Google Redirect

I would really appreciate some help on getting rid of these redirects. Here are the logs I've taken using OTL:

OTL logfile created on: 08/09/2010 16:12:46 - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Users\Peter\Desktop
Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 57.00% Memory free
7.00 Gb Paging File | 5.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.70 Gb Total Space | 132.66 Gb Free Space | 29.11% Space Free | Partition Type: NTFS
Drive D: | 465.76 Gb Total Space | 272.25 Gb Free Space | 58.45% Space Free | Partition Type: NTFS
Drive E: | 10.00 Gb Total Space | 5.79 Gb Free Space | 57.95% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive Z: | 458.10 Gb Total Space | 272.98 Gb Free Space | 59.59% Space Free | Partition Type: NTFS

Computer Name: PETER-PC
Current User Name: Peter
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Peter\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\System32\atashost.exe (WebEx Communications, Inc.)
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\Peter\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing, S.L.)
PRC - C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
PRC - C:\Program Files\Unlocker\UnlockerAssistant.exe ()
PRC - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files\UltraMon\UltraMonUiAcc.exe (Realtime Soft Ltd)
PRC - C:\Program Files\UltraMon\UltraMonTaskbar.exe (Realtime Soft Ltd)
PRC - C:\Program Files\UltraMon\UltraMon.exe (Realtime Soft Ltd)
PRC - C:\Program Files\Common Files\Sage SData\Sage.SData.Service.exe (Sage (UK) Limited)
PRC - C:\Windows\csifcsvc.exe (Thomson Reuters)
PRC - C:\Program Files\PFU\ScanSnap\Driver\PfuSsMon.exe (PFU LIMITED)
PRC - C:\Program Files\PFU\ScanSnap\CardMinder\CardLauncher.exe (PFU LIMITED)
PRC - C:\Program Files\PFU\Rack2\RKiwrtK.exe (PFU LIMITED)
PRC - c:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.)
PRC - C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
PRC - C:\Program Files\PFU\Rack2\Rkasynct.exe (PFU LIMITED)
PRC - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe (American Power Conversion Corporation)
PRC - C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe (American Power Conversion Corporation)
PRC - C:\Program Files\Common Files\aol\1252186683\ee\aolsoftware.exe (AOL LLC)
PRC - C:\Program Files\Common Files\aol\acs\AOLacsd.exe (AOL LLC)


========== Modules (SafeList) ==========

MOD - C:\Users\Peter\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_5090ab56bcba71c
2\msvcr90.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_5090ab56bcba71c
2\msvcp90.dll (Microsoft Corporation)
MOD - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\asoehook.dll (Symantec Corporation)
MOD - C:\Program Files\Unlocker\UnlockerHook.dll ()
MOD - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll (RealPlayer)
MOD - C:\Program Files\UltraMon\RTSUltraMonHook.dll (Realtime Soft Ltd)
MOD - C:\Program Files\UltraMon\UltraMonResButtons.dll (Realtime Soft Ltd)
MOD - C:\Windows\System32\networkexplorer.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\davclnt.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cscapi.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\GdiPlus.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\PFU\ScanSnap\CardMinder\CardHook.dll (PFU Limited.)
MOD - C:\Program Files\PFU\ScanSnap\CardMinder\CardCommon.dll (PFU Limited.)
MOD - C:\Windows\System32\ntlanman.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\drprov.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msvcp71.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msvcr71.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (atashost) – C:\Windows\System32\atashost.exe (WebEx Communications, Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (QBCFMonitorService) – C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe (Intuit)
SRV - (Microsoft SharePoint Workspace Audit Service) – C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (aspnet_state) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe (Microsoft Corporation)
SRV - (WPFFontCache_v0400) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (NetTcpPortSharing) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (NetTcpActivator) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (NetPipeActivator) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (NetMsmqActivator) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (NIS) – C:\Program Files\Norton Internet Security\Engine\17.7.0.12\ccSvcHst.exe (Symantec Corporation)
SRV - (osppsvc) – C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (Sage SData Service) – C:\Program Files\Common Files\Sage SData\Sage.SData.Service.exe (Sage (UK) Limited)
SRV - (FCPrintService) – C:\Windows\csifcsvc.exe (Thomson Reuters)
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\570\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (ioloSystemService) – C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe ()
SRV - (ioloFileInfoList) – C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe ()
SRV - (SandraAgentSrv) – C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP4\RpcAgentSrv.exe (SiSoftware)
SRV - (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ) – c:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (MSSQLSERVER) SQL Server (MSSQLSERVER) – C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.)
SRV - (SQLBrowser) – C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
SRV - (MSSQLServerADHelper) – C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation)
SRV - (SQLWriter) – C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
SRV - (NasPmService) – C:\Program Files\BUFFALO\NASNAVI\nassvc.exe (BUFFALO INC.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AERTFilters) – C:\Windows\System32\AERTSrv.exe (Andrea Electronics Corporation)
SRV - (APC UPS Service) – C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe (American Power Conversion Corporation)
SRV - (QBFCService) – C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe (Intuit Inc.)
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)


========== Driver Services (SafeList) ==========

DRV - (NwlnkFwd) – C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) – C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (BHDrvx86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20100810.004\BHDrvx86.sys (Symantec Corporation)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100907.048\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100907.048\NAVENG.SYS (Symantec Corporation)
DRV - (IDSVix86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100906.001\IDSvix86.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (SYMTDIv) – C:\Windows\System32\Drivers\NIS\1107000.00C\SYMTDIV.SYS (Symantec Corporation)
DRV - (SymIRON) – C:\Windows\system32\drivers\NIS\1107000.00C\Ironx86.SYS (Symantec Corporation)
DRV - (fssfltr) – C:\Windows\System32\drivers\fssfltr.sys (Microsoft Corporation)
DRV - (SymEFA) – C:\Windows\system32\drivers\NIS\1107000.00C\SYMEFA.SYS (Symantec Corporation)
DRV - (SRTSP) – C:\Windows\System32\Drivers\NIS\1107000.00C\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\system32\drivers\NIS\1107000.00C\SRTSPX.SYS (Symantec Corporation)
DRV - (ccHP) – C:\Windows\system32\drivers\NIS\1107000.00C\ccHPx86.sys (Symantec Corporation)
DRV - (SymDS) – C:\Windows\system32\drivers\NIS\1107000.00C\SYMDS.SYS (Symantec Corporation)
DRV - (SymEvent) – C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (SANDRA) – C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP4\WNt500x86\sandra.sys (SiSoftware)
DRV - (cpuz132) – C:\Windows\System32\drivers\cpuz132_x32.sys (Windows ® Codename Longhorn DDK provider)
DRV - (ElRawDisk) – C:\Windows\System32\drivers\elrawdsk.sys (EldoS Corporation)
DRV - (UltraMonUtility) – C:\Program Files\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys (Realtime Soft Ltd)
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (MegaSR) – C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (HidBatt) – C:\Windows\System32\drivers\hidbatt.sys (Microsoft Corporation)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (AVMNgTunM779) – C:\Windows\System32\drivers\AVerTun.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV - (AVMNgCapM779) – C:\Windows\System32\drivers\AVerCap.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV - (AVMNgBasM779) – C:\Windows\System32\drivers\AVerBas.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV - (wanatw) WAN Miniport (ATW) – C:\Windows\System32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (FileDisk) – C:\Windows\System32\drivers\filedisk.sys (iolo technologies, LLC (based on original work by Bo Brantén))
DRV - (HPFXBULK) – C:\Windows\System32\drivers\hpfxbulk.sys (Hewlett Packard)
DRV - (Aspi32) – C:\Windows\System32\drivers\aspi32.sys (Adaptec)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {4a6e1b85-1193-4a2a-aab8-7417f275f18a} - C:\Program Files\AOL Broadband Toolbar\aolbbtb.dll (AOL LLC.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/news/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 20 CA EC 0E F8 82 CA 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\..\URLSearchHook: {4a6e1b85-1193-4a2a-aab8-7417f275f18a} - C:\Program Files\AOL Broadband Toolbar\aolbbtb.dll (AOL LLC.)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AOL Search powered by Google"
FF - prefs.js..browser.search.defaulturl: "http://search.aol.co.uk/aol/search?query={searchTerms}&invocationType;=tb50-ff-aolbbTB50CL-chromesbox-en-uk"
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.aol.co.uk"
FF - prefs.js..extensions.enabledItems: [removed]:1.5.5.1982
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313
FF - prefs.js..extensions.enabledItems: {796503e4-19fe-48a3-82da-5c1fe0a13e3f}:5.0.0.3553
FF - prefs.js..extensions.enabledItems: {c2f863cd-0429-48c7-bb54-db756a951760}:5.96.10.6044
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.5
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:4.6
FF - prefs.js..keyword.URL: "http://search.aol.co.uk/aol/search?invocationType=tb50-ff-aolbbTB50CL-ab-en-uk&query;="


FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\ [2010/06/02 02:34:18 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\ [2010/01/13 04:18:58 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/08/17 08:21:38 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/18 16:33:05 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/07 22:31:20 | 000,000,000 | —D | M]

[2009/09/05 12:03:56 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Mozilla\Extensions
[2010/09/08 11:52:23 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\c5l0myxl.default\extensions
[2010/05/29 18:16:32 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\c5l0myxl.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/08/19 23:36:53 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\c5l0myxl.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/12/29 01:13:53 | 000,000,000 | —D | M] (AOL Broadband Toolbar) – C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\c5l0myxl.default\extensions\{796503e4-19fe-48a3-82da-5c1fe0a13e3f}
[2010/08/19 23:37:26 | 000,000,000 | —D | M] (No name found) – C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\c5l0myxl.default\extensions\{c2f863cd-0429-48c7-bb54-db756a951760}
[2010/05/27 10:08:39 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\c5l0myxl.default\extensions\[removed]
[2009/12/04 05:16:42 | 000,004,554 | —- | M] () – C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\c5l0myxl.default\searchplugins\aim-search-1.xml
[2009/09/10 13:38:56 | 000,004,212 | —- | M] () – C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\c5l0myxl.default\searchplugins\aim-search.xml
[2009/12/29 01:18:42 | 000,004,602 | —- | M] () – C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\c5l0myxl.default\searchplugins\aol-search-powered-by-google.xml
[2010/09/08 11:52:23 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/04/06 07:05:44 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/04/06 07:05:44 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/04/06 07:05:44 | 000,000,769 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/04/06 07:05:44 | 000,001,135 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/09/07 21:42:06 | 000,001,784 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 212.95.49.48 www.google.com
O1 - Hosts: 212.95.49.48 us.search.yahoo.com
O1 - Hosts: 212.95.49.48 uk.search.yahoo.com
O1 - Hosts: 212.95.49.48 search.yahoo.com
O1 - Hosts: 212.95.49.48 www.google.com.br
O1 - Hosts: 212.95.49.48 www.google.it
O1 - Hosts: 212.95.49.48 www.google.es
O1 - Hosts: 212.95.49.48 www.google.co.jp
O1 - Hosts: 212.95.49.48 www.google.com.mx
O1 - Hosts: 212.95.49.48 www.google.ca
O1 - Hosts: 212.95.49.48 www.google.com.au
O1 - Hosts: 212.95.49.48 www.google.nl
O1 - Hosts: 212.95.49.48 www.google.co.za
O1 - Hosts: 212.95.49.48 www.google.be
O1 - Hosts: 212.95.49.48 www.google.gr
O1 - Hosts: 212.95.49.48 www.google.at
O1 - Hosts: 212.95.49.48 www.google.se
O1 - Hosts: 212.95.49.48 www.google.ch
O1 - Hosts: 212.95.49.48 www.google.pt
O1 - Hosts: 212.95.49.48 www.google.dk
O1 - Hosts: 212.95.49.48 www.google.fi
O1 - Hosts: 212.95.49.48 www.google.ie
O1 - Hosts: 212.95.49.48 www.google.no
O1 - Hosts: 4 more lines…
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (AOL Broadband Toolbar Loader) - {776a9d06-e178-4aa0-aee4-b4de3a64ad28} - C:\Program Files\AOL Broadband Toolbar\aolbbtb.dll (AOL LLC.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (&Windows; Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (AOL Broadband Toolbar) - {e6ed7f95-e571-4f81-8757-5eb11252703d} - C:\Program Files\AOL Broadband Toolbar\aolbbtb.dll (AOL LLC.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows; Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Broadband Toolbar) - {E6ED7F95-E571-4F81-8757-5EB11252703D} - C:\Program Files\AOL Broadband Toolbar\aolbbtb.dll (AOL LLC.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\aol\1252186683\ee\aolsoftware.exe (AOL LLC)
O4 - HKLM..\Run: [Nuance PDF Reader-reminder] C:\Program Files\Nuance\PDF Reader\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [Rkiwrtk] C:\Program Files\PFU\Rack2\RKiwrtK.exe (PFU LIMITED)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()
O4 - HKCU..\Run: [Backup4all OTB Agent] File not found
O4 - HKCU..\Run: [Backup4all Scheduler] File not found
O4 - HKCU..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
O4 - Startup: C:\Users\Peter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O8 - Extra context menu item: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Se&nd; to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog; This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked; Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked; Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.5.3.cab (DLM Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.254.254 [removed] [removed]
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\570\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\570\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O22 - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\System32\DreamScene.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2009/12/19 00:05:41 | 000,000,000 | —D | M] - C:\AutoRoute 2010 – [ NTFS ]
O32 - AutoRun File - [2007/11/10 09:26:28 | 000,027,332 | —- | M] () - Z:\Auto-Protect is Off.pdf – [ NTFS ]
O32 - AutoRun File - [1999/04/26 23:11:24 | 000,034,304 | —- | M] () - Z:\Autoglass.doc – [ NTFS ]
O32 - AutoRun File - [2002/05/24 23:02:20 | 000,024,576 | —- | M] () - Z:\Autoview.doc – [ NTFS ]
O32 - AutoRun File - [2009/12/18 23:33:44 | 000,000,000 | —D | M] - Z:\AutoRoute 2010 – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2010/09/08 16:08:23 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Users\Peter\Desktop\OTL.exe
[2010/09/08 15:39:54 | 000,000,000 | —D | C] – C:\Users\Peter\AppData\Local\Adobe
[2010/09/08 15:38:23 | 000,000,000 | —D | C] – C:\Users\Peter\Desktop\GooredFix Backups
[2010/09/08 13:03:12 | 000,000,000 | —D | C] – \\LS-QL109\Peter\VirusProblem
[2010/09/08 12:07:55 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/09/07 14:44:52 | 001,293,400 | —- | C] (Kaspersky Lab ZAO) – C:\Users\Peter\Desktop\TDSSKiller.exe
[2010/09/07 10:18:17 | 000,029,272 | R— | C] (Adobe Systems Incorporated.) – C:\Windows\System32\AdobePDF.dll
[2010/09/03 13:21:04 | 000,000,000 | —D | C] – C:\Users\Peter\AppData\Local\Thomson Reuters
[2010/09/02 18:26:28 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/09/02 18:26:27 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/08/26 14:06:18 | 000,118,784 | —- | C] (Thomson Reuters) – C:\Windows\csifcsvc.exe
[2010/08/26 14:06:14 | 000,011,264 | —- | C] (Thomson Reuters) – C:\Windows\fcpurge.exe
[2010/08/26 14:04:45 | 000,000,000 | —D | C] – C:\WinCSI
[2010/08/26 14:00:44 | 000,104,328 | —- | C] (WebEx Communications, Inc.) – C:\Windows\System32\atsckernel.exe
[2010/08/26 14:00:43 | 000,043,912 | —- | C] (WebEx Communications, Inc.) – C:\Windows\System32\atashost.exe
[2010/08/20 21:03:12 | 000,000,000 | —D | C] – C:\Users\Peter\AppData\Local\WinZip
[2010/08/18 16:32:13 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2010/08/17 08:21:02 | 000,000,000 | —D | C] – C:\Program Files\Common Files\xing shared
[2010/08/14 21:45:50 | 000,000,000 | —D | C] – C:\ProgramData\DivX
[2010/08/13 22:03:48 | 000,000,000 | —D | C] – C:\ProgramData\Syscon
[2010/08/13 21:44:59 | 000,000,000 | —D | C] – C:\Users\Peter\AppData\Roaming\Fujitsu
[2010/08/13 21:36:43 | 000,000,000 | —D | C] – C:\ProgramData\PFU
[2010/08/13 21:34:10 | 000,000,000 | —D | C] – \\LS-QL109\Peter\Raku2Personal
[2010/08/13 21:32:22 | 000,000,000 | —D | C] – C:\Users\Peter\AppData\Roaming\InstallShield
[2010/08/13 21:12:24 | 000,000,000 | —D | C] – C:\Users\Peter\AppData\Roaming\PFU
[2010/08/13 20:34:16 | 000,000,000 | —D | C] – C:\Program Files\ABBYY FineReader for ScanSnap
[2010/08/13 20:32:22 | 000,035,328 | —- | C] (PFU) – C:\Windows\System32\pfdvmn.dll
[2010/08/13 20:32:22 | 000,032,768 | —- | C] (PFU) – C:\Windows\System32\chksti.dll
[2010/08/13 20:32:22 | 000,031,232 | —- | C] (PFU) – C:\Windows\System32\pfusti.dll
[2010/08/13 20:32:00 | 000,393,216 | —- | C] (PFU Limited.) – C:\Windows\System32\PFUP60.dll
[2010/08/13 20:32:00 | 000,249,856 | —- | C] (PFU Limited.) – C:\Windows\System32\PFURT.dll
[2010/08/13 20:32:00 | 000,069,632 | —- | C] (PFU Limited.) – C:\Windows\System32\PFUIRT.dll
[2010/08/13 20:23:27 | 001,990,656 | —- | C] (PFU Limited) – C:\Windows\System32\ippi5s300.dll
[2010/08/13 20:23:27 | 001,990,656 | —- | C] (PFU Limited) – C:\Windows\System32\ippi5s1300.dll
[2010/08/13 20:23:27 | 001,302,528 | —- | C] (PFU Limited) – C:\Windows\System32\ijl5s300.dll
[2010/08/13 20:23:27 | 001,302,528 | —- | C] (PFU Limited) – C:\Windows\System32\ijl5s1300.dll
[2010/08/13 20:23:27 | 000,279,552 | —- | C] (PFU Limited) – C:\Windows\System32\S1300u.dll
[2010/08/13 20:23:27 | 000,264,192 | —- | C] (PFU Limited) – C:\Windows\System32\s300u.dll
[2010/08/13 20:23:27 | 000,024,064 | —- | C] (PFU) – C:\Windows\System32\Fjmcusb.dll
[2010/08/13 20:23:27 | 000,021,504 | —- | C] (PFU) – C:\Windows\System32\fj52usb.dll
[2010/08/13 20:23:20 | 000,069,632 | —- | C] (PFU LIMITED) – C:\Windows\System32\distortion.dll
[2010/08/13 20:23:17 | 000,000,000 | —D | C] – C:\Windows\SSDriver
[2010/08/13 20:22:29 | 000,000,000 | —D | C] – C:\Program Files\PFU
[2010/08/13 20:22:29 | 000,000,000 | —D | C] – C:\Program Files\Common Files\PFU
[2010/08/11 23:20:17 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2010/08/11 23:20:17 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2010/08/11 23:20:17 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2010/08/11 23:20:17 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2010/08/11 23:20:17 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2010/08/11 23:20:17 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2010/08/11 23:20:17 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2010/08/11 23:20:16 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2010/08/11 23:20:16 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2010/08/11 23:20:16 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2010/08/11 23:20:16 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2010/08/11 23:20:16 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2010/08/11 23:20:16 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2010/08/11 23:20:16 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2010/08/11 23:20:16 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2010/08/11 23:20:15 | 000,081,920 | —- | C] (Radius Inc.) – C:\Windows\System32\iccvid.dll
[2010/08/11 23:20:07 | 002,037,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2010/08/11 23:20:06 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rtutils.dll
[2010/08/11 23:19:55 | 003,600,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2010/08/11 23:19:55 | 003,548,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2010/08/11 15:00:04 | 000,000,000 | —D | C] – \\LS-QL109\Peter\kidsgrandfather
[2010/08/10 05:15:58 | 000,094,208 | —- | C] (Apple Inc.) – C:\Windows\System32\QuickTimeVR.qtx
[2010/08/10 05:15:58 | 000,069,632 | —- | C] (Apple Inc.) – C:\Windows\System32\QuickTime.qts
[2009/06/30 21:05:18 | 000,018,944 | —- | C] ( ) – C:\Windows\System32\implode.dll
[2008/12/23 09:32:46 | 000,184,320 | R— | C] ( ) – C:\Windows\System32\SgE.interop.MSXML2.dll
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[10 C:\Users\Public\Documents\*.tmp files -> C:\Users\Public\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/09/08 16:21:00 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/09/08 16:20:10 | 008,650,752 | -HS- | M] () – C:\Users\Peter\ntuser.dat
[2010/09/08 16:20:04 | 000,000,906 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-928310548-3610001372-2690045346-1000UA.job
[2010/09/08 16:12:17 | 1763,582,975 | —- | M] () – C:\Users\Peter\Peter.pst
[2010/09/08 16:10:39 | 000,169,472 | —- | M] () – C:\Users\Peter\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/08 16:08:24 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\Peter\Desktop\OTL.exe
[2010/09/08 15:59:43 | 000,002,359 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\UltraMon.lnk
[2010/09/08 15:59:32 | 000,000,878 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/09/08 15:59:15 | 000,004,000 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/09/08 15:59:15 | 000,004,000 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/09/08 15:59:14 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/09/08 15:59:12 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/09/08 15:59:04 | 3487,748,096 | -HS- | M] () – C:\hiberfil.sys
[2010/09/08 15:57:36 | 000,524,288 | -HS- | M] () – C:\Users\Peter\ntuser.dat{32247a3c-9bc9-11de-94a6-97a5ca6fbc0e}.TMContainer00000000000000000001.regtrans-ms
[2010/09/08 15:57:36 | 000,065,536 | -HS- | M] () – C:\Users\Peter\ntuser.dat{32247a3c-9bc9-11de-94a6-97a5ca6fbc0e}.TM.blf
[2010/09/08 15:57:34 | 004,276,363 | -H– | M] () – C:\Users\Peter\AppData\Local\IconCache.db
[2010/09/08 15:48:12 | 000,001,358 | —- | M] () – C:\Windows\win.ini
[2010/09/08 14:56:59 | 000,000,422 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{A42855A4-FB33-454F-B9C9-979B2841FC40}.job
[2010/09/08 14:52:09 | 000,001,854 | —- | M] () – C:\Users\Peter\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2010/09/08 14:52:08 | 000,001,854 | —- | M] () – C:\Users\Public\Desktop\Safari.lnk
[2010/09/08 14:01:56 | 000,039,808 | —- | M] () – \\LS-QL109\Peter\CIOT - Tax advisers critici…pdf
[2010/09/08 14:00:54 | 000,041,390 | —- | M] () – \\LS-QL109\Peter\CIOT - HMRC cuts - Withdraw…pdf
[2010/09/08 12:07:55 | 000,001,948 | —- | M] () – C:\Users\Peter\Desktop\HiJackThis.lnk
[2010/09/08 11:54:16 | 000,015,216 | —- | M] () – \\LS-QL109\Peter\VirusProblem.docx
[2010/09/08 09:14:40 | 000,000,085 | —- | M] () – C:\Windows\SGREP32.INI
[2010/09/08 09:05:41 | 000,001,896 | —- | M] () – C:\Windows\System32\SGLCH32.USR
[2010/09/08 06:39:02 | 000,024,428 | —- | M] () – \\LS-QL109\Peter\CashFlow2010-09.xlsx
[2010/09/08 00:20:24 | 000,000,854 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-928310548-3610001372-2690045346-1000Core.job
[2010/09/07 20:53:05 | 000,000,474 | -H– | M] () – C:\Windows\tasks\Norton Security Scan for Peter.job
[2010/09/07 14:44:52 | 001,293,400 | —- | M] (Kaspersky Lab ZAO) – C:\Users\Peter\Desktop\TDSSKiller.exe
[2010/09/01 13:38:36 | 000,000,900 | —- | M] () – C:\Users\Public\Documents\forms.gif
[2010/09/01 13:38:36 | 000,000,887 | —- | M] () – C:\Users\Public\Documents\ticked-enabled.gif
[2010/09/01 13:38:36 | 000,000,887 | —- | M] () – C:\Users\Public\Documents\Finalised.gif
[2010/09/01 13:38:36 | 000,000,862 | —- | M] () – C:\Users\Public\Documents\unticked-enabled.gif
[2010/09/01 13:38:36 | 000,000,858 | —- | M] () – C:\Users\Public\Documents\ticked-disabled.gif
[2010/09/01 13:38:36 | 000,000,857 | —- | M] () – C:\Users\Public\Documents\Empty.gif
[2010/09/01 13:38:36 | 000,000,849 | —- | M] () – C:\Users\Public\Documents\unticked-disabled.gif
[2010/09/01 13:38:35 | 000,000,862 | —- | M] () – C:\Users\Public\Documents\SchedIncomplete.gif
[2010/09/01 08:04:26 | 000,025,135 | —- | M] () – \\LS-QL109\Peter\CashFlow2010-08.xlsx
[2010/08/26 14:05:36 | 000,001,309 | —- | M] () – C:\Users\Public\Desktop\FileCabinet CS.lnk
[2010/08/26 14:00:37 | 000,104,328 | —- | M] (WebEx Communications, Inc.) – C:\Windows\System32\atsckernel.exe
[2010/08/26 14:00:37 | 000,043,912 | —- | M] (WebEx Communications, Inc.) – C:\Windows\System32\atashost.exe
[2010/08/20 21:02:30 | 000,001,750 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
[2010/08/20 12:31:31 | 000,390,152 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/08/17 08:21:26 | 000,185,920 | —- | M] (RealNetworks, Inc.) – C:\Windows\System32\rmoc3260.dll
[2010/08/17 08:21:14 | 000,006,656 | —- | M] (RealNetworks, Inc.) – C:\Windows\System32\pndx5016.dll
[2010/08/17 08:21:14 | 000,005,632 | —- | M] (RealNetworks, Inc.) – C:\Windows\System32\pndx5032.dll
[2010/08/17 08:20:06 | 000,278,528 | —- | M] (Real Networks, Inc) – C:\Windows\System32\pncrt.dll
[2010/08/13 20:31:58 | 000,000,757 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CardMinder Viewer.lnk
[2010/08/13 20:30:28 | 000,000,761 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Conversion to PDF with ScanSnap Organizer.lnk
[2010/08/13 20:23:18 | 000,001,605 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ScanSnap Manager.lnk
[2010/08/11 14:59:44 | 000,353,176 | —- | M] () – \\LS-QL109\Peter\kidsgrandfather.zip
[2010/08/10 15:06:00 | 000,025,794 | —- | M] () – \\LS-QL109\Peter\CashFlow2010-08 (Autosaved)a.xlsx
[2010/08/10 05:15:58 | 000,094,208 | —- | M] (Apple Inc.) – C:\Windows\System32\QuickTimeVR.qtx
[2010/08/10 05:15:58 | 000,069,632 | —- | M] (Apple Inc.) – C:\Windows\System32\QuickTime.qts
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[10 C:\Users\Public\Documents\*.tmp files -> C:\Users\Public\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/08 14:52:08 | 000,001,854 | —- | C] () – C:\Users\Public\Desktop\Safari.lnk
[2010/09/08 14:01:56 | 000,039,808 | —- | C] () – \\LS-QL109\Peter\CIOT - Tax advisers critici…pdf
[2010/09/08 14:00:54 | 000,041,390 | —- | C] () – \\LS-QL109\Peter\CIOT - HMRC cuts - Withdraw…pdf
[2010/09/08 12:07:55 | 000,001,948 | —- | C] () – C:\Users\Peter\Desktop\HiJackThis.lnk
[2010/09/08 11:54:16 | 000,015,216 | —- | C] () – \\LS-QL109\Peter\VirusProblem.docx
[2010/09/08 06:39:00 | 000,024,428 | —- | C] () – \\LS-QL109\Peter\CashFlow2010-09.xlsx
[2010/09/01 08:04:24 | 000,025,135 | —- | C] () – \\LS-QL109\Peter\CashFlow2010-08.xlsx
[2010/08/26 14:05:36 | 000,001,309 | —- | C] () – C:\Users\Public\Desktop\FileCabinet CS.lnk
[2010/08/13 20:31:58 | 000,000,757 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CardMinder Viewer.lnk
[2010/08/13 20:30:28 | 000,000,761 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Conversion to PDF with ScanSnap Organizer.lnk
[2010/08/13 20:23:29 | 000,000,161 | —- | C] () – C:\Windows\DISPARAM.INI
[2010/08/13 20:23:18 | 000,001,605 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ScanSnap Manager.lnk
[2010/08/11 14:59:38 | 000,353,176 | —- | C] () – \\LS-QL109\Peter\kidsgrandfather.zip
[2010/08/10 15:06:00 | 000,025,794 | —- | C] () – \\LS-QL109\Peter\CashFlow2010-08 (Autosaved)a.xlsx
[2010/07/07 17:14:35 | 000,040,960 | —- | C] () – C:\Windows\System32\SgEEncrypt.dll
[2010/07/07 17:14:27 | 000,000,127 | —- | C] () – C:\Windows\BackRest.ini
[2010/04/22 10:41:03 | 000,040,448 | —- | C] () – C:\Windows\System32\UNACE.DLL
[2010/03/12 17:17:54 | 000,256,512 | —- | C] () – C:\Windows\System32\SGOPopDg.dll
[2010/03/12 17:17:52 | 000,401,408 | —- | C] () – C:\Windows\System32\sgBackupRestore.dll
[2010/03/12 17:17:51 | 000,094,208 | —- | C] () – C:\Windows\System32\P11Dreg.dll
[2010/03/12 17:17:51 | 000,040,960 | —- | C] () – C:\Windows\System32\sgServPackId.dll
[2010/02/09 11:33:54 | 000,045,056 | —- | C] () – C:\Windows\System32\SgELauncher.dll
[2010/02/09 11:33:14 | 000,114,688 | —- | C] () – C:\Windows\System32\SgEData.dll
[2010/01/07 19:57:52 | 000,000,052 | —- | C] () – C:\Windows\System32\actobp.ini
[2009/12/27 14:48:10 | 000,000,053 | —- | C] () – C:\Windows\wininit.ini
[2009/12/24 12:11:10 | 000,282,624 | —- | C] () – C:\Windows\System32\SGList32.dll
[2009/12/24 12:11:04 | 000,278,528 | —- | C] () – C:\Windows\System32\SGTool32.dll
[2009/12/24 12:11:00 | 000,090,112 | —- | C] () – C:\Windows\System32\SGIntl32.dll
[2009/12/24 12:10:58 | 000,172,032 | —- | C] () – C:\Windows\System32\SGHelp32.dll
[2009/12/24 12:10:58 | 000,073,728 | —- | C] () – C:\Windows\System32\SGDt32.dll
[2009/12/24 12:10:52 | 000,258,048 | —- | C] () – C:\Windows\System32\SGSchemeXml.dll
[2009/12/24 12:10:44 | 000,118,784 | —- | C] () – C:\Windows\System32\SGSchemeXP.dll
[2009/12/24 12:10:40 | 000,176,128 | —- | C] () – C:\Windows\System32\SGSchemeDefault.dll
[2009/12/24 12:10:34 | 000,221,184 | —- | C] () – C:\Windows\System32\SGSchemeManager.dll
[2009/12/24 12:10:28 | 000,094,208 | —- | C] () – C:\Windows\System32\SGCom32.dll
[2009/12/24 12:09:52 | 000,143,360 | —- | C] () – C:\Windows\System32\SGSTDREG.dll
[2009/12/24 12:09:48 | 000,131,072 | —- | C] () – C:\Windows\System32\SGRegister.dll
[2009/12/24 12:09:44 | 000,241,664 | —- | C] () – C:\Windows\System32\SGWebBrowser.dll
[2009/12/23 17:21:00 | 000,008,192 | —- | C] () – C:\Windows\System32\NetFerret.dll
[2009/10/23 08:23:36 | 000,000,256 | —- | C] () – C:\Windows\MYOBP.INI
[2009/10/23 08:23:36 | 000,000,125 | —- | C] () – C:\Windows\SwDrvs.ini
[2009/10/23 08:23:36 | 000,000,039 | —- | C] () – C:\Windows\MYOB.INI
[2009/09/29 11:54:50 | 000,087,552 | —- | C] () – C:\Windows\System32\cpwmon2k.dll
[2009/09/22 23:09:53 | 000,000,085 | —- | C] () – C:\Windows\SGREP32.INI
[2009/09/22 12:09:33 | 000,000,093 | —- | C] () – C:\Users\Peter\AppData\Local\fusioncache.dat
[2009/09/12 18:23:34 | 000,000,064 | —- | C] () – C:\ProgramData\sandra.ldb
[2009/09/12 18:22:57 | 011,927,552 | —- | C] () – C:\ProgramData\sandra.mda
[2009/09/12 14:41:07 | 000,053,248 | —- | C] () – C:\Windows\System32\ZLIB.DLL
[2009/09/10 17:08:57 | 000,000,663 | —- | C] () – C:\Windows\openrda.ini
[2009/09/10 17:08:56 | 000,335,872 | —- | C] () – C:\Windows\System32\ctreestd.dll
[2009/09/10 17:08:47 | 000,000,000 | —- | C] () – C:\Windows\drvxl32.INI
[2009/09/10 17:08:46 | 000,000,000 | —- | C] () – C:\Windows\drvwd32.INI
[2009/09/05 21:49:40 | 000,000,004 | —- | C] () – C:\Windows\msoffice.ini
[2009/09/05 20:23:50 | 002,116,008 | —- | C] () – C:\Windows\System32\Incinerator.dll
[2009/09/05 20:23:06 | 000,074,703 | —- | C] () – C:\Windows\System32\mfc45.dll
[2009/09/04 20:13:43 | 000,000,054 | —- | C] () – C:\Windows\Payroll.ini
[2009/09/04 15:26:49 | 001,724,416 | —- | C] () – C:\Windows\System32\SGRep32.dll
[2009/09/04 15:26:49 | 000,249,856 | —- | C] () – C:\Windows\System32\SGCDlg32.dll
[2009/09/04 15:26:49 | 000,233,472 | —- | C] () – C:\Windows\System32\SGLch32.dll
[2009/09/04 15:26:49 | 000,200,704 | —- | C] () – C:\Windows\System32\SGTBar32.dll
[2009/09/04 15:26:49 | 000,143,360 | —- | C] () – C:\Windows\System32\SGCtrlEx.dll
[2009/09/04 15:26:49 | 000,061,440 | —- | C] () – C:\Windows\System32\SGAppBar.dll
[2009/09/04 15:26:49 | 000,061,440 | —- | C] () – C:\Windows\System32\SG3D32.dll
[2009/09/04 15:26:49 | 000,049,152 | —- | C] () – C:\Windows\System32\SgStat32.dll
[2009/09/04 15:26:49 | 000,049,152 | —- | C] () – C:\Windows\System32\SGLogo32.dll
[2009/09/04 15:26:34 | 000,032,256 | —- | C] () – C:\Windows\System32\_RegTLB.dll
[2009/09/04 03:03:20 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/09/03 22:50:04 | 000,169,472 | —- | C] () – C:\Users\Peter\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/09/02 23:59:45 | 000,000,541 | —- | C] () – C:\Windows\ODBC.INI
[2009/09/02 23:38:16 | 000,540,672 | —- | C] () – C:\Windows\System32\Tx32.dll
[2009/09/02 23:38:15 | 000,000,478 | —- | C] () – C:\Windows\System32\IC32.INI
[2009/09/02 16:10:10 | 000,000,680 | —- | C] () – C:\Users\Peter\AppData\Local\d3d9caps.dat
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/07/27 15:15:32 | 000,001,205 | —- | C] () – C:\Windows\SAGEINTL.INI
[2009/07/20 14:17:40 | 000,178,176 | —- | C] () – C:\Windows\System32\unrar.dll
[2009/06/30 21:05:18 | 000,030,793 | —- | C] () – C:\Windows\System32\crtslv.dll
[2009/05/12 08:36:15 | 000,126,976 | —- | C] () – C:\Windows\System32\Isb.dll
[2009/02/04 23:09:45 | 000,024,576 | —- | C] () – C:\Windows\System32\VlUtils.dll
[2009/02/04 23:06:46 | 000,315,392 | —- | C] () – C:\Windows\System32\VLMenuRes.dll
[2009/02/04 01:30:04 | 000,017,920 | —- | C] () – C:\Windows\System32\xfxbinimg.dll
[2008/12/22 10:28:06 | 000,061,440 | —- | C] () – C:\Windows\System32\SageFolderBrowser.dll
[2008/12/02 20:06:22 | 000,017,408 | —- | C] () – C:\Windows\System32\SgDate.dll
[2008/12/01 15:36:00 | 000,180,224 | —- | C] () – C:\Windows\System32\SGJPEG32.dll
[2008/09/02 19:35:30 | 000,005,434 | —- | C] () – C:\Windows\UN070209.INI
[2008/08/29 17:58:54 | 000,004,605 | —- | C] () – C:\Windows\UN080516.INI
[2008/07/28 17:06:48 | 000,014,344 | —- | C] () – C:\Windows\UN060501.INI
[2008/06/03 03:35:18 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2008/04/27 10:33:36 | 000,765,952 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2008/04/14 09:39:40 | 001,914,216 | —- | C] () – C:\Windows\System32\ltmm15.dll
[2008/01/21 03:23:41 | 000,081,158 | —- | C] () – C:\Windows\System32\manage-bde.ini.en
[2007/01/08 00:48:36 | 000,548,864 | —- | C] () – C:\Windows\System32\hpgt4850.dll
[2006/11/02 13:34:20 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/09/06 20:42:56 | 000,237,568 | —- | C] () – C:\Windows\System32\hppapr02.dll
[2006/07/17 13:11:36 | 000,667,280 | —- | C] () – C:\Windows\System32\tx12.dll
[2006/02/09 04:20:00 | 000,000,530 | —- | C] () – C:\Windows\System32\tx12_ic.ini
[2002/04/16 11:27:54 | 000,000,005 | -HS- | C] () – C:\Windows\System32\CdI5T.drv
[1998/03/26 02:12:00 | 000,053,248 | —- | C] () – C:\Windows\System32\SgHmZLib.dll

========== LOP Check ==========

[2009/11/21 14:30:05 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\acccore
[2009/12/02 23:56:40 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Chaos Software
[2010/04/22 14:31:51 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Digita
[2009/10/13 08:52:39 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\FolderPrint
[2009/11/22 17:07:21 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Forte
[2010/08/13 21:44:59 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Fujitsu
[2010/01/10 02:52:39 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\G-Lock Software
[2010/04/21 16:15:22 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\GoodSync
[2009/09/05 20:24:05 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\iolo
[2010/02/17 00:16:46 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Likno
[2010/04/01 21:34:23 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Likno Software
[2009/10/02 10:01:52 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\NASNaviator2
[2009/09/06 19:11:33 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\NeoDownloader
[2010/04/21 16:19:10 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Paltalk
[2010/08/13 21:46:35 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\PFU
[2010/04/07 15:46:59 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Photoactions
[2009/09/15 11:51:48 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Softland
[2009/09/10 11:25:07 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Tific
[2010/03/05 09:48:01 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\VOWSoft
[2010/05/21 09:29:25 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\webex
[2010/07/03 16:31:57 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Zeon
[2009/10/13 09:00:37 | 000,000,516 | —- | M] () – C:\Windows\Tasks\b4a_BackupToD.job
[2010/09/08 15:57:47 | 000,032,572 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/09/08 14:56:59 | 000,000,422 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{A42855A4-FB33-454F-B9C9-979B2841FC40}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2006/09/18 22:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/11 07:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2009/09/03 00:37:47 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2006/09/18 22:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2008/05/22 13:13:55 | 000,004,672 | RH– | M] () – C:\dell.sdr
[2010/09/08 15:59:04 | 3487,748,096 | -HS- | M] () – C:\hiberfil.sys
[2010/03/31 12:07:48 | 001,549,847 | —- | M] () – C:\Hudson Clarke Associates (Backup 31 Mar 2010 12 07 PM) 31 Mar 2010 12 07 PM.QBB
[2010/04/22 15:00:35 | 000,000,072 | —- | M] () – C:\msbasppl.syn
[1999/09/14 00:00:00 | 000,000,035 | —- | M] () – C:\mscrsv.syc
[2010/09/08 15:58:59 | 3801,366,528 | -HS- | M] () – C:\pagefile.sys
[2010/03/10 22:19:24 | 000,561,621 | —- | M] () – C:\pvlog.log
[2010/09/08 15:57:28 | 000,062,398 | —- | M] () – C:\TDSSKiller.2.4.2.1_08.09.2010_15.55.47_log.txt
[2009/06/22 16:42:03 | 000,001,935 | —- | M] () – C:\VETlog.txt

< %systemroot%\Fonts\*.com >
[2006/11/02 13:35:26 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 13:35:26 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 13:35:26 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/09/04 12:42:15 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 22:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/12/11 20:16:56 | 000,115,712 | —- | M] (Thomson Reuters) – C:\Windows\System32\spool\prtprocs\w32x86\csintprt.dll
[2007/01/25 14:24:04 | 000,286,208 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\hpzpp4wm.dll
[2008/01/21 03:21:22 | 000,089,600 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006/11/02 13:34:09 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 19:58:12 | 000,030,512 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2005/01/12 16:49:02 | 000,114,688 | —- | M] (SoftTech InterCorp) – C:\Windows\PictureViewerEXE.scr
[2010/02/14 03:52:34 | 000,240,128 | —- | M] (Realtime Soft Ltd) – C:\Windows\UltraMon.scr
[2010/04/17 00:04:40 | 000,306,032 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/01/21 03:41:56 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2008/01/21 04:16:46 | 017,956,864 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2008/01/21 04:16:31 | 000,106,496 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2008/01/21 04:16:46 | 000,020,480 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 11:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 11:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/09/03 00:03:20 | 000,000,221 | -HS- | M] () – C:\Users\Peter\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/09/08 16:08:24 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\Peter\Desktop\OTL.exe
[2010/09/07 14:44:52 | 001,293,400 | —- | M] (Kaspersky Lab ZAO) – C:\Users\Peter\Desktop\TDSSKiller.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-09-08 05:09:42

========== Alternate Data Streams ==========

@Alternate Data Stream - 198 bytes -> C:\ProgramData\TEMP:0D6E9A34
@Alternate Data Stream - 164 bytes -> C:\ProgramData\TEMP:D1B5B4F1
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:21654C57
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:8B4F37E5
< End of report >

OTL Extras logfile created on: 08/09/2010 16:12:46 - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Users\Peter\Desktop
Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 57.00% Memory free
7.00 Gb Paging File | 5.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.70 Gb Total Space | 132.66 Gb Free Space | 29.11% Space Free | Partition Type: NTFS
Drive D: | 465.76 Gb Total Space | 272.25 Gb Free Space | 58.45% Space Free | Partition Type: NTFS
Drive E: | 10.00 Gb Total Space | 5.79 Gb Free Space | 57.95% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive Z: | 458.10 Gb Total Space | 272.98 Gb Free Space | 59.59% Space Free | Partition Type: NTFS

Computer Name: PETER-PC
Current User Name: Peter
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] – Reg Error: Value error.
https [open] – Reg Error: Value error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
jsfile – "C:\Program Files\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1" (Macromedia, Inc.)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Search with SnitchPlus] – SnitchPlus.exe %1
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1AE80C07-0C2E-4D33-BB48-DF2BC1F4A3B6}" = rport=139 | protocol=6 | dir=out | app=system |
"{4859AECC-E8FC-4B1B-9B11-A3589121DAA3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=file and printer sharing (spooler service - rpc-epmap) |
"{4B0183EC-A1EF-4A08-BEA5-2F580EBE22F1}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=c:\windows\system32\spoolsv.exe |
"{6705FF0A-E27F-4B54-B54F-1EAEE9AB3D56}" = lport=445 | protocol=6 | dir=in | app=system |
"{85CCED3F-0C32-414E-BC3D-1AC5027D53B9}" = lport=137 | protocol=17 | dir=in | app=system |
"{8CEEEC80-18C3-4D06-A952-C5C041B2D6D4}" = rport=138 | protocol=17 | dir=out | app=system |
"{A9C4DCD3-B89A-41C1-89AC-D28AFE78F095}" = lport=rpc | protocol=6 | dir=in | app=c:\program files\sisoftware\sisoftware sandra lite 2009.sp4\wnt500x86\rpcsandrasrv.exe |
"{ACD4E773-1764-4FE2-8FBF-99C25BD58994}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe |
"{BDC89B65-B820-46C0-9808-C4D37AE04C04}" = lport=rpc | protocol=6 | dir=in | app=c:\program files\sisoftware\sisoftware sandra lite 2009.sp4\rpcagentsrv.exe |
"{BE5C034C-1CA9-4CBD-839E-DC3BAF4CB5F5}" = rport=137 | protocol=17 | dir=out | app=system |
"{D3BF0530-0D27-4C61-903B-48F6962A16F4}" = rport=445 | protocol=6 | dir=out | app=system |
"{DCB3B6E3-5B71-40EC-A58C-EEAE8C4BDE91}" = lport=138 | protocol=17 | dir=in | app=system |
"{E1C786BD-8AE7-4A3B-A469-826828F1BA9B}" = lport=139 | protocol=6 | dir=in | app=system |
"{E5D5ABB3-784E-4971-B62A-9C31CD8142B3}" = lport=2869 | protocol=6 | dir=in | app=system |
"{FDF4E47D-9921-44C3-88B2-EE11DD1ACF18}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{005F647B-B3DD-4A7F-8E8B-D9955C1F1AA5}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{0360C3DB-6222-46B6-8E5E-62E03526E9B5}" = protocol=6 | dir=in | app=c:\program files\aim\aim.exe |
"{079DF5D9-7CD5-43CB-A853-98DCFD50FDF9}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{0C6EEAA4-8BCF-4BF8-B098-64562FE21F8A}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{0CFD1519-A048-461C-A5AD-72F7DC38BFF4}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{0DD13042-6A00-485B-AD75-18303AE204BB}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{0FED6DD8-C314-4EF6-BFD8-A48E73D0F8FA}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{112EC5DB-981D-4591-8861-39E1041E3F8C}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{152AE8DD-16CB-4D30-B430-3F04005FFA86}" = protocol=17 | dir=in | app=c:\program files\aol 9.1 betaa\waol.exe |
"{1589A207-A773-4EB4-AE0A-71F323E1FB21}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{1F33CEA9-C3DC-476E-8976-6D74777FD601}" = protocol=17 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe |
"{231C17B2-EFE6-4C31-92FE-3866BE09F116}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{2844C36E-FF67-4E34-A15B-9E0344A5F2F0}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{293991E6-CA3B-4D22-8726-C372D0708CD6}" = protocol=17 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{29D0DF0E-F57B-4580-A2F6-E26EBA09AEFD}" = protocol=6 | dir=in | app=c:\program files\common files\aol\1252186683\ee\aolsoftware.exe |
"{2F68837A-9A8F-4027-BFAB-62FBA1F87E46}" = protocol=17 | dir=in | app=c:\program files\aol 9.0 vra\waol.exe |
"{37801810-E96D-482F-AB08-7C6B629D0731}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{39971A43-DCB6-4D24-90D5-2DD8259101FE}" = protocol=17 | dir=in | app=c:\program files\aim\aim.exe |
"{3C09F911-1F97-4D99-8C64-B7FF4BF4792C}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{3C6E984E-8733-431B-A17C-4546B4ADE730}" = protocol=6 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{3E6C0FB5-4D50-4503-8CB8-F415B81B86F6}" = protocol=6 | dir=in | app=c:\program files\common files\aol\1252186683\ee\aolsoftware.exe |
"{53673D33-B0B2-4922-B4B0-1E25A0E20CBB}" = protocol=17 | dir=in | app=c:\program files\aol 9.1\waol.exe |
"{59977675-3304-4118-B444-2C9938A39782}" = protocol=1 | dir=out | name=file and printer sharing (echo request - icmpv4-out) |
"{5C2E46F7-907E-4F18-8400-F6E7EBD83D6E}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{61AA7D16-0AC8-4701-AEA1-7933444D2AAF}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{659397D2-3A3B-4B70-86B5-AAC6AB0F65AD}" = protocol=6 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{68604C58-066E-40CC-B509-6094693ECAC2}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{6BD35653-9CC2-40C7-A524-1CA8D4DBAA85}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{782A3868-1CC1-48E3-9173-0624A86C8161}" = protocol=6 | dir=in | app=c:\program files\common files\aol\1251906345\ee\aolsoftware.exe |
"{7CA0AC84-C3B3-4D67-9E18-8602F7C9E188}" = protocol=17 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{807EC3A3-00FB-4547-AACD-7C3530C15850}" = protocol=6 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{80CBAF31-DFAC-4103-95E8-75BFB1197557}" = protocol=58 | dir=in | name=file and printer sharing (echo request - icmpv6-in) |
"{86E23B0D-626F-4F07-89CD-E1A890DDC25A}" = protocol=6 | dir=in | app=c:\program files\aol 9.1 beta\waol.exe |
"{88ECD9D7-12B7-4017-AE24-1667ADEFB98F}" = protocol=58 | dir=out | name=file and printer sharing (echo request - icmpv6-out) |
"{8F7BEEEC-014B-4D57-A78D-8114BCC1FF49}" = protocol=17 | dir=in | app=c:\program files\common files\aol\1251906345\ee\aolsoftware.exe |
"{91747E29-BD9D-44F9-8192-CF38195941D5}" = protocol=6 | dir=in | app=c:\program files\buffalo\nasnavi\nasnavi.exe |
"{97094B10-F5CA-4766-A4DE-36A578464A6B}" = protocol=6 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{979C20B6-74C7-4876-B36D-9343ADF8E4D9}" = protocol=17 | dir=in | app=c:\program files\common files\aol\1252186683\ee\aolsoftware.exe |
"{A0B668F5-89A6-458C-ACB0-5667F52254AA}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{A8B9538F-D58F-4443-B14E-F912D300B053}" = protocol=17 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{B1C3B4B4-3AD3-41B0-A258-443FDBF0AF3F}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{B5768A02-2977-419C-A1AD-C0C5EAAB9FB8}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{B7239BAD-37E4-49D5-B36F-C098B40D6EEE}" = protocol=6 | dir=in | app=c:\program files\aol 9.0 vra\waol.exe |
"{BA0CBE59-657C-4B8D-8A4A-6D7605BD3F4E}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{BA2465C3-86FC-482D-B31B-EC70EF62127C}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{BB3AE71C-CF14-4828-A877-5BB2BDC4E390}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{BBD404FC-84CF-4F1B-8E6B-351E9E120AF7}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{C0E74CCB-173A-4C06-A67C-DA3786C8E667}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{C67D2693-9CF8-41E9-9F67-4E1CD320A363}" = protocol=17 | dir=in | app=c:\program files\aol 9.1 beta\waol.exe |
"{C68283BE-7174-4334-8D10-9D787B781964}" = protocol=1 | dir=in | app=c:\program files\sisoftware\sisoftware sandra lite 2009.sp4\wnt500x86\rpcsandrasrv.exe |
"{CA00E18B-075C-4591-A540-DC78FDB33879}" = protocol=1 | dir=in | name=file and printer sharing (echo request - icmpv4-in) |
"{CBA54E47-DF3E-4C96-9635-270589D3A097}" = protocol=6 | dir=in | app=c:\program files\aol 9.1 betaa\waol.exe |
"{D31735F7-96EF-4F17-8D66-BDFFAF73D1AA}" = protocol=17 | dir=in | app=c:\program files\common files\aol\1252186683\ee\aolsoftware.exe |
"{D3F2720C-0DB2-45A5-9BAC-84BAC24F78D8}" = protocol=6 | dir=in | app=c:\program files\aol 9.1\waol.exe |
"{D505B3C5-1562-40AA-AE82-CBCB9B381782}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{DA242F87-5415-4AE0-BA50-73FE51448526}" = protocol=17 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{DB8A5815-2597-4594-900E-DB218AC1C24F}" = protocol=1 | dir=in | app=c:\program files\sisoftware\sisoftware sandra lite 2009.sp4\rpcagentsrv.exe |
"{E6402415-7A84-4198-9BBF-91ABDE2B221E}" = protocol=6 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe |
"{E962202F-0A41-40CA-982B-E46EE4C014D8}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{ED9A15B0-27E4-45C8-BBF5-71F3AA116EA7}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{EDFCF9B3-F0F2-409A-8904-1B7197F192C1}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{EEF8E89B-12E6-4DD0-8B35-62392CD110E0}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{F723EC7F-1ADC-4B9F-B71D-BEC24A0FD4AF}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{F91CF097-7174-47B3-89FC-A7A7ED9259E8}" = protocol=17 | dir=in | app=c:\program files\buffalo\nasnavi\nasnavi.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0654EEE0-53F6-4FF4-839D-CFDDC4761687}" = Payroll for Windows
"{07EF3970-F8E5-4A27-A5A3-230484D35026}" = Microsoft Expression Encoder 4
"{0837A661-FEC3-48B3-876C-91E7D32048A9}" = Macromedia Dreamweaver 8
"{087000A2-3C3F-4C46-8B84-1777C87D98C9}" = Microsoft Tool Web Package : XCACLS.EXE
"{08D605B4-DCD1-451F-ABD7-52E6BB868E4E}" = Microsoft Expression Design 4
"{08F32589-5E39-42B8-8BC5-6A8126ED2A70}" = Microsoft Visual C++ 2008 Redistributable Package
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{14C7CA63-C8F1-41DF-BED7-3A2EA8533D33}" = InternetSubmissions
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{19EC958B-3B45-4130-8E38-DE22AC74667D}" = Sage 50 Payroll
"{1BD07DF4-FB06-41BA-B896-B2DA59000C96}" = Windows Live Toolbar
"{1E3CA1C4-1E90-401B-8CC0-911DF018D8D8}" = AllWebMenus PRO 5.3.830
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{20608BFA-6068-48FE-A410-400F2A124C27}" = Microsoft SQL Server Management Studio Express
"{20ACB2F8-3BCA-45A8-80A2-9D3CB5C25F43}" = Safari
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java™ 6 Update 17
"{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}" = Microsoft SQL Server 2005 Tools Express Edition
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition
"{2CC5FCAE-51BA-4926-8C2B-4F07E54F6EA3}" = ScanSnap
"{2FB1FDA6-38C4-4ABC-82C1-1BD9A873431E}" = Digita Corporation Tax
"{30FD0984-5144-4CDB-A45C-B8D631681DCA}" = MYOB Accounting Plus v16
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3215CE05-DB3D-4913-B55A-91E91D322C12}" = Payroll for Windows
"{350FB27C-CF62-4EF3-AF9D-70FF313FE221}" = iTunes
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{3C4F5DAA-3E31-4058-A588-9AD169C35CB8}" = Digita Accounts Production
"{3FC29AC3-68C5-4D75-9681-F53D2B393E80}" = DotNet20withMsi30
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{46727738-701B-48CC-A5AB-E1CD8F39008B}" = Sage Payroll for Windows
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{4ABDA736-BEF7-4193-B5F4-477FF1938264}" = SnitchPlus
"{4B719A70-F14A-4f5c-90B5-346B24B7FFF1}" = Windows 7 Upgrade Advisor
"{4D21F997-85AD-42D2-986F-D91C4836438D}" = Accounts
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}" = Macromedia Extension Manager
"{55E63724-2BFE-49BC-B03E-9BE0F62E18C2}" = ScanSnap Organizer
"{56B4002F-671C-49F4-984C-C760FE3806B5}" = Microsoft SQL Server VSS Writer
"{59CA6732-10A2-450A-BDB4-9BD2F5F5FB73}" = Sperry Software - Global Search And Replace
"{5A0C892E-FD1C-4203-941E-0956AED20A6A}" = APC PowerChute Personal Edition
"{5A3F6A80-7913-475E-8B96-477A952CFA43}" = SupportSoft Assisted Service
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5EF2F12F-AEB0-4A15-B37B-5CC419DF51B7}" = Digita Personal Tax
"{5F8D931D-B230-47F3-A9C0-0C8CA459A332}" = Microsoft Expression Web 4
"{606BC780-101C-41DB-808D-4539BFA0774A}" = MobileMe Control Panel
"{616830F7-46E4-4329-B0F2-565FD829B65B}" = Sage 50 Payroll
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{64D81F04-5F41-46A5-AC7B-0420765C267C}" = MYOB ODBC Direct v7
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6DEF11C0-35FF-4160-A543-FDD336C4DAE5}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{7061F715-D782-4120-A034-2B4B4F28CC1D}" = Accounts
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72B12ED5-82FE-452D-9D3B-07A4BCBC3D35}" = Digita Shared Components v2.0
"{73713D6F-7103-4CA7-A2C9-0EE55B261633}" = Digita Practice Management
"{73BFDF1D-6883-42D4-8E1A-62AD86C07FBE}" = Payroll for Windows
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{7E545666-F423-45FD-B3DF-C0B99A1A579F}" = QuickBooks Premier Edition 2008
"{82006733-1BF0-4FDA-905F-826395796DC4}" = Payroll for Windows
"{830A965B-A880-42DF-B204-2A7D253F7B25}" = Rack2-Viewer (This application may be deleted by deleting Rack2-Filer)
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8DCD0779-8811-4060-9227-871E2FD48E45}" = CardMinder V4.1
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90120000-00D1-0409-0000-0000000FF1CE}" = Microsoft Office Access database engine 2007 (English)
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{9117AB89-42D2-4722-AF0D-54028B830F3D}" = Payroll for Windows
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{96327C3C-96BE-4C7A-A6F7-A71635E5949A}" = Microsoft SQL Server 2005 Backward compatibility
"{979534ED-D2C5-4B9E-A6B2-9D5301A57550}" = Sage 50 Payroll
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
"{9F479685-180E-4C05-9400-D59292A1B29C}" = Windows Live Movie Maker
"{A14D8BD3-ACFC-4846-AFE2-43D4CF80EFA4}" = Payroll for Windows
"{A2B7B3E9-479A-4973-9864-C4E930118C9F}" = Payroll for Windows
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AC76BA86-1033-F400-7760-000000000003}" = Adobe Acrobat 8 Professional - English, Français, Deutsch
"{ADDBF612-6455-4968-A673-9620067695AF}" = Payroll for Windows
"{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}" = Microsoft Office Live Add-in 1.4
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B480904D-F73F-4673-B034-8A5F492C9184}" = Nuance PDF Reader
"{B49673F8-7AB6-4A14-8213-C8A7BE370010}" = UltraMon
"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
"{B592D5B2-D758-46F2-9250-EB18AB5F37F3}" = Payroll for Windows
"{BBD3F66B-1180-4785-B679-3F91572CD3B4}_is1" = iolo technologies' System Mechanic Professional
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BD68F46D-8A82-4664-8E68-F87C55BDEFD4}" = Microsoft SQL Server Native Client
"{BF127B80-CFD5-4379-9752-E8AF1A5D0141}" = Microsoft Expression Encoder 4 Screen Capture Codec
"{C2D129C0-7508-11DF-9F1B-005056806466}" = Google Earth
"{C3113E55-7BCB-4de3-8EBF-60E6CE6B2196}_is1" = SiSoftware Sandra Lite 2009.SP4
"{C36F0970-455C-11DE-3D6C-00CA5A144AE1}" = Chaos 7
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{C82185E8-C27B-4EF4-2010-3333BC2C2B6D}" = Microsoft AutoRoute 2010
"{C845E16D-4D66-44C8-B7B5-53739900AC7E}" = Microsoft Office Accounting 2009
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CB348A95-74C2-4A2A-93B4-51B74EAF4CE4}" = Digita Database Backup
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CCAECA5E-4AD6-4B0D-85FB-5B95B9253AC8}" = Payroll for Windows
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BD}" = WinZip 14.5
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D4F2AFD3-0167-4464-B92F-78AB6DA8A0AA}" = CardMinder
"{D92FF8EB-BD77-40AE-B68B-A6BFC6F8661D}" = Windows Live Family Safety
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DBCDB997-EEEB-4BE9-BAFF-26B4094DBDE6}" = ScanSnap Manager
"{DC0C35E4-CD3D-4F12-95BB-7C74D9467BD7}" = Microsoft Office Accounting 2009 PayPal Addin
"{DE8BC3BE-E210-478E-B7CF-B64EC7BA510E}" = Payroll for Windows
"{E58F3B88-3B3E-4F85-9323-04789D979C15}" = ScanSnap Organizer
"{E5FBC6F2-6423-4C35-9E4F-72684C9BCE6F}" = IS Update for Sage Payroll
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{E639E6B1-E93C-48DC-9882-7FE06398180A}" = Rack2-Filer
"{E820BB66-6F68-4ADB-A2D2-6F46B6CAD180}" = Digita Company Secretarial
"{EB900AF8-CC61-4E15-871B-98D1EA3E8025}" = QuickTime
"{ED5312F5-91D0-4CED-BE24-C562EC8F7F2F}" = Payroll for Windows
"{EE39FFBD-544E-49E4-A999-6819828EAE91}" = Windows Live Photo Gallery
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F220FBFB-32AA-4FD3-B9F1-DE8F6BB3F155}" = Sage 50 P11D 2010
"{F3CA9611-CD42-4562-ADAB-A554CF8E17F1}" = Microsoft WSE 2.0 SP3 Runtime
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"{F571656D-5C1B-4BE1-9E6E-7AA3D21928FF}" = Payroll for Windows
"{F7BC4898-77BA-4590-A550-ED91232B03E3}" = Sage 50 Payroll
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone Configuration Utility
"{FB400000-0002-0000-0000-074957833700}" = ABBYY FineReader for ScanSnap ™ 4.1
"{FE249899-295F-4D9D-BC3C-D5AF24BF6CCA}" = Payroll for Windows
"7-Zip" = 7-Zip 4.65
"ActiveTouchMeetingClient" = WebEx
"Adobe Acrobat 8 Professional - English, Français, Deutsch" = Adobe Acrobat 8.2.4 Professional
"Adobe Acrobat 8 Professional - English, Français, Deutsch_824" = Adobe Acrobat 8.2.4 - CPSID_83708
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Advanced Zip Repair v1.8" = Advanced Zip Repair v1.8
"AOL Broadband Toolbar" = AOL Broadband Toolbar
"AOL Uninstaller" = AOL Uninstaller (Choose which Products to Remove)
"Banner Maker Pro 8_is1" = Banner Maker Pro Version 8
"Batch Rename .EXE_is1" = Batch Rename .EXE [removed]
"CCleaner" = CCleaner (remove only)
"CoffeeCup Sitemapper" = CoffeeCup Sitemapper
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.52.2
"CutePDF Writer Installation" = CutePDF Writer 2.8
"Design_7.0.20516.0" = Microsoft Expression Design 4
"DHTML_Menu_Builder" = DHTML Menu Builder 4.20
"DigiGuide TV Guide" = DigiGuide TV Guide
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX Setup
"Encoder_4.0.1639.0" = Microsoft Expression Encoder 4
"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v5.50
"Extreme Thumbnail Generator_is1" = Extreme Thumbnail Generator 1.17
"FileCabinet CS" = FileCabinet CS
"FileCabinet CS Print Driver" = FileCabinet CS Print Driver
"Forte Agent" = Forté Agent
"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1
"G-Lock EasyMail v6.53_is1" = G-Lock EasyMail
"G-Lock EasyMail v6.54_is1" = G-Lock EasyMail
"G-Lock EasyMail v6.55_is1" = G-Lock EasyMail
"G-Lock EasyMail v6.56_is1" = G-Lock EasyMail
"G-Lock EasyMail v6.60_is1" = G-Lock EasyMail
"GoToAssist" = GoToAssist Corporate
"HDD Health_is1" = HDD Health v3.3 Beta
"InstallShield_{2FB1FDA6-38C4-4ABC-82C1-1BD9A873431E}" = Digita Corporation Tax
"InstallShield_{30FD0984-5144-4CDB-A45C-B8D631681DCA}" = MYOB Accounting Plus v16
"InstallShield_{3C4F5DAA-3E31-4058-A588-9AD169C35CB8}" = Digita Accounts Production
"InstallShield_{4D21F997-85AD-42D2-986F-D91C4836438D}" = Sage 50 Accounts 2011
"InstallShield_{5EF2F12F-AEB0-4A15-B37B-5CC419DF51B7}" = Digita Personal Tax
"InstallShield_{73713D6F-7103-4CA7-A2C9-0EE55B261633}" = Digita Practice Management
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Office Accounting 2009" = Microsoft Office Accounting 2009
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox (3.6.6)" = Mozilla Firefox (3.6.6)
"NIS" = Norton Internet Security
"NSS" = Norton Security Scan
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"OutlookBackupPro" = OutlookBackupPro
"RealPlayer 12.0" = RealPlayer
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"SpamBully 4 for Outlook" = SpamBully 4 for Outlook [removed]
"STG FolderPrint Plus_is1" = STG FolderPrint Plus 3.73
"SysTools ZIP Repair - Demo Version 3.0 Build 1408_is1" = SysTools ZIP Repair
"UltSounds" = Windows Sound Schemes
"UltSounds2" = Ultimate Extras sounds from Microsoft® Tinker™
"UN060501" = BUFFALO NAS Navigator
"UN070209" = Uninstall of File Security Tool
"UN080516" = BUFFALO LinkStation(LS-QL) Setup Guide
"Unlocker" = Unlocker 1.8.9
"ViewpointMediaPlayer" = Viewpoint Media Player
"Web_4.0.1165.0" = Microsoft Expression Web 4
"WebFerret" = WebFerret
"WinLiveSuite_Wave3" = Windows Live Essentials
"Zip Repair Pro_is1" = Zip Repair Pro

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"GoToMeeting" = GoToMeeting 4.5.0.457

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

OTL logfile created on: 09/09/2010 09:05:22 - Run 2
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Users\Peter\Desktop
Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 58.00% Memory free
7.00 Gb Paging File | 5.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.70 Gb Total Space | 127.31 Gb Free Space | 27.94% Space Free | Partition Type: NTFS
Drive D: | 465.76 Gb Total Space | 272.25 Gb Free Space | 58.45% Space Free | Partition Type: NTFS
Drive E: | 10.00 Gb Total Space | 5.79 Gb Free Space | 57.95% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive Z: | 458.10 Gb Total Space | 272.98 Gb Free Space | 59.59% Space Free | Partition Type: NTFS

Computer Name: PETER-PC
Current User Name: Peter
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Peter\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Peter\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Windows\System32\atashost.exe (WebEx Communications, Inc.)
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Users\Peter\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing, S.L.)
PRC - C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
PRC - C:\Program Files\Unlocker\UnlockerAssistant.exe ()
PRC - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files\UltraMon\UltraMonUiAcc.exe (Realtime Soft Ltd)
PRC - C:\Program Files\UltraMon\UltraMonTaskbar.exe (Realtime Soft Ltd)
PRC - C:\Program Files\UltraMon\UltraMon.exe (Realtime Soft Ltd)
PRC - C:\Program Files\Common Files\Sage SData\Sage.SData.Service.exe (Sage (UK) Limited)
PRC - C:\Windows\csifcsvc.exe (Thomson Reuters)
PRC - C:\Program Files\PFU\ScanSnap\Driver\PfuSsMon.exe (PFU LIMITED)
PRC - C:\Program Files\PFU\ScanSnap\CardMinder\CardLauncher.exe (PFU LIMITED)
PRC - C:\Program Files\PFU\Rack2\RKiwrtK.exe (PFU LIMITED)
PRC - c:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.)
PRC - C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
PRC - C:\Program Files\PFU\Rack2\Rkasynct.exe (PFU LIMITED)
PRC - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe (American Power Conversion Corporation)
PRC - C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe (American Power Conversion Corporation)
PRC - C:\Program Files\Common Files\aol\1252186683\ee\aolsoftware.exe (AOL LLC)


========== Modules (SafeList) ==========

MOD - C:\Users\Peter\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_5090ab56bcba71c
2\msvcr90.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_5090ab56bcba71c
2\msvcp90.dll (Microsoft Corporation)
MOD - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\asoehook.dll (Symantec Corporation)
MOD - C:\Program Files\Unlocker\UnlockerHook.dll ()
MOD - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll (RealPlayer)
MOD - C:\Program Files\UltraMon\RTSUltraMonHook.dll (Realtime Soft Ltd)
MOD - C:\Program Files\UltraMon\UltraMonResButtons.dll (Realtime Soft Ltd)
MOD - C:\Windows\System32\networkexplorer.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\davclnt.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cscapi.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\GdiPlus.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\ntlanman.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\drprov.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msvcp71.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msvcr71.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (atashost) – C:\Windows\System32\atashost.exe (WebEx Communications, Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (QBCFMonitorService) – C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe (Intuit)
SRV - (Microsoft SharePoint Workspace Audit Service) – C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (aspnet_state) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe (Microsoft Corporation)
SRV - (WPFFontCache_v0400) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (NetTcpPortSharing) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (NetTcpActivator) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (NetPipeActivator) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (NetMsmqActivator) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe (Microsoft Corporation)
SRV - (NIS) – C:\Program Files\Norton Internet Security\Engine\17.7.0.12\ccSvcHst.exe (Symantec Corporation)
SRV - (osppsvc) – C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (Sage SData Service) – C:\Program Files\Common Files\Sage SData\Sage.SData.Service.exe (Sage (UK) Limited)
SRV - (FCPrintService) – C:\Windows\csifcsvc.exe (Thomson Reuters)
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\570\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (ioloSystemService) – C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe ()
SRV - (ioloFileInfoList) – C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe ()
SRV - (SandraAgentSrv) – C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP4\RpcAgentSrv.exe (SiSoftware)
SRV - (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ) – c:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (MSSQLSERVER) SQL Server (MSSQLSERVER) – C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.)
SRV - (SQLBrowser) – C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
SRV - (MSSQLServerADHelper) – C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation)
SRV - (SQLWriter) – C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
SRV - (NasPmService) – C:\Program Files\BUFFALO\NASNAVI\nassvc.exe (BUFFALO INC.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AERTFilters) – C:\Windows\System32\AERTSrv.exe (Andrea Electronics Corporation)
SRV - (APC UPS Service) – C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe (American Power Conversion Corporation)
SRV - (QBFCService) – C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe (Intuit Inc.)
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)


========== Driver Services (SafeList) ==========

DRV - (NwlnkFwd) – C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) – C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (BHDrvx86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20100810.004\BHDrvx86.sys (Symantec Corporation)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100908.050\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100908.050\NAVENG.SYS (Symantec Corporation)
DRV - (IDSVix86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100908.001\IDSvix86.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (SYMTDIv) – C:\Windows\System32\Drivers\NIS\1107000.00C\SYMTDIV.SYS (Symantec Corporation)
DRV - (SymIRON) – C:\Windows\system32\drivers\NIS\1107000.00C\Ironx86.SYS (Symantec Corporation)
DRV - (fssfltr) – C:\Windows\System32\drivers\fssfltr.sys (Microsoft Corporation)
DRV - (SymEFA) – C:\Windows\system32\drivers\NIS\1107000.00C\SYMEFA.SYS (Symantec Corporation)
DRV - (SRTSP) – C:\Windows\System32\Drivers\NIS\1107000.00C\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\system32\drivers\NIS\1107000.00C\SRTSPX.SYS (Symantec Corporation)
DRV - (ccHP) – C:\Windows\system32\drivers\NIS\1107000.00C\ccHPx86.sys (Symantec Corporation)
DRV - (SymDS) – C:\Windows\system32\drivers\NIS\1107000.00C\SYMDS.SYS (Symantec Corporation)
DRV - (SymEvent) – C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (SANDRA) – C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP4\WNt500x86\sandra.sys (SiSoftware)
DRV - (cpuz132) – C:\Windows\System32\drivers\cpuz132_x32.sys (Windows ® Codename Longhorn DDK provider)
DRV - (ElRawDisk) – C:\Windows\System32\drivers\elrawdsk.sys (EldoS Corporation)
DRV - (UltraMonUtility) – C:\Program Files\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys (Realtime Soft Ltd)
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (MegaSR) – C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (HidBatt) – C:\Windows\System32\drivers\hidbatt.sys (Microsoft Corporation)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (AVMNgTunM779) – C:\Windows\System32\drivers\AVerTun.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV - (AVMNgCapM779) – C:\Windows\System32\drivers\AVerCap.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV - (AVMNgBasM779) – C:\Windows\System32\drivers\AVerBas.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV - (wanatw) WAN Miniport (ATW) – C:\Windows\System32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (FileDisk) – C:\Windows\System32\drivers\filedisk.sys (iolo technologies, LLC (based on original work by Bo Brantén))
DRV - (HPFXBULK) – C:\Windows\System32\drivers\hpfxbulk.sys (Hewlett Packard)
DRV - (Aspi32) – C:\Windows\System32\drivers\aspi32.sys (Adaptec)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {4a6e1b85-1193-4a2a-aab8-7417f275f18a} - C:\Program Files\AOL Broadband Toolbar\aolbbtb.dll (AOL LLC.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/news/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 20 CA EC 0E F8 82 CA 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\..\URLSearchHook: {4a6e1b85-1193-4a2a-aab8-7417f275f18a} - C:\Program Files\AOL Broadband Toolbar\aolbbtb.dll (AOL LLC.)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AOL Search powered by Google"
FF - prefs.js..browser.search.defaulturl: "http://search.aol.co.uk/aol/search?query={searchTerms}&invocationType;=tb50-ff-aolbbTB50CL-chromesbox-en-uk"
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.aol.co.uk"
FF - prefs.js..extensions.enabledItems: [removed]:1.5.5.1982
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313
FF - prefs.js..extensions.enabledItems: {796503e4-19fe-48a3-82da-5c1fe0a13e3f}:5.0.0.3553
FF - prefs.js..extensions.enabledItems: {c2f863cd-0429-48c7-bb54-db756a951760}:5.96.10.6044
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.5
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:4.6
FF - prefs.js..keyword.URL: "http://search.aol.co.uk/aol/search?invocationType=tb50-ff-aolbbTB50CL-ab-en-uk&query;="


FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\ [2010/06/02 02:34:18 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\ [2010/01/13 04:18:58 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/08/17 08:21:38 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/18 16:33:05 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/08 20:59:59 | 000,000,000 | —D | M]

[2009/09/05 12:03:56 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Mozilla\Extensions
[2010/09/08 11:52:23 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\c5l0myxl.default\extensions
[2010/05/29 18:16:32 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\c5l0myxl.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/08/19 23:36:53 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\c5l0myxl.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/12/29 01:13:53 | 000,000,000 | —D | M] (AOL Broadband Toolbar) – C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\c5l0myxl.default\extensions\{796503e4-19fe-48a3-82da-5c1fe0a13e3f}
[2010/08/19 23:37:26 | 000,000,000 | —D | M] (No name found) – C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\c5l0myxl.default\extensions\{c2f863cd-0429-48c7-bb54-db756a951760}
[2010/05/27 10:08:39 | 000,000,000 | —D | M] – C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\c5l0myxl.default\extensions\[removed]
[2009/12/04 05:16:42 | 000,004,554 | —- | M] () – C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\c5l0myxl.default\searchplugins\aim-search-1.xml
[2009/09/10 13:38:56 | 000,004,212 | —- | M] () – C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\c5l0myxl.default\searchplugins\aim-search.xml
[2009/12/29 01:18:42 | 000,004,602 | —- | M] () – C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\c5l0myxl.default\searchplugins\aol-search-powered-by-google.xml
[2010/09/08 21:00:03 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/09/08 21:00:03 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/07/17 05:00:04 | 000,423,656 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/04/06 07:05:44 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/04/06 07:05:44 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/04/06 07:05:44 | 000,000,769 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/04/06 07:05:44 | 000,001,135 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/09/07 21:42:06 | 000,001,784 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 212.95.49.48 www.google.com
O1 - Hosts: 212.95.49.48 us.search.yahoo.com
O1 - Hosts: 212.95.49.48 uk.search.yahoo.com
O1 - Hosts: 212.95.49.48 search.yahoo.com
O1 - Hosts: 212.95.49.48 www.google.com.br
O1 - Hosts: 212.95.49.48 www.google.it
O1 - Hosts: 212.95.49.48 www.google.es
O1 - Hosts: 212.95.49.48 www.google.co.jp
O1 - Hosts: 212.95.49.48 www.google.com.mx
O1 - Hosts: 212.95.49.48 www.google.ca
O1 - Hosts: 212.95.49.48 www.google.com.au
O1 - Hosts: 212.95.49.48 www.google.nl
O1 - Hosts: 212.95.49.48 www.google.co.za
O1 - Hosts: 212.95.49.48 www.google.be
O1 - Hosts: 212.95.49.48 www.google.gr
O1 - Hosts: 212.95.49.48 www.google.at
O1 - Hosts: 212.95.49.48 www.google.se
O1 - Hosts: 212.95.49.48 www.google.ch
O1 - Hosts: 212.95.49.48 www.google.pt
O1 - Hosts: 212.95.49.48 www.google.dk
O1 - Hosts: 212.95.49.48 www.google.fi
O1 - Hosts: 212.95.49.48 www.google.ie
O1 - Hosts: 212.95.49.48 www.google.no
O1 - Hosts: 4 more lines…
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (AOL Broadband Toolbar Loader) - {776a9d06-e178-4aa0-aee4-b4de3a64ad28} - C:\Program Files\AOL Broadband Toolbar\aolbbtb.dll (AOL LLC.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (&Windows; Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (AOL Broadband Toolbar) - {e6ed7f95-e571-4f81-8757-5eb11252703d} - C:\Program Files\AOL Broadband Toolbar\aolbbtb.dll (AOL LLC.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows; Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Broadband Toolbar) - {E6ED7F95-E571-4F81-8757-5EB11252703D} - C:\Program Files\AOL Broadband Toolbar\aolbbtb.dll (AOL LLC.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\aol\1252186683\ee\aolsoftware.exe (AOL LLC)
O4 - HKLM..\Run: [Nuance PDF Reader-reminder] C:\Program Files\Nuance\PDF Reader\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [Rkiwrtk] C:\Program Files\PFU\Rack2\RKiwrtK.exe (PFU LIMITED)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()
O4 - HKCU..\Run: [Backup4all OTB Agent] File not found
O4 - HKCU..\Run: [Backup4all Scheduler] File not found
O4 - HKCU..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
O4 - Startup: C:\Users\Peter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O8 - Extra context menu item: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Se&nd; to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog; This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked; Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked; Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.5.3.cab (DLM Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.254.254 [removed] [removed]
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\570\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\570\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O22 - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\System32\DreamScene.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2009/12/19 00:05:41 | 000,000,000 | —D | M] - C:\AutoRoute 2010 – [ NTFS ]
O32 - AutoRun File - [2007/11/10 09:26:28 | 000,027,332 | —- | M] () - Z:\Auto-Protect is Off.pdf – [ NTFS ]
O32 - AutoRun File - [1999/04/26 23:11:24 | 000,034,304 | —- | M] () - Z:\Autoglass.doc – [ NTFS ]
O32 - AutoRun File - [2002/05/24 23:02:20 | 000,024,576 | —- | M] () - Z:\Autoview.doc – [ NTFS ]
O32 - AutoRun File - [2009/12/18 23:33:44 | 000,000,000 | —D | M] - Z:\AutoRoute 2010 – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/09/08 21:02:45 | 000,000,000 | —D | C] – C:\_OTL
[2010/09/08 21:00:28 | 000,000,000 | —D | C] – C:\ProgramData\Sun
[2010/09/08 21:00:27 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/09/08 20:59:59 | 000,423,656 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\deployJava1.dll
[2010/09/08 20:59:59 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2010/09/08 20:59:59 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2010/09/08 20:59:59 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2010/09/08 16:08:23 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Users\Peter\Desktop\OTL.exe
[2010/09/08 15:39:54 | 000,000,000 | —D | C] – C:\Users\Peter\AppData\Local\Adobe
[2010/09/08 15:38:23 | 000,000,000 | —D | C] – C:\Users\Peter\Desktop\GooredFix Backups
[2010/09/08 13:03:12 | 000,000,000 | —D | C] – \\LS-QL109\Peter\VirusProblem
[2010/09/08 12:07:55 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/09/07 14:44:52 | 001,293,400 | —- | C] (Kaspersky Lab ZAO) – C:\Users\Peter\Desktop\TDSSKiller.exe
[2010/09/07 10:18:17 | 000,029,272 | R— | C] (Adobe Systems Incorporated.) – C:\Windows\System32\AdobePDF.dll
[2010/09/03 13:21:04 | 000,000,000 | —D | C] – C:\Users\Peter\AppData\Local\Thomson Reuters
[2010/09/02 18:26:28 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/09/02 18:26:27 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/08/26 14:06:18 | 000,118,784 | —- | C] (Thomson Reuters) – C:\Windows\csifcsvc.exe
[2010/08/26 14:06:14 | 000,011,264 | —- | C] (Thomson Reuters) – C:\Windows\fcpurge.exe
[2010/08/26 14:04:45 | 000,000,000 | —D | C] – C:\WinCSI
[2010/08/26 14:00:44 | 000,104,328 | —- | C] (WebEx Communications, Inc.) – C:\Windows\System32\atsckernel.exe
[2010/08/26 14:00:43 | 000,043,912 | —- | C] (WebEx Communications, Inc.) – C:\Windows\System32\atashost.exe
[2010/08/20 21:03:12 | 000,000,000 | —D | C] – C:\Users\Peter\AppData\Local\WinZip
[2010/08/18 16:32:13 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2010/08/17 08:21:02 | 000,000,000 | —D | C] – C:\Program Files\Common Files\xing shared
[2010/08/14 21:45:50 | 000,000,000 | —D | C] – C:\ProgramData\DivX
[2010/08/13 22:03:48 | 000,000,000 | —D | C] – C:\ProgramData\Syscon
[2010/08/13 21:44:59 | 000,000,000 | —D | C] – C:\Users\Peter\AppData\Roaming\Fujitsu
[2010/08/13 21:36:43 | 000,000,000 | —D | C] – C:\ProgramData\PFU
[2010/08/13 21:34:10 | 000,000,000 | —D | C] – \\LS-QL109\Peter\Raku2Personal
[2010/08/13 21:32:22 | 000,000,000 | —D | C] – C:\Users\Peter\AppData\Roaming\InstallShield
[2010/08/13 21:12:24 | 000,000,000 | —D | C] – C:\Users\Peter\AppData\Roaming\PFU
[2010/08/13 20:34:16 | 000,000,000 | —D | C] – C:\Program Files\ABBYY FineReader for ScanSnap
[2010/08/13 20:32:22 | 000,035,328 | —- | C] (PFU) – C:\Windows\System32\pfdvmn.dll
[2010/08/13 20:32:22 | 000,032,768 | —- | C] (PFU) – C:\Windows\System32\chksti.dll
[2010/08/13 20:32:22 | 000,031,232 | —- | C] (PFU) – C:\Windows\System32\pfusti.dll
[2010/08/13 20:32:00 | 000,393,216 | —- | C] (PFU Limited.) – C:\Windows\System32\PFUP60.dll
[2010/08/13 20:32:00 | 000,249,856 | —- | C] (PFU Limited.) – C:\Windows\System32\PFURT.dll
[2010/08/13 20:32:00 | 000,069,632 | —- | C] (PFU Limited.) – C:\Windows\System32\PFUIRT.dll
[2010/08/13 20:23:27 | 001,990,656 | —- | C] (PFU Limited) – C:\Windows\System32\ippi5s300.dll
[2010/08/13 20:23:27 | 001,990,656 | —- | C] (PFU Limited) – C:\Windows\System32\ippi5s1300.dll
[2010/08/13 20:23:27 | 001,302,528 | —- | C] (PFU Limited) – C:\Windows\System32\ijl5s300.dll
[2010/08/13 20:23:27 | 001,302,528 | —- | C] (PFU Limited) – C:\Windows\System32\ijl5s1300.dll
[2010/08/13 20:23:27 | 000,279,552 | —- | C] (PFU Limited) – C:\Windows\System32\S1300u.dll
[2010/08/13 20:23:27 | 000,264,192 | —- | C] (PFU Limited) – C:\Windows\System32\s300u.dll
[2010/08/13 20:23:27 | 000,024,064 | —- | C] (PFU) – C:\Windows\System32\Fjmcusb.dll
[2010/08/13 20:23:27 | 000,021,504 | —- | C] (PFU) – C:\Windows\System32\fj52usb.dll
[2010/08/13 20:23:20 | 000,069,632 | —- | C] (PFU LIMITED) – C:\Windows\System32\distortion.dll
[2010/08/13 20:23:17 | 000,000,000 | —D | C] – C:\Windows\SSDriver
[2010/08/13 20:22:29 | 000,000,000 | —D | C] – C:\Program Files\PFU
[2010/08/13 20:22:29 | 000,000,000 | —D | C] – C:\Program Files\Common Files\PFU
[2010/08/11 23:20:17 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2010/08/11 23:20:17 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2010/08/11 23:20:17 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2010/08/11 23:20:17 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2010/08/11 23:20:17 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2010/08/11 23:20:17 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2010/08/11 23:20:17 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2010/08/11 23:20:16 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2010/08/11 23:20:16 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2010/08/11 23:20:16 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2010/08/11 23:20:16 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2010/08/11 23:20:16 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2010/08/11 23:20:16 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2010/08/11 23:20:16 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2010/08/11 23:20:16 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2010/08/11 23:20:15 | 000,081,920 | —- | C] (Radius Inc.) – C:\Windows\System32\iccvid.dll
[2010/08/11 23:20:07 | 002,037,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2010/08/11 23:20:06 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rtutils.dll
[2010/08/11 23:19:55 | 003,600,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2010/08/11 23:19:55 | 003,548,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2010/08/11 15:00:04 | 000,000,000 | —D | C] – \\LS-QL109\Peter\kidsgrandfather
[2009/06/30 21:05:18 | 000,018,944 | —- | C] ( ) – C:\Windows\System32\implode.dll
[2008/12/23 09:32:46 | 000,184,320 | R— | C] ( ) – C:\Windows\System32\SgE.interop.MSXML2.dll
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[10 C:\Users\Public\Documents\*.tmp files -> C:\Users\Public\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/09/09 09:05:17 | 008,650,752 | -HS- | M] () – C:\Users\Peter\ntuser.dat
[2010/09/09 08:59:34 | 000,170,496 | —- | M] () – C:\Users\Peter\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/09 08:58:55 | 000,080,384 | —- | M] () – C:\Users\Peter\Desktop\MBRCheck.exe
[2010/09/09 08:52:58 | 000,002,359 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\UltraMon.lnk
[2010/09/09 08:52:56 | 000,000,878 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/09/09 08:52:45 | 000,524,288 | -HS- | M] () – C:\Users\Peter\ntuser.dat{32247a3c-9bc9-11de-94a6-97a5ca6fbc0e}.TMContainer00000000000000000001.regtrans-ms
[2010/09/09 08:52:45 | 000,065,536 | -HS- | M] () – C:\Users\Peter\ntuser.dat{32247a3c-9bc9-11de-94a6-97a5ca6fbc0e}.TM.blf
[2010/09/09 08:21:00 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/09/09 08:20:00 | 000,000,906 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-928310548-3610001372-2690045346-1000UA.job
[2010/09/09 07:33:33 | 000,004,000 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/09/09 07:33:33 | 000,004,000 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/09/09 07:33:24 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/09/09 07:33:22 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/09/09 07:33:11 | 3487,748,096 | -HS- | M] () – C:\hiberfil.sys
[2010/09/09 00:20:00 | 000,000,854 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-928310548-3610001372-2690045346-1000Core.job
[2010/09/08 23:00:49 | 000,000,422 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{A42855A4-FB33-454F-B9C9-979B2841FC40}.job
[2010/09/08 21:08:52 | 1763,582,975 | —- | M] () – C:\Users\Peter\Peter.pst
[2010/09/08 20:53:05 | 000,000,474 | -H– | M] () – C:\Windows\tasks\Norton Security Scan for Peter.job
[2010/09/08 16:08:24 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\Peter\Desktop\OTL.exe
[2010/09/08 15:57:34 | 004,276,363 | -H– | M] () – C:\Users\Peter\AppData\Local\IconCache.db
[2010/09/08 15:48:12 | 000,001,358 | —- | M] () – C:\Windows\win.ini
[2010/09/08 14:52:09 | 000,001,854 | —- | M] () – C:\Users\Peter\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2010/09/08 14:52:08 | 000,001,854 | —- | M] () – C:\Users\Public\Desktop\Safari.lnk
[2010/09/08 14:01:56 | 000,039,808 | —- | M] () – \\LS-QL109\Peter\CIOT - Tax advisers critici…pdf
[2010/09/08 14:00:54 | 000,041,390 | —- | M] () – \\LS-QL109\Peter\CIOT - HMRC cuts - Withdraw…pdf
[2010/09/08 12:07:55 | 000,001,948 | —- | M] () – C:\Users\Peter\Desktop\HiJackThis.lnk
[2010/09/08 11:54:16 | 000,015,216 | —- | M] () – \\LS-QL109\Peter\VirusProblem.docx
[2010/09/08 09:14:40 | 000,000,085 | —- | M] () – C:\Windows\SGREP32.INI
[2010/09/08 09:05:41 | 000,001,896 | —- | M] () – C:\Windows\System32\SGLCH32.USR
[2010/09/08 06:39:02 | 000,024,428 | —- | M] () – \\LS-QL109\Peter\CashFlow2010-09.xlsx
[2010/09/07 14:44:52 | 001,293,400 | —- | M] (Kaspersky Lab ZAO) – C:\Users\Peter\Desktop\TDSSKiller.exe
[2010/09/01 13:38:36 | 000,000,900 | —- | M] () – C:\Users\Public\Documents\forms.gif
[2010/09/01 13:38:36 | 000,000,887 | —- | M] () – C:\Users\Public\Documents\ticked-enabled.gif
[2010/09/01 13:38:36 | 000,000,887 | —- | M] () – C:\Users\Public\Documents\Finalised.gif
[2010/09/01 13:38:36 | 000,000,862 | —- | M] () – C:\Users\Public\Documents\unticked-enabled.gif
[2010/09/01 13:38:36 | 000,000,858 | —- | M] () – C:\Users\Public\Documents\ticked-disabled.gif
[2010/09/01 13:38:36 | 000,000,857 | —- | M] () – C:\Users\Public\Documents\Empty.gif
[2010/09/01 13:38:36 | 000,000,849 | —- | M] () – C:\Users\Public\Documents\unticked-disabled.gif
[2010/09/01 13:38:35 | 000,000,862 | —- | M] () – C:\Users\Public\Documents\SchedIncomplete.gif
[2010/09/01 08:04:26 | 000,025,135 | —- | M] () – \\LS-QL109\Peter\CashFlow2010-08.xlsx
[2010/08/26 14:05:36 | 000,001,309 | —- | M] () – C:\Users\Public\Desktop\FileCabinet CS.lnk
[2010/08/26 14:00:37 | 000,104,328 | —- | M] (WebEx Communications, Inc.) – C:\Windows\System32\atsckernel.exe
[2010/08/26 14:00:37 | 000,043,912 | —- | M] (WebEx Communications, Inc.) – C:\Windows\System32\atashost.exe
[2010/08/20 21:02:30 | 000,001,750 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
[2010/08/20 12:31:31 | 000,390,152 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/08/17 08:21:26 | 000,185,920 | —- | M] (RealNetworks, Inc.) – C:\Windows\System32\rmoc3260.dll
[2010/08/17 08:21:14 | 000,006,656 | —- | M] (RealNetworks, Inc.) – C:\Windows\System32\pndx5016.dll
[2010/08/17 08:21:14 | 000,005,632 | —- | M] (RealNetworks, Inc.) – C:\Windows\System32\pndx5032.dll
[2010/08/17 08:20:06 | 000,278,528 | —- | M] (Real Networks, Inc) – C:\Windows\System32\pncrt.dll
[2010/08/13 20:31:58 | 000,000,757 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CardMinder Viewer.lnk
[2010/08/13 20:30:28 | 000,000,761 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Conversion to PDF with ScanSnap Organizer.lnk
[2010/08/13 20:23:18 | 000,001,605 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ScanSnap Manager.lnk
[2010/08/11 14:59:44 | 000,353,176 | —- | M] () – \\LS-QL109\Peter\kidsgrandfather.zip
[2010/08/10 15:06:00 | 000,025,794 | —- | M] () – \\LS-QL109\Peter\CashFlow2010-08 (Autosaved)a.xlsx
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[10 C:\Users\Public\Documents\*.tmp files -> C:\Users\Public\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/09 08:58:55 | 000,080,384 | —- | C] () – C:\Users\Peter\Desktop\MBRCheck.exe
[2010/09/08 14:52:08 | 000,001,854 | —- | C] () – C:\Users\Public\Desktop\Safari.lnk
[2010/09/08 14:01:56 | 000,039,808 | —- | C] () – \\LS-QL109\Peter\CIOT - Tax advisers critici…pdf
[2010/09/08 14:00:54 | 000,041,390 | —- | C] () – \\LS-QL109\Peter\CIOT - HMRC cuts - Withdraw…pdf
[2010/09/08 12:07:55 | 000,001,948 | —- | C] () – C:\Users\Peter\Desktop\HiJackThis.lnk
[2010/09/08 11:54:16 | 000,015,216 | —- | C] () – \\LS-QL109\Peter\VirusProblem.docx
[2010/09/08 06:39:00 | 000,024,428 | —- | C] () – \\LS-QL109\Peter\CashFlow2010-09.xlsx
[2010/09/01 08:04:24 | 000,025,135 | —- | C] () – \\LS-QL109\Peter\CashFlow2010-08.xlsx
[2010/08/26 14:05:36 | 000,001,309 | —- | C] () – C:\Users\Public\Desktop\FileCabinet CS.lnk
[2010/08/13 20:31:58 | 000,000,757 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CardMinder Viewer.lnk
[2010/08/13 20:30:28 | 000,000,761 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Conversion to PDF with ScanSnap Organizer.lnk
[2010/08/13 20:23:29 | 000,000,161 | —- | C] () – C:\Windows\DISPARAM.INI
[2010/08/13 20:23:18 | 000,001,605 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ScanSnap Manager.lnk
[2010/08/11 14:59:38 | 000,353,176 | —- | C] () – \\LS-QL109\Peter\kidsgrandfather.zip
[2010/08/10 15:06:00 | 000,025,794 | —- | C] () – \\LS-QL109\Peter\CashFlow2010-08 (Autosaved)a.xlsx
[2010/07/07 17:14:35 | 000,040,960 | —- | C] () – C:\Windows\System32\SgEEncrypt.dll
[2010/07/07 17:14:27 | 000,000,127 | —- | C] () – C:\Windows\BackRest.ini
[2010/04/22 10:41:03 | 000,040,448 | —- | C] () – C:\Windows\System32\UNACE.DLL
[2010/03/12 17:17:54 | 000,256,512 | —- | C] () – C:\Windows\System32\SGOPopDg.dll
[2010/03/12 17:17:52 | 000,401,408 | —- | C] () – C:\Windows\System32\sgBackupRestore.dll
[2010/03/12 17:17:51 | 000,094,208 | —- | C] () – C:\Windows\System32\P11Dreg.dll
[2010/03/12 17:17:51 | 000,040,960 | —- | C] () – C:\Windows\System32\sgServPackId.dll
[2010/02/09 11:33:54 | 000,045,056 | —- | C] () – C:\Windows\System32\SgELauncher.dll
[2010/02/09 11:33:14 | 000,114,688 | —- | C] () – C:\Windows\System32\SgEData.dll
[2010/01/07 19:57:52 | 000,000,052 | —- | C] () – C:\Windows\System32\actobp.ini
[2009/12/27 14:48:10 | 000,000,053 | —- | C] () – C:\Windows\wininit.ini
[2009/12/24 12:11:10 | 000,282,624 | —- | C] () – C:\Windows\System32\SGList32.dll
[2009/12/24 12:11:04 | 000,278,528 | —- | C] () – C:\Windows\System32\SGTool32.dll
[2009/12/24 12:11:00 | 000,090,112 | —- | C] () – C:\Windows\System32\SGIntl32.dll
[2009/12/24 12:10:58 | 000,172,032 | —- | C] () – C:\Windows\System32\SGHelp32.dll
[2009/12/24 12:10:58 | 000,073,728 | —- | C] () – C:\Windows\System32\SGDt32.dll
[2009/12/24 12:10:52 | 000,258,048 | —- | C] () – C:\Windows\System32\SGSchemeXml.dll
[2009/12/24 12:10:44 | 000,118,784 | —- | C] () – C:\Windows\System32\SGSchemeXP.dll
[2009/12/24 12:10:40 | 000,176,128 | —- | C] () – C:\Windows\System32\SGSchemeDefault.dll
[2009/12/24 12:10:34 | 000,221,184 | —- | C] () – C:\Windows\System32\SGSchemeManager.dll
[2009/12/24 12:10:28 | 000,094,208 | —- | C] () – C:\Windows\System32\SGCom32.dll
[2009/12/24 12:09:52 | 000,143,360 | —- | C] () – C:\Windows\System32\SGSTDREG.dll
[2009/12/24 12:09:48 | 000,131,072 | —- | C] () – C:\Windows\System32\SGRegister.dll
[2009/12/24 12:09:44 | 000,241,664 | —- | C] () – C:\Windows\System32\SGWebBrowser.dll
[2009/12/23 17:21:00 | 000,008,192 | —- | C] () – C:\Windows\System32\NetFerret.dll
[2009/10/23 08:23:36 | 000,000,256 | —- | C] () – C:\Windows\MYOBP.INI
[2009/10/23 08:23:36 | 000,000,125 | —- | C] () – C:\Windows\SwDrvs.ini
[2009/10/23 08:23:36 | 000,000,039 | —- | C] () – C:\Windows\MYOB.INI
[2009/09/29 11:54:50 | 000,087,552 | —- | C] () – C:\Windows\System32\cpwmon2k.dll
[2009/09/22 23:09:53 | 000,000,085 | —- | C] () – C:\Windows\SGREP32.INI
[2009/09/22 12:09:33 | 000,000,093 | —- | C] () – C:\Users\Peter\AppData\Local\fusioncache.dat
[2009/09/12 18:23:34 | 000,000,064 | —- | C] () – C:\ProgramData\sandra.ldb
[2009/09/12 18:22:57 | 011,927,552 | —- | C] () – C:\ProgramData\sandra.mda
[2009/09/12 14:41:07 | 000,053,248 | —- | C] () – C:\Windows\System32\ZLIB.DLL
[2009/09/10 17:08:57 | 000,000,663 | —- | C] () – C:\Windows\openrda.ini
[2009/09/10 17:08:56 | 000,335,872 | —- | C] () – C:\Windows\System32\ctreestd.dll
[2009/09/10 17:08:47 | 000,000,000 | —- | C] () – C:\Windows\drvxl32.INI
[2009/09/10 17:08:46 | 000,000,000 | —- | C] () – C:\Windows\drvwd32.INI
[2009/09/05 21:49:40 | 000,000,004 | —- | C] () – C:\Windows\msoffice.ini
[2009/09/05 20:23:50 | 002,116,008 | —- | C] () – C:\Windows\System32\Incinerator.dll
[2009/09/05 20:23:06 | 000,074,703 | —- | C] () – C:\Windows\System32\mfc45.dll
[2009/09/04 20:13:43 | 000,000,054 | —- | C] () – C:\Windows\Payroll.ini
[2009/09/04 15:26:49 | 001,724,416 | —- | C] () – C:\Windows\System32\SGRep32.dll
[2009/09/04 15:26:49 | 000,249,856 | —- | C] () – C:\Windows\System32\SGCDlg32.dll
[2009/09/04 15:26:49 | 000,233,472 | —- | C] () – C:\Windows\System32\SGLch32.dll
[2009/09/04 15:26:49 | 000,200,704 | —- | C] () – C:\Windows\System32\SGTBar32.dll
[2009/09/04 15:26:49 | 000,143,360 | —- | C] () – C:\Windows\System32\SGCtrlEx.dll
[2009/09/04 15:26:49 | 000,061,440 | —- | C] () – C:\Windows\System32\SGAppBar.dll
[2009/09/04 15:26:49 | 000,061,440 | —- | C] () – C:\Windows\System32\SG3D32.dll
[2009/09/04 15:26:49 | 000,049,152 | —- | C] () – C:\Windows\System32\SgStat32.dll
[2009/09/04 15:26:49 | 000,049,152 | —- | C] () – C:\Windows\System32\SGLogo32.dll
[2009/09/04 15:26:34 | 000,032,256 | —- | C] () – C:\Windows\System32\_RegTLB.dll
[2009/09/04 03:03:20 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/09/03 22:50:04 | 000,170,496 | —- | C] () – C:\Users\Peter\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/09/02 23:59:45 | 000,000,541 | —- | C] () – C:\Windows\ODBC.INI
[2009/09/02 23:38:16 | 000,540,672 | —- | C] () – C:\Windows\System32\Tx32.dll
[2009/09/02 23:38:15 | 000,000,478 | —- | C] () – C:\Windows\System32\IC32.INI
[2009/09/02 16:10:10 | 000,000,680 | —- | C] () – C:\Users\Peter\AppData\Local\d3d9caps.dat
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/07/27 15:15:32 | 000,001,205 | —- | C] () – C:\Windows\SAGEINTL.INI
[2009/07/20 14:17:40 | 000,178,176 | —- | C] () – C:\Windows\System32\unrar.dll
[2009/06/30 21:05:18 | 000,030,793 | —- | C] () – C:\Windows\System32\crtslv.dll
[2009/05/12 08:36:15 | 000,126,976 | —- | C] () – C:\Windows\System32\Isb.dll
[2009/02/04 23:09:45 | 000,024,576 | —- | C] () – C:\Windows\System32\VlUtils.dll
[2009/02/04 23:06:46 | 000,315,392 | —- | C] () – C:\Windows\System32\VLMenuRes.dll
[2009/02/04 01:30:04 | 000,017,920 | —- | C] () – C:\Windows\System32\xfxbinimg.dll
[2008/12/22 10:28:06 | 000,061,440 | —- | C] () – C:\Windows\System32\SageFolderBrowser.dll
[2008/12/02 20:06:22 | 000,017,408 | —- | C] () – C:\Windows\System32\SgDate.dll
[2008/12/01 15:36:00 | 000,180,224 | —- | C] () – C:\Windows\System32\SGJPEG32.dll
[2008/09/02 19:35:30 | 000,005,434 | —- | C] () – C:\Windows\UN070209.INI
[2008/08/29 17:58:54 | 000,004,605 | —- | C] () – C:\Windows\UN080516.INI
[2008/07/28 17:06:48 | 000,014,344 | —- | C] () – C:\Windows\UN060501.INI
[2008/06/03 03:35:18 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2008/04/27 10:33:36 | 000,765,952 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2008/04/14 09:39:40 | 001,914,216 | —- | C] () – C:\Windows\System32\ltmm15.dll
[2008/01/21 03:23:41 | 000,081,158 | —- | C] () – C:\Windows\System32\manage-bde.ini.en
[2007/01/08 00:48:36 | 000,548,864 | —- | C] () – C:\Windows\System32\hpgt4850.dll
[2006/11/02 13:34:20 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/09/06 20:42:56 | 000,237,568 | —- | C] () – C:\Windows\System32\hppapr02.dll
[2006/07/17 13:11:36 | 000,667,280 | —- | C] () – C:\Windows\System32\tx12.dll
[2006/02/09 04:20:00 | 000,000,530 | —- | C] () – C:\Windows\System32\tx12_ic.ini
[2002/04/16 11:27:54 | 000,000,005 | -HS- | C] () – C:\Windows\System32\CdI5T.drv
[1998/03/26 02:12:00 | 000,053,248 | —- | C] () – C:\Windows\System32\SgHmZLib.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 198 bytes -> C:\ProgramData\TEMP:0D6E9A34
@Alternate Data Stream - 164 bytes -> C:\ProgramData\TEMP:D1B5B4F1
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:21654C57
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:8B4F37E5
< End of report >