\program files\NormalApplet.html
2004-11-11 22:29 . 2009-10-29 07:53 11047 ——w- c:\program files\pixx-readme.txt
2004-07-24 20:52 . 2009-10-29 07:53 2495 ——w- c:\program files\HeavyApplet.html
2004-06-20 17:58 . 2009-10-29 07:53 730 ——w- c:\program files\pjirc.cfg
2004-05-31 19:29 . 2009-10-29 07:53 2131 ——w- c:\program files\AppletWithJS.html
2004-05-20 18:00 . 2009-10-22 04:53 495104 —-a-w- c:\program files\STOIK_Capturer.msi
2004-04-27 01:09 . 2009-10-22 04:53 1871 —-a-w- c:\program files\readme.txt
2004-04-19 03:13 . 2009-10-29 07:53 734 ——w- c:\program files\thanks.txt
2003-03-21 00:21 . 2009-10-29 07:53 17704 ——w- c:\program files\background.gif
2003-02-09 23:25 . 2009-10-29 07:53 17718 ——w- c:\program files\license.txt
2007-11-23 11:50 . 2007-11-23 11:44 8192 –sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-11-25 19:01 1230080 —-a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-04-08 1232896]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-10-03 323392]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-09-03 3342336]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2009-10-31 2356088]
"WeatherEye"="c:\users\April\AppData\Local\TheWeatherNetwork\WeatherEye\WeatherEye.exe" [2009-10-27 718232]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2007-11-23 1006264]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
"SunJavaUpdateReg"="c:\windows\system32\jureg.exe" [2009-02-07 54680]
"EverioService"="c:\program files\CyberLink\PCM4Everio\EverioService.exe" [2007-06-06 151552]
"PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2009-07-29 846448]
"DT HPW"="c:\program files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2008-06-24 81920]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-04-08 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-04-01 36352]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-10-15 623992]
"snpstd"="c:\windows\vsnpstd.exe" [2005-10-11 339968]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-23 13535776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-08-23 92704]
"Launch LGDCore"="c:\program files\Common Files\Logitech\G-series Software\LGDCore.exe" [2006-07-23 1126400]
"DeathAdder"="c:\program files\Razer\DeathAdder\razerhid.exe" [2007-09-07 159744]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]

c:\users\April\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
wkcalrem.LNK - c:\program files\Microsoft Works\WkCalRem.exe [2007-6-20 46432]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Citrus Alarm Clock.lnk - c:\program files\Citrus Alarm Clock\Citrus Alarm Clock.exe [2008-5-4 326656]
Snapfish Media Detector.lnk - c:\program files\Snapfish Picture Mover\SnapfishMediaDetector.exe [2007-5-7 1273856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [14/02/2010 12:32 PM 64288]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [05/02/2009 10:11 PM 333192]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [05/02/2009 10:11 PM 360584]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [05/02/2010 10:12 AM 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [05/02/2010 10:11 AM 285392]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [02/12/2009 7:19 AM 1181328]
R2 PdiService;Portrait Displays SDK Service;c:\program files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [07/08/2009 7:23 PM 109168]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [17/08/2009 12:32 AM 239648]
R3 DAdderFltr;DeathAdder Mouse;c:\windows\System32\drivers\dadder.sys [29/09/2009 10:29 PM 22784]
R3 xcbdaNtsc;ViXS Tuner Card (NTSC);c:\windows\System32\drivers\xcbda.sys [23/11/2007 6:01 AM 156928]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [12/04/2008 12:06 AM 717296]
S2 gupdate1c95c992cc15830;Google Update Service (gupdate1c95c992cc15830);c:\program files\Google\Update\GoogleUpdate.exe [12/12/2008 2:35 PM 133104]
S3 LiveTurbineMessageService;Turbine Message Service - Live;c:\program files\Turbine\Turbine Download Manager\TurbineMessageService.exe [20/01/2010 4:07 PM 271856]
S3 LiveTurbineNetworkService;Turbine Network Service - Live;c:\program files\Turbine\Turbine Download Manager\TurbineNetworkService.exe [20/01/2010 4:07 PM 218608]
S4 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [27/08/2009 9:06 AM 464264]
S4 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [27/08/2009 9:06 AM 234888]
.
Contents of the 'Scheduled Tasks' folder

2010-02-14 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 18:31]

2010-02-14 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 18:31]

2010-02-14 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 18:31]

2010-02-14 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 18:31]

2010-02-14 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 18:31]

2010-02-14 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-12-07 10:16]

2010-02-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-12-12 17:57]

2010-02-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-12-12 17:57]

2010-02-14 c:\windows\Tasks\User_Feed_Synchronization-{232F54BC-E566-4F1D-BD15-2E58324827BC}.job
- c:\windows\system32\msfeedssync.exe [2009-05-18 11:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.ca/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=81&bd=Pavilion&pf=desktop
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: StumbleUpon PhotoBlog It! - StumbleUponIEBar.dll/blogimage
FF - ProfilePath - c:\users\April\AppData\Roaming\Mozilla\Firefox\Profiles\4rhpbiwa.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/index.php?lh=2f821592ff46f387c6487e03e19d50db&
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - c:\program files\AskBarDis\bar\bin\askBar.dll
HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
HKLM-Run-Launch LCDMon - c:\program files\Common Files\Logitech\LCD Manager\lcdmon.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-14 15:29
Windows 6.0.6000 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll nvstor32.sys >>UNKNOWN [0x8852D8C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x829aed1f
\Driver\ACPI -> acpi.sys @ 0x802329d6
\Driver\atapi -> ataport.SYS @ 0x807e69c6
IoDeviceObjectType -> ParseProcedure -> ntkrnlpa.exe @ 0x8219727f
SecurityProcedure -> ntkrnlpa.exe @ 0x821964a3
\Device\Harddisk0\DR0 -> ParseProcedure -> ntkrnlpa.exe @ 0x8219727f
SecurityProcedure -> ntkrnlpa.exe @ 0x821964a3
user & kernel MBR OK

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\DISPLAY\Default_Monitor\5&34f9ced1&0&UID256\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\DISPLAY\Default_Monitor\5&34f9ced1&0&UID256\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\DISPLAY\HWP26A9\5&34f9ced1&0&UID273\Device Parameters\MODES]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\DISPLAY\HWP26A9\5&34f9ced1&0&UID273\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\DISPLAY\HWP26A9\5&34f9ced1&0&UID273\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\DISPLAY\HWP26A9\5&34f9ced1&0&UID33554705\Device Parameters\MODES]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\DISPLAY\HWP26A9\5&34f9ced1&0&UID33554705\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\DISPLAY\HWP26A9\5&34f9ced1&0&UID33554705\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)
.
Completion time: 2010-02-14 15:33:07
ComboFix-quarantined-files.txt 2010-02-14 21:33

Pre-Run: 46,576,046,080 bytes free
Post-Run: 47,441,408,000 bytes free

- - End Of File - - BBC404C349CB5E7EAD30881E5EBC247B

Hi again

Malwarebytes did not find anything

mbr.log:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys tskCACD.tmp dxgkrnl.sys nvlddmkm.sys
kernel: MBR read successfully
user & kernel MBR OK

malwarebyes log

Malwarebytes' Anti-Malware 1.44
Database version: 3802
Windows 6.0.6000
Internet Explorer 8.0.6001.18783

27/02/2010 12:30:39 PM
mbam-log-2010-02-27 (12-30-39).txt

Scan type: Quick Scan
Objects scanned: 106693
Time elapsed: 5 minute(s), 43 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

OTL

OTL logfile created on: 27/02/2010 12:33:53 PM - Run 2
OTL by OldTimer - Version 3.1.30.3 Folder = C:\Users\April\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18783)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 66.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.48 Gb Total Space | 40.18 Gb Free Space | 13.93% Space Free | Partition Type: NTFS
Drive D: | 9.61 Gb Total Space | 1.32 Gb Free Space | 13.71% Space Free | Partition Type: NTFS
Drive E: | 298.09 Gb Total Space | 122.60 Gb Free Space | 41.13% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YESLOITERING
Current User Name: April
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Users\April\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\April\AppData\Local\TheWeatherNetwork\WeatherEye\WeatherEye.exe (Pelmorex Media Inc.)
PRC - C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
PRC - C:\Program Files\Electronic Arts\EADM\Core.exe (Electronic Arts)
PRC - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files\Portrait Displays\Pivot Software\Floater.exe ()
PRC - C:\Program Files\Portrait Displays\Pivot Software\wpCtrl.exe ()
PRC - C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe (Portrait Displays, Inc.)
PRC - C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
PRC - C:\Windows\System32\jureg.exe (Sun Microsystems, Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
PRC - C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation)
PRC - C:\Program Files\Portrait Displays\HP My Display\dthtml.exe (Portrait Displays, Inc)
PRC - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe ()
PRC - C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe (Portrait Displays Inc.)
PRC - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
PRC - C:\Program Files\Winamp\winampa.exe ()
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\Citrus Alarm Clock\Citrus Alarm Clock.exe (Orangeline Interactive)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple, Inc.)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Windows\System32\drivers\XAudio.exe (Conexant Systems, Inc.)
PRC - c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe (Hewlett-Packard)
PRC - C:\Program Files\Razer\DeathAdder\razerhid.exe ()
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files\Microsoft Works\WkCalRem.exe (Microsoft® Corporation)
PRC - C:\Program Files\CyberLink\PCM4Everio\EverioService.exe (CyberLink Corp.)
PRC - C:\hp\KBD\kbd.exe (Hewlett-Packard Company)
PRC - C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
PRC - C:\Program Files\Razer\DeathAdder\razerofa.exe (Razer Inc.)
PRC - C:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
PRC - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)
PRC - C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
PRC - C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe (Nuance Communications, Inc.)
PRC - C:\Program Files\CyberLink\Shared Files\RichVideo.exe ()
PRC - C:\Program Files\Razer\DeathAdder\razertra.exe ()
PRC - C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Windows\System32\WUDFHost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\wbem\unsecapp.exe (Microsoft Corporation)
PRC - C:\Windows\System32\schtasks.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe (Logitech Inc.)
PRC - C:\Windows\vsnpstd.exe ()


========== Modules (SafeList) ==========

MOD - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
MOD - C:\Users\April\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Portrait Displays\Pivot Software\Winphook.dll ()
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (NRONOPDCKS) – File not found
SRV - (DRJJMK) – File not found
SRV - (avg9emc) – C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (LiveTurbineMessageService) – C:\Program Files\Turbine\Turbine Download Manager\TurbineMessageService.exe (Turbine, Inc.)
SRV - (LiveTurbineNetworkService) – C:\Program Files\Turbine\Turbine Download Manager\TurbineNetworkService.exe (Turbine, Inc.)
SRV - (Stereo Service) – C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (PdiService) – C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe (Portrait Displays, Inc.)
SRV - (ASKUpgrade) – C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe ()
SRV - (ASKService) – C:\Program Files\AskBarDis\bar\bin\AskService.exe ()
SRV - (GameConsoleService) – C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (gusvc) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (LightScribeService) – C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (gupdate1c95c992cc15830) Google Update Service (gupdate1c95c992cc15830) – C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (odserv) – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (nvsvc) – C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation)
SRV - (DTSRVC) – C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe ()
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple, Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (XAudioService) – C:\Windows\System32\drivers\XAudio.exe (Conexant Systems, Inc.)
SRV - (HP Health Check Service) – c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe (Hewlett-Packard)
SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (Adobe Version Cue CS3) – C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe (Adobe Systems Incorporated)
SRV - (RichVideo) Cyberlink RichVideo Service(CRVS) – C:\Program Files\CyberLink\Shared Files\RichVideo.exe ()
SRV - (ehstart) – C:\Windows\ehome\ehstart.dll (Microsoft Corporation)
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)


========== Driver Services (SafeList) ==========

DRV - (AvgTdiX) – C:\Windows\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) – C:\Windows\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\Windows\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (nvstor32) – C:\Windows\system32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (PdiPorts) – C:\Windows\System32\drivers\PdiPorts.sys (Portrait Displays, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (HSXHWBS2) – C:\Windows\System32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\Windows\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) – C:\Windows\System32\drivers\HSX_DP.sys (Conexant Systems, Inc.)
DRV - (sptd) – C:\Windows\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (GEARAspiWDM) – C:\Windows\System32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (XAudio) – C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (xcbdaNtsc) ViXS Tuner Card (NTSC) – C:\Windows\System32\drivers\xcbda.sys (ViXS Systems Inc.)
DRV - (DAdderFltr) – C:\Windows\System32\drivers\dadder.sys (Razer (Asia-Pacific) Pte Ltd)
DRV - (motmodem) – C:\Windows\System32\drivers\motmodem.sys (Motorola)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Avc) – C:\Windows\System32\drivers\avc.sys (Microsoft Corporation)
DRV - (61883) – C:\Windows\System32\drivers\61883.sys (Microsoft Corporation)
DRV - (MSTAPE) – C:\Windows\System32\drivers\mstape.sys (Microsoft Corporation)
DRV - (AVCSTRM) – C:\Windows\System32\drivers\avcstrm.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (secdrv) – C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (mdmxsdk) – C:\Windows\System32\drivers\mdmxsdk.sys (Conexant)
DRV - (snpstd) – C:\Windows\System32\drivers\snpstd.sys ()
DRV - (Ps2) – C:\Windows\System32\drivers\PS2.sys (Hewlett-Packard Company)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.facebook.com/index.php?lh=2f821592ff46f387c6487e03e19d50db&"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.716

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/02/27 01:33:11 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/16 11:59:02 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/02/16 11:59:01 | 000,000,000 | —D | M]

[2008/09/12 14:47:52 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\Mozilla\Extensions
[2010/02/27 01:48:14 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\Mozilla\Firefox\Profiles\4rhpbiwa.default\extensions
[2009/02/25 02:07:29 | 000,000,000 | —D | M] (Greasemonkey) – C:\Users\April\AppData\Roaming\Mozilla\Firefox\Profiles\4rhpbiwa.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2009/08/27 09:06:37 | 000,000,000 | —D | M] (No name found) – C:\Users\April\AppData\Roaming\Mozilla\Firefox\Profiles\4rhpbiwa.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2010/02/27 01:48:14 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/03/24 09:27:52 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2008/08/28 20:15:51 | 000,221,184 | —- | M] (CNN) – C:\Program Files\Mozilla Firefox\plugins\NPTURNMED.dll

O1 HOSTS File: ([2006/09/18 15:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()
O2 - BHO: (StumbleUpon Launcher) - {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll (stumbleupon.com)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (StumbleUpon Toolbar) - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll (stumbleupon.com)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe_ID0EYTHM] C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3Tray.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe ()
O4 - HKLM..\Run: [DT HPW] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe ()
O4 - HKLM..\Run: [EverioService] C:\Program Files\CyberLink\PCM4Everio\EverioService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [HP Health Check Scheduler] File not found
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
O4 - HKLM..\Run: [Launch LCDMon] C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe File not found
O4 - HKLM..\Run: [Launch LGDCore] C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe (Logitech Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
O4 - HKLM..\Run: [PivotSoftware] C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe ()
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [snpstd] C:\Windows\vsnpstd.exe ()
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateReg] C:\Windows\System32\jureg.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [BitTorrent DNA] C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe (Electronic Arts)
O4 - HKCU..\Run: [WeatherEye] C:\Users\April\AppData\Local\TheWeatherNetwork\WeatherEye\WeatherEye.exe (Pelmorex Media Inc.)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - Startup: C:\Users\April\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wkcalrem.LNK = C:\Program Files\Microsoft Works\WkCalRem.exe (Microsoft® Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O8 - Extra context menu item: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Users\April\Pictures\Photo-a-go-go\hundy thou\acidgreen.jpg
O24 - Desktop BackupWallPaper: C:\Users\April\Pictures\Photo-a-go-go\hundy thou\acidgreen.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/11/23 06:41:34 | 000,000,074 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{4b58a471-de63-11de-97af-001e8cb6dd45}\Shell - "" = AutoRun
O33 - MountPoints2\{4b58a471-de63-11de-97af-001e8cb6dd45}\Shell\AutoRun\command - "" = L:\HPLauncher.exe – File not found
O33 - MountPoints2\{749fa1f6-2032-11de-9789-001e8cb6dd45}\Shell\AutoRun\command - "" = F:\setup.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/02/27 01:33:40 | 000,012,464 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\avgrsstx.dll
[2010/02/27 01:33:39 | 000,360,584 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgtdix.sys
[2010/02/27 01:33:29 | 000,333,192 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgldx86.sys
[2010/02/27 01:33:27 | 000,028,424 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgmfx86.sys
[2010/02/27 01:33:27 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\Avg
[2010/02/27 00:57:36 | 000,177,416 | —- | C] (Kaspersky Lab) – C:\Users\April\Desktop\TDSSKiller.exe
[2010/02/26 12:25:30 | 000,549,888 | —- | C] (OldTimer Tools) – C:\Users\April\Desktop\OTL.exe
[2010/02/25 04:49:45 | 000,000,000 | —D | C] – C:\Users\April\AppData\Local\Adobe
[2010/02/25 04:39:35 | 000,000,000 | —D | C] – C:\Users\April\AppData\Roaming\Malwarebytes
[2010/02/25 04:39:31 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/02/25 04:39:30 | 000,019,160 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/02/25 04:39:30 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/02/25 04:39:30 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/02/25 04:37:49 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/02/25 04:36:46 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2010/02/25 04:34:39 | 000,791,393 | —- | C] (Lars Hederer ) – C:\Users\April\Desktop\erunt_setup.exe
[2010/02/25 04:31:39 | 000,021,504 | —- | C] (Doug Knox) – C:\Users\April\Desktop\SysRestorePoint.exe
[2010/02/25 03:33:29 | 000,334,720 | —- | C] (Sysinternals - www.sysinternals.com) – C:\Users\April\Desktop\RootkitRevealer.exe
[2010/02/25 02:52:56 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2010/02/25 02:49:59 | 000,000,000 | —D | C] – C:\Users\April\AppData\Roaming\SUPERAntiSpyware.com
[2010/02/25 02:49:59 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2010/02/15 23:57:51 | 000,000,000 | —D | C] – C:\32788R22FWJFW
[2010/02/14 15:33:10 | 000,000,000 | —D | C] – C:\Users\April\AppData\Local\temp(142)
[2010/02/14 15:33:10 | 000,000,000 | —D | C] – C:\Windows\temp
[2010/02/14 15:09:36 | 000,000,000 | —D | C] – C:\ComboFix
[2010/02/14 15:08:56 | 000,000,000 | —D | C] – C:\Qoobox
[2010/02/14 13:18:59 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/02/14 12:30:51 | 000,000,000 | -H-D | C] – C:\ProgramData\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
[2010/02/14 12:30:25 | 000,000,000 | —D | C] – C:\ProgramData\Lavasoft
[2010/02/14 12:30:25 | 000,000,000 | —D | C] – C:\Program Files\Lavasoft
[2010/02/09 05:02:47 | 000,000,000 | —D | C] – C:\Users\April\Documents\FONTS
[2010/02/05 10:13:11 | 000,000,000 | —D | C] – C:\$AVG
[2010/02/05 10:11:47 | 000,000,000 | —D | C] – C:\ProgramData\avg9
[2010/02/02 23:20:08 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DivX Shared
[2008/12/07 02:56:38 | 000,061,440 | —- | C] ( ) – C:\Windows\System32\rsnpstd.dll
[2005/04/20 23:16:28 | 000,036,864 | —- | C] ( ) – C:\Windows\System32\vsnpstd.dll
[2004/02/16 19:59:50 | 000,061,440 | —- | C] ( ) – C:\Windows\System32\csnpstd.dll

========== Files - Modified Within 30 Days ==========

[2010/02/27 12:32:54 | 004,194,304 | -HS- | M] () – C:\Users\April\NTUSER.DAT
[2010/02/27 12:32:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/02/27 12:06:40 | 000,003,472 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/02/27 12:06:40 | 000,003,472 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/02/27 12:03:10 | 000,077,312 | —- | M] () – C:\Users\April\Desktop\mbr.exe
[2010/02/27 10:48:12 | 000,000,793 | —- | M] () – C:\Users\Public\Desktop\World of Warcraft.lnk
[2010/02/27 05:51:07 | 000,000,418 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{232F54BC-E566-4F1D-BD15-2E58324827BC}.job
[2010/02/27 04:32:00 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/02/27 01:33:48 | 000,001,649 | —- | M] () – C:\Users\Public\Desktop\AVG Free 9.0.lnk
[2010/02/27 01:33:40 | 000,012,464 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\avgrsstx.dll
[2010/02/27 01:33:39 | 000,360,584 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgtdix.sys
[2010/02/27 01:33:30 | 000,333,192 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgldx86.sys
[2010/02/27 01:33:27 | 056,305,693 | —- | M] () – C:\Windows\System32\drivers\Avg\incavi.avm
[2010/02/27 01:33:27 | 006,061,540 | —- | M] () – C:\Windows\System32\drivers\Avg\avi7.avg
[2010/02/27 01:33:27 | 000,492,629 | —- | M] () – C:\Windows\System32\drivers\Avg\miniavi.avg
[2010/02/27 01:33:27 | 000,142,495 | —- | M] () – C:\Windows\System32\drivers\Avg\microavi.avg
[2010/02/27 01:33:27 | 000,113,461 | —- | M] () – C:\Windows\System32\drivers\Avg\iavichjw.avm
[2010/02/27 01:33:27 | 000,028,424 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgmfx86.sys
[2010/02/27 01:13:05 | 000,729,436 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/02/27 01:13:05 | 000,631,234 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/02/27 01:13:05 | 000,111,812 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/02/27 01:09:44 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2010/02/27 01:06:54 | 000,054,156 | -H– | M] () – C:\Windows\QTFont.qfn
[2010/02/27 01:06:47 | 000,001,356 | —- | M] () – C:\Users\April\AppData\Local\d3d9caps.dat
[2010/02/27 01:06:39 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/02/27 01:06:38 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/02/27 01:06:35 | 3219,644,416 | -HS- | M] () – C:\hiberfil.sys
[2010/02/27 01:06:22 | 000,110,624 | —- | M] (NVIDIA Corporation) – C:\Windows\System32\drivers\nvstor32.sys
[2010/02/27 01:05:22 | 002,729,699 | -H– | M] () – C:\Users\April\AppData\Local\IconCache.db
[2010/02/26 12:25:30 | 000,549,888 | —- | M] (OldTimer Tools) – C:\Users\April\Desktop\OTL.exe
[2010/02/26 10:37:54 | 000,293,376 | —- | M] () – C:\Users\April\Desktop\cqpgucjv.exe
[2010/02/26 10:30:26 | 000,000,020 | —- | M] () – C:\Users\April\defogger_reenable
[2010/02/25 23:41:07 | 000,112,128 | —- | M] () – C:\Users\April\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/25 10:45:14 | 000,177,416 | —- | M] (Kaspersky Lab) – C:\Users\April\Desktop\TDSSKiller.exe
[2010/02/25 05:23:24 | 000,050,477 | —- | M] () – C:\Users\April\Desktop\Defogger.exe
[2010/02/25 04:39:34 | 000,000,820 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/25 04:36:50 | 000,000,735 | —- | M] () – C:\Users\April\Desktop\NTREGOPT.lnk
[2010/02/25 04:36:49 | 000,000,716 | —- | M] () – C:\Users\April\Desktop\ERUNT.lnk
[2010/02/25 04:34:41 | 000,791,393 | —- | M] (Lars Hederer ) – C:\Users\April\Desktop\erunt_setup.exe
[2010/02/25 04:31:39 | 000,021,504 | —- | M] (Doug Knox) – C:\Users\April\Desktop\SysRestorePoint.exe
[2010/02/25 02:50:02 | 000,000,904 | —- | M] () – C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk
[2010/02/16 11:59:03 | 000,001,726 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010/02/16 00:59:53 | 000,001,876 | —- | M] () – C:\Users\April\Desktop\HijackThis.lnk
[2010/02/16 00:20:26 | 004,194,304 | -HS- | M] () – C:\Users\April\ntuser.dat_previous
[2010/02/09 09:11:53 | 000,001,266 | —- | M] () – C:\Users\April\Desktop\DivX Movies.lnk
[2010/02/06 21:59:13 | 000,002,075 | —- | M] () – C:\Users\Public\Desktop\Google Earth.lnk

========== Files Created - No Company Name ==========

[2010/02/27 12:03:07 | 000,077,312 | —- | C] () – C:\Users\April\Desktop\mbr.exe
[2010/02/27 01:33:48 | 000,001,649 | —- | C] () – C:\Users\Public\Desktop\AVG Free 9.0.lnk
[2010/02/27 01:33:27 | 056,305,693 | —- | C] () – C:\Windows\System32\drivers\Avg\incavi.avm
[2010/02/27 01:33:27 | 006,061,540 | —- | C] () – C:\Windows\System32\drivers\Avg\avi7.avg
[2010/02/27 01:33:27 | 000,492,629 | —- | C] () – C:\Windows\System32\drivers\Avg\miniavi.avg
[2010/02/27 01:33:27 | 000,142,495 | —- | C] () – C:\Windows\System32\drivers\Avg\microavi.avg
[2010/02/27 01:33:27 | 000,113,461 | —- | C] () – C:\Windows\System32\drivers\Avg\iavichjw.avm
[2010/02/26 12:21:47 | 3219,644,416 | -HS- | C] () – C:\hiberfil.sys
[2010/02/26 10:37:54 | 000,293,376 | —- | C] () – C:\Users\April\Desktop\cqpgucjv.exe
[2010/02/26 10:30:10 | 000,000,020 | —- | C] () – C:\Users\April\defogger_reenable
[2010/02/25 05:17:24 | 000,050,477 | —- | C] () – C:\Users\April\Desktop\Defogger.exe
[2010/02/25 04:39:34 | 000,000,820 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/25 04:36:50 | 000,000,735 | —- | C] () – C:\Users\April\Desktop\NTREGOPT.lnk
[2010/02/25 04:36:49 | 000,000,716 | —- | C] () – C:\Users\April\Desktop\ERUNT.lnk
[2010/02/25 03:33:29 | 000,102,160 | —- | C] () – C:\Users\April\Desktop\RootkitRevealer.chm
[2010/02/25 02:50:02 | 000,000,904 | —- | C] () – C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk
[2010/02/16 00:59:53 | 000,001,876 | —- | C] () – C:\Users\April\Desktop\HijackThis.lnk
[2010/02/06 21:59:13 | 000,002,075 | —- | C] () – C:\Users\Public\Desktop\Google Earth.lnk
[2010/02/05 14:14:59 | 367,262,412 | —- | C] () – C:\Users\April\Desktop\Lost.S05E09.HDTV.XviD-NoTV.avi
[2010/02/05 12:47:29 | 367,862,124 | —- | C] () – C:\Users\April\Desktop\Lost.S05E08.HDTV.XviD-XOR.avi
[2010/02/05 12:03:56 | 367,273,454 | —- | C] () – C:\Users\April\Desktop\Lost.S05E06 - 316.avi
[2010/02/05 11:08:21 | 367,116,288 | —- | C] () – C:\Users\April\Desktop\Lost.S05E05 - This Place is Death.avi
[2010/02/05 10:25:31 | 367,084,004 | —- | C] () – C:\Users\April\Desktop\Lost.S05E02 - The Lie.avi
[2010/02/05 09:41:54 | 367,797,282 | —- | C] () – C:\Users\April\Desktop\Lost.S05E03 - Jughead.avi
[2010/02/05 07:32:55 | 367,214,354 | —- | C] () – C:\Users\April\Desktop\lost.S05E14.hdtv.xvid-notv.avi
[2010/02/05 07:32:25 | 367,248,890 | —- | C] () – C:\Users\April\Desktop\lost.S05E15.hdtv.xvid-notv.avi
[2010/02/05 05:38:34 | 733,678,316 | —- | C] () – C:\Users\April\Desktop\lost.s05e16-e17.hdtv.xvid-fqm.avi
[2010/02/02 23:19:48 | 000,001,266 | —- | C] () – C:\Users\April\Desktop\DivX Movies.lnk
[2010/01/20 16:22:11 | 000,000,093 | —- | C] () – C:\Users\April\AppData\Local\fusioncache.dat
[2009/10/29 01:53:47 | 000,147,301 | —- | C] () – C:\Program Files\irc.jar
[2009/10/29 01:53:47 | 000,133,627 | —- | C] () – C:\Program Files\irc-unsigned.jar
[2009/10/29 01:53:47 | 000,086,969 | —- | C] () – C:\Program Files\irc.cab
[2009/10/29 01:53:47 | 000,070,487 | —- | C] () – C:\Program Files\pixx.jar
[2009/10/29 01:53:47 | 000,051,629 | —- | C] () – C:\Program Files\pixx.cab
[2009/10/29 01:53:47 | 000,025,978 | —- | C] () – C:\Program Files\readme_1.txt
[2009/10/29 01:53:47 | 000,017,718 | —- | C] () – C:\Program Files\license.txt
[2009/10/29 01:53:47 | 000,017,704 | —- | C] () – C:\Program Files\background.gif
[2009/10/29 01:53:47 | 000,011,047 | —- | C] () – C:\Program Files\pixx-readme.txt
[2009/10/29 01:53:47 | 000,009,430 | —- | C] () – C:\Program Files\versions.txt
[2009/10/29 01:53:47 | 000,007,788 | —- | C] () – C:\Program Files\securedirc.cab
[2009/10/29 01:53:47 | 000,003,989 | —- | C] () – C:\Program Files\french.lng
[2009/10/29 01:53:47 | 000,003,843 | —- | C] () – C:\Program Files\english.lng
[2009/10/29 01:53:47 | 000,003,158 | —- | C] () – C:\Program Files\IRCApplet.class
[2009/10/29 01:53:47 | 000,002,840 | —- | C] () – C:\Program Files\pixx-french.lng
[2009/10/29 01:53:47 | 000,002,633 | —- | C] () – C:\Program Files\pixx-english.lng
[2009/10/29 01:53:47 | 000,002,495 | —- | C] () – C:\Program Files\HeavyApplet.html
[2009/10/29 01:53:47 | 000,002,131 | —- | C] () – C:\Program Files\AppletWithJS.html
[2009/10/29 01:53:47 | 000,002,083 | —- | C] () – C:\Program Files\NormalApplet.html
[2009/10/29 01:53:47 | 000,001,748 | —- | C] () – C:\Program Files\securedirc-unsigned.cab
[2009/10/29 01:53:47 | 000,000,734 | —- | C] () – C:\Program Files\thanks.txt
[2009/10/29 01:53:47 | 000,000,730 | —- | C] () – C:\Program Files\pjirc.cfg
[2009/10/29 01:53:47 | 000,000,531 | —- | C] () – C:\Program Files\SimpleApplet.html
[2009/10/21 22:53:13 | 000,495,104 | —- | C] () – C:\Program Files\STOIK_Capturer.msi
[2009/10/21 22:53:13 | 000,001,871 | —- | C] () – C:\Program Files\readme.txt
[2009/05/14 19:21:00 | 000,000,262 | —- | C] () – C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2009/04/08 20:13:48 | 000,020,992 | —- | C] () – C:\Windows\jestertb.dll
[2008/11/02 18:37:01 | 000,499,200 | —- | C] () – C:\Windows\System32\WZDPlay.dll
[2008/08/22 22:14:47 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2008/06/10 18:07:20 | 003,596,288 | —- | C] () – C:\Windows\System32\qt-dx331.dll
[2008/06/10 18:03:26 | 000,000,416 | —- | C] () – C:\Windows\System32\dtu100.dll.manifest
[2008/06/10 18:03:26 | 000,000,416 | —- | C] () – C:\Windows\System32\dpl100.dll.manifest
[2008/05/22 16:18:54 | 000,012,288 | —- | C] () – C:\Windows\System32\DivXWMPExtType.dll
[2008/04/12 16:56:24 | 002,463,976 | —- | C] () – C:\Windows\System32\NPSWF32.dll
[2008/04/12 00:08:34 | 000,001,356 | —- | C] () – C:\Users\April\AppData\Local\d3d9caps.dat
[2008/04/02 01:36:12 | 000,000,412 | —- | C] () – C:\Windows\MAXLINK.INI
[2008/03/30 01:57:08 | 000,007,432 | —- | C] () – C:\Windows\System32\Machnm32.sys
[2008/03/30 00:29:42 | 000,002,164 | —- | C] () – C:\Users\April\AppData\Roaming\wklnhst.dat
[2008/03/29 22:18:56 | 000,112,128 | —- | C] () – C:\Users\April\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/11/23 06:34:23 | 000,000,342 | —- | C] () – C:\ProgramData\hpzinstall.log
[2007/11/23 06:16:23 | 000,327,680 | —- | C] () – C:\Windows\System32\pythoncom25.dll
[2007/11/23 06:16:23 | 000,102,400 | —- | C] () – C:\Windows\System32\pywintypes25.dll
[2006/11/02 06:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 01:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/05/03 21:40:42 | 000,390,784 | —- | C] () – C:\Windows\System32\drivers\snpstd.sys
[2003/01/17 23:34:40 | 000,015,541 | —- | C] () – C:\Windows\snpstd.ini

========== Custom Scans ==========



< MD5 for: NVSTOR32.SYS >
[2007/10/26 05:51:22 | 000,110,624 | —- | M] (NVIDIA Corporation) MD5=63B7838E9C272BAAA7B33A0CA4EBB748 – C:\hp\DRIVERS\nvidia_storage\nvstor32.sys
[2010/02/27 01:06:22 | 000,110,624 | —- | M] (NVIDIA Corporation) MD5=63B7838E9C272BAAA7B33A0CA4EBB748 – C:\Windows\System32\drivers\nvstor32.sys
[2007/10/26 05:51:22 | 000,110,624 | —- | M] (NVIDIA Corporation) MD5=63B7838E9C272BAAA7B33A0CA4EBB748 – C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_b4609a34\nvstor32.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 64 bytes -> C:\Users\April\Desktop\jrhillplace.avi:TOC.WMV
< End of report >

Well that Kaspersky thing took forever

Here is its log and a new OTL log

The computer is running fine and there are no redirects or popups

Thanks again

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Monday, March 1, 2010
Operating system: Microsoft Windows Vista Home Premium Edition, 32-bit (build 6000)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Monday, March 01, 2010 01:56:48
Records in database: 3672549
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
G:\
H:\
I:\
J:\
K:\

Scan statistics:
Objects scanned: 320941
Threats found: 1
Infected objects found: 1
Suspicious objects found: 0
Scan duration: 07:16:40


File name / Threat / Threats count
C:\Qoobox\Quarantine\C\Windows\System32\spool\prtprocs\w32x86\00002163.tmp.vir Infected: Trojan-Dropper.Win32.Steps.mh 1

Selected area has been scanned.

OTL logfile created on: 01/03/2010 7:34:01 AM - Run 3
OTL by OldTimer - Version 3.1.30.3 Folder = C:\Users\April\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18783)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 57.00% Memory free


6.00 Gb Paging File | 4.00 Gb Available in Paging File | 64.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.48 Gb Total Space | 38.97 Gb Free Space | 13.51% Space Free | Partition Type: NTFS
Drive D: | 9.61 Gb Total Space | 1.32 Gb Free Space | 13.71% Space Free | Partition Type: NTFS
Drive E: | 298.09 Gb Total Space | 122.60 Gb Free Space | 41.13% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YESLOITERING
Current User Name: April
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\April\AppData\Local\Temp\jkos-April\binaries\ScanningProcess.exe (Kaspersky Lab.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Users\April\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\April\AppData\Local\TheWeatherNetwork\WeatherEye\WeatherEye.exe (Pelmorex Media Inc.)
PRC - C:\Program Files\Java\jre6\bin\jp2launcher.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Java\jre6\bin\java.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
PRC - C:\Program Files\Electronic Arts\EADM\Core.exe (Electronic Arts)
PRC - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files\Portrait Displays\Pivot Software\Floater.exe ()
PRC - C:\Program Files\Portrait Displays\Pivot Software\wpCtrl.exe ()
PRC - C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe (Portrait Displays, Inc.)
PRC - C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
PRC - C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation)
PRC - C:\Program Files\Portrait Displays\HP My Display\dthtml.exe (Portrait Displays, Inc)
PRC - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe ()
PRC - C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe (Portrait Displays Inc.)
PRC - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
PRC - C:\Program Files\Winamp\winampa.exe ()
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple, Inc.)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Windows\System32\drivers\XAudio.exe (Conexant Systems, Inc.)
PRC - c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe (Hewlett-Packard)
PRC - C:\Program Files\Razer\DeathAdder\razerhid.exe ()
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files\Microsoft Works\WkCalRem.exe (Microsoft® Corporation)
PRC - C:\Program Files\CyberLink\PCM4Everio\EverioService.exe (CyberLink Corp.)
PRC - C:\hp\KBD\kbd.exe (Hewlett-Packard Company)
PRC - C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
PRC - C:\Program Files\Razer\DeathAdder\razerofa.exe (Razer Inc.)
PRC - C:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
PRC - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)
PRC - C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
PRC - C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe (Nuance Communications, Inc.)
PRC - C:\Program Files\CyberLink\Shared Files\RichVideo.exe ()
PRC - C:\Program Files\Razer\DeathAdder\razertra.exe ()
PRC - C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Windows\System32\WUDFHost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\wbem\unsecapp.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe (Logitech Inc.)
PRC - C:\Windows\vsnpstd.exe ()


========== Modules (SafeList) ==========

MOD - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
MOD - C:\Users\April\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Portrait Displays\Pivot Software\Winphook.dll ()
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (NRONOPDCKS) – File not found
SRV - (DRJJMK) – File not found
SRV - (avg9emc) – C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (LiveTurbineMessageService) – C:\Program Files\Turbine\Turbine Download Manager\TurbineMessageService.exe (Turbine, Inc.)
SRV - (LiveTurbineNetworkService) – C:\Program Files\Turbine\Turbine Download Manager\TurbineNetworkService.exe (Turbine, Inc.)
SRV - (Stereo Service) – C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (PdiService) – C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe (Portrait Displays, Inc.)
SRV - (ASKUpgrade) – C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe ()
SRV - (ASKService) – C:\Program Files\AskBarDis\bar\bin\AskService.exe ()
SRV - (GameConsoleService) – C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (gusvc) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (LightScribeService) – C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (gupdate1c95c992cc15830) Google Update Service (gupdate1c95c992cc15830) – C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (odserv) – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (nvsvc) – C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation)
SRV - (DTSRVC) – C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe ()
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple, Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (XAudioService) – C:\Windows\System32\drivers\XAudio.exe (Conexant Systems, Inc.)
SRV - (HP Health Check Service) – c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe (Hewlett-Packard)
SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (Adobe Version Cue CS3) – C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe (Adobe Systems Incorporated)
SRV - (RichVideo) Cyberlink RichVideo Service(CRVS) – C:\Program Files\CyberLink\Shared Files\RichVideo.exe ()
SRV - (ehstart) – C:\Windows\ehome\ehstart.dll (Microsoft Corporation)
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)


========== Driver Services (SafeList) ==========

DRV - (AvgTdiX) – C:\Windows\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) – C:\Windows\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\Windows\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (nvstor32) – C:\Windows\system32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (PdiPorts) – C:\Windows\System32\drivers\PdiPorts.sys (Portrait Displays, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (HSXHWBS2) – C:\Windows\System32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\Windows\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) – C:\Windows\System32\drivers\HSX_DP.sys (Conexant Systems, Inc.)
DRV - (sptd) – C:\Windows\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (GEARAspiWDM) – C:\Windows\System32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (XAudio) – C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (xcbdaNtsc) ViXS Tuner Card (NTSC) – C:\Windows\System32\drivers\xcbda.sys (ViXS Systems Inc.)
DRV - (DAdderFltr) – C:\Windows\System32\drivers\dadder.sys (Razer (Asia-Pacific) Pte Ltd)
DRV - (motmodem) – C:\Windows\System32\drivers\motmodem.sys (Motorola)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Avc) – C:\Windows\System32\drivers\avc.sys (Microsoft Corporation)
DRV - (61883) – C:\Windows\System32\drivers\61883.sys (Microsoft Corporation)
DRV - (MSTAPE) – C:\Windows\System32\drivers\mstape.sys (Microsoft Corporation)
DRV - (AVCSTRM) – C:\Windows\System32\drivers\avcstrm.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (secdrv) – C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (mdmxsdk) – C:\Windows\System32\drivers\mdmxsdk.sys (Conexant)
DRV - (snpstd) – C:\Windows\System32\drivers\snpstd.sys ()
DRV - (Ps2) – C:\Windows\System32\drivers\PS2.sys (Hewlett-Packard Company)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.facebook.com/index.php?lh=2f821592ff46f387c6487e03e19d50db&"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.716

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/02/27 01:33:11 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/27 16:21:50 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/02/16 11:59:01 | 000,000,000 | —D | M]

[2008/09/12 14:47:52 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\Mozilla\Extensions
[2010/02/28 23:02:37 | 000,000,000 | —D | M] – C:\Users\April\AppData\Roaming\Mozilla\Firefox\Profiles\4rhpbiwa.default\extensions
[2009/02/25 02:07:29 | 000,000,000 | —D | M] (Greasemonkey) – C:\Users\April\AppData\Roaming\Mozilla\Firefox\Profiles\4rhpbiwa.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2009/08/27 09:06:37 | 000,000,000 | —D | M] (No name found) – C:\Users\April\AppData\Roaming\Mozilla\Firefox\Profiles\4rhpbiwa.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2010/02/28 23:02:37 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/03/24 09:27:52 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2008/08/28 20:15:51 | 000,221,184 | —- | M] (CNN) – C:\Program Files\Mozilla Firefox\plugins\NPTURNMED.dll

O1 HOSTS File: ([2006/09/18 15:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()
O2 - BHO: (StumbleUpon Launcher) - {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll (stumbleupon.com)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (StumbleUpon Toolbar) - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll (stumbleupon.com)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe_ID0EYTHM] C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3Tray.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe ()
O4 - HKLM..\Run: [DT HPW] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe ()
O4 - HKLM..\Run: [EverioService] C:\Program Files\CyberLink\PCM4Everio\EverioService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [HP Health Check Scheduler] File not found
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
O4 - HKLM..\Run: [Launch LCDMon] C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe File not found
O4 - HKLM..\Run: [Launch LGDCore] C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe (Logitech Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
O4 - HKLM..\Run: [PivotSoftware] C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe ()
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [snpstd] C:\Windows\vsnpstd.exe ()
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [BitTorrent DNA] C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe (Electronic Arts)
O4 - HKCU..\Run: [WeatherEye] C:\Users\April\AppData\Local\TheWeatherNetwork\WeatherEye\WeatherEye.exe (Pelmorex Media Inc.)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - Startup: C:\Users\April\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wkcalrem.LNK = C:\Program Files\Microsoft Works\WkCalRem.exe (Microsoft® Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O8 - Extra context menu item: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Users\April\Pictures\Photo-a-go-go\hundy thou\acidgreen.jpg
O24 - Desktop BackupWallPaper: C:\Users\April\Pictures\Photo-a-go-go\hundy thou\acidgreen.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/11/23 06:41:34 | 000,000,074 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{4b58a471-de63-11de-97af-001e8cb6dd45}\Shell - "" = AutoRun
O33 - MountPoints2\{4b58a471-de63-11de-97af-001e8cb6dd45}\Shell\AutoRun\command - "" = L:\HPLauncher.exe – File not found
O33 - MountPoints2\{749fa1f6-2032-11de-9789-001e8cb6dd45}\Shell\AutoRun\command - "" = F:\setup.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/02/28 23:02:11 | 000,000,000 | —D | C] – C:\Users\April\AppData\Roaming\AVG9
[2010/02/28 22:49:19 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2010/02/28 22:49:19 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2010/02/28 22:49:19 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2010/02/28 22:49:19 | 000,055,072 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\jureg.exe
[2010/02/27 01:33:40 | 000,012,464 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\avgrsstx.dll
[2010/02/27 01:33:39 | 000,360,584 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgtdix.sys
[2010/02/27 01:33:29 | 000,333,192 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgldx86.sys
[2010/02/27 01:33:27 | 000,028,424 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgmfx86.sys
[2010/02/27 01:33:27 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\Avg
[2010/02/27 00:57:36 | 000,177,416 | —- | C] (Kaspersky Lab) – C:\Users\April\Desktop\TDSSKiller.exe
[2010/02/26 12:25:30 | 000,549,888 | —- | C] (OldTimer Tools) – C:\Users\April\Desktop\OTL.exe
[2010/02/25 04:49:45 | 000,000,000 | —D | C] – C:\Users\April\AppData\Local\Adobe
[2010/02/25 04:39:35 | 000,000,000 | —D | C] – C:\Users\April\AppData\Roaming\Malwarebytes
[2010/02/25 04:39:31 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/02/25 04:39:30 | 000,019,160 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/02/25 04:39:30 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/02/25 04:39:30 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/02/25 04:37:49 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/02/25 04:36:46 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2010/02/25 04:34:39 | 000,791,393 | —- | C] (Lars Hederer ) – C:\Users\April\Desktop\erunt_setup.exe
[2010/02/25 04:31:39 | 000,021,504 | —- | C] (Doug Knox) – C:\Users\April\Desktop\SysRestorePoint.exe
[2010/02/25 03:33:29 | 000,334,720 | —- | C] (Sysinternals - www.sysinternals.com) – C:\Users\April\Desktop\RootkitRevealer.exe
[2010/02/25 02:52:56 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2010/02/25 02:49:59 | 000,000,000 | —D | C] – C:\Users\April\AppData\Roaming\SUPERAntiSpyware.com
[2010/02/25 02:49:59 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2010/02/15 23:57:51 | 000,000,000 | —D | C] – C:\32788R22FWJFW
[2010/02/14 15:33:10 | 000,000,000 | —D | C] – C:\Users\April\AppData\Local\temp(142)
[2010/02/14 15:33:10 | 000,000,000 | —D | C] – C:\Windows\temp
[2010/02/14 15:09:36 | 000,000,000 | —D | C] – C:\ComboFix
[2010/02/14 15:08:56 | 000,000,000 | —D | C] – C:\Qoobox
[2010/02/14 13:18:59 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/02/14 12:30:51 | 000,000,000 | -H-D | C] – C:\ProgramData\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
[2010/02/14 12:30:25 | 000,000,000 | —D | C] – C:\ProgramData\Lavasoft
[2010/02/14 12:30:25 | 000,000,000 | —D | C] – C:\Program Files\Lavasoft
[2010/02/09 05:02:47 | 000,000,000 | —D | C] – C:\Users\April\Documents\FONTS
[2010/02/05 10:13:11 | 000,000,000 | —D | C] – C:\$AVG
[2010/02/05 10:11:47 | 000,000,000 | —D | C] – C:\ProgramData\avg9
[2010/02/02 23:20:08 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DivX Shared
[2008/12/07 02:56:38 | 000,061,440 | —- | C] ( ) – C:\Windows\System32\rsnpstd.dll
[2005/04/20 23:16:28 | 000,036,864 | —- | C] ( ) – C:\Windows\System32\vsnpstd.dll
[2004/02/16 19:59:50 | 000,061,440 | —- | C] ( ) – C:\Windows\System32\csnpstd.dll

========== Files - Modified Within 30 Days ==========

[2010/03/01 07:34:07 | 004,194,304 | -HS- | M] () – C:\Users\April\NTUSER.DAT
[2010/03/01 07:32:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/03/01 06:55:59 | 000,003,472 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/03/01 06:55:59 | 000,003,472 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/03/01 04:32:00 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/03/01 03:37:16 | 000,112,640 | —- | M] () – C:\Users\April\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/01 03:32:33 | 000,000,418 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{232F54BC-E566-4F1D-BD15-2E58324827BC}.job
[2010/02/28 23:02:47 | 000,729,436 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/02/28 23:02:47 | 000,631,234 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/02/28 23:02:47 | 000,111,812 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/02/28 22:58:55 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2010/02/28 22:56:14 | 000,054,156 | -H– | M] () – C:\Windows\QTFont.qfn
[2010/02/28 22:56:14 | 000,008,268 | —- | M] () – C:\Users\April\AppData\Local\d3d9caps.dat
[2010/02/28 22:55:58 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/02/28 22:55:56 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/02/28 22:55:52 | 3219,644,416 | -HS- | M] () – C:\hiberfil.sys
[2010/02/28 22:53:27 | 003,407,073 | -H– | M] () – C:\Users\April\AppData\Local\IconCache.db
[2010/02/28 22:18:17 | 056,460,208 | —- | M] () – C:\Windows\System32\drivers\Avg\incavi.avm
[2010/02/27 12:03:10 | 000,077,312 | —- | M] () – C:\Users\April\Desktop\mbr.exe
[2010/02/27 10:48:12 | 000,000,793 | —- | M] () – C:\Users\Public\Desktop\World of Warcraft.lnk
[2010/02/27 01:33:48 | 000,001,649 | —- | M] () – C:\Users\Public\Desktop\AVG Free 9.0.lnk
[2010/02/27 01:33:40 | 000,012,464 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\avgrsstx.dll
[2010/02/27 01:33:39 | 000,360,584 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgtdix.sys
[2010/02/27 01:33:30 | 000,333,192 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgldx86.sys
[2010/02/27 01:33:27 | 006,061,540 | —- | M] () – C:\Windows\System32\drivers\Avg\avi7.avg
[2010/02/27 01:33:27 | 000,492,629 | —- | M] () – C:\Windows\System32\drivers\Avg\miniavi.avg
[2010/02/27 01:33:27 | 000,142,495 | —- | M] () – C:\Windows\System32\drivers\Avg\microavi.avg
[2010/02/27 01:33:27 | 000,113,461 | —- | M] () – C:\Windows\System32\drivers\Avg\iavichjw.avm
[2010/02/27 01:33:27 | 000,028,424 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgmfx86.sys
[2010/02/27 01:06:22 | 000,110,624 | —- | M] (NVIDIA Corporation) – C:\Windows\System32\drivers\nvstor32.sys
[2010/02/26 12:25:30 | 000,549,888 | —- | M] (OldTimer Tools) – C:\Users\April\Desktop\OTL.exe
[2010/02/26 10:37:54 | 000,293,376 | —- | M] () – C:\Users\April\Desktop\cqpgucjv.exe
[2010/02/26 10:30:26 | 000,000,020 | —- | M] () – C:\Users\April\defogger_reenable
[2010/02/25 10:45:14 | 000,177,416 | —- | M] (Kaspersky Lab) – C:\Users\April\Desktop\TDSSKiller.exe
[2010/02/25 05:23:24 | 000,050,477 | —- | M] () – C:\Users\April\Desktop\Defogger.exe
[2010/02/25 04:39:34 | 000,000,820 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/25 04:36:50 | 000,000,735 | —- | M] () – C:\Users\April\Desktop\NTREGOPT.lnk
[2010/02/25 04:36:49 | 000,000,716 | —- | M] () – C:\Users\April\Desktop\ERUNT.lnk
[2010/02/25 04:34:41 | 000,791,393 | —- | M] (Lars Hederer ) – C:\Users\April\Desktop\erunt_setup.exe
[2010/02/25 04:31:39 | 000,021,504 | —- | M] (Doug Knox) – C:\Users\April\Desktop\SysRestorePoint.exe
[2010/02/25 02:50:02 | 000,000,904 | —- | M] () – C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk
[2010/02/16 11:59:03 | 000,001,726 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010/02/16 00:59:53 | 000,001,876 | —- | M] () – C:\Users\April\Desktop\HijackThis.lnk
[2010/02/16 00:20:26 | 004,194,304 | -HS- | M] () – C:\Users\April\ntuser.dat_previous
[2010/02/09 09:11:53 | 000,001,266 | —- | M] () – C:\Users\April\Desktop\DivX Movies.lnk
[2010/02/06 21:59:13 | 000,002,075 | —- | M] () – C:\Users\Public\Desktop\Google Earth.lnk

========== Files Created - No Company Name ==========

[2010/02/27 12:03:07 | 000,077,312 | —- | C] () – C:\Users\April\Desktop\mbr.exe
[2010/02/27 01:33:48 | 000,001,649 | —- | C] () – C:\Users\Public\Desktop\AVG Free 9.0.lnk
[2010/02/27 01:33:27 | 056,460,208 | —- | C] () – C:\Windows\System32\drivers\Avg\incavi.avm
[2010/02/27 01:33:27 | 006,061,540 | —- | C] () – C:\Windows\System32\drivers\Avg\avi7.avg
[2010/02/27 01:33:27 | 000,492,629 | —- | C] () – C:\Windows\System32\drivers\Avg\miniavi.avg
[2010/02/27 01:33:27 | 000,142,495 | —- | C] () – C:\Windows\System32\drivers\Avg\microavi.avg
[2010/02/27 01:33:27 | 000,113,461 | —- | C] () – C:\Windows\System32\drivers\Avg\iavichjw.avm
[2010/02/26 12:21:47 | 3219,644,416 | -HS- | C] () – C:\hiberfil.sys
[2010/02/26 10:37:54 | 000,293,376 | —- | C] () – C:\Users\April\Desktop\cqpgucjv.exe
[2010/02/26 10:30:10 | 000,000,020 | —- | C] () – C:\Users\April\defogger_reenable
[2010/02/25 05:17:24 | 000,050,477 | —- | C] () – C:\Users\April\Desktop\Defogger.exe
[2010/02/25 04:39:34 | 000,000,820 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/25 04:36:50 | 000,000,735 | —- | C] () – C:\Users\April\Desktop\NTREGOPT.lnk
[2010/02/25 04:36:49 | 000,000,716 | —- | C] () – C:\Users\April\Desktop\ERUNT.lnk
[2010/02/25 03:33:29 | 000,102,160 | —- | C] () – C:\Users\April\Desktop\RootkitRevealer.chm
[2010/02/25 02:50:02 | 000,000,904 | —- | C] () – C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk
[2010/02/16 00:59:53 | 000,001,876 | —- | C] () – C:\Users\April\Desktop\HijackThis.lnk
[2010/02/06 21:59:13 | 000,002,075 | —- | C] () – C:\Users\Public\Desktop\Google Earth.lnk
[2010/02/05 14:14:59 | 367,262,412 | —- | C] () – C:\Users\April\Desktop\Lost.S05E09.HDTV.XviD-NoTV.avi
[2010/02/05 12:47:29 | 367,862,124 | —- | C] () – C:\Users\April\Desktop\Lost.S05E08.HDTV.XviD-XOR.avi
[2010/02/05 12:03:56 | 367,273,454 | —- | C] () – C:\Users\April\Desktop\Lost.S05E06 - 316.avi
[2010/02/05 11:08:21 | 367,116,288 | —- | C] () – C:\Users\April\Desktop\Lost.S05E05 - This Place is Death.avi
[2010/02/05 10:25:31 | 367,084,004 | —- | C] () – C:\Users\April\Desktop\Lost.S05E02 - The Lie.avi
[2010/02/05 09:41:54 | 367,797,282 | —- | C] () – C:\Users\April\Desktop\Lost.S05E03 - Jughead.avi
[2010/02/05 07:32:55 | 367,214,354 | —- | C] () – C:\Users\April\Desktop\lost.S05E14.hdtv.xvid-notv.avi
[2010/02/05 07:32:25 | 367,248,890 | —- | C] () – C:\Users\April\Desktop\lost.S05E15.hdtv.xvid-notv.avi
[2010/02/05 05:38:34 | 733,678,316 | —- | C] () – C:\Users\April\Desktop\lost.s05e16-e17.hdtv.xvid-fqm.avi
[2010/02/02 23:19:48 | 000,001,266 | —- | C] () – C:\Users\April\Desktop\DivX Movies.lnk
[2010/01/20 16:22:11 | 000,000,093 | —- | C] () – C:\Users\April\AppData\Local\fusioncache.dat
[2009/10/29 01:53:47 | 000,147,301 | —- | C] () – C:\Program Files\irc.jar
[2009/10/29 01:53:47 | 000,133,627 | —- | C] () – C:\Program Files\irc-unsigned.jar
[2009/10/29 01:53:47 | 000,086,969 | —- | C] () – C:\Program Files\irc.cab
[2009/10/29 01:53:47 | 000,070,487 | —- | C] () – C:\Program Files\pixx.jar
[2009/10/29 01:53:47 | 000,051,629 | —- | C] () – C:\Program Files\pixx.cab
[2009/10/29 01:53:47 | 000,025,978 | —- | C] () – C:\Program Files\readme_1.txt
[2009/10/29 01:53:47 | 000,017,718 | —- | C] () – C:\Program Files\license.txt
[2009/10/29 01:53:47 | 000,017,704 | —- | C] () – C:\Program Files\background.gif
[2009/10/29 01:53:47 | 000,011,047 | —- | C] () – C:\Program Files\pixx-readme.txt
[2009/10/29 01:53:47 | 000,009,430 | —- | C] () – C:\Program Files\versions.txt
[2009/10/29 01:53:47 | 000,007,788 | —- | C] () – C:\Program Files\securedirc.cab
[2009/10/29 01:53:47 | 000,003,989 | —- | C] () – C:\Program Files\french.lng
[2009/10/29 01:53:47 | 000,003,843 | —- | C] () – C:\Program Files\english.lng
[2009/10/29 01:53:47 | 000,003,158 | —- | C] () – C:\Program Files\IRCApplet.class
[2009/10/29 01:53:47 | 000,002,840 | —- | C] () – C:\Program Files\pixx-french.lng
[2009/10/29 01:53:47 | 000,002,633 | —- | C] () – C:\Program Files\pixx-english.lng
[2009/10/29 01:53:47 | 000,002,495 | —- | C] () – C:\Program Files\HeavyApplet.html
[2009/10/29 01:53:47 | 000,002,131 | —- | C] () – C:\Program Files\AppletWithJS.html
[2009/10/29 01:53:47 | 000,002,083 | —- | C] () – C:\Program Files\NormalApplet.html
[2009/10/29 01:53:47 | 000,001,748 | —- | C] () – C:\Program Files\securedirc-unsigned.cab
[2009/10/29 01:53:47 | 000,000,734 | —- | C] () – C:\Program Files\thanks.txt
[2009/10/29 01:53:47 | 000,000,730 | —- | C] () – C:\Program Files\pjirc.cfg
[2009/10/29 01:53:47 | 000,000,531 | —- | C] () – C:\Program Files\SimpleApplet.html
[2009/10/21 22:53:13 | 000,495,104 | —- | C] () – C:\Program Files\STOIK_Capturer.msi
[2009/10/21 22:53:13 | 000,001,871 | —- | C] () – C:\Program Files\readme.txt
[2009/05/14 19:21:00 | 000,000,262 | —- | C] () – C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2009/04/08 20:13:48 | 000,020,992 | —- | C] () – C:\Windows\jestertb.dll
[2008/11/02 18:37:01 | 000,499,200 | —- | C] () – C:\Windows\System32\WZDPlay.dll
[2008/08/22 22:14:47 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2008/06/10 18:07:20 | 003,596,288 | —- | C] () – C:\Windows\System32\qt-dx331.dll
[2008/06/10 18:03:26 | 000,000,416 | —- | C] () – C:\Windows\System32\dtu100.dll.manifest
[2008/06/10 18:03:26 | 000,000,416 | —- | C] () – C:\Windows\System32\dpl100.dll.manifest
[2008/05/22 16:18:54 | 000,012,288 | —- | C] () – C:\Windows\System32\DivXWMPExtType.dll
[2008/04/12 16:56:24 | 002,463,976 | —- | C] () – C:\Windows\System32\NPSWF32.dll
[2008/04/12 00:08:34 | 000,008,268 | —- | C] () – C:\Users\April\AppData\Local\d3d9caps.dat
[2008/04/02 01:36:12 | 000,000,412 | —- | C] () – C:\Windows\MAXLINK.INI
[2008/03/30 01:57:08 | 000,007,432 | —- | C] () – C:\Windows\System32\Machnm32.sys
[2008/03/30 00:29:42 | 000,002,164 | —- | C] () – C:\Users\April\AppData\Roaming\wklnhst.dat
[2008/03/29 22:18:56 | 000,112,640 | —- | C] () – C:\Users\April\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/11/23 06:34:23 | 000,000,342 | —- | C] () – C:\ProgramData\hpzinstall.log
[2007/11/23 06:16:23 | 000,327,680 | —- | C] () – C:\Windows\System32\pythoncom25.dll
[2007/11/23 06:16:23 | 000,102,400 | —- | C] () – C:\Windows\System32\pywintypes25.dll
[2006/11/02 06:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 01:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/05/03 21:40:42 | 000,390,784 | —- | C] () – C:\Windows\System32\drivers\snpstd.sys
[2003/01/17 23:34:40 | 000,015,541 | —- | C] () – C:\Windows\snpstd.ini

========== Alternate Data Streams ==========

@Alternate Data Stream - 64 bytes -> C:\Users\April\Desktop\jrhillplace.avi:TOC.WMV
< End of report >

Hi Aprilizer,

The computer is running fine and there are no redirects or popups

Looks good.

The one Kaspersky detection will be removed when we remove our tools.

Important If you no longer have a copy of Combofix.exe on your desktop, please download a copy from Link 1 . We will not run it but will need it for an important part of the clean up routine.


If no other problems, we can clean up our tools. Keep Defogger, we will use it shortly.

From your desktop, please delete, if present

• any notepads/logs that we created
• GMER.zip
• GMER (cqpgucjv.exe)
• MBR.exe

Next

Open the Run box by pressing the Windows key and R.

Copy and paste the following line into the run box and click OK

Combofix /uninstall


Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.


I suggest you keep MBAM. Keep MBAM updated and use it regularly.

To re-enable your Emulation drivers, double click DeFogger to run the tool.

• The application window will appear
• Click the Re-enable button to re-enable your CD Emulation drivers
• Click Yes to continue
• A 'Finished!' message will appear
• Click OK
• DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.



Updates and upgrades

Your logs indicate you have Java™ 6 Update 17 installed which is out of date. You can try to update it via the Java Console as you did before or you can manually update it as follows:

Open Add/Remove programs and please uninstall Java™ 6 Update 17
To get the newest version follow these instructions:

• Go to http://java.sun.com/javase/downloads/index.jsp
• Scroll down to "Java Runtime Environment (JRE) 6 Update 18
• Click the download button on the right.

If Information Bar pop-ups up, right-click on it and say it's OK to display the blocked content.

• Select the platform (Windows, in your case), mutli language.
• Accept the license agreement, click continue.

You do not have to install the Java Web Start ActiveX Control

• Scroll down and click on Windows Offline Installation,
• Save the file jre-6u18-windows-i586-p.exe to your desktop;

Do not select Run . Do not install it yet.

When the download is complete, close your browser.

• Right click on the saved file ( jre-6u18-windows-i586-p.exe) and select "Run as Administrator" to install the update.
• Delete the downloaded installation file after completing the above procedure and reboot if not prompted to do so.

You have an older version of Adobe Reader. You can download the current version HERE

You may want to consider Foxit Reader instead. It may be a bit lighter on resources.

Visit their support forum
Foxit Forum

In either case you should uninstall Adobe Reader 8.1.2 first. Be sure to move any PDF documents to another folder first though.


Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall. Just add a firewall.

* If you are behind a router Windows firewall should be fine. Otherwise a 3rd party firewall with outbound monitoring is recommended.

Click FIREWALL for tips, reviews and links to good, free and paid for firewalls. (Note: Zone Alarm is becoming bloatware,IMO)


You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.


-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.

• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.


- Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis.


- Ensure that Automatic Update is turned on so you get all the latest patches.
Click start, control panel, click Security Center.


- Keep your antivirus program updated, as well as any other security programs you have.


-More tips and programs can be found HERE


- You may also want to read this article By Tony Klein
http://www.freedomlist.com/forum/viewtopic.php?t=22879

We will keep this thread open for a couple of days. Please post back if you have any problems or questions. Please post back when you have finished so this thread can be marked "Resolved".


Take care