Intrusion: HTTPS Tidserv Request 2

It started one week ago. I saw a similar solved problem in the forums, but I am reluctant to follow that same procedure without professional help. My Norton "Intrusion Prevention" log just from today is listed below. Below my Norton log I have pasted my Hijackthis results. If someone could help me out I would be so greatful. Thank you,

David

Norton Log:

Intrusion: HTTPS Tidserv Request 2.
Intruder: [removed](https(443)).
Risk Level: High.
Protocol: TCP.
Attacked IP: DAVIDLAPTOP(192.168.0.4).
Attacked Port: 1481.
Intrusion detected and blocked. All communication with [removed] will be blocked for 30 minutes.
Intrusion detected and blocked. All communication with [removed] will be blocked for 30 minutes.
Intrusion: HTTP Tidserv Request.
Intruder: [removed](http(80)).
Risk Level: High.
Protocol: TCP.
Attacked IP: localhost.
Attacked Port: 1120.
Intrusion: HTTPS Tidserv Request 2.
Intruder: 19js810300z.com([removed])(https(443)).
Risk Level: High.
Protocol: TCP.
Attacked IP: DAVIDLAPTOP(192.168.0.4).
Attacked Port: 1054.
Intrusion detected and blocked. All communication with 19js810300z.com([removed]) will be blocked for 30 minutes.
Intrusion Prevention is monitoring 1053 signatures.
Intrusion Prevention Signature File Version: 20100707.001. Intrusion Prevention Engine Version: 4.6.0.26.
Intrusion Prevention has been enabled.
Intrusion: HTTPS Tidserv Request 2.
Intruder: [removed](https(443)).
Risk Level: High.
Protocol: TCP.
Attacked IP: DAVIDLAPTOP(192.168.0.4).
Attacked Port: 1605.
Intrusion detected and blocked. All communication with [removed] will be blocked for 30 minutes.
Intrusion: HTTP Tidserv Request.
Intruder: [removed](http(80)).
Risk Level: High.
Protocol: TCP.
Attacked IP: localhost.
Attacked Port: 1399.
Intrusion detected and blocked. All communication with [removed] will be blocked for 30 minutes.
Intrusion: HTTPS Tidserv Request 2.
Intruder: 19js810300z.com([removed])(https(443)).
Risk Level: High.
Protocol: TCP.
Attacked IP: DAVIDLAPTOP(192.168.0.4).
Attacked Port: 1076.
Intrusion detected and blocked. All communication with 19js810300z.com([removed]) will be blocked for 30 minutes.
Intrusion Prevention is monitoring 1053 signatures.
Intrusion Prevention Signature File Version: 20100707.001. Intrusion Prevention Engine Version: 4.6.0.26.
Intrusion Prevention has been enabled.
Intrusion detected and blocked. All communication with [removed] will be blocked for 30 minutes.
Intrusion: HTTP Tidserv Request.
Intruder: [removed](http(80)).
Risk Level: High.
Protocol: TCP.
Attacked IP: localhost.
Attacked Port: 4593.
Intrusion detected and blocked. All communication with [removed] will be blocked for 30 minutes.
Intrusion: HTTP Tidserv Request.
Intruder: [removed](http(80)).
Risk Level: High.
Protocol: TCP.
Attacked IP: localhost.
Attacked Port: 4303.
Intrusion detected and blocked. All communication with [removed] will be blocked for 30 minutes.
Intrusion: HTTP Tidserv Request.
Intruder: [removed](http(80)).
Risk Level: High.
Protocol: TCP.
Attacked IP: localhost.
Attacked Port: 4146.
Intrusion detected and blocked. All communication with [removed] will be blocked for 30 minutes.
Intrusion: HTTP Tidserv Request.
Intruder: [removed](http(80)).
Risk Level: High.
Protocol: TCP.
Attacked IP: localhost.
Attacked Port: 3751.
Intrusion: HTTPS Tidserv Request 2.
Intruder: [removed](https(443)).
Risk Level: High.
Protocol: TCP.
Attacked IP: DAVIDLAPTOP(192.168.0.4).
Attacked Port: 3442.
Intrusion detected and blocked. All communication with [removed] will be blocked for 30 minutes.
Intrusion detected and blocked. All communication with 19js810300z.com([removed]) will be blocked for 30 minutes.
Intrusion: HTTPS Tidserv Request 2.
Intruder: 19js810300z.com([removed])(https(443)).
Risk Level: High.
Protocol: TCP.
Attacked IP: DAVIDLAPTOP(192.168.0.4).
Attacked Port: 3058.
Intrusion: HTTP Tidserv Request.
Intruder: [removed](http(80)).
Risk Level: High.
Protocol: TCP.
Attacked IP: localhost.
Attacked Port: 3054.
Intrusion detected and blocked. All communication with [removed] will be blocked for 30 minutes.
Intrusion detected and blocked. All communication with [removed] will be blocked for 30 minutes.
Intrusion: HTTP Tidserv Request.
Intruder: [removed](http(80)).
Risk Level: High.
Protocol: TCP.
Attacked IP: localhost.
Attacked Port: 1547.
Intrusion detected and blocked. All communication with [removed] will be blocked for 30 minutes.
Intrusion: HTTPS Tidserv Request 2.
Intruder: [removed](https(443)).
Risk Level: High.
Protocol: TCP.
Attacked IP: DAVIDLAPTOP(192.168.0.4).
Attacked Port: 1242.
Intrusion detected and blocked. All communication with 19js810300z.com([removed]) will be blocked for 30 minutes.
Intrusion: HTTPS Tidserv Request 2.
Intruder: 19js810300z.com([removed])(https(443)).
Risk Level: High.
Protocol: TCP.
Attacked IP: DAVIDLAPTOP(192.168.0.4).
Attacked Port: 1081.
Intrusion Prevention is monitoring 1053 signatures.
Intrusion Prevention Signature File Version: 20100707.001. Intrusion Prevention Engine Version: 4.6.0.26.
Intrusion Prevention has been enabled.
Intrusion: HTTP Tidserv Request.
Intruder: [removed](http(80)).
Risk Level: High.
Protocol: TCP.
Attacked IP: localhost.
Attacked Port: 1059.
Intrusion detected and blocked. All communication with [removed] will be blocked for 30 minutes.
Intrusion: HTTPS Tidserv Request 2.
Intruder: 19js810300z.com([removed])(https(443)).
Risk Level: High.
Protocol: TCP.
Attacked IP: DAVIDLAPTOP(192.168.0.4).
Attacked Port: 1051.
Intrusion detected and blocked. All communication with 19js810300z.com([removed]) will be blocked for 30 minutes.
Intrusion Prevention is monitoring 1053 signatures.
Intrusion Prevention Signature File Version: 20100707.001. Intrusion Prevention Engine Version: 4.6.0.26.
Intrusion Prevention has been enabled.
Intrusion detected and blocked. All communication with 19js810300z.com([removed]) will be blocked for 30 minutes.
Intrusion: HTTPS Tidserv Request 2.
Intruder: 19js810300z.com([removed])(https(443)).
Risk Level: High.
Protocol: TCP.
Attacked IP: DAVIDLAPTOP(192.168.0.4).
Attacked Port: 1039.
Intrusion Prevention is monitoring 1050 signatures.
Intrusion Prevention Signature File Version: 20100630.002. Intrusion Prevention Engine Version: 4.6.0.26.
Intrusion Prevention has been enabled.
Intrusion detected and blocked. All communication with [removed] will be blocked for 30 minutes.
Intrusion: HTTP Tidserv Request.
Intruder: [removed](http(80)).
Risk Level: High.
Protocol: TCP.
Attacked IP: localhost.
Attacked Port: 2452.
Intrusion: HTTP Tidserv Request.
Intruder: [removed](http(80)).
Risk Level: High.
Protocol: TCP.
Attacked IP: localhost.
Attacked Port: 2228.
Intrusion detected and blocked. All communication with [removed] will be blocked for 30 minutes.
Intrusion: HTTPS Tidserv Request 2.
Intruder: [removed](https(443)).
Risk Level: High.
Protocol: TCP.
Attacked IP: 192.168.0.2.
Attacked Port: 2035.
Intrusion detected and blocked. All communication with [removed] will be blocked for 30 minutes.
Intrusion: HTTPS Tidserv Request 2.
Intruder: [removed](https(443)).
Risk Level: High.
Protocol: TCP.
Attacked IP: 192.168.0.2.
Attacked Port: 4185.
Intrusion detected and blocked. All communication with [removed] will be blocked for 30 minutes.
Intrusion: HTTP Tidserv Request.
Intruder: [removed](http(80)).
Risk Level: High.
Protocol: TCP.
Attacked IP: localhost.
Attacked Port: 1139.
Intrusion detected and blocked. All communication with [removed] will be blocked for 30 minutes.
Intrusion detected and blocked. All communication with [removed] will be blocked for 30 minutes.
Intrusion: HTTPS Tidserv Request 2.
Intruder: [removed](https(443)).
Risk Level: High.
Protocol: TCP.
Attacked IP: 192.168.0.2.
Attacked Port: 4360.


Hjackthis results:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:43:11 PM, on 7/8/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Vongo\VongoService.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Documents and Settings\User\Local Settings\Application Data\Autobahn\mlb-nexdef-autobahn.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\DAP\DAP.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\User\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/a/slugmail.ucsc.edu/…mp;ltmplcache=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf=laptop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Getsubtitle Toolbar - {96be2cf7-f71e-4efd-9a3b-3b44b598a420} - C:\Program Files\Getsubtitle\tbGet0.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Getsubtitle Toolbar - {96be2cf7-f71e-4efd-9a3b-3b44b598a420} - C:\Program Files\Getsubtitle\tbGet0.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Getsubtitle Toolbar - {96be2cf7-f71e-4efd-9a3b-3b44b598a420} - C:\Program Files\Getsubtitle\tbGet0.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [qyukrkvm] C:\Documents and Settings\User\Local Settings\Application Data\lwwqllrtk\qsqeanptssd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [cxyvhegr] C:\Documents and Settings\User\Local Settings\Application Data\wehwrqowo\wusyapatssd.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O4 - Startup: MLB.TV NexDef Plug-in.lnk = C:\Documents and Settings\User\Local Settings\Application Data\Autobahn\mlb-nexdef-autobahn.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O4 - Global Startup: Vongo Tray.lnk = ?
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: iOpus iMacros - {0483894E-2422-45E0-8384-021AFF1AF3CD} - C:\Program Files\iMacros\imacros.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q306&bd=pavilion&pf=laptop
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://site.ebrary.com.oca.ucsc.edu/lib/uc…s/ebraryRdr.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/files/w…ntrol_en_US.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://daveandceline.spaces.live.com//Phot…ad/MsnPUpld.cab
O16 - DPF: {4F29DE54-5EB7-4D76-B610-A86B5CD2A234} (GameTap Player) - http://archives.gametap.com/static/cab_hea…apWebPlayer.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…tDetection2.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.photofinale.com/ImageUploader3/ImageUploader3.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Vongo Service - Starz Entertainment Group LLC - C:\Program Files\Vongo\VongoService.exe

–
End of file - 18344 bytes

Hello JonTom,

thank you so much for your prompt reply! Below are my OTL results:

OTL logfile created on: 7/9/2010 2:07:54 PM - Run 1
OTL by OldTimer - Version 3.2.8.1 Folder = C:\Documents and Settings\User\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 423.00 Mb Available Physical Memory | 41.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 59.65 Gb Total Space | 4.57 Gb Free Space | 7.67% Space Free | Partition Type: NTFS
Drive D: | 13.86 Gb Total Space | 1.00 Gb Free Space | 7.20% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DAVIDLAPTOP
Current User Name: User
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/07/09 14:05:36 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
PRC - [2010/06/10 21:03:08 | 000,144,176 | —- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/03/04 15:08:20 | 000,099,720 | —- | M] (Symantec Corporation) – C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2009/11/06 13:19:06 | 000,323,392 | —- | M] (BitTorrent, Inc.) – C:\Program Files\DNA\btdna.exe
PRC - [2009/04/01 14:51:34 | 000,801,032 | —- | M] () – C:\Documents and Settings\User\Local Settings\Application Data\Autobahn\mlb-nexdef-autobahn.exe
PRC - [2008/11/29 13:02:34 | 003,061,248 | —- | M] (Speedbit Ltd.) – C:\Program Files\DAP\DAP.exe
PRC - [2008/04/13 17:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2008/03/04 10:28:08 | 001,251,720 | —- | M] () – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
PRC - [2008/02/11 17:22:14 | 000,191,848 | —- | M] (Symantec Corporation) – c:\Program Files\Common Files\Symantec Shared\CCEVTMGR.EXE
PRC - [2008/02/11 17:22:14 | 000,169,320 | —- | M] (Symantec Corporation) – c:\Program Files\Common Files\Symantec Shared\CCSETMGR.EXE
PRC - [2008/02/11 17:22:14 | 000,053,096 | —- | M] (Symantec Corporation) – C:\Program Files\Common Files\Symantec Shared\CCAPP.EXE
PRC - [2008/01/29 17:38:31 | 000,583,048 | —- | M] (Symantec Corporation) – C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
PRC - [2007/10/25 16:33:22 | 000,563,984 | —- | M] () – C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
PRC - [2007/10/19 13:19:22 | 000,141,848 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
PRC - [2007/10/19 13:17:28 | 000,186,904 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
PRC - [2007/10/01 15:50:08 | 000,214,408 | —- | M] (Symantec Corporation) – c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
PRC - [2007/09/13 18:49:48 | 000,202,088 | —- | M] (Symantec Corporation) – c:\Program Files\Common Files\Symantec Shared\CCPROXY.EXE
PRC - [2007/08/09 00:27:52 | 000,073,728 | —- | M] (HP) – C:\WINDOWS\system32\HPZipm12.exe
PRC - [2007/06/08 10:00:29 | 000,068,856 | —- | M] (Google Inc.) – C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2007/05/23 13:13:38 | 000,139,888 | —- | M] (Symantec Corporation) – c:\Program Files\Norton Internet Security\Norton AntiVirus\NAVAPSVC.EXE
PRC - [2007/03/29 11:59:42 | 000,176,128 | —- | M] (Starz Entertainment Group LLC) – C:\Program Files\Vongo\VongoService.exe
PRC - [2006/12/15 11:36:28 | 000,750,720 | —- | M] (Symantec Corporation) – C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
PRC - [2005/12/23 21:44:26 | 000,491,606 | —- | M] () – C:\Program Files\HPQ\Shared\HpqToaster.exe
PRC - [2005/11/03 19:06:22 | 001,160,848 | —- | M] (Symantec Corporation) – c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
PRC - [2005/09/24 09:42:32 | 000,475,136 | —- | M] (Hewlett-Packard Development Company, L.P.) – C:\Program Files\Hp\Digital Imaging\bin\hpqimzone.exe
PRC - [2005/09/18 19:40:42 | 001,421,824 | —- | M] (Methlabs) – C:\Program Files\PeerGuardian2\pg2.exe
PRC - [2005/08/11 16:30:30 | 000,081,920 | —- | M] (Macrovision Corporation) – C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe


========== Modules (SafeList) ==========

MOD - [2010/07/09 14:05:36 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
MOD - [2010/03/04 15:01:09 | 000,503,808 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\MSVCP71.DLL
MOD - [2010/03/04 15:01:09 | 000,348,160 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\MSVCR71.DLL
MOD - [2008/04/13 17:10:20 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msscript.ocx
MOD - [2008/02/11 17:22:14 | 000,379,240 | —- | M] (Symantec Corporation) – c:\Program Files\Common Files\Symantec Shared\CCL40.DLL
MOD - [2007/10/19 13:19:10 | 000,109,080 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcInj.dll
MOD - [2005/09/24 01:38:24 | 000,123,488 | —- | M] (Symantec Corporation) – C:\Program Files\Common Files\Symantec Shared\AntiSpam\asOEHook.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/06/10 21:03:08 | 000,144,176 | —- | M] (Apple Inc.) [Auto | Running] – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe – (Apple Mobile Device)
SRV - [2010/03/04 15:08:20 | 002,106,760 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE – (LiveUpdate)
SRV - [2010/03/04 15:08:20 | 000,099,720 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe – (Automatic LiveUpdate Scheduler)
SRV - [2008/03/04 10:28:08 | 001,251,720 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe – (Symantec Core LC)
SRV - [2008/02/11 17:22:14 | 000,191,848 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe – (ccEvtMgr)
SRV - [2008/02/11 17:22:14 | 000,169,320 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe – (ccSetMgr)
SRV - [2008/01/29 17:38:31 | 000,583,048 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe – (LiveUpdate Notice Service)
SRV - [2007/10/19 13:21:16 | 000,141,848 | —- | M] (Logitech Inc.) [Auto | Stopped] – C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe – (LVSrvLauncher)
SRV - [2007/10/19 13:19:22 | 000,141,848 | —- | M] (Logitech Inc.) [Auto | Running] – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe – (LVPrcSrv)
SRV - [2007/10/19 13:17:28 | 000,186,904 | —- | M] (Logitech Inc.) [Auto | Running] – C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe – (LVCOMSer)
SRV - [2007/10/01 15:50:08 | 000,214,408 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe – (SNDSrvc)
SRV - [2007/09/13 18:49:48 | 000,202,088 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Common Files\Symantec Shared\ccProxy.exe – (ccProxy)
SRV - [2007/08/09 00:27:52 | 000,073,728 | —- | M] (HP) [Auto | Running] – C:\WINDOWS\system32\HPZipm12.exe – (Pml Driver HPZ12)
SRV - [2007/05/23 13:13:38 | 000,139,888 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe – (navapsvc)
SRV - [2007/03/29 11:59:42 | 000,176,128 | —- | M] (Starz Entertainment Group LLC) [Auto | Running] – C:\Program Files\Vongo\VongoService.exe – (Vongo Service)
SRV - [2007/01/16 11:52:26 | 000,072,328 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – c:\Program Files\Norton Internet Security\ccPwdSvc.exe – (ccISPwdSvc)
SRV - [2007/01/16 09:25:28 | 000,045,696 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – c:\Program Files\Norton Internet Security\comHost.exe – (comHost)
SRV - [2006/12/15 11:36:28 | 000,750,720 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE – (NSCService)
SRV - [2005/11/03 19:06:22 | 001,160,848 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe – (SPBBCSvc)
SRV - [2005/08/26 21:22:48 | 000,198,368 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe – (SAVScan)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\DRIVERS\USBKey.sys – (USBDongle)
DRV - [2010/06/23 12:37:11 | 000,264,568 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20100707.001\SymIDSCo.sys – (SYMIDSCO)
DRV - [2010/05/27 01:00:00 | 000,371,248 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys – (eeCtrl)
DRV - [2010/05/27 01:00:00 | 000,102,448 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys – (EraserUtilRebootDrv)
DRV - [2010/05/11 01:00:00 | 001,347,504 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100709.002\NAVEX15.SYS – (NAVEX15)
DRV - [2010/05/11 01:00:00 | 000,085,552 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100709.002\NAVENG.SYS – (NAVENG)
DRV - [2009/03/27 01:16:28 | 000,012,672 | —- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\cpuz132_x32.sys – (cpuz132)
DRV - [2009/01/05 22:19:44 | 000,124,464 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SYMEVENT.SYS – (SymEvent)
DRV - [2008/05/08 07:02:52 | 000,203,136 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\rmcast.sys – (RMCAST)
DRV - [2008/04/13 11:45:12 | 000,060,032 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\usbaudio.sys – (usbaudio) USB Audio Driver (WDM)
DRV - [2008/04/13 11:39:44 | 000,092,544 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\mqac.sys – (MQAC)
DRV - [2008/04/13 11:36:39 | 000,043,008 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\amdagp.sys – (amdagp)
DRV - [2008/04/13 11:36:39 | 000,040,960 | —- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\sisagp.sys – (sisagp)
DRV - [2008/04/13 09:36:05 | 000,144,384 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\hdaudbus.sys – (HDAudBus)
DRV - [2007/10/19 13:16:30 | 002,109,976 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Lvckap.sys – (LVcKap)
DRV - [2007/10/11 18:59:24 | 000,025,624 | —- | M] () [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LVPr2Mon.sys – (LVPr2Mon)
DRV - [2007/10/11 18:59:02 | 002,142,488 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LVMVdrv.sys – (LVMVDrv)
DRV - [2007/10/01 15:49:26 | 000,189,320 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\SYMTDI.SYS – (SYMTDI)
DRV - [2007/10/01 15:49:20 | 000,023,944 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\SYMREDRV.SYS – (SYMREDRV)
DRV - [2007/10/01 15:49:16 | 000,031,624 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\SYMIDS.SYS – (SYMIDS)
DRV - [2007/10/01 15:49:10 | 000,028,040 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\SYMNDIS.SYS – (SYMNDIS)
DRV - [2007/10/01 15:49:04 | 000,098,184 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\SYMFW.SYS – (SYMFW)
DRV - [2007/10/01 15:48:56 | 000,012,680 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\SYMDNS.SYS – (SYMDNS)
DRV - [2007/05/06 09:13:19 | 000,008,413 | —- | M] (RealNetworks, Inc.) [Kernel | Auto | Running] – C:\WINDOWS\System32\drivers\mcstrm.sys – (MCSTRM)
DRV - [2007/03/06 17:54:40 | 000,041,376 | —- | M] (Labtec Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LVUSBSta.sys – (LVUSBSta)
DRV - [2007/03/06 17:48:46 | 001,273,504 | —- | M] (Labtec Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LV302V32.SYS – (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2007/03/06 17:48:46 | 000,014,240 | —- | M] (Labtec Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\lv302af.sys – (pepifilter)
DRV - [2006/10/06 12:49:44 | 000,010,344 | —- | M] (Symantec Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\symlcbrd.sys – (symlcbrd)
DRV - [2006/09/24 06:28:46 | 000,005,248 | —- | M] (Windows ® 2000 DDK provider) [Kernel | Boot | Running] – C:\WINDOWS\system32\speedfan.sys – (speedfan)
DRV - [2006/06/02 22:02:36 | 000,572,928 | —- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\CHDAud.sys – (HdAudAddService)
DRV - [2006/04/15 15:26:00 | 003,658,528 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nv4_mini.sys – (nv)
DRV - [2006/03/14 11:02:54 | 001,428,480 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\w39n51.sys – (w39n51) Intel®
DRV - [2006/03/03 22:31:48 | 000,192,736 | —- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SynTP.sys – (SynTP)
DRV - [2005/11/03 19:06:22 | 000,389,776 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys – (SPBBCDrv)
DRV - [2005/11/03 07:40:07 | 000,063,488 | —- | M] (Protection Technology) [Kernel | Boot | Running] – C:\WINDOWS\System32\drivers\sfvfs02.sys – (sfvfs02) StarForce Protection VFS Driver (version 2.x)
DRV - [2005/10/13 02:07:12 | 000,874,240 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\iaStor.sys – (iaStor)
DRV - [2005/09/20 03:30:56 | 000,162,432 | —- | M] (Texas Instruments) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tifm21.sys – (tifm21)
DRV - [2005/09/19 13:24:20 | 000,005,760 | —- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\EabUsb.sys – (eabusb)
DRV - [2005/09/19 13:24:10 | 000,009,344 | —- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\CPQBttn.sys – (HBtnKey)
DRV - [2005/09/19 13:23:52 | 000,007,808 | —- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\eabfiltr.sys – (eabfiltr)
DRV - [2005/09/18 19:02:52 | 000,005,632 | —- | M] () [Kernel | On_Demand | Running] – C:\Program Files\PeerGuardian2\pgfilter.sys – (pgfilter)
DRV - [2005/08/26 21:22:50 | 000,053,896 | —- | M] (Symantec Corporation) [Kernel | System | Running] – c:\Program Files\Norton Internet Security\Norton AntiVirus\Savrtpel.sys – (SAVRTPEL)
DRV - [2005/08/26 21:22:48 | 000,334,984 | —- | M] (Symantec Corporation) [Kernel | System | Running] – c:\Program Files\Norton Internet Security\Norton AntiVirus\savrt.sys – (SAVRT)
DRV - [2005/08/22 08:07:00 | 001,035,008 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_DPV.sys – (HSF_DPV)
DRV - [2005/08/22 08:06:16 | 000,201,600 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSFHWAZL.sys – (HSFHWAZL)
DRV - [2005/08/22 08:06:10 | 000,718,464 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_CNXT.sys – (winachsf)
DRV - [2005/08/10 05:44:04 | 000,050,688 | —- | M] (Protection Technology) [Kernel | Boot | Running] – C:\WINDOWS\System32\drivers\sfdrv01.sys – (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2005/05/16 06:20:39 | 000,006,656 | —- | M] (Protection Technology) [Kernel | Boot | Running] – C:\WINDOWS\System32\drivers\sfhlp02.sys – (sfhlp02) StarForce Protection Helper Driver (version 2.x)
DRV - [2004/08/03 23:31:34 | 000,020,992 | —- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\RTL8139.sys – (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2001/08/17 23:07:44 | 000,019,072 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\sparrow.sys – (Sparrow)
DRV - [2001/08/17 23:07:42 | 000,030,688 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\sym_u3.sys – (sym_u3)
DRV - [2001/08/17 23:07:40 | 000,028,384 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\sym_hi.sys – (sym_hi)
DRV - [2001/08/17 23:07:36 | 000,032,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\symc8xx.sys – (symc8xx)
DRV - [2001/08/17 23:07:34 | 000,016,256 | —- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\symc810.sys – (symc810)
DRV - [2001/08/17 22:52:22 | 000,036,736 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\ultra.sys – (ultra)
DRV - [2001/08/17 22:52:20 | 000,045,312 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\ql12160.sys – (ql12160)
DRV - [2001/08/17 22:52:20 | 000,040,320 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\ql1080.sys – (ql1080)
DRV - [2001/08/17 22:52:18 | 000,049,024 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\ql1280.sys – (ql1280)
DRV - [2001/08/17 22:52:16 | 000,179,584 | —- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys – (dac2w2k)
DRV - [2001/08/17 22:52:12 | 000,017,280 | —- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\mraid35x.sys – (mraid35x)
DRV - [2001/08/17 22:52:00 | 000,026,496 | —- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\asc.sys – (asc)
DRV - [2001/08/17 22:51:58 | 000,014,848 | —- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\asc3550.sys – (asc3550)
DRV - [2001/08/17 22:51:56 | 000,005,248 | —- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\aliide.sys – (AliIde)
DRV - [2001/08/17 22:51:54 | 000,006,656 | —- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\cmdide.sys – (CmdIde)
DRV - [2000/03/22 20:42:24 | 000,044,192 | —- | M] (PC-Doctor Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\drivers\PcdrNt.sys – (PcdrNt)
DRV - [1996/04/03 12:33:26 | 000,005,248 | —- | M] () [Kernel | Boot | Running] – C:\WINDOWS\system32\giveio.sys – (giveio)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/a/slugmail.ucsc.edu/…mp;ltmplcache=2
IE - HKCU\..\URLSearchHook: {96be2cf7-f71e-4efd-9a3b-3b44b598a420} - C:\Program Files\Getsubtitle\tbGet0.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "https://cruzmail.ucsc.edu/"
FF - prefs.js..extensions.enabledItems: [removed]:3.5.0.145
FF - prefs.js..extensions.enabledItems: {F17C1572-C9EC-4e5c-A542-D05CBB5C5A08}:[removed]
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..extensions.enabledItems: {99a0337c-6303-4879-b72e-500fd9aaca8c}:1.0.8
FF - prefs.js..extensions.enabledItems: [removed]:2.0.3

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/05/08 14:10:27 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/07 09:53:25 | 000,000,000 | —D | M]

[2009/01/31 22:21:43 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Mozilla\Extensions
[2010/06/30 21:40:20 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\b9dri3uz.default\extensions
[2010/05/08 14:09:22 | 000,000,000 | —D | M] (Greasemonkey) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\b9dri3uz.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010/06/12 20:44:24 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\b9dri3uz.default\extensions\[removed]
[2010/05/08 14:09:25 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\b9dri3uz.default\extensions\[removed]
[2010/06/30 21:40:20 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/07/10 01:08:46 | 000,000,000 | —D | M] (TextAloud Firefox Plugin) – C:\Program Files\Mozilla Firefox\extensions\{99a0337c-6303-4879-b72e-500fd9aaca8c}
[2008/09/03 17:11:24 | 000,054,600 | —- | M] (BitTorrent, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll

O1 HOSTS File: ([2005/11/03 23:54:06 | 000,000,731 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Getsubtitle Toolbar) - {96be2cf7-f71e-4efd-9a3b-3b44b598a420} - C:\Program Files\Getsubtitle\tbGet0.dll (Conduit Ltd.)
O2 - BHO: (CNavExtBho Class) - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NAVSHEXT.DLL (Symantec Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Getsubtitle Toolbar) - {96be2cf7-f71e-4efd-9a3b-3b44b598a420} - C:\Program Files\Getsubtitle\tbGet0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Norton AntiVirus) - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NAVSHEXT.DLL (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Getsubtitle Toolbar) - {96BE2CF7-F71E-4EFD-9A3B-3B44B598A420} - C:\Program Files\Getsubtitle\tbGet0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton AntiVirus) - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NAVSHEXT.DLL (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ccApp] c:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\Cpqset.exe ()
O4 - HKLM..\Run: [cxyvhegr] C:\Documents and Settings\User\Local Settings\Application Data\wehwrqowo\wusyapatssd.exe File not found
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\CHDAudPropShortcut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe File not found
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
O4 - HKLM..\Run: [MsmqIntCert] C:\WINDOWS\System32\mqrt.dll (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [qyukrkvm] C:\Documents and Settings\User\Local Settings\Application Data\lwwqllrtk\qsqeanptssd.exe File not found
O4 - HKLM..\Run: [RecGuard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - HKCU..\Run: [BitTorrent DNA] C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [DW4] File not found
O4 - HKCU..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe (IGN Entertainment)
O4 - HKCU..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe (Methlabs)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\StartUp\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\StartUp\HP Photosmart Premier Fast Start.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Development Company, L.P.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\StartUp\Vongo Tray.lnk = C:\WINDOWS\Installer\{8C3AE2D1-854D-4650-A73D-C7CC7EE36B80}\NewShortcut2_DB7E00C96DEF489A8112D8F81614F45A.exe File not found
O4 - Startup: C:\Documents and Settings\User\Start Menu\Programs\StartUp\MLB.TV NexDef Plug-in.lnk = C:\Documents and Settings\User\Local Settings\Application Data\Autobahn\mlb-nexdef-autobahn.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm ()
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm ()
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm ()
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll (Google Inc.)
O9 - Extra Button: iOpus iMacros - {0483894E-2422-45E0-8384-021AFF1AF3CD} - C:\Program Files\iMacros\imacros.dll File not found
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra Button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe File not found
O9 - Extra 'Tools' menuitem : PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} http://site.ebrary.com.oca.ucsc.edu/lib/uc…s/ebraryRdr.cab (Infotl Control)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {0DB074F0-617E-4EE9-912C-2965CF2AA5A4} http://download.microsoft.com/download/7/0…tualEarth3D.cab (Reg Error: Key error.)
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} http://www.lizardtech.com/download/files/w…ntrol_en_US.cab (DjVuCtl Class)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab (CDownloadCtrl Object)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www2.snapfish.com/SnapfishActivia.cab (Snapfish Activia)
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe (Reg Error: Key error.)
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab (SysData Class)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://daveandceline.spaces.live.com//Phot…ad/MsnPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {4F29DE54-5EB7-4D76-B610-A86B5CD2A234} http://archives.gametap.com/static/cab_hea…apWebPlayer.cab (GameTap Player)
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} http://www.systemrequirementslab.com/sysreqlab2.cab (System Requirements Lab Class)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/inst…tDetection2.cab (GMNRev Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} http://www.photofinale.com/ImageUploader3/ImageUploader3.cab (Aurigma Image Uploader 3.5 Control)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flash…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O24 - Desktop BackupWallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/07/27 22:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2004/04/30 14:01:14 | 000,000,053 | -HS- | M] () - D:\Autorun.inf – [ FAT32 ]
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun - "" = Auto&Play
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (70663829905735680)

========== Files/Folders - Created Within 30 Days ==========

[2010/07/09 14:05:35 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
[2010/07/08 20:41:35 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\User\Desktop\HiJackThis.exe
[2010/07/08 20:16:11 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Malwarebytes
[2010/07/08 20:16:01 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/07/08 20:15:58 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/07/08 20:15:58 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/07/08 20:15:57 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/08 20:14:58 | 006,153,352 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\User\Desktop\mbam-setup-1.46.exe
[2010/07/08 19:30:43 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2010/07/08 19:30:37 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun
[2010/07/08 14:00:48 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\HpUpdate
[2010/07/08 13:26:25 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/07/08 12:36:02 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/07/08 09:34:41 | 000,000,000 | RH-D | C] – C:\Documents and Settings\User\Recent
[2010/07/07 14:13:48 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\wehwrqowo
[2010/07/04 12:09:10 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/07/04 12:09:10 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/07/02 11:15:28 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Pimsleur Spanish I, II, III, & Plus (Complete Course) - Downsampled
[2010/07/02 11:13:50 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Learn Japanese (Pimsleur) (3rd Edition) (4 Audio CDs - MP3)
[2010/07/02 10:56:42 | 000,224,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tabctl32.ocx
[2010/07/02 10:56:42 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\iOpus-i-M
[2010/07/02 10:56:41 | 000,241,016 | —- | C] (iOpus Software GmbH) – C:\WINDOWS\System32\imatl.dll
[2010/07/02 10:56:40 | 000,000,000 | —D | C] – C:\Program Files\iMacros
[2010/06/27 08:16:03 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\lwwqllrtk
[2010/06/24 09:46:19 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\California History
[2010/06/20 11:31:11 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/06/20 11:24:55 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2010/06/17 12:20:11 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\CSUS Spec. Coll
[2010/06/15 08:08:55 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\SF Library Archives
[2010/06/15 08:08:55 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Lowell High School
[2010/06/15 08:08:54 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\secondarys of interest for dissertation
[2010/06/15 08:08:54 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Hoover Institution PDFs
[2010/06/15 08:08:54 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\history reading
[2010/06/15 08:08:53 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Japan info for Dissertation
[2010/06/15 07:38:09 | 000,000,000 | R–D | C] – C:\Documents and Settings\User\Desktop\My Dropbox
[2010/06/15 07:35:30 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Dropbox
[2010/06/10 10:07:56 | 000,743,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll
[3 C:\Documents and Settings\User\Desktop\*.tmp files -> C:\Documents and Settings\User\Desktop\*.tmp -> ]
[22 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\User\My Documents\*.tmp files -> C:\Documents and Settings\User\My Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/07/09 14:05:36 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
[2010/07/09 13:50:43 | 000,001,073 | —- | M] () – C:\hpqp.ini
[2010/07/09 13:50:12 | 000,000,039 | —- | M] () – C:\XP_TV.ini
[2010/07/09 13:50:04 | 000,050,868 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2010/07/09 13:49:02 | 000,000,878 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/09 13:48:58 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/09 13:48:36 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/09 09:36:00 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/09 00:46:51 | 000,000,420 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{D183E32C-161B-4143-B951-9386A1095E28}.job
[2010/07/09 00:01:00 | 000,000,232 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010/07/08 20:41:39 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\User\Desktop\HiJackThis.exe
[2010/07/08 20:17:05 | 007,077,888 | -H– | M] () – C:\Documents and Settings\User\NTUSER.DAT
[2010/07/08 20:16:04 | 000,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/08 20:15:04 | 006,153,352 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\User\Desktop\mbam-setup-1.46.exe
[2010/07/08 19:30:36 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/07/08 15:45:22 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\User\ntuser.ini
[2010/07/08 14:02:11 | 000,000,765 | —- | M] () – C:\WINDOWS\win.ini
[2010/07/08 14:02:11 | 000,000,252 | —- | M] () – C:\WINDOWS\system.ini
[2010/07/08 14:02:11 | 000,000,209 | RHS- | M] () – C:\boot.ini
[2010/07/08 13:26:05 | 001,578,136 | -H– | M] () – C:\Documents and Settings\User\Local Settings\Application Data\IconCache.db
[2010/07/08 13:11:55 | 000,027,136 | —- | M] () – C:\Documents and Settings\User\Desktop\email for ca history student.doc
[2010/07/08 12:55:05 | 000,042,885 | —- | M] () – C:\Documents and Settings\User\Desktop\Notes for student - California History Guest Lecture.pdf
[2010/07/08 12:54:28 | 000,053,248 | —- | M] () – C:\Documents and Settings\User\Desktop\Notes for student - California History Guest Lecture.doc
[2010/07/07 09:53:26 | 000,001,729 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/07/06 23:01:48 | 000,146,432 | —- | M] () – C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/06 00:22:03 | 000,055,296 | —- | M] () – C:\Documents and Settings\User\Desktop\California History Guest Lecture.doc
[2010/07/03 09:23:57 | 000,023,733 | —- | M] () – C:\Documents and Settings\User\Desktop\eliza's prog era CALecture4.docx
[2010/07/02 09:54:39 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/06/30 22:03:54 | 000,060,928 | —- | M] () – C:\Documents and Settings\User\Desktop\hospice time sheet.doc
[2010/06/26 08:10:27 | 000,000,837 | —- | M] () – C:\Documents and Settings\User\Desktop\Internet Explorer.lnk
[2010/06/23 00:07:15 | 000,064,168 | -H– | M] () – C:\WINDOWS\System32\mlfcache.dat
[2010/06/20 22:00:35 | 000,000,020 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
[2010/06/20 22:00:35 | 000,000,020 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\PKP_DLds.DAT
[2010/06/19 15:02:24 | 001,901,453 | —- | M] () – C:\Documents and Settings\User\Desktop\The_white_peril_in_the_Far_East.pdf
[2010/06/17 15:28:43 | 010,238,893 | —- | M] () – C:\Documents and Settings\User\Desktop\The_American_Japanese_problem_2.pdf
[2010/06/17 15:00:00 | 002,265,858 | —- | M] () – C:\Documents and Settings\User\Desktop\Should_Congress_enact_special_laws_affec.pdf
[2010/06/17 13:08:19 | 000,148,597 | —- | M] () – C:\Documents and Settings\User\Desktop\in school deferment form.pdf
[2010/06/15 13:52:14 | 000,060,978 | —- | M] () – C:\Documents and Settings\User\Desktop\for parents IHR Dissertation Fellowship Proposal.xml
[2010/06/13 20:51:52 | 000,493,364 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/13 20:51:52 | 000,420,520 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/13 20:51:52 | 000,067,732 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/06/10 10:50:40 | 000,286,904 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/10 10:03:02 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/06/10 09:03:24 | 000,022,528 | —- | M] () – C:\Documents and Settings\User\Desktop\COUPONS.doc
[2010/06/09 15:31:19 | 000,075,798 | —- | M] () – C:\Documents and Settings\User\Desktop\celine-fua_almaden-valley-athletic-club-san-jose.pdf
[3 C:\Documents and Settings\User\Desktop\*.tmp files -> C:\Documents and Settings\User\Desktop\*.tmp -> ]
[22 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\User\My Documents\*.tmp files -> C:\Documents and Settings\User\My Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/08 20:16:04 | 000,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/08 13:49:48 | 000,001,757 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
[2010/07/08 13:49:48 | 000,001,648 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NkbMonitor.exe.lnk
[2010/07/08 13:49:48 | 000,000,798 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
[2010/07/08 13:49:47 | 000,001,876 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Vongo Tray.lnk
[2010/07/08 13:49:47 | 000,001,121 | —- | C] () – C:\Documents and Settings\User\Start Menu\Programs\StartUp\MLB.TV NexDef Plug-in.lnk
[2010/07/08 13:11:55 | 000,027,136 | —- | C] () – C:\Documents and Settings\User\Desktop\email for ca history student.doc
[2010/07/08 12:54:54 | 000,042,885 | —- | C] () – C:\Documents and Settings\User\Desktop\Notes for student - California History Guest Lecture.pdf
[2010/07/08 12:54:28 | 000,053,248 | —- | C] () – C:\Documents and Settings\User\Desktop\Notes for student - California History Guest Lecture.doc
[2010/07/03 09:24:11 | 000,023,733 | —- | C] () – C:\Documents and Settings\User\Desktop\eliza's prog era CALecture4.docx
[2010/07/01 07:10:17 | 000,055,296 | —- | C] () – C:\Documents and Settings\User\Desktop\California History Guest Lecture.doc
[2010/06/30 22:03:53 | 000,060,928 | —- | C] () – C:\Documents and Settings\User\Desktop\hospice time sheet.doc
[2010/06/20 11:32:00 | 000,002,137 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/06/19 15:02:21 | 001,901,453 | —- | C] () – C:\Documents and Settings\User\Desktop\The_white_peril_in_the_Far_East.pdf
[2010/06/19 14:49:18 | 010,238,893 | —- | C] () – C:\Documents and Settings\User\Desktop\The_American_Japanese_problem_2.pdf
[2010/06/17 14:59:03 | 002,265,858 | —- | C] () – C:\Documents and Settings\User\Desktop\Should_Congress_enact_special_laws_affec.pdf
[2010/06/17 13:08:19 | 000,148,597 | —- | C] () – C:\Documents and Settings\User\Desktop\in school deferment form.pdf
[2010/06/15 13:52:13 | 000,060,978 | —- | C] () – C:\Documents and Settings\User\Desktop\for parents IHR Dissertation Fellowship Proposal.xml
[2010/06/15 08:13:29 | 000,167,793 | —- | C] () – C:\Documents and Settings\User\Desktop\foucault Discipline_and_Publish_ch3.pdf
[2010/06/15 07:43:41 | 008,373,134 | —- | C] () – C:\Documents and Settings\User\Desktop\Kubo p.187 on int. of J. The Pedagogical seminary, GSHall's Journal.pdf
[2010/06/10 09:03:23 | 000,022,528 | —- | C] () – C:\Documents and Settings\User\Desktop\COUPONS.doc
[2010/06/09 15:31:16 | 000,075,798 | —- | C] () – C:\Documents and Settings\User\Desktop\celine-fua_almaden-valley-athletic-club-san-jose.pdf
[2008/12/21 12:00:57 | 000,001,002 | —- | C] () – C:\WINDOWS\Dartemup.ini
[2008/08/04 23:07:20 | 000,065,216 | —- | C] () – C:\WINDOWS\System32\PDFreDirectMonNT.dll
[2008/03/10 09:38:28 | 000,051,370 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2008/01/20 12:07:39 | 000,166,216 | —- | C] () – C:\WINDOWS\System32\contmenu.dll
[2008/01/04 14:58:50 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/01/04 14:57:22 | 000,000,416 | —- | C] () – C:\WINDOWS\System32\dtu100.dll.manifest
[2008/01/04 14:57:22 | 000,000,416 | —- | C] () – C:\WINDOWS\System32\dpl100.dll.manifest
[2008/01/04 14:56:24 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2007/12/22 20:40:13 | 000,000,504 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2007/10/11 18:59:24 | 000,025,624 | —- | C] () – C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2007/04/02 20:33:57 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\hpzids01.dll
[2007/03/31 17:28:18 | 000,000,132 | —- | C] () – C:\WINDOWS\cool.ini
[2007/03/31 17:26:21 | 000,000,011 | —- | C] () – C:\WINDOWS\wordpad.ini
[2007/03/27 18:33:20 | 000,167,456 | —- | C] () – C:\WINDOWS\System32\BOCOF.DLL
[2007/03/27 18:33:20 | 000,004,052 | —- | C] () – C:\WINDOWS\unwise32.ini
[2006/10/06 12:58:58 | 000,000,174 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2006/10/06 12:56:29 | 000,000,698 | —- | C] () – C:\WINDOWS\NSSetDefaultBrowser.ini
[2006/10/06 12:36:15 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/10/06 12:28:34 | 000,028,836 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2006/04/15 15:26:00 | 001,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/04/15 15:26:00 | 001,466,368 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/04/15 15:26:00 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/04/15 15:26:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/04/15 15:26:00 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2006/03/28 06:51:10 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/03/28 06:15:24 | 000,000,108 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/03/28 06:12:08 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2005/12/02 11:09:10 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/08/05 23:01:54 | 000,235,008 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/01/13 12:46:34 | 000,172,032 | —- | C] () – C:\WINDOWS\System32\tifmicon.dll
[2003/01/07 13:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[1996/04/03 12:33:26 | 000,005,248 | —- | C] () – C:\WINDOWS\System32\giveio.sys

========== LOP Check ==========

[2008/06/05 22:37:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Age of Empires 3 YPack Trial
[2006/10/06 14:42:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DIGStream
[2007/05/11 12:18:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2007/12/17 00:50:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GameTap
[2010/06/09 10:05:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GameTap Web Player
[2010/07/02 10:56:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iOpus-i-M
[2007/05/08 11:49:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nikon
[2007/05/08 11:49:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Radio Sounds
[2008/11/29 13:02:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SpeedBit
[2007/03/31 11:08:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\StarzEntertainment
[2010/07/09 14:05:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/04/17 23:09:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TrackMania
[2007/05/11 12:18:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2008/11/29 23:32:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WildTangent
[2010/04/08 11:28:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/02/09 18:24:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/06/21 15:45:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2007/10/01 20:17:09 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\.glconnect
[2010/05/02 10:03:27 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Amazon
[2010/04/12 21:50:22 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\AnvSoft
[2010/07/06 23:00:59 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\BitTorrent
[2010/02/01 12:01:23 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\BonkEnc
[2009/02/11 11:59:25 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/07/09 14:10:39 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\DNA
[2010/07/05 23:50:48 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Dropbox
[2007/11/26 01:59:38 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\fretsonfire
[2007/11/20 23:18:29 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\GetRightToGo
[2008/11/28 23:38:54 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\iWin
[2007/11/16 01:42:24 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Leadertech
[2009/10/08 11:22:44 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\LimeWire
[2008/01/20 19:48:49 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\MSNShell
[2008/01/04 11:49:42 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Netscape
[2007/07/05 03:47:19 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Nikon
[2010/05/20 15:13:41 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\PDF reDirect
[2007/06/24 13:55:16 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Snapfish
[2009/10/09 16:25:32 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Template
[2007/09/09 21:00:23 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Ultimate Spanish
[2007/04/01 09:14:05 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\WildTangent
[2009/10/29 16:16:47 | 000,000,104 | —- | M] () – C:\WINDOWS\Tasks\Critical Battery Alarm Program.job
[2009/07/25 11:48:28 | 000,000,104 | —- | M] () – C:\WINDOWS\Tasks\Low Battery Alarm Program.job
[2010/07/09 00:01:00 | 000,000,232 | —- | M] () – C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
[2010/07/09 00:46:51 | 000,000,420 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{D183E32C-161B-4143-B951-9386A1095E28}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2004/08/10 00:00:00 | 016,971,599 | —- | M] () .cab file – C:\I386\sp2.cab:AGP440.sys
[2004/08/10 08:00:00 | 016,971,599 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/09/28 11:48:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/09/28 11:48:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 11:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 11:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/04 08:07:42 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/10 00:00:00 | 016,971,599 | —- | M] () .cab file – C:\I386\sp2.cab:atapi.sys
[2004/08/10 08:00:00 | 016,971,599 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/09/28 11:48:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/09/28 11:48:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 11:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 11:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 22:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/04 07:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 17:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 17:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/10 08:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: IASTOR.SYS >
[2005/10/13 02:07:12 | 000,874,240 | —- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B – C:\SWSETUP\HDD\iastor.sys
[2005/10/13 02:07:12 | 000,874,240 | —- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B – C:\WINDOWS\system32\drivers\iaStor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/13 17:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 17:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2004/08/10 08:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/10 08:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 17:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 17:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/04/13 17:11:51 | 001,267,200 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\comsvcs.dll
[22 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2006/03/27 21:30:26 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2006/03/27 21:30:26 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2006/03/27 21:30:26 | 000,888,832 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\drivers\*.sys /90 >
[2010/04/29 15:39:26 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbam.sys
[2010/04/29 15:39:38 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys
[2010/04/19 20:47:42 | 000,041,984 | —- | M] (Apple, Inc.) – C:\WINDOWS\system32\drivers\usbaapl.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0F8F5844
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5BB923A2
< End of report >

and my otl Extras.txt results:

OTL Extras logfile created on: 7/9/2010 2:07:54 PM - Run 1
OTL by OldTimer - Version 3.2.8.1 Folder = C:\Documents and Settings\User\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 423.00 Mb Available Physical Memory | 41.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 59.65 Gb Total Space | 4.57 Gb Free Space | 7.67% Space Free | Partition Type: NTFS
Drive D: | 13.86 Gb Total Space | 1.00 Gb Free Space | 7.20% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DAVIDLAPTOP
Current User Name: User
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"" =

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"3389:TCP" = 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"3389:TCP" = 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Vongo\VongoService.exe" = C:\Program Files\Vongo\VongoService.exe:*:enabled:VongoService – (Starz Entertainment Group LLC)
"" =
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink – File not found
"C:\Program Files\Hp\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Program Files\Hp\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe – ()
"C:\Program Files\Hp\Digital Imaging\Unload\HpqDIA.exe" = C:\Program Files\Hp\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe – ( )
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire – (Lime Wire, LLC)
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype – File not found
"C:\Program Files\MySpace\IM\MySpaceIM.exe" = C:\Program Files\MySpace\IM\MySpaceIM.exe:*:Enabled:MySpaceIM – File not found
"C:\Program Files\MSNShell\Bin\engie.exe" = C:\Program Files\MSNShell\Bin\engie.exe:*:Enabled:MSNShell – (MSNShell Team)
"C:\Program Files\DNA\btdna.exe" = C:\Program Files\DNA\btdna.exe:*:Enabled:DNA – (BitTorrent, Inc.)
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent – (BitTorrent, Inc.)
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Program Files\Steam\Steam.exe" = C:\Program Files\Steam\Steam.exe:*:Enabled:Steam – File not found
"C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe" = C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe:*:Enabled:Remote Assistance - Windows Messenger and Voice – (Microsoft Corporation)
"C:\Documents and Settings\User\Application Data\Dropbox\bin\Dropbox.exe" = C:\Documents and Settings\User\Application Data\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox – ()
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\Program Files\VideoLAN\VLC\vlc.exe" = C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player – ()


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic Data Module
"{08C5815C-2C6E-44f8-8748-0E61BC9AFB68}" = Symantec KB-DocID:2003093015493306
"{09D8492A-C8E2-421E-927D-46800FB327A3}" = Wireless Home Network Setup
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{1248C09A-BD6B-47F5-BF3F-CD2B700D9FCB}" = ccCommon
"{12E2B9E9-05B1-407d-B0FD-B5F350535125}" = Norton Internet Security
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1CB34CE9-0E6B-493F-BB66-3425E5DF76E5}" = CP_CalendarTemplates1
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{23012310-3E05-46A5-88A9-C6CBCABCAC79}" = Customer Experience Enhancement
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23B35809-5E4A-4F14-8332-1CDEDDFAC089}" = CP_Package_Variety2
"{24BEBF2E-73F3-4599-840B-EDC612CCDD0D}" = Destinations
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java™ 6 Update 14
"{27555031-A116-4EC6-9991-7B400142A936}" = HP PSC & OfficeJet 6.1.A
"{2818095F-FB6C-42C8-827E-0A406CC9AFF5}" = Quicken 2006
"{286F29AF-0BE2-4D5F-AB17-B7631A810553}" = muvee autoProducer 4.5
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2A548002-9042-4083-A270-B67473DE1073}" = SkinsHP1
"{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}" = SymNet
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{2EBF25F1-F8A2-40EA-92BE-931C142A44E2}" = CC_ccProxyExt
"{30738666-9805-4926-A78F-91DA33B6C437}" = ccPxyCore
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.00 E2
"{34F3FCF1-817B-4D61-B6AF-19D9486AFEA0}" = Unload
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35725FBC-A136-4A46-9F29-091759D9BB93}" = MVision
"{3672B097-EA69-4bfe-B92F-29AE6D9D2B34}" = Norton Internet Security
"{36D620AD-EEBA-4973-BA86-0C9AE6396620}" = OptionalContentQFolder
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{3FE0CFAB-584A-4AA5-B8CD-C32284CFA308}" = RandMap
"{4041C245-7099-4C96-9738-5EBC23827B3C}" = BufferChm
"{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works
"{4302B2DD-D958-40E3-BAF3-B07FFE1978CE}" = HP Wireless Assistant 2.00 E1
"{449F3A9E-9903-4a0d-A209-08030D45A935}" = Norton Internet Security
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP QuickPlay 2.1
"{47D2103B-FD51-4017-9C20-DD408B17D726}" = Office 2003 Trial Assistant
"{48185814-A224-447a-81DA-71BD20580E1B}" = Norton Internet Security
"{494D17B5-3369-4905-8C4B-80C972C5E0FF}" = CP_Panorama1Config
"{4DA4012B-39AF-48c2-B23B-A4D570D233A6}" = cp_LightScribeConfig
"{522D1D79-9C0A-4361-91F8-2AFF8EC6C2E1}" = CP_Package_Variety1
"{52FBAE98-D389-4281-8C14-21B4046CCB4E}" = SonicAC3Encoder
"{53EE9E42-CECB-4C92-BF76-9CA65DAF8F1C}" = FullDPAppQFolder
"{54F0998F-73C8-4b51-8286-FE903C231BED}" = cp_PosterPrintConfig
"{5677563D-0CB1-485F-9E18-C5025306BB3F}" = Norton AntiSpam
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{5E977DEC-5BB4-44C7-9FE5-9357D2DB4FCB}" = Disc2Phone
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler
"{6815FCDD-401D-481E-BA88-31B4754C2B46}" = Macromedia Flash Player 8
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{766633B3-1AFA-44B6-A3FC-1DE991CD9C52}" = CP_Package_Basic1
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77772678-817F-4401-9301-ED1D01A8DA56}" = SPBBC
"{79F8E1D4-36C1-439C-95FA-F695050B5B07}" = Sonic_PrimoSDK
"{7AB3A249-FB81-416B-917A-A2A10E74C503}" = iTunes
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7B6CF9EB-CB2B-4A1A-81A9-BE1A9044690A}" = TIPCI
"{80AE27BA-B0ED-4288-A8B9-D8194BCF4115}" = cp_UpdateProjectsConfig
"{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Easy Internet Sign-up
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{819A6E18-2533-4434-AB91-E5D95F3549A2}" = WR2 Demo ATS
"{82A5BF38-8461-4A5C-B2C9-24F5256D92A6}" = Norton Protection Center
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{869C3062-4745-4949-B6C9-98AF24D89030}" = PhotoGallery
"{86C0E2A3-1EDA-4F01-A43D-80DA8642813C}_is1" = GameTap Web Player
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver
"{8ACAFF25-59A0-4B25-89E3-30E6A42D1D6E}" = Kelly Slater's Pro Surfer™ Demo
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{939F8208-C8CE-4AFF-B7BA-ACEB2E74A6CB}" =
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{945AC98B-3DC8-45BE-BAE0-22CEEE37A103}" = Logitech QuickCam
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{961034C0-58DF-11DF-97FD-005056806466}" = Google Earth Plug-in
"{9D4ABB0C-F60B-44A6-956C-A4A63D5495C9}" = CueTour
"{A01FC76F-CC09-4658-9E37-5C2F635EE708}" = TourSetup
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A5F68DC8-0278-4AD8-B413-861509B5F25B}" = ArcSoft Panorama Maker 3
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support
"{A93C9E60-29B6-49da-BA21-F70AC6AADE20}" = Norton Internet Security
"{AADFE0B9-F905-4d5f-A144-0ADB2EFA747B}" = Norton Internet Security
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic Audio Module
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.3
"{AC76BA86-7AD7-5760-0000-900000000003}" = Japanese Fonts Support For Adobe Reader 9
"{AEF7A12C-CD9B-4773-8AD1-6916138CA7EA}" = SmartAudio
"{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}" = HP Update
"{B11E71BA-498C-42D4-9F1A-9D7A89D9DA61}" = CP_AtenaShokunin1Config
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic Copy Module
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B16AF568-A644-483C-A6DA-5028CD019C8C}" = SonicMPEGEncoder
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1
"{B57F2FF0-5A25-4332-B503-4592B370C02F}" = CP_Package_Variety3
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B7C61755-DB48-4003-948F-3D34DB8EAF69}" = MSRedist
"{BBD3BF67-5B89-4CBB-BA58-5818ED5F3290}" = cp_OnlineProjectsConfig
"{BC96BBA7-C634-460E-AD18-A0A994213F80}" = HP User Guides–System Recovery
"{BCE72AED-3332-4863-9567-C5DCB9052CA2}" = Netflix Movie Viewer
"{BEF726DD-4037-4214-8C6A-E625C02D2870}" = Logitech Audio Echo Cancellation Component
"{C6812939-B117-48E6-A3BA-1709C14A3C8C}" = Scan
"{C6F5B6CF-609C-428E-876F-CA83176C021B}" = Norton AntiVirus 2006
"{C8753E28-2680-49BF-BD48-DD38FD086EFE}" = AiO_Scan_CDA
"{C9224FFE-7EFB-4D9C-9AA5-08CCD6A82381}_is1" = Ultimate Subtitles v1.01
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader
"{D2464E10-4895-441F-8CC3-0A898D2E8F01}" = Microsoft IntelliPoint 6.11
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{D755C7A3-C03E-4460-8C00-AC6E55505FB5}" = LightScribe [removed]
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{DB7E00C9-6DEF-489A-8112-D8F81614F45A}" = Vongo
"{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}" = LiveUpdate Notice (Symantec Corporation)
"{E2AFC96C-CBAF-4BAD-B87E-F8227623F3B9}" = The Ultimate Spanish Review and Practice CD-ROM
"{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}" = Norton Internet Security
"{E5EE9939-259F-4DE2-8023-5C49E16A4F43}" = Norton Internet Security
"{E74E3D81-773B-4DCF-B706-50236F80BD81}" = HP User Guides 0019
"{E85FA9A1-C241-4698-893B-DD99509B8DB0}" = Norton WMI Update
"{EA516024-D84D-41F1-814F-83175A6188F2}" = Logitech Video Enumerator
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F64306A5-4C32-41bb-B153-53986527FAB4}" = Norton WMI Update
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{FC8D25A7-FF1B-41BB-BB3B-9A06C0A60AE0}" = InstantShareDevices
"{FF3999BE-1A7B-4738-88AA-97BF14094A4A}" = PictureProject
"{FFB4DD53-28B7-4981-BFF0-9BD801F61095}" = Norton Internet Security
"074EEF5F-3BE8-4112-B253-C5D6CDE2924C" = Zuma Deluxe from Hewlett-Packard Laptops (remove only)
"0E5266B4-9069-401A-93AE-5FF9F1712016" = Insaniquarium Deluxe from Hewlett-Packard Laptops (remove only)
"103EFD47-9F2C-4490-95DD-AE6C442AFB92" = SCRABBLE from Hewlett-Packard Laptops (remove only)
"12133444-BF36-4d4e-B7FB-A3424C645DE4" = GemMaster Mystic
"1C3FDBBA-EBF7-4CDB-AD8A-A1125734AF86" = Tradewinds from Hewlett-Packard Laptops (remove only)
"382C11F0-1A18-4F76-B8E0-15CA7F209C22" = Chuzzle Deluxe from Hewlett-Packard Laptops (remove only)
"384E0BF4-1E1F-45A6-B60E-42144A3F15CD" = Blackhawk Striker 2 from Hewlett-Packard Laptops (remove only)
"7948472C-423F-4134-B68F-48D660A05D71" = Big Kahuna Reef from Hewlett-Packard Laptops (remove only)
"7ED8A70C-9597-40BE-AEA0-0573182F1F51" = Super Granny from Hewlett-Packard Laptops (remove only)
"7F8C5718-1BA9-4AAE-96D2-2B04D05F2D54" = Polar Bowler from Hewlett-Packard Laptops (remove only)
"82A44D22-9452-49FB-00FB-CEC7DCAF7E23" = EA SPORTS online 2006
"9F3399B2-9ED6-4339-84A2-686432638B86" = Blasterball 2 from Hewlett-Packard Laptops (remove only)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.10
"Any Video Converter_is1" = Any Video Converter 3.0.4
"Autobahn" = MLB.TV NexDef Plug-in
"B0202B33-E73D-4FCD-AC88-0B2971AFC116" = Slyder from Hewlett-Packard Laptops (remove only)
"B0769D17-E72A-4E87-A83F-1F7A3F080008" = Bookworm Deluxe from Hewlett-Packard Laptops (remove only)
"B3EE3001-DC24-4cd1-8743-5692C716659F" = Otto
"C264D692-8E15-4141-96A2-5621332E5DD0" = Slingo Deluxe from Hewlett-Packard Laptops (remove only)
"CCleaner" = CCleaner (remove only)
"CNXT_HDAUDIO" = Conexant HD Audio
"CNXT_MODEM_HDAUDIO_CPL30A5m" = HDAUDIO Soft Data Fax Modem with SmartCP
"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2008-01-24
"ComcastHSI" = Comcast High-Speed Internet Install Wizard
"Cool Edit 2000" = Cool Edit 2000
"CPUID HWMonitor_is1" = CPUID HWMonitor 1.14
"D2E44AA4-8665-4490-A6C9-2D0744B47B27" = Polar Golfer from Hewlett-Packard Laptops (remove only)
"Dart 'm Up" = Dart 'm Up
"DED8E2B5-BA9F-448F-84E8-0AEF79876F95" = Snowboard SuperJam
"Digital Editions" = Adobe Digital Editions
"DjVu" = Lizardtech DjVu Control (autoinstall)
"Download Accelerator Plus (DAP)" = Download Accelerator Plus (DAP)
"Download Manager" = Download Manager 2.3.6
"E332F38A-75F6-4EF2-88CC-246E8A1CB5D7" = Oasis from Hewlett-Packard Laptops (remove only)
"EF860173-4FB7-4DE1-8BE8-5400F05A0DC5" = Puzzle Express from Hewlett-Packard Laptops (remove only)
"Electronic Piano 2.5_is1" = Electronic Piano 2.5
"ESPNMotion" = ESPNMotion
"F2566CC2-D4C4-44ED-A838-3F8288D8D3FE" = Flip Words from Hewlett-Packard Laptops (remove only)
"Frets on Fire" = Frets On Fire
"Gameloft Connect" = Gameloft Connect
"Getsubtitle Toolbar" = Getsubtitle Toolbar
"HP Game Console" = HP Game Console and games
"HP Imaging Device Functions" = HP Imaging Device Functions 6.0
"HP Photo & Imaging" = HP Photosmart Premier Software 6.0
"HP Rhapsody" = HP Rhapsody
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{23012310-3E05-46A5-88A9-C6CBCABCAC79}" = Customer Experience Enhancement
"InstallShield_{7B6CF9EB-CB2B-4A1A-81A9-BE1A9044690A}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"InstallShield_{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Easy Internet Sign-up
"InstallShield_{819A6E18-2533-4434-AB91-E5D95F3549A2}" = WR2 Demo ATS
"InstallShield_{E2AFC96C-CBAF-4BAD-B87E-F8227623F3B9}" = The Ultimate Spanish Review and Practice CD-ROM
"legacyqcam_10.51" = Labtec Legacy USB Camera Driver Package
"LimeWire" = LimeWire 4.18.3
"LiveUpdate" = LiveUpdate 3.0 (Symantec Corporation)
"lvdrivers_11.50" = Logitech QuickCam Driver Package
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSNShell" = MSNShell 4
"Netscape Browser" = Netscape Browser (remove only)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"PartyPoker" = PartyPoker
"PDF reDirect" = PDF reDirect (remove only)
"PeerGuardian_is1" = PeerGuardian 2.0
"PictureProject In Touch Downloader" = PictureProject In Touch Downloader 1.0
"PROSet" = Intel® PRO Network Connections Drivers
"RealPlayer 6.0" = RealPlayer
"Rhapsody" = Rhapsody
"SpeedFan" = SpeedFan (remove only)
"SymSetup.{A93C9E60-29B6-49da-BA21-F70AC6AADE20}" = Norton Internet Security 2006 (Symantec Corporation)
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"SystemRequirementsLab" = System Requirements Lab
"The Weather Channel Desktop" = The Weather Channel Desktop
"TmNations_is1" = TrackMania Nations ESWC 1.7.9
"TmNationsForever_is1" = TmNationsForever Update 2010-03-15
"VLC media player" = VLC media player 1.0.5
"Weather Services" = Weather Services
"WIC" = Windows Imaging Component
"WildTangent CDA" = WildTangent Web Driver
"WildTangent hp Master Uninstall" = HP Games
"WildTangent wildgames Master Uninstall" = WildTangent Games
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent" = BitTorrent
"BitTorrent DNA" = DNA
"Dropbox" = Dropbox
"Move Media Player" = Move Media Player
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/9/2010 2:58:50 PM | Computer Name = DAVIDLAPTOP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6219500

Error - 7/9/2010 2:59:06 PM | Computer Name = DAVIDLAPTOP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 7/9/2010 2:59:06 PM | Computer Name = DAVIDLAPTOP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 6235125

Error - 7/9/2010 2:59:06 PM | Computer Name = DAVIDLAPTOP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6235125

Error - 7/9/2010 2:59:22 PM | Computer Name = DAVIDLAPTOP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 7/9/2010 2:59:22 PM | Computer Name = DAVIDLAPTOP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 6250750

Error - 7/9/2010 2:59:22 PM | Computer Name = DAVIDLAPTOP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6250750

Error - 7/9/2010 2:59:37 PM | Computer Name = DAVIDLAPTOP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 7/9/2010 2:59:37 PM | Computer Name = DAVIDLAPTOP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 6266375

Error - 7/9/2010 2:59:37 PM | Computer Name = DAVIDLAPTOP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6266375

[ System Events ]
Error - 7/8/2010 4:17:21 PM | Computer Name = DAVIDLAPTOP | Source = E100B | ID = 262150
Description = Adapter Intel® PRO/100 VE Network Connection: Hardware failure detected

Error - 7/8/2010 4:17:23 PM | Computer Name = DAVIDLAPTOP | Source = E100B | ID = 262150
Description = Adapter Intel® PRO/100 VE Network Connection: Hardware failure detected

Error - 7/8/2010 4:17:25 PM | Computer Name = DAVIDLAPTOP | Source = E100B | ID = 262150
Description = Adapter Intel® PRO/100 VE Network Connection: Hardware failure detected

Error - 7/8/2010 4:17:27 PM | Computer Name = DAVIDLAPTOP | Source = E100B | ID = 262150
Description = Adapter Intel® PRO/100 VE Network Connection: Hardware failure detected

Error - 7/8/2010 4:17:29 PM | Computer Name = DAVIDLAPTOP | Source = E100B | ID = 262150
Description = Adapter Intel® PRO/100 VE Network Connection: Hardware failure detected

Error - 7/8/2010 4:17:31 PM | Computer Name = DAVIDLAPTOP | Source = E100B | ID = 262150
Description = Adapter Intel® PRO/100 VE Network Connection: Hardware failure detected

Error - 7/8/2010 4:19:55 PM | Computer Name = DAVIDLAPTOP | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.0.2 for the Network Card with network
address 0013026C8646 has been denied by the DHCP server 0.0.0.0 (The DHCP Server
sent a DHCPNACK message).

Error - 7/9/2010 2:47:21 AM | Computer Name = DAVIDLAPTOP | Source = DCOM | ID = 10010
Description = The server {F3A614DC-ABE0-11D2-A441-00C04F795683} did not register
with DCOM within the required timeout.

Error - 7/9/2010 12:26:52 PM | Computer Name = DAVIDLAPTOP | Source = Windows Update Agent | ID = 16
Description = Unable to Connect: Windows is unable to connect to the automatic updates
service and therefore cannot download and install updates according to the set
schedule. Windows will continue to try to establish a connection.

Error - 7/9/2010 5:02:22 PM | Computer Name = DAVIDLAPTOP | Source = MRxSmb | ID = 8003
Description = The master browser has received a server announcement from the computer
CELINE-PC that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{61CF838A-5A3F-4B85. The master browser is stopping or an election is
being forced.


< End of report >

and here is the Gmer.txt. OTL ran fine but Gmer did not. I had to restart it (and the computer) a couple times. It took several hours…and my computer shut itself down in the middle without me doing anything. Kind of strange. I hope it didn't ruin the scan. In any case, thank you so much for your help!

David

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-07-09 21:10:11
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\User\LOCALS~1\Temp\pwriipog.sys


—- System - GMER 1.0.15 —-

SSDT 86535800 ZwAlertResumeThread
SSDT 8712E668 ZwAlertThread
SSDT 8657C170 ZwAllocateVirtualMemory
SSDT 867899A8 ZwConnectPort
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwCreateKey [0xAA595020]
SSDT 867C7098 ZwCreateMutant
SSDT 86766280 ZwCreateThread
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteKey [0xAA5952A0]
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xAA595800]
SSDT 86710170 ZwFreeVirtualMemory
SSDT 8677B858 ZwImpersonateAnonymousToken
SSDT 86711A90 ZwImpersonateThread
SSDT 865771B8 ZwMapViewOfSection
SSDT 8668EE98 ZwOpenEvent
SSDT 866714E8 ZwOpenProcessToken
SSDT 867B5170 ZwOpenThreadToken
SSDT 8670E008 ZwQueryValueKey
SSDT 866CE6D8 ZwResumeThread
SSDT 868218B8 ZwSetContextThread
SSDT 864EB170 ZwSetInformationProcess
SSDT 866711C0 ZwSetInformationThread
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xAA595A50]
SSDT 865E1D10 ZwSuspendProcess
SSDT 8679E488 ZwSuspendThread
SSDT 86704D80 ZwTerminateProcess
SSDT 86581380 ZwTerminateThread
SSDT 867F7DD8 ZwUnmapViewOfSection
SSDT 866CF170 ZwWriteVirtualMemory

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwCallbackReturn + 2DBC 80504658 4 Bytes CALL EAD6AD71
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB248C360, 0x2212DD, 0xE8000020]
init C:\WINDOWS\system32\drivers\tifm21.sys entry point in "init" section [0xAC9FCEBF]

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\System32\svchost.exe[1336] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 006E000A
.text C:\WINDOWS\System32\svchost.exe[1336] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 006F000A
.text C:\WINDOWS\System32\svchost.exe[1336] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 006D000C
.text C:\WINDOWS\System32\svchost.exe[1336] USER32.dll!GetCursorPos 7E42974E 5 Bytes JMP 01E4000A
.text C:\WINDOWS\System32\svchost.exe[1336] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 00F3000A
.text C:\WINDOWS\Explorer.EXE[1928] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00B8000A
.text C:\WINDOWS\Explorer.EXE[1928] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00C2000A
.text C:\WINDOWS\Explorer.EXE[1928] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00B7000C

—- Devices - GMER 1.0.15 —-

Device Ntfs.sys (NT File System Driver/Microsoft Corporation)
Device Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)

AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 eabfiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Development Company, L.P.)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)

AttachedDevice SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)

—- EOF - GMER 1.0.15 —-

Thank you so much for your help thus far. So I completed step 1 (Java) without a hitch, but I could not do step two. I disabled Norton Internet Security, Norton Anti-virus Auto Protect, and the Norton firewall and then went to the Kapersky site, but each time before it could even begin downloading it gave me the following error message: "Launch of Java application is interupted. Please establish an uninterrupted internet connection for work with this program." I tried going to several different sites, so my internet is connection is working. Perhaps I did not completely disable Norton and it is blocking Java? Or I somehow downloaded and installed the wrong Java app? (Though I don't think I did.) Is there some other recourse I can take?
I'm not sure whether this will tell you if I did something wrong with my Java installation / norton disabling, but just in case, here is an OTL readout of my computer at present:

OTL logfile created on: 7/12/2010 12:41:33 AM - Run 2
OTL by OldTimer - Version 3.2.8.1 Folder = C:\Documents and Settings\User\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 308.00 Mb Available Physical Memory | 30.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 59.65 Gb Total Space | 4.45 Gb Free Space | 7.46% Space Free | Partition Type: NTFS
Drive D: | 13.86 Gb Total Space | 1.00 Gb Free Space | 7.20% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DAVIDLAPTOP
Current User Name: User
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/07/09 14:05:36 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
PRC - [2010/06/10 21:03:08 | 000,144,176 | —- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/03/04 15:08:20 | 000,099,720 | —- | M] (Symantec Corporation) – C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2009/11/06 13:19:06 | 000,323,392 | —- | M] (BitTorrent, Inc.) – C:\Program Files\DNA\btdna.exe
PRC - [2009/04/01 14:51:34 | 000,801,032 | —- | M] () – C:\Documents and Settings\User\Local Settings\Application Data\Autobahn\mlb-nexdef-autobahn.exe
PRC - [2008/04/13 17:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2008/03/04 10:28:08 | 001,251,720 | —- | M] () – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
PRC - [2008/02/11 17:22:14 | 000,191,848 | —- | M] (Symantec Corporation) – c:\Program Files\Common Files\Symantec Shared\CCEVTMGR.EXE
PRC - [2008/02/11 17:22:14 | 000,169,320 | —- | M] (Symantec Corporation) – c:\Program Files\Common Files\Symantec Shared\CCSETMGR.EXE
PRC - [2008/02/11 17:22:14 | 000,053,096 | —- | M] (Symantec Corporation) – C:\Program Files\Common Files\Symantec Shared\CCAPP.EXE
PRC - [2008/01/29 17:38:31 | 000,583,048 | —- | M] (Symantec Corporation) – C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
PRC - [2007/10/25 16:33:22 | 000,563,984 | —- | M] () – C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
PRC - [2007/10/19 13:19:22 | 000,141,848 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
PRC - [2007/10/19 13:17:28 | 000,186,904 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
PRC - [2007/10/01 15:50:08 | 000,214,408 | —- | M] (Symantec Corporation) – c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
PRC - [2007/09/13 18:49:48 | 000,202,088 | —- | M] (Symantec Corporation) – c:\Program Files\Common Files\Symantec Shared\CCPROXY.EXE
PRC - [2007/06/08 10:00:29 | 000,068,856 | —- | M] (Google Inc.) – C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2007/05/23 13:13:38 | 000,139,888 | —- | M] (Symantec Corporation) – c:\Program Files\Norton Internet Security\Norton AntiVirus\NAVAPSVC.EXE
PRC - [2007/03/29 11:59:42 | 000,176,128 | —- | M] (Starz Entertainment Group LLC) – C:\Program Files\Vongo\VongoService.exe
PRC - [2006/12/15 11:36:28 | 000,750,720 | —- | M] (Symantec Corporation) – C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
PRC - [2005/12/23 21:44:26 | 000,491,606 | —- | M] () – C:\Program Files\HPQ\Shared\HpqToaster.exe
PRC - [2005/11/03 19:06:22 | 001,160,848 | —- | M] (Symantec Corporation) – c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
PRC - [2005/09/24 09:42:32 | 000,475,136 | —- | M] (Hewlett-Packard Development Company, L.P.) – C:\Program Files\Hp\Digital Imaging\bin\hpqimzone.exe
PRC - [2005/09/18 19:40:42 | 001,421,824 | —- | M] (Methlabs) – C:\Program Files\PeerGuardian2\pg2.exe
PRC - [2005/08/11 16:30:30 | 000,081,920 | —- | M] (Macrovision Corporation) – C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe


========== Modules (SafeList) ==========

MOD - [2010/07/09 14:05:36 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
MOD - [2010/03/04 15:01:09 | 000,503,808 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\MSVCP71.DLL
MOD - [2010/03/04 15:01:09 | 000,348,160 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\MSVCR71.DLL
MOD - [2008/04/13 17:10:20 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msscript.ocx
MOD - [2008/02/11 17:22:14 | 000,379,240 | —- | M] (Symantec Corporation) – c:\Program Files\Common Files\Symantec Shared\CCL40.DLL
MOD - [2007/10/19 13:19:10 | 000,109,080 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcInj.dll
MOD - [2005/09/24 01:38:24 | 000,123,488 | —- | M] (Symantec Corporation) – C:\Program Files\Common Files\Symantec Shared\AntiSpam\asOEHook.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/06/10 21:03:08 | 000,144,176 | —- | M] (Apple Inc.) [Auto | Running] – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe – (Apple Mobile Device)
SRV - [2010/03/04 15:08:20 | 002,106,760 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE – (LiveUpdate)
SRV - [2010/03/04 15:08:20 | 000,099,720 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe – (Automatic LiveUpdate Scheduler)
SRV - [2008/03/04 10:28:08 | 001,251,720 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe – (Symantec Core LC)
SRV - [2008/02/11 17:22:14 | 000,191,848 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe – (ccEvtMgr)
SRV - [2008/02/11 17:22:14 | 000,169,320 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe – (ccSetMgr)
SRV - [2008/01/29 17:38:31 | 000,583,048 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe – (LiveUpdate Notice Service)
SRV - [2007/10/19 13:21:16 | 000,141,848 | —- | M] (Logitech Inc.) [Auto | Stopped] – C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe – (LVSrvLauncher)
SRV - [2007/10/19 13:19:22 | 000,141,848 | —- | M] (Logitech Inc.) [Auto | Running] – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe – (LVPrcSrv)
SRV - [2007/10/19 13:17:28 | 000,186,904 | —- | M] (Logitech Inc.) [Auto | Running] – C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe – (LVCOMSer)
SRV - [2007/10/01 15:50:08 | 000,214,408 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe – (SNDSrvc)
SRV - [2007/09/13 18:49:48 | 000,202,088 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Common Files\Symantec Shared\ccProxy.exe – (ccProxy)
SRV - [2007/08/09 00:27:52 | 000,073,728 | —- | M] (HP) [Auto | Stopped] – C:\WINDOWS\system32\HPZipm12.exe – (Pml Driver HPZ12)
SRV - [2007/05/23 13:13:38 | 000,139,888 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe – (navapsvc)
SRV - [2007/03/29 11:59:42 | 000,176,128 | —- | M] (Starz Entertainment Group LLC) [Auto | Running] – C:\Program Files\Vongo\VongoService.exe – (Vongo Service)
SRV - [2007/01/16 11:52:26 | 000,072,328 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – c:\Program Files\Norton Internet Security\ccPwdSvc.exe – (ccISPwdSvc)
SRV - [2007/01/16 09:25:28 | 000,045,696 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – c:\Program Files\Norton Internet Security\comHost.exe – (comHost)
SRV - [2006/12/15 11:36:28 | 000,750,720 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE – (NSCService)
SRV - [2005/11/03 19:06:22 | 001,160,848 | —- | M] (Symantec Corporation) [Auto | Running] – c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe – (SPBBCSvc)
SRV - [2005/08/26 21:22:48 | 000,198,368 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe – (SAVScan)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\DRIVERS\USBKey.sys – (USBDongle)
DRV - [2010/06/23 12:37:11 | 000,264,568 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20100707.001\SymIDSCo.sys – (SYMIDSCO)
DRV - [2010/05/27 01:00:00 | 000,371,248 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys – (eeCtrl)
DRV - [2010/05/27 01:00:00 | 000,102,448 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys – (EraserUtilRebootDrv)
DRV - [2010/05/11 01:00:00 | 001,347,504 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100711.002\NAVEX15.SYS – (NAVEX15)
DRV - [2010/05/11 01:00:00 | 000,085,552 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100711.002\NAVENG.SYS – (NAVENG)
DRV - [2009/03/27 01:16:28 | 000,012,672 | —- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\cpuz132_x32.sys – (cpuz132)
DRV - [2009/01/05 22:19:44 | 000,124,464 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SYMEVENT.SYS – (SymEvent)
DRV - [2008/05/08 07:02:52 | 000,203,136 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\rmcast.sys – (RMCAST)
DRV - [2008/04/13 11:45:12 | 000,060,032 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\usbaudio.sys – (usbaudio) USB Audio Driver (WDM)
DRV - [2008/04/13 11:39:44 | 000,092,544 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\mqac.sys – (MQAC)
DRV - [2008/04/13 11:36:39 | 000,043,008 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\amdagp.sys – (amdagp)
DRV - [2008/04/13 11:36:39 | 000,040,960 | —- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\sisagp.sys – (sisagp)
DRV - [2008/04/13 09:36:05 | 000,144,384 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\hdaudbus.sys – (HDAudBus)
DRV - [2007/10/19 13:16:30 | 002,109,976 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Lvckap.sys – (LVcKap)
DRV - [2007/10/11 18:59:24 | 000,025,624 | —- | M] () [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LVPr2Mon.sys – (LVPr2Mon)
DRV - [2007/10/11 18:59:02 | 002,142,488 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LVMVdrv.sys – (LVMVDrv)
DRV - [2007/10/01 15:49:26 | 000,189,320 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\SYMTDI.SYS – (SYMTDI)
DRV - [2007/10/01 15:49:20 | 000,023,944 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\SYMREDRV.SYS – (SYMREDRV)
DRV - [2007/10/01 15:49:16 | 000,031,624 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\SYMIDS.SYS – (SYMIDS)
DRV - [2007/10/01 15:49:10 | 000,028,040 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\SYMNDIS.SYS – (SYMNDIS)
DRV - [2007/10/01 15:49:04 | 000,098,184 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\SYMFW.SYS – (SYMFW)
DRV - [2007/10/01 15:48:56 | 000,012,680 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\SYMDNS.SYS – (SYMDNS)
DRV - [2007/05/06 09:13:19 | 000,008,413 | —- | M] (RealNetworks, Inc.) [Kernel | Auto | Running] – C:\WINDOWS\System32\drivers\mcstrm.sys – (MCSTRM)
DRV - [2007/03/06 17:54:40 | 000,041,376 | —- | M] (Labtec Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LVUSBSta.sys – (LVUSBSta)
DRV - [2007/03/06 17:48:46 | 001,273,504 | —- | M] (Labtec Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LV302V32.SYS – (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2007/03/06 17:48:46 | 000,014,240 | —- | M] (Labtec Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\lv302af.sys – (pepifilter)
DRV - [2006/10/06 12:49:44 | 000,010,344 | —- | M] (Symantec Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\symlcbrd.sys – (symlcbrd)
DRV - [2006/09/24 06:28:46 | 000,005,248 | —- | M] (Windows ® 2000 DDK provider) [Kernel | Boot | Running] – C:\WINDOWS\system32\speedfan.sys – (speedfan)
DRV - [2006/06/02 22:02:36 | 000,572,928 | —- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\CHDAud.sys – (HdAudAddService)
DRV - [2006/04/15 15:26:00 | 003,658,528 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nv4_mini.sys – (nv)
DRV - [2006/03/14 11:02:54 | 001,428,480 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\w39n51.sys – (w39n51) Intel®
DRV - [2006/03/03 22:31:48 | 000,192,736 | —- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SynTP.sys – (SynTP)
DRV - [2005/11/03 19:06:22 | 000,389,776 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys – (SPBBCDrv)
DRV - [2005/11/03 07:40:07 | 000,063,488 | —- | M] (Protection Technology) [Kernel | Boot | Running] – C:\WINDOWS\System32\drivers\sfvfs02.sys – (sfvfs02) StarForce Protection VFS Driver (version 2.x)
DRV - [2005/10/13 02:07:12 | 000,874,240 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\iaStor.sys – (iaStor)
DRV - [2005/09/20 03:30:56 | 000,162,432 | —- | M] (Texas Instruments) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tifm21.sys – (tifm21)
DRV - [2005/09/19 13:24:20 | 000,005,760 | —- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\EabUsb.sys – (eabusb)
DRV - [2005/09/19 13:24:10 | 000,009,344 | —- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\CPQBttn.sys – (HBtnKey)
DRV - [2005/09/19 13:23:52 | 000,007,808 | —- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\eabfiltr.sys – (eabfiltr)
DRV - [2005/09/18 19:02:52 | 000,005,632 | —- | M] () [Kernel | On_Demand | Running] – C:\Program Files\PeerGuardian2\pgfilter.sys – (pgfilter)
DRV - [2005/08/26 21:22:50 | 000,053,896 | —- | M] (Symantec Corporation) [Kernel | System | Running] – c:\Program Files\Norton Internet Security\Norton AntiVirus\Savrtpel.sys – (SAVRTPEL)
DRV - [2005/08/26 21:22:48 | 000,334,984 | —- | M] (Symantec Corporation) [Kernel | System | Running] – c:\Program Files\Norton Internet Security\Norton AntiVirus\savrt.sys – (SAVRT)
DRV - [2005/08/22 08:07:00 | 001,035,008 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_DPV.sys – (HSF_DPV)
DRV - [2005/08/22 08:06:16 | 000,201,600 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSFHWAZL.sys – (HSFHWAZL)
DRV - [2005/08/22 08:06:10 | 000,718,464 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_CNXT.sys – (winachsf)
DRV - [2005/08/10 05:44:04 | 000,050,688 | —- | M] (Protection Technology) [Kernel | Boot | Running] – C:\WINDOWS\System32\drivers\sfdrv01.sys – (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2005/05/16 06:20:39 | 000,006,656 | —- | M] (Protection Technology) [Kernel | Boot | Running] – C:\WINDOWS\System32\drivers\sfhlp02.sys – (sfhlp02) StarForce Protection Helper Driver (version 2.x)
DRV - [2004/08/03 23:31:34 | 000,020,992 | —- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\RTL8139.sys – (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2001/08/17 23:07:44 | 000,019,072 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\sparrow.sys – (Sparrow)
DRV - [2001/08/17 23:07:42 | 000,030,688 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\sym_u3.sys – (sym_u3)
DRV - [2001/08/17 23:07:40 | 000,028,384 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\sym_hi.sys – (sym_hi)
DRV - [2001/08/17 23:07:36 | 000,032,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\symc8xx.sys – (symc8xx)
DRV - [2001/08/17 23:07:34 | 000,016,256 | —- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\symc810.sys – (symc810)
DRV - [2001/08/17 22:52:22 | 000,036,736 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\ultra.sys – (ultra)
DRV - [2001/08/17 22:52:20 | 000,045,312 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\ql12160.sys – (ql12160)
DRV - [2001/08/17 22:52:20 | 000,040,320 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\ql1080.sys – (ql1080)
DRV - [2001/08/17 22:52:18 | 000,049,024 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\ql1280.sys – (ql1280)
DRV - [2001/08/17 22:52:16 | 000,179,584 | —- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys – (dac2w2k)
DRV - [2001/08/17 22:52:12 | 000,017,280 | —- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\mraid35x.sys – (mraid35x)
DRV - [2001/08/17 22:52:00 | 000,026,496 | —- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\asc.sys – (asc)
DRV - [2001/08/17 22:51:58 | 000,014,848 | —- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\asc3550.sys – (asc3550)
DRV - [2001/08/17 22:51:56 | 000,005,248 | —- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\aliide.sys – (AliIde)
DRV - [2001/08/17 22:51:54 | 000,006,656 | —- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\DRIVERS\cmdide.sys – (CmdIde)
DRV - [2000/03/22 20:42:24 | 000,044,192 | —- | M] (PC-Doctor Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\drivers\PcdrNt.sys – (PcdrNt)
DRV - [1996/04/03 12:33:26 | 000,005,248 | —- | M] () [Kernel | Boot | Running] – C:\WINDOWS\system32\giveio.sys – (giveio)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/a/slugmail.ucsc.edu/…mp;ltmplcache=2
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "https://cruzmail.ucsc.edu/"
FF - prefs.js..extensions.enabledItems: [removed]:3.5.0.145
FF - prefs.js..extensions.enabledItems: {F17C1572-C9EC-4e5c-A542-D05CBB5C5A08}:[removed]
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..extensions.enabledItems: {99a0337c-6303-4879-b72e-500fd9aaca8c}:1.0.8
FF - prefs.js..extensions.enabledItems: [removed]:2.0.3

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/05/08 14:10:27 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/11 18:37:24 | 000,000,000 | —D | M]

[2009/01/31 22:21:43 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Mozilla\Extensions
[2010/07/10 10:07:01 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\b9dri3uz.default\extensions
[2010/05/08 14:09:22 | 000,000,000 | —D | M] (Greasemonkey) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\b9dri3uz.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010/05/08 14:09:25 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\b9dri3uz.default\extensions\[removed]
[2010/07/11 18:37:26 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/07/10 01:08:46 | 000,000,000 | —D | M] (TextAloud Firefox Plugin) – C:\Program Files\Mozilla Firefox\extensions\{99a0337c-6303-4879-b72e-500fd9aaca8c}
[2010/07/11 18:37:26 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/07/11 18:36:55 | 000,423,656 | —- | M] (Oracle) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2005/11/03 23:54:06 | 000,000,731 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (CNavExtBho Class) - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NAVSHEXT.DLL (Symantec Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Norton AntiVirus) - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NAVSHEXT.DLL (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton AntiVirus) - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NAVSHEXT.DLL (Symantec Corporation)
O4 - HKLM..\Run: [ccApp] c:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\Cpqset.exe ()
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\CHDAudPropShortcut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
O4 - HKLM..\Run: [MsmqIntCert] C:\WINDOWS\System32\mqrt.dll (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [RecGuard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - HKCU..\Run: [BitTorrent DNA] C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe (IGN Entertainment)
O4 - HKCU..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe (Methlabs)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\StartUp\HP Photosmart Premier Fast Start.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Development Company, L.P.)
O4 - Startup: C:\Documents and Settings\User\Start Menu\Programs\StartUp\MLB.TV NexDef Plug-in.lnk = C:\Documents and Settings\User\Local Settings\Application Data\Autobahn\mlb-nexdef-autobahn.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm ()
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm ()
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm ()
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll (Google Inc.)
O9 - Extra Button: iOpus iMacros - {0483894E-2422-45E0-8384-021AFF1AF3CD} - C:\Program Files\iMacros\imacros.dll File not found
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra Button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe File not found
O9 - Extra 'Tools' menuitem : PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} http://site.ebrary.com.oca.ucsc.edu/lib/uc…s/ebraryRdr.cab (Infotl Control)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} http://www.lizardtech.com/download/files/w…ntrol_en_US.cab (DjVuCtl Class)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab (CDownloadCtrl Object)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www2.snapfish.com/SnapfishActivia.cab (Snapfish Activia)
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab (SysData Class)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://daveandceline.spaces.live.com//Phot…ad/MsnPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {4F29DE54-5EB7-4D76-B610-A86B5CD2A234} http://archives.gametap.com/static/cab_hea…apWebPlayer.cab (GameTap Player)
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} http://www.systemrequirementslab.com/sysreqlab2.cab (System Requirements Lab Class)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/inst…tDetection2.cab (GMNRev Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} http://www.photofinale.com/ImageUploader3/ImageUploader3.cab (Aurigma Image Uploader 3.5 Control)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flash…ent/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O24 - Desktop BackupWallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001/07/27 22:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2004/04/30 14:01:14 | 000,000,053 | -HS- | M] () - D:\Autorun.inf – [ FAT32 ]
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun - "" = Auto&Play
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (70663829905735680)

========== Files/Folders - Created Within 30 Days ==========

[2010/07/11 18:37:59 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/07/11 18:37:24 | 000,423,656 | —- | C] (Oracle) – C:\WINDOWS\System32\deployJava1.dll
[2010/07/11 18:37:24 | 000,153,376 | —- | C] (Oracle) – C:\WINDOWS\System32\javaws.exe
[2010/07/11 18:37:24 | 000,145,184 | —- | C] (Oracle) – C:\WINDOWS\System32\javaw.exe
[2010/07/11 18:37:24 | 000,145,184 | —- | C] (Oracle) – C:\WINDOWS\System32\java.exe
[2010/07/11 18:37:24 | 000,073,728 | —- | C] (Oracle) – C:\WINDOWS\System32\javacpl.cpl
[2010/07/10 10:22:28 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/07/10 10:22:25 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/07/10 10:22:25 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/10 10:10:24 | 000,000,000 | —D | C] – C:\_OTL
[2010/07/09 14:05:35 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
[2010/07/08 20:41:35 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\User\Desktop\HiJackThis.exe
[2010/07/08 20:16:11 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Malwarebytes
[2010/07/08 20:15:58 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/07/08 20:14:58 | 006,153,352 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\User\Desktop\mbam-setup-1.46.exe
[2010/07/08 19:30:43 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2010/07/08 19:30:37 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun
[2010/07/08 14:00:48 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\HpUpdate
[2010/07/08 13:26:25 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/07/08 12:36:02 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/07/08 09:34:41 | 000,000,000 | RH-D | C] – C:\Documents and Settings\User\Recent
[2010/07/04 12:09:10 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/07/04 12:09:10 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/07/02 11:15:28 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Pimsleur Spanish I, II, III, & Plus (Complete Course) - Downsampled
[2010/07/02 11:13:50 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Learn Japanese (Pimsleur) (3rd Edition) (4 Audio CDs - MP3)
[2010/07/02 10:56:42 | 000,224,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tabctl32.ocx
[2010/07/02 10:56:42 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\iOpus-i-M
[2010/07/02 10:56:41 | 000,241,016 | —- | C] (iOpus Software GmbH) – C:\WINDOWS\System32\imatl.dll
[2010/07/02 10:56:40 | 000,000,000 | —D | C] – C:\Program Files\iMacros
[2010/06/24 09:46:19 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\California History
[2010/06/20 11:31:11 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/06/20 11:24:55 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2010/06/17 12:20:11 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\CSUS Spec. Coll
[2010/06/15 08:08:55 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\SF Library Archives
[2010/06/15 08:08:55 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Lowell High School
[2010/06/15 08:08:54 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\secondarys of interest for dissertation
[2010/06/15 08:08:54 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Hoover Institution PDFs
[2010/06/15 08:08:54 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\history reading
[2010/06/15 08:08:53 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Japan info for Dissertation
[2010/06/15 07:38:09 | 000,000,000 | R–D | C] – C:\Documents and Settings\User\Desktop\My Dropbox
[2010/06/15 07:35:30 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\Dropbox

========== Files - Modified Within 30 Days ==========

[2010/07/12 00:36:01 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/12 00:03:29 | 000,001,073 | —- | M] () – C:\hpqp.ini
[2010/07/11 18:41:55 | 000,000,039 | —- | M] () – C:\XP_TV.ini
[2010/07/11 18:41:53 | 000,050,868 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2010/07/11 18:40:49 | 000,000,878 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/11 18:40:44 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/11 18:40:26 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/11 18:38:54 | 007,077,888 | -H– | M] () – C:\Documents and Settings\User\NTUSER.DAT
[2010/07/11 18:38:54 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\User\ntuser.ini
[2010/07/11 18:36:53 | 000,423,656 | —- | M] (Oracle) – C:\WINDOWS\System32\deployJava1.dll
[2010/07/11 18:36:53 | 000,153,376 | —- | M] (Oracle) – C:\WINDOWS\System32\javaws.exe
[2010/07/11 18:36:53 | 000,145,184 | —- | M] (Oracle) – C:\WINDOWS\System32\javaw.exe
[2010/07/11 18:36:53 | 000,145,184 | —- | M] (Oracle) – C:\WINDOWS\System32\java.exe
[2010/07/11 18:36:53 | 000,073,728 | —- | M] (Oracle) – C:\WINDOWS\System32\javacpl.cpl
[2010/07/11 09:58:13 | 000,000,420 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{D183E32C-161B-4143-B951-9386A1095E28}.job
[2010/07/10 10:22:31 | 000,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/09 14:23:49 | 000,284,915 | —- | M] () – C:\Documents and Settings\User\Desktop\gmer.zip
[2010/07/09 14:05:36 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\User\Desktop\OTL.exe
[2010/07/08 20:41:39 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\User\Desktop\HiJackThis.exe
[2010/07/08 20:15:04 | 006,153,352 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\User\Desktop\mbam-setup-1.46.exe
[2010/07/08 19:30:36 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/07/08 14:02:11 | 000,000,765 | —- | M] () – C:\WINDOWS\win.ini
[2010/07/08 14:02:11 | 000,000,252 | —- | M] () – C:\WINDOWS\system.ini
[2010/07/08 14:02:11 | 000,000,209 | RHS- | M] () – C:\boot.ini
[2010/07/08 13:26:05 | 001,578,136 | -H– | M] () – C:\Documents and Settings\User\Local Settings\Application Data\IconCache.db
[2010/07/08 13:11:55 | 000,027,136 | —- | M] () – C:\Documents and Settings\User\Desktop\email for ca history student.doc
[2010/07/08 12:55:05 | 000,042,885 | —- | M] () – C:\Documents and Settings\User\Desktop\Notes for student - California History Guest Lecture.pdf
[2010/07/08 12:54:28 | 000,053,248 | —- | M] () – C:\Documents and Settings\User\Desktop\Notes for student - California History Guest Lecture.doc
[2010/07/07 09:53:26 | 000,001,729 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/07/06 23:01:48 | 000,146,432 | —- | M] () – C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/06 00:22:03 | 000,055,296 | —- | M] () – C:\Documents and Settings\User\Desktop\California History Guest Lecture.doc
[2010/07/03 09:23:57 | 000,023,733 | —- | M] () – C:\Documents and Settings\User\Desktop\eliza's prog era CALecture4.docx
[2010/07/02 09:54:39 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/06/30 22:03:54 | 000,060,928 | —- | M] () – C:\Documents and Settings\User\Desktop\hospice time sheet.doc
[2010/06/26 08:10:27 | 000,000,837 | —- | M] () – C:\Documents and Settings\User\Desktop\Internet Explorer.lnk
[2010/06/23 00:07:15 | 000,064,168 | -H– | M] () – C:\WINDOWS\System32\mlfcache.dat
[2010/06/20 22:00:35 | 000,000,020 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
[2010/06/20 22:00:35 | 000,000,020 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\PKP_DLds.DAT
[2010/06/19 15:02:24 | 001,901,453 | —- | M] () – C:\Documents and Settings\User\Desktop\The_white_peril_in_the_Far_East.pdf
[2010/06/17 15:28:43 | 010,238,893 | —- | M] () – C:\Documents and Settings\User\Desktop\The_American_Japanese_problem_2.pdf
[2010/06/17 15:00:00 | 002,265,858 | —- | M] () – C:\Documents and Settings\User\Desktop\Should_Congress_enact_special_laws_affec.pdf
[2010/06/17 13:08:19 | 000,148,597 | —- | M] () – C:\Documents and Settings\User\Desktop\in school deferment form.pdf
[2010/06/15 13:52:14 | 000,060,978 | —- | M] () – C:\Documents and Settings\User\Desktop\for parents IHR Dissertation Fellowship Proposal.xml
[2010/06/13 20:51:52 | 000,493,364 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/13 20:51:52 | 000,420,520 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/13 20:51:52 | 000,067,732 | —- | M] () – C:\WINDOWS\System32\perfc009.dat

========== Files Created - No Company Name ==========

[2010/07/10 10:22:31 | 000,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/09 14:24:04 | 000,293,376 | —- | C] () – C:\Documents and Settings\User\Desktop\gmer.exe
[2010/07/09 14:23:45 | 000,284,915 | —- | C] () – C:\Documents and Settings\User\Desktop\gmer.zip
[2010/07/08 13:49:48 | 000,001,648 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NkbMonitor.exe.lnk
[2010/07/08 13:49:48 | 000,000,798 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
[2010/07/08 13:49:47 | 000,001,121 | —- | C] () – C:\Documents and Settings\User\Start Menu\Programs\StartUp\MLB.TV NexDef Plug-in.lnk
[2010/07/08 13:11:55 | 000,027,136 | —- | C] () – C:\Documents and Settings\User\Desktop\email for ca history student.doc
[2010/07/08 12:54:54 | 000,042,885 | —- | C] () – C:\Documents and Settings\User\Desktop\Notes for student - California History Guest Lecture.pdf
[2010/07/08 12:54:28 | 000,053,248 | —- | C] () – C:\Documents and Settings\User\Desktop\Notes for student - California History Guest Lecture.doc
[2010/07/03 09:24:11 | 000,023,733 | —- | C] () – C:\Documents and Settings\User\Desktop\eliza's prog era CALecture4.docx
[2010/07/01 07:10:17 | 000,055,296 | —- | C] () – C:\Documents and Settings\User\Desktop\California History Guest Lecture.doc
[2010/06/30 22:03:53 | 000,060,928 | —- | C] () – C:\Documents and Settings\User\Desktop\hospice time sheet.doc
[2010/06/20 11:32:00 | 000,002,137 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/06/19 15:02:21 | 001,901,453 | —- | C] () – C:\Documents and Settings\User\Desktop\The_white_peril_in_the_Far_East.pdf
[2010/06/19 14:49:18 | 010,238,893 | —- | C] () – C:\Documents and Settings\User\Desktop\The_American_Japanese_problem_2.pdf
[2010/06/17 14:59:03 | 002,265,858 | —- | C] () – C:\Documents and Settings\User\Desktop\Should_Congress_enact_special_laws_affec.pdf
[2010/06/17 13:08:19 | 000,148,597 | —- | C] () – C:\Documents and Settings\User\Desktop\in school deferment form.pdf
[2010/06/15 13:52:13 | 000,060,978 | —- | C] () – C:\Documents and Settings\User\Desktop\for parents IHR Dissertation Fellowship Proposal.xml
[2010/06/15 08:13:29 | 000,167,793 | —- | C] () – C:\Documents and Settings\User\Desktop\foucault Discipline_and_Publish_ch3.pdf
[2010/06/15 07:43:41 | 008,373,134 | —- | C] () – C:\Documents and Settings\User\Desktop\Kubo p.187 on int. of J. The Pedagogical seminary, GSHall's Journal.pdf
[2008/12/21 12:00:57 | 000,001,002 | —- | C] () – C:\WINDOWS\Dartemup.ini
[2008/08/04 23:07:20 | 000,065,216 | —- | C] () – C:\WINDOWS\System32\PDFreDirectMonNT.dll
[2008/03/10 09:38:28 | 000,051,370 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2008/01/20 12:07:39 | 000,166,216 | —- | C] () – C:\WINDOWS\System32\contmenu.dll
[2008/01/04 14:58:50 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/01/04 14:57:22 | 000,000,416 | —- | C] () – C:\WINDOWS\System32\dtu100.dll.manifest
[2008/01/04 14:57:22 | 000,000,416 | —- | C] () – C:\WINDOWS\System32\dpl100.dll.manifest
[2008/01/04 14:56:24 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2007/12/22 20:40:13 | 000,000,504 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2007/10/11 18:59:24 | 000,025,624 | —- | C] () – C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2007/04/02 20:33:57 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\hpzids01.dll
[2007/03/31 17:28:18 | 000,000,132 | —- | C] () – C:\WINDOWS\cool.ini
[2007/03/31 17:26:21 | 000,000,011 | —- | C] () – C:\WINDOWS\wordpad.ini
[2007/03/27 18:33:20 | 000,167,456 | —- | C] () – C:\WINDOWS\System32\BOCOF.DLL
[2007/03/27 18:33:20 | 000,004,052 | —- | C] () – C:\WINDOWS\unwise32.ini
[2006/10/06 12:58:58 | 000,000,174 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2006/10/06 12:56:29 | 000,000,698 | —- | C] () – C:\WINDOWS\NSSetDefaultBrowser.ini
[2006/10/06 12:36:15 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/10/06 12:28:34 | 000,028,836 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2006/04/15 15:26:00 | 001,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/04/15 15:26:00 | 001,466,368 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/04/15 15:26:00 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/04/15 15:26:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/04/15 15:26:00 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2006/03/28 06:51:10 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/03/28 06:15:24 | 000,000,108 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/03/28 06:12:08 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2005/12/02 11:09:10 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/08/05 23:01:54 | 000,235,008 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/01/13 12:46:34 | 000,172,032 | —- | C] () – C:\WINDOWS\System32\tifmicon.dll
[2003/01/07 13:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[1996/04/03 12:33:26 | 000,005,248 | —- | C] () – C:\WINDOWS\System32\giveio.sys

========== LOP Check ==========

[2008/06/05 22:37:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Age of Empires 3 YPack Trial
[2006/10/06 14:42:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DIGStream
[2007/05/11 12:18:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2007/12/17 00:50:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GameTap
[2010/06/09 10:05:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GameTap Web Player
[2010/07/02 10:56:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iOpus-i-M
[2007/05/08 11:49:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nikon
[2007/05/08 11:49:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Radio Sounds
[2008/11/29 13:02:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SpeedBit
[2007/03/31 11:08:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\StarzEntertainment
[2010/07/11 18:35:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/04/17 23:09:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TrackMania
[2007/05/11 12:18:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2008/11/29 23:32:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WildTangent
[2010/04/08 11:28:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/02/09 18:24:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/06/21 15:45:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2007/10/01 20:17:09 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\.glconnect
[2010/05/02 10:03:27 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Amazon
[2010/04/12 21:50:22 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\AnvSoft
[2010/02/01 12:01:23 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\BonkEnc
[2009/02/11 11:59:25 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/07/12 00:43:29 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\DNA
[2010/07/05 23:50:48 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Dropbox
[2007/11/26 01:59:38 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\fretsonfire
[2007/11/20 23:18:29 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\GetRightToGo
[2008/11/28 23:38:54 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\iWin
[2007/11/16 01:42:24 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Leadertech
[2009/10/08 11:22:44 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\LimeWire
[2008/01/20 19:48:49 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\MSNShell
[2008/01/04 11:49:42 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Netscape
[2007/07/05 03:47:19 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Nikon
[2010/05/20 15:13:41 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\PDF reDirect
[2007/06/24 13:55:16 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Snapfish
[2009/10/09 16:25:32 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Template
[2007/09/09 21:00:23 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\Ultimate Spanish
[2007/04/01 09:14:05 | 000,000,000 | —D | M] – C:\Documents and Settings\User\Application Data\WildTangent
[2009/10/29 16:16:47 | 000,000,104 | —- | M] () – C:\WINDOWS\Tasks\Critical Battery Alarm Program.job
[2009/07/25 11:48:28 | 000,000,104 | —- | M] () – C:\WINDOWS\Tasks\Low Battery Alarm Program.job
[2010/07/11 09:58:13 | 000,000,420 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{D183E32C-161B-4143-B951-9386A1095E28}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2004/08/10 00:00:00 | 016,971,599 | —- | M] () .cab file – C:\I386\sp2.cab:AGP440.sys
[2004/08/10 08:00:00 | 016,971,599 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/09/28 11:48:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/09/28 11:48:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 11:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 11:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/04 08:07:42 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/10 00:00:00 | 016,971,599 | —- | M] () .cab file – C:\I386\sp2.cab:atapi.sys
[2004/08/10 08:00:00 | 016,971,599 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/09/28 11:48:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/09/28 11:48:59 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 11:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 11:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 22:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/04 07:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 17:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 17:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/10 08:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: IASTOR.SYS >
[2005/10/13 02:07:12 | 000,874,240 | —- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B – C:\SWSETUP\HDD\iastor.sys
[2005/10/13 02:07:12 | 000,874,240 | —- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B – C:\WINDOWS\system32\drivers\iaStor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/13 17:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 17:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2004/08/10 08:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/10 08:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 17:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 17:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/04/13 17:11:51 | 001,267,200 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\comsvcs.dll
[2009/03/08 05:31:44 | 000,348,160 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtmsft.dll
[2009/03/08 05:31:38 | 000,216,064 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtrans.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2006/03/27 21:30:26 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2006/03/27 21:30:26 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2006/03/27 21:30:26 | 000,888,832 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\drivers\*.sys /90 >
[2010/04/29 15:39:26 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbam.sys
[2010/04/29 15:39:38 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys
[2010/04/19 20:47:42 | 000,041,984 | —- | M] (Apple, Inc.) – C:\WINDOWS\system32\drivers\usbaapl.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0F8F5844
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5BB923A2
< End of report >