i have qbyrd redirecting my searches! help!

hi…hope i can get help here! thanks!
OTL logfile created on: 30/12/2010 1:53:06 AM - Run 1
OTL by OldTimer - Version 3.2.18.2 Folder = D:\OWNER-PC\Downloads
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 65.00% Memory free
6.00 Gb Paging File | 4.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 71.28 Gb Total Space | 32.72 Gb Free Space | 45.91% Space Free | Partition Type: NTFS
Drive D: | 70.94 Gb Total Space | 38.60 Gb Free Space | 54.41% Space Free | Partition Type: NTFS
Drive F: | 562.92 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive G: | 931.51 Gb Total Space | 792.84 Gb Free Space | 85.11% Space Free | Partition Type: NTFS

Computer Name: OWNER-PC | User Name: owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/12/30 01:51:46 | 000,602,624 | —- | M] (OldTimer Tools) – D:\OWNER-PC\Downloads\OTL.exe
PRC - [2010/12/16 21:24:30 | 023,343,848 | —- | M] (Dropbox, Inc.) – C:\Users\owner\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2010/12/13 17:16:14 | 009,777,448 | —- | M] (Apple Inc.) – C:\Program Files\iTunes\iTunes.exe
PRC - [2010/12/11 12:59:56 | 000,016,856 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\plugin-container.exe
PRC - [2010/12/11 12:59:55 | 000,912,344 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/12/09 23:05:40 | 012,584,112 | —- | M] (Mozilla Messaging) – C:\Program Files\Mozilla Thunderbird\thunderbird.exe
PRC - [2010/11/04 16:05:54 | 000,266,800 | —- | M] () – C:\Program Files\Hotspot Shield\bin\openvpnas.exe
PRC - [2010/10/25 04:07:48 | 000,095,568 | —- | M] (Devguru Co., Ltd.) – C:\Windows\System32\dgdersvc.exe
PRC - [2010/10/16 00:57:30 | 000,037,664 | —- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
PRC - [2010/10/16 00:40:40 | 000,037,664 | —- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/10/15 13:42:14 | 000,326,704 | —- | M] () – C:\Program Files\Hotspot Shield\bin\hsswd.exe
PRC - [2010/10/15 13:35:30 | 000,352,304 | —- | M] (AnchorFree Inc.) – C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
PRC - [2010/09/23 03:47:16 | 000,349,616 | —- | M] (Adobe Systems Incorporated) – C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe
PRC - [2010/09/07 10:12:02 | 002,838,912 | —- | M] (AVAST Software) – C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/09/07 10:11:59 | 000,040,384 | —- | M] (AVAST Software) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010/08/09 23:00:42 | 000,013,088 | —- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
PRC - [2010/08/04 00:51:38 | 000,380,928 | —- | M] (AMD) – C:\Windows\System32\atieclxx.exe
PRC - [2010/08/04 00:51:12 | 000,176,128 | —- | M] (AMD) – C:\Windows\System32\atiesrxx.exe
PRC - [2010/07/24 02:07:42 | 002,614,272 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2010/06/29 17:55:26 | 001,352,832 | —- | M] (Lavasoft) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2010/06/19 17:55:39 | 000,864,112 | —- | M] (Lavasoft) – C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2010/05/28 01:25:04 | 000,233,472 | —- | M] (Teruten) – C:\Windows\System32\FsUsbExService.Exe
PRC - [2010/04/16 02:18:34 | 000,173,352 | —- | M] (TeamViewer GmbH) – C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe
PRC - [2010/03/04 22:38:00 | 000,071,096 | —- | M] () – C:\Program Files\CDBurnerXP\NMSAccessU.exe
PRC - [2009/10/26 13:46:54 | 001,458,176 | —- | M] (Motorola Inc.) – C:\Program Files\motorola\SMSERIAL\sm56hlpr.exe
PRC - [2009/07/13 20:14:42 | 000,049,152 | —- | M] (Microsoft Corporation) – C:\Windows\System32\taskhost.exe
PRC - [2009/07/13 20:14:29 | 003,179,520 | —- | M] (Microsoft Corporation) – C:\Windows\System32\sppsvc.exe
PRC - [2009/07/13 20:14:24 | 000,157,184 | —- | M] (Microsoft Corporation) – c:\Program Files\Windows Defender\MpCmdRun.exe
PRC - [2009/07/13 20:14:15 | 000,271,360 | —- | M] (Microsoft Corporation) – C:\Windows\System32\conhost.exe
PRC - [2009/07/13 20:14:13 | 000,776,192 | —- | M] (Microsoft Corporation) – C:\Windows\System32\calc.exe
PRC - [2009/07/13 20:14:12 | 000,100,864 | —- | M] (Microsoft Corporation) – C:\Windows\System32\audiodg.exe
PRC - [2009/02/23 18:43:12 | 000,576,000 | —- | M] (MagicISO, Inc.) – C:\Program Files\MagicDisc\MagicDisc.exe
PRC - [2008/11/11 09:38:06 | 000,620,544 | —- | M] (Nokia.) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
PRC - [2008/09/19 08:52:04 | 000,130,560 | —- | M] () – C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
PRC - [2008/06/22 19:47:43 | 000,045,056 | —- | M] () – C:\Windows\System32\UTSCSI.EXE
PRC - [2008/06/03 08:02:34 | 000,119,808 | —- | M] () – C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
PRC - [2006/11/08 21:57:52 | 003,784,704 | —- | M] (Realtek Semiconductor) – C:\Windows\RtHDVCpl.exe


========== Modules (SafeList) ==========

MOD - [2010/12/30 01:51:46 | 000,602,624 | —- | M] (OldTimer Tools) – D:\OWNER-PC\Downloads\OTL.exe
MOD - [2010/10/14 02:00:55 | 001,680,896 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
MOD - [2009/07/13 20:16:15 | 000,099,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\sspicli.dll
MOD - [2009/07/13 20:16:13 | 000,092,160 | —- | M] (Microsoft Corporation) – C:\Windows\System32\sechost.dll
MOD - [2009/07/13 20:16:13 | 000,050,688 | —- | M] (Microsoft Corporation) – C:\Windows\System32\samcli.dll
MOD - [2009/07/13 20:16:12 | 000,031,744 | —- | M] (Microsoft Corporation) – C:\Windows\System32\profapi.dll
MOD - [2009/07/13 20:16:03 | 000,022,016 | —- | M] (Microsoft Corporation) – C:\Windows\System32\netutils.dll
MOD - [2009/07/13 20:15:35 | 000,288,256 | —- | M] (Microsoft Corporation) – C:\Windows\System32\KernelBase.dll
MOD - [2009/07/13 20:15:11 | 000,064,512 | —- | M] (Microsoft Corporation) – C:\Windows\System32\devobj.dll
MOD - [2009/07/13 20:15:07 | 000,036,864 | —- | M] (Microsoft Corporation) – C:\Windows\System32\cryptbase.dll
MOD - [2009/07/13 20:15:02 | 000,145,920 | —- | M] (Microsoft Corporation) – C:\Windows\System32\cfgmgr32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe – (WPFFontCache_v0400)
SRV - [2010/11/04 16:10:06 | 000,057,640 | —- | M] () [On_Demand | Stopped] – C:\Program Files\Hotspot Shield\bin\HssTrayService.exe – (HssTrayService)
SRV - [2010/11/04 16:05:54 | 000,266,800 | —- | M] () [Auto | Running] – C:\Program Files\Hotspot Shield\bin\openvpnas.exe – (HotspotShieldService)
SRV - [2010/10/25 04:07:48 | 000,095,568 | —- | M] (Devguru Co., Ltd.) [Auto | Running] – C:\Windows\System32\dgdersvc.exe – (dgdersvc)
SRV - [2010/10/16 00:40:40 | 000,037,664 | —- | M] (Apple Inc.) [Auto | Running] – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe – (Apple Mobile Device)
SRV - [2010/10/15 13:42:14 | 000,326,704 | —- | M] () [Auto | Running] – C:\Program Files\Hotspot Shield\bin\hsswd.exe – (HssWd)
SRV - [2010/10/15 13:35:30 | 000,352,304 | —- | M] (AnchorFree Inc.) [Auto | Running] – C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe – (HssSrv)
SRV - [2010/09/07 10:11:59 | 000,040,384 | —- | M] (AVAST Software) [On_Demand | Running] – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe – (avast! Web Scanner)
SRV - [2010/09/07 10:11:59 | 000,040,384 | —- | M] (AVAST Software) [On_Demand | Running] – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe – (avast! Mail Scanner)
SRV - [2010/09/07 10:11:59 | 000,040,384 | —- | M] (AVAST Software) [Auto | Running] – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe – (avast! Antivirus)
SRV - [2010/08/11 13:13:21 | 001,343,400 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\Wat\WatAdminSvc.exe – (WatAdminSvc)
SRV - [2010/08/04 00:51:12 | 000,176,128 | —- | M] (AMD) [Auto | Running] – C:\Windows\System32\atiesrxx.exe – (AMD External Events Utility)
SRV - [2010/06/29 17:55:26 | 001,352,832 | —- | M] (Lavasoft) [On_Demand | Running] – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe – (Lavasoft Ad-Aware Service)
SRV - [2010/05/28 01:25:04 | 000,233,472 | —- | M] (Teruten) [Auto | Running] – C:\Windows\System32\FsUsbExService.Exe – (FsUsbExService)
SRV - [2010/04/16 02:18:34 | 000,173,352 | —- | M] (TeamViewer GmbH) [Auto | Running] – C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe – (TeamViewer5)
SRV - [2010/03/18 16:47:22 | 000,035,160 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe – (aspnet_state)
SRV - [2010/03/18 12:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2010/03/18 12:16:28 | 000,124,240 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe – (NetTcpPortSharing)
SRV - [2010/03/18 12:16:28 | 000,124,240 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe – (NetTcpActivator)
SRV - [2010/03/18 12:16:28 | 000,124,240 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe – (NetPipeActivator)
SRV - [2010/03/18 12:16:28 | 000,124,240 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe – (NetMsmqActivator)
SRV - [2010/03/04 22:38:00 | 000,071,096 | —- | M] () [Auto | Running] – C:\Program Files\CDBurnerXP\NMSAccessU.exe – (NMSAccess)
SRV - [2009/07/13 20:16:21 | 000,185,856 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wwansvc.dll – (WwanSvc)
SRV - [2009/07/13 20:16:17 | 000,151,552 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wbiosrvc.dll – (WbioSrvc)
SRV - [2009/07/13 20:16:17 | 000,119,808 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\umpo.dll – (Power)
SRV - [2009/07/13 20:16:16 | 000,037,376 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\themeservice.dll – (Themes)
SRV - [2009/07/13 20:16:15 | 000,053,760 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sppuinotify.dll – (sppuinotify)
SRV - [2009/07/13 20:16:13 | 000,043,520 | —- | M] (Microsoft Corporation) [Unknown | Running] – C:\Windows\System32\RpcEpMap.dll – (RpcEptMapper)
SRV - [2009/07/13 20:16:13 | 000,025,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sensrsvc.dll – (SensrSvc)
SRV - [2009/07/13 20:16:12 | 001,004,544 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\PeerDistSvc.dll – (PeerDistSvc)
SRV - [2009/07/13 20:16:12 | 000,269,824 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\pnrpsvc.dll – (PNRPsvc)
SRV - [2009/07/13 20:16:12 | 000,269,824 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\pnrpsvc.dll – (p2pimsvc)
SRV - [2009/07/13 20:16:12 | 000,165,376 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\provsvc.dll – (HomeGroupProvider)
SRV - [2009/07/13 20:16:12 | 000,020,480 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\pnrpauto.dll – (PNRPAutoReg)
SRV - [2009/07/13 20:15:41 | 000,680,960 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2009/07/13 20:15:36 | 000,194,560 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\ListSvc.dll – (HomeGroupListener)
SRV - [2009/07/13 20:15:21 | 000,797,696 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\FntCache.dll – (FontCache)
SRV - [2009/07/13 20:15:11 | 000,253,440 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\dhcpcore.dll – (Dhcp)
SRV - [2009/07/13 20:15:10 | 000,218,624 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\defragsvc.dll – (defragsvc)
SRV - [2009/07/13 20:14:59 | 000,076,800 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\bdesvc.dll – (BDESVC)
SRV - [2009/07/13 20:14:58 | 000,088,064 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\AxInstSv.dll – (AxInstSV) ActiveX Installer (AxInstSV)
SRV - [2009/07/13 20:14:53 | 000,027,648 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\appidsvc.dll – (AppIDSvc)
SRV - [2009/07/13 20:14:29 | 003,179,520 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\sppsvc.exe – (sppsvc)
SRV - [2008/11/11 09:38:06 | 000,620,544 | —- | M] (Nokia.) [On_Demand | Running] – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe – (ServiceLayer)
SRV - [2008/06/22 19:47:43 | 000,045,056 | —- | M] () [Auto | Running] – C:\Windows\System32\UTSCSI.EXE – (UTSCSI)
SRV - [2007/11/07 13:40:19 | 001,252,232 | —- | M] () [On_Demand | Stopped] – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe – (Symantec Core LC)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\owner\AppData\Local\Temp\catchme.sys – (catchme)
DRV - [2010/10/25 04:07:48 | 000,018,120 | —- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\dgderdrv.sys – (dgderdrv)
DRV - [2010/10/25 04:03:52 | 000,036,640 | —- | M] () [Kernel | On_Demand | Running] – C:\Windows\System32\FsUsbExDisk.Sys – (FsUsbExDisk)
DRV - [2010/09/22 14:19:02 | 000,037,376 | —- | M] (AnchorFree Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\HssDrv.sys – (HssDrv)
DRV - [2010/09/22 14:19:02 | 000,032,768 | —- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\taphss.sys – (taphss)
DRV - [2010/09/07 09:52:25 | 000,046,672 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\Windows\System32\drivers\aswTdi.sys – (aswTdi)
DRV - [2010/09/07 09:52:03 | 000,165,584 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\Windows\System32\drivers\aswSP.sys – (aswSP)
DRV - [2010/09/07 09:47:46 | 000,023,376 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\Windows\System32\drivers\aswRdr.sys – (aswRdr)
DRV - [2010/09/07 09:47:30 | 000,050,768 | —- | M] (AVAST Software) [File_System | Auto | Running] – C:\Windows\System32\drivers\aswMonFlt.sys – (aswMonFlt)
DRV - [2010/09/07 09:47:07 | 000,017,744 | —- | M] (AVAST Software) [File_System | Auto | Running] – C:\Windows\System32\drivers\aswFsBlk.sys – (aswFsBlk)
DRV - [2010/08/04 01:21:44 | 006,096,384 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\atikmdag.sys – (amdkmdag)
DRV - [2010/08/04 00:15:30 | 000,214,016 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\atikmpag.sys – (amdkmdap)
DRV - [2010/07/24 02:07:06 | 000,133,720 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\Drivers\ksecpkg.sys – (KSecPkg)
DRV - [2010/06/05 17:55:36 | 000,064,288 | —- | M] (Lavasoft AB) [File_System | Boot | Running] – C:\Windows\system32\DRIVERS\Lbd.sys – (Lbd)
DRV - [2010/04/19 19:29:20 | 000,018,432 | —- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\netaapl.sys – (Netaapl)
DRV - [2009/11/12 13:48:56 | 000,007,168 | —- | M] () [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\StarOpen.sys – (StarOpen)
DRV - [2009/10/26 14:09:06 | 001,095,936 | —- | M] (Motorola Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\smserial.sys – (smserial)
DRV - [2009/09/28 08:22:00 | 000,315,392 | —- | M] () [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\yk62x86.sys – (yukonw7)
DRV - [2009/07/13 20:26:21 | 000,015,952 | —- | M] (CMD Technology, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\cmdide.sys – (cmdide)
DRV - [2009/07/13 20:26:17 | 000,297,552 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\adpahci.sys – (adpahci)
DRV - [2009/07/13 20:26:15 | 000,422,976 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\adp94xx.sys – (adp94xx)
DRV - [2009/07/13 20:26:15 | 000,159,312 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\amdsbs.sys – (amdsbs)
DRV - [2009/07/13 20:26:15 | 000,146,512 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\adpu320.sys – (adpu320)
DRV - [2009/07/13 20:26:15 | 000,086,608 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\arcsas.sys – (arcsas)
DRV - [2009/07/13 20:26:15 | 000,079,952 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\amdsata.sys – (amdsata)
DRV - [2009/07/13 20:26:15 | 000,076,368 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\arc.sys – (arc)
DRV - [2009/07/13 20:26:15 | 000,023,616 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\amdxata.sys – (amdxata)
DRV - [2009/07/13 20:26:15 | 000,014,400 | —- | M] (Acer Laboratories Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\aliide.sys – (aliide)
DRV - [2009/07/13 20:20:44 | 000,142,416 | —- | M] (NVIDIA Corporation) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\nvstor.sys – (nvstor)
DRV - [2009/07/13 20:20:44 | 000,044,624 | —- | M] (IBM Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\nfrd960.sys – (nfrd960)
DRV - [2009/07/13 20:20:37 | 000,089,168 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_sas.sys – (LSI_SAS)
DRV - [2009/07/13 20:20:36 | 000,332,352 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\iaStorV.sys – (iaStorV)
DRV - [2009/07/13 20:20:36 | 000,235,584 | —- | M] (LSI Corporation, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\MegaSR.sys – (MegaSR)
DRV - [2009/07/13 20:20:36 | 000,096,848 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_scsi.sys – (LSI_SCSI)
DRV - [2009/07/13 20:20:36 | 000,095,824 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_fc.sys – (LSI_FC)
DRV - [2009/07/13 20:20:36 | 000,054,864 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_sas2.sys – (LSI_SAS2)
DRV - [2009/07/13 20:20:36 | 000,041,040 | —- | M] (Intel Corp./ICP vortex GmbH) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\iirsp.sys – (iirsp)
DRV - [2009/07/13 20:20:36 | 000,030,800 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\megasas.sys – (megasas)
DRV - [2009/07/13 20:20:36 | 000,013,904 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\hwpolicy.sys – (hwpolicy)
DRV - [2009/07/13 20:20:28 | 000,453,712 | —- | M] (Emulex) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\elxstor.sys – (elxstor)
DRV - [2009/07/13 20:20:28 | 000,070,720 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\djsvs.sys – (aic78xx)
DRV - [2009/07/13 20:20:28 | 000,067,152 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\HpSAMD.sys – (HpSAMD)
DRV - [2009/07/13 20:20:28 | 000,046,160 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\fsdepends.sys – (FsDepends)
DRV - [2009/07/13 20:19:11 | 000,141,904 | —- | M] (VIA Technologies Inc.,Ltd) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vsmraid.sys – (vsmraid)
DRV - [2009/07/13 20:19:10 | 000,175,824 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vmbus.sys – (vmbus)
DRV - [2009/07/13 20:19:10 | 000,159,824 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vhdmp.sys – (vhdmp)
DRV - [2009/07/13 20:19:10 | 000,040,896 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\vmstorfl.sys – (storflt)
DRV - [2009/07/13 20:19:10 | 000,032,832 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\vdrvroot.sys – (vdrvroot)
DRV - [2009/07/13 20:19:10 | 000,028,224 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\storvsc.sys – (storvsc)
DRV - [2009/07/13 20:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\wimmount.sys – (WIMMount)
DRV - [2009/07/13 20:19:10 | 000,016,976 | —- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\viaide.sys – (viaide)
DRV - [2009/07/13 20:19:04 | 001,383,488 | —- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\ql2300.sys – (ql2300)
DRV - [2009/07/13 20:19:04 | 000,173,648 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\rdyboost.sys – (rdyboost)
DRV - [2009/07/13 20:19:04 | 000,106,064 | —- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\ql40xx.sys – (ql40xx)
DRV - [2009/07/13 20:19:04 | 000,077,888 | —- | M] (Silicon Integrated Systems) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\sisraid4.sys – (SiSRaid4)
DRV - [2009/07/13 20:19:04 | 000,043,088 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\pcw.sys – (pcw)
DRV - [2009/07/13 20:19:04 | 000,040,016 | —- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\SiSRaid2.sys – (SiSRaid2)
DRV - [2009/07/13 20:19:04 | 000,021,072 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\stexstor.sys – (stexstor)
DRV - [2009/07/13 20:17:54 | 000,369,568 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\Drivers\cng.sys – (CNG)
DRV - [2009/07/13 19:57:25 | 000,272,128 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\Brserid.sys – (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2009/07/13 19:02:41 | 000,018,944 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\rdpbus.sys – (rdpbus)
DRV - [2009/07/13 19:01:41 | 000,007,168 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\RDPREFMP.sys – (RDPREFMP)
DRV - [2009/07/13 18:55:00 | 000,049,152 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\agilevpn.sys – (RasAgileVpn) WAN Miniport (IKEv2)
DRV - [2009/07/13 18:53:51 | 000,009,728 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\wfplwf.sys – (WfpLwf)
DRV - [2009/07/13 18:52:44 | 000,027,136 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ndiscap.sys – (NdisCap)
DRV - [2009/07/13 18:52:02 | 000,019,968 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\vwifibus.sys – (vwifibus)
DRV - [2009/07/13 18:52:00 | 000,163,328 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\1394ohci.sys – (1394ohci)
DRV - [2009/07/13 18:51:35 | 000,008,192 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\umpass.sys – (UmPass)
DRV - [2009/07/13 18:51:23 | 000,080,640 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\USBAUDIO.sys – (usbaudio) USB Audio Driver (WDM)
DRV - [2009/07/13 18:51:11 | 000,034,944 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\winusb.sys – (WinUsb)
DRV - [2009/07/13 18:51:08 | 000,004,096 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mshidkmdf.sys – (mshidkmdf)
DRV - [2009/07/13 18:46:55 | 000,012,288 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\MTConfig.sys – (MTConfig)
DRV - [2009/07/13 18:45:26 | 000,031,232 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\CompositeBus.sys – (CompositeBus)
DRV - [2009/07/13 18:36:52 | 000,050,176 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\appid.sys – (AppID)
DRV - [2009/07/13 18:33:50 | 000,026,624 | —- | M] (Microsoft Corporation) [Kernel | Unknown | Stopped] – C:\Windows\System32\drivers\scfilter.sys – (scfilter)
DRV - [2009/07/13 18:28:47 | 000,005,632 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vms3cap.sys – (s3cap)
DRV - [2009/07/13 18:28:45 | 000,017,920 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\VMBusHID.sys – (VMBusHID)
DRV - [2009/07/13 18:24:05 | 000,032,256 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\discache.sys – (discache)
DRV - [2009/07/13 18:16:36 | 000,009,728 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\acpipmi.sys – (AcpiPmi)
DRV - [2009/07/13 18:11:04 | 000,052,736 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\amdppm.sys – (AmdPPM)
DRV - [2009/07/13 17:54:14 | 000,026,624 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\hcw85cir.sys – (hcw85cir)
DRV - [2009/07/13 17:53:33 | 000,012,160 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\BrUsbMdm.sys – (BrUsbMdm)
DRV - [2009/07/13 17:53:33 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\BrUsbSer.sys – (BrUsbSer)
DRV - [2009/07/13 17:53:32 | 000,062,336 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\BrSerWdm.sys – (BrSerWdm)
DRV - [2009/07/13 17:53:28 | 000,013,568 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\BrFiltLo.sys – (BrFiltLo)
DRV - [2009/07/13 17:53:28 | 000,005,248 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\BrFiltUp.sys – (BrFiltUp)
DRV - [2009/07/13 17:02:49 | 000,229,888 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\b57nd60x.sys – (b57nd60x)
DRV - [2009/07/13 17:02:48 | 003,100,160 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\evbdx.sys – (ebdrv)
DRV - [2009/07/13 17:02:48 | 000,430,080 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\bxvbdx.sys – (b06bdrv)
DRV - [2009/02/24 17:42:14 | 000,116,736 | —- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\mcdbus.sys – (mcdbus)
DRV - [2008/11/11 13:42:00 | 000,024,832 | —- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\lgusbmodem.sys – (USBModem)
DRV - [2008/11/11 13:41:00 | 000,019,968 | —- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\lgusbdiag.sys – (UsbDiag)
DRV - [2008/11/11 13:41:00 | 000,013,056 | —- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\lgusbbus.sys – (usbbus)
DRV - [2008/08/26 09:26:12 | 000,018,816 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\pccsmcfd.sys – (pccsmcfd)
DRV - [2008/03/15 21:26:52 | 000,018,816 | —- | M] (RIF) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\dvd43llh.sys – (dvd43llh)
DRV - [2007/07/03 00:37:08 | 000,110,112 | —- | M] (NVIDIA Corporation) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\nvstor32.sys – (nvstor32)
DRV - [2007/06/18 14:18:26 | 000,023,680 | —- | M] (Motorola) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\motmodem.sys – (motmodem)
DRV - [2007/04/21 09:15:42 | 000,009,344 | —- | M] (Hajo Krabbenhöft) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\tenCapture.sys – (tenCapture)
DRV - [2007/01/05 20:59:34 | 000,086,096 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\nvraid.sys – (nvraid)
DRV - [2006/12/14 14:49:03 | 000,006,144 | —- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\NTIDrvr.sys – (NTIDrvr)
DRV - [2006/11/08 06:09:24 | 001,647,976 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\RTKVHDA.sys – (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006/09/19 15:47:04 | 000,080,744 | —- | M] (Wasay) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\WSVD.sys – (WSVD)
DRV - [2006/08/28 21:30:04 | 000,013,952 | —- | M] () [Kernel | Boot | Stopped] – C:\Windows\System32\drivers\UBHelper.sys – (UBHelper)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
IE - HKCU\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "chrome://speeddial/content/speeddial.xul"
FF - prefs.js..extensions.enabledItems: {64161300-e22b-11db-8314-0800200c9a66}:0.9.5.8
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.2
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.7.2
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.1
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:3.2.3.3

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/18 02:33:07 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/18 02:33:06 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010/12/18 02:33:07 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/07/23 23:24:09 | 000,000,000 | —D | M] (No name found) – C:\Users\owner\AppData\Roaming\Mozilla\Extensions
[2010/07/23 23:24:09 | 000,000,000 | —D | M] (No name found) – C:\Users\owner\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010/12/29 00:26:50 | 000,000,000 | —D | M] (No name found) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\xtzv1gzr.default\extensions
[2010/07/23 21:08:46 | 000,000,000 | —D | M] (Screengrab) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\xtzv1gzr.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2010/07/23 21:08:46 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\xtzv1gzr.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/23 21:08:46 | 000,000,000 | —D | M] (TradeManager-Plugin) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\xtzv1gzr.default\extensions\{4D144BC3-23FB-47de-90C5-63CCB0139CCF}
[2010/12/18 03:08:48 | 000,000,000 | —D | M] (Speed Dial) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\xtzv1gzr.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}
[2010/08/30 12:29:35 | 000,000,000 | —D | M] (MP3Tunes Load2Mobile) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\xtzv1gzr.default\extensions\{841f33b8-4989-4900-ba30-597b4be97ae2}
[2010/11/23 01:29:19 | 000,000,000 | —D | M] (Modify Headers) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\xtzv1gzr.default\extensions\{b749fc7c-e949-447f-926c-3f4eed6accfe}
[2010/10/22 16:10:08 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\xtzv1gzr.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/12/22 13:10:15 | 000,000,000 | —D | M] (uTorrentBar Community Toolbar) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\xtzv1gzr.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2010/12/18 03:08:48 | 000,000,000 | —D | M] (Adblock Plus) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\xtzv1gzr.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/10/22 16:10:08 | 000,000,000 | —D | M] (Download Statusbar) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\xtzv1gzr.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2010/12/22 13:10:15 | 000,000,000 | —D | M] (Conduit Engine) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\xtzv1gzr.default\extensions\[removed]
[2010/07/23 21:08:45 | 000,000,000 | —D | M] ({PRODUCT-NAME}) – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\xtzv1gzr.default\extensions\[removed]
[2010/03/24 10:34:04 | 000,002,456 | —- | M] () – C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\xtzv1gzr.default\searchplugins\iMeshWebSearch.xml
[2010/11/23 04:38:42 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/03/31 20:33:08 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/08/25 12:08:28 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/11/23 04:38:42 | 000,000,000 | —D | M] (afurladvisor) – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2010/03/31 20:33:08 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2010/04/12 16:29:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/07/12 11:33:56 | 000,012,800 | —- | M] (Nullsoft, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npwachk.dll
[2010/03/24 10:34:04 | 000,002,456 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\iMeshWebSearch.xml

O1 HOSTS File: ([2010/12/05 17:21:30 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - No CLSID value found.
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll File not found
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll File not found
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll File not found
O2 - BHO: (VDownloader Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (&Google; Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll File not found
O3 - HKLM\..\Toolbar: (VDownloader Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O3 - HKLM\..\Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (&Google; Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (VDownloader Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SMSERIAL] C:\Program Files\motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKCU..\Run: [cdloader] C:\Users\owner\AppData\Roaming\mjusbsp\cdloader2.exe (magicJack L.P.)
O4 - HKCU..\Run: [KiesTrayAgent] File not found
O4 - HKCU..\Run: [S60 PC Suite Tray] C:\Program Files\Samsung\Samsung PC Studio 7\PCSuite.exe ()
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - Startup: C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\owner\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx2.hotmail.com/mail/w2/resources/…NPUplden-ca.cab (MSN Photo Upload Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {BA2D9665-D672-446F-98F4-E3E41FA12A01} http://www.mypccenter.com/CAB/PCA.cab (PCAObj Class)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O24 - Desktop WallPaper: C:\Users\owner\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\owner\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 16:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2006/10/27 16:44:05 | 000,000,175 | R— | M] () - F:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)
NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)

Drivers32: aux - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\Windows\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.ac3acm - C:\Windows\System32\AC3ACM.acm (fccHandler)
Drivers32: msacm.alf2cd - C:\Windows\System32\alf2cd.acm (NCT Company)
Drivers32: msacm.divxa32 - C:\Windows\System32\DivXa32.acm (Hacked With Joy !)
Drivers32: msacm.imaadpcm - C:\Windows\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\Windows\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\Windows\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\Windows\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.scg726 - C:\Windows\System32\Scg726.acm (SHARP Corporation)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.vorbis - C:\Windows\System32\vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/)
Drivers32: msacm.voxacm160 - C:\Windows\System32\vct3216.acm (Voxware, Inc.)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIV3 - C:\Windows\System32\DivXc32.dll (Hacked with Joy !)
Drivers32: vidc.DIV4 - C:\Windows\System32\DivXc32f.dll (Hacked with Joy !)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.dvsd - C:\Windows\System32\mcdvd_32.dll (MainConcept)
Drivers32: VIDC.HFYU - C:\Windows\System32\HUFFYUV.DLL (Disappearing Inc.)
Drivers32: vidc.i420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.iv31 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv32 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv41 - C:\Windows\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.iyuv - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.mp42 - C:\Windows\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mp43 - C:\Windows\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mpg4 - C:\Windows\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\Windows\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\Windows\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: vidc.uyvy - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: vidc.yuy2 - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yv12 - C:\Windows\System32\yv12vfw.dll (www.helixcommunity.org)
Drivers32: vidc.yvu9 - C:\Windows\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvyu - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave2 - C:\Windows\System32\serwvdrv.dll (Microsoft Corporation)
Drivers32: wave3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\Windows\System32\msacm32.drv (Microsoft Corporation)


========== Files/Folders - Created Within 30 Days ==========

[2010/12/28 14:28:49 | 000,000,000 | R–D | C] – C:\Users\owner\Dropbox
[2010/12/28 14:23:24 | 000,000,000 | —D | C] – C:\Users\owner\AppData\Roaming\Dropbox
[2010/12/27 00:21:28 | 000,000,000 | —D | C] – C:\Users\owner\AppData\Roaming\XnView
[2010/12/27 00:21:13 | 000,000,000 | —D | C] – C:\Program Files\XnView
[2010/12/27 00:11:42 | 000,000,000 | —D | C] – C:\Program Files\Winspy
[2010/12/19 01:58:41 | 000,000,000 | —D | C] – C:\Users\owner\Documents\Phones
[2010/12/18 02:34:55 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/12/18 02:32:49 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2010/12/18 02:31:18 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2010/12/16 22:50:10 | 000,000,000 | —D | C] – C:\Users\owner\AppData\Roaming\PC Suite
[2010/12/16 22:50:10 | 000,000,000 | —D | C] – C:\ProgramData\PC Suite
[2010/12/16 22:38:14 | 000,000,000 | —D | C] – C:\Program Files\Common Files\PCSuite
[2010/12/16 22:38:06 | 000,018,816 | —- | C] (Nokia) – C:\Windows\System32\drivers\pccsmcfd.sys
[2010/12/16 22:38:06 | 000,000,000 | —D | C] – C:\Program Files\DIFX
[2010/12/16 22:37:57 | 000,090,624 | —- | C] (Nokia) – C:\Windows\System32\nmwcdcls.dll
[2010/12/16 21:53:17 | 000,000,000 | —D | C] – C:\Windows\System32\System32
[2010/12/15 13:17:58 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2010/12/15 13:17:50 | 000,606,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2010/12/15 13:17:48 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2010/12/15 13:17:48 | 000,381,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2010/12/15 13:17:48 | 000,185,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2010/12/15 13:17:48 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2010/12/15 13:17:48 | 000,064,512 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2010/12/15 13:17:48 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2010/12/15 13:17:47 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2010/12/15 13:17:47 | 000,386,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2010/12/15 13:17:47 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2010/12/15 13:17:47 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2010/12/15 13:17:42 | 000,496,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\taskschd.dll
[2010/12/15 13:17:42 | 000,351,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmicmiplugin.dll
[2010/12/15 13:17:41 | 000,305,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\taskcomp.dll
[2010/12/15 13:17:41 | 000,179,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\schtasks.exe
[2010/12/15 13:17:39 | 000,294,400 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2010/12/15 13:17:39 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2010/12/15 13:17:38 | 000,314,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\webio.dll
[2010/12/15 13:17:37 | 000,101,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\consent.exe
[2010/12/15 13:17:36 | 002,327,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2010/12/05 17:24:39 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2010/12/05 17:19:35 | 000,000,000 | —D | C] – C:\Users\owner\AppData\Local\temp
[2010/12/05 16:51:56 | 000,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2010/12/05 16:51:56 | 000,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2010/12/05 16:51:56 | 000,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2010/12/05 16:51:47 | 000,000,000 | —D | C] – C:\ComboFix
[2010/12/05 16:51:23 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2010/12/05 16:50:53 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/12/05 16:50:35 | 000,000,000 | —D | C] – C:\Qoobox
[2010/12/05 15:48:33 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/12/05 15:48:29 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/12/04 16:48:07 | 000,000,000 | —D | C] – C:\ProgramData\Graboid Inc
[2010/12/04 16:46:46 | 000,000,000 | —D | C] – C:\Program Files\completedir
[2010/11/30 14:55:06 | 001,892,184 | —- | C] (Microsoft Corporation) – C:\Windows\System32\D3DX9_42.dll
[2010/11/30 14:55:05 | 002,414,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3dx9_31.dll
[2010/04/10 16:24:40 | 002,131,336 | —- | C] (Ask.com ) – C:\Program Files\Common Files\AskToolbarInstaller.exe
[2008/12/07 01:41:07 | 002,480,620 | —- | C] (DownloadBoosters LLC) – C:\Users\owner\AppData\Roaming\rrentturbobooster_installer.exe
[21 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/12/30 01:16:11 | 000,006,512 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/12/30 01:16:11 | 000,006,512 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/12/30 01:16:08 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/12/30 01:16:02 | 000,000,908 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1316480461-3079241605-3145038289-1000UA.job
[2010/12/29 18:53:41 | 002,763,738 | —- | M] () – C:\Users\owner\Desktop\IMG_1794.JPG
[2010/12/29 18:53:28 | 000,057,907 | —- | M] () – C:\Users\owner\Desktop\IMG_0597.JPG
[2010/12/29 11:06:45 | 000,000,856 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1316480461-3079241605-3145038289-1000Core.job
[2010/12/28 14:28:49 | 000,001,043 | —- | M] () – C:\Users\owner\Desktop\Dropbox.lnk
[2010/12/28 14:23:58 | 000,001,023 | —- | M] () – C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2010/12/28 13:19:08 | 003,674,594 | —- | M] () – C:\Users\owner\Desktop\Kristen-Stewart-kristen-stewart-7526784-1663-2464.jpg
[2010/12/28 13:18:14 | 000,092,955 | —- | M] () – C:\Users\owner\Desktop\kristen-stewart-premiere-600x300-prphotos-wd.jpg
[2010/12/28 13:17:53 | 000,037,061 | —- | M] () – C:\Users\owner\Desktop\kristen-stewart1.jpg
[2010/12/28 13:03:00 | 000,025,230 | —- | M] () – C:\Users\owner\Desktop\kristen-stewart-depressed-breaking-dawn.jpg
[2010/12/28 12:45:59 | 000,024,724 | —- | M] () – C:\Users\owner\Desktop\user33_pic6_1245890556.jpg
[2010/12/28 12:45:50 | 000,055,622 | —- | M] () – C:\Users\owner\Desktop\greg-mottola-20071221045024944.jpg
[2010/12/27 00:21:46 | 000,000,897 | —- | M] () – C:\Users\owner\Desktop\XnView.lnk
[2010/12/27 00:21:16 | 000,000,921 | —- | M] () – C:\Users\owner\Application Data\Microsoft\Internet Explorer\Quick Launch\XnView.lnk
[2010/12/27 00:15:21 | 000,256,256 | —- | M] () – C:\Users\owner\Documents\pbentry.dat
[2010/12/27 00:11:42 | 000,000,945 | —- | M] () – C:\Users\owner\Desktop\Super Winspy.lnk
[2010/12/25 11:07:34 | 000,685,618 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/12/25 11:07:34 | 000,133,700 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/12/25 01:50:14 | 000,320,000 | —- | M] () – C:\Users\owner\Documents\pbnumber.dat
[2010/12/22 05:30:39 | 000,000,831 | —- | M] () – C:\Users\owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Opera.lnk
[2010/12/22 05:30:39 | 000,000,807 | —- | M] () – C:\Users\Public\Desktop\Opera.lnk
[2010/12/19 12:26:41 | 000,002,157 | —- | M] () – C:\Users\owner\Desktop\mahifgeirg_113198534.jpg
[2010/12/19 12:26:32 | 000,010,825 | —- | M] () – C:\Users\owner\Desktop\1xu34w452v_112733862.jpg
[2010/12/19 12:26:28 | 000,004,914 | —- | M] () – C:\Users\owner\Desktop\mahifgeirg_113198685.jpg
[2010/12/19 02:40:04 | 000,043,940 | —- | M] () – C:\Users\owner\Documents\bpbug.gz
[2010/12/19 01:29:55 | 000,064,000 | —- | M] () – C:\Users\owner\Documents\wmcUID.dat
[2010/12/18 17:52:48 | 004,360,740 | —- | M] () – C:\Users\owner\Desktop\Samsung_Galaxys(en).pdf
[2010/12/18 17:14:05 | 000,091,006 | —- | M] () – C:\Users\owner\Desktop\matts bill.jpg
[2010/12/18 12:12:05 | 000,028,761 | —- | M] () – C:\Users\owner\Desktop\8507nbj_20.jpeg
[2010/12/18 02:37:45 | 2415,566,848 | -HS- | M] () – C:\hiberfil.sys
[2010/12/18 02:35:31 | 000,001,757 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2010/12/18 02:32:59 | 000,001,819 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/12/16 23:34:01 | 000,002,898 | —- | M] () – C:\aqua_bitmap.cpp
[2010/12/16 23:31:30 | 000,001,917 | —- | M] () – C:\Users\Public\Desktop\Samsung Kies.lnk
[2010/12/16 23:08:38 | 001,820,125 | R— | M] () – C:\Users\owner\Documents\GalaxyS_One-Click_Root_All_Models.rar
[2010/12/16 22:38:16 | 000,002,551 | —- | M] () – C:\Users\Public\Desktop\Samsung PC Studio 7.lnk
[2010/12/16 21:44:21 | 000,000,995 | —- | M] () – C:\Users\owner\Desktop\magicJack.lnk
[2010/12/16 03:21:04 | 000,442,008 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/12/16 03:03:37 | 000,002,048 | —- | M] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2010/12/16 03:03:26 | 001,638,912 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2010/12/16 03:03:26 | 000,606,208 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2010/12/16 03:03:26 | 000,599,040 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2010/12/16 03:03:26 | 000,386,048 | —- | M] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2010/12/16 03:03:26 | 000,381,440 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2010/12/16 03:03:26 | 000,185,856 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2010/12/16 03:03:26 | 000,176,640 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2010/12/16 03:03:26 | 000,064,512 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2010/12/16 03:03:26 | 000,048,128 | —- | M] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2010/12/16 03:03:26 | 000,044,544 | —- | M] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2010/12/16 03:03:26 | 000,012,800 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2010/12/16 03:03:19 | 000,496,128 | —- | M] (Microsoft Corporation) – C:\Windows\System32\taskschd.dll
[2010/12/16 03:03:19 | 000,351,232 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wmicmiplugin.dll
[2010/12/16 03:03:19 | 000,305,152 | —- | M] (Microsoft Corporation) – C:\Windows\System32\taskcomp.dll
[2010/12/16 03:03:19 | 000,179,712 | —- | M] (Microsoft Corporation) – C:\Windows\System32\schtasks.exe
[2010/12/16 03:03:16 | 000,294,400 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2010/12/16 03:03:16 | 000,034,304 | —- | M] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2010/12/16 03:03:14 | 000,314,368 | —- | M] (Microsoft Corporation) – C:\Windows\System32\webio.dll
[2010/12/16 03:02:57 | 000,101,760 | —- | M] (Microsoft Corporation) – C:\Windows\System32\consent.exe
[2010/12/16 03:00:34 | 002,327,552 | —- | M] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2010/12/05 17:21:30 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2010/12/05 15:17:14 | 000,001,937 | —- | M] () – C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2010/12/05 15:17:11 | 000,002,577 | —- | M] () – C:\Windows\System32\config.nt
[2010/12/01 12:37:24 | 000,734,550 | —- | M] () – C:\Users\owner\Desktop\IMG00022-20101127-2135.jpg
[2010/11/30 14:55:07 | 000,000,969 | —- | M] () – C:\Users\owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Winamp.lnk
[2010/11/30 14:53:07 | 001,064,195 | —- | M] () – C:\Users\owner\Documents\Evil_Knegro.wmv
[2010/11/30 14:53:05 | 003,181,576 | —- | M] () – C:\Users\owner\Documents\Leroy_Gets_A_New_Harley.wmv
[2010/11/30 14:53:00 | 001,848,535 | —- | M] () – C:\Users\owner\Documents\Tyrone_gets_a_new_scooter.wmv
[21 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/12/29 18:53:38 | 002,763,738 | —- | C] () – C:\Users\owner\Desktop\IMG_1794.JPG
[2010/12/29 18:53:25 | 000,057,907 | —- | C] () – C:\Users\owner\Desktop\IMG_0597.JPG
[2010/12/28 14:28:49 | 000,001,043 | —- | C] () – C:\Users\owner\Desktop\Dropbox.lnk
[2010/12/28 14:23:58 | 000,001,023 | —- | C] () – C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2010/12/28 13:18:13 | 000,092,955 | —- | C] () – C:\Users\owner\Desktop\kristen-stewart-premiere-600x300-prphotos-wd.jpg
[2010/12/28 13:17:53 | 000,037,061 | —- | C] () – C:\Users\owner\Desktop\kristen-stewart1.jpg
[2010/12/28 13:02:59 | 000,025,230 | —- | C] () – C:\Users\owner\Desktop\kristen-stewart-depressed-breaking-dawn.jpg
[2010/12/28 12:45:58 | 000,024,724 | —- | C] () – C:\Users\owner\Desktop\user33_pic6_1245890556.jpg
[2010/12/28 12:45:50 | 000,055,622 | —- | C] () – C:\Users\owner\Desktop\greg-mottola-20071221045024944.jpg
[2010/12/28 12:45:40 | 003,674,594 | —- | C] () – C:\Users\owner\Desktop\Kristen-Stewart-kristen-stewart-7526784-1663-2464.jpg
[2010/12/27 00:21:16 | 000,000,921 | —- | C] () – C:\Users\owner\Application Data\Microsoft\Internet Explorer\Quick Launch\XnView.lnk
[2010/12/27 00:21:16 | 000,000,897 | —- | C] () – C:\Users\owner\Desktop\XnView.lnk
[2010/12/27 00:11:42 | 000,007,380 | —- | C] () – C:\Windows\System32\winspy.tlb
[2010/12/27 00:11:42 | 000,000,945 | —- | C] () – C:\Users\owner\Desktop\Super Winspy.lnk
[2010/12/25 01:49:56 | 000,256,256 | —- | C] () – C:\Users\owner\Documents\pbentry.dat
[2010/12/22 05:30:39 | 000,000,807 | —- | C] () – C:\Users\Public\Desktop\Opera.lnk
[2010/12/19 12:26:41 | 000,002,157 | —- | C] () – C:\Users\owner\Desktop\mahifgeirg_113198534.jpg
[2010/12/19 12:26:31 | 000,010,825 | —- | C] () – C:\Users\owner\Desktop\1xu34w452v_112733862.jpg
[2010/12/19 12:26:23 | 000,004,914 | —- | C] () – C:\Users\owner\Desktop\mahifgeirg_113198685.jpg
[2010/12/19 02:39:08 | 000,043,940 | —- | C] () – C:\Users\owner\Documents\bpbug.gz
[2010/12/19 01:29:55 | 000,064,000 | —- | C] () – C:\Users\owner\Documents\wmcUID.dat
[2010/12/19 01:29:42 | 000,320,000 | —- | C] () – C:\Users\owner\Documents\pbnumber.dat
[2010/12/18 17:52:48 | 004,360,740 | —- | C] () – C:\Users\owner\Desktop\Samsung_Galaxys(en).pdf
[2010/12/18 17:14:05 | 000,091,006 | —- | C] () – C:\Users\owner\Desktop\matts bill.jpg
[2010/12/18 12:32:57 | 000,028,761 | —- | C] () – C:\Users\owner\Desktop\8507nbj_20.jpeg
[2010/12/18 02:35:31 | 000,001,757 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2010/12/18 02:32:59 | 000,001,819 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/12/18 00:33:54 | 001,820,125 | R— | C] () – C:\Users\owner\Documents\GalaxyS_One-Click_Root_All_Models.rar
[2010/12/16 23:31:30 | 000,001,917 | —- | C] () – C:\Users\Public\Desktop\Samsung Kies.lnk
[2010/12/16 22:38:16 | 000,002,551 | —- | C] () – C:\Users\Public\Desktop\Samsung PC Studio 7.lnk
[2010/12/05 16:51:56 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2010/12/05 16:51:56 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2010/12/05 16:51:56 | 000,089,088 | —- | C] () – C:\Windows\MBR.exe
[2010/12/05 16:51:56 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2010/12/05 16:51:56 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2010/12/05 15:17:14 | 000,001,937 | —- | C] () – C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2010/12/01 12:37:21 | 000,734,550 | —- | C] () – C:\Users\owner\Desktop\IMG00022-20101127-2135.jpg
[2010/11/30 14:53:06 | 001,064,195 | —- | C] () – C:\Users\owner\Documents\Evil_Knegro.wmv
[2010/11/30 14:53:01 | 003,181,576 | —- | C] () – C:\Users\owner\Documents\Leroy_Gets_A_New_Harley.wmv
[2010/11/30 14:52:59 | 001,848,535 | —- | C] () – C:\Users\owner\Documents\Tyrone_gets_a_new_scooter.wmv
[2010/10/25 04:09:56 | 000,974,848 | —- | C] () – C:\Windows\System32\cis-2.4.dll
[2010/10/25 04:09:56 | 000,081,920 | —- | C] () – C:\Windows\System32\issacapi_bs-2.3.dll
[2010/10/25 04:09:56 | 000,065,536 | —- | C] () – C:\Windows\System32\issacapi_pe-2.3.dll
[2010/10/25 04:09:56 | 000,057,344 | —- | C] () – C:\Windows\System32\issacapi_se-2.3.dll
[2010/10/10 19:48:28 | 000,110,592 | —- | C] () – C:\Windows\System32\FsUsbExDevice.Dll
[2010/10/10 19:48:28 | 000,036,640 | —- | C] () – C:\Windows\System32\FsUsbExDisk.Sys
[2010/10/01 23:47:25 | 000,000,036 | —- | C] () – C:\Users\owner\AppData\Local\housecall.guid.cache
[2010/08/04 00:14:28 | 000,023,040 | —- | C] () – C:\Windows\System32\atitmpxx.dll
[2010/07/23 21:31:45 | 000,000,418 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2010/06/10 13:46:38 | 000,076,407 | —- | C] () – C:\Users\owner\AppData\Roaming\Smiley.ico
[2010/05/15 00:53:10 | 000,007,168 | —- | C] () – C:\Windows\System32\drivers\StarOpen.sys
[2010/04/23 00:46:22 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2010/04/22 11:56:41 | 000,000,038 | —- | C] () – C:\Users\owner\AppData\Roaming\AVSMediaPlayer.m3u
[2009/09/28 08:22:00 | 000,315,392 | —- | C] () – C:\Windows\System32\drivers\yk62x86.sys
[2009/07/13 18:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 18:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/01/15 18:31:21 | 000,027,648 | —- | C] () – C:\Windows\System32\AVSredirect.dll
[2008/12/20 02:38:13 | 000,000,034 | —- | C] () – C:\Windows\cdplayer.ini
[2008/11/13 12:30:46 | 000,233,472 | —- | C] () – C:\Windows\System32\lame_enc.dll
[2008/09/19 16:57:34 | 003,596,288 | —- | C] () – C:\Windows\System32\qt-dx331.dll
[2008/08/15 22:41:32 | 000,000,116 | —- | C] () – C:\Windows\NeroDigital.ini
[2008/03/17 00:07:02 | 000,000,114 | —- | C] () – C:\Users\owner\AppData\Roaming\AVSDVDPlayer.m3u
[2008/03/16 14:25:59 | 000,815,104 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2008/03/16 14:25:59 | 000,180,224 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2008/02/12 12:52:25 | 001,936,528 | —- | C] () – C:\Windows\System32\ltmm15.dll
[2007/11/04 19:45:36 | 000,394,240 | —- | C] () – C:\Windows\System32\Smab.dll
[2007/02/06 22:57:20 | 000,086,016 | —- | C] () – C:\Windows\System32\MSNSpook.dll
[2006/12/14 14:49:49 | 000,013,952 | —- | C] () – C:\Windows\System32\drivers\UBHelper.sys
[2006/12/14 14:12:14 | 000,001,024 | RH– | C] () – C:\Windows\System32\NTIBUN4.dll
[2006/12/14 13:26:31 | 000,000,700 | —- | C] () – C:\Windows\generic.ini
[2006/12/14 13:26:31 | 000,000,095 | —- | C] () – C:\Windows\Alaunch.ini
[2001/12/26 18:12:30 | 000,065,536 | —- | C] () – C:\Windows\System32\multiplex_vcd.dll
[2001/09/04 01:46:38 | 000,110,592 | —- | C] () – C:\Windows\System32\Hmpg12.dll
[2001/07/30 18:33:56 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC.dll
[2001/07/24 00:04:36 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC_MMX.dll
[2000/02/04 00:18:12 | 000,165,376 | —- | C] () – C:\Windows\System32\unrar.dll
[1999/01/27 12:39:06 | 000,065,024 | —- | C] () – C:\Windows\System32\indounin.dll
[1997/06/13 06:56:08 | 000,056,832 | —- | C] () – C:\Windows\System32\Iyvu9_32.dll

========== LOP Check ==========

[2010/08/17 16:25:50 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\.minecraft
[2010/07/23 21:08:25 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Acer
[2010/07/23 21:08:27 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\AVSMedia
[2010/07/23 21:08:27 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Canneverbe Limited
[2010/07/23 21:08:27 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Canopus
[2010/12/29 11:59:31 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Dropbox
[2010/07/23 21:08:28 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\eMule
[2010/11/16 10:32:37 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\FMZilla
[2010/07/23 21:08:28 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\fretsonfire
[2010/07/23 21:08:28 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\GetRightToGo
[2010/07/23 21:08:28 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\GlobalSCAPE
[2010/07/23 21:08:28 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Leadertech
[2010/07/23 21:08:28 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\LimeWire
[2010/10/10 19:22:24 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Mael
[2010/07/23 21:08:39 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Metacafe
[2010/12/16 21:44:28 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\mjusbsp
[2010/07/23 21:08:46 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\MusicNet
[2010/07/23 21:08:46 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\OpenOffice.org
[2010/08/25 12:17:37 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Opera
[2010/08/23 16:03:53 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Outertech
[2010/12/16 22:50:10 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\PC Suite
[2008/11/17 19:49:47 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Publish Providers
[2010/08/10 23:06:01 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\RipIt4Me
[2010/12/16 23:35:31 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Samsung
[2010/07/23 21:08:49 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Sony
[2010/07/23 21:08:49 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\StumbleUpon
[2010/07/23 21:08:49 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\TeamViewer
[2010/07/23 23:24:08 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\Thunderbird
[2010/07/23 21:08:49 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\TuneUp Software
[2010/12/29 01:02:07 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\uTorrent
[2010/12/27 00:24:16 | 000,000,000 | —D | M] – C:\Users\owner\AppData\Roaming\XnView
[2009/07/13 23:53:46 | 000,009,966 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/07/23 12:44:46 | 000,015,661 | —- | M] () – C:\aaw7boot.log
[2010/12/16 23:34:01 | 000,002,898 | —- | M] () – C:\aqua_bitmap.cpp
[2009/06/10 16:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/03 12:56:35 | 000,000,325 | -H– | M] () – C:\Boot.BAK
[2010/07/24 00:52:00 | 000,000,469 | RHS- | M] () – C:\boot.ini
[2010/07/24 00:52:00 | 000,000,469 | RHS- | M] () – C:\Boot.ini.saved
[2009/07/13 20:38:58 | 000,383,562 | RHS- | M] () – C:\bootmgr
[2010/07/24 00:52:07 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2009/06/10 16:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2009/08/02 03:59:51 | 000,171,136 | RHS- | M] () – C:\grldr
[2010/12/18 02:37:45 | 2415,566,848 | -HS- | M] () – C:\hiberfil.sys
[2008/02/05 00:29:49 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2008/02/05 00:29:49 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/05 00:59:34 | 000,250,032 | RHS- | M] () – C:\ntldr
[2010/12/18 02:37:46 | 3220,758,528 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2009/07/13 20:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 18:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
[2009/07/13 20:16:19 | 000,029,696 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2009/07/13 23:52:25 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 23:52:25 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 23:52:25 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 23:52:25 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 16:31:19 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\*. /mp /s >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.scr >
[2010/09/07 10:12:17 | 000,038,848 | —- | M] (AVAST Software) – C:\Windows\avastSS.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/07/13 20:15:13 | 000,346,112 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\dxtmsft.dll
[2009/07/13 20:15:13 | 000,215,552 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\dxtrans.dll
[2009/07/13 20:15:21 | 000,462,848 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\FirewallAPI.dll
[2009/07/13 20:15:36 | 000,226,816 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\LocationApi.dll
[21 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >

< %systemroot%\system32\user32.dll /md5 >
[2010/08/11 13:13:32 | 000,811,520 | —- | M] (Microsoft Corporation) MD5=7BD7F45FF37FA0669CD32CA0EF46E22C – C:\Windows\System32\user32.dll
[21 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

< %systemroot%\system32\ws2_32.dll /md5 >
[2009/07/13 20:16:20 | 000,206,336 | —- | M] (Microsoft Corporation) MD5=DAAE8A9B8C0ACC7F858454132553C30D – C:\Windows\System32\ws2_32.dll
[21 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

< %systemroot%\system32\ws2help.dll /md5 >
[2009/07/13 20:11:26 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=808AABDF9337312195CAFF76D1804786 – C:\Windows\System32\ws2help.dll
[21 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-12-29 05:07:30

========== Alternate Data Streams ==========

@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:A8ADE5D8

< End of report >
OTL Extras logfile created on: 30/12/2010 1:53:06 AM - Run 1
OTL by OldTimer - Version 3.2.18.2 Folder = D:\OWNER-PC\Downloads
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 65.00% Memory free
6.00 Gb Paging File | 4.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 71.28 Gb Total Space | 32.72 Gb Free Space | 45.91% Space Free | Partition Type: NTFS
Drive D: | 70.94 Gb Total Space | 38.60 Gb Free Space | 54.41% Space Free | Partition Type: NTFS
Drive F: | 562.92 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive G: | 931.51 Gb Total Space | 792.84 Gb Free Space | 85.11% Space Free | Partition Type: NTFS

Computer Name: OWNER-PC | User Name: owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.ini [@ = GetDiz.Document] – C:\Program Files\GetDiz\GetDiz.exe (Outertech - http://outertech.com)
.txt [@ = GetDiz.Document] – C:\Program Files\GetDiz\GetDiz.exe (Outertech - http://outertech.com)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Acer\Empowering Technology\eDataSecurity\decryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled:decryption – File not found
"C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe" = C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu – File not found
"C:\Acer\Empowering Technology\eDataSecurity\encryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption – File not found


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}" = HiJackThis
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{104A059B-CD20-4632-A8F6-D8C80E14782D}" = Magellan POI File Editor
"{119E2FCB-5CDD-4C24-BCB2-56A824E2BF0A}_is1" = Manic Digger
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.5.4
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{1EE88B84-7BE5-4FB5-8DEA-B81D5409D62E}" = Opera 11.00
"{1F0A73B4-6187-3CE7-B07A-807BC8F28B4F}" = ccc-utility
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{2212E17D-2931-5F26-9213-00EEC82C7EF0}" = ccc-core-static
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216018F0}" = Java™ 6 Update 18
"{26A24AE4-039D-4CA4-87B4-2F83216019FF}" = Java™ 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216020F0}" = Java™ 6 Update 20
"{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1" = ConvertHelper 2.2
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java™ 6 Update 4
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{338F08AB-C262-42C7-B000-34DE1A475273}" = Ad-Aware Email Scanner for Outlook
"{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}" = PC Connectivity Solution
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{503231D1-3A81-69DC-A95D-5273AB7A1CCC}" = Catalyst Control Center Graphics Previews Vista
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{59D98250-CFEB-4A0B-A737-FC7CADE27852}" = CuteFTP 7 Home
"{5C08784B-D955-4BB4-8C70-43C89A738F58}" = Motorola Phone Tools
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{67ADE9AF-5CD9-4089-8825-55DE4B366799}" = NTI Backup NOW! 4.7
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6BCB7EAA-598C-4836-B7EA-3642E41AA222}" = Microsoft LifeCam
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B08D306-7266-4647-A926-2F78817ED1E0}" = Microsoft Corporation
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{87323561-58BA-4D5B-BADA-A791B69D1705}" = Catalyst Control Center - Branding
"{881F5DE8-9367-4B81-A325-E91BBC6472F9}" = iTunes
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8EA5CBF8-DFF4-5C69-9434-F87F8C21293C}" = Catalyst Control Center Graphics Previews Common
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90850409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{986D4985-AA54-4C78-B3D9-F4E743314125}" = .NET Utilities
"{98736A65-3C79-49EC-B7E9-A3C77774B0E6}" = Google SketchUp 6
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A1E480F4-805E-AE2D-5F83-FC7618F47046}" = Catalyst Control Center InstallProxy
"{A7E19604-93AF-4611-8C9F-CE509C2B286E}_is1" = VDownloader 2.8.387
"{A92B6797-9C07-4E25-AD96-29087D3A2AC2}" = TouchCopy 09
"{AB6F6C80-1C35-4672-BDEF-F26FF214C409}" = Samsung PC Studio 7
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.1
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B3D8B2F8-3C2C-45BC-933E-8B60E78F6684}" = Google SketchUp 6
"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{B883FC57-818A-2C84-34CF-917B3C56C85B}" = CCC Help English
"{BAD8CA9C-77C0-4663-B00B-A8D3B13C341B}" = Motorola Phone Tools
"{BEFBEDDF-1417-4C8A-92FB-F003C0D41199}" = OpenOffice.org 3.2
"{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem driver
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D2BD3C8F-9D7F-472B-BDF9-7309A5CB813A}" = Motorola Driver Installation 3.5.0
"{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"{DBDDB011-4FA3-11D5-AD9A-0050BA1AB546}" = Configuration Utility
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E1180142-3B31-4DCC-9D27-7AC2D37662BF}" = LightScribe 1.4.124.1
"{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F49FEF83-45CA-4CE8-8304-A7372BA07AA9}" = Motorola Phone Tools
"{FA61D601-A0FC-48BD-AE7A-54946BCD7FB6}_is1" = BitPim 1.0.7
"{FB26A501-6BA6-459B-89AA-9736730752FB}" = VoiceOver Kit
"{FD423BBD-8095-D342-F496-59D7C22FD581}" = ATI Catalyst Install Manager
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"ACE-HIGH MP3 WAV WMA OGG Converter" = ACE-HIGH MP3 WAV WMA OGG Converter
"Ad-Aware" = Ad-Aware
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Alive YouTube Video Converter_is1" = Alive YouTube Video Converter (version 1.0.8.6)
"Applian FLV Player2.0.23" = Applian FLV Player
"avast5" = avast! Free Antivirus
"AVIConverter" = AVIConverter 3.0
"AVS DVD Player_is1" = AVS DVD Player version 2.4
"AVS Media Player_is1" = AVS Media Player 3.1
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
"AVS4YOU Video Converter 6_is1" = AVS Video Converter 6
"BCDP7_is1" = Business Card Designer Plus 7.3.0.0
"Belltech Business Card Designer Pro 4.7 (Trial)_is1" = Belltech Business Card Designer Pro 4.7
"CAD X11 Demo" = CAD X11 Demo
"Collab" = Collab
"DECCHECK" = Microsoft Windows XP Video Decoder Checkup Utility
"DivX Setup.divx.com" = DivX Setup
"DVD Decrypter" = DVD Decrypter (Remove Only)
"DVD Shrink_is1" = DVD Shrink 3.2
"DVD43_is1" = DVD43 v3.9.0
"DVDBuilder_is1" = DVDBuilder 2.8
"ENTERPRISE" = Microsoft Office Enterprise 2007
"File Shredder_is1" = File Shredder 2.0
"FL Studio 7" = FL Studio 7
"FLV Player" = FLV Player 2.0 (build 25)
"Free YouTube to Mp3 Converter_is1" = Free YouTube to Mp3 Converter version 2.4
"GetDiz 4.5" = GetDiz 4.5
"Graboid Video" = Graboid Video 1.73
"HotspotShield" = Hotspot Shield 1.54
"HUFFYUV" = Huffyuv AVI lossless video codec (Remove Only)
"HxD Hex Editor_is1" = HxD Hex Editor version 1.7.7.0
"InFlac" = InFlac 1.1.1
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"InstallShield_{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"KLiteCodecPack_is1" = K-Lite Codec Pack 6.0.4 (Basic)
"Learn Electronics Part 1" = Twisted Pair Computer Based Training Learn Electronics Part 1 5.03
"LimeWire" = LimeWire PRO 4.14.8
"MagicDisc 2.7.106" = MagicDisc 2.7.106
"magicJack Recovery Tool_is1" = magicJack Recovery Tool 1.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Metacafe" = Metacafe
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"Mozilla Thunderbird (3.1.7)" = Mozilla Thunderbird (3.1.7)
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"Power Supply Designer II" = Power Supply Designer II
"Replay Media Catcher2.10" = Replay Media Catcher
"Samsung PC Studio 7" = Samsung PC Studio 7
"SKDEBC" = Business Card Pro
"SMSERIAL" = Motorola SM56 Speakerphone Modem
"ST6UNST #1" = audioGnome Active Installer
"ST6UNST #2" = audioGnome
"SUPER ©" = SUPER © Version 2010.bld.38 (May 2, 2010)
"Super Winspy_is1" = Super Winspy v3.7
"TeamViewer 5" = TeamViewer 5
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.0.1
"VobSub" = VobSub v2.05 (Remove Only)
"Winamp" = Winamp
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"XnView_is1" = XnView 1.97.8
"Xvid_is1" = Xvid 1.2.1 final uninstall

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
"magicJack" = magicJack
"uTorrent" = µTorrent
"Winamp Detect" = Winamp Detector Plug-in

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

well here it is… i uninstalled hotspot shield removed java n reinstalled updated version ComboFix 11-01-02.02 - owner 02/01/2011 13:58:07.2.1 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.2.1033.18.3072.2237 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308} SP: avast! Antivirus *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5} SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {61CDFD9D-3CAC-9270-C6FC-52325ACB795B} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\muzapp.exe c:\windows\system32\system32 c:\windows\system32\system32\cis-2.4.dll c:\windows\system32\system32\issacapi_bs-2.3.dll c:\windows\system32\system32\issacapi_pe-2.3.dll c:\windows\system32\system32\issacapi_se-2.3.dll c:\windows\system32\system32\MACXMLProto.dll c:\windows\system32\system32\MaDRM.dll c:\windows\system32\system32\MaJGUILib.dll c:\windows\system32\system32\MaJUtilLib.dll c:\windows\system32\system32\MAMACExtract.dll c:\windows\system32\system32\MASetupCaller.dll c:\windows\system32\system32\MASetupCleaner.exe c:\windows\system32\system32\MaXMLProto.dll c:\windows\system32\system32\MetaStore2.dll c:\windows\system32\system32\Microsoft.Synchronization.dll c:\windows\system32\system32\MK_Lyric.dll c:\windows\system32\system32\MSCLib.dll c:\windows\system32\system32\MSFLib.dll c:\windows\system32\system32\MSLUR71.dll c:\windows\system32\system32\msvcp60.dll c:\windows\system32\system32\MTTELECHIP.dll c:\windows\system32\system32\MTXSYNCICON.dll c:\windows\system32\system32\muzaf1.dll c:\windows\system32\system32\muzapp.dll c:\windows\system32\system32\muzapp.exe c:\windows\system32\system32\muzdecode.ax c:\windows\system32\system32\muzeffect.ax c:\windows\system32\system32\muzmp4sp.ax c:\windows\system32\system32\muzmpgsp.ax c:\windows\system32\system32\muzoggsp.ax c:\windows\system32\system32\muzwmts.dll c:\windows\system32\system32\psapi.dll c:\windows\system32\system32\Synchronization2.dll . —- Previous Run ——- . c:\users\owner\AppData\Roaming\ayer__Will_play_ALL_movies_.exe c:\windows\system32\muzapp.exe – Previous Run – Infected copy of c:\windows\system32\userinit.exe was found and disinfected Restored copy from - c:\combofix\HarddiskVolumeShadowCopy29_!Windows!System32!userinit.exe ——– . ((((((((((((((((((((((((( Files Created from 2010-12-02 to 2011-01-02 ))))))))))))))))))))))))))))))) . 2011-01-02 19:05 . 2011-01-02 19:05 ——– d—–w- c:\users\owner\AppData\Local\temp 2011-01-02 19:05 . 2011-01-02 19:05 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-01-02 18:23 . 2011-01-02 18:23 ——– d—–w- c:\programdata\hsswpr 2010-12-31 17:03 . 2010-11-10 04:33 6273872 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6EC703C5-9075-4F01-ADCF-AC31AC04CFF0}\mpengine.dll 2010-12-28 19:28 . 2011-01-02 18:29 ——– dc—-r- c:\users\owner\Dropbox 2010-12-28 19:23 . 2011-01-02 18:29 ——– dc—-w- c:\users\owner\AppData\Roaming\Dropbox 2010-12-27 05:21 . 2010-12-27 05:24 ——– dc—-w- c:\users\owner\AppData\Roaming\XnView 2010-12-27 05:21 . 2010-12-27 05:21 ——– dc—-w- c:\program files\XnView 2010-12-27 05:11 . 2010-12-27 05:11 ——– dc—-w- c:\program files\Winspy 2010-12-18 07:34 . 2010-12-18 07:34 ——– dc—-w- c:\program files\iPod 2010-12-18 07:31 . 2010-12-18 07:31 ——– dc—-w- c:\program files\Bonjour 2010-12-17 03:50 . 2010-12-17 03:50 ——– dc—-w- c:\users\owner\AppData\Roaming\PC Suite 2010-12-17 03:50 . 2010-12-17 03:50 ——– d—–w- c:\programdata\PC Suite 2010-12-17 03:38 . 2010-12-17 03:38 ——– dc—-w- c:\program files\Common Files\PCSuite 2010-12-17 03:38 . 2010-12-17 03:38 ——– dc—-w- c:\program files\DIFX 2010-12-17 03:38 . 2008-08-26 14:26 18816 —-a-w- c:\windows\system32\drivers\pccsmcfd.sys 2010-12-17 03:37 . 2007-05-02 21:31 90624 —-a-w- c:\windows\system32\nmwcdcls.dll 2010-12-05 20:48 . 2010-11-29 22:42 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-12-05 20:48 . 2010-11-29 22:42 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-12-04 21:48 . 2010-12-04 21:48 ——– d—–w- c:\programdata\Graboid Inc 2010-12-04 21:46 . 2010-12-05 22:48 ——– dc—-w- c:\program files\completedir . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-01-02 18:28 . 2010-05-07 20:59 472808 -c–a-w- c:\windows\system32\deployJava1.dll 2010-11-29 22:38 . 2010-11-29 22:38 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx 2010-11-29 22:38 . 2010-11-29 22:38 69632 —-a-w- c:\windows\system32\QuickTime.qts 2010-11-23 06:51 . 2010-11-23 06:51 0 —-a-w- c:\windows\system32\REN6C83.tmp 2010-11-23 06:51 . 2010-11-23 06:51 0 —-a-w- c:\windows\system32\REN6C72.tmp 2010-11-23 06:51 . 2010-11-23 06:51 0 —-a-w- c:\windows\system32\REN6C71.tmp 2010-10-28 07:00 . 2010-10-26 17:12 26504 —-a-w- c:\windows\system32\drivers\Diskdump.sys 2010-10-27 07:02 . 2010-10-26 17:13 641536 —-a-w- c:\windows\system32\CPFilters.dll 2010-10-27 07:02 . 2010-10-26 17:13 417792 —-a-w- c:\windows\system32\msdri.dll 2010-10-27 07:02 . 2010-10-26 17:13 204288 —-a-w- c:\windows\system32\MSNP.ax 2010-10-27 07:02 . 2010-10-26 17:13 199680 —-a-w- c:\windows\system32\mpg2splt.ax 2010-10-25 09:09 . 2010-10-25 09:09 974848 -c–a-w- c:\windows\system32\cis-2.4.dll 2010-10-25 09:09 . 2010-10-25 09:09 81920 -c–a-w- c:\windows\system32\issacapi_bs-2.3.dll 2010-10-25 09:09 . 2010-10-25 09:09 65536 -c–a-w- c:\windows\system32\issacapi_pe-2.3.dll 2010-10-25 09:09 . 2010-10-25 09:09 57344 -c–a-w- c:\windows\system32\MTXSYNCICON.dll 2010-10-25 09:09 . 2010-10-25 09:09 57344 -c–a-w- c:\windows\system32\MK_Lyric.dll 2010-10-25 09:09 . 2010-10-25 09:09 57344 -c–a-w- c:\windows\system32\issacapi_se-2.3.dll 2010-10-25 09:09 . 2010-10-25 09:09 569344 -c–a-w- c:\windows\system32\muzdecode.ax 2010-10-25 09:09 . 2010-10-25 09:09 491520 -c–a-w- c:\windows\system32\muzapp.dll 2010-10-25 09:09 . 2010-10-25 09:09 49152 -c–a-w- c:\windows\system32\MaJGUILib.dll 2010-10-25 09:09 . 2010-10-25 09:09 45056 -c–a-w- c:\windows\system32\MaXMLProto.dll 2010-10-25 09:09 . 2010-10-25 09:09 45056 -c–a-w- c:\windows\system32\MACXMLProto.dll 2010-10-25 09:09 . 2010-10-25 09:09 413696 -c–a-w- c:\programdata\Microsoft\Windows\Templates\msvcp60.dll 2010-10-25 09:09 . 2010-10-25 09:09 40960 -c–a-w- c:\windows\system32\MTTELECHIP.dll 2010-10-25 09:09 . 2010-10-25 09:09 40960 -c–a-w- c:\windows\system32\MAMACExtract.dll 2010-10-25 09:09 . 2010-10-25 09:09 352256 -c–a-w- c:\windows\system32\MSLUR71.dll 2010-10-25 09:09 . 2010-10-25 09:09 258048 -c–a-w- c:\windows\system32\muzoggsp.ax 2010-10-25 09:09 . 2010-10-25 09:09 245760 -c–a-w- c:\windows\system32\MSCLib.dll 2010-10-25 09:09 . 2010-10-25 09:09 24576 -c–a-w- c:\windows\system32\MASetupCleaner.exe 2010-10-25 09:09 . 2010-10-25 09:09 243576 -c–a-w- c:\windows\system32\MASetupCaller.dll 2010-10-25 09:09 . 2010-10-25 09:09 23040 -c–a-w- c:\programdata\Microsoft\Windows\Templates\psapi.dll 2010-10-25 09:09 . 2010-10-25 09:09 200704 -c–a-w- c:\windows\system32\muzwmts.dll 2010-10-25 09:09 . 2010-10-25 09:09 155648 -c–a-w- c:\windows\system32\MSFLib.dll 2010-10-25 09:09 . 2010-10-25 09:09 135168 -c–a-w- c:\windows\system32\muzaf1.dll 2010-10-25 09:09 . 2010-10-25 09:09 131072 -c–a-w- c:\windows\system32\muzmpgsp.ax 2010-10-25 09:09 . 2010-10-25 09:09 122880 -c–a-w- c:\windows\system32\muzeffect.ax 2010-10-25 09:09 . 2010-10-25 09:09 118784 -c–a-w- c:\windows\system32\MaDRM.dll 2010-10-25 09:09 . 2010-10-25 09:09 110592 -c–a-w- c:\windows\system32\muzmp4sp.ax 2010-10-25 09:09 . 2010-10-25 09:09 511328 -c–a-w- c:\windows\system32\Synchronization2.dll 2010-10-25 09:09 . 2010-10-25 09:09 288608 -c–a-w- c:\windows\system32\Microsoft.Synchronization.dll 2010-10-25 09:09 . 2010-10-25 09:09 253280 -c–a-w- c:\windows\system32\MetaStore2.dll 2010-10-25 09:07 . 2010-10-25 09:07 95568 -c–a-w- c:\windows\system32\dgdersvc.exe 2010-10-25 09:07 . 2010-10-25 09:07 763216 -c–a-w- c:\windows\system32\dgderapi.dll 2010-10-25 09:07 . 2010-10-25 09:07 319456 -c–a-w- c:\programdata\Microsoft\Windows\Templates\DIFxAPI.dll 2010-10-25 09:07 . 2010-10-25 09:07 18120 -c–a-w- c:\windows\system32\drivers\dgderdrv.sys 2010-10-25 09:03 . 2010-10-11 00:48 36640 —-a-w- c:\windows\system32\FsUsbExDisk.Sys 2010-10-19 15:41 . 2010-07-04 13:16 222080 -c—-w- c:\windows\system32\MpSigStub.exe 2010-10-14 07:01 . 2010-10-14 05:15 1413632 —-a-w- c:\windows\system32\ole32.dll 2010-10-14 07:01 . 2010-10-14 05:15 109056 —-a-w- c:\windows\system32\t2embed.dll 2010-10-14 07:00 . 2010-10-14 05:15 224256 —-a-w- c:\windows\system32\schannel.dll 2010-10-14 07:00 . 2010-10-14 05:15 530432 —-a-w- c:\windows\system32\comctl32.dll 2010-10-14 07:00 . 2010-10-14 05:15 954752 —-a-w- c:\windows\system32\mfc40.dll 2010-10-14 07:00 . 2010-10-14 05:15 954288 —-a-w- c:\windows\system32\mfc40u.dll 2010-10-14 07:00 . 2010-10-14 05:15 12625408 —-a-w- c:\windows\system32\wmploc.DLL 2010-10-14 07:00 . 2010-10-14 05:15 310784 —-a-w- c:\windows\system32\drivers\srv.sys 2010-10-14 07:00 . 2010-10-14 05:15 308736 —-a-w- c:\windows\system32\drivers\srv2.sys 2010-10-14 07:00 . 2010-10-14 05:15 168448 —-a-w- c:\windows\system32\srvsvc.dll 2010-10-14 07:00 . 2010-10-14 05:15 113664 —-a-w- c:\windows\system32\drivers\srvnet.sys 2010-10-14 07:00 . 2010-10-14 05:15 738816 —-a-w- c:\windows\system32\wmpmde.dll 2010-10-14 07:00 . 2010-10-14 05:15 363520 —-a-w- c:\windows\system32\StructuredQuery.dll 2010-10-07 17:23 . 2010-10-07 17:23 91424 —-a-w- c:\windows\system32\dnssd.dll 2010-10-07 17:23 . 2010-10-07 17:23 107808 —-a-w- c:\windows\system32\dns-sd.exe 2010-02-10 15:18 . 2010-04-10 21:24 2131336 -c–a-w- c:\program files\Common Files\AskToolbarInstaller.exe 2009-05-01 21:02 . 2009-05-01 21:02 1044480 -c–a-w- c:\program files\mozilla firefox\plugins\libdivx.dll 2009-05-01 21:02 . 2009-05-01 21:02 200704 -c–a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll 2006-05-03 09:06 163328 -csha-r- c:\windows\System32\flvDX.dll 2007-02-21 10:47 31232 -csha-r- c:\windows\System32\msfDX.dll 2008-03-16 12:30 216064 -csha-r- c:\windows\System32\nbDX.dll . ——- Sigcheck ——- [-] 2010-08-11 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll [7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [BU] [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] c:\program files\Ask.com\GenericAskToolbar.dll [BU] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [BU] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [BU] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 94208 -c–a-w- c:\users\owner\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 94208 -c–a-w- c:\users\owner\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 94208 -c–a-w- c:\users\owner\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "cdloader"="c:\users\owner\AppData\Roaming\mjusbsp\cdloader2.exe" [2010-12-03 50592] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504] "Google Update"="c:\users\owner\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-09-11 136176] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-11-06 328056] "S60 PC Suite Tray"="c:\program files\Samsung\Samsung PC Studio 7\PCSuite.exe" [2008-12-06 699392] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="RtHDVCpl.exe" [2006-11-09 3784704] "avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288] "SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2009-10-26 1458176] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-12-13 421160] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Samsung.PCSync"="c:\program files\Samsung\Samsung PC Studio 7\PcSync2.exe" [2009-06-04 1294336] c:\users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\owner\AppData\Roaming\Dropbox\bin\Dropbox.exe [2010-12-16 23343848] MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2010-11-5 576000] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2010-09-21 04:07 932288 -c–a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2010-09-23 08:47 35760 -c–a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cdloader] 2010-12-03 12:39 50592 -c–a-w- c:\users\owner\AppData\Roaming\mjusbsp\cdloader2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate] c:\program files\DivX\DivX Update\DivXUpdate.exe [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] 2004-04-17 16:41 196608 -c–a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] 2005-08-11 19:30 81920 -c–a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2010-12-13 22:16 421160 -c–a-w- c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\javahr] c:\path\javahr.exe [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\javahr2] c:\path\javahr2.exe [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] c:\windows\system32\NvCpl.dll [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] c:\windows\system32\NvMcTray.dll [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2010-11-29 22:38 421888 -c–a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl] 2006-11-09 02:57 3784704 —-a-w- c:\windows\RtHDVCpl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent] 2010-11-06 17:54 328056 -c–a-w- c:\program files\uTorrent\uTorrent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent Turbo Booster] c:\program files\uTorrent Turbo Booster\uTorrent Turbo Booster.exe [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX3000] c:\windows\vVX3000.exe [BU] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [2010-04-20 18432] R3 tenCapture;tenCapture;c:\windows\system32\DRIVERS\tenCapture.sys [2007-04-21 9344] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-08-11 1343400] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [x] R3 WSVD;WSVD;c:\windows\system32\drivers\WSVD.sys [2006-09-19 80744] S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2010-06-05 64288] S1 aswSP;aswSP; [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-08-04 176128] S2 aswFsBlk;aswFsBlk; [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768] S2 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [2010-10-25 95568] S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-05-28 233472] S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-04-16 173352] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-08-04 6096384] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-08-04 214016] S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2010-10-25 18120] S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2010-10-25 36640] S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-06-29 1352832] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392] . Contents of the 'Scheduled Tasks' folder 2011-01-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1316480461-3079241605-3145038289-1000Core.job - c:\users\owner\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-11 02:25] 2011-01-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1316480461-3079241605-3145038289-1000UA.job - c:\users\owner\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-11 02:25] . . ——- Supplementary Scan ——- . uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 uStart Page = about:blank uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to AMV Converter… - c:\program files\MP3 Player Utilities 4.03\AMVConverter\grab.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 4.03\MediaManager\grab.html DPF: {BA2D9665-D672-446F-98F4-E3E41FA12A01} - hxxp://www.mypccenter.com/CAB/PCA.cab FF - ProfilePath - c:\users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\xtzv1gzr.default\ FF - prefs.js: browser.startup.homepage - chrome://speeddial/content/speeddial.xul FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} FF - Ext: Speed Dial: {64161300-e22b-11db-8314-0800200c9a66} - %profile%\extensions\{64161300-e22b-11db-8314-0800200c9a66} FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} FF - Ext: Download Statusbar: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} - %profile%\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} FF - Ext: Screengrab: {02450954-cdd9-410f-b1da-db804e18c671} - %profile%\extensions\{02450954-cdd9-410f-b1da-db804e18c671} FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} FF - Ext: Conduit Engine : [removed] - %profile%\extensions\[removed] . . ——- File Associations ——- . .txt=GetDiz.Document . - - - - ORPHANS REMOVED - - - - URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file) HKCU-Run-KiesTrayAgent - (no file) . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000001 "MSCurrentCountry"=dword:000000b5 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2011-01-02 14:08:46 ComboFix-quarantined-files.txt 2011-01-02 19:08 Pre-Run: 36,490,100,736 bytes free Post-Run: 36,322,336,768 bytes free - - End Of File - - 2DD268329628A85349620F774B57EBFA

combo fix report after running with script ComboFix 11-01-02.02 - owner 02/01/2011 19:06:53.3.1 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.2.1033.18.3072.1936 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\owner\Desktop\CFScript.txt AV: avast! Antivirus *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308} SP: avast! Antivirus *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5} SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {61CDFD9D-3CAC-9270-C6FC-52325ACB795B} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\chrome.manifest c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\install.rdf c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome.manifest c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\install.rdf c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome.manifest c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\install.rdf . ((((((((((((((((((((((((( Files Created from 2010-12-03 to 2011-01-03 ))))))))))))))))))))))))))))))) . 2011-01-03 00:14 . 2011-01-03 00:14 ——– d—–w- c:\users\owner\AppData\Local\temp 2011-01-03 00:14 . 2011-01-03 00:14 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-01-02 22:58 . 2011-01-03 00:03 ——– dc—-w- c:\users\owner\AppData\Roaming\vlc 2011-01-02 18:23 . 2011-01-02 18:23 ——– d—–w- c:\programdata\hsswpr 2010-12-31 17:03 . 2010-11-10 04:33 6273872 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6EC703C5-9075-4F01-ADCF-AC31AC04CFF0}\mpengine.dll 2010-12-28 19:28 . 2011-01-02 20:06 ——– dc—-r- c:\users\owner\Dropbox 2010-12-28 19:23 . 2011-01-02 20:06 ——– dc—-w- c:\users\owner\AppData\Roaming\Dropbox 2010-12-27 05:21 . 2010-12-27 05:24 ——– dc—-w- c:\users\owner\AppData\Roaming\XnView 2010-12-27 05:21 . 2010-12-27 05:21 ——– dc—-w- c:\program files\XnView 2010-12-27 05:11 . 2010-12-27 05:11 ——– dc—-w- c:\program files\Winspy 2010-12-18 07:34 . 2010-12-18 07:34 ——– dc—-w- c:\program files\iPod 2010-12-18 07:31 . 2010-12-18 07:31 ——– dc—-w- c:\program files\Bonjour 2010-12-17 03:50 . 2010-12-17 03:50 ——– dc—-w- c:\users\owner\AppData\Roaming\PC Suite 2010-12-17 03:50 . 2010-12-17 03:50 ——– d—–w- c:\programdata\PC Suite 2010-12-17 03:38 . 2010-12-17 03:38 ——– dc—-w- c:\program files\Common Files\PCSuite 2010-12-17 03:38 . 2010-12-17 03:38 ——– dc—-w- c:\program files\DIFX 2010-12-17 03:37 . 2007-05-02 21:31 90624 —-a-w- c:\windows\system32\nmwcdcls.dll 2010-12-05 20:48 . 2010-11-29 22:42 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-12-05 20:48 . 2010-11-29 22:42 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-12-04 21:48 . 2010-12-04 21:48 ——– d—–w- c:\programdata\Graboid Inc 2010-12-04 21:46 . 2010-12-05 22:48 ——– dc—-w- c:\program files\completedir . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-01-02 18:28 . 2010-05-07 20:59 472808 -c–a-w- c:\windows\system32\deployJava1.dll 2010-11-29 22:38 . 2010-11-29 22:38 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx 2010-11-29 22:38 . 2010-11-29 22:38 69632 —-a-w- c:\windows\system32\QuickTime.qts 2010-11-23 06:51 . 2010-11-23 06:51 0 —-a-w- c:\windows\system32\REN6C83.tmp 2010-11-23 06:51 . 2010-11-23 06:51 0 —-a-w- c:\windows\system32\REN6C72.tmp 2010-11-23 06:51 . 2010-11-23 06:51 0 —-a-w- c:\windows\system32\REN6C71.tmp 2010-10-28 07:00 . 2010-10-26 17:12 26504 —-a-w- c:\windows\system32\drivers\Diskdump.sys 2010-10-27 07:02 . 2010-10-26 17:13 641536 —-a-w- c:\windows\system32\CPFilters.dll 2010-10-27 07:02 . 2010-10-26 17:13 417792 —-a-w- c:\windows\system32\msdri.dll 2010-10-27 07:02 . 2010-10-26 17:13 204288 —-a-w- c:\windows\system32\MSNP.ax 2010-10-27 07:02 . 2010-10-26 17:13 199680 —-a-w- c:\windows\system32\mpg2splt.ax 2010-10-25 09:09 . 2010-10-25 09:09 974848 -c–a-w- c:\windows\system32\cis-2.4.dll 2010-10-25 09:09 . 2010-10-25 09:09 81920 -c–a-w- c:\windows\system32\issacapi_bs-2.3.dll 2010-10-25 09:09 . 2010-10-25 09:09 65536 -c–a-w- c:\windows\system32\issacapi_pe-2.3.dll 2010-10-25 09:09 . 2010-10-25 09:09 57344 -c–a-w- c:\windows\system32\MTXSYNCICON.dll 2010-10-25 09:09 . 2010-10-25 09:09 57344 -c–a-w- c:\windows\system32\MK_Lyric.dll 2010-10-25 09:09 . 2010-10-25 09:09 57344 -c–a-w- c:\windows\system32\issacapi_se-2.3.dll 2010-10-25 09:09 . 2010-10-25 09:09 569344 -c–a-w- c:\windows\system32\muzdecode.ax 2010-10-25 09:09 . 2010-10-25 09:09 491520 -c–a-w- c:\windows\system32\muzapp.dll 2010-10-25 09:09 . 2010-10-25 09:09 49152 -c–a-w- c:\windows\system32\MaJGUILib.dll 2010-10-25 09:09 . 2010-10-25 09:09 45056 -c–a-w- c:\windows\system32\MaXMLProto.dll 2010-10-25 09:09 . 2010-10-25 09:09 45056 -c–a-w- c:\windows\system32\MACXMLProto.dll 2010-10-25 09:09 . 2010-10-25 09:09 413696 -c–a-w- c:\programdata\Microsoft\Windows\Templates\msvcp60.dll 2010-10-25 09:09 . 2010-10-25 09:09 40960 -c–a-w- c:\windows\system32\MTTELECHIP.dll 2010-10-25 09:09 . 2010-10-25 09:09 40960 -c–a-w- c:\windows\system32\MAMACExtract.dll 2010-10-25 09:09 . 2010-10-25 09:09 352256 -c–a-w- c:\windows\system32\MSLUR71.dll 2010-10-25 09:09 . 2010-10-25 09:09 258048 -c–a-w- c:\windows\system32\muzoggsp.ax 2010-10-25 09:09 . 2010-10-25 09:09 245760 -c–a-w- c:\windows\system32\MSCLib.dll 2010-10-25 09:09 . 2010-10-25 09:09 24576 -c–a-w- c:\windows\system32\MASetupCleaner.exe 2010-10-25 09:09 . 2010-10-25 09:09 243576 -c–a-w- c:\windows\system32\MASetupCaller.dll 2010-10-25 09:09 . 2010-10-25 09:09 23040 -c–a-w- c:\programdata\Microsoft\Windows\Templates\psapi.dll 2010-10-25 09:09 . 2010-10-25 09:09 200704 -c–a-w- c:\windows\system32\muzwmts.dll 2010-10-25 09:09 . 2010-10-25 09:09 155648 -c–a-w- c:\windows\system32\MSFLib.dll 2010-10-25 09:09 . 2010-10-25 09:09 135168 -c–a-w- c:\windows\system32\muzaf1.dll 2010-10-25 09:09 . 2010-10-25 09:09 131072 -c–a-w- c:\windows\system32\muzmpgsp.ax 2010-10-25 09:09 . 2010-10-25 09:09 122880 -c–a-w- c:\windows\system32\muzeffect.ax 2010-10-25 09:09 . 2010-10-25 09:09 118784 -c–a-w- c:\windows\system32\MaDRM.dll 2010-10-25 09:09 . 2010-10-25 09:09 110592 -c–a-w- c:\windows\system32\muzmp4sp.ax 2010-10-25 09:09 . 2010-10-25 09:09 511328 -c–a-w- c:\windows\system32\Synchronization2.dll 2010-10-25 09:09 . 2010-10-25 09:09 288608 -c–a-w- c:\windows\system32\Microsoft.Synchronization.dll 2010-10-25 09:09 . 2010-10-25 09:09 253280 -c–a-w- c:\windows\system32\MetaStore2.dll 2010-10-25 09:07 . 2010-10-25 09:07 95568 -c–a-w- c:\windows\system32\dgdersvc.exe 2010-10-25 09:07 . 2010-10-25 09:07 763216 -c–a-w- c:\windows\system32\dgderapi.dll 2010-10-25 09:07 . 2010-10-25 09:07 319456 -c–a-w- c:\programdata\Microsoft\Windows\Templates\DIFxAPI.dll 2010-10-25 09:07 . 2010-10-25 09:07 18120 -c–a-w- c:\windows\system32\drivers\dgderdrv.sys 2010-10-25 09:03 . 2010-10-11 00:48 36640 —-a-w- c:\windows\system32\FsUsbExDisk.Sys 2010-10-19 15:41 . 2010-07-04 13:16 222080 -c—-w- c:\windows\system32\MpSigStub.exe 2010-10-14 07:01 . 2010-10-14 05:15 1413632 —-a-w- c:\windows\system32\ole32.dll 2010-10-14 07:01 . 2010-10-14 05:15 109056 —-a-w- c:\windows\system32\t2embed.dll 2010-10-14 07:00 . 2010-10-14 05:15 224256 —-a-w- c:\windows\system32\schannel.dll 2010-10-14 07:00 . 2010-10-14 05:15 530432 —-a-w- c:\windows\system32\comctl32.dll 2010-10-14 07:00 . 2010-10-14 05:15 954752 —-a-w- c:\windows\system32\mfc40.dll 2010-10-14 07:00 . 2010-10-14 05:15 954288 —-a-w- c:\windows\system32\mfc40u.dll 2010-10-14 07:00 . 2010-10-14 05:15 12625408 —-a-w- c:\windows\system32\wmploc.DLL 2010-10-14 07:00 . 2010-10-14 05:15 310784 —-a-w- c:\windows\system32\drivers\srv.sys 2010-10-14 07:00 . 2010-10-14 05:15 308736 —-a-w- c:\windows\system32\drivers\srv2.sys 2010-10-14 07:00 . 2010-10-14 05:15 168448 —-a-w- c:\windows\system32\srvsvc.dll 2010-10-14 07:00 . 2010-10-14 05:15 113664 —-a-w- c:\windows\system32\drivers\srvnet.sys 2010-10-14 07:00 . 2010-10-14 05:15 738816 —-a-w- c:\windows\system32\wmpmde.dll 2010-10-14 07:00 . 2010-10-14 05:15 363520 —-a-w- c:\windows\system32\StructuredQuery.dll 2010-10-07 17:23 . 2010-10-07 17:23 91424 —-a-w- c:\windows\system32\dnssd.dll 2010-10-07 17:23 . 2010-10-07 17:23 107808 —-a-w- c:\windows\system32\dns-sd.exe 2010-02-10 15:18 . 2010-04-10 21:24 2131336 -c–a-w- c:\program files\Common Files\AskToolbarInstaller.exe 2009-05-01 21:02 . 2009-05-01 21:02 1044480 -c–a-w- c:\program files\mozilla firefox\plugins\libdivx.dll 2009-05-01 21:02 . 2009-05-01 21:02 200704 -c–a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll 2006-05-03 09:06 163328 -csha-r- c:\windows\System32\flvDX.dll 2007-02-21 10:47 31232 -csha-r- c:\windows\System32\msfDX.dll 2008-03-16 12:30 216064 -csha-r- c:\windows\System32\nbDX.dll . ——- Sigcheck ——- [-] 2010-08-11 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll [7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [BU] [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] c:\program files\Ask.com\GenericAskToolbar.dll [BU] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [BU] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [BU] [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1] [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 94208 -c–a-w- c:\users\owner\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 94208 -c–a-w- c:\users\owner\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 94208 -c–a-w- c:\users\owner\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "cdloader"="c:\users\owner\AppData\Roaming\mjusbsp\cdloader2.exe" [2010-12-03 50592] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504] "Google Update"="c:\users\owner\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-09-11 136176] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-11-06 328056] "S60 PC Suite Tray"="c:\program files\Samsung\Samsung PC Studio 7\PCSuite.exe" [2008-12-06 699392] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="RtHDVCpl.exe" [2006-11-09 3784704] "avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288] "SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2009-10-26 1458176] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-12-13 421160] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Samsung.PCSync"="c:\program files\Samsung\Samsung PC Studio 7\PcSync2.exe" [2009-06-04 1294336] c:\users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\owner\AppData\Roaming\Dropbox\bin\Dropbox.exe [2010-12-16 23343848] MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2010-11-5 576000] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2010-09-21 04:07 932288 -c–a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2010-09-23 08:47 35760 -c–a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cdloader] 2010-12-03 12:39 50592 -c–a-w- c:\users\owner\AppData\Roaming\mjusbsp\cdloader2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate] c:\program files\DivX\DivX Update\DivXUpdate.exe [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] 2004-04-17 16:41 196608 -c–a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] 2005-08-11 19:30 81920 -c–a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2010-12-13 22:16 421160 -c–a-w- c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\javahr] c:\path\javahr.exe [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\javahr2] c:\path\javahr2.exe [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] c:\windows\system32\NvCpl.dll [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] c:\windows\system32\NvMcTray.dll [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2010-11-29 22:38 421888 -c–a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl] 2006-11-09 02:57 3784704 —-a-w- c:\windows\RtHDVCpl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent] 2010-11-06 17:54 328056 -c–a-w- c:\program files\uTorrent\uTorrent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent Turbo Booster] c:\program files\uTorrent Turbo Booster\uTorrent Turbo Booster.exe [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX3000] c:\windows\vVX3000.exe [BU] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [2010-04-20 18432] R3 tenCapture;tenCapture;c:\windows\system32\DRIVERS\tenCapture.sys [2007-04-21 9344] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-08-11 1343400] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [x] R3 WSVD;WSVD;c:\windows\system32\drivers\WSVD.sys [2006-09-19 80744] S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2010-06-05 64288] S1 aswSP;aswSP; [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-08-04 176128] S2 aswFsBlk;aswFsBlk; [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768] S2 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [2010-10-25 95568] S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-05-28 233472] S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-04-16 173352] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-08-04 6096384] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-08-04 214016] S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2010-10-25 18120] S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2010-10-25 36640] S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-06-29 1352832] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392] . Contents of the 'Scheduled Tasks' folder 2011-01-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1316480461-3079241605-3145038289-1000Core.job - c:\users\owner\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-11 02:25] 2011-01-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1316480461-3079241605-3145038289-1000UA.job - c:\users\owner\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-11 02:25] . . ——- Supplementary Scan ——- . uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 uStart Page = about:blank uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to AMV Converter… - c:\program files\MP3 Player Utilities 4.03\AMVConverter\grab.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 4.03\MediaManager\grab.html DPF: {BA2D9665-D672-446F-98F4-E3E41FA12A01} - hxxp://www.mypccenter.com/CAB/PCA.cab FF - ProfilePath - c:\users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\xtzv1gzr.default\ FF - prefs.js: browser.startup.homepage - chrome://speeddial/content/speeddial.xul FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} FF - Ext: Speed Dial: {64161300-e22b-11db-8314-0800200c9a66} - %profile%\extensions\{64161300-e22b-11db-8314-0800200c9a66} FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} FF - Ext: Download Statusbar: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} - %profile%\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} FF - Ext: Screengrab: {02450954-cdd9-410f-b1da-db804e18c671} - %profile%\extensions\{02450954-cdd9-410f-b1da-db804e18c671} FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} FF - Ext: Conduit Engine : [removed] - %profile%\extensions\[removed] . . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000001 "MSCurrentCountry"=dword:000000b5 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2011-01-02 19:17:50 ComboFix-quarantined-files.txt 2011-01-03 00:17 ComboFix2.txt 2011-01-02 19:08 Pre-Run: 36,151,345,152 bytes free Post-Run: 35,695,931,392 bytes free - - End Of File - - E7CB6D9C43BA9906ABC4B9A431062348