[Resolved] Google redirect (via Firefox)

OTL logfile created on: 3/12/2010 6:01:12 PM - Run 1
OTL by OldTimer - Version 3.1.37.0 Folder = C:\Documents and Settings\Henry\My Documents\INCOMING\FM BROWSER
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 58.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 144.38 Gb Total Space | 104.44 Gb Free Space | 72.33% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive R: | 511.00 Mb Total Space | 510.99 Mb Free Space | 100.00% Space Free | Partition Type: FAT32

Computer Name: BORG
Current User Name: Henry
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Henry\My Documents\INCOMING\FM BROWSER\OTL.exe (OldTimer Tools)
PRC - C:\Documents and Settings\Henry\Application Data\SystemProc\lsass.exe (NWxkCAG5g)
PRC - C:\Program Files\Google\Update\1.2.183.17\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files\Citrix\GoToMeeting\452\g2mstart.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\GoToMeeting\452\g2mlauncher.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\GoToMeeting\452\g2mcomm.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\MozyHome\mozystat.exe (Mozy, Inc.)
PRC - C:\Documents and Settings\Henry\Start Menu\Programs\Startup\AltEdge.exe (www.1HourSoftware.com)
PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
PRC - C:\Program Files\Titlebar Date-Time\TBDT.exe (Whispering Pines Software http://WhisperingPinesSoftware.com)
PRC - C:\Program Files\dvd43\DVD43_Tray.exe ()
PRC - C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
PRC - C:\Program Files\StartKiller\StartKiller.exe (Tordex)
PRC - C:\WINDOWS\system32\igfxext.exe (Intel Corporation)
PRC - C:\Program Files\ShortKeys2\shklite.exe (Insight Software Solutions)
PRC - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\system32\FpLogonServ.exe (AuthenTec,Inc)
PRC - C:\WINDOWS\system32\TAMSvr.exe (AuthenTec Inc.)
PRC - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
PRC - C:\Program Files\Toshiba\TME3\TMERzCtl.exe (TOSHIBA)
PRC - C:\Program Files\Apoint2K\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe (TOSHIBA CORPORATION.)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
PRC - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe ()
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe (TOSHIBA CORPORATION.)
PRC - C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe (Intel® Corporation)
PRC - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
PRC - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe (TOSHIBA CORPORATION.)
PRC - C:\Program Files\Eraser\Eraser.exe (The Eraser Project)
PRC - C:\WINDOWS\system32\ThpSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Realtek\RTL8187 Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)
PRC - C:\WINDOWS\system32\TODDSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\FolderSize\FolderSizeSvc.exe (Brio)
PRC - C:\Program Files\Toshiba\Wireless Hotkey\TosHKCW.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION)
PRC - C:\Program Files\RocketDock\RocketDock.exe ()
PRC - C:\WINDOWS\tsnp2std.exe ()
PRC - C:\Program Files\NetMeter\NetMeter.exe ()
PRC - C:\WINDOWS\vsnp2std.exe (Sonix)
PRC - C:\Program Files\Infineon\Security Platform Software\SpTNA.exe (Infineon Technologies AG)
PRC - C:\Program Files\Infineon\Security Platform Software\PSDrt.exe (Infineon Technologies AG)
PRC - C:\WINDOWS\system32\IfxPsdSv.exe (Infineon Technologies AG)
PRC - C:\WINDOWS\FixCamera.exe ()
PRC - C:\Program Files\Toshiba\TOSHIBA Direct Disc Writer\DDWMon.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Toshiba\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
PRC - C:\Program Files\CrossHair\CrossHair.exe ()
PRC - C:\TOSHIBA\IVP\ISM\pinger.exe ()
PRC - C:\Program Files\MuralPix\MpAgent.exe (Learsy)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe (TOSHIBA CORPORATION.)
PRC - C:\Program Files\Microsoft ActiveSync\wcescomm.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft ActiveSync\rapimgr.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\PSIService.exe ()
PRC - C:\WINDOWS\system32\00THotkey.exe (TOSHIBA Corporation)
PRC - C:\WINDOWS\system32\TFNF5.exe (TOSHIBA Corp.)
PRC - C:\Program Files\Toshiba\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Toshiba\TME3\TMESRV31.exe (TOSHIBA)
PRC - C:\Program Files\Toshiba\TouchED\TouchED.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Toshiba\TME3\TMEEJME.exe (TOSHIBA)
PRC - C:\Program Files\Canon\MultiPASS4\mpservic.exe (Canon Inc)
PRC - C:\Program Files\yProxy\yProxy.exe (Brawny Lads Productions)
PRC - C:\Program Files\PerSono\PersTray.exe (Plantronics)
PRC - C:\WINDOWS\system32\FxRedir.exe (Canon Inc)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Henry\My Documents\INCOMING\FM BROWSER\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\ShortKeys2\shkhook.dll (Insight Software Solutions)
MOD - C:\Program Files\RocketDock\RocketDock.dll ()


========== Win32 Services (SafeList) ==========

SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
SRV - (aswUpdSv) – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (FingerprintServer) – C:\WINDOWS\system32\FpLogonServ.exe (AuthenTec,Inc)
SRV - (Authentec memory manager) – C:\WINDOWS\system32\TAMSvr.exe (AuthenTec Inc.)
SRV - (TNaviSrv) – C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
SRV - (TOSHIBA Bluetooth Service) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (Swupdtmr) – c:\TOSHIBA\IVP\swupdate\swupdtmr.exe ()
SRV - (EvtEng) – C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV - (S24EventMonitor) – C:\Program Files\Intel\WiFi\bin\S24EvMon.exe (Intel® Corporation)
SRV - (RegSrvc) – C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
SRV - (Thpsrv) – C:\WINDOWS\system32\ThpSrv.exe (TOSHIBA Corporation)
SRV - (TODDSrv) – C:\WINDOWS\system32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (FolderSize) – C:\Program Files\FolderSize\FolderSizeSvc.exe (Brio)
SRV - (PersonalSecureDriveService) – C:\WINDOWS\system32\IfxPsdSv.exe (Infineon Technologies AG)
SRV - (pinger) – C:\TOSHIBA\IVP\ISM\pinger.exe ()
SRV - (ProtexisLicensing) – C:\WINDOWS\system32\PSIService.exe ()
SRV - (Tmesrv) – C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe (TOSHIBA)
SRV - (CFSvcs) – C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (MpService) – C:\Program Files\Canon\MultiPASS4\mpservic.exe (Canon Inc)


========== Driver Services (SafeList) ==========

DRV - (epmntdrv) – C:\WINDOWS\system32\epmntdrv.sys ()
DRV - (EuGdiDrv) – C:\WINDOWS\system32\EuGdiDrv.sys ()
DRV - (aswTdi) – C:\WINDOWS\system32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\system32\drivers\aswRdr.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\system32\drivers\aavmker4.sys (ALWIL Software)
DRV - (aswMon2) – C:\WINDOWS\system32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswSP) – C:\WINDOWS\system32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (dvd43llh) – C:\WINDOWS\system32\drivers\dvd43llh.sys (RIF)
DRV - (pwdrvio) – C:\WINDOWS\system32\pwdrvio.sys ()
DRV - (pwdspio) – C:\WINDOWS\system32\pwdspio.sys ()
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (iaStor) – C:\WINDOWS\system32\drivers\iaStor.sys (Intel Corporation)
DRV - (snapman) – C:\WINDOWS\system32\DRIVERS\snapman.sys (Acronis)
DRV - (SCRCAMHRDRV) – C:\WINDOWS\system32\drivers\SCRCAMHRDRV.sys (Windows ® Server 2003 DDK provider)
DRV - (mcdbus) – C:\WINDOWS\system32\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (NPF) – C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (ialm) – C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation)
DRV - (hotcore3) – C:\WINDOWS\system32\drivers\hotcore3.sys (Paragon Software Group)
DRV - (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor) – C:\WINDOWS\system32\drivers\ATSwpDrv.sys (AuthenTec, Inc.)
DRV - (tos_sps32) – C:\WINDOWS\system32\DRIVERS\tos_sps32.sys (TOSHIBA Corporation)
DRV - (Ambfilt) – C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (TosRfSnd) – C:\WINDOWS\system32\drivers\TosRfSnd.sys (TOSHIBA Corporation)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (tosrfbd) – C:\WINDOWS\system32\drivers\tosrfbd.sys (TOSHIBA CORPORATION)
DRV - (Tosrfcom) – C:\WINDOWS\system32\drivers\tosrfcom.sys (TOSHIBA Corporation)
DRV - (UVCFTR) – C:\WINDOWS\system32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.)
DRV - (Thpdrv) – C:\WINDOWS\system32\DRIVERS\thpdrv.sys (TOSHIBA Corporation)
DRV - (Tosrfusb) – C:\WINDOWS\system32\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV - (RTLWUSB) – C:\WINDOWS\system32\drivers\rtl8187.sys (Realtek Semiconductor Corporation )
DRV - (e1yexpress) Intel® – C:\WINDOWS\system32\drivers\e1y5132.sys (Intel Corporation)
DRV - (NETw5x32) Intel® – C:\WINDOWS\system32\drivers\NETw5x32.sys (Intel Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (tosporte) – C:\WINDOWS\system32\drivers\tosporte.sys (TOSHIBA Corporation)
DRV - (s24trans) – C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (Tosrfhid) – C:\WINDOWS\system32\drivers\Tosrfhid.sys (TOSHIBA Corporation.)
DRV - (PalmUSBD) – C:\WINDOWS\system32\drivers\PalmUSBD.sys (PalmSource, Inc.)
DRV - (tosrfbnp) – C:\WINDOWS\system32\drivers\tosrfbnp.sys (TOSHIBA Corporation)
DRV - (SNP2STD) USB2.0 PC Camera (SNP2STD) – C:\WINDOWS\system32\drivers\snp2sxp.sys ()
DRV - (Thpevm) – C:\WINDOWS\system32\DRIVERS\Thpevm.SYS (TOSHIBA Corporation)
DRV - (PersonalSecureDrive) – C:\WINDOWS\System32\drivers\psd.sys (Infineon Technologies AG)
DRV - (IFXTPM) – C:\WINDOWS\system32\drivers\ifxtpm.sys (Infineon Technologies AG)
DRV - (BusRMUSB) – C:\WINDOWS\system32\drivers\BusRMUSB.sys (Windows ® Server 2003 DDK provider)
DRV - (tdudf) – C:\WINDOWS\system32\drivers\tdudf.sys (TOSHIBA Corporation)
DRV - (tdcmdpst) – C:\WINDOWS\system32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (TEchoCan) – C:\WINDOWS\system32\drivers\TEchoCan.sys (TOSHIBA Corporation)
DRV - (trudf) – C:\WINDOWS\system32\drivers\trudf.sys (TOSHIBA Corporation)
DRV - (TVALZ) – C:\WINDOWS\system32\DRIVERS\TVALZ.SYS (TOSHIBA Corporation)
DRV - (tosrfec) – C:\WINDOWS\system32\drivers\tosrfec.sys (TOSHIBA Corporation)
DRV - (Monfilt) – C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)
DRV - (toshidpt) – C:\WINDOWS\system32\drivers\Toshidpt.sys (TOSHIBA Corporation.)
DRV - (tosrfnds) – C:\WINDOWS\system32\drivers\tosrfnds.sys (TOSHIBA Corporation.)
DRV - (TMEI3E) – C:\WINDOWS\system32\drivers\TMEI3E.sys (Toshiba Corporation)
DRV - (RRamdisk) – C:\WINDOWS\system32\DRIVERS\rramdisk.sys (gavotte)
DRV - (Netdevio) – C:\WINDOWS\system32\drivers\Netdevio.sys (TOSHIBA Corporation.)
DRV - (uacFlt) – C:\WINDOWS\system32\drivers\uacflt.sys (Micronas GmbH)
DRV - (cis1284) – C:\WINDOWS\system32\drivers\cis1284.sys (Canon)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;="
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/ig?hl=en&source;=iglk"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: {097d3191-e6fa-4728-9826-b533d755359d}:0.7.11
FF - prefs.js..extensions.enabledItems: {9CE11043-9A15-4207-A565-0C94C42D590D}:2.0
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:[removed]
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100211.5
FF - prefs.js..extensions.enabledItems: {1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}:0.4.4
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.64.4
FF - prefs.js..extensions.enabledItems: {AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.63
FF - prefs.js..extensions.enabledItems: [removed]:0.7.1
FF - prefs.js..extensions.enabledItems: [removed]:1.0.12
FF - prefs.js..extensions.enabledItems: [removed]:0.8.2009122501
FF - prefs.js..extensions.enabledItems: {a756d17a-5a4c-4417-813c-c8cd0151e486}:1.3.2
FF - prefs.js..extensions.enabledItems: {29852C08-1E91-4889-A6BF-C77F91D6A8F3}:1.8.57


FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/03/11 19:32:35 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/03/11 19:32:35 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.3\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010/03/11 09:50:25 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.3\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2009/12/08 17:28:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Mozilla\Extensions
[2009/12/08 17:28:53 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Henry\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010/03/12 12:47:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions
[2010/01/18 20:41:46 | 000,000,000 | —D | M] (All-in-One Sidebar) – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}
[2010/02/15 15:49:59 | 000,000,000 | —D | M] (FlashGot) – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2010/02/15 15:50:12 | 000,000,000 | —D | M] (Image Zoom) – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}
[2010/01/28 18:42:39 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\{29852C08-1E91-4889-A6BF-C77F91D6A8F3}
[2010/03/12 12:46:54 | 000,000,000 | —D | M] (Open Profile Folder) – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\{a756d17a-5a4c-4417-813c-c8cd0151e486}
[2010/02/15 15:50:12 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}
[2010/01/07 22:58:18 | 000,000,000 | —D | M] (Adblock Plus) – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/02/15 15:50:10 | 000,000,000 | —D | M] (Greasemonkey) – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010/01/07 22:58:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\[removed]
[2009/11/13 15:31:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\[removed]
[2009/08/31 13:30:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\[removed]
[2010/01/06 19:40:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\[removed]
[2010/03/12 12:47:02 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/03/11 15:09:53 | 000,000,000 | —D | M] (Firefox security) – C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}
[2009/10/24 13:06:59 | 000,036,864 | —- | M] (Homestead Technologies, Inc.) – C:\Program Files\Mozilla Firefox\plugins\nphssb.dll
[2009/06/22 10:10:58 | 000,677,152 | —- | M] (Medical Informatics Engineering, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npzzatif.dll
[2009/07/31 06:19:37 | 000,002,400 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\seekservice110.xml

O1 HOSTS File: ([2010/01/10 21:36:13 | 000,371,829 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 12819 more lines…
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4A1C6093-14F9-44D7-860E-5D265CFCA9D9} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A58686ED-FC46-44C3-95C6-4A812AB776F1} - No CLSID value found.
O4 - HKLM..\Run: [000StTHK] C:\WINDOWS\System32\000StTHK.exe ()
O4 - HKLM..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe ()
O4 - HKLM..\Run: [dvd43] C:\Program Files\dvd43\DVD43_Tray.exe ()
O4 - HKLM..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe ()
O4 - HKLM..\Run: [fxredir] C:\WINDOWS\system32\FxRedir.exe (Canon Inc)
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe (Intel® Corporation)
O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION)
O4 - HKLM..\Run: [MuralPixAgent] C:\Program Files\MuralPix\MpAgent.exe (Learsy)
O4 - HKLM..\Run: [NDSTray.exe] File not found
O4 - HKLM..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe ()
O4 - HKLM..\Run: [SmoothView] C:\Program Files\Toshiba\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe (Sonix)
O4 - HKLM..\Run: [TAudEffect] C:\Program Files\TOSHIBA\TAudEffect\TAudEff.exe (TOSHIBA)
O4 - HKLM..\Run: [TFNF5] C:\WINDOWS\System32\TFNF5.exe (TOSHIBA Corp.)
O4 - HKLM..\Run: [ThpSrv] C:\WINDOWS\System32\thpsrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TMERzCtl.EXE] C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE (TOSHIBA)
O4 - HKLM..\Run: [TMESRV.EXE] C:\Program Files\TOSHIBA\TME3\TMESRV31.EXE (TOSHIBA)
O4 - HKLM..\Run: [TOSDCR] C:\WINDOWS\System32\TOSDCR.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TosHKCW.exe] C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [TouchED] C:\Program Files\Toshiba\TouchED\TouchED.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe ()
O4 - HKCU..\Run: [C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe ()
O4 - HKCU..\Run: [CrossHair] C:\Program Files\CrossHair\CrossHair.exe ()
O4 - HKCU..\Run: [GoToMeeting] C:\Program Files\Citrix\GoToMeeting\452\g2mstart.exe (Citrix Online, a division of Citrix Systems, Inc.)
O4 - HKCU..\Run: [H/PC Connection Agent] C:\Program Files\Microsoft ActiveSync\Wcescomm.exe (Microsoft Corporation)
O4 - HKCU..\Run: [RocketDock] C:\Program Files\RocketDock\RocketDock.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk = C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MozyHome Status.lnk = C:\Program Files\MozyHome\mozystat.exe (Mozy, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Perstray.lnk = C:\Program Files\PerSono\PersTray.exe (Plantronics)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\REALTEK RTL8187 Wireless LAN Utility.lnk = C:\Program Files\Realtek\RTL8187 Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ShortKeys Lite.lnk = C:\Program Files\ShortKeys2\shklite.exe (Insight Software Solutions)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Start Killer.lnk = C:\Program Files\StartKiller\StartKiller.exe (Tordex)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\yProxy.lnk = C:\Program Files\yProxy\yProxy.exe (Brawny Lads Productions)
O4 - Startup: C:\Documents and Settings\Henry\Start Menu\Programs\Startup\AltEdge.exe (www.1HourSoftware.com)
O4 - Startup: C:\Documents and Settings\Henry\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O4 - Startup: C:\Documents and Settings\Henry\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Henry\Start Menu\Programs\Startup\Titlebar Date-Time.lnk = C:\Program Files\Titlebar Date-Time\TBDT.exe (Whispering Pines Software http://WhisperingPinesSoftware.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: RTHDBPL = C:\Documents and Settings\Henry\Application Data\SystemProc\lsass.exe (NWxkCAG5g)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetIcon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Eraser = C:\Program Files\Eraser\Eraser.exe -hide (The Eraser Project)
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Easy-WebPrint Add To Print List - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint High Speed Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Preview - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: Microsoft XML Parser for Java file:///C:/WINDOWS/Java/classes/xmldso.cab (Reg Error: Key error.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\ATFUS: DllName - C:\WINDOWS\system32\FpWinLogonNp.dll - C:\WINDOWS\system32\FpWinlogonNp.dll (AuthenTec,Inc)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\TosBtNP: DllName - TosBtNP.dll - C:\WINDOWS\System32\TosBtNP.dll (TOSHIBA CORPORATION)
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/09/17 15:56:14 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/03/11 15:09:54 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Henry\Application Data\SystemProc
[2010/03/10 17:50:51 | 003,558,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\moviemk.exe
[2010/01/14 12:43:40 | 001,928,244 | —- | C] (Freeware D.J.B. Osborne) – C:\Program Files\HeliosPaint.exe
[2009/12/21 12:50:52 | 000,151,552 | —- | C] ( ) – C:\WINDOWS\System32\rsnp2std.dll
[2009/12/21 12:50:52 | 000,077,824 | —- | C] ( ) – C:\WINDOWS\System32\csnp2std.dll
[2009/11/10 19:15:06 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2009/10/09 14:27:06 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[2009/04/10 06:24:57 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/02/21 06:37:48 | 000,069,632 | —- | C] (ATTO Technology Inc.) – C:\Program Files\bench32.exe
[2009/02/19 10:39:14 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2009/02/17 14:05:55 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Intel
[2009/02/17 14:05:55 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Intel
[2008/09/17 16:00:31 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2008/09/17 15:56:11 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2008/09/17 15:56:11 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft

========== Files - Modified Within 30 Days ==========

[2010/03/12 18:02:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/03/12 18:00:11 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/03/12 17:59:03 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/03/12 17:58:35 | 000,000,312 | —- | M] () – C:\WINDOWS\tasks\GlaryInitialize.job
[2010/03/12 17:58:31 | 000,000,236 | —- | M] () – C:\WINDOWS\tasks\OGALogon.job
[2010/03/12 17:58:30 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/03/12 17:58:21 | 000,000,978 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1566897640-232253103-705547321-1005UA.job
[2010/03/12 17:58:21 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/03/12 17:57:51 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/03/12 17:57:45 | 3079,852,032 | -HS- | M] () – C:\hiberfil.sys
[2010/03/12 17:43:17 | 009,961,472 | —- | M] () – C:\Documents and Settings\Henry\ntuser.dat
[2010/03/12 01:45:07 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/03/11 19:02:22 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Henry\ntuser.ini
[2010/03/11 09:56:00 | 000,000,926 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1566897640-232253103-705547321-1005Core.job
[2010/03/09 01:37:04 | 000,003,526 | —- | M] () – C:\WINDOWS\mozy.blk
[2010/03/09 01:37:04 | 000,000,372 | —- | M] () – C:\WINDOWS\mozy.flt
[2010/03/08 11:19:26 | 000,002,626 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2010/03/08 03:00:50 | 000,001,355 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/02/18 14:36:00 | 003,731,456 | —- | M] () – C:\Documents and Settings\Henry\Desktop\LEM BUSINESS PLAN3.ppt
[2010/02/16 13:49:22 | 150,576,640 | —- | M] () – C:\SB2010_setup.msi
[2010/02/15 12:04:32 | 000,177,664 | —- | M] () – C:\Documents and Settings\Henry\My Documents\Itinerary SA cruise.doc
[2010/02/15 12:04:32 | 000,000,162 | -H– | M] () – C:\Documents and Settings\Henry\My Documents\~$inerary SA cruise.doc
[2010/02/12 10:30:55 | 000,022,528 | —- | M] () – C:\Documents and Settings\Henry\My Documents\Retired Officer Project agenda for conf dall.doc
[2010/02/12 09:22:41 | 000,000,815 | —- | M] () – C:\Documents and Settings\Henry\My Documents\ChatLog Retired Officers Project 2010_02_12 09_22.rtf

========== Files Created - No Company Name ==========

[2010/02/18 14:35:59 | 003,731,456 | —- | C] () – C:\Documents and Settings\Henry\Desktop\LEM BUSINESS PLAN3.ppt
[2010/02/17 08:55:41 | 150,576,640 | —- | C] () – C:\SB2010_setup.msi
[2010/02/15 12:04:32 | 000,000,162 | -H– | C] () – C:\Documents and Settings\Henry\My Documents\~$inerary SA cruise.doc
[2010/02/15 12:04:31 | 000,177,664 | —- | C] () – C:\Documents and Settings\Henry\My Documents\Itinerary SA cruise.doc
[2010/02/12 10:30:55 | 000,022,528 | —- | C] () – C:\Documents and Settings\Henry\My Documents\Retired Officer Project agenda for conf dall.doc
[2010/02/12 09:22:41 | 000,000,815 | —- | C] () – C:\Documents and Settings\Henry\My Documents\ChatLog Retired Officers Project 2010_02_12 09_22.rtf
[2010/02/05 05:47:32 | 000,014,848 | —- | C] () – C:\WINDOWS\System32\EuEpmGdi.dll
[2010/02/05 05:47:32 | 000,013,192 | —- | C] () – C:\WINDOWS\System32\epmntdrv.sys
[2010/02/05 05:47:32 | 000,008,456 | —- | C] () – C:\WINDOWS\System32\EuGdiDrv.sys
[2009/12/21 18:14:20 | 000,024,238 | —- | C] () – C:\Documents and Settings\Henry\Application Data\Comma Separated Values (Windows).ADR
[2009/12/21 12:50:59 | 000,025,472 | —- | C] () – C:\WINDOWS\System32\drivers\sncamd.sys
[2009/12/21 12:50:59 | 000,015,497 | —- | C] () – C:\WINDOWS\snp2std.ini
[2009/12/21 12:50:58 | 012,212,864 | —- | C] () – C:\WINDOWS\System32\drivers\snp2sxp.sys
[2009/11/28 08:50:45 | 000,112,640 | —- | C] () – C:\WINDOWS\System32\rrsec.dll
[2009/10/26 08:31:14 | 000,002,528 | —- | C] () – C:\Documents and Settings\Henry\Application Data\$_hpcst$.hpc
[2009/08/18 05:39:52 | 000,053,299 | —- | C] () – C:\WINDOWS\System32\pthreadVC.dll
[2009/08/18 05:37:28 | 000,403,968 | —- | C] () – C:\Program Files\ToYcon.exe
[2009/08/16 07:27:26 | 000,016,456 | —- | C] () – C:\WINDOWS\System32\pwdrvio.sys
[2009/08/16 07:27:26 | 000,011,088 | —- | C] () – C:\WINDOWS\System32\pwdspio.sys
[2009/08/10 16:31:06 | 000,000,000 | —- | C] () – C:\WINDOWS\ToDisc.INI
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2009/07/31 06:19:29 | 000,237,568 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2009/07/20 05:51:15 | 000,015,620 | —- | C] () – C:\WINDOWS\System32\SystemRes13.sm.SYS
[2009/07/16 22:38:06 | 000,001,160 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2009/07/16 19:14:46 | 004,637,952 | —- | C] () – C:\Program Files\Common Files\lpuninstall.exe
[2009/07/11 11:07:43 | 000,000,058 | —- | C] () – C:\Documents and Settings\Henry\Local Settings\Application Data\DonationCoder_ScreenshotCaptor_InstallInfo.dat
[2009/07/08 15:30:01 | 000,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2009/07/07 21:10:01 | 000,007,680 | —- | C] () – C:\WINDOWS\System32\CNMVS6j.DLL
[2009/07/02 19:00:30 | 000,008,704 | —- | C] () – C:\WINDOWS\rmubcntl.dll
[2009/07/02 19:00:30 | 000,007,680 | —- | C] () – C:\WINDOWS\cvnet05.dll
[2009/07/02 19:00:30 | 000,000,090 | —- | C] () – C:\WINDOWS\PsLink.ini
[2009/07/02 18:36:13 | 000,010,831 | —- | C] () – C:\WINDOWS\System32\MpUPMon.dll
[2009/06/04 06:50:09 | 004,244,744 | —- | C] () – C:\WINDOWS\System32\qtp-mt334.dll
[2009/06/04 06:50:09 | 000,247,560 | —- | C] () – C:\WINDOWS\System32\prgiso.dll
[2009/06/04 06:50:09 | 000,013,576 | —- | C] () – C:\WINDOWS\System32\wnaspi32.dll
[2009/04/12 12:33:06 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v5016.dll
[2009/04/02 21:19:42 | 000,037,888 | —- | C] () – C:\WINDOWS\System32\setupnt.dll
[2009/03/30 06:25:56 | 000,323,248 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/03/06 08:46:37 | 000,000,097 | —- | C] () – C:\WINDOWS\WirelessFTP.INI
[2009/02/21 06:42:41 | 000,000,000 | —- | C] () – C:\WINDOWS\bench32.INI
[2009/02/19 15:05:44 | 000,007,680 | —- | C] () – C:\WINDOWS\System32\CNMVS61.DLL
[2009/02/18 22:57:47 | 000,000,449 | —- | C] () – C:\WINDOWS\MakeDocW.ini
[2009/02/18 22:57:47 | 000,000,000 | —- | C] () – C:\WINDOWS\MakeDocW.exe.INI
[2009/02/18 20:02:47 | 000,011,264 | —- | C] () – C:\Documents and Settings\Henry\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/02/18 10:57:15 | 000,000,000 | —- | C] () – C:\WINDOWS\tosOBEX.INI
[2009/02/18 09:23:53 | 000,000,098 | —- | C] () – C:\WINDOWS\Cm102.ini.cfl
[2009/02/17 17:45:20 | 000,087,552 | —- | C] () – C:\WINDOWS\System32\cpwmon2k.dll
[2009/02/17 14:13:36 | 000,000,014 | RHS- | C] () – C:\WINDOWS\System32\drivers\fbd.sys
[2009/02/17 14:09:12 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2009/02/17 14:01:55 | 000,000,000 | —- | C] () – C:\WINDOWS\NDSTray.INI
[2009/02/17 13:57:13 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4973.dll
[2009/02/17 13:47:36 | 000,000,004 | RHS- | C] () – C:\WINDOWS\System32\drivers\taishop.sys
[2008/09/17 15:51:58 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2008/09/17 15:38:55 | 000,000,339 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2008/09/17 15:35:03 | 001,288,192 | —- | C] () – C:\WINDOWS\System32\quartz(2).dll
[2007/12/21 15:46:32 | 000,118,784 | —- | C] () – C:\WINDOWS\System32\TosBtAcc.dll
[2005/07/22 20:30:18 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\TosCommAPI.dll

========== LOP Check ==========

[2009/07/02 18:36:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Canon
[2009/12/13 08:06:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Copernic
[2009/09/20 12:24:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Easy Flyer Creator
[2009/09/06 18:24:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GARMIN
[2009/02/19 14:40:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\HotSync
[2009/06/14 11:28:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Infineon
[2009/02/22 19:14:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Insight Software
[2009/02/22 19:14:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Insight Software Solutions
[2009/02/25 16:43:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Macrium
[2009/02/18 14:37:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sync App Settings
[2010/03/12 17:58:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/02/27 20:07:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TOSHIBA
[2009/02/17 19:31:59 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{A25FEDC1-F6D7-440C-BCE2-B71F595F6646}
[2009/08/18 05:39:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Apowersoft
[2009/11/29 17:48:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\calibre
[2010/01/31 14:47:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Copernic
[2009/07/11 11:07:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\DonationCoder
[2009/09/12 15:20:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\GARMIN
[2009/02/17 18:12:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\GlarySoft
[2009/05/23 17:04:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Gold Wave Editor Pro
[2010/01/27 18:57:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\GrabIt
[2009/02/19 14:40:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\HotSync
[2009/08/13 20:10:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\IcoFX
[2009/06/14 11:28:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Infineon
[2009/02/20 13:44:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\IObit
[2009/10/02 19:53:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\LockHunter
[2009/12/12 08:03:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\MailWasherPro
[2009/06/10 21:04:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\mjusbsp
[2009/03/06 15:44:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Mobipocket
[2009/11/22 13:26:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\MuralPix
[2010/01/31 19:26:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\OfficeRecovery
[2009/08/24 21:41:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Opera
[2009/04/04 06:51:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Participatory Culture Foundation
[2009/04/04 06:58:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\PCF-VLC
[2009/12/23 10:45:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Sprite Software
[2009/02/18 14:37:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Sync App Settings
[2010/03/11 15:09:54 | 000,000,000 | -HSD | M] – C:\Documents and Settings\Henry\Application Data\SystemProc
[2009/12/08 17:28:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Thunderbird
[2009/03/03 11:56:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\toshiba
[2010/02/15 12:23:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\uTorrent
[2009/07/20 05:56:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\WikidPad
[2008/09/17 16:13:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\WinBatch
[2009/08/16 20:30:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Windows Search
[2010/03/12 17:58:35 | 000,000,312 | —- | M] () – C:\WINDOWS\Tasks\GlaryInitialize.job
[2010/03/12 01:45:07 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2010/03/12 17:58:31 | 000,000,236 | —- | M] () – C:\WINDOWS\Tasks\OGALogon.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 196 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:284D1EE4
@Alternate Data Stream - 195 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C265C458
@Alternate Data Stream - 162 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DCE70D73
@Alternate Data Stream - 153 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:820563D3
< End of report >

OTL Extras logfile created on: 3/12/2010 6:01:12 PM - Run 1
OTL by OldTimer - Version 3.1.37.0 Folder = C:\Documents and Settings\Henry\My Documents\INCOMING\FM BROWSER
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 58.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 144.38 Gb Total Space | 104.44 Gb Free Space | 72.33% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive R: | 511.00 Mb Total Space | 510.99 Mb Free Space | 100.00% Space Free | Partition Type: FAT32

Computer Name: BORG
Current User Name: Henry
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"UACDisableNotify" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe" = C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager – (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe" = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager – (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe" = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\TOSHIBA\ivp\NetInt\Netint.exe" = C:\TOSHIBA\ivp\NetInt\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrade Engine – (TOSHIBA Corporation)
"C:\TOSHIBA\Ivp\ISM\pinger.exe" = C:\TOSHIBA\IVP\ISM\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger – ()
"C:\Program Files\Palm\Hotsync.exe" = C:\Program Files\Palm\Hotsync.exe:*:Enabled:HotSync® Manager Application – File not found
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\Program Files\Participatory Culture Foundation\Miro\Miro_Downloader.exe" = C:\Program Files\Participatory Culture Foundation\Miro\Miro_Downloader.exe:*:Enabled:Miro_Downloader – ()
"C:\Documents and Settings\Henry\Application Data\mjusbsp\magicJack.exe" = C:\Documents and Settings\Henry\Application Data\mjusbsp\magicJack.exe:*:Enabled:magicJack – (magicJack L.P.)
"C:\Program Files\Airlink101\Airlink101 PS Software\PsLink.exe" = C:\Program Files\Airlink101\Airlink101 PS Software\PsLink.exe:*:Enabled:PsLink – ()
"C:\WINDOWS\PsMon.exe" = C:\WINDOWS\PsMon.exe:*:Enabled:PsMonitor – ()
"C:\Documents and Settings\Henry\My Documents\INCOMING\FM BROWSER\Treo_700P_ROW_Simulator_Release\PalmSDK\Simulators\Treo_700P_ROW_Simulator_Release_Build_31\palmsim.exe" = C:\Documents and Settings\Henry\My Documents\INCOMING\FM BROWSER\Treo_700P_ROW_Simulator_Release\PalmSDK\Simulators\Treo_700P_ROW_Simulator_Release_Build_31\palmsim.exe:*:Enabled:Palm OS Simulator Component – File not found
"C:\Program Files\VideoLAN\VLC\vlc.exe" = C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player – ()
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe" = C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager – (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe" = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager – (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe" = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application – (Microsoft Corporation)
"C:\Documents and Settings\Henry\Local Settings\Temp\pylC8.tmp\pyrun.exe" = C:\Documents and Settings\Henry\Local Settings\Temp\pylC8.tmp\pyrun.exe:*:Enabled:pyrun – File not found
"C:\Program Files\Sprite Software\Sprite Backup\spriteservice.exe" = C:\Program Files\Sprite Software\Sprite Backup\spriteservice.exe:*:Enabled:Sprite PC Service – ()
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook – (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote – (Microsoft Corporation)
"C:\Program Files\mIRC\mirc.exe" = C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC – (mIRC Co. Ltd.)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser – (Opera Software)
"C:\Documents and Settings\Henry\desktop\My Mobile\MyMobiler\MyMobiler.exe" = C:\Documents and Settings\Henry\desktop\My Mobile\MyMobiler\MyMobiler.exe:*:Enabled:My Mobiler – (MTUX Corp)
"C:\WINDOWS\system32\GoogleOverlay.exe" = C:\WINDOWS\system32\GoogleOverlay.exe:*:Enabled:Explorer – File not found


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{05B68931-AD1D-4879-AF0E-D2BFF9750C58}" = CrossHair
"{13D0A392-F027-4A0A-AC76-B6F3109E1A35}_is1" = InstantMask 1.2
"{1A15507A-8551-4626-915D-3D5FA095CC1B}" = Corel Paint Shop Pro X
"{1CB92574-96F2-467B-B793-5CEB35C40C29}" = Image Resizer Powertoy for Windows XP
"{22A83C29-58A8-4CAB-8EDC-918D74F8429E}_is1" = WikidPad 1.8final
"{291B3A3B-F808-45B8-8113-DF232FCB6C82}" = Microsoft .NET Compact Framework 3.5
"{2C38F661-26B7-445D-B87D-B53FE2D3BD42}" = TOSHIBA PC Diagnostic Tool
"{2CD65167-671F-49A3-B6C7-3B919DF028E2}_is1" = Streaming Video Recorder V2.0.1
"{2D87E961-577B-492B-AD54-1368680FB9A7}" = Bing Maps 3D
"{2EAF7E61-068E-11DF-953C-005056806466}" = Google Earth
"{30283233-3BE6-473D-A47C-ED964A2F78B4}_is1" = Inpaint 2.3
"{321DC1B9-2041-4788-B6FC-D4423A9BF1DC}" = calibre
"{334B6B44-2C7F-4AC0-A215-E780541CE033}" = Paragon Drive Copy 9.0 Personal Special Edition
"{342126E1-173C-4585-BFBE-3EBDD20E3E9E}" = Mobipocket Reader 6.2
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{414A373B-59DF-4102-94CA-9FE9A74CBDDA}" = Garmin Trip and Waypoint Manager v5
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{56190F69-01D3-46CA-9861-43377C5E9B87}" = TOSHIBA Utilities
"{59B039FE-9396-45F8-8B97-6B3F87FA7DB9}" = MouseFone
"{5E3CFCA6-C95A-47CB-A822-7FA80D423AF2}" = MapSource
"{690BE098-6D0D-493D-B079-BD7E8F81A141}" = Opera 10.10
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75438C0E-9925-412E-AD85-D0E71C6CE2ED}" = Digital Viewer
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7862BAD8-A379-4128-8AA1-EFD5A9603C53}" = Wireless Hotkey
"{7F3B0E97-447F-4199-84E3-7745BAA2E497}" = TOSHIBA Cooling Performance Diagnostic Tool
"{86B77B5A-B157-6386-37B0-DB2494DEEAFF}" = MozyHome Remote Backup
"{8827923A-B5B5-44F9-8FAF-DFFDB23BBEB8}" = Sprite Backup
"{8A508AAA-3B69-4326-B89E-A6166FA05D3C}" = Canon MultiPASS Suite 4.00
"{8C52A46C-7961-4A81-AB4B-92CF65CB4772}_is1" = Sothink Web Video Downloader
"{8F5F3634-4F0F-477D-AA79-25AEB425B517}" = Airlink101 PS Software
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISER_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISER_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISER_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{99052DB7-9592-4522-A558-5417BBAD48EE}" = Microsoft ActiveSync
"{9ACBDDE2-DD2D-4103-8ECE-D1A9F7F03D1A}" = TOSHIBA Power Saver
"{A2075A09-28AA-4D30-9BCC-82EAD9FA51BD}" = TrueSuite Access Manager
"{A6690C0E-B96E-4F0F-A8EB-D5B332454AC6}" = TOSHIBA Controls
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA468551-1794-42FE-B504-C41D75EEBDF2}_is1" = Partition Wizard Home Edition 4.0
"{AC76BA86-7AD7-5760-0000-900000000003}" = Japanese Fonts Support For Adobe Reader 9
"{B1102A25-3AA3-446B-AA0F-A699B07A02FD}" = Garmin USB Drivers
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B4E96960-5F6B-48B9-A5BD-6A5A9BB4F027}" = Avery Wizard 3.1
"{BEF106F8-2689-4530-925A-E1117836E8CD}" = Google SketchUp 7
"{C0FC3B56-E345-40CD-A5CB-7EB791CE3E74}" = TOSHIBA Password Utility
"{C9E4932C-8417-4E4C-A0E3-EE534810AB4D}" = ClearType Tuning Control Panel Applet
"{CAAB0192-5704-469F-A0BE-2D842D70E93B}_is1" = Sothink FLV Player
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D43908B1-76F6-42FB-B97D-0F4694769ACF}" = Start Killer
"{D63F2860-678D-11D4-B355-0010A4F75374}" = PerSono
"{D958FAC4-BAE0-4B1D-A42E-DE9BFDE7DDEE}" = Canon PhotoRecord
"{EA6EB7D0-C920-4434-B43D-0DDD0AF8F497}" = Garmin MapSource
"{F6591A9D-A7EF-4FDF-8440-F42C725E37F4}" = Easy Flyer Creator 2.0
"{F7C33BDF-F4F1-45AC-9DA7-C4937F3D91EB}_is1" = Xandros Presto 1.0.1
"{F850707C-B6A0-4B56-8709-F89CF8F9AC6D}" = Eraser
"{FC712CA0-A945-11d4-A594-956F6349FC18}" = True Launch Bar
"{FC8D21C8-7B29-4104-ADB0-FEE9CA1C7922}" = Folder Size for Windows
"{FD6034A3-655C-49F0-B496-D4CBFD74D7A7}" = Palm Desktop by ACCESS
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"3D Text Commander" = 3D Text Commander 3.0.1 by Insofta Development
"ABC Amber Sony Converter" = ABC Amber Sony Converter
"Allway Sync_is1" = Allway Sync version 9.4.11
"AnVir Task Manager" = AnVir Task Manager
"avast!" = avast! Antivirus
"CanonBJ_BJN_UTILITY" = BJ Network Tool
"CCleaner" = CCleaner
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"ConvertLIT Graphical User Interface" = ConvertLIT Graphical User Interface 2.0
"CutePDF Writer Installation" = CutePDF Writer 2.7
"DVD Shrink_is1" = DVD Shrink 3.2
"DVD43_is1" = DVD43 v4.4.1
"EASEUS Data Recovery Wizard 5.0.1_is1" = EASEUS Data Recovery Wizard 5.0.1
"EASEUS Partition Master Professional Edition_is1" = EASEUS Partition Master 5.0.1 Professional
"Easy-WebPrint" = Easy-WebPrint
"Eraser" = Eraser
"Free Mp3/Wma/Ogg Converter_is1" = Free Mp3/Wma/Ogg Converter 5.1
"Glary Utilities_is1" = Glary Utilities Pro 2.18.0.786
"Gold Wave Editor Pro_is1" = Gold Wave Editor Pro v10.2.2
"GOM Player" = GOM Player
"Google Updater" = Google Updater
"GrabIt_is1" = GrabIt 1.7.2 Beta 4 (build 997)
"HijackThis" = HijackThis 2.0.2
"IcoFX_is1" = IcoFX 1.6.4
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"Incomedia WebSite X5 Smart" = Incomedia WebSite X5 Smart
"Intuit SiteBuilder" = Intuit SiteBuilder
"LockHunter_is1" = LockHunter version 1.0 beta 3, 32 bit edition
"MagicDisc 2.7.106" = MagicDisc 2.7.106
"MigrateEasy" = Acronis Migrate Easy
"mIRC" = mIRC
"Miro" = Miro
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"Mozilla Thunderbird (3.0.3)" = Mozilla Thunderbird (3.0.3)
"MuralPix" = MuralPix 1.07
"MWSnap 3" = MWSnap 3
"NetMeter_is1" = NetMeter 1.1.3
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Picasa 3" = Picasa 3
"Pocket Mechanic v2.98 (WM5)" = Pocket Mechanic v2.98 (WM5)
"PROHYBRIDR" = 2007 Microsoft Office system
"Recuva" = Recuva
"Registrar Registry Manager (registered)_is1" = Registrar Registry Manager 4.00
"Registrar Registry Manager 4.00 (Professional Edition)" = Registrar Registry Manager 4.00 (Professional Edition)
"Resco Explorer" = Resco Explorer
"RocketDock_is1" = RocketDock 1.3.5
"ShortKeys Lite" = ShortKeys Lite
"Smart Defrag_is1" = Smart Defrag
"Snapshot" = Snapshot (remove only)
"Spb Backup" = Spb Backup
"Spb Pocket Plus" = Spb Pocket Plus
"Spb Weather" = Spb Weather
"Spb Wireless Monitor" = Spb Wireless Monitor
"SpeedyFox_is1" = SpeedyFox
"Titlbar Date-Time_is1" = Titlbar Date-Time Version 1.13
"TME" = Uninstall for TOSHIBA Mobile Extension3
"Tweak UI 2.10" = Tweak UI
"VisualRoute Lite Edition" = VisualRoute Lite Edition
"VLC media player" = VLC media player 1.0.0
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"yProxy" = yProxy

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"GoToMeeting" = GoToMeeting 4.5.0.452
"LastPass" = LastPass (uninstall only)

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 12/26/2009 6:45:19 PM | Computer Name = BORG | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\Documents and Settings\Henry\Local Settings\Temp\scoped_dir21319\TEMP_INSTALL\manifest.json
failed, 00000005.

Error - 12/26/2009 6:45:19 PM | Computer Name = BORG | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\Documents and Settings\Henry\Local Settings\Temp\scoped_dir21319\TEMP_INSTALL\i\agxjaHJvbWV0aGVtZXNyDAsSBEZpbGUYktsBDA
failed, 00000005.

Error - 12/26/2009 6:45:19 PM | Computer Name = BORG | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\Documents and Settings\Henry\Local Settings\Temp\scoped_dir21319\TEMP_INSTALL\i\agxjaHJvbWV0aGVtZXNyDAsSBEZpbGUYltMBDA
failed, 00000005.

Error - 12/26/2009 6:45:19 PM | Computer Name = BORG | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\Documents and Settings\Henry\Local Settings\Temp\scoped_dir21319\TEMP_INSTALL\i\agxjaHJvbWV0aGVtZXNyDAsSBEZpbGUYmtMBDA
failed, 00000005.

Error - 12/26/2009 6:45:19 PM | Computer Name = BORG | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\Documents and Settings\Henry\Local Settings\Temp\scoped_dir21319\TEMP_INSTALL\i\agxjaHJvbWV0aGVtZXNyDAsSBEZpbGUYoaQBDA
failed, 00000005.

Error - 12/26/2009 6:45:19 PM | Computer Name = BORG | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\Documents and Settings\Henry\Local Settings\Temp\scoped_dir21319\DECODED_IMAGES
failed, 00000005.

Error - 2/14/2010 2:27:04 AM | Computer Name = BORG | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://brakinghead.org.ua/download/BrakingHead_setup.CAB failed, 00000026.

Error - 3/2/2010 6:19:06 PM | Computer Name = BORG | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\WINDOWS\SoftwareDistribution\Download\fd7ccb9801a128b117a9fb207082094e\BIT2E.tmp
failed, 00000026.

Error - 3/2/2010 6:19:32 PM | Computer Name = BORG | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\WINDOWS\SoftwareDistribution\Download\cfa9afe0dfc4b8473a3ea9b4d6a1dad8\BIT2F.tmp
failed, 00000026.

Error - 3/4/2010 2:11:33 AM | Computer Name = BORG | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
C:\WINDOWS\SoftwareDistribution\Download\fd7ccb9801a128b117a9fb207082094e\BITC.tmp
failed, 00000026.

[ Application Events ]
Error - 3/6/2010 2:04:14 AM | Computer Name = BORG | Source = Google Update | ID = 20
Description =

Error - 3/6/2010 5:32:32 AM | Computer Name = BORG | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 80072f76, P2 endsearch, P3 search, P4 1.1.1593.0,
P5 mpsigdwn.dll, P6 1.1.1593.0, P7 windows defender, P8 NIL, P9 NIL, P10 NIL.

Error - 3/7/2010 8:48:07 PM | Computer Name = BORG | Source = NativeWrapper | ID = 5000
Description =

Error - 3/7/2010 8:48:15 PM | Computer Name = BORG | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 2.0-kb974417,
P2 1033, P3 1605, P4 msi, P5 f, P6 9.0.40302.0, P7 install, P8 x86, P9 xp, P10
0.

Error - 3/10/2010 11:35:25 AM | Computer Name = BORG | Source = NativeWrapper | ID = 5000
Description =

Error - 3/10/2010 11:35:43 AM | Computer Name = BORG | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 3.5-kb963707,
P2 1033, P3 1612, P4 msi, P5 f, P6 9.0.31211.0, P7 install, P8 x86, P9 xp, P10
0.

Error - 3/10/2010 11:36:07 AM | Computer Name = BORG | Source = MsiInstaller | ID = 1023
Description = Product: Microsoft .NET Framework 2.0 Service Pack 2 - Update '{BEEBFC3C-48B1-4A38-A3C5-81BA19DF5F40}'
could not be installed. Error code 1651. Additional information is available in
the log file C:\WINDOWS\system32\config\SYSTEM~1\LOCALS~1\Temp\Microsoft .NET Framework
2.0-KB958481_20100310_153556078-Msi0.txt.

Error - 3/10/2010 11:36:07 AM | Computer Name = BORG | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 2.0-kb958481,
P2 1033, P3 1651, P4 msi, P5 f, P6 9.0.31211.0, P7 install, P8 x86, P9 xp, P10
0.

Error - 3/10/2010 11:36:15 AM | Computer Name = BORG | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 2.0-kb974417,
P2 1033, P3 1605, P4 msi, P5 f, P6 9.0.40302.0, P7 install, P8 x86, P9 xp, P10
0.

Error - 3/12/2010 9:43:05 PM | Computer Name = BORG | Source = Application Error | ID = 1000
Description = Faulting application mymobiler.exe, version 1.0.0.1, faulting module
mymobiler.exe, version 1.0.0.1, fault address 0x00028252.

[ OSession Events ]
Error - 8/13/2009 10:29:47 AM | Computer Name = BORG | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 75411
seconds with 1620 seconds of active time. This session ended with a crash.

Error - 11/20/2009 5:19:04 PM | Computer Name = BORG | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 320262
seconds with 13680 seconds of active time. This session ended with a crash.

Error - 12/24/2009 2:27:03 PM | Computer Name = BORG | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 13326
seconds with 1620 seconds of active time. This session ended with a crash.

Error - 1/25/2010 9:05:19 PM | Computer Name = BORG | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 416
seconds with 360 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 3/11/2010 11:06:39 PM | Computer Name = BORG | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC0000010'
while processing the file 'Recycled' on the volume 'HarddiskVolumeRD'. It has
stopped monitoring the volume.

Error - 3/12/2010 12:09:38 AM | Computer Name = BORG | Source = Print | ID = 6161
Description = The document 958571 OHCD.pdf owned by Henry failed to print on printer
Canon PIXMA iP4000R. Data type: NT EMF 1.008. Size of the spool file in bytes:
524288. Number of bytes printed: 0. Total number of pages in the document: 1. Number
of pages printed: 0. Client machine: \\BORG. Win32 error code returned by the print
processor: 3 (0x3).

Error - 3/12/2010 7:00:29 AM | Computer Name = BORG | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC0000010'
while processing the file '_641250_' on the volume 'HarddiskVolumeRD'. It has
stopped monitoring the volume.

Error - 3/12/2010 7:00:31 AM | Computer Name = BORG | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Microsoft .NET Framework 1.1 Service Pack 1 Security Update
for Windows 2000, Windows XP, Windows Vista, Windows Server 2008, Windows 7, and
Windows Server 2008 R2 (KB953297).

Error - 3/12/2010 7:00:56 AM | Computer Name = BORG | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Microsoft .NET Framework 2.0 Service Pack 2 Security Update
for Windows 2000, Windows Server 2003, and Windows XP (KB974417).

Error - 3/12/2010 9:59:41 PM | Computer Name = BORG | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC0000010'
while processing the file 'Recycled' on the volume 'HarddiskVolumeRD'. It has
stopped monitoring the volume.

Error - 3/12/2010 10:00:07 PM | Computer Name = BORG | Source = DCOM | ID = 10016
Description = The machine-default permission settings do not grant Local Activation
permission for the COM Server application with CLSID {A4199E55-EBB9-49E5-AF1A-7A5408B2E206}

to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20). This security permission
can be modified using the Component Services administrative tool.

Error - 3/12/2010 10:00:07 PM | Computer Name = BORG | Source = DCOM | ID = 10016
Description = The machine-default permission settings do not grant Local Activation
permission for the COM Server application with CLSID {A4199E55-EBB9-49E5-AF1A-7A5408B2E206}

to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20). This security permission
can be modified using the Component Services administrative tool.

Error - 3/12/2010 10:00:07 PM | Computer Name = BORG | Source = DCOM | ID = 10016
Description = The machine-default permission settings do not grant Local Activation
permission for the COM Server application with CLSID {A4199E55-EBB9-49E5-AF1A-7A5408B2E206}

to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20). This security permission
can be modified using the Component Services administrative tool.

Error - 3/12/2010 10:00:09 PM | Computer Name = BORG | Source = Service Control Manager | ID = 7000
Description = The ScreenCamera HR service failed to start due to the following error:
%%1058


< End of report >

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-12 18:40:38
Windows 5.1.2600 Service Pack 3
Running: qn1dfp8v.exe; Driver: C:\DOCUME~1\Henry\LOCALS~1\Temp\fgldqpod.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xA83B56B8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xA83B5574]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xA83B5A52]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xA83B514C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xA83B564E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xA83B508C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xA83B50F0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xA83B576E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xA83B572E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xA83B58AE]

—- Kernel code sections - GMER 1.0.15 —-

.text C:\WINDOWS\system32\drivers\tos_sps32.sys section is writeable [0xB9CEB480, 0x3C939, 0xE8000020]
.dsrt C:\WINDOWS\system32\drivers\tos_sps32.sys unknown last section [0xB9D2C900, 0x3CA, 0x48000040]

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Mozilla Firefox\firefox.exe[5220] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)

—- User IAT/EAT - GMER 1.0.15 —-

IAT C:\WINDOWS\system32\services.exe[1344] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00380002
IAT C:\WINDOWS\system32\services.exe[1344] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 00380000

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs mozy.sys (Mozy Change Monitor Filter Driver/Mozy, Inc.)
AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\usbstor \Device\000000a1 dvd43llh.sys (dvd43llh.sys/RIF)

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 snapman.sys (Acronis Snapshot API/Acronis)

Device \Driver\usbstor \Device\000000a5 dvd43llh.sys (dvd43llh.sys/RIF)
Device \Driver\mcdbus \Device\00000088 dvd43llh.sys (dvd43llh.sys/RIF)
Device \Driver\mcdbus \Device\mcdbus dvd43llh.sys (dvd43llh.sys/RIF)

AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \FileSystem\Fastfat \Fat mozy.sys (Mozy Change Monitor Filter Driver/Mozy, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

—- EOF - GMER 1.0.15 —-

#1
If cured, no further questions.
Comment: My son used this laptop on a trip, but is sure that it was uninfected while he had it. We think this infection occurred when I accidently clicked on the enclosure to a friend's email.
————————————————————————————

#2 Combofix log

ComboFix 10-03-12.04 - Henry 03/13/2010 6:17.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2937.1633 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100308-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Henry\Application Data\SystemProc
c:\documents and settings\Henry\Application Data\SystemProc\lsass.exe
c:\documents and settings\Henry\Start Menu\Programs\Startup\MagicDisc.lnk
C:\install.exe
c:\program files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}
c:\program files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul
c:\program files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf
c:\recycler\S-1-5-21-259743849-349352752-3167014290-500
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\SHELLLNK.TLB
c:\windows\system32\wpcap.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_NPF
——-\Legacy_uacFlt
——-\Service_NPF
——-\Service_uacFlt


((((((((((((((((((((((((( Files Created from 2010-02-13 to 2010-03-13 )))))))))))))))))))))))))))))))
.

2010-03-11 01:50 . 2009-10-23 15:28 3558912 -c—-w- c:\windows\system32\dllcache\moviemk.exe
2010-02-17 16:55 . 2010-02-16 21:49 150576640 —-a-w- C:\SB2010_setup.msi

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-13 14:24 . 2009-02-18 01:37 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-13 06:10 . 2009-02-18 05:03 ——– d—–w- c:\program files\Mozilla Thunderbird
2010-03-12 20:00 . 2009-02-19 18:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-03-11 17:30 . 2008-09-18 01:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-02-15 23:25 . 2009-04-02 13:54 ——– d—–w- c:\program files\uTorrent
2010-02-15 20:23 . 2009-04-02 13:54 ——– d—–w- c:\documents and settings\Henry\Application Data\uTorrent
2010-02-13 02:29 . 2009-07-10 03:04 ——– d—–w- c:\documents and settings\Henry\Application Data\vlc
2010-02-05 13:47 . 2010-02-05 13:47 ——– d—–w- c:\program files\EASEUS
2010-02-01 03:26 . 2010-02-01 03:26 ——– d—–w- c:\documents and settings\Henry\Application Data\OfficeRecovery
2010-02-01 03:21 . 2010-02-01 03:21 ——– d—–w- c:\program files\Recuva
2010-02-01 03:11 . 2010-02-01 03:11 ——– d—–w- c:\program files\OfficeRecovery
2010-01-31 22:52 . 2008-09-18 00:31 ——– d—–w- c:\program files\Google
2010-01-31 22:47 . 2009-12-13 16:06 ——– d—–w- c:\documents and settings\Henry\Application Data\Copernic
2010-01-29 04:35 . 2010-02-05 13:47 1692288 —-a-w- c:\windows\system32\BootMan.exe
2010-01-29 02:36 . 2010-01-29 02:36 ——– d—–w- c:\program files\InstantMask 1.2
2010-01-28 04:09 . 2009-08-25 05:40 ——– d—–w- c:\program files\Opera
2010-01-28 02:57 . 2009-02-23 04:03 ——– d—–w- c:\documents and settings\Henry\Application Data\GrabIt
2010-01-27 18:15 . 2009-02-18 05:39 81504 —-a-w- c:\documents and settings\Henry\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-27 18:14 . 2010-01-27 18:14 ——– d—–w- c:\program files\Avery
2010-01-24 12:10 . 2010-01-24 12:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2010-01-21 23:44 . 2010-01-21 23:44 ——– d—–w- c:\documents and settings\Henry\Application Data\Office Genuine Advantage
2010-01-21 00:53 . 2010-02-05 13:47 13192 —-a-w- c:\windows\system32\epmntdrv.sys
2010-01-21 00:53 . 2010-02-05 13:47 86408 —-a-w- c:\windows\system32\setupempdrv03.exe
2010-01-21 00:53 . 2010-02-05 13:47 8456 —-a-w- c:\windows\system32\EuGdiDrv.sys
2010-01-21 00:52 . 2010-02-05 13:47 14848 —-a-w- c:\windows\system32\EuEpmGdi.dll
2010-01-17 23:32 . 2008-09-18 01:14 ——– d—–w- c:\program files\Microsoft.NET
2010-01-14 20:43 . 2010-01-14 20:43 1928244 —-a-w- c:\program files\HeliosPaint.exe
2010-01-14 15:29 . 2010-01-14 15:29 ——– d—–w- c:\program files\Glary Utilities
2010-01-13 16:38 . 2010-01-13 16:38 ——– d—–w- c:\program files\AnVir Task Manager
2010-01-13 04:34 . 2010-01-13 04:05 ——– d—–w- c:\documents and settings\Henry\Application Data\mIRC
2010-01-13 04:32 . 2010-01-13 04:05 ——– d—–w- c:\program files\mIRC
2010-01-06 15:32 . 2009-03-30 14:25 323248 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-12-31 16:50 . 2008-09-17 23:35 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 21:29 . 2009-12-21 21:29 21035 —-a-w- c:\windows\system32\drivers\AegisP.sys
2009-12-21 19:14 . 2008-09-17 23:35 916480 —-a-w- c:\windows\system32\wininet.dll
2009-12-17 03:29 . 2009-12-17 03:29 162816 —-a-w- c:\windows\system32\fmod.dll
2009-12-16 18:43 . 2008-09-17 23:51 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2008-09-17 23:34 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-07-17 03:14 . 2009-07-17 03:14 4637952 —-a-w- c:\program files\Common Files\lpuninstall.exe
2009-05-22 01:54 . 2009-08-18 13:37 403968 —-a-w- c:\program files\ToYcon.exe
2008-07-29 21:54 . 2009-02-21 14:37 69632 —-a-w- c:\program files\bench32.exe
2009-08-05 22:40 . 2009-07-17 06:38 1160 –sha-w- c:\windows\system32\KGyGaAvL.sys
2009-02-17 22:13 . 2009-02-17 22:13 14 –sh–r- c:\windows\system32\drivers\fbd.sys
2009-02-17 21:47 . 2009-02-17 21:47 4 –sh–r- c:\windows\system32\drivers\taishop.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]
@="{747E722C-CB46-4a9d-BDFE-192AAD5099B1}"
[HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4a9d-BDFE-192AAD5099B1}]
2010-01-04 19:36 2848568 —-a-w- c:\program files\MozyHome\mozyshell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]
@="{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}"
[HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}]
2010-01-04 19:36 2848568 —-a-w- c:\program files\MozyHome\mozyshell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"CrossHair"="c:\program files\CrossHair\CrossHair.exe" [2007-04-03 102400]
"c:\program files\NetMeter\NetMeter.exe"="c:\program files\NetMeter\NetMeter.exe" [2007-08-11 331264]
"Google Update"="c:\documents and settings\Henry\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-10-31 135664]
"GoToMeeting"="c:\program files\Citrix\GoToMeeting\452\g2mstart.exe" [2010-02-13 39816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"NDSTray.exe"="NDSTray.exe" [BU]
"TFNF5"="TFNF5.exe" [2006-04-11 622592]
"IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2008-05-01 1347584]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2008-05-01 1191936]
"TosHKCW.exe"="c:\program files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2007-10-05 172032]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-12-15 184320]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]
"00THotkey"="c:\windows\system32\00THotkey.exe" [2006-07-05 258048]
"000StTHK"="000StTHK.exe" [2001-06-23 24576]
"DDWMon"="c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe" [2007-04-14 311296]
"TAudEffect"="c:\program files\TOSHIBA\TAudEffect\TAudEff.exe" [2006-08-10 344144]
"TMERzCtl.EXE"="c:\program files\TOSHIBA\TME3\TMERzCtl.EXE" [2008-07-10 94208]
"TMESRV.EXE"="c:\program files\TOSHIBA\TME3\TMESRV31.EXE" [2005-12-14 126976]
"TOSDCR"="TOSDCR.EXE" [2005-12-13 57344]
"TouchED"="c:\program files\TOSHIBA\TouchED\TouchED.exe" [2005-06-29 126976]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2007-01-26 136816]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"IFXSPMGT"="c:\windows\system32\ifxspmgt.exe" [2008-01-26 677144]
"RTHDCPL"="RTHDCPL.EXE" [2009-05-21 17881600]
"fxredir"="c:\windows\system32\fxredir.exe" [2001-08-22 65536]
"dvd43"="c:\program files\dvd43\dvd43_tray.exe" [2009-06-29 827904]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-12-12 143360]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-12-12 172032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-12-12 143360]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2007-04-10 159744]
"MuralPixAgent"="c:\program files\MuralPix\MpAgent.exe" [2006-12-30 102400]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"FixCamera"="c:\windows\FixCamera.exe" [2007-07-12 20480]
"tsnp2std"="c:\windows\tsnp2std.exe" [2007-08-31 262144]
"snp2std"="c:\windows\vsnp2std.exe" [2007-08-07 348160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]

c:\documents and settings\Henry\Start Menu\Programs\Startup\
AltEdge.exe [2009-12-13 215738]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
Titlebar Date-Time.lnk - c:\program files\Titlebar Date-Time\TBDT.exe [2009-8-16 135168]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2008-8-12 2979144]
MozyHome Status.lnk - c:\program files\MozyHome\mozystat.exe [2010-1-4 2893624]
Perstray.lnk - c:\program files\PerSono\perstray.exe [2009-10-26 40960]
REALTEK RTL8187 Wireless LAN Utility.lnk - c:\program files\Realtek\RTL8187 Wireless LAN Utility\RtWLan.exe [2009-12-21 815104]
ShortKeys Lite.lnk - c:\program files\ShortKeys2\shklite.exe [2009-2-22 2747392]
Start Killer.lnk - c:\program files\StartKiller\StartKiller.exe [2008-12-20 90112]
yProxy.lnk - c:\program files\yProxy\yProxy.exe [2009-3-2 675328]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ATFUS]
2008-09-03 21:48 208896 —-a-w- c:\windows\system32\FpWinlogonNp.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TosBtNP]
2006-07-22 03:54 65536 —-a-w- c:\windows\system32\TosBtNP.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=c:\windows\pss\HotSync Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PS-Link.lnk]
backup=c:\windows\pss\PS-Link.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Henry^Start Menu^Programs^Startup^Canon IJ Status Monitor Canon iP3600 series (Copy 1).lnk]
backup=c:\windows\pss\Canon IJ Status Monitor Canon iP3600 series (Copy 1).lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"FingerPrintNotifer"="c:\program files\TrueSuite Access Manager\FpNotifier.exe"
"UsbMonitor"="c:\program files\TrueSuite Access Manager\usbnotify.exe"
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" /start
"MPTBox"=c:\program files\Canon\MultiPASS4\MPTBox.exe
"monitr32"=c:\program files\Canon\MultiPASS4\monitr32.exe
"TPSMain"=TPSMain.exe
"TPSODDCtl"=TPSODDCtl.exe
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"MouseFone"=c:\program files\MouseFone\MouseFone.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=
"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= c:\\TOSHIBA\\IVP\\ISM\\pinger.exe
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Participatory Culture Foundation\\Miro\\Miro_Downloader.exe"=
"c:\\Documents and Settings\\Henry\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Program Files\\Airlink101\\Airlink101 PS Software\\PsLink.exe"=
"c:\\WINDOWS\\PsMon.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Sprite Software\\Sprite Backup\\spriteservice.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Documents and Settings\\Henry\\desktop\\My Mobile\\MyMobiler\\MyMobiler.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [6/4/2009 6:50 AM 40368]
R0 RRamdisk;Ramdisk Driver;c:\windows\system32\drivers\rramdisk.sys [2/23/2009 9:33 AM 10368]
R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\drivers\thpdrv.sys [7/9/2008 9:39 AM 27768]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\drivers\Thpevm.sys [9/4/2007 10:14 AM 6528]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2/17/2009 3:49 PM 114768]
R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\system32\drivers\psd.sys [7/24/2007 6:59 AM 38816]
R1 TMEI3E;TMEI3E;c:\windows\system32\drivers\TMEI3E.sys [9/17/2008 4:35 PM 5888]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2/17/2009 3:49 PM 20560]
R2 Authentec memory manager;Authentec memory manager service;c:\windows\system32\TAMSvr.exe [2/17/2009 2:01 PM 49152]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [12/21/2009 1:29 PM 38144]
R2 FingerprintServer;Fingerprint Server;c:\windows\system32\FpLogonServ.exe [2/17/2009 2:01 PM 131072]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [3/26/2007 11:22 AM 105856]
R2 Tmesrv;Tmesrv3;c:\program files\Toshiba\TME3\TMESRV31.exe [9/17/2008 4:35 PM 126976]
R2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [2/19/2007 11:15 AM 134016]
R3 BusRMUSB;Remote USB Bus;c:\windows\system32\drivers\BusRMUSB.sys [4/26/2009 10:28 AM 43008]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [2/17/2009 1:52 PM 243856]
S2 gupdate1c992c15c824c1a;Google Update Service (gupdate1c992c15c824c1a);c:\program files\Google\Update\GoogleUpdate.exe [2/19/2009 10:39 AM 133104]
S2 SCRCAMHRDRV;ScreenCamera HR;c:\windows\system32\drivers\SCRCAMHRDRV.sys [12/9/2009 6:23 AM 234304]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [6/28/2009 6:27 PM 1684736]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2/5/2010 5:47 AM 13192]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2/5/2010 5:47 AM 8456]
S3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [9/17/2008 5:37 PM 41216]
S3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [8/16/2009 7:27 AM 16456]
S3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [8/16/2009 7:27 AM 11088]
S3 RAMDiskXP;RAMDiskXP;c:\windows\system32\Drivers\RAMDiskXP.sys –> c:\windows\system32\Drivers\RAMDiskXP.sys [?]
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8187.sys [12/21/2009 1:29 PM 332928]
S3 TEchoCan;Toshiba Audio Effect;c:\windows\system32\drivers\TEchoCan.sys [9/17/2008 4:34 PM 435072]
.
Contents of the 'Scheduled Tasks' folder

2010-03-13 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2010-01-14 20:09]

2010-03-13 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-09-18 04:09]

2010-03-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-19 18:39]

2010-03-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-19 18:39]

2010-03-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1566897640-232253103-705547321-1005Core.job
- c:\documents and settings\Henry\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-26 22:45]

2010-03-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1566897640-232253103-705547321-1005UA.job
- c:\documents and settings\Henry\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-26 22:45]

2010-03-12 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 02:20]

2010-03-13 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 23:07]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
FF - ProfilePath - c:\documents and settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk
FF - component: c:\documents and settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\[removed]\platform\WINNT_x86-msvc\components\lpxpcom.dll
FF - plugin: c:\documents and settings\Henry\Local Settings\Application Data\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\progra~1\Palm\PACKAG~1\NPInstal.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nphssb.dll
FF - plugin: c:\program files\Picasa2\npPicasa2.dll
FF - plugin: c:\program files\Picasa2\npPicasa3.dll
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

HKLM-Explorer_Run-RTHDBPL - c:\documents and settings\Henry\Application Data\SystemProc\lsass.exe
SafeBoot-WinDefend
AddRemove-EASEUS Data Recovery Wizard 5.0.1_is1 - e:\easeus\EASEUS Recovery Wizard 5.0.1\unins000.exe
AddRemove-Registrar Registry Manager 4.00 (Professional Edition) - c:\program files\Registrar Registry Manager\unwise.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-13 06:28
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
RTHDBPL = c:\documents and settings\Henry\Application Data\SystemProc\lsass.exe???????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Microsoft\Environment*]
"Licence0"="REMOVED"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1248)
c:\windows\system32\FpWinLogonNp.dll
c:\program files\TrueSuite Access Manager\FpSuites.dll
c:\program files\TrueSuite Access Manager\SharedResources.dll
c:\program files\TrueSuite Access Manager\FPResource.dll
c:\windows\system32\authTpm.dll

- - - - - - - > 'explorer.exe'(1024)
c:\windows\system32\WININET.dll
c:\program files\RocketDock\RocketDock.dll
c:\program files\MozyHome\mozyshell.dll
c:\program files\ShortKeys2\shkHook.dll
c:\program files\TrueLaunchBar\tlb.dll
c:\program files\TrueLaunchBar\plugins\clipman\clipman.dll
c:\program files\TrueLaunchBar\plugins\wlmon\wlmon.dll
c:\windows\system32\ieframe.dll
c:\program files\StartKiller\ASHook.dll
c:\program files\TOSHIBA\TME3\TMEEJMD.DLL
c:\program files\TrueLaunchBar\plugins\turnoff\turnoff.dll
c:\program files\Canon\MultiPASS4\DTM4.DLL
c:\windows\system32\LTWVC11n.dll
c:\program files\Canon\MultiPASS4\MpDBIf.dll
c:\windows\system32\MPSRVC.dll
c:\program files\Canon\MultiPASS4\StorMgr.dll
c:\program files\Canon\MultiPASS4\CTree.dll
c:\windows\system32\LTKRN11N.DLL
c:\windows\system32\LTDIS11N.DLL
c:\windows\system32\LTFIL11N.DLL
c:\windows\system32\LTLST11N.DLL
c:\program files\TrueLaunchBar\plugins\pview\pview.dll
c:\program files\TrueLaunchBar\plugins\arp\arp.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Intel\WiFi\bin\S24EvMon.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Google\Update\1.2.183.17\GoogleCrashHandler.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\program files\FolderSize\FolderSizeSvc.exe
c:\windows\system32\IFXTCS.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\MozyHome\mozybackup.exe
c:\program files\Canon\MultiPASS4\MPSERVIC.EXE
c:\windows\system32\IfxPsdSv.exe
c:\windows\system32\PSIService.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\toshiba\IVP\swupdate\swupdtmr.exe
c:\windows\system32\ThpSrv.exe
c:\program files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
c:\windows\system32\TODDSrv.exe
c:\program files\TOSHIBA\TME3\TMEEJME.EXE
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\thpsrv.exe
c:\program files\TOSHIBA\ConfigFree\NDSTray.exe
c:\windows\system32\TFNF5.exe
c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\wscntfy.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Apoint2K\HidFind.exe
c:\program files\Apoint2K\Apntex.exe
c:\program files\Microsoft ActiveSync\Wcescomm.exe
c:\windows\system32\igfxext.exe
c:\program files\Infineon\Security Platform Software\PSDrt.exe
c:\program files\Infineon\Security Platform Software\SpTna.exe
c:\windows\system32\wbem\unsecapp.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
c:\program files\Citrix\GoToMeeting\452\g2mcomm.exe
c:\program files\Citrix\GoToMeeting\452\g2mlauncher.exe
c:\documents and settings\Henry\Start Menu\Programs\Startup\AltEdge.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
.
**************************************************************************
.
Completion time: 2010-03-13 06:36:21 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-13 14:36

Pre-Run: 114,110,754,816 bytes free
Post-Run: 114,159,587,328 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
C:\xanldr.mbr="Xandros Presto"

- - End Of File - - 4055FDEF44E58A1CD7465AD34B6B3771

————————————————————————————

#3 CK log

CKScanner - Additional Security Risks - These are not necessarily bad
c:\aircrk\aircrack-ng.url
c:\program files\corel\corel paint shop pro x\bump maps\cracked desert.pspimage
scanner sequence 3.ZZ.11
—– EOF —–

————————————————————————————

#4 Status

Computer never slowed down - the symptom was random redirects after Google searches under Firefox. I just tried a few Google searches, and clicked on links. The results were correct, so it looks like the problem is solved.

———————————————————————————–

THANKS!

MALWARE BYTES NEXT, BUT HERE'S COMBOFIX SCRIPT

———————————-

ComboFix 10-03-12.04 - Henry 03/13/2010 9:52.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2937.1597 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Henry\Desktop\CFscript.txt
AV: avast! antivirus 4.8.1368 [VPS 100308-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Files Created from 2010-02-13 to 2010-03-13 )))))))))))))))))))))))))))))))
.

2010-03-11 01:50 . 2009-10-23 15:28 3558912 -c—-w- c:\windows\system32\dllcache\moviemk.exe
2010-02-17 16:55 . 2010-02-16 21:49 150576640 —-a-w- C:\SB2010_setup.msi

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-13 17:59 . 2009-02-18 01:37 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-13 16:42 . 2009-02-18 05:03 ——– d—–w- c:\program files\Mozilla Thunderbird
2010-03-12 20:00 . 2009-02-19 18:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-03-11 17:30 . 2008-09-18 01:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-02-15 23:25 . 2009-04-02 13:54 ——– d—–w- c:\program files\uTorrent
2010-02-15 20:23 . 2009-04-02 13:54 ——– d—–w- c:\documents and settings\Henry\Application Data\uTorrent
2010-02-15 04:17 . 2010-03-13 06:12 651776 —-a-w- c:\documents and settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\[removed]\platform\WINNT_x86-msvc\components\lpxpcom.dll
2010-02-13 02:29 . 2009-07-10 03:04 ——– d—–w- c:\documents and settings\Henry\Application Data\vlc
2010-02-05 13:47 . 2010-02-05 13:47 ——– d—–w- c:\program files\EASEUS
2010-02-01 03:26 . 2010-02-01 03:26 ——– d—–w- c:\documents and settings\Henry\Application Data\OfficeRecovery
2010-02-01 03:21 . 2010-02-01 03:21 ——– d—–w- c:\program files\Recuva
2010-02-01 03:11 . 2010-02-01 03:11 ——– d—–w- c:\program files\OfficeRecovery
2010-01-31 22:52 . 2008-09-18 00:31 ——– d—–w- c:\program files\Google
2010-01-31 22:47 . 2009-12-13 16:06 ——– d—–w- c:\documents and settings\Henry\Application Data\Copernic
2010-01-29 04:35 . 2010-02-05 13:47 1692288 —-a-w- c:\windows\system32\BootMan.exe
2010-01-29 02:36 . 2010-01-29 02:36 ——– d—–w- c:\program files\InstantMask 1.2
2010-01-28 04:09 . 2009-08-25 05:40 ——– d—–w- c:\program files\Opera
2010-01-28 02:57 . 2009-02-23 04:03 ——– d—–w- c:\documents and settings\Henry\Application Data\GrabIt
2010-01-27 18:15 . 2009-02-18 05:39 81504 —-a-w- c:\documents and settings\Henry\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-27 18:14 . 2010-01-27 18:14 ——– d—–w- c:\program files\Avery
2010-01-24 12:10 . 2010-01-24 12:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2010-01-21 23:44 . 2010-01-21 23:44 ——– d—–w- c:\documents and settings\Henry\Application Data\Office Genuine Advantage
2010-01-21 00:53 . 2010-02-05 13:47 13192 —-a-w- c:\windows\system32\epmntdrv.sys
2010-01-21 00:53 . 2010-02-05 13:47 86408 —-a-w- c:\windows\system32\setupempdrv03.exe
2010-01-21 00:53 . 2010-02-05 13:47 8456 —-a-w- c:\windows\system32\EuGdiDrv.sys
2010-01-21 00:52 . 2010-02-05 13:47 14848 —-a-w- c:\windows\system32\EuEpmGdi.dll
2010-01-17 23:32 . 2008-09-18 01:14 ——– d—–w- c:\program files\Microsoft.NET
2010-01-14 20:43 . 2010-01-14 20:43 1928244 —-a-w- c:\program files\HeliosPaint.exe
2010-01-14 15:29 . 2010-01-14 15:29 ——– d—–w- c:\program files\Glary Utilities
2010-01-13 16:38 . 2010-01-13 16:38 ——– d—–w- c:\program files\AnVir Task Manager
2010-01-13 04:34 . 2010-01-13 04:05 ——– d—–w- c:\documents and settings\Henry\Application Data\mIRC
2010-01-13 04:32 . 2010-01-13 04:05 ——– d—–w- c:\program files\mIRC
2010-01-06 15:32 . 2009-03-30 14:25 323248 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-12-31 16:50 . 2008-09-17 23:35 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 21:29 . 2009-12-21 21:29 21035 —-a-w- c:\windows\system32\drivers\AegisP.sys
2009-12-21 19:14 . 2008-09-17 23:35 916480 ——w- c:\windows\system32\wininet.dll
2009-12-17 03:29 . 2009-12-17 03:29 162816 —-a-w- c:\windows\system32\fmod.dll
2009-12-16 18:43 . 2008-09-17 23:51 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2008-09-17 23:34 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-07-17 03:14 . 2009-07-17 03:14 4637952 —-a-w- c:\program files\Common Files\lpuninstall.exe
2009-05-22 01:54 . 2009-08-18 13:37 403968 —-a-w- c:\program files\ToYcon.exe
2008-07-29 21:54 . 2009-02-21 14:37 69632 —-a-w- c:\program files\bench32.exe
2009-08-05 22:40 . 2009-07-17 06:38 1160 –sha-w- c:\windows\system32\KGyGaAvL.sys
2009-02-17 22:13 . 2009-02-17 22:13 14 –sh–r- c:\windows\system32\drivers\fbd.sys
2009-02-17 21:47 . 2009-02-17 21:47 4 –sh–r- c:\windows\system32\drivers\taishop.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]
@="{747E722C-CB46-4a9d-BDFE-192AAD5099B1}"
[HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4a9d-BDFE-192AAD5099B1}]
2010-01-04 19:36 2848568 —-a-w- c:\program files\MozyHome\mozyshell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]
@="{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}"
[HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}]
2010-01-04 19:36 2848568 —-a-w- c:\program files\MozyHome\mozyshell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"CrossHair"="c:\program files\CrossHair\CrossHair.exe" [2007-04-03 102400]
"c:\program files\NetMeter\NetMeter.exe"="c:\program files\NetMeter\NetMeter.exe" [2007-08-11 331264]
"Google Update"="c:\documents and settings\Henry\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-10-31 135664]
"GoToMeeting"="c:\program files\Citrix\GoToMeeting\452\g2mstart.exe" [2010-02-13 39816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"TFNF5"="TFNF5.exe" [2006-04-11 622592]
"IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2008-05-01 1347584]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2008-05-01 1191936]
"TosHKCW.exe"="c:\program files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2007-10-05 172032]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-12-15 184320]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]
"00THotkey"="c:\windows\system32\00THotkey.exe" [2006-07-05 258048]
"000StTHK"="000StTHK.exe" [2001-06-23 24576]
"DDWMon"="c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe" [2007-04-14 311296]
"TAudEffect"="c:\program files\TOSHIBA\TAudEffect\TAudEff.exe" [2006-08-10 344144]
"TMERzCtl.EXE"="c:\program files\TOSHIBA\TME3\TMERzCtl.EXE" [2008-07-10 94208]
"TMESRV.EXE"="c:\program files\TOSHIBA\TME3\TMESRV31.EXE" [2005-12-14 126976]
"TOSDCR"="TOSDCR.EXE" [2005-12-13 57344]
"TouchED"="c:\program files\TOSHIBA\TouchED\TouchED.exe" [2005-06-29 126976]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2007-01-26 136816]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"IFXSPMGT"="c:\windows\system32\ifxspmgt.exe" [2008-01-26 677144]
"RTHDCPL"="RTHDCPL.EXE" [2009-05-21 17881600]
"fxredir"="c:\windows\system32\fxredir.exe" [2001-08-22 65536]
"dvd43"="c:\program files\dvd43\dvd43_tray.exe" [2009-06-29 827904]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-12-12 143360]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-12-12 172032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-12-12 143360]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2007-04-10 159744]
"MuralPixAgent"="c:\program files\MuralPix\MpAgent.exe" [2006-12-30 102400]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"FixCamera"="c:\windows\FixCamera.exe" [2007-07-12 20480]
"tsnp2std"="c:\windows\tsnp2std.exe" [2007-08-31 262144]
"snp2std"="c:\windows\vsnp2std.exe" [2007-08-07 348160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]

c:\documents and settings\Henry\Start Menu\Programs\Startup\
AltEdge.exe [2009-12-13 215738]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
Titlebar Date-Time.lnk - c:\program files\Titlebar Date-Time\TBDT.exe [2009-8-16 135168]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2008-8-12 2979144]
MozyHome Status.lnk - c:\program files\MozyHome\mozystat.exe [2010-1-4 2893624]
Perstray.lnk - c:\program files\PerSono\perstray.exe [2009-10-26 40960]
REALTEK RTL8187 Wireless LAN Utility.lnk - c:\program files\Realtek\RTL8187 Wireless LAN Utility\RtWLan.exe [2009-12-21 815104]
ShortKeys Lite.lnk - c:\program files\ShortKeys2\shklite.exe [2009-2-22 2747392]
Start Killer.lnk - c:\program files\StartKiller\StartKiller.exe [2008-12-20 90112]
yProxy.lnk - c:\program files\yProxy\yProxy.exe [2009-3-2 675328]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ATFUS]
2008-09-03 21:48 208896 —-a-w- c:\windows\system32\FpWinlogonNp.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TosBtNP]
2006-07-22 03:54 65536 —-a-w- c:\windows\system32\TosBtNP.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=c:\windows\pss\HotSync Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PS-Link.lnk]
backup=c:\windows\pss\PS-Link.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Henry^Start Menu^Programs^Startup^Canon IJ Status Monitor Canon iP3600 series (Copy 1).lnk]
backup=c:\windows\pss\Canon IJ Status Monitor Canon iP3600 series (Copy 1).lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"FingerPrintNotifer"="c:\program files\TrueSuite Access Manager\FpNotifier.exe"
"UsbMonitor"="c:\program files\TrueSuite Access Manager\usbnotify.exe"
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" /start
"MPTBox"=c:\program files\Canon\MultiPASS4\MPTBox.exe
"monitr32"=c:\program files\Canon\MultiPASS4\monitr32.exe
"TPSMain"=TPSMain.exe
"TPSODDCtl"=TPSODDCtl.exe
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"MouseFone"=c:\program files\MouseFone\MouseFone.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=
"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= c:\\TOSHIBA\\IVP\\ISM\\pinger.exe
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Participatory Culture Foundation\\Miro\\Miro_Downloader.exe"=
"c:\\Documents and Settings\\Henry\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Program Files\\Airlink101\\Airlink101 PS Software\\PsLink.exe"=
"c:\\WINDOWS\\PsMon.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Sprite Software\\Sprite Backup\\spriteservice.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Documents and Settings\\Henry\\desktop\\My Mobile\\MyMobiler\\MyMobiler.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [6/4/2009 6:50 AM 40368]
R0 RRamdisk;Ramdisk Driver;c:\windows\system32\drivers\rramdisk.sys [2/23/2009 9:33 AM 10368]
R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\drivers\thpdrv.sys [7/9/2008 9:39 AM 27768]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\drivers\Thpevm.sys [9/4/2007 10:14 AM 6528]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2/17/2009 3:49 PM 114768]
R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\system32\drivers\psd.sys [7/24/2007 6:59 AM 38816]
R1 TMEI3E;TMEI3E;c:\windows\system32\drivers\TMEI3E.sys [9/17/2008 4:35 PM 5888]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2/17/2009 3:49 PM 20560]
R2 Authentec memory manager;Authentec memory manager service;c:\windows\system32\TAMSvr.exe [2/17/2009 2:01 PM 49152]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [12/21/2009 1:29 PM 38144]
R2 FingerprintServer;Fingerprint Server;c:\windows\system32\FpLogonServ.exe [2/17/2009 2:01 PM 131072]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [3/26/2007 11:22 AM 105856]
R2 Tmesrv;Tmesrv3;c:\program files\Toshiba\TME3\TMESRV31.exe [9/17/2008 4:35 PM 126976]
R2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [2/19/2007 11:15 AM 134016]
R3 BusRMUSB;Remote USB Bus;c:\windows\system32\drivers\BusRMUSB.sys [4/26/2009 10:28 AM 43008]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [2/17/2009 1:52 PM 243856]
S2 gupdate1c992c15c824c1a;Google Update Service (gupdate1c992c15c824c1a);c:\program files\Google\Update\GoogleUpdate.exe [2/19/2009 10:39 AM 133104]
S2 SCRCAMHRDRV;ScreenCamera HR;c:\windows\system32\drivers\SCRCAMHRDRV.sys [12/9/2009 6:23 AM 234304]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [6/28/2009 6:27 PM 1684736]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2/5/2010 5:47 AM 13192]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2/5/2010 5:47 AM 8456]
S3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [9/17/2008 5:37 PM 41216]
S3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [8/16/2009 7:27 AM 16456]
S3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [8/16/2009 7:27 AM 11088]
S3 RAMDiskXP;RAMDiskXP;c:\windows\system32\Drivers\RAMDiskXP.sys –> c:\windows\system32\Drivers\RAMDiskXP.sys [?]
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8187.sys [12/21/2009 1:29 PM 332928]
S3 TEchoCan;Toshiba Audio Effect;c:\windows\system32\drivers\TEchoCan.sys [9/17/2008 4:34 PM 435072]
.
Contents of the 'Scheduled Tasks' folder

2010-03-13 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2010-01-14 20:09]

2010-03-13 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-09-18 04:09]

2010-03-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-19 18:39]

2010-03-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-19 18:39]

2010-03-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1566897640-232253103-705547321-1005Core.job
- c:\documents and settings\Henry\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-26 22:45]

2010-03-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1566897640-232253103-705547321-1005UA.job
- c:\documents and settings\Henry\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-26 22:45]

2010-03-12 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 02:20]

2010-03-13 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 23:07]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
FF - ProfilePath - c:\documents and settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk
FF - component: c:\documents and settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\[removed]\platform\WINNT_x86-msvc\components\lpxpcom.dll
FF - plugin: c:\documents and settings\Henry\Local Settings\Application Data\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\progra~1\Palm\PACKAG~1\NPInstal.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nphssb.dll
FF - plugin: c:\program files\Picasa2\npPicasa2.dll
FF - plugin: c:\program files\Picasa2\npPicasa3.dll
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-13 10:05
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Microsoft\Environment*]
"Licence0"="REMOVED"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1244)
c:\windows\system32\FpWinLogonNp.dll
c:\program files\TrueSuite Access Manager\FpSuites.dll
c:\program files\TrueSuite Access Manager\SharedResources.dll
c:\program files\TrueSuite Access Manager\FPResource.dll
c:\windows\system32\authTpm.dll
c:\windows\system32\cscui.dll

- - - - - - - > 'explorer.exe'(6036)
c:\windows\system32\WININET.dll
c:\program files\RocketDock\RocketDock.dll
c:\program files\MozyHome\mozyshell.dll
c:\program files\ShortKeys2\shkHook.dll
c:\program files\TrueLaunchBar\tlb.dll
c:\program files\TrueLaunchBar\plugins\clipman\clipman.dll
c:\program files\TrueLaunchBar\plugins\wlmon\wlmon.dll
c:\program files\TrueLaunchBar\plugins\turnoff\turnoff.dll
c:\program files\Canon\MultiPASS4\DTM4.DLL
c:\windows\system32\LTWVC11n.dll
c:\program files\Canon\MultiPASS4\MpDBIf.dll
c:\windows\system32\MPSRVC.dll
c:\program files\Canon\MultiPASS4\StorMgr.dll
c:\program files\Canon\MultiPASS4\CTree.dll
c:\windows\system32\LTKRN11N.DLL
c:\windows\system32\LTDIS11N.DLL
c:\windows\system32\LTFIL11N.DLL
c:\windows\system32\LTLST11N.DLL
c:\program files\TrueLaunchBar\plugins\pview\pview.dll
c:\program files\TrueLaunchBar\plugins\arp\arp.dll
c:\windows\system32\ieframe.dll
c:\program files\StartKiller\ASHook.dll
c:\program files\TOSHIBA\TME3\TMEEJMD.DLL
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Intel\WiFi\bin\S24EvMon.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\program files\Google\Update\1.2.183.17\GoogleCrashHandler.exe
c:\program files\FolderSize\FolderSizeSvc.exe
c:\windows\system32\IFXTCS.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\MozyHome\mozybackup.exe
c:\program files\Canon\MultiPASS4\MPSERVIC.EXE
c:\windows\system32\IfxPsdSv.exe
c:\windows\system32\PSIService.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\toshiba\IVP\swupdate\swupdtmr.exe
c:\windows\system32\ThpSrv.exe
c:\program files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
c:\windows\system32\TODDSrv.exe
c:\program files\TOSHIBA\TME3\TMEEJME.EXE
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\dwwin.exe
c:\windows\system32\thpsrv.exe
c:\windows\system32\TFNF5.exe
c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\igfxext.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Apoint2K\HidFind.exe
c:\program files\Apoint2K\Apntex.exe
c:\program files\Infineon\Security Platform Software\PSDrt.exe
c:\program files\Infineon\Security Platform Software\SpTna.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Microsoft ActiveSync\Wcescomm.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
c:\program files\Citrix\GoToMeeting\452\g2mcomm.exe
c:\program files\Citrix\GoToMeeting\452\g2mlauncher.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\documents and settings\Henry\Start Menu\Programs\Startup\AltEdge.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
.
**************************************************************************
.
Completion time: 2010-03-13 10:06:29 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-13 18:06
ComboFix2.txt 2010-03-13 14:36

Pre-Run: 114,153,312,256 bytes free
Post-Run: 114,118,782,976 bytes free

- - End Of File - - 6C93B8877DC360754E71EEFCF306C380

ESET (wow!):

C:\Documents and Settings\Henry\Application Data\Thunderbird\Profiles\7ktymm7r.Henry\Mail\Local Folders\Inbox Win32/Merond.O worm contained infected files
C:\Documents and Settings\Henry\Application Data\Thunderbird\Profiles\7ktymm7r.Henry\Mail\Local Folders\Trash multiple threats contained infected files
C:\Qoobox\Quarantine\C\Documents and Settings\Henry\Application Data\SystemProc\lsass.exe.vir Win32/Dursg.A trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{FD43AEFB-9366-41E0-A2FE-5D16511021C5}\RP675\A0066737.exe Win32/Dursg.A trojan cleaned by deleting - quarantined
—————————————————————–

OTL AGAIN:

OTL logfile created on: 3/13/2010 10:13:44 PM - Run 3
OTL by OldTimer - Version 3.1.37.0 Folder = C:\Documents and Settings\Henry\My Documents\INCOMING\FM BROWSER
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 49.00% Memory free
5.00 Gb Paging File | 3.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 144.38 Gb Total Space | 106.12 Gb Free Space | 73.50% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive R: | 511.00 Mb Total Space | 510.99 Mb Free Space | 100.00% Space Free | Partition Type: FAT32

Computer Name: BORG
Current User Name: Henry
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Henry\My Documents\INCOMING\FM BROWSER\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Mozilla Thunderbird\thunderbird.exe (Mozilla Messaging)
PRC - C:\Program Files\Google\Update\1.2.183.17\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files\Citrix\GoToMeeting\452\g2mstart.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\GoToMeeting\452\g2mlauncher.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\GoToMeeting\452\g2mcomm.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\MozyHome\mozystat.exe (Mozy, Inc.)
PRC - C:\Documents and Settings\Henry\Start Menu\Programs\Startup\AltEdge.exe (www.1HourSoftware.com)
PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
PRC - C:\Program Files\Titlebar Date-Time\TBDT.exe (Whispering Pines Software http://WhisperingPinesSoftware.com)
PRC - C:\Program Files\dvd43\DVD43_Tray.exe ()
PRC - C:\Program Files\StartKiller\StartKiller.exe (Tordex)
PRC - C:\WINDOWS\system32\igfxext.exe (Intel Corporation)
PRC - C:\Program Files\ShortKeys2\shklite.exe (Insight Software Solutions)
PRC - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\system32\FpLogonServ.exe (AuthenTec,Inc)
PRC - C:\WINDOWS\system32\TAMSvr.exe (AuthenTec Inc.)
PRC - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
PRC - C:\Program Files\Toshiba\TME3\TMERzCtl.exe (TOSHIBA)
PRC - C:\Program Files\Apoint2K\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe (TOSHIBA CORPORATION.)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe (TOSHIBA CORPORATION.)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
PRC - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe ()
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe (TOSHIBA CORPORATION.)
PRC - C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe (Intel® Corporation)
PRC - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
PRC - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe (TOSHIBA CORPORATION.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe (TOSHIBA CORPORATION.)
PRC - C:\WINDOWS\system32\ThpSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Realtek\RTL8187 Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)
PRC - C:\WINDOWS\system32\TODDSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\FolderSize\FolderSizeSvc.exe (Brio)
PRC - C:\Program Files\Toshiba\Wireless Hotkey\TosHKCW.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION)
PRC - C:\Program Files\RocketDock\RocketDock.exe ()
PRC - C:\WINDOWS\tsnp2std.exe ()
PRC - C:\Program Files\NetMeter\NetMeter.exe ()
PRC - C:\WINDOWS\vsnp2std.exe (Sonix)
PRC - C:\Program Files\Infineon\Security Platform Software\SpTNA.exe (Infineon Technologies AG)
PRC - C:\Program Files\Infineon\Security Platform Software\PSDrt.exe (Infineon Technologies AG)
PRC - C:\WINDOWS\system32\IfxPsdSv.exe (Infineon Technologies AG)
PRC - C:\WINDOWS\FixCamera.exe ()
PRC - C:\Program Files\Toshiba\TOSHIBA Direct Disc Writer\DDWMon.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Toshiba\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
PRC - C:\Program Files\CrossHair\CrossHair.exe ()
PRC - C:\TOSHIBA\IVP\ISM\pinger.exe ()
PRC - C:\TOSHIBA\IVP\ISM\Ivpsvmgr.exe (TOSHIBA Corporation)
PRC - C:\Program Files\MuralPix\MpAgent.exe (Learsy)
PRC - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe (TOSHIBA CORPORATION.)
PRC - C:\Program Files\Microsoft ActiveSync\wcescomm.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft ActiveSync\rapimgr.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\PSIService.exe ()
PRC - C:\WINDOWS\system32\00THotkey.exe (TOSHIBA Corporation)
PRC - C:\WINDOWS\system32\TFNF5.exe (TOSHIBA Corp.)
PRC - C:\Program Files\Toshiba\TME3\TMESRV31.exe (TOSHIBA)
PRC - C:\Program Files\Toshiba\TouchED\TouchED.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Toshiba\TME3\TMEEJME.exe (TOSHIBA)
PRC - C:\Program Files\Canon\MultiPASS4\mpservic.exe (Canon Inc)
PRC - C:\Program Files\yProxy\yProxy.exe (Brawny Lads Productions)
PRC - C:\Program Files\PerSono\PersTray.exe (Plantronics)
PRC - C:\WINDOWS\system32\FxRedir.exe (Canon Inc)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Henry\My Documents\INCOMING\FM BROWSER\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\ShortKeys2\shkhook.dll (Insight Software Solutions)
MOD - C:\Program Files\RocketDock\RocketDock.dll ()


========== Win32 Services (SafeList) ==========

SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
SRV - (aswUpdSv) – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (FingerprintServer) – C:\WINDOWS\system32\FpLogonServ.exe (AuthenTec,Inc)
SRV - (Authentec memory manager) – C:\WINDOWS\system32\TAMSvr.exe (AuthenTec Inc.)
SRV - (TNaviSrv) – C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
SRV - (TOSHIBA Bluetooth Service) – C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (Swupdtmr) – c:\TOSHIBA\IVP\swupdate\swupdtmr.exe ()
SRV - (EvtEng) – C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV - (S24EventMonitor) – C:\Program Files\Intel\WiFi\bin\S24EvMon.exe (Intel® Corporation)
SRV - (RegSrvc) – C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
SRV - (Thpsrv) – C:\WINDOWS\system32\ThpSrv.exe (TOSHIBA Corporation)
SRV - (TODDSrv) – C:\WINDOWS\system32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (FolderSize) – C:\Program Files\FolderSize\FolderSizeSvc.exe (Brio)
SRV - (PersonalSecureDriveService) – C:\WINDOWS\system32\IfxPsdSv.exe (Infineon Technologies AG)
SRV - (pinger) – C:\TOSHIBA\IVP\ISM\pinger.exe ()
SRV - (ProtexisLicensing) – C:\WINDOWS\system32\PSIService.exe ()
SRV - (Tmesrv) – C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe (TOSHIBA)
SRV - (CFSvcs) – C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (MpService) – C:\Program Files\Canon\MultiPASS4\mpservic.exe (Canon Inc)


========== Driver Services (SafeList) ==========

DRV - (epmntdrv) – C:\WINDOWS\system32\epmntdrv.sys ()
DRV - (EuGdiDrv) – C:\WINDOWS\system32\EuGdiDrv.sys ()
DRV - (aswTdi) – C:\WINDOWS\system32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\system32\drivers\aswRdr.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\system32\drivers\aavmker4.sys (ALWIL Software)
DRV - (aswMon2) – C:\WINDOWS\system32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswSP) – C:\WINDOWS\system32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (dvd43llh) – C:\WINDOWS\system32\drivers\dvd43llh.sys (RIF)
DRV - (pwdrvio) – C:\WINDOWS\system32\pwdrvio.sys ()
DRV - (pwdspio) – C:\WINDOWS\system32\pwdspio.sys ()
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (iaStor) – C:\WINDOWS\system32\drivers\iaStor.sys (Intel Corporation)
DRV - (snapman) – C:\WINDOWS\system32\DRIVERS\snapman.sys (Acronis)
DRV - (SCRCAMHRDRV) – C:\WINDOWS\system32\drivers\SCRCAMHRDRV.sys (Windows ® Server 2003 DDK provider)
DRV - (mcdbus) – C:\WINDOWS\system32\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (ialm) – C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation)
DRV - (hotcore3) – C:\WINDOWS\system32\drivers\hotcore3.sys (Paragon Software Group)
DRV - (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor) – C:\WINDOWS\system32\drivers\ATSwpDrv.sys (AuthenTec, Inc.)
DRV - (tos_sps32) – C:\WINDOWS\system32\DRIVERS\tos_sps32.sys (TOSHIBA Corporation)
DRV - (Ambfilt) – C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (TosRfSnd) – C:\WINDOWS\system32\drivers\TosRfSnd.sys (TOSHIBA Corporation)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (tosrfbd) – C:\WINDOWS\system32\drivers\tosrfbd.sys (TOSHIBA CORPORATION)
DRV - (Tosrfcom) – C:\WINDOWS\system32\drivers\tosrfcom.sys (TOSHIBA Corporation)
DRV - (UVCFTR) – C:\WINDOWS\system32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.)
DRV - (Thpdrv) – C:\WINDOWS\system32\DRIVERS\thpdrv.sys (TOSHIBA Corporation)
DRV - (Tosrfusb) – C:\WINDOWS\system32\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV - (RTLWUSB) – C:\WINDOWS\system32\drivers\rtl8187.sys (Realtek Semiconductor Corporation )
DRV - (e1yexpress) Intel® – C:\WINDOWS\system32\drivers\e1y5132.sys (Intel Corporation)
DRV - (NETw5x32) Intel® – C:\WINDOWS\system32\drivers\NETw5x32.sys (Intel Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (tosporte) – C:\WINDOWS\system32\drivers\tosporte.sys (TOSHIBA Corporation)
DRV - (s24trans) – C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (Tosrfhid) – C:\WINDOWS\system32\drivers\Tosrfhid.sys (TOSHIBA Corporation.)
DRV - (PalmUSBD) – C:\WINDOWS\system32\drivers\PalmUSBD.sys (PalmSource, Inc.)
DRV - (tosrfbnp) – C:\WINDOWS\system32\drivers\tosrfbnp.sys (TOSHIBA Corporation)
DRV - (SNP2STD) USB2.0 PC Camera (SNP2STD) – C:\WINDOWS\system32\drivers\snp2sxp.sys ()
DRV - (Thpevm) – C:\WINDOWS\system32\DRIVERS\Thpevm.SYS (TOSHIBA Corporation)
DRV - (PersonalSecureDrive) – C:\WINDOWS\System32\drivers\psd.sys (Infineon Technologies AG)
DRV - (IFXTPM) – C:\WINDOWS\system32\drivers\ifxtpm.sys (Infineon Technologies AG)
DRV - (BusRMUSB) – C:\WINDOWS\system32\drivers\BusRMUSB.sys (Windows ® Server 2003 DDK provider)
DRV - (tdudf) – C:\WINDOWS\system32\drivers\tdudf.sys (TOSHIBA Corporation)
DRV - (tdcmdpst) – C:\WINDOWS\system32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (TEchoCan) – C:\WINDOWS\system32\drivers\TEchoCan.sys (TOSHIBA Corporation)
DRV - (trudf) – C:\WINDOWS\system32\drivers\trudf.sys (TOSHIBA Corporation)
DRV - (TVALZ) – C:\WINDOWS\system32\DRIVERS\TVALZ.SYS (TOSHIBA Corporation)
DRV - (tosrfec) – C:\WINDOWS\system32\drivers\tosrfec.sys (TOSHIBA Corporation)
DRV - (Monfilt) – C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)
DRV - (toshidpt) – C:\WINDOWS\system32\drivers\Toshidpt.sys (TOSHIBA Corporation.)
DRV - (tosrfnds) – C:\WINDOWS\system32\drivers\tosrfnds.sys (TOSHIBA Corporation.)
DRV - (TMEI3E) – C:\WINDOWS\system32\drivers\TMEI3E.sys (Toshiba Corporation)
DRV - (RRamdisk) – C:\WINDOWS\system32\DRIVERS\rramdisk.sys (gavotte)
DRV - (Netdevio) – C:\WINDOWS\system32\drivers\Netdevio.sys (TOSHIBA Corporation.)
DRV - (cis1284) – C:\WINDOWS\system32\drivers\cis1284.sys (Canon)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;="
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/ig?hl=en&source;=iglk"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: {097d3191-e6fa-4728-9826-b533d755359d}:0.7.11
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:[removed]
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100211.5
FF - prefs.js..extensions.enabledItems: {1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}:0.4.4
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.66.0
FF - prefs.js..extensions.enabledItems: {AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.63
FF - prefs.js..extensions.enabledItems: [removed]:0.7.1
FF - prefs.js..extensions.enabledItems: [removed]:1.0.12
FF - prefs.js..extensions.enabledItems: [removed]:0.8.2009122501
FF - prefs.js..extensions.enabledItems: {a756d17a-5a4c-4417-813c-c8cd0151e486}:1.3.2
FF - prefs.js..extensions.enabledItems: {29852C08-1E91-4889-A6BF-C77F91D6A8F3}:1.8.58


FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/03/11 19:32:35 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/03/11 19:32:35 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.3\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010/03/11 09:50:25 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.3\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2009/12/08 17:28:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Mozilla\Extensions
[2009/12/08 17:28:53 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Henry\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010/03/13 20:56:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions
[2010/01/18 20:41:46 | 000,000,000 | —D | M] (All-in-One Sidebar) – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}
[2010/03/12 22:12:08 | 000,000,000 | —D | M] (FlashGot) – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2010/02/15 15:50:12 | 000,000,000 | —D | M] (Image Zoom) – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}
[2010/03/12 22:12:02 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\{29852C08-1E91-4889-A6BF-C77F91D6A8F3}
[2010/03/12 12:46:54 | 000,000,000 | —D | M] (Open Profile Folder) – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\{a756d17a-5a4c-4417-813c-c8cd0151e486}
[2010/02/15 15:50:12 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}
[2010/01/07 22:58:18 | 000,000,000 | —D | M] (Adblock Plus) – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/02/15 15:50:10 | 000,000,000 | —D | M] (Greasemonkey) – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010/03/12 22:12:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\[removed]
[2009/11/13 15:31:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\[removed]
[2009/08/31 13:30:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\[removed]
[2010/01/06 19:40:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Mozilla\Firefox\Profiles\hhv1yiej.default\extensions\[removed]
[2010/03/13 20:56:18 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/10/24 13:06:59 | 000,036,864 | —- | M] (Homestead Technologies, Inc.) – C:\Program Files\Mozilla Firefox\plugins\nphssb.dll
[2009/06/22 10:10:58 | 000,677,152 | —- | M] (Medical Informatics Engineering, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npzzatif.dll
[2009/07/31 06:19:37 | 000,002,400 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\seekservice110.xml

O1 HOSTS File: ([2010/03/13 09:58:57 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4A1C6093-14F9-44D7-860E-5D265CFCA9D9} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A58686ED-FC46-44C3-95C6-4A812AB776F1} - No CLSID value found.
O4 - HKLM..\Run: [000StTHK] C:\WINDOWS\System32\000StTHK.exe ()
O4 - HKLM..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe ()
O4 - HKLM..\Run: [dvd43] C:\Program Files\dvd43\DVD43_Tray.exe ()
O4 - HKLM..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe ()
O4 - HKLM..\Run: [fxredir] C:\WINDOWS\system32\FxRedir.exe (Canon Inc)
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe (Intel® Corporation)
O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION)
O4 - HKLM..\Run: [MuralPixAgent] C:\Program Files\MuralPix\MpAgent.exe (Learsy)
O4 - HKLM..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe ()
O4 - HKLM..\Run: [SmoothView] C:\Program Files\Toshiba\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe (Sonix)
O4 - HKLM..\Run: [TAudEffect] C:\Program Files\TOSHIBA\TAudEffect\TAudEff.exe (TOSHIBA)
O4 - HKLM..\Run: [TFNF5] C:\WINDOWS\System32\TFNF5.exe (TOSHIBA Corp.)
O4 - HKLM..\Run: [ThpSrv] C:\WINDOWS\System32\thpsrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TMERzCtl.EXE] C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE (TOSHIBA)
O4 - HKLM..\Run: [TMESRV.EXE] C:\Program Files\TOSHIBA\TME3\TMESRV31.EXE (TOSHIBA)
O4 - HKLM..\Run: [TOSDCR] C:\WINDOWS\System32\TOSDCR.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TosHKCW.exe] C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [TouchED] C:\Program Files\Toshiba\TouchED\TouchED.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe ()
O4 - HKCU..\Run: [C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe ()
O4 - HKCU..\Run: [CrossHair] C:\Program Files\CrossHair\CrossHair.exe ()
O4 - HKCU..\Run: [GoToMeeting] C:\Program Files\Citrix\GoToMeeting\452\g2mstart.exe (Citrix Online, a division of Citrix Systems, Inc.)
O4 - HKCU..\Run: [H/PC Connection Agent] C:\Program Files\Microsoft ActiveSync\Wcescomm.exe (Microsoft Corporation)
O4 - HKCU..\Run: [RocketDock] C:\Program Files\RocketDock\RocketDock.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk = C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MozyHome Status.lnk = C:\Program Files\MozyHome\mozystat.exe (Mozy, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Perstray.lnk = C:\Program Files\PerSono\PersTray.exe (Plantronics)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\REALTEK RTL8187 Wireless LAN Utility.lnk = C:\Program Files\Realtek\RTL8187 Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ShortKeys Lite.lnk = C:\Program Files\ShortKeys2\shklite.exe (Insight Software Solutions)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Start Killer.lnk = C:\Program Files\StartKiller\StartKiller.exe (Tordex)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\yProxy.lnk = C:\Program Files\yProxy\yProxy.exe (Brawny Lads Productions)
O4 - Startup: C:\Documents and Settings\Henry\Start Menu\Programs\Startup\AltEdge.exe (www.1HourSoftware.com)
O4 - Startup: C:\Documents and Settings\Henry\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Henry\Start Menu\Programs\Startup\Titlebar Date-Time.lnk = C:\Program Files\Titlebar Date-Time\TBDT.exe (Whispering Pines Software http://WhisperingPinesSoftware.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Easy-WebPrint Add To Print List - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint High Speed Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Preview - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: Microsoft XML Parser for Java file:///C:/WINDOWS/Java/classes/xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\ATFUS: DllName - C:\WINDOWS\system32\FpWinLogonNp.dll - C:\WINDOWS\system32\FpWinlogonNp.dll (AuthenTec,Inc)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\TosBtNP: DllName - TosBtNP.dll - C:\WINDOWS\System32\TosBtNP.dll (TOSHIBA CORPORATION)
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/09/17 15:56:14 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/03/13 16:52:02 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2010/03/13 11:51:14 | 000,000,000 | —D | C] – C:\Program Files\JMF2.1.1e
[2010/03/13 11:50:57 | 000,000,000 | —D | C] – C:\Documents and Settings\Henry\WINDOWS
[2010/03/13 11:47:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Henry\.SunDownloadManager
[2010/03/13 11:11:29 | 000,000,000 | —D | C] – C:\Documents and Settings\Henry\Application Data\Malwarebytes
[2010/03/13 11:11:24 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/03/13 11:11:22 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/03/13 11:11:21 | 000,019,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/03/13 11:11:20 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/03/13 11:08:05 | 005,115,824 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Henry\Desktop\mbam-setup.exe
[2010/03/13 10:02:14 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/03/13 09:34:12 | 000,000,000 | —D | C] – C:\ComboFix
[2010/03/13 06:14:30 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/03/13 06:13:39 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/03/13 06:13:39 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/03/13 06:13:39 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/03/13 06:13:39 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/03/13 06:13:31 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/03/13 06:13:12 | 000,000,000 | —D | C] – C:\Qoobox
[2010/03/10 17:50:51 | 003,558,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\moviemk.exe
[2010/01/14 12:43:40 | 001,928,244 | —- | C] (Freeware D.J.B. Osborne) – C:\Program Files\HeliosPaint.exe
[2009/12/21 12:50:52 | 000,151,552 | —- | C] ( ) – C:\WINDOWS\System32\rsnp2std.dll
[2009/12/21 12:50:52 | 000,077,824 | —- | C] ( ) – C:\WINDOWS\System32\csnp2std.dll
[2009/11/10 19:15:06 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2009/10/09 14:27:06 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[2009/04/10 06:24:57 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/02/21 06:37:48 | 000,069,632 | —- | C] (ATTO Technology Inc.) – C:\Program Files\bench32.exe
[2009/02/19 10:39:14 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2009/02/17 14:05:55 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Intel
[2009/02/17 14:05:55 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Intel
[2008/09/17 16:00:31 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2008/09/17 15:56:11 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2008/09/17 15:56:11 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft

========== Files - Modified Within 30 Days ==========

[2010/03/13 22:02:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/03/13 21:56:00 | 000,000,978 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1566897640-232253103-705547321-1005UA.job
[2010/03/13 21:02:00 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/03/13 14:39:22 | 000,000,036 | —- | M] () – C:\Documents and Settings\Henry\Local Settings\Application Data\housecall.guid.cache
[2010/03/13 14:13:16 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/03/13 14:11:47 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/03/13 14:11:19 | 000,000,312 | —- | M] () – C:\WINDOWS\tasks\GlaryInitialize.job
[2010/03/13 14:11:17 | 000,000,236 | —- | M] () – C:\WINDOWS\tasks\OGALogon.job
[2010/03/13 14:11:12 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/03/13 14:10:51 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/03/13 14:10:44 | 3079,852,032 | -HS- | M] () – C:\hiberfil.sys
[2010/03/13 14:09:51 | 009,961,472 | —- | M] () – C:\Documents and Settings\Henry\ntuser.dat
[2010/03/13 14:09:51 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Henry\ntuser.ini
[2010/03/13 12:16:45 | 000,000,313 | —- | M] () – C:\Documents and Settings\Henry\.JMAppsCfg
[2010/03/13 11:11:26 | 000,000,707 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/03/13 11:08:17 | 005,115,824 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Henry\Desktop\mbam-setup.exe
[2010/03/13 10:27:26 | 000,003,526 | —- | M] () – C:\WINDOWS\mozy.blk
[2010/03/13 10:27:26 | 000,000,372 | —- | M] () – C:\WINDOWS\mozy.flt
[2010/03/13 09:59:31 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/03/13 09:58:57 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/03/13 06:14:36 | 000,000,313 | RHS- | M] () – C:\boot.ini
[2010/03/13 06:12:25 | 000,451,584 | —- | M] () – C:\Documents and Settings\Henry\Desktop\CKScanner.exe
[2010/03/13 06:09:19 | 003,888,854 | R— | M] () – C:\Documents and Settings\Henry\Desktop\ComboFix.exe
[2010/03/13 00:15:19 | 000,123,923 | —- | M] () – C:\Documents and Settings\Henry\Desktop\MacDonald,_John_D._-_The_Girl,_The_Gold_Watch,_And_Everything_[rtf].rar
[2010/03/12 01:45:07 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/03/11 09:56:00 | 000,000,926 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1566897640-232253103-705547321-1005Core.job
[2010/03/08 11:19:26 | 000,002,626 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2010/03/08 03:00:50 | 000,001,355 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/02/18 14:36:00 | 003,731,456 | —- | M] () – C:\Documents and Settings\Henry\Desktop\LEM BUSINESS PLAN3.ppt
[2010/02/16 13:49:22 | 150,576,640 | —- | M] () – C:\SB2010_setup.msi
[2010/02/15 12:04:32 | 000,177,664 | —- | M] () – C:\Documents and Settings\Henry\My Documents\Itinerary SA cruise.doc
[2010/02/15 12:04:32 | 000,000,162 | -H– | M] () – C:\Documents and Settings\Henry\My Documents\~$inerary SA cruise.doc
[2010/02/12 10:30:55 | 000,022,528 | —- | M] () – C:\Documents and Settings\Henry\My Documents\Retired Officer Project agenda for conf dall.doc
[2010/02/12 09:22:41 | 000,000,815 | —- | M] () – C:\Documents and Settings\Henry\My Documents\ChatLog Retired Officers Project 2010_02_12 09_22.rtf

========== Files Created - No Company Name ==========

[2010/03/13 14:39:22 | 000,000,036 | —- | C] () – C:\Documents and Settings\Henry\Local Settings\Application Data\housecall.guid.cache
[2010/03/13 12:16:45 | 000,000,313 | —- | C] () – C:\Documents and Settings\Henry\.JMAppsCfg
[2010/03/13 11:51:16 | 000,413,696 | —- | C] () – C:\WINDOWS\System32\jsound.dll
[2010/03/13 11:51:16 | 000,380,928 | —- | C] () – C:\WINDOWS\System32\jmmpa.dll
[2010/03/13 11:51:16 | 000,282,624 | —- | C] () – C:\WINDOWS\System32\jmh261.dll
[2010/03/13 11:51:16 | 000,184,320 | —- | C] () – C:\WINDOWS\System32\jmvh263.dll
[2010/03/13 11:51:16 | 000,143,360 | —- | C] () – C:\WINDOWS\System32\jmjpeg.dll
[2010/03/13 11:51:16 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\jmh263enc.dll
[2010/03/13 11:51:16 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\jmg723.dll
[2010/03/13 11:51:16 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\jmmpegv.dll
[2010/03/13 11:51:16 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\jmutil.dll
[2010/03/13 11:51:16 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\jmgsm.dll
[2010/03/13 11:51:16 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\jmvfw.dll
[2010/03/13 11:51:16 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\jmvcm.dll
[2010/03/13 11:51:16 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\jmgdi.dll
[2010/03/13 11:51:16 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\jmmci.dll
[2010/03/13 11:51:15 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\jmam.dll
[2010/03/13 11:51:15 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\jmcvid.dll
[2010/03/13 11:51:15 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\jmacm.dll
[2010/03/13 11:51:15 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\jmdaud.dll
[2010/03/13 11:51:15 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\jmfjawt.dll
[2010/03/13 11:51:15 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\jmddraw.dll
[2010/03/13 11:51:15 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\jmdaudc.dll
[2010/03/13 11:11:26 | 000,000,707 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/03/13 06:14:36 | 000,000,244 | —- | C] () – C:\Boot.bak
[2010/03/13 06:14:32 | 000,260,272 | —- | C] () – C:\cmldr
[2010/03/13 06:13:39 | 000,261,632 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/03/13 06:13:39 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/03/13 06:13:39 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/03/13 06:13:39 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/03/13 06:13:39 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/03/13 06:12:25 | 000,451,584 | —- | C] () – C:\Documents and Settings\Henry\Desktop\CKScanner.exe
[2010/03/13 06:09:11 | 003,888,854 | R— | C] () – C:\Documents and Settings\Henry\Desktop\ComboFix.exe
[2010/03/13 00:15:18 | 000,123,923 | —- | C] () – C:\Documents and Settings\Henry\Desktop\MacDonald,_John_D._-_The_Girl,_The_Gold_Watch,_And_Everything_[rtf].rar
[2010/02/18 14:35:59 | 003,731,456 | —- | C] () – C:\Documents and Settings\Henry\Desktop\LEM BUSINESS PLAN3.ppt
[2010/02/17 08:55:41 | 150,576,640 | —- | C] () – C:\SB2010_setup.msi
[2010/02/15 12:04:32 | 000,000,162 | -H– | C] () – C:\Documents and Settings\Henry\My Documents\~$inerary SA cruise.doc
[2010/02/15 12:04:31 | 000,177,664 | —- | C] () – C:\Documents and Settings\Henry\My Documents\Itinerary SA cruise.doc
[2010/02/12 10:30:55 | 000,022,528 | —- | C] () – C:\Documents and Settings\Henry\My Documents\Retired Officer Project agenda for conf dall.doc
[2010/02/12 09:22:41 | 000,000,815 | —- | C] () – C:\Documents and Settings\Henry\My Documents\ChatLog Retired Officers Project 2010_02_12 09_22.rtf
[2010/02/05 05:47:32 | 000,014,848 | —- | C] () – C:\WINDOWS\System32\EuEpmGdi.dll
[2010/02/05 05:47:32 | 000,013,192 | —- | C] () – C:\WINDOWS\System32\epmntdrv.sys
[2010/02/05 05:47:32 | 000,008,456 | —- | C] () – C:\WINDOWS\System32\EuGdiDrv.sys
[2009/12/21 18:14:20 | 000,024,238 | —- | C] () – C:\Documents and Settings\Henry\Application Data\Comma Separated Values (Windows).ADR
[2009/12/21 12:50:59 | 000,025,472 | —- | C] () – C:\WINDOWS\System32\drivers\sncamd.sys
[2009/12/21 12:50:59 | 000,015,497 | —- | C] () – C:\WINDOWS\snp2std.ini
[2009/12/21 12:50:58 | 012,212,864 | —- | C] () – C:\WINDOWS\System32\drivers\snp2sxp.sys
[2009/11/28 08:50:45 | 000,112,640 | —- | C] () – C:\WINDOWS\System32\rrsec.dll
[2009/10/26 08:31:14 | 000,002,528 | —- | C] () – C:\Documents and Settings\Henry\Application Data\$_hpcst$.hpc
[2009/08/18 05:37:28 | 000,403,968 | —- | C] () – C:\Program Files\ToYcon.exe
[2009/08/16 07:27:26 | 000,016,456 | —- | C] () – C:\WINDOWS\System32\pwdrvio.sys
[2009/08/16 07:27:26 | 000,011,088 | —- | C] () – C:\WINDOWS\System32\pwdspio.sys
[2009/08/10 16:31:06 | 000,000,000 | —- | C] () – C:\WINDOWS\ToDisc.INI
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2009/07/31 06:19:29 | 000,237,568 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2009/07/20 05:51:15 | 000,015,620 | —- | C] () – C:\WINDOWS\System32\SystemRes13.sm.SYS
[2009/07/16 22:38:06 | 000,001,160 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2009/07/16 19:14:46 | 004,637,952 | —- | C] () – C:\Program Files\Common Files\lpuninstall.exe
[2009/07/11 11:07:43 | 000,000,058 | —- | C] () – C:\Documents and Settings\Henry\Local Settings\Application Data\DonationCoder_ScreenshotCaptor_InstallInfo.dat
[2009/07/08 15:30:01 | 000,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2009/07/07 21:10:01 | 000,007,680 | —- | C] () – C:\WINDOWS\System32\CNMVS6j.DLL
[2009/07/02 19:00:30 | 000,008,704 | —- | C] () – C:\WINDOWS\rmubcntl.dll
[2009/07/02 19:00:30 | 000,007,680 | —- | C] () – C:\WINDOWS\cvnet05.dll
[2009/07/02 19:00:30 | 000,000,090 | —- | C] () – C:\WINDOWS\PsLink.ini
[2009/07/02 18:36:13 | 000,010,831 | —- | C] () – C:\WINDOWS\System32\MpUPMon.dll
[2009/06/04 06:50:09 | 004,244,744 | —- | C] () – C:\WINDOWS\System32\qtp-mt334.dll
[2009/06/04 06:50:09 | 000,247,560 | —- | C] () – C:\WINDOWS\System32\prgiso.dll
[2009/06/04 06:50:09 | 000,013,576 | —- | C] () – C:\WINDOWS\System32\wnaspi32.dll
[2009/04/12 12:33:06 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v5016.dll
[2009/04/02 21:19:42 | 000,037,888 | —- | C] () – C:\WINDOWS\System32\setupnt.dll
[2009/03/30 06:25:56 | 000,323,248 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/03/06 08:46:37 | 000,000,097 | —- | C] () – C:\WINDOWS\WirelessFTP.INI
[2009/02/21 06:42:41 | 000,000,000 | —- | C] () – C:\WINDOWS\bench32.INI
[2009/02/19 15:05:44 | 000,007,680 | —- | C] () – C:\WINDOWS\System32\CNMVS61.DLL
[2009/02/18 22:57:47 | 000,000,449 | —- | C] () – C:\WINDOWS\MakeDocW.ini
[2009/02/18 22:57:47 | 000,000,000 | —- | C] () – C:\WINDOWS\MakeDocW.exe.INI
[2009/02/18 20:02:47 | 000,011,264 | —- | C] () – C:\Documents and Settings\Henry\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/02/18 10:57:15 | 000,000,000 | —- | C] () – C:\WINDOWS\tosOBEX.INI
[2009/02/18 09:23:53 | 000,000,098 | —- | C] () – C:\WINDOWS\Cm102.ini.cfl
[2009/02/17 17:45:20 | 000,087,552 | —- | C] () – C:\WINDOWS\System32\cpwmon2k.dll
[2009/02/17 14:13:36 | 000,000,014 | RHS- | C] () – C:\WINDOWS\System32\drivers\fbd.sys
[2009/02/17 14:09:12 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2009/02/17 14:01:55 | 000,000,000 | —- | C] () – C:\WINDOWS\NDSTray.INI
[2009/02/17 13:57:13 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4973.dll
[2009/02/17 13:47:36 | 000,000,004 | RHS- | C] () – C:\WINDOWS\System32\drivers\taishop.sys
[2008/09/17 15:51:58 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2008/09/17 15:38:55 | 000,000,339 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2008/09/17 15:35:03 | 001,288,192 | —- | C] () – C:\WINDOWS\System32\quartz(2).dll
[2007/12/21 15:46:32 | 000,118,784 | —- | C] () – C:\WINDOWS\System32\TosBtAcc.dll
[2005/07/22 20:30:18 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\TosCommAPI.dll

========== LOP Check ==========

[2009/07/02 18:36:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Canon
[2009/12/13 08:06:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Copernic
[2009/09/20 12:24:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Easy Flyer Creator
[2009/09/06 18:24:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GARMIN
[2009/02/19 14:40:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\HotSync
[2009/06/14 11:28:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Infineon
[2009/02/22 19:14:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Insight Software
[2009/02/22 19:14:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Insight Software Solutions
[2009/02/25 16:43:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Macrium
[2009/02/18 14:37:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sync App Settings
[2010/03/13 14:11:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/02/27 20:07:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TOSHIBA
[2009/02/17 19:31:59 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{A25FEDC1-F6D7-440C-BCE2-B71F595F6646}
[2009/08/18 05:39:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Apowersoft
[2009/11/29 17:48:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\calibre
[2010/01/31 14:47:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Copernic
[2009/07/11 11:07:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\DonationCoder
[2009/09/12 15:20:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\GARMIN
[2009/02/17 18:12:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\GlarySoft
[2009/05/23 17:04:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Gold Wave Editor Pro
[2010/01/27 18:57:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\GrabIt
[2009/02/19 14:40:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\HotSync
[2009/08/13 20:10:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\IcoFX
[2009/06/14 11:28:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Infineon
[2009/02/20 13:44:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\IObit
[2009/10/02 19:53:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\LockHunter
[2009/12/12 08:03:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\MailWasherPro
[2009/06/10 21:04:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\mjusbsp
[2009/03/06 15:44:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Mobipocket
[2009/11/22 13:26:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\MuralPix
[2010/01/31 19:26:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\OfficeRecovery
[2009/08/24 21:41:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Opera
[2009/04/04 06:51:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Participatory Culture Foundation
[2009/04/04 06:58:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\PCF-VLC
[2009/12/23 10:45:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Sprite Software
[2009/02/18 14:37:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Sync App Settings
[2009/12/08 17:28:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Thunderbird
[2009/03/03 11:56:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\toshiba
[2010/02/15 12:23:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\uTorrent
[2009/07/20 05:56:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\WikidPad
[2008/09/17 16:13:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\WinBatch
[2009/08/16 20:30:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Henry\Application Data\Windows Search
[2010/03/13 14:11:19 | 000,000,312 | —- | M] () – C:\WINDOWS\Tasks\GlaryInitialize.job
[2010/03/12 01:45:07 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2010/03/13 14:11:17 | 000,000,236 | —- | M] () – C:\WINDOWS\Tasks\OGALogon.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 196 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:284D1EE4
@Alternate Data Stream - 195 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C265C458
@Alternate Data Stream - 162 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DCE70D73
@Alternate Data Stream - 153 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:820563D3
< End of report >

—————————————————————————

Computer continues to be quick and stable.
No repetition of the original problem (redirect of Firefox+Google)
Looks like I had junk in there of which Avast! was unaware (buy NOD32?)