HTTP Nukesploit Request Take 2

Re-post as original post was blank:
I am infected with a virus. Norton found an HTTP Nukesploit Request, and didn't do anything with it. My problem is similar to this guy's, but I didn't want to use his custom fix in case mine's different.
I ran OTL and am including the log files (OTL.txt and Extras.txt) below. Can anyone help? Thank you!

OTL.txt:

OTL logfile created on: 9/13/2010 11:02:44 AM - Run 1
OTL by OldTimer - Version 3.2.12.0 Folder = C:\Documents and Settings\Admin\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 58.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 931.51 Gb Total Space | 440.63 Gb Free Space | 47.30% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GREGNEW
Current User Name: Admin
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/09/13 11:02:20 | 000,576,000 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Admin\Desktop\OTL.exe
PRC - [2010/09/03 17:11:54 | 000,864,624 | —- | M] (Lavasoft) – C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2010/09/03 17:11:53 | 001,355,928 | —- | M] (Lavasoft) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2010/08/13 12:58:56 | 000,144,672 | —- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/07/26 12:52:06 | 000,546,360 | —- | M] (Google) – C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
PRC - [2010/04/23 13:48:24 | 009,241,088 | —- | M] () – C:\Program Files\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe
PRC - [2010/02/25 17:21:50 | 000,126,392 | R— | M] (Symantec Corporation) – C:\Program Files\Norton Security Suite\Norton Security Suite\Engine\4.2.0.12\ccsvchst.exe
PRC - [2010/01/22 16:20:34 | 000,413,810 | —- | M] () – C:\Program Files\Samsung\SAMSUNG PC Share Manager\http_ss_win_pro.exe
PRC - [2010/01/21 13:27:44 | 009,136,960 | —- | M] (Western Digital) – C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
PRC - [2010/01/21 13:27:42 | 002,057,536 | —- | M] (WDC) – C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
PRC - [2010/01/21 13:24:08 | 000,110,592 | —- | M] (WDC) – C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
PRC - [2009/11/08 15:39:39 | 000,323,392 | —- | M] (BitTorrent, Inc.) – C:\Program Files\DNA\btdna.exe
PRC - [2009/07/20 12:30:50 | 000,813,584 | —- | M] (Logitech, Inc.) – C:\Program Files\Logitech\SetPoint\SetPoint.exe
PRC - [2009/07/10 12:42:32 | 000,055,824 | —- | M] (Logitech, Inc.) – C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
PRC - [2009/06/16 05:58:08 | 000,020,480 | —- | M] (Memeo) – C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
PRC - [2009/06/10 01:02:50 | 000,904,840 | —- | M] (Acronis) – C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
PRC - [2009/06/10 00:57:40 | 000,136,472 | —- | M] (Acronis) – C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
PRC - [2009/06/10 00:57:36 | 000,431,384 | —- | M] (Acronis) – C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
PRC - [2009/06/10 00:55:30 | 001,326,080 | —- | M] (Acronis) – C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
PRC - [2009/02/28 16:40:38 | 000,075,048 | —- | M] (cyberlink) – C:\Program Files\CyberLink\Shared Files\brs.exe
PRC - [2009/02/16 06:55:38 | 000,087,336 | —- | M] (CyberLink Corp.) – C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe
PRC - [2008/06/11 20:43:26 | 000,640,376 | —- | M] (Adobe Systems Inc.) – C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
PRC - [2008/05/16 13:31:48 | 031,256,576 | —- | M] () – C:\Program Files\MSI\DualCoreCenter\DualCoreCenter.exe
PRC - [2008/05/07 14:12:54 | 003,425,632 | —- | M] (Symantec Corporation) – C:\Program Files\Norton Save and Restore\Agent\VProSvc.exe
PRC - [2008/05/07 14:12:54 | 002,037,088 | —- | M] (Symantec Corporation) – C:\Program Files\Norton Save and Restore\Agent\VProTray.exe
PRC - [2008/04/13 17:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2008/02/09 17:06:33 | 000,238,968 | —- | M] (Symantec Corporation) – C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2008/02/09 17:06:15 | 000,308,600 | —- | M] (Symantec Corporation) – C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
PRC - [2004/04/14 12:46:50 | 000,057,393 | —- | M] (ScanSoft, Inc.) – C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
PRC - [2004/03/18 07:33:26 | 000,892,928 | —- | M] (Logitech Inc.) – C:\Program Files\Logitech\iTouch\iTouch.exe
PRC - [2002/04/11 17:00:00 | 000,057,344 | —- | M] (brother Industries Ltd) – C:\WINDOWS\system32\brsvc01a.exe
PRC - [2001/12/12 17:01:00 | 000,045,056 | —- | M] (brother Industries Ltd) – C:\WINDOWS\system32\brss01a.exe


========== Modules (SafeList) ==========

MOD - [2010/09/13 11:02:20 | 000,576,000 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Admin\Desktop\OTL.exe
MOD - [2010/05/13 22:35:01 | 000,415,088 | R— | M] (Symantec Corporation) – C:\Program Files\Norton Security Suite\Norton Security Suite\Engine\4.2.0.12\asoehook.dll
MOD - [2009/07/20 12:29:06 | 000,045,584 | —- | M] (Logitech, Inc.) – C:\Program Files\Logitech\SetPoint\lgscroll.dll
MOD - [2009/07/11 23:12:06 | 000,632,656 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll
MOD - [2009/07/11 21:02:02 | 000,653,120 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
MOD - [2009/07/11 21:02:00 | 000,569,664 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
MOD - [2008/04/13 17:10:20 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msscript.ocx
MOD - [2004/03/18 07:26:50 | 000,004,608 | —- | M] (Logitech Inc.) – C:\Program Files\Logitech\iTouch\itchhk.dll
MOD - [2004/03/18 07:26:48 | 000,114,688 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\Logitech\Scrolling\LGMSGHK.DLL


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] – C:\WINDOWS\System32\appmgmts.dll – (AppMgmt)
SRV - [2010/09/09 14:40:00 | 002,854,488 | —- | M] () [Auto | Running] – c:\Program Files\Common Files\Akamai\rswin_3746.dll – (Akamai)
SRV - [2010/09/03 17:11:53 | 001,355,928 | —- | M] (Lavasoft) [Auto | Running] – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe – (Lavasoft Ad-Aware Service)
SRV - [2010/08/13 12:58:56 | 000,144,672 | —- | M] (Apple Inc.) [Auto | Running] – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe – (Apple Mobile Device)
SRV - [2010/04/23 13:48:24 | 009,241,088 | —- | M] () [Auto | Running] – C:\Program Files\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe – (AllShare)
SRV - [2010/02/25 17:21:50 | 000,126,392 | R— | M] (Symantec Corporation) [Unknown | Running] – C:\Program Files\Norton Security Suite\Norton Security Suite\Engine\4.2.0.12\ccSvcHst.exe – (N360)
SRV - [2010/01/21 13:24:08 | 000,110,592 | —- | M] (WDC) [Auto | Running] – C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe – (WDDMService)
SRV - [2009/08/01 18:25:44 | 000,020,480 | —- | M] () [Auto | Stopped] – C:\Program Files\VillainousMind\Locura Personal Media Server\Bin\LocuraPersonalMediaServer.exe – (Locura Personal Media Server)
SRV - [2009/07/26 04:43:14 | 000,025,832 | —- | M] (BioWare) [On_Demand | Stopped] – C:\Program Files\Dragon Age\bin_ship\daupdatersvc.service.exe – (DAUpdaterSvc)
SRV - [2009/07/20 12:28:10 | 000,121,360 | —- | M] (Logitech, Inc.) [On_Demand | Stopped] – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe – (LBTServ)
SRV - [2009/06/16 05:58:08 | 000,020,480 | —- | M] (Memeo) [Auto | Running] – C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe – (WDSmartWareBackgroundService)
SRV - [2009/06/10 00:57:36 | 000,431,384 | —- | M] (Acronis) [Auto | Running] – C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe – (AcrSch2Svc)
SRV - [2009/02/13 15:14:56 | 000,655,624 | —- | M] (Acresso Software Inc.) [On_Demand | Stopped] – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe – (FLEXnet Licensing Service)
SRV - [2008/09/05 09:52:32 | 003,220,856 | —- | M] (Symantec Corporation) [On_Demand | Stopped] – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE – (LiveUpdate)
SRV - [2008/08/15 03:46:20 | 000,284,016 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe – (Adobe Version Cue CS4)
SRV - [2008/05/07 14:12:54 | 003,425,632 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Norton Save and Restore\Agent\VProSvc.exe – (Norton Save and Restore)
SRV - [2008/02/09 17:06:33 | 000,238,968 | —- | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe – (Automatic LiveUpdate Scheduler)
SRV - [2002/04/11 17:00:00 | 000,057,344 | —- | M] (brother Industries Ltd) [Auto | Running] – C:\WINDOWS\system32\brsvc01a.exe – (Brother XP spl Service)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – D:\NTACCESS.sys – (NTACCESS)
DRV - File not found [Kernel | On_Demand | Stopped] – D:\INSTALL\GMSIPCI.SYS – (GMSIPCI)
DRV - [2010/08/13 14:37:28 | 000,015,008 | —- | M] () [Kernel | On_Demand | Stopped] – C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys – (Lavasoft Kernexplorer)
DRV - [2010/08/09 18:11:05 | 000,692,272 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20100810.004\BHDrvx86.sys – (BHDrvx86)
DRV - [2010/07/16 22:08:26 | 001,362,608 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100912.005\NAVEX15.SYS – (NAVEX15)
DRV - [2010/07/16 22:08:26 | 000,085,424 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100912.005\NAVENG.SYS – (NAVENG)
DRV - [2010/07/12 01:55:39 | 000,064,288 | —- | M] (Lavasoft AB) [File_System | Boot | Running] – C:\WINDOWS\system32\DRIVERS\Lbd.sys – (Lbd)
DRV - [2010/05/28 17:39:01 | 000,371,248 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys – (eeCtrl)
DRV - [2010/05/28 17:39:01 | 000,102,448 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys – (EraserUtilRebootDrv)
DRV - [2010/05/28 12:33:19 | 000,331,640 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100909.001\IDSXpx86.sys – (IDSxpx86)
DRV - [2010/05/05 21:01:59 | 000,361,904 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\N360\0402000.00C\SYMTDI.SYS – (SYMTDI)
DRV - [2010/04/28 22:03:51 | 000,116,784 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\N360\0402000.00C\Ironx86.SYS – (SymIRON)
DRV - [2010/04/25 07:10:27 | 005,912,096 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RtkHDAud.sys – (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2010/04/25 07:10:24 | 001,395,800 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Monfilt.sys – (Monfilt)
DRV - [2010/04/25 07:10:23 | 001,691,480 | —- | M] (Creative) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Ambfilt.sys – (Ambfilt)
DRV - [2010/04/21 20:02:20 | 000,173,104 | —- | M] (Symantec Corporation) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\N360\0402000.00C\SYMEFA.SYS – (SymEFA)
DRV - [2010/04/21 19:29:50 | 000,325,680 | —- | M] (Symantec Corporation) [File_System | On_Demand | Running] – C:\WINDOWS\System32\Drivers\N360\0402000.00C\SRTSP.SYS – (SRTSP)
DRV - [2010/04/21 19:29:50 | 000,043,696 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\N360\0402000.00C\SRTSPX.SYS – (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2010/04/17 16:00:36 | 000,124,976 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SYMEVENT.SYS – (SymEvent)
DRV - [2010/04/04 18:04:35 | 000,044,384 | —- | M] (Acronis) [File_System | Auto | Running] – C:\WINDOWS\system32\drivers\tifsfilt.sys – (tifsfilter)
DRV - [2010/04/04 18:04:34 | 000,441,760 | —- | M] (Acronis) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\timntr.sys – (timounter)
DRV - [2010/04/04 18:04:18 | 000,132,480 | —- | M] (Acronis) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\snapman.sys – (snapman)
DRV - [2010/04/04 18:04:05 | 000,368,480 | —- | M] (Acronis) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\tdrpman.sys – (tdrpman)
DRV - [2010/03/02 21:21:08 | 004,630,016 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ati2mtag.sys – (ati2mtag)
DRV - [2010/02/25 17:22:57 | 000,501,888 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\N360\0402000.00C\ccHPx86.sys – (ccHP)
DRV - [2010/02/11 05:02:15 | 000,226,880 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\tcpip6.sys – (Tcpip6)
DRV - [2009/12/02 23:09:48 | 000,047,408 | R— | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SymIM.sys – (SymIMMP)
DRV - [2009/12/02 23:09:48 | 000,047,408 | R— | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\SymIM.sys – (SymIM)
DRV - [2009/10/14 20:50:05 | 000,328,752 | R— | M] (Symantec Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\N360\0402000.00C\SYMDS.SYS – (SymDS)
DRV - [2009/07/28 05:55:00 | 000,143,360 | —- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Rtenicxp.sys – (RTLE8023xp)
DRV - [2009/06/17 09:56:16 | 000,037,392 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LMouFilt.Sys – (LMouFilt)
DRV - [2009/06/17 09:56:06 | 000,035,472 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LHidFilt.Sys – (LHidFilt)
DRV - [2009/06/17 09:55:58 | 000,010,384 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LHidEqd.sys – (LHidEqd)
DRV - [2009/06/17 09:55:50 | 000,040,720 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LEqdUsb.sys – (LEqdUsb)
DRV - [2009/05/09 01:14:20 | 000,014,736 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\nuidfltr.sys – (NuidFltr)
DRV - [2009/02/28 16:40:18 | 000,087,536 | —- | M] (CyberLink Corp.) [2009/05/10 11:49:45] [Kernel | Auto | Running] – C:\Program Files\CyberLink\PowerDVD9\000.fcl – ({B154377D-700F-42cc-9474-23858FBDF4BD})
DRV - [2009/02/13 08:02:52 | 000,011,520 | —- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wdcsam.sys – (WDC_SAM)
DRV - [2009/01/23 00:51:18 | 000,064,480 | —- | M] (Juniper Networks) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\NEOFLTR_630_13881.sys – (NEOFLTR_630_13881) Juniper Networks TDI Filter Driver (NEOFLTR_630_13881)
DRV - [2008/09/26 07:53:00 | 000,079,120 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LMouKE.Sys – (LMouKE)
DRV - [2008/09/26 07:52:00 | 000,063,248 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\L8042mou.Sys – (L8042mou)
DRV - [2008/09/26 07:52:00 | 000,020,240 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\L8042Kbd.sys – (L8042Kbd)
DRV - [2008/09/26 07:52:00 | 000,010,384 | —- | M] (Logitech, Inc.) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\LBeepKE.sys – (LBeepKE)
DRV - [2008/08/14 05:57:42 | 000,074,720 | —- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] – C:\WINDOWS\System32\drivers\adfs.sys – (adfs)
DRV - [2008/05/07 13:59:20 | 000,137,952 | —- | M] (StorageCraft) [File_System | Boot | Running] – C:\WINDOWS\system32\DRIVERS\symsnap.sys – (symsnap)
DRV - [2008/04/30 12:54:28 | 000,064,160 | —- | M] (Juniper Networks) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\NEOFLTR_600_13073.sys – (NEOFLTR_600_13073) Juniper Networks TDI Filter Driver (NEOFLTR_600_13073)
DRV - [2008/04/13 11:56:06 | 000,088,320 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\nwlnkipx.sys – (NwlnkIpx)
DRV - [2008/04/13 10:46:20 | 000,048,128 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\61883.sys – (61883)
DRV - [2008/04/13 10:46:20 | 000,038,912 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\avc.sys – (Avc)
DRV - [2008/04/13 10:46:10 | 000,051,200 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\msdv.sys – (MSDV)
DRV - [2008/03/24 08:14:02 | 000,055,808 | —- | M] (Your Corporation) [Kernel | On_Demand | Running] – C:\Program Files\MSI\DualCoreCenter\RushTop.sys – (RushTopDevice2)
DRV - [2008/02/27 06:08:04 | 000,028,160 | —- | M] (MICRO-STAR INT'L CO., LTD.) [Kernel | On_Demand | Running] – C:\Program Files\MSI\DualCoreCenter\NTGLM7X.sys – (DualCoreCenter)
DRV - [2007/10/12 07:40:12 | 000,009,096 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\WINDOWS\System32\DRIVERS\amdide.sys – (amdide)
DRV - [2007/07/20 15:40:10 | 000,084,992 | —- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AtiHdmi.sys – (AtiHdmiService)
DRV - [2007/06/29 12:47:34 | 000,034,304 | —- | M] (AMD, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AmdLLD.sys – (AmdLLD)
DRV - [2007/06/27 16:31:26 | 000,014,072 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\vproeventmonitor.sys – (VProEventMonitor)
DRV - [2007/02/13 17:06:36 | 000,128,104 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\WimFltr.sys – (WimFltr)
DRV - [2007/02/13 16:33:04 | 000,037,864 | —- | M] (Symantec Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\v2imount.sys – (v2imount)
DRV - [2006/07/01 20:39:40 | 000,036,864 | —- | M] (Advanced Micro Devices) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\AmdK8.sys – (AmdK8)
DRV - [2005/11/20 22:48:21 | 000,016,512 | —- | M] (Adaptec) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\ASPI32.SYS – (Aspi32)
DRV - [2005/01/07 15:07:18 | 000,138,752 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\hdaudbus.sys – (HDAudBus)
DRV - [2004/03/10 11:42:24 | 000,012,953 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\itchfltr.sys – (itchfltr)
DRV - [2004/03/03 07:50:00 | 000,037,887 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LHidUsb.sys – (LHidUsb)
DRV - [2004/03/03 07:50:00 | 000,014,095 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LCcfltr.sys – (LCcfltr)
DRV - [2003/03/31 05:00:00 | 000,063,232 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\nwlnknb.sys – (NwlnkNb)
DRV - [2003/03/31 05:00:00 | 000,055,936 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\nwlnkspx.sys – (NwlnkSpx)
DRV - [2003/01/25 13:54:00 | 000,428,064 | —- | M] (AVerMedia TECHNOLOGIES, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Cap7134.sys – (Cap7134)
DRV - [2001/08/17 11:05:06 | 000,025,216 | —- | M] (Microsoft Corporation) [Kernel | System | Stopped] – C:\WINDOWS\system32\drivers\OVSound2.sys – (lusbaudio)
DRV - [2001/08/17 11:05:04 | 000,025,088 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\OVCA.sys – (QCAbsee) Logitech QuickCam Web (0801)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/mycomcast/#
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\IPSFFPlgn\ [2010/06/12 11:29:33 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\coFFPlgn\ [2010/04/17 16:01:12 | 000,000,000 | —D | M]


O1 HOSTS File: ([2009/02/13 16:07:22 | 000,000,762 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O2 - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\Snagit 9\SnagitBHO.dll (TechSmith Corporation)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Security Suite\Norton Security Suite\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Security Suite\Norton Security Suite\Engine\4.2.0.12\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Norton Security Suite\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Snagit) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\Snagit 9\SnagitIEAddin.dll (TechSmith Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Norton Security Suite\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe (Acronis)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe_ID0ENQBO] C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4Tray.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [BDRegion] C:\Program Files\CyberLink\Shared Files\brs.exe (cyberlink)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [DelReg] C:\Program Files\MSI\DualCoreCenter\DelReg.exe ()
O4 - HKLM..\Run: [DiscWizardMonitor.exe] C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe File not found
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [Norton Save and Restore 2.0] C:\Program Files\Norton Save and Restore\Agent\VProTray.exe (Symantec Corporation)
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [PDVD9LanguageShortcut] C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [RemoteControl9] C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Scansoft, Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
O4 - HKLM..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe (Logitech Inc.)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [BitTorrent DNA] C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
O4 - Startup: C:\Documents and Settings\Admin\Start Menu\Programs\Startup\Logitech . Product Registration.lnk = C:\Program Files\Common Files\Logishrd\eReg\SetPoint\eReg.exe (Leader Technologies/Logitech)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DualCoreCenter.lnk = C:\Program Files\MSI\DualCoreCenter\StartUpDualCoreCenter.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Calendar Sync.lnk = C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe (Google)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDDMStatus.lnk = C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe (WDC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDSmartWare.lnk = C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe (Western Digital)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Juniper Networks\Secure Application Manager\samnsp.dll (Juniper Networks)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Juniper Networks\Secure Application Manager\samnsp.dll (Juniper Networks)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: com.tw ([asia.msi] http in Trusted sites)
O15 - HKCU\..Trusted Domains: com.tw ([global.msi] http in Trusted sites)
O15 - HKCU\..Trusted Domains: com.tw ([www.msi] http in Trusted sites)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {16F67783-7E72-4C39-99C4-4780A8335484} http://www.syncmyride.com/Own/Modules/Uplo…pplets/sync.cab (SyncXfer Class)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2…78f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1232827385745 (WUWebControl Class)
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} https://webdl.symantec.com/activex/symdlmgr.cab (Symantec Download Manager)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} http://liveupdate.msi.com.tw/autobios/LOnline/install.cab (WebSDev Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} https://netscreen.upmc.com/dana-cached/setu…perSetupSP1.cab (JuniperSetupControlXP Class)
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://secureconnect.salemhospital.org/dan…SetupClient.cab (JuniperSetupClientControl Class)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.2.0…inAxControl.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Admin\My Documents\My Pictures\pregolego.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Admin\My Documents\My Pictures\pregolego.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (relog_ap) - C:\WINDOWS\System32\relog_ap.dll (Acronis)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/01/24 11:50:28 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2010/01/10 09:42:37 | 002,047,357 | —- | M] () - C:\AutoHotkey104805_Install.exe – [ NTFS ]
O33 - MountPoints2\{0c8b4757-ecd6-11dd-8dd0-0021851ca4a6}\Shell\AutoRun\command - "" = E:\PortableVault.exe – File not found
O33 - MountPoints2\{0f661173-75a0-11df-bdf8-0021851ca4a6}\Shell\AutoRun\command - "" = E:\PortableVault.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/09/13 11:01:54 | 000,576,000 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Admin\Desktop\OTL.exe
[2010/09/13 10:39:08 | 000,000,000 | —D | C] – C:\WINDOWS\pss
[2010/09/13 07:05:06 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/09/13 07:04:43 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/09/13 07:04:43 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/09/13 07:04:43 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/09/12 20:28:43 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\Local Settings\Application Data\NPE
[2010/09/08 06:48:08 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/09/08 06:47:54 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/09/06 14:39:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\My Documents\AdAware
[2010/09/04 20:55:00 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\hidserv.dll
[2010/09/04 20:52:35 | 000,014,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\nuidfltr.sys
[2010/09/04 20:51:47 | 000,000,000 | —D | C] – C:\Program Files\Microsoft IntelliPoint
[2010/09/03 17:51:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\Local Settings\Application Data\Google
[2010/09/03 17:51:34 | 000,000,000 | —D | C] – C:\Program Files\Google
[2010/08/23 13:40:36 | 000,000,000 | —D | C] – C:\Documents and Settings\Admin\My Documents\Retirement investments
[2010/08/18 15:59:49 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2009/05/03 10:25:45 | 000,047,360 | —- | C] (VSO Software) – C:\Documents and Settings\Admin\Application Data\pcouffin.sys
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/09/13 11:02:20 | 000,576,000 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Admin\Desktop\OTL.exe
[2010/09/13 10:48:50 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/09/13 10:47:26 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/09/13 10:47:20 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/09/13 10:46:17 | 006,815,744 | —- | M] () – C:\Documents and Settings\Admin\ntuser.dat
[2010/09/13 10:46:16 | 002,645,470 | -H– | M] () – C:\Documents and Settings\Admin\Local Settings\Application Data\IconCache.db
[2010/09/13 10:08:43 | 000,000,826 | —- | M] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/09/13 10:03:20 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Admin\ntuser.ini
[2010/09/13 09:24:14 | 000,000,310 | —- | M] () – C:\WINDOWS\tasks\Orb Index when idle.job
[2010/09/12 20:15:21 | 000,002,422 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/09/10 07:49:12 | 031,004,533 | —- | M] () – C:\Documents and Settings\Admin\My Documents\Quran_English.pdf
[2010/09/08 06:49:09 | 000,001,804 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/09/07 20:31:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/09/06 12:15:06 | 000,004,635 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/09/06 12:15:05 | 000,524,850 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/09/06 12:15:05 | 000,443,896 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/09/06 12:15:05 | 000,071,962 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/09/05 08:22:16 | 000,000,962 | —- | M] () – C:\Documents and Settings\Admin\Start Menu\Programs\Startup\Logitech . Product Registration.lnk
[2010/09/04 23:17:06 | 000,092,696 | —- | M] () – C:\Documents and Settings\Admin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/09/04 23:16:04 | 002,230,552 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/09/04 23:14:34 | 000,000,290 | -H– | M] () – C:\WINDOWS\tasks\Microsoft_Hardware_Launch_IPoint_exe.job
[2010/09/04 20:55:02 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
[2010/09/04 20:52:22 | 000,001,879 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Microsoft Mouse.lnk
[2010/09/03 17:51:35 | 000,001,856 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Calendar Sync.lnk
[2010/09/02 09:26:38 | 000,000,085 | —- | M] () – C:\WINDOWS\brmx2001.ini
[2010/08/30 18:04:17 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_LHidEqd_01005.Wdf
[2010/08/30 18:04:13 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_LEqdUsb_01005.Wdf
[2010/08/30 18:03:22 | 000,001,692 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Logitech Mouse and Keyboard Settings.lnk
[2010/08/30 18:03:20 | 000,001,698 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
[2010/08/24 15:49:49 | 000,002,155 | —- | M] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2010/08/18 16:00:16 | 000,001,615 | —- | M] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/10 07:49:10 | 031,004,533 | —- | C] () – C:\Documents and Settings\Admin\My Documents\Quran_English.pdf
[2010/09/08 06:49:09 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/09/05 08:22:15 | 000,000,962 | —- | C] () – C:\Documents and Settings\Admin\Start Menu\Programs\Startup\Logitech . Product Registration.lnk
[2010/09/04 20:55:02 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
[2010/09/04 20:52:53 | 000,000,290 | -H– | C] () – C:\WINDOWS\tasks\Microsoft_Hardware_Launch_IPoint_exe.job
[2010/09/04 20:52:21 | 000,001,879 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Microsoft Mouse.lnk
[2010/09/03 17:51:35 | 000,001,856 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Calendar Sync.lnk
[2010/08/30 18:04:17 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_LHidEqd_01005.Wdf
[2010/08/30 18:04:13 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_LEqdUsb_01005.Wdf
[2010/08/24 15:49:47 | 000,002,155 | —- | C] () – C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2010/08/24 15:49:44 | 000,001,804 | —- | C] () – C:\Documents and Settings\Admin\Desktop\iTunes.lnk
[2010/08/18 16:00:15 | 000,001,615 | —- | C] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010/05/25 06:42:39 | 000,000,038 | —- | C] () – C:\WINDOWS\AviSplitter.INI
[2010/01/01 14:05:16 | 000,000,760 | —- | C] () – C:\Documents and Settings\Admin\Application Data\setup_ldm.iss
[2009/10/04 08:17:23 | 000,561,152 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/10/04 08:17:23 | 000,159,744 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/10/04 08:17:23 | 000,135,168 | —- | C] () – C:\WINDOWS\System32\DVDIFOFilter.dll
[2009/07/08 14:53:37 | 000,000,140 | —- | C] () – C:\WINDOWS\asym.ini
[2009/07/08 01:05:20 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\RtNicProp32.dll
[2009/06/22 17:46:09 | 000,013,000 | —- | C] () – C:\Documents and Settings\Admin\Application Data\Comma Separated Values (DOS).CAL
[2009/05/03 10:25:50 | 000,000,034 | —- | C] () – C:\Documents and Settings\Admin\Application Data\pcouffin.log
[2009/05/03 10:25:45 | 000,087,608 | —- | C] () – C:\Documents and Settings\Admin\Application Data\inst.exe
[2009/05/03 10:25:45 | 000,007,887 | —- | C] () – C:\Documents and Settings\Admin\Application Data\pcouffin.cat
[2009/05/03 10:25:45 | 000,001,144 | —- | C] () – C:\Documents and Settings\Admin\Application Data\pcouffin.inf
[2009/02/25 04:32:01 | 000,199,784 | —- | C] () – C:\Documents and Settings\Admin\Application Data\JuniperSetup.exe
[2009/02/18 03:38:10 | 000,022,103 | —- | C] () – C:\Documents and Settings\Admin\Application Data\Comma Separated Values (Windows).ADR
[2009/02/16 15:57:09 | 000,007,680 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2009/02/16 15:57:09 | 000,000,547 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009/02/16 15:57:06 | 000,348,160 | —- | C] () – C:\WINDOWS\System32\cdga.dll
[2009/02/15 18:18:37 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2009/02/13 16:28:21 | 000,156,160 | —- | C] () – C:\Documents and Settings\Admin\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/02/08 20:02:19 | 000,000,051 | —- | C] () – C:\WINDOWS\iTouch.ini
[2009/01/30 19:56:01 | 000,215,144 | R— | C] () – C:\WINDOWS\patchw32.dll
[2009/01/30 19:54:55 | 000,215,144 | R— | C] () – C:\WINDOWS\pw32a.dll
[2009/01/29 16:35:13 | 000,000,000 | —- | C] () – C:\Program Files\error.dat
[2009/01/29 16:35:13 | 000,000,000 | —- | C] () – C:\WINDOWS\BROWNIE.INI
[2009/01/29 16:35:13 | 000,000,000 | —- | C] () – C:\WINDOWS\briwm04a.ini
[2009/01/29 16:35:04 | 000,000,030 | —- | C] () – C:\WINDOWS\System32\brss01a.ini
[2009/01/29 16:29:21 | 000,000,085 | —- | C] () – C:\WINDOWS\brmx2001.ini
[2009/01/29 16:29:21 | 000,000,084 | —- | C] () – C:\WINDOWS\opt_2460.ini
[2009/01/29 16:26:24 | 000,001,401 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2009/01/29 16:26:24 | 000,000,508 | —- | C] () – C:\WINDOWS\brwmark.ini
[2009/01/29 16:26:24 | 000,000,152 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2009/01/29 16:26:24 | 000,000,079 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2009/01/29 16:25:56 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\BrMuSNMP.dll
[2009/01/29 16:24:19 | 000,027,019 | —- | C] () – C:\WINDOWS\maxlink.ini
[2009/01/29 14:40:40 | 000,217,088 | —- | C] () – C:\WINDOWS\NVGfxOgl.dll
[2008/10/07 07:13:30 | 000,197,912 | —- | C] () – C:\WINDOWS\System32\physxcudart_20.dll
[2008/10/07 07:13:22 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 07:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008/10/07 07:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008/10/07 07:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 07:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008/10/07 07:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelKorean.dll
[2008/10/07 07:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008/10/07 07:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelGerman.dll
[2008/10/07 07:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelFrench.dll
[2004/08/04 00:56:42 | 000,755,200 | —- | C] () – C:\WINDOWS\System32\ir50_32.dll
[2004/08/04 00:56:42 | 000,338,432 | —- | C] () – C:\WINDOWS\System32\ir41_qcx.dll
[2004/08/04 00:56:42 | 000,200,192 | —- | C] () – C:\WINDOWS\System32\ir50_qc.dll
[2004/08/04 00:56:42 | 000,183,808 | —- | C] () – C:\WINDOWS\System32\ir50_qcx.dll
[2004/08/04 00:56:42 | 000,120,320 | —- | C] () – C:\WINDOWS\System32\ir41_qc.dll
[2002/03/04 08:16:34 | 000,110,592 | R— | C] () – C:\WINDOWS\System32\Jpeg32.dll
< End of report >

Extras.txt

OTL Extras logfile created on: 9/13/2010 11:02:44 AM - Run 1
OTL by OldTimer - Version 3.2.12.0 Folder = C:\Documents and Settings\Admin\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 58.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 931.51 Gb Total Space | 440.63 Gb Free Space | 47.30% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GREGNEW
Current User Name: Admin
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"5353:TCP" = 5353:TCP:*:Enabled:Adobe CSI CS4
"3703:TCP" = 3703:TCP:*:Enabled:Adobe Version Cue CS4 Server
"3704:TCP" = 3704:TCP:*:Enabled:Adobe Version Cue CS4 Server
"51000:TCP" = 51000:TCP:*:Enabled:Adobe Version Cue CS4 Server
"51001:TCP" = 51001:TCP:*:Enabled:Adobe Version Cue CS4 Server
"1037:TCP" = 1037:TCP:*:Enabled:Akamai NetSession Interface
"5000:UDP" = 5000:UDP:*:Enabled:Akamai NetSession Interface

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook – (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove – (Microsoft Corporation)
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote – (Microsoft Corporation)
"C:\Program Files\DNA\btdna.exe" = C:\Program Files\DNA\btdna.exe:*:Enabled:DNA – (BitTorrent, Inc.)
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent – (BitTorrent, Inc.)
"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" = C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4 – (Adobe Systems Incorporated)
"C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe" = C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:*:Enabled:Adobe Version Cue CS4 Server – (Adobe Systems Incorporated)
"C:\Program Files\Juniper Networks\Secure Application Manager\dsSamProxy.exe" = C:\Program Files\Juniper Networks\Secure Application Manager\dsSamProxy.exe:*:Enabled:Secure Application Manager Proxy – (Juniper Networks)
"C:\Program Files\VillainousMind\Locura Personal Media Server\Bin\LocuraPersonalMediaServer.exe" = C:\Program Files\VillainousMind\Locura Personal Media Server\Bin\LocuraPersonalMediaServer.exe:LocalSubNet:Enabled:Locura Personal Media Server – ()
"C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java™ Platform SE binary – (Sun Microsystems, Inc.)
"C:\Program Files\Orb Networks\Orb\bin\Orb.exe" = C:\Program Files\Orb Networks\Orb\bin\Orb.exe:*:Enabled:Orb – File not found
"C:\Program Files\Orb Networks\Orb\bin\OrbLauncher.exe" = C:\Program Files\Orb Networks\Orb\bin\OrbLauncher.exe:*:Enabled:OrbLauncher – File not found
"C:\Program Files\Orb Networks\Orb\bin\OrbSetupWizard.exe" = C:\Program Files\Orb Networks\Orb\bin\OrbSetupWizard.exe:*:Enabled:OrbSetupWizard – File not found
"C:\Program Files\Orb Networks\Orb\bin\OrbControlPanel.exe" = C:\Program Files\Orb Networks\Orb\bin\OrbControlPanel.exe:*:Enabled:OrbControlPanel – File not found
"C:\Program Files\Orb Networks\Orb\bin\OrbStreamerClient.exe" = C:\Program Files\Orb Networks\Orb\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client – File not found
"C:\Program Files\Dragon Age\bin_ship\daorigins.exe" = C:\Program Files\Dragon Age\bin_ship\daorigins.exe:*:Enabled:Dragon Age Origins Game – (BioWare)
"C:\Program Files\Dragon Age\DAOriginsLauncher.exe" = C:\Program Files\Dragon Age\DAOriginsLauncher.exe:*:Enabled:Dragon Age Origins Launcher – (BioWare)
"C:\Program Files\Dragon Age\bin_ship\daupdatersvc.service.exe" = C:\Program Files\Dragon Age\bin_ship\daupdatersvc.service.exe:*:Enabled:Dragon Age Origins Updater – (BioWare)
"C:\Program Files\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe" = C:\Program Files\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe:*:Enabled:AllShare – ()
"C:\Program Files\Samsung\SAMSUNG PC Share Manager\http_ss_win_pro.exe" = C:\Program Files\Samsung\SAMSUNG PC Share Manager\http_ss_win_pro.exe:*:Enabled:PCSM_http_ss_win_pro – ()
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}" = Adobe Color NA Recommended Settings CS4
"{02A3343C-028E-62D3-E193-AC15E8508B64}" = Catalyst Control Center Graphics Light
"{036AA4D4-6D32-11D4-9875-00105ACE7734}" = Logitech iTouch Software
"{03DEEAD2-F3B7-45BF-9006-A25D015F00D2}" = Adobe Flash Player 10 Plugin
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{063BD2FA-85DE-0A14-F266-7BD869F719BA}" = Catalyst Control Center Graphics Full New
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{14F70205-1940-4000-88C7-BE799A6B2CAD}" = Adobe Soundbooth CS4
"{15BF7AAF-846C-4A6D-80E1-5D1FC7FB461B}" = Adobe SGM CS4
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}" = Adobe AIR
"{1B7C06E1-4888-47A6-992A-0990B9683486}" = Adobe Version Cue CS4 Server
"{1C4551A6-4743-4093-91E4-1477CD655043}" = NVIDIA PhysX
"{1DCA3EAA-6EB5-4563-A970-EA14D75037BA}" = Adobe InDesign CS4
"{1E04CB54-AF4E-4AC3-B4B7-C0A160BE57F1}" = Adobe InDesign CS4 Icon Handler
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2133CB3F-F891-4081-8681-FEE2B2419FF4}" = Orb Runtime libraries
"{2168245A-B5AD-40D8-A641-48E3E070B5B6}" = Adobe Flash CS4 STI-en
"{232DB76D-4751-41A9-9EC2-CDC0DAC1FAB6}" = WD SmartWare
"{23E8D2D6-F7C8-4A35-816C-6C914EE0A601}" = Citrix Presentation Server Client - Web Only
"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java™ 6 Update 21
"{2894C259-B270-EFAA-3131-491B261E894A}" = ccc-utility
"{297190A1-4B0D-4CD6-8B9F-3907F15C3FD8}" = Adobe CS4 American English Speech Analysis Models
"{2A2E822B-3B0E-46C1-9E3B-ACD7D1E95139}" = SAMSUNG PC Share Manager
"{2BAF2B96-7560-48B4-87D4-10178DDBE217}" = Adobe InDesign CS4 Application Feature Set Files (Roman)
"{2E1A6A90-62A6-4862-9962-81DBFD001033}" = Nero 7 Essentials
"{30C8AA56-4088-426F-91D1-0EDFD3A25678}" = Adobe Dreamweaver CS4
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{338F08AB-C262-42C7-B000-34DE1A475273}" = Ad-Aware Email Scanner for Outlook
"{33D90C6D-DF69-44A7-A124-352457F9410B}" = Locura Personal Media Server
"{349EEF84-59E0-5B35-182D-50948D7DB592}" = ccc-core-static
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{350FB27C-CF62-4EF3-AF9D-70FF313FE221}" = iTunes
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{36CDA33B-909B-4719-97D1-C4B99309BDC7}" = ATI Parental Control & Encoder
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{40A6C96D-808E-41DD-8716-617AB6B0F1F1}" = Brother MFL-Pro Suite
"{428FDF9F-E010-4C4C-A8BB-156960AFCA1C}" = Adobe Fireworks CS4
"{43509E18-076E-40FE-AF38-CA5ED400A5A9}" = Pixel Bender Toolkit
"{44E240EC-2224-4078-A88B-2CEE0D3016EF}" = Adobe After Effects CS4 Presets
"{45EC816C-0771-4C14-AE6D-72D1B578F4C8}" = Adobe After Effects CS4
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A52555C-032A-4083-BDD9-6A85ABFB39A8}" = Adobe SING CS4
"{4A6B1116-E9C1-4480-41B5-35290C1EFD3B}" = ccc-core-preinstall
"{4BC14A37-586A-4AB3-A458-874AAE29337C}" = Adobe Setup
"{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}" = Adobe Color EU Extra Settings CS4
"{561968FD-56A1-49FD-9ED0-F55482C7C5BC}" = Adobe Media Encoder CS4 Exporter
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5EAD5443-7194-46CC-A055-428E6ABB1BAF}" = Adobe Encore CS4
"{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}" = Adobe Dynamiclink Support
"{61D6891E-E822-4448-9F9A-0AAAAEB6AF6C}" = Adobe Creative Suite 4 Master Collection
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{66A9D30D-1464-4C7F-B2F3-507DADAF2595}" = Microsoft IntelliPoint 6.3
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6C89B82E-AD76-7715-43EA-C37E563E83BB}" = ATI Catalyst Install Manager
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7406DF60-016D-476B-A2C7-55D997592047}" = Adobe OnLocation CS4
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{77C80DAB-4C40-ACD2-E645-FD3E1F05EA90}" = CCC Help English
"{793D1D88-6141-43DE-BE58-59BCE31B4090}" = Adobe Flash CS4 Extension - Flash Lite STI en
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7C503E58-B2BC-11D5-978A-0050BA84F5F7}" = Neverwinter Nights
"{7CC7BDD5-6F10-4724-96A1-EAC7D9F2831C}" = Adobe InDesign CS4 Common Base Files
"{8186FF34-D389-4B7E-9A2F-C197585BCFBD}" = Adobe Media Encoder CS4 Importer
"{819E24AA-DB15-4BA8-8D76-92BDF710610B}" = Adobe Setup
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{87532CAB-7932-4F84-8937-823337622807}" = Adobe Illustrator CS4
"{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{907B4640-266B-4A21-92FB-CD1A86CD0F63}" = RollerCoaster Tycoon 3
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9F8FDE1A-FA91-43F2-887B-CF080156D57E}" = Adobe Setup
"{A17EABB6-D0C6-44E5-820C-72DC7F495064}" = PaperPort
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A6EC82A0-1414-475D-8AFD-469089F3080D}" = Adobe Contribute CS4
"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9
"{AEB9948B-4FF2-47C9-990E-47014492A0FE}" = MSXML 6.0 Parser
"{AEC81925-9C76-4707-84A9-40696C613ED3}" = Dragon Age: Origins
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B0255743-165B-4BD5-8DA8-37DFB993B201}" = Norton Save and Restore
"{B05DE7B7-0B40-4411-BD4B-222CAE2D8F15}" = Adobe MotionPicture Color Files CS4
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B15381DD-FF97-4FCD-A881-ED4DB0975500}" = Adobe Color Video Profiles AE CS4
"{B169BC97-B8AA-4ACA-9CF2-9D0FF5BABDF7}" = Adobe Premiere Pro CS4 Functional Content
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B440D659-FECA-4BDD-A12B-5C9F05790FF3}" = Snagit 9.1.2
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B9F4561A-924D-4510-A85A-BB0960C338CB}" = Adobe Asset Services CS4
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BE9CEAAA-F069-4331-BF2F-8D350F6504F4}" = Adobe Media Encoder CS4 Additional Exporter
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C151CE54-E7EA-4804-854B-F515368B0798}" = AMD Processor Driver
"{C43E4B9C-14C8-4EB0-998B-85211B6EDD61}" = Acronis True Image WD Edition
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C86E7C99-E4AD-79C7-375B-1AEF9A91EC2B}" = Acrobat.com
"{C938BE91-3BB5-4B84-9EF6-88F0505D0038}" = Adobe Premiere Pro CS4 Third Party Content
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D499F8DE-3F31-4900-9157-61061613704B}" = Adobe Premiere Pro CS4
"{DAE507C4-7E9E-B204-531C-A9306522D7A9}" = Catalyst Control Center Graphics Full Existing
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DD58AC0F-CE28-B5EA-72C4-08CE056A77EA}" = Catalyst Control Center HydraVision Full
"{DEB90B8E-0DCB-48CE-B90E-8842A2BD643E}" = Adobe Media Encoder CS4
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E80F62FF-5D3C-4A19-8409-9721F2928206}" = LiveUpdate (Symantec Corporation)
"{E8EE9410-8AC4-4F43-A626-DDECA75C79F3}" = Adobe Setup
"{EB900AF8-CC61-4E15-871B-98D1EA3E8025}" = QuickTime
"{EC68232E-C74E-4F1A-B296-DFD2E1944E10}" = Adobe Setup
"{EE353798-E875-42E0-B58D-7E6696182EA8}" = Adobe Media Encoder CS4 Dolby
"{F0949359-3DA7-52EF-50E6-FDD6B9491E2D}" = Catalyst Control Center Graphics Previews Common
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F16DCA31-4DB4-F8F6-5ED1-6FAFB7228FFF}" = Catalyst Control Center InstallProxy
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F67CCC08-C544-A440-A47A-D60A25118CD1}" = Catalyst Control Center Core Implementation
"{F6E99614-F042-4459-82B7-8B38B2601356}" = Adobe Flash CS4
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone Configuration Utility
"{FB2A5FCC-B81B-48C2-A009-7804694D83E9}" = Adobe Encore CS4 Codecs
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FF3D660E-E5CC-47FD-8050-1B4DE3BA81A9}" = Dual-Core Optimizer
"3D Virtual Human Anatomy Studio_is1" = 3DVFDS Ver 0.9.1
"Ad-Aware" = Ad-Aware
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Adobe_0b36ff97a89684768f1da4defc9f237" = Adobe Encore CS4 Codecs
"Adobe_5eba9bbdf1514a06b1a4c79a2920188" = Adobe Media Encoder CS4 Exporter
"Adobe_6e02d32c7e5a9d9fc86bc91618cafda" = Adobe Premiere Pro CS4 Third Party Content
"Adobe_7774cb1e022c49962995a9014500066" = Adobe Media Encoder CS4 Importer
"Adobe_b2d6abde968e6f277ddbfd501383e02" = Adobe Creative Suite 4 Master Collection
"Aiseesoft Total Video Converter_is1" = Aiseesoft Total Video Converter
"AutoHotkey" = AutoHotkey 1.0.48.05
"Brother MFC-420CN" = Brother MFC-420CN
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Cucusoft Ultimate DVD + Video Converter Suite_is1" = Cucusoft Ultimate DVD + Video Converter Suite [removed]
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DualCoreCenter_is1" = DualCoreCenter
"DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5_is1" = DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5.1.1.0
"ENTERPRISE" = Microsoft Office Enterprise 2007
"GOM Player" = GOM Player
"Google Calendar Sync" = Google Calendar Sync
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{2A2E822B-3B0E-46C1-9E3B-ACD7D1E95139}" = SAMSUNG PC Share Manager
"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"Interactive_Atlas" = Interactive Atlas
"Logitech Unifying" = Logitech Unifying Software 1.10
"Metacafe" = Metacafe
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSI Live Update 3" = MSI Live Update 3
"N360" = Norton Security Suite
"Neoteris_Secure_Application_Manager" = Juniper Networks Secure Application Manager
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PsuedoLiveUpdate" = LiveUpdate (Symantec Corporation)
"Tipard Total Media Converter_is1" = Tipard Total Media Converter
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent" = BitTorrent
"BitTorrent DNA" = DNA
"Juniper_Setup_Client" = Juniper Networks Setup Client
"Move Media Player" = Move Media Player
"Warcraft III" = Warcraft III: All Products

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 9/12/2010 10:57:02 PM | Computer Name = GREGNEW | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 9/12/2010 11:01:31 PM | Computer Name = GREGNEW | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 9/12/2010 11:02:18 PM | Computer Name = GREGNEW | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 9/12/2010 11:02:19 PM | Computer Name = GREGNEW | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 9/12/2010 11:59:29 PM | Computer Name = GREGNEW | Source = Norton Save and Restore | ID = 100
Description = Error EC8F17B7: Cannot create recovery points for job: My Computer
Backup. Error EC8F03ED: Cannot create the recovery point. Error E7D10026: Unable
to get attributes for 'G:/Norton Backups/'. Error EBAB03F1: The system cannot find
the path specified. Details: 0xE7D10026 Source: Norton Save & Restore

Error - 9/13/2010 1:34:55 AM | Computer Name = GREGNEW | Source = Norton Save and Restore | ID = 100
Description = Error EC8F1C50: Cannot create file backup for job: My Documents Backup.
Error E7D1000B: Unable to make directory 'G:/'. Error E7D10026: Unable to get attributes
for 'G:/'. Error EBAB03F1: The system cannot find the path specified. Error E4BC0004:
Unable to backup file C:/Documents and Settings/Admin/My Documents/Moving expenses
2010.xls. Details: 0xEBAB0005 Source: Norton Save & Restore

Error - 9/13/2010 9:53:47 AM | Computer Name = GREGNEW | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 locurapersonalmediaserver.exe, P2 1.0.3500.36772,
P3 4a74eb18, P4 locurapersonalmediaserver, P5 1.0.3500.36772, P6 4a74eb18, P7 2,
P8 7, P9 system.io.filenotfoundexception, P10 NIL.

Error - 9/13/2010 1:05:25 PM | Computer Name = GREGNEW | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 locurapersonalmediaserver.exe, P2 1.0.3500.36772,
P3 4a74eb18, P4 locurapersonalmediaserver, P5 1.0.3500.36772, P6 4a74eb18, P7 2,
P8 7, P9 system.io.filenotfoundexception, P10 NIL.

Error - 9/13/2010 1:43:59 PM | Computer Name = GREGNEW | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 locurapersonalmediaserver.exe, P2 1.0.3500.36772,
P3 4a74eb18, P4 locurapersonalmediaserver, P5 1.0.3500.36772, P6 4a74eb18, P7 2,
P8 7, P9 system.io.filenotfoundexception, P10 NIL.

Error - 9/13/2010 1:48:19 PM | Computer Name = GREGNEW | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 locurapersonalmediaserver.exe, P2 1.0.3500.36772,
P3 4a74eb18, P4 locurapersonalmediaserver, P5 1.0.3500.36772, P6 4a74eb18, P7 2,
P8 7, P9 system.io.filenotfoundexception, P10 NIL.

[ OSession Events ]
Error - 5/3/2010 8:10:13 PM | Computer Name = GREGNEW | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 1623
seconds with 180 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 9/13/2010 1:05:19 PM | Computer Name = GREGNEW | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Locura Personal Media
Server service to connect.

Error - 9/13/2010 1:05:19 PM | Computer Name = GREGNEW | Source = Service Control Manager | ID = 7000
Description = The Locura Personal Media Server service failed to start due to the
following error: %%1053

Error - 9/13/2010 1:05:33 PM | Computer Name = GREGNEW | Source = RemoteAccess | ID = 20106
Description = Unable to add the interface {22D11BE9-C02F-472A-95D5-1687D15BB3D1}
with the Router Manager for the IP protocol. The following error occurred: Cannot
complete this function.

Error - 9/13/2010 1:09:42 PM | Computer Name = GREGNEW | Source = PlugPlayManager | ID = 11
Description = The device Root\LEGACY_SYMSMR130\0000 disappeared from the system
without first being prepared for removal.

Error - 9/13/2010 1:43:52 PM | Computer Name = GREGNEW | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Locura Personal Media
Server service to connect.

Error - 9/13/2010 1:43:52 PM | Computer Name = GREGNEW | Source = Service Control Manager | ID = 7000
Description = The Locura Personal Media Server service failed to start due to the
following error: %%1053

Error - 9/13/2010 1:44:10 PM | Computer Name = GREGNEW | Source = RemoteAccess | ID = 20106
Description = Unable to add the interface {22D11BE9-C02F-472A-95D5-1687D15BB3D1}
with the Router Manager for the IP protocol. The following error occurred: Cannot
complete this function.

Error - 9/13/2010 1:48:13 PM | Computer Name = GREGNEW | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Locura Personal Media
Server service to connect.

Error - 9/13/2010 1:48:13 PM | Computer Name = GREGNEW | Source = Service Control Manager | ID = 7000
Description = The Locura Personal Media Server service failed to start due to the
following error: %%1053

Error - 9/13/2010 1:48:30 PM | Computer Name = GREGNEW | Source = RemoteAccess | ID = 20106
Description = Unable to add the interface {22D11BE9-C02F-472A-95D5-1687D15BB3D1}
with the Router Manager for the IP protocol. The following error occurred: Cannot
complete this function.


< End of report >

Nightwizard,
I tried a few things, got it scanned in regular mode, but then when I went to save the log file my system froze. I went ahead and scanned it in safe mode, and it worked fine. I don't know if it's missing something, though, because there was a LOT less text after scanning in Safe mode. Anyway, here it is:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-19 17:44:02
Windows 5.1.2600 Service Pack 3
Running: llj5vr2v.exe; Driver: C:\DOCUME~1\Admin\LOCALS~1\Temp\axtdqpob.sys


—- System - GMER 1.0.15 —-

SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xF74D787E]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xF74D7BFE]

—- Kernel code sections - GMER 1.0.15 —-

? SYMDS.SYS The system cannot find the file specified. !
? SYMEFA.SYS The system cannot find the file specified. !

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)
AttachedDevice \Driver\Tcpip \Device\Ip NEOFLTR_630_13881.SYS (NetBIOS Redirector/Juniper Networks)
AttachedDevice \Driver\Tcpip \Device\Tcp NEOFLTR_630_13881.SYS (NetBIOS Redirector/Juniper Networks)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)
AttachedDevice \Driver\Tcpip \Device\Udp NEOFLTR_630_13881.SYS (NetBIOS Redirector/Juniper Networks)
AttachedDevice \Driver\Tcpip \Device\RawIp NEOFLTR_630_13881.SYS (NetBIOS Redirector/Juniper Networks)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000a3a592252
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000a3a592252@0026e2187d94 0x65 0x21 0x2D 0xB8 …
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000a3a592252 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000a3a592252@0026e2187d94 0x65 0x21 0x2D 0xB8 …

—- Files - GMER 1.0.15 —-

File C:\Documents and Settings\Admin\My Documents\Downloads\Adobe.Creative.Suite.4.Master.Collection\Adobe.Creative.Suite.4\Adobe CS4\extensions\AdobeDreamweaver10en_USLanguagePack\AdobeDreamweaver10en_USLanguagePack.msi 0 bytes
File C:\Documents and Settings\Admin\My Documents\Downloads\Adobe.Creative.Suite.4.Master.Collection\Adobe.Creative.Suite.4\Adobe CS4\extensions\AdobeDreamweaver10en_USLanguagePack\AdobeDreamweaver10en_USLanguagePack.proxy.xml 2360 bytes
File C:\Documents and Settings\Admin\My Documents\Downloads\Adobe.Creative.Suite.4.Master.Collection\Adobe.Creative.Suite.4\Adobe CS4\extensions\AdobeDreamweaver10en_USLanguagePack\Assets 0 bytes
File C:\Documents and Settings\Admin\My Documents\Downloads\Adobe.Creative.Suite.4.Master.Collection\Adobe.Creative.Suite.4\Adobe CS4\extensions\AdobeDreamweaver10en_USLanguagePack\Conditions.js 0 bytes
File C:\Documents and Settings\Admin\My Documents\Downloads\Adobe.Creative.Suite.4.Master.Collection\Adobe.Creative.Suite.4\Adobe CS4\extensions\AdobeDreamweaver10en_USLanguagePack\Instructions.js 0 bytes
File C:\Documents and Settings\Admin\My Documents\Downloads\Adobe.Creative.Suite.4.Master.Collection\Adobe.Creative.Suite.4\Adobe CS4\extensions\AdobeDreamweaver10en_USLanguagePack\SharedSupport 0 bytes

—- EOF - GMER 1.0.15 —-

Nice!
Well, here's the ComboFix.txt, as an attachment and copied below:


ComboFix 10-09-21.03 - Admin 09/23/2010 6:36.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3071.1809 [GMT -7:00]
Running from: c:\dls\ComboFix.exe
AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning disabled* (Updated) {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
AV: Norton Security Suite *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Admin\Application Data\inst.exe
c:\documents and settings\Admin\Application Data\JuniperSetup.exe
c:\documents and settings\Admin\Recent\Thumbs.db

.
((((((((((((((((((((((((( Files Created from 2010-08-23 to 2010-09-23 )))))))))))))))))))))))))))))))
.

2010-09-18 23:02 . 2010-09-18 23:05 ——– dc-h–w- c:\windows\ie8
2010-09-18 15:18 . 2010-09-18 15:18 ——– d—–w- c:\program files\Softmed
2010-09-13 14:05 . 2010-09-13 14:05 ——– d—–w- c:\program files\Common Files\Java
2010-09-13 03:28 . 2010-09-13 13:51 ——– d—–w- c:\documents and settings\Admin\Local Settings\Application Data\NPE
2010-09-13 03:21 . 2010-09-13 03:23 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\NPE
2010-09-08 13:48 . 2010-09-08 13:48 ——– d—–w- c:\program files\iPod
2010-09-08 13:47 . 2010-09-08 13:49 ——– d—–w- c:\program files\iTunes
2010-09-05 03:55 . 2008-04-14 02:11 21504 —-a-w- c:\windows\system32\drivers\hidserv.dll
2010-09-05 03:52 . 2009-05-09 08:14 14736 —-a-w- c:\windows\system32\drivers\nuidfltr.sys
2010-09-05 03:52 . 2008-06-10 20:04 31048 —-a-w- c:\windows\system32\drivers\point32.sys
2010-09-05 03:51 . 2010-09-05 03:52 ——– d—–w- c:\program files\Microsoft IntelliPoint
2010-09-04 00:51 . 2010-09-04 00:51 ——– d—–w- c:\documents and settings\Admin\Local Settings\Application Data\Google
2010-09-04 00:51 . 2010-09-04 00:51 ——– d—–w- c:\program files\Google

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-23 13:46 . 2009-02-06 19:49 ——– d—–w- c:\documents and settings\Admin\Application Data\DNA
2010-09-23 13:19 . 2009-10-16 02:13 ——– d—–w- c:\program files\Common Files\Akamai
2010-09-22 14:47 . 2009-01-25 02:31 ——– d—–w- c:\documents and settings\Admin\Application Data\Apple Computer
2010-09-22 14:40 . 2010-08-18 22:59 ——– d—–w- c:\program files\QuickTime
2010-09-21 22:37 . 2009-01-29 11:37 ——– d—–w- c:\documents and settings\Admin\Application Data\Juniper Networks
2010-09-20 04:10 . 2010-01-04 00:30 74600 —ha-w- c:\windows\system32\mlfcache.dat
2010-09-20 00:58 . 2009-02-06 19:49 ——– d—–w- c:\program files\DNA
2010-09-18 15:18 . 2010-09-18 15:18 10134 —-a-r- c:\documents and settings\Admin\Application Data\Microsoft\Installer\{DDB3CBDC-2700-4585-86DD-98AD946DED1B}\ARPPRODUCTICON.exe
2010-09-13 14:04 . 2009-01-29 11:43 ——– d—–w- c:\program files\Java
2010-09-13 03:22 . 2009-05-06 12:52 ——– d—–w- c:\documents and settings\All Users\Application Data\Norton
2010-09-08 13:48 . 2009-01-25 02:30 ——– d—–w- c:\program files\Common Files\Apple
2010-09-08 13:41 . 2010-09-08 13:41 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 10.0.0.68\SetupAdmin.exe
2010-09-05 06:17 . 2009-01-25 01:12 92696 —-a-w- c:\documents and settings\Admin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-09-05 03:55 . 2010-09-05 03:55 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2010-08-31 01:05 . 2009-01-25 17:44 ——– d—–w- c:\program files\Common Files\Logishrd
2010-08-31 01:04 . 2010-08-31 01:04 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidEqd_01005.Wdf
2010-08-31 01:04 . 2010-08-31 01:04 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_LEqdUsb_01005.Wdf
2010-08-31 00:54 . 2009-01-25 17:47 ——– d—–w- c:\documents and settings\All Users\Application Data\LogiShrd
2010-08-29 23:40 . 2009-01-25 03:42 ——– d—–w- c:\program files\Microsoft Silverlight
2010-08-17 13:17 . 2003-03-31 12:00 58880 —-a-w- c:\windows\system32\spoolsv.exe
2010-08-14 15:50 . 2010-08-14 15:20 ——– d—–w- c:\program files\Warcraft III
2010-08-14 15:40 . 2010-08-14 15:23 76168 —-a-w- c:\windows\War3Unin.dat
2010-08-14 15:33 . 2010-08-14 15:23 2829 —-a-w- c:\windows\War3Unin.pif
2010-08-14 15:33 . 2010-08-14 15:23 139264 —-a-w- c:\windows\War3Unin.exe
2010-08-13 20:14 . 2009-02-06 19:50 ——– d—–w- c:\documents and settings\Admin\Application Data\BitTorrent
2010-08-06 17:38 . 2010-08-06 17:38 61440 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-2146c529-n\decora-sse.dll
2010-08-06 17:38 . 2010-08-06 17:38 503808 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3bcb555b-n\msvcp71.dll
2010-08-06 17:38 . 2010-08-06 17:38 499712 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3bcb555b-n\jmc.dll
2010-08-06 17:38 . 2010-08-06 17:38 348160 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3bcb555b-n\msvcr71.dll
2010-08-06 17:38 . 2010-08-06 17:38 12800 —-a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-2146c529-n\decora-d3d.dll
2010-08-03 23:12 . 2009-01-29 11:37 37464 —-a-w- c:\documents and settings\Admin\Application Data\Juniper Networks\Setup\uninstall.exe
2010-07-26 20:05 . 2010-07-26 20:05 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}
2010-07-22 15:49 . 2003-03-31 12:00 590848 —-a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 05:57 . 2009-04-17 04:34 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2010-07-17 12:00 . 2010-05-01 20:40 423656 —-a-w- c:\windows\system32\deployJava1.dll
2010-07-12 08:56 . 2010-07-26 20:05 2979280 -c–a-w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}\Ad-AwareInstall.exe
2010-07-12 08:55 . 2010-04-02 21:08 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-07-12 08:55 . 2010-04-03 04:35 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-06-30 12:31 . 2003-03-31 12:00 149504 —-a-w- c:\windows\system32\schannel.dll
2009-01-29 23:35 . 2009-01-29 23:35 0 —-a-w- c:\program files\error.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-08 323392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\System32\IME\TINTLGNT\TINTSETP.EXE" [2003-03-31 455168]
"PHIME2002A"="c:\windows\System32\IME\TINTLGNT\TINTSETP.EXE" [2003-03-31 455168]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AcronisTimounterMonitor"="c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2009-06-10 904840]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 77824]
"DelReg"="c:\program files\MSI\DualCoreCenter\DelReg.exe" [2008-05-14 196608]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 57393]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 40960]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"Norton Save and Restore 2.0"="c:\program files\Norton Save and Restore\Agent\VProTray.exe" [2008-05-07 2037088]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-16 153136]
"zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2004-03-18 892928]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-12 640376]
"RemoteControl9"="c:\program files\CyberLink\PowerDVD9\PDVD9Serv.exe" [2009-02-16 87336]
"PDVD9LanguageShortcut"="c:\program files\CyberLink\PowerDVD9\Language\Language.exe" [2008-10-14 50472]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2009-02-28 75048]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2009-06-10 1326080]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2009-06-10 136472]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-03 98304]
"RTHDCPL"="RTHDCPL.EXE" [2010-04-25 19523104]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-09 47904]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Admin\Start Menu\Programs\Startup\
Logitech . Product Registration.lnk - c:\program files\Common Files\Logishrd\eReg\SetPoint\eReg.exe [2008-11-7 517384]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
DualCoreCenter.lnk - c:\program files\MSI\DualCoreCenter\StartUpDualCoreCenter.exe [2009-1-29 192512]
Google Calendar Sync.lnk - c:\program files\Google\Google Calendar Sync\GoogleCalendarSync.exe [2010-7-26 546360]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-1-25 813584]
Status Monitor.lnk - c:\program files\Brother\Brmfcmon\BrMfcWnd.exe [2009-1-29 819200]
WDDMStatus.lnk - c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2010-1-21 2057536]
WDSmartWare.lnk - c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe [2010-1-21 9136960]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 19:28 72208 —-a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"RequireSignedAppInit_DLLs"=1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS4\\Server\\bin\\VersionCueCS4.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Juniper Networks\\Secure Application Manager\\dsSamProxy.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daorigins.exe"=
"c:\\Program Files\\Dragon Age\\DAOriginsLauncher.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daupdatersvc.service.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Samsung\\SAMSUNG PC Share Manager\\WiselinkPro.exe"=
"c:\\Program Files\\Samsung\\SAMSUNG PC Share Manager\\http_ss_win_pro.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"3703:TCP"= 3703:TCP:Adobe Version Cue CS4 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS4 Server
"51000:TCP"= 51000:TCP:Adobe Version Cue CS4 Server
"51001:TCP"= 51001:TCP:Adobe Version Cue CS4 Server
"4229:TCP"= 4229:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [4/2/2010 2:08 PM 64288]
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0402000.00C\symds.sys [6/5/2010 6:35 AM 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0402000.00C\symefa.sys [6/5/2010 6:35 AM 173104]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20100901.003\BHDrvx86.sys [8/31/2010 3:57 PM 692272]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0402000.00C\cchpx86.sys [6/5/2010 6:35 AM 501888]
R1 NEOFLTR_600_13073;Juniper Networks TDI Filter Driver (NEOFLTR_600_13073);c:\windows\system32\drivers\NEOFLTR_600_13073.sys [4/30/2008 12:54 PM 64160]
R1 NEOFLTR_630_13881;Juniper Networks TDI Filter Driver (NEOFLTR_630_13881);c:\windows\system32\drivers\NEOFLTR_630_13881.sys [1/23/2009 12:51 AM 64480]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0402000.00C\ironx86.sys [6/5/2010 6:35 AM 116784]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2009/05/10 11:49];c:\program files\CyberLink\PowerDVD9\000.fcl [2/28/2009 4:40 PM 87536]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [3/31/2003 5:00 AM 14336]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [1/25/2009 10:46 AM 10384]
R2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Norton Security Suite\Engine\4.2.0.12\ccsvchst.exe [6/5/2010 6:35 AM 126392]
R2 Norton Save and Restore;Norton Save and Restore;c:\program files\Norton Save and Restore\Agent\VProSvc.exe [2/13/2007 4:57 PM 3425632]
R2 WDDMService;WD SmartWare Drive Manager;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [1/21/2010 1:24 PM 110592]
R2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [6/16/2009 5:58 AM 20480]
R3 DualCoreCenter;DualCoreCenter;c:\program files\MSI\DualCoreCenter\NTGLM7X.sys [1/29/2009 2:40 PM 28160]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [5/28/2010 5:39 PM 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100917.001\IDSXpx86.sys [9/18/2010 7:42 AM 331640]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\drivers\LEqdUsb.sys [6/17/2009 9:55 AM 40720]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\drivers\LHidEqd.sys [6/17/2009 9:55 AM 10384]
R3 RushTopDevice2;RushTopDevice2;c:\program files\MSI\DualCoreCenter\RushTop.sys [1/29/2009 2:40 PM 55808]
S2 AllShare;SAMSUNG AllShare Service;c:\program files\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe [4/23/2010 1:48 PM 9241088]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/12/2010 1:55 AM 1355928]
S2 Locura Personal Media Server;Locura Personal Media Server;c:\program files\VillainousMind\Locura Personal Media Server\Bin\LocuraPersonalMediaServer.exe [8/1/2009 6:25 PM 20480]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [8/15/2008 3:46 AM 284016]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [4/25/2010 7:11 AM 1691480]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\Dragon Age\bin_ship\daupdatersvc.service.exe [1/3/2010 5:52 PM 25832]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [8/13/2010 2:37 PM 15008]
S3 QCAbsee;Logitech QuickCam Web (0801);c:\windows\system32\drivers\OVCA.sys [5/25/2009 6:03 PM 25088]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [4/3/2010 10:03 AM 11520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder

2010-09-21 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-07-12 00:11]

2010-09-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-09-05 c:\windows\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job
- c:\program files\Microsoft IntelliPoint\ipoint.exe [2008-06-10 19:56]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.comcast.net/mycomcast/#
uInternet Settings,ProxyOverride = *.local
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB
DPF: {16F67783-7E72-4C39-99C4-4780A8335484} - hxxp://www.syncmyride.com/Own/Modules/UploadDownload/applets/sync.cab
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://secureconnect.salemhospital.org/dana-cached/sc/JuniperSetupClient.cab
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
HKCU-Run-AdobeBridge - (no file)
HKLM-Run-DiscWizardMonitor.exe - c:\program files\Seagate\DiscWizard\DiscWizardMonitor.exe
AddRemove-Tipard Total Media Converter_is1 - c:\program files\Tipard Studio\Tipard Total Media Converter\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-23 06:48
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton Security Suite\Norton Security Suite\Engine\4.2.0.12\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Norton Security Suite\Engine\4.2.0.12\diMaster.dll\" /prefetch:1"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{B154377D-700F-42cc-9474-23858FBDF4BD}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD9\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-842925246-1960408961-839522115-1005\Software\SecuROM\License information*]
"datasecu"=hex:bc,c7,72,e9,90,22,33,ce,69,0b,2e,fa,04,df,bd,7a,f1,5a,21,f5,2e,
82,b1,58,17,b7,e5,88,f9,5c,ef,bd,9a,90,e4,5d,58,a7,61,83,20,f4,15,02,7b,8b,\
"rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1256)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'lsass.exe'(1312)
c:\windows\system32\relog_ap.dll
.
Completion time: 2010-09-23 06:55:38
ComboFix-quarantined-files.txt 2010-09-23 13:55

Pre-Run: 474,326,564,864 bytes free
Post-Run: 474,343,305,216 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn /usepmtimer

- - End Of File - - 0B1746A33593104642F76CC73F49B1F4