http://www.searchqu.com/406

Hi,
searchqu installed on my pc, when i loaded firefox my homepage (google) was gone and replaced with http://www.searchqu.com/406 , there was also an addon search tab, i removed the tab from the tools>add ons section. I then went to tools>options>homepage and changed it back to google. However when i create a new tab it reverts to http://www.searchqu.com/406, prior to this the tab section was empty. I also went to MSCONFIG and i deselected a startup program called DATAMN~1, restarted my pc, but the still goes to site location everytime i create new tabs (ya i did restart pc), oh also. System Restore wont work for me, when i click on the icon, it does nothing, when i click on it a second time it creates a window labeled System Restore, but it is empty of content, so i cannot use system restore points, i also tried a CKscanner.exe, it scans the pc, but for some reason i get a bluescreen of death.

DDS (Ver_2011-06-12.02) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_25
Run by [removed] at 0:23:26 on 2011-06-13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3069.2250 [GMT 1:00]
.
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *Enabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\dcmsvc\dcmsvc.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\INTELLINET NETWORK SOLUTIONS\11n USB Wireless LAN Utility\RtWLan.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\FsUsbExService.Exe
C:\Program Files\Common Files\GFI\ReportCenter\Framework v3.5\gfireporterservice.exe
C:\Program Files\IObit\IObit Security 360\IS360srv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
C:\Program Files\Polar\Daemon\polard.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\VMware\VMware Player\vmware-authd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\Restore\rstrui.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: DivX Plus Web Player HTML5 : {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - c:\progra~1\wi371a~1\datamngr\toolbar\searchqudtx.dll
BHO: UrlHelper Class: {a40dc6c5-79d0-4ca8-a185-8ff989af1115} - c:\progra~1\wi371a~1\datamngr\IEBHO.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - c:\progra~1\wi371a~1\datamngr\toolbar\searchqudtx.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\mark\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [CTHelper] CTHELPER.EXE
mRun: [CTxfiHlp] CTXFIHLP.EXE
mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [dcmsvc] c:\program files\dcmsvc\dcmsvc.exe
mRun: [MobileConnect] %programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe /silent
mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSCONFIG.EXE /auto
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\intell~1.lnk - c:\program files\intellinet network solutions\11n usb wireless lan utility\RtWLan.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
LSP: c:\program files\vmware\vmware player\vsocklib.dll
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\update
Trusted Zone: windowsupdate.com\download
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1288173104563
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1288173567954
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{6F100EAB-BD94-45F0-9502-ACFCA5C140D2} : NameServer = 156.154.70.22,156.154.71.22
TCP: Interfaces\{8C9111DA-1F4F-4634-8CE5-87F26E019EB5} : NameServer = 156.154.70.22,156.154.71.22
TCP: Interfaces\{AD1A05B6-17D8-4E70-B7BD-A3F286F488FF} : DhcpNameServer = 192.168.1.1 192.168.1.1
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\mark\application data\mozilla\firefox\profiles\9dd0e757.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2645238&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Search Results
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ie
FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=102&systemid=406&q=
FF - prefs.js: network.proxy.type - 0
FF - component: c:\program files\windows ilivid toolbar\datamngr\firefoxextension\components\DataMngrHlpFF3.dll
FF - plugin: c:\documents and settings\mark\local settings\application data\google\update\1.3.21.57\npGoogleUpdate3.dll
FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: DivX Plus Web Player HTML5 : {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\divx\divx plus web player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\divx\divx plus web player\firefox\wpa
FF - Ext: Java Quick Starter: [removed] - c:\program files\java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-3-13 441176]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-10-27 307928]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [2011-1-6 242472]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2011-1-6 29400]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-10-27 19544]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-10-27 42184]
R2 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2011-1-18 1779792]
R2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-12-3 217088]
R2 GFI_ReportCenter35;GFI ReportCenter 3.5;c:\program files\common files\gfi\reportcenter\framework v3.5\gfireporterservice.exe [2009-6-16 111912]
R2 IS360service;IS360service;c:\program files\iobit\iobit security 360\is360srv.exe [2011-5-11 312152]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 Polar Daemon;Polar Daemon;c:\program files\polar\daemon\polard.exe [2010-5-31 344064]
R2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [2011-3-25 70768]
R2 VMCService;Vodafone Mobile Connect Service;c:\program files\vodafone\vodafone mobile connect\bin\VMCService.exe [2010-3-15 9216]
R2 VMUSBArbService;VMware USB Arbitration Service;c:\program files\common files\vmware\usb\vmware-usbarbitrator.exe [2011-3-25 539248]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2010-12-3 36640]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-6-12 22712]
R3 RTL8192su;INTELLINET NETWORK SOLUTIONS 802.11n USB Network Adapter;c:\windows\system32\drivers\RTL8192su.sys [2010-11-5 591488]
R4 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-6-12 366640]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\drivers\ssadadb.sys [2011-3-9 30312]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2011-3-8 20032]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [2011-1-15 113280]
S3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\drivers\ewusbfake.sys [2011-1-15 100736]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-6-12 39984]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-10-20 50704]
S3 PSSDK42;PSSDK42;c:\windows\system32\drivers\pssdk42.sys [2011-2-11 38976]
S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys –> c:\windows\system32\drivers\rt2870.sys [?]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [2011-3-9 121192]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [2011-3-9 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [2011-3-9 136680]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\drivers\ssadserd.sys [2011-3-9 114152]
S3 SwitchBoard;SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2008-7-11 47128]
S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [2008-7-10 242712]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10.sqlexpress\mssql\binn\SQLAGENT.EXE [2008-7-11 369688]
.
=============== Created Last 30 ================
.
2011-06-12 21:11:18 ——– d—–w- c:\program files\ESET
2011-06-12 20:24:52 ——– d-s—w- C:\ComboFix
2011-06-12 19:59:41 ——– d-sha-r- C:\cmdcons
2011-06-12 19:51:30 98816 —-a-w- c:\windows\sed.exe
2011-06-12 19:51:30 518144 —-a-w- c:\windows\SWREG.exe
2011-06-12 19:51:30 256512 —-a-w- c:\windows\PEV.exe
2011-06-12 19:51:30 208896 —-a-w- c:\windows\MBR.exe
2011-06-12 17:16:57 ——– d—–w- c:\documents and settings\mark\application data\Malwarebytes
2011-06-12 17:16:52 39984 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-12 17:16:52 ——– d—–w- c:\documents and settings\all users\application data\Malwarebytes
2011-06-12 17:16:48 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-06-12 17:16:48 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-06-05 18:17:20 ——– d—–w- c:\program files\PowerISO
2011-06-05 18:15:46 ——– d—–w- c:\documents and settings\mark\application data\searchquband
2011-06-05 18:15:46 ——– d—–w- c:\documents and settings\mark\AppData
2011-06-05 14:19:22 ——– d—–w- c:\documents and settings\mark\local settings\application data\Ilivid Player
2011-06-05 14:16:35 ——– d—–w- c:\documents and settings\mark\application data\searchqutoolbar
2011-06-05 14:13:40 ——– d—–w- c:\documents and settings\all users\application data\boost_interprocess
2011-06-05 14:13:20 ——– d—–w- c:\program files\Windows iLivid Toolbar
2011-06-02 00:29:51 ——– d—–w- c:\documents and settings\mark\application data\Blender Foundation
2011-06-02 00:29:44 ——– d—–w- c:\program files\Blender Foundation
2011-05-28 00:15:30 819 —-a-w- c:\windows\system32\regpackages.bat
2011-05-28 00:15:30 2682880 —-a-w- c:\windows\system32\vcredist_x86.exe
2011-05-28 00:14:58 ——– d—–w- C:\trueSpace761Std
2011-05-27 12:09:42 ——– d—–w- c:\documents and settings\mark\local settings\application data\PackageAware
2011-05-26 15:31:37 ——– d—–w- c:\documents and settings\mark\application data\MyHeritage
2011-05-26 15:31:37 ——– d—–w- c:\documents and settings\all users\application data\MyHeritage
2011-05-26 15:31:25 454656 —-a-w- c:\windows\system32\PaintX.dll
2011-05-26 15:31:25 372736 —-a-w- c:\windows\system32\ijl15.dll
2011-05-26 15:31:24 608448 —-a-w- c:\windows\system32\comctl32.ocx
2011-05-26 15:31:24 137000 —-a-w- c:\windows\system32\msmapi32.ocx
2011-05-26 15:31:24 ——– d—–w- c:\documents and settings\mark\application data\The Complete Genealogy Reporter - FTB
2011-05-26 15:30:53 ——– d—–w- c:\program files\MyHeritage
2011-05-25 22:25:39 ——– d—–w- c:\program files\GeoControl2
2011-05-24 15:14:24 387600 —-a-w- c:\windows\system32\FTBSaver.scr
2011-05-17 21:36:45 ——– d—–w- c:\program files\THQ
2011-05-17 15:57:08 ——– d—–w- c:\documents and settings\mark\WINDOWS
2011-05-16 13:44:17 ——– d—–w- c:\documents and settings\mark\.android
.
==================== Find3M ====================
.
2011-05-10 15:52:24 284744 —-a-w- c:\windows\system32\guard32.dll
2011-05-10 15:52:23 29400 —-a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-05-10 15:52:23 17416 —-a-w- c:\windows\system32\drivers\cmderd.sys
2011-05-10 15:52:22 242472 —-a-w- c:\windows\system32\drivers\cmdGuard.sys
2011-05-10 12:10:59 40112 —-a-w- c:\windows\avastSS.scr
2011-05-10 12:03:54 441176 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-04-29 17:29:51 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-04-29 17:29:51 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-03-25 22:27:18 854256 —-a-w- c:\windows\system32\drivers\vmx86.sys
2011-03-25 22:27:16 70768 —-a-w- c:\windows\system32\drivers\vmci.sys
2011-03-25 22:27:02 760432 —-a-w- c:\windows\system32\vnetlib.dll
2011-03-25 22:26:46 334448 —-a-w- c:\windows\system32\vmnetdhcp.exe
2011-03-25 22:26:28 404080 —-a-w- c:\windows\system32\vmnat.exe
2011-03-25 22:25:46 24688 —-a-w- c:\windows\system32\drivers\VMkbd.sys
2011-03-25 22:25:02 51312 —-a-w- c:\windows\system32\vmnetbridge.dll
2011-03-25 22:25:00 32752 —-a-w- c:\windows\system32\drivers\vmnetbridge.sys
2011-03-25 22:24:56 26352 —-a-w- c:\windows\system32\drivers\vmnetuserif.sys
2011-03-25 21:27:32 32368 —-a-w- c:\windows\system32\drivers\hcmon.sys
2011-03-25 21:00:54 252528 —-a-w- c:\windows\system32\vmnc.dll
2011-03-25 19:05:00 59952 —-a-w- c:\windows\system32\vnetinst.dll
2011-03-25 19:05:00 18736 —-a-w- c:\windows\system32\drivers\vmnet.sys
2011-03-25 19:05:00 16560 —-a-w- c:\windows\system32\drivers\vmnetadapter.sys
.
============= FINISH: 0:26:59.62 ===============

OTL Extras logfile created on: 15/06/2011 01:55:11 - Run 1
OTL by OldTimer - Version 3.2.24.0 Folder = C:\Documents and Settings\Mark\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001809 | Country: Ireland | Language: ENI | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.12 Gb Available Physical Memory | 70.81% Memory free
4.84 Gb Paging File | 4.02 Gb Available in Paging File | 83.12% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298.08 Gb Total Space | 169.40 Gb Free Space | 56.83% Space Free | Partition Type: NTFS
Drive D: | 186.31 Gb Total Space | 89.85 Gb Free Space | 48.23% Space Free | Partition Type: NTFS
Drive L: | 931.51 Gb Total Space | 805.15 Gb Free Space | 86.44% Space Free | Partition Type: NTFS

Computer Name: MARK-8AA2A066AD | User Name: Mark | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [Bridge] – C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
"1542:TCP" = 1542:TCP:*:Enabled:Realtek WPS TCP Prot
"1542:UDP" = 1542:UDP:*:Enabled:Realtek WPS UDP Prot
"53:UDP" = 53:UDP:*:Enabled:Realtek AP UDP Prot

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Documents and Settings\Mark\My Documents\Downloads\Conquer_P2P_20100921.exe" = C:\Documents and Settings\Mark\My Documents\Downloads\Conquer_P2P_20100921.exe:*:Enabled:Conquer_P2P_20100921.exe – (TQ Digital Entertainment)
"C:\Program Files\VMware\VMware Player\vmware-authd.exe" = C:\Program Files\VMware\VMware Player\vmware-authd.exe:*:Enabled:VMware Authd – (VMware, Inc.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EDIMAX\Common\ApUI.exe" = C:\Program Files\EDIMAX\Common\ApUI.exe:*:Enabled:Edimax Wireless Utility
"C:\Documents and Settings\Mark\My Documents\Downloads\Conquer_P2P_20100921.exe" = C:\Documents and Settings\Mark\My Documents\Downloads\Conquer_P2P_20100921.exe:*:Enabled:Conquer_P2P_20100921.exe – (TQ Digital Entertainment)
"C:\Program Files\uTorrent\utorrent.exe" = C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\Program Files\INTELLINET NETWORK SOLUTIONS\11n USB Wireless LAN Utility\RtWLan.exe" = C:\Program Files\INTELLINET NETWORK SOLUTIONS\11n USB Wireless LAN Utility\RtWLan.exe:*:Enabled:RtWlan – (Realtek Semiconductor Corp.)
"C:\Program Files\CCP\EVE\bin\ExeFile.exe" = C:\Program Files\CCP\EVE\bin\ExeFile.exe:*:Enabled:CCP ExeFile – (CCP hf.)
"C:\Games\World_of_Tanks_closed_Beta\WorldOfTanks.exe" = C:\Games\World_of_Tanks_closed_Beta\WorldOfTanks.exe:*:Disabled:World of Tanks
"C:\WINDOWS\system32\muzapp.exe" = C:\WINDOWS\system32\muzapp.exe:*:Enabled:MUZ AOD APP player – (Musiccity Co.Ltd.)
"C:\Documents and Settings\Mark\Desktop\EVE\bin\ExeFile.exe" = C:\Documents and Settings\Mark\Desktop\EVE\bin\ExeFile.exe:*:Enabled:CCP ExeFile
"C:\Games\World_of_Tanks_closed_Beta\WOTLauncher.exe" = C:\Games\World_of_Tanks_closed_Beta\WOTLauncher.exe:*:Enabled:World of Tanks Launcher
"C:\Program Files\INTELLINET NETWORK SOLUTIONS\11n USB Wireless LAN Utility\RTLDHCP.exe" = C:\Program Files\INTELLINET NETWORK SOLUTIONS\11n USB Wireless LAN Utility\RTLDHCP.exe:*:Enabled:RTLDHCP – ()
"C:\Program Files\PRTG Network Monitor\PRTG Probe.exe" = C:\Program Files\PRTG Network Monitor\PRTG Probe.exe:*:Enabled:PRTG_Network_Monitor_Probe
"C:\Program Files\PRTG Network Monitor\PRTG Server Administrator.exe" = C:\Program Files\PRTG Network Monitor\PRTG Server Administrator.exe:*:Enabled:PRTG_Network_Monitor_Admin_Tool
"C:\Program Files\PRTG Network Monitor\PRTG Server.exe" = C:\Program Files\PRTG Network Monitor\PRTG Server.exe:*:Enabled:PRTG_Network_Monitor_Server
"C:\Program Files\Cain\Cain.exe" = C:\Program Files\Cain\Cain.exe:*:Disabled:Cain - Password Recovery Utility
"C:\Program Files\GFI\LANguard 9\languard.exe" = C:\Program Files\GFI\LANguard 9\languard.exe:*:Enabled:languard – ()
"C:\Documents and Settings\Mark\Desktop\SuperScan4.exe" = C:\Documents and Settings\Mark\Desktop\SuperScan4.exe:*:Enabled:SuperScan 4 Beta 1
"C:\Documents and Settings\Mark\Desktop\CleanCoGen\xrVfskhroRjw.exe" = C:\Documents and Settings\Mark\Desktop\CleanCoGen\xrVfskhroRjw.exe:*:Enabled:
"C:\Program Files\Conquer Online 2.0\IsecPlus\91GameCheck.exe" = C:\Program Files\Conquer Online 2.0\IsecPlus\91GameCheck.exe:*:Disabled:91GameCheck – ()
"C:\Program Files\VMware\VMware Player\vmware-authd.exe" = C:\Program Files\VMware\VMware Player\vmware-authd.exe:*:Enabled:VMware Authd – (VMware, Inc.)
"C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\dtUser.exe" = C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\dtUser.exe:*:Enabled:DTX broker – (Visicom Media Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{044F9133-B8D7-4d11-BF39-803FA20F5C8B}" = Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Win32
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0C19D563-5F25-4621-BF10-01F741BD283F}" = Microsoft SQL Server Compact 3.5 SP1 Design Tools English
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{196E77C5-F524-4B50-BD1A-2C21EEE9B8F7}" = Microsoft SQL Server 2008 Common Files
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.6.5
"{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1" = World of Tanks v.0.6.4
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216025FF}" = Java™ 6 Update 25
"{342D4AD7-EC4C-4EC8-AEA6-E70F5905A490}" = SQL Server System CLR Types
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{3F67FD4A-380F-4081-A506-1D2C0091A93E}" = GFI LANguard 9.0 ReportPack
"{4815BD99-96A4-49FE-A885-DCF06E9E4E78}" = Microsoft SQL Server 2008 Database Engine Shared
"{49D2008F-D878-4FC8-B1CE-36D17B6D0A8B}_is1" = Conquer Test
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A6F34E2-09E5-4616-B227-4A26A488A6F9}" = Microsoft SQL Server 2008 Common Files
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{58721EC3-8D4E-4B79-BC51-1054E2DDCD10}" = Microsoft SQL Server 2008 Database Engine Services
"{5BE1E709-30E4-3D6D-A708-96CE8D5E5E8D}" = Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for .NET Framework - enu
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{66F78C51-D108-4F0C-A93C-1CBE74CE338F}" = Company of Heroes
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6E9EF98E-259E-416D-B5F8-0ABDB99942CE}" = Adobe Flash Player 10 ActiveX
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{722C2EC9-745F-44EA-A119-D548DB55A3B0}" = GFI ReportCenter Framework
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78B51FD5-DA3F-4B48-8F3F-4E4068F25D89}_is1" = Conquer Online 2.0
"{7FE01684-4C95-FB0E-061D-EDB29166B98B}" = Warner Bros. Digital Copy Manager
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C049499-055C-4a0c-A916-1D8CA1FF45EB}" = INTELLINET NETWORK SOLUTIONS 802.11n LAN Driver and Utility
"{9D6D76A6-4328-49E8-97A7-531A74841DA5}" = Microsoft SQL Server 2008 Setup Support Files (English)
"{9F3E3C1B-6964-48D6-84C8-925C9A5A8229}" = Polar Daemon
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A4418082-E601-3954-805B-D56A2B50EC8B}" = Microsoft Visual C# 2008 Express Edition with SP1 - ENU
"{A53A11EA-0095-493F-86FA-A15E8A86A405}" = VMware Player
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.0
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 260.99
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 260.99
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 135.36
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.10.0514
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B4E343DD-BAAB-4D59-AD9C-DEA0AFE09DF1}" = Mumble 1.2.3
"{B5153233-9AEE-4CD4-9D2C-4FAAC870DBE2}" = Microsoft SQL Server 2008 Database Engine Services
"{B581D589-488E-4465-8A14-9848A0C9628F}" = EveHQ
"{B7F54262-AB66-44B3-88BF-9FC69941B643}" = Broadcom Gigabit Integrated Controller
"{B857D868-F8B0-43EE-BC2B-D9E5ED21F237}" = Microsoft SQL Server VSS Writer
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C688457E-03FD-4941-923B-A27F4D42A7DD}" = Microsoft SQL Server 2008 Browser
"{C965F01C-76EA-4BD7-973E-46236AE312D7}" = Sql Server Customer Experience Improvement Program
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CBE19707-CF6D-4819-9574-3DFD568960FA}" = GFI LANguard 9.6
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFC9F871-7C40-40B6-BE4A-B98A5B309716}" = Adobe Flash Professional CS5
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D102611A-6466-4101-A51D-51069303AC65}" = tools-linux
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{D9D937B0-E842-4130-9588-B948E876904A}" = Microsoft SQL Server 2008 Native Client
"{DD217BA1-1DEA-4E9B-8C09-64E24E9A6E2C}" = GeoControl 2.10
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E21DC406-9F79-4094-AFA5-E66154F7D28C}" = Vodafone Mobile Connect Lite
"{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}" = Microsoft SQL Server Compact 3.5 SP1 English
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F1DC7648-8623-442F-92B7-E118DF61872E}" = Microsoft SQL Server 2008 RsFx Driver
"{F3494AB6-6900-41C6-AF57-823626827ED8}" = Microsoft SQL Server 2008 Database Engine Shared
"{F5E87B12-3C27-452F-8E78-21D42164FD83}" = Microsoft SQL Server 2008 Management Objects
"{FD8E178D-8B4E-42DA-B434-EFF270329B1C}" = COMODO Internet Security
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{FFD9383C-01D5-4897-A954-43AF599AED30}" = tools-windows
"12133444-BF36-4d4e-B7FB-A3424C645DE4" = GemMaster Mystic
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AudibleManager" = AudibleManager
"avast" = avast! Free Antivirus
"B3EE3001-DC24-4cd1-8743-5692C716659F" = Otto
"Blender" = Blender
"Caligari trueSpace7.61 Beta 8 Standalone_is1" = Uninstall trueSpace7.61 Beta 8 Standalone
"Celestia_is1" = Celestia 1.6.0
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.warnerbros.DigitalCopyManager.449F66ACC381FDC604DC2AA255FEECEEBBBEE1E5.
1" = Warner Bros. Digital Copy Manager
"dcmsvc_is1" = dcmsvc 1.0
"DivX Setup.divx.com" = DivX Setup
"ESET Online Scanner" = ESET Online Scanner v3
"ESPNMotion" = ESPNMotion
"EVE" = EVE Online (remove only)
"EVEMon" = EVEMon
"Family Tree Builder" = MyHeritage Family Tree Builder
"H-BOT NPC Hunter DEMO3.0" = H-BOT NPC Hunter DEMO
"H-BOT NPC Hunter DEMO3.1" = H-BOT NPC Hunter DEMO
"H-BOT NPC Hunter3.1" = H-BOT NPC Hunter
"ie8" = Windows Internet Explorer 8
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{CBE19707-CF6D-4819-9574-3DFD568960FA}" = GFI LANguard 9.6
"IObit Security 360_is1" = IObit Security 360
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.0.1200
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft SQL Server 10" = Microsoft SQL Server 2008
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008
"Microsoft Visual C# 2008 Express Edition with SP1 - ENU" = Microsoft Visual C# 2008 Express Edition with SP1 - ENU
"Mozilla Firefox (3.6.17)" = Mozilla Firefox (3.6.17)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MyFreeCodec" = MyFreeCodec
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"PowerISO" = PowerISO
"Searchqu 406 MediaBar" = Windows iLivid Toolbar
"Sudden Strike 2_is1" = Sudden Strike 2
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.1.7
"VMware_Player" = VMware Player
"VMware_Workstation" = VMware Workstation
"Vue 8" = Vue 8
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinPcapInst" = WinPcap 4.1.1
"WinRAR archiver" = WinRAR archiver
"winscp3_is1" = WinSCP 4.2.9
"Wireshark" = Wireshark 0.99.4
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"MyFreeCodec" = MyFreeCodec
"TeamSpeak 3 Client" = TeamSpeak 3 Client

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 14/06/2011 17:05:03 | Computer Name = MARK-8AA2A066AD | Source = Windows Search Service | ID = 3013
Description = The entry in
the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 14/06/2011 17:05:05 | Computer Name = MARK-8AA2A066AD | Source = Windows Search Service | ID = 3013
Description = The entry in
the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 14/06/2011 17:05:05 | Computer Name = MARK-8AA2A066AD | Source = Windows Search Service | ID = 3013
Description = The entry in
the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 14/06/2011 17:05:05 | Computer Name = MARK-8AA2A066AD | Source = Windows Search Service | ID = 3013
Description = The entry
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 14/06/2011 17:05:05 | Computer Name = MARK-8AA2A066AD | Source = Windows Search Service | ID = 3013
Description = The entry
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 14/06/2011 17:06:16 | Computer Name = MARK-8AA2A066AD | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Tried to start a service that wasn't the latest version of CLR Optimization service.
Will shutdown

Error - 14/06/2011 17:20:08 | Computer Name = MARK-8AA2A066AD | Source = VMCService | ID = 0
Description = conflictManagerTypeValue

Error - 14/06/2011 17:45:25 | Computer Name = MARK-8AA2A066AD | Source = VMCService | ID = 0
Description = conflictManagerTypeValue

Error - 14/06/2011 18:37:29 | Computer Name = MARK-8AA2A066AD | Source = VMCService | ID = 0
Description = conflictManagerTypeValue

Error - 14/06/2011 20:48:18 | Computer Name = MARK-8AA2A066AD | Source = Windows Search Service | ID = 3013
Description = The entry MACHINES\WINDOWS 7\WINDOWS 7.VMSD.LCK> in the hash map cannot be updated. Context:
Application, SystemIndex Catalog Details: A device attached to the system is not
functioning. (0x8007001f)

[ System Events ]
Error - 13/06/2011 07:17:05 | Computer Name = MARK-8AA2A066AD | Source = NetBT | ID = 4307
Description = Initialization failed because the transport refused to open initial
Addresses.

Error - 13/06/2011 07:35:52 | Computer Name = MARK-8AA2A066AD | Source = ipnathlp | ID = 30013
Description = The DHCP allocator has disabled itself on IP address 192.168.100.1,
since
the IP address is outside the 192.168.0.0/255.255.255.0 scope from which addresses
are being allocated to DHCP clients. To enable the DHCP allocator on this IP address,
please
change the scope to include the IP address, or change the IP address to fall within
the scope.

Error - 13/06/2011 07:36:03 | Computer Name = MARK-8AA2A066AD | Source = ipnathlp | ID = 32003
Description = The Network Address Translator (NAT) was unable to request an operation
of
the kernel-mode translation module. This may indicate misconfiguration, insufficient
resources, or an internal error. The data is the error code.

Error - 13/06/2011 13:58:46 | Computer Name = MARK-8AA2A066AD | Source = NetBT | ID = 4307
Description = Initialization failed because the transport refused to open initial
Addresses.

Error - 13/06/2011 17:51:49 | Computer Name = MARK-8AA2A066AD | Source = NetBT | ID = 4307
Description = Initialization failed because the transport refused to open initial
Addresses.

Error - 14/06/2011 14:09:28 | Computer Name = MARK-8AA2A066AD | Source = Service Control Manager | ID = 7034
Description = The Polar Daemon service terminated unexpectedly. It has done this
1 time(s).

Error - 14/06/2011 15:01:50 | Computer Name = MARK-8AA2A066AD | Source = Service Control Manager | ID = 7034
Description = The VMware Authorization Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 14/06/2011 15:01:58 | Computer Name = MARK-8AA2A066AD | Source = Service Control Manager | ID = 7034
Description = The SQL Server VSS Writer service terminated unexpectedly. It has
done this 1 time(s).

Error - 14/06/2011 15:02:18 | Computer Name = MARK-8AA2A066AD | Source = Service Control Manager | ID = 7031
Description = The VMware USB Arbitration Service service terminated unexpectedly.
It has done this 1 time(s). The following corrective action will be taken in
10000 milliseconds: Restart the service.

Error - 14/06/2011 15:02:23 | Computer Name = MARK-8AA2A066AD | Source = Service Control Manager | ID = 7031
Description = The Windows Search service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 30000 milliseconds:
Restart the service.


< End of report >

OTL logfile created on: 15/06/2011 01:55:11 - Run 1
OTL by OldTimer - Version 3.2.24.0 Folder = C:\Documents and Settings\Mark\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001809 | Country: Ireland | Language: ENI | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.12 Gb Available Physical Memory | 70.81% Memory free
4.84 Gb Paging File | 4.02 Gb Available in Paging File | 83.12% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298.08 Gb Total Space | 169.40 Gb Free Space | 56.83% Space Free | Partition Type: NTFS
Drive D: | 186.31 Gb Total Space | 89.85 Gb Free Space | 48.23% Space Free | Partition Type: NTFS
Drive L: | 931.51 Gb Total Space | 805.15 Gb Free Space | 86.44% Space Free | Partition Type: NTFS

Computer Name: MARK-8AA2A066AD | User Name: Mark | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Mark\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\WINDOWS\system32\vmnetdhcp.exe (VMware, Inc.)
PRC - C:\WINDOWS\system32\vmnat.exe (VMware, Inc.)
PRC - C:\Program Files\VMware\VMware Player\vmware-authd.exe (VMware, Inc.)
PRC - C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe (VMware, Inc.)
PRC - C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
PRC - C:\Program Files\IObit\IObit Security 360\is360srv.exe (IObit)
PRC - C:\Program Files\Polar\Daemon\polard.exe ()
PRC - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
PRC - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone)
PRC - C:\Program Files\INTELLINET NETWORK SOLUTIONS\11n USB Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)
PRC - C:\Program Files\Common Files\GFI\ReportCenter\Framework v3.5\gfireporterservice.exe (GFI Software Ltd.)
PRC - C:\Program Files\dcmsvc\dcmsvc.exe ()
PRC - C:\WINDOWS\system32\Restore\rstrui.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\Ctxfihlp.exe (Creative Technology Ltd)
PRC - C:\WINDOWS\system32\CtHelper.exe (Creative Technology Ltd)
PRC - C:\WINDOWS\system32\CTxfispi.exe (Creative Technology Ltd)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Mark\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\guard32.dll (COMODO)
MOD - C:\Program Files\Alwil Software\Avast5\snxhk.dll (AVAST Software)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\CTAGENT.DLL (Creative Technology Ltd)


========== Win32 Services (SafeList) ==========

SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (cmdAgent) – C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (VMnetDHCP) – C:\WINDOWS\system32\vmnetdhcp.exe (VMware, Inc.)
SRV - (VMware NAT Service) – C:\WINDOWS\system32\vmnat.exe (VMware, Inc.)
SRV - (VMAuthdService) – C:\Program Files\VMware\VMware Player\vmware-authd.exe (VMware, Inc.)
SRV - (VMUSBArbService) – C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe (VMware, Inc.)
SRV - (FsUsbExService) – C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
SRV - (ufad-ws60) – C:\Program Files\VMware\VMware Player\vmware-ufad.exe (VMware, Inc.)
SRV - (IS360service) – C:\Program Files\IObit\IObit Security 360\is360srv.exe (IObit)
SRV - (Polar Daemon) – C:\Program Files\Polar\Daemon\polard.exe ()
SRV - (VMCService) – C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone)
SRV - (SwitchBoard) – C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (GFI_ReportCenter35) – C:\Program Files\Common Files\GFI\ReportCenter\Framework v3.5\gfireporterservice.exe (GFI Software Ltd.)


========== Driver Services (SafeList) ==========

DRV - (MBAMSwissArmy) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (MBAMProtector) – C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (Inspect) – C:\WINDOWS\System32\DRIVERS\inspect.sys (COMODO)
DRV - (cmdHlp) – C:\WINDOWS\system32\drivers\cmdhlp.sys (COMODO)
DRV - (cmdGuard) – C:\WINDOWS\system32\drivers\cmdGuard.sys (COMODO)
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (vmx86) – C:\WINDOWS\system32\drivers\vmx86.sys (VMware, Inc.)
DRV - (vmci) – C:\WINDOWS\system32\drivers\vmci.sys (VMware, Inc.)
DRV - (vmkbd) – C:\WINDOWS\system32\drivers\VMkbd.sys (VMware, Inc.)
DRV - (VMnetBridge) – C:\WINDOWS\system32\drivers\vmnetbridge.sys (VMware, Inc.)
DRV - (VMnetuserif) – C:\WINDOWS\system32\drivers\vmnetuserif.sys (VMware, Inc.)
DRV - (hcmon) – C:\WINDOWS\system32\drivers\hcmon.sys (VMware, Inc.)
DRV - (VMnetAdapter) – C:\WINDOWS\system32\drivers\vmnetadapter.sys (VMware, Inc.)
DRV - (PSSDK42) – C:\WINDOWS\system32\drivers\pssdk42.sys (microOLAP Technologies LTD)
DRV - (dgderdrv) – C:\WINDOWS\system32\drivers\dgderdrv.sys (Devguru Co., Ltd)
DRV - (ssadmdm) – C:\WINDOWS\system32\drivers\ssadmdm.sys (MCCI Corporation)
DRV - (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) – C:\WINDOWS\system32\drivers\ssadbus.sys (MCCI Corporation)
DRV - (ssadserd) SAMSUNG Android USB Diagnostic Serial Port (WDM) – C:\WINDOWS\system32\drivers\ssadserd.sys (MCCI Corporation)
DRV - (ssadmdfl) SAMSUNG Android USB Modem (Filter) – C:\WINDOWS\system32\drivers\ssadmdfl.sys (MCCI Corporation)
DRV - (androidusb) – C:\WINDOWS\system32\drivers\ssadadb.sys (Google Inc)
DRV - (FsUsbExDisk) – C:\WINDOWS\system32\FsUsbExDisk.Sys ()
DRV - (vstor2-ws60) – C:\Program Files\VMware\VMware Player\vstor2-ws60.sys (VMware, Inc.)
DRV - (Tcpip6) – C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (RTL8192su) – C:\WINDOWS\system32\drivers\RTL8192su.sys (Realtek Semiconductor Corporation )
DRV - (ewusbnet) – C:\WINDOWS\system32\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)
DRV - (hwdatacard) – C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (hwusbfake) – C:\WINDOWS\system32\drivers\ewusbfake.sys (Huawei Technologies Co., Ltd.)
DRV - (NPF) – C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (RsFx0102) – C:\WINDOWS\system32\drivers\RsFx0102.sys (Microsoft Corporation)
DRV - (NwlnkIpx) – C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (nm) – C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)
DRV - (SCDEmu) – C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (ctaud2k) Creative Audio Driver (WDM) – C:\WINDOWS\system32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ha20x2k) – C:\WINDOWS\system32\drivers\ha20x2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:\WINDOWS\system32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\WINDOWS\system32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctac32k) – C:\WINDOWS\system32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (nvatabus) – C:\WINDOWS\system32\DRIVERS\nvatabus.sys (NVIDIA Corporation)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (NwlnkNb) – C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.defaultthis.engineName: "ZoneAlarm Security Customized Web Search"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.startup.homepage: "http://www.google.ie"
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {1FD91A9C-410C-4090-BBCC-55D3450EF433}:1.0
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/02/14 00:56:14 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/02/14 00:56:14 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/30 21:55:55 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/30 21:55:55 | 000,000,000 | —D | M]

[2011/06/05 15:15:35 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Mark\Application Data\Mozilla\Extensions
[2011/06/14 19:57:16 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\9dd0e757.default\extensions
[2010/11/04 13:24:04 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\9dd0e757.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/05/13 12:39:38 | 000,000,000 | —D | M] (Greasemonkey) – C:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\9dd0e757.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011/01/17 15:41:38 | 000,000,939 | —- | M] () – C:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\9dd0e757.default\searchplugins\conduit.xml
[2011/06/05 15:13:38 | 000,002,501 | —- | M] () – C:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\9dd0e757.default\searchplugins\SearchResults.xml
[2011/06/14 19:57:16 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/04/29 18:30:05 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
[2011/02/14 00:56:14 | 000,000,000 | —D | M] (DivX Plus Web Player HTML5 ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\HTML5VIDEO
[2011/02/14 00:56:14 | 000,000,000 | —D | M] (DivX HiQ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\WPA
[2011/04/29 18:29:52 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/06/05 15:15:35 | 000,000,000 | —D | M] (DataMngr) – C:\PROGRAM FILES\WINDOWS ILIVID TOOLBAR\DATAMNGR\FIREFOXEXTENSION
[2011/04/29 18:29:51 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2011/06/05 15:13:38 | 000,002,501 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\SearchResults.xml

O1 HOSTS File: ([2004/08/10 12:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (UrlHelper Class) - {A40DC6C5-79D0-4ca8-A185-8FF989AF1115} - C:\Program Files\Windows iLivid Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\System32\CtHelper.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [CTxfiHlp] C:\WINDOWS\System32\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [dcmsvc] C:\Program Files\dcmsvc\dcmsvc.exe ()
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [MobileConnect] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\INTELLINET NETWORK SOLUTIONS 802.11n Wireless LAN Utility.lnk = C:\Program Files\INTELLINET NETWORK SOLUTIONS\11n USB Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000052 - C:\Program Files\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000053 - C:\Program Files\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O15 - HKCU\..Trusted Domains: microsoft.com ([*.update] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([*.update] https in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([update] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([update] https in Trusted sites)
O15 - HKCU\..Trusted Domains: windowsupdate.com ([download] http in Trusted sites)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1288173104563 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1288173567954 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Mark\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Mark\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/10/26 15:42:27 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2007/08/20 21:28:34 | 000,000,000 | RHSD | M] - D:\autorun.inf – [ NTFS ]
O32 - AutoRun File - [2010/09/30 17:00:30 | 000,000,047 | —- | M] () - L:\Autodesk 3ds serial.txt – [ NTFS ]
O32 - AutoRun File - [2008/12/15 10:52:18 | 000,000,080 | —- | M] () - L:\Autorun.inf – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (56590081070202880)

========== Files/Folders - Created Within 30 Days ==========

[2011/06/15 01:48:48 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Mark\Desktop\OTL.exe
[2011/06/14 23:58:11 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Local Settings\Application Data\Audible
[2011/06/14 23:55:36 | 000,255,352 | —- | C] (Audible, Inc.) – C:\WINDOWS\System32\awrdscdc.ax
[2011/06/14 23:55:23 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msxml3a.dll
[2011/06/14 23:54:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\AudibleManager
[2011/06/14 23:54:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\My Documents\Audible
[2011/06/14 23:54:21 | 000,000,000 | —D | C] – C:\Program Files\Audible
[2011/06/14 23:54:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\Audible
[2011/06/14 23:53:51 | 001,525,176 | —- | C] (Audible Inc.) – C:\Documents and Settings\Mark\Desktop\ActiveSetupN.exe
[2011/06/14 23:18:24 | 004,121,903 | R— | C] (Swearware) – C:\Documents and Settings\Mark\Desktop\ComboFix.exe
[2011/06/14 22:36:04 | 000,000,000 | –SD | C] – C:\32788R22FWJFW
[2011/06/14 21:58:25 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2011/06/14 21:36:14 | 000,000,000 | —D | C] – C:\WINDOWS\SxsCaPendDel
[2011/06/14 20:02:13 | 000,105,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mup.sys
[2011/06/12 22:11:18 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/06/12 20:59:41 | 000,000,000 | RHSD | C] – C:\cmdcons
[2011/06/12 20:51:30 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/06/12 20:51:30 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/06/12 20:51:30 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/06/12 20:51:30 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/06/12 20:51:14 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2011/06/12 20:50:08 | 000,000,000 | —D | C] – C:\Qoobox
[2011/06/12 20:48:54 | 000,000,000 | R–D | C] – C:\Documents and Settings\Mark\Start Menu\Programs\Administrative Tools
[2011/06/12 18:16:57 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Application Data\Malwarebytes
[2011/06/12 18:16:52 | 000,039,984 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/06/12 18:16:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/06/12 18:16:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/06/12 18:16:48 | 000,022,712 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/06/12 18:16:48 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/06/05 19:17:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\PowerISO
[2011/06/05 19:17:20 | 000,000,000 | —D | C] – C:\Program Files\PowerISO
[2011/06/05 19:15:46 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Application Data\searchquband
[2011/06/05 19:15:46 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\AppData
[2011/06/05 15:19:22 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Local Settings\Application Data\Ilivid Player
[2011/06/05 15:16:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Application Data\searchqutoolbar
[2011/06/05 15:13:40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\boost_interprocess
[2011/06/05 15:13:20 | 000,000,000 | —D | C] – C:\Program Files\Windows iLivid Toolbar
[2011/06/02 16:06:41 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Desktop\Microsoft.Windows.7.Working.Activator.For.OEM.READNFO-BiEBiE
[2011/06/02 01:30:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Blender Foundation
[2011/06/02 01:29:51 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Application Data\Blender Foundation
[2011/06/02 01:29:44 | 000,000,000 | —D | C] – C:\Program Files\Blender Foundation
[2011/05/28 01:17:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Start Menu\Programs\Caligari trueSpace7.61 Beta 8 Standalone
[2011/05/28 01:15:30 | 002,682,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vcredist_x86.exe
[2011/05/28 01:14:58 | 000,000,000 | —D | C] – C:\trueSpace761Std
[2011/05/27 13:09:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Local Settings\Application Data\PackageAware
[2011/05/26 16:31:37 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\My Documents\MyHeritage
[2011/05/26 16:31:37 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Application Data\MyHeritage
[2011/05/26 16:31:37 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\MyHeritage
[2011/05/26 16:31:27 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Start Menu\Programs\MyHeritage.com
[2011/05/26 16:31:25 | 000,372,736 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\ijl15.dll
[2011/05/26 16:31:24 | 000,608,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\comctl32.ocx
[2011/05/26 16:31:24 | 000,137,000 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msmapi32.ocx
[2011/05/26 16:31:24 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Application Data\The Complete Genealogy Reporter - FTB
[2011/05/26 16:30:53 | 000,000,000 | —D | C] – C:\Program Files\MyHeritage
[2011/05/25 23:25:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\My Documents\GeoControl2
[2011/05/25 23:25:39 | 000,000,000 | —D | C] – C:\Program Files\GeoControl2
[2011/05/25 23:25:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Start Menu\Programs\GeoControl2
[2011/05/24 16:14:24 | 000,387,600 | —- | C] (MyHeritage) – C:\WINDOWS\System32\FTBSaver.scr
[2011/05/22 21:32:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Start Menu\Programs\EVEMon
[2011/05/19 13:26:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\World of Tanks
[2011/05/18 12:32:08 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Apple
[2011/05/17 23:03:14 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\THQ
[2011/05/17 22:36:45 | 000,000,000 | —D | C] – C:\Program Files\THQ
[2011/05/17 16:57:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\WINDOWS
[2011/05/16 14:44:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\.android
[2011/05/16 14:43:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Desktop\android-sdk-windows
[2006/12/12 10:47:24 | 000,034,816 | —- | C] ( ) – C:\WINDOWS\System32\a3d.dll
[2006/12/12 10:34:02 | 000,010,240 | —- | C] ( ) – C:\WINDOWS\System32\KILLAPPS.EXE
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/15 01:48:54 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Mark\Desktop\OTL.exe
[2011/06/15 01:45:46 | 000,000,420 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{23A18CCC-75BD-4F74-A52C-7624EAC70162}.job
[2011/06/15 01:22:00 | 000,000,974 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-515967899-842925246-725345543-1003UA.job
[2011/06/14 23:56:36 | 000,000,307 | —- | M] () – C:\Documents and Settings\Mark\Desktop\admhelper
[2011/06/14 23:55:53 | 000,001,606 | —- | M] () – C:\Documents and Settings\Mark\Desktop\Audible Manager.lnk
[2011/06/14 23:55:36 | 000,255,352 | —- | M] (Audible, Inc.) – C:\WINDOWS\System32\awrdscdc.ax
[2011/06/14 23:54:00 | 001,525,176 | —- | M] (Audible Inc.) – C:\Documents and Settings\Mark\Desktop\ActiveSetupN.exe
[2011/06/14 23:36:19 | 000,000,278 | —- | M] () – C:\WINDOWS\tasks\SmartDefrag_Startup.job
[2011/06/14 23:36:19 | 000,000,268 | —- | M] () – C:\WINDOWS\tasks\ASC4_PerformanceMonitor.job
[2011/06/14 23:35:57 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/06/14 23:33:59 | 000,064,756 | —- | M] () – C:\WINDOWS\System32\DVCState-{00000004-00000000-00000005-00001102-00000005-10031102}.rfx
[2011/06/14 23:33:59 | 000,053,968 | —- | M] () – C:\WINDOWS\System32\BMXStateBkp-{00000004-00000000-00000005-00001102-00000005-10031102}.rfx
[2011/06/14 23:33:59 | 000,053,968 | —- | M] () – C:\WINDOWS\System32\BMXState-{00000004-00000000-00000005-00001102-00000005-10031102}.rfx
[2011/06/14 23:33:59 | 000,001,080 | —- | M] () – C:\WINDOWS\System32\settingsbkup.sfm
[2011/06/14 23:33:59 | 000,001,080 | —- | M] () – C:\WINDOWS\System32\settings.sfm
[2011/06/14 23:22:00 | 000,000,922 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-515967899-842925246-725345543-1003Core.job
[2011/06/14 23:18:24 | 004,121,903 | R— | M] (Swearware) – C:\Documents and Settings\Mark\Desktop\ComboFix.exe
[2011/06/14 21:59:09 | 000,596,394 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/06/14 21:59:09 | 000,123,276 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/06/14 21:53:01 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/06/13 02:00:00 | 000,000,340 | —- | M] () – C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-MARK-8AA2A066AD-Mark.job
[2011/06/13 00:07:03 | 000,000,325 | RHS- | M] () – C:\boot.ini
[2011/06/12 18:16:52 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/12 00:43:00 | 000,001,438 | —- | M] () – C:\Documents and Settings\Mark\.recently-used.xbel
[2011/06/11 23:42:50 | 000,123,904 | —- | M] () – C:\Documents and Settings\Mark\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/11 00:33:08 | 000,001,551 | —- | M] () – C:\Documents and Settings\Mark\Desktop\config.ini
[2011/06/08 17:23:16 | 000,002,255 | —- | M] () – C:\Documents and Settings\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/06/08 17:23:15 | 000,002,277 | —- | M] () – C:\Documents and Settings\Mark\Desktop\Google Chrome.lnk
[2011/06/08 12:32:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/06/05 19:17:21 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\PowerISO.lnk
[2011/06/02 01:30:06 | 000,001,745 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Blender.lnk
[2011/05/30 23:19:48 | 005,964,800 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtml.dll
[2011/05/29 11:35:36 | 000,000,209 | —- | M] () – C:\Boot.bak
[2011/05/29 09:11:30 | 000,039,984 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/05/28 01:17:07 | 000,001,418 | —- | M] () – C:\Documents and Settings\Mark\Desktop\trueSpace7.61 Beta 8 Standalone.lnk
[2011/05/28 01:17:07 | 000,001,303 | —- | M] () – C:\Documents and Settings\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\trueSpace7.61 Beta 8 Standalone.lnk
[2011/05/28 01:14:58 | 000,000,037 | —- | M] () – C:\WINDOWS\Caligari.ini
[2011/05/27 01:26:24 | 000,001,389 | —- | M] () – C:\Documents and Settings\Mark\Desktop\EVE.lnk
[2011/05/26 19:23:22 | 050,331,702 | —- | M] () – C:\Documents and Settings\Mark\My Documents\Shader3.bmp
[2011/05/26 19:22:55 | 050,331,702 | —- | M] () – C:\Documents and Settings\Mark\My Documents\Shader2.bmp
[2011/05/26 19:18:47 | 033,554,602 | —- | M] () – C:\Documents and Settings\Mark\My Documents\FlatPlain.tif
[2011/05/26 19:18:11 | 002,342,694 | —- | M] () – C:\Documents and Settings\Mark\My Documents\terrainFlatRiver.bmp
[2011/05/26 16:57:39 | 000,000,408 | —- | M] () – C:\WINDOWS\MyHeritage.INI
[2011/05/26 16:31:27 | 000,000,774 | —- | M] () – C:\Documents and Settings\Mark\Desktop\MyHeritage Family Tree Builder.lnk
[2011/05/26 00:42:25 | 016,778,294 | —- | M] () – C:\Documents and Settings\Mark\My Documents\ble.bmp
[2011/05/26 00:39:22 | 033,554,602 | —- | M] () – C:\Documents and Settings\Mark\My Documents\coolAssedfkinTerrain.tif
[2011/05/25 23:26:02 | 000,000,720 | —- | M] () – C:\Documents and Settings\Mark\Desktop\GeoControl2.lnk
[2011/05/24 16:14:24 | 000,387,600 | —- | M] (MyHeritage) – C:\WINDOWS\System32\FTBSaver.scr
[2011/05/22 21:31:58 | 000,302,003 | —- | M] () – C:\Documents and Settings\Mark\My Documents\EVEMon_Settings_2761.xml.bak
[2011/05/22 13:09:35 | 000,002,557 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Vodafone Mobile Connect.lnk
[2011/05/19 13:26:52 | 000,000,681 | —- | M] () – C:\Documents and Settings\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\World of Tanks.lnk
[2011/05/19 13:26:52 | 000,000,663 | —- | M] () – C:\Documents and Settings\All Users\Desktop\World of Tanks.lnk
[2011/05/17 23:03:14 | 000,000,815 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Company of Heroes.lnk
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/14 23:56:36 | 000,000,307 | —- | C] () – C:\Documents and Settings\Mark\Desktop\admhelper
[2011/06/14 23:55:53 | 000,001,606 | —- | C] () – C:\Documents and Settings\Mark\Desktop\Audible Manager.lnk
[2011/06/12 20:59:46 | 000,000,209 | —- | C] () – C:\Boot.bak
[2011/06/12 20:59:44 | 000,260,272 | RHS- | C] () – C:\cmldr
[2011/06/12 20:51:30 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/06/12 20:51:30 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/06/12 20:51:30 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/06/12 20:51:30 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/06/12 20:51:30 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/06/12 18:16:52 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/12 00:43:00 | 000,001,438 | —- | C] () – C:\Documents and Settings\Mark\.recently-used.xbel
[2011/06/05 19:17:21 | 000,000,682 | —- | C] () – C:\Documents and Settings\All Users\Desktop\PowerISO.lnk
[2011/06/02 01:30:06 | 000,001,745 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Blender.lnk
[2011/05/28 01:17:07 | 000,001,418 | —- | C] () – C:\Documents and Settings\Mark\Desktop\trueSpace7.61 Beta 8 Standalone.lnk
[2011/05/28 01:17:07 | 000,001,303 | —- | C] () – C:\Documents and Settings\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\trueSpace7.61 Beta 8 Standalone.lnk
[2011/05/28 01:15:30 | 000,000,819 | —- | C] () – C:\WINDOWS\System32\regpackages.bat
[2011/05/28 01:14:58 | 000,000,037 | —- | C] () – C:\WINDOWS\Caligari.ini
[2011/05/27 01:26:24 | 000,001,389 | —- | C] () – C:\Documents and Settings\Mark\Desktop\EVE.lnk
[2011/05/26 19:23:21 | 050,331,702 | —- | C] () – C:\Documents and Settings\Mark\My Documents\Shader3.bmp
[2011/05/26 19:22:53 | 050,331,702 | —- | C] () – C:\Documents and Settings\Mark\My Documents\Shader2.bmp
[2011/05/26 19:18:46 | 033,554,602 | —- | C] () – C:\Documents and Settings\Mark\My Documents\FlatPlain.tif
[2011/05/26 19:18:11 | 002,342,694 | —- | C] () – C:\Documents and Settings\Mark\My Documents\terrainFlatRiver.bmp
[2011/05/26 16:32:30 | 000,000,408 | —- | C] () – C:\WINDOWS\MyHeritage.INI
[2011/05/26 16:31:27 | 000,000,774 | —- | C] () – C:\Documents and Settings\Mark\Desktop\MyHeritage Family Tree Builder.lnk
[2011/05/26 16:31:25 | 000,454,656 | —- | C] () – C:\WINDOWS\System32\PaintX.dll
[2011/05/26 00:42:24 | 016,778,294 | —- | C] () – C:\Documents and Settings\Mark\My Documents\ble.bmp
[2011/05/26 00:39:20 | 033,554,602 | —- | C] () – C:\Documents and Settings\Mark\My Documents\coolAssedfkinTerrain.tif
[2011/05/25 23:26:02 | 000,000,720 | —- | C] () – C:\Documents and Settings\Mark\Desktop\GeoControl2.lnk
[2011/05/22 21:32:50 | 000,302,003 | —- | C] () – C:\Documents and Settings\Mark\My Documents\EVEMon_Settings_2761.xml.bak
[2011/05/19 13:26:52 | 000,000,681 | —- | C] () – C:\Documents and Settings\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\World of Tanks.lnk
[2011/05/19 13:26:52 | 000,000,663 | —- | C] () – C:\Documents and Settings\All Users\Desktop\World of Tanks.lnk
[2011/05/17 23:03:14 | 000,000,815 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Company of Heroes.lnk
[2011/05/17 00:09:39 | 000,001,608 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Conquer Online 2.0.lnk
[2011/03/22 17:32:09 | 000,004,212 | -H– | C] () – C:\WINDOWS\System32\zllictbl.dat
[2011/03/08 22:39:02 | 000,251,198 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2011/03/08 22:39:02 | 000,251,198 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-515967899-842925246-725345543-1003-0.dat
[2011/02/10 12:50:44 | 000,000,254 | —- | C] () – C:\WINDOWS\w32dasm8.ini
[2011/01/29 18:00:24 | 000,030,568 | —- | C] () – C:\WINDOWS\MusiccityDownload.exe
[2011/01/29 18:00:22 | 000,974,848 | —- | C] () – C:\WINDOWS\System32\cis-2.4.dll
[2011/01/29 18:00:22 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2011/01/29 18:00:22 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2011/01/29 18:00:22 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\issacapi_se-2.3.dll
[2010/12/03 16:42:03 | 000,152,520 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/12/03 13:36:59 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\FsUsbExDevice.Dll
[2010/12/03 13:36:59 | 000,036,640 | —- | C] () – C:\WINDOWS\System32\FsUsbExDisk.Sys
[2010/11/06 12:13:35 | 000,241,436 | —- | C] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2010/11/06 12:13:33 | 000,241,440 | —- | C] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2010/11/06 12:13:33 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\nvdrssel.bin
[2010/11/05 03:15:56 | 000,451,072 | —- | C] () – C:\WINDOWS\System32\ISSRemoveSP.exe
[2010/11/02 11:39:42 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2010/10/27 23:49:30 | 000,123,904 | —- | C] () – C:\Documents and Settings\Mark\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/27 23:21:32 | 000,376,832 | —- | C] () – C:\WINDOWS\System32\AegisI5Installer.exe
[2010/10/27 15:03:02 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2010/10/27 12:50:06 | 000,000,600 | —- | C] () – C:\Documents and Settings\Mark\Application Data\winscp.rnd
[2010/10/27 09:50:08 | 002,293,194 | —- | C] () – C:\WINDOWS\System32\nvdata.bin
[2010/10/26 16:33:11 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2010/10/26 16:32:29 | 000,247,104 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/10/26 15:50:16 | 000,000,127 | —- | C] () – C:\Documents and Settings\Mark\Local Settings\Application Data\fusioncache.dat
[2010/10/26 15:44:02 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2010/10/26 15:40:03 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2010/03/15 20:15:34 | 000,156,430 | R— | C] () – C:\Documents and Settings\All Users\Application Data\DeviceManager.xml.rc4
[2009/10/20 19:19:30 | 000,053,299 | —- | C] () – C:\WINDOWS\System32\pthreadVC.dll
[2009/10/06 08:16:00 | 000,819,200 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2008/05/26 21:59:42 | 000,018,904 | —- | C] () – C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 21:59:40 | 000,106,605 | —- | C] () – C:\WINDOWS\System32\structuredqueryschema.bin
[2007/09/27 10:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2006/12/19 07:15:20 | 000,065,154 | —- | C] () – C:\WINDOWS\System32\instwdm.ini
[2006/12/12 10:48:22 | 000,043,520 | —- | C] () – C:\WINDOWS\System32\CTBurst.dll
[2006/12/12 10:46:52 | 000,037,888 | —- | C] () – C:\WINDOWS\PSCONV.EXE
[2006/12/12 10:39:02 | 000,325,821 | —- | C] () – C:\WINDOWS\System32\ctdlang.dat
[2006/12/12 10:39:02 | 000,046,273 | —- | C] () – C:\WINDOWS\System32\ctdnlstr.dat
[2006/12/12 10:36:32 | 000,035,328 | —- | C] () – C:\WINDOWS\System32\regplib.exe
[2006/12/12 10:36:14 | 000,149,838 | —- | C] () – C:\WINDOWS\System32\CTBAS2W.DAT
[2006/12/12 10:34:30 | 000,274,587 | —- | C] () – C:\WINDOWS\System32\CTSBAS2W.DAT
[2006/12/12 10:34:22 | 000,240,568 | —- | C] () – C:\WINDOWS\System32\CTSBASW.DAT
[2006/12/12 10:34:22 | 000,114,908 | —- | C] () – C:\WINDOWS\System32\CTBASICW.DAT
[2006/12/12 10:34:06 | 000,313,207 | —- | C] () – C:\WINDOWS\System32\ctstatic.dat
[2006/12/12 10:34:06 | 000,053,932 | —- | C] () – C:\WINDOWS\System32\ctdaught.dat
[2006/12/12 10:34:04 | 000,005,120 | —- | C] () – C:\WINDOWS\System32\ENLOCSTR.EXE
[2006/11/30 08:01:26 | 000,000,054 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2006/05/18 07:03:24 | 000,000,269 | —- | C] () – C:\WINDOWS\System32\KILL.INI
[2005/08/05 14:01:54 | 000,235,008 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2005/03/22 23:38:24 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2005/03/22 23:38:24 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/10 12:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/10 12:00:00 | 000,596,394 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/10 12:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/10 12:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/10 12:00:00 | 000,123,276 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/10 12:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/10 12:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/10 12:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/10 12:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/10 12:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2010/10/27 13:03:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2011/06/05 19:53:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\boost_interprocess
[2011/06/07 13:41:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\CCP
[2010/10/26 15:50:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DIGStream
[2011/06/13 01:51:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\e-onsoftware
[2011/05/11 18:00:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IObit
[2011/05/26 16:43:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MyHeritage
[2011/02/11 02:39:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Paessler
[2011/03/18 23:27:05 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe
[2010/12/17 02:44:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Samsung
[2011/02/11 13:36:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2011/01/15 09:43:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Vodafone
[2011/06/02 01:29:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\Blender Foundation
[2011/03/22 17:32:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\CheckPoint
[2010/12/22 13:01:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\com.warnerbros.DigitalCopyManager.449F66ACC381FDC604DC2AA255FEECEEBBBEE1E5.
1
[2011/02/14 00:57:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\DDMSettings
[2011/05/20 18:47:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\e-on software
[2011/04/06 22:43:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\EveHQ
[2011/05/22 21:32:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\EVEMon
[2011/05/04 16:09:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\gtk-2.0
[2011/05/11 18:00:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\IObit
[2011/06/12 18:12:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\Mumble
[2011/05/26 16:33:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\MyHeritage
[2010/10/28 00:05:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\OfficeGuardian
[2011/01/20 13:42:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\Polar WebSync
[2010/12/17 02:44:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\Samsung
[2011/06/05 19:15:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\searchquband
[2011/06/05 15:16:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\searchqutoolbar
[2011/05/26 16:31:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\The Complete Genealogy Reporter - FTB
[2010/11/17 21:34:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\TS3Client
[2011/06/05 20:41:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\uTorrent
[2011/01/15 09:43:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\Vodafone
[2010/11/04 01:08:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\W
[2010/12/25 20:47:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\wargaming.net
[2010/10/27 13:09:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\Windows Desktop Search
[2010/11/19 15:20:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\Windows Search
[2011/02/11 02:53:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\Wireshark
[2011/06/14 23:36:19 | 000,000,268 | —- | M] () – C:\WINDOWS\Tasks\ASC4_PerformanceMonitor.job
[2011/06/14 23:36:19 | 000,000,278 | —- | M] () – C:\WINDOWS\Tasks\SmartDefrag_Startup.job
[2011/06/15 01:45:46 | 000,000,420 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{23A18CCC-75BD-4F74-A52C-7624EAC70162}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2011/04/30 19:26:48 | 000,001,024 | —- | M] () – C:\.rnd
[2010/12/17 02:44:04 | 000,002,006 | —- | M] () – C:\aqua_bitmap.cpp
[2010/10/26 15:42:27 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2011/05/29 11:35:36 | 000,000,209 | —- | M] () – C:\Boot.bak
[2011/06/13 00:07:03 | 000,000,325 | RHS- | M] () – C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () – C:\cmldr
[2010/10/26 15:42:27 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/10/26 15:42:27 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/10/26 15:42:27 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/10 12:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/10/29 01:01:12 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/06/14 23:35:52 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys
[2 C:\*.tmp files -> C:\*.tmp -> ]

< %systemroot%\Fonts\*.com >
[2006/04/18 16:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2010/10/26 15:42:11 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 13:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/04/09 14:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 11:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/05/10 13:10:59 | 000,040,112 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2010/10/28 00:09:40 | 000,001,666 | -H– | M] () – C:\Documents and Settings\Mark\Application Data\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2010/10/26 16:31:45 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2010/10/26 16:31:45 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2010/10/26 16:31:45 | 000,917,504 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lîk /x >
[2010/10/29 01:03:24 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini
[2010/10/27 10:59:48 | 000,001,566 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Microsoft Update.lnk
[2010/12/14 22:13:15 | 000,002,433 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\New Office Document.lnk
[2010/12/05 21:23:15 | 000,002,443 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Open Office Document.lnk
[2010/10/29 01:03:24 | 000,001,563 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Set Program Access and Defaults.lnk
[2010/10/26 15:42:27 | 000,000,398 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Windows Catalog.lnk
[2010/10/27 10:49:59 | 000,001,507 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Windows Update.lnk

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Deskuop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-06-14 20:59:25

========== Alternate Data Streams ==========

@Alternate Data Stream - 233 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9A870F8B

< End of report >