Google Redirect/ Root kit?

I am running a desktop with Windows Vista, I generally use Firefox for my browser. I have Norton 360 but recently I have become infected with several viruses/trojans and other malware. I used malwarebytes to find and clean some of it but it couldn't clean all of it, even after running it three times. In desperation I downloaded Norton Power Eraser and ran it. It got rid of it, as far as I know, I ran it a second and third time and it comes up clean. I have run malwarebytes since then and come up clean. I also ran bitdefender online quickscan before and after running Norton PE and it found a trojan before I ran it, but after it came up clean.

I thought I was done, but I still have a google redirect problem. I am also unable to access some sites, which just hang. I went into about:config and attempted to disable the redirect I found there, but it hasn't changed anything.

I asked for help last night on the WTT chat and was told to try TDSS rootkit removal tool, but it didn't find anything.

I didn't read the instructions real closely and so I ran all 3 scans. (sorry)

OTL logfile created on: 8/18/2011 9:51:01 AM - Run 1
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Users\jtmeserole\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19120)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.87 Gb Total Physical Memory | 1.68 Gb Available Physical Memory | 58.61% Memory free
5.95 Gb Paging File | 4.93 Gb Available in Paging File | 82.86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 286.80 Gb Total Space | 182.58 Gb Free Space | 63.66% Space Free | Partition Type: NTFS
Drive D: | 11.28 Gb Total Space | 1.59 Gb Free Space | 14.08% Space Free | Partition Type: NTFS
Drive F: | 298.02 Gb Total Space | 178.19 Gb Free Space | 59.79% Space Free | Partition Type: FAT32

Computer Name: JTMESEROLE-PC | User Name: jtmeserole | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\jtmeserole\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Norton Online\Engine\2.2.0.20\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Norton 360\Engine\5.1.0.29\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files\LSI SoftModem\agrsmsvc.exe (LSI Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\wpcumi.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()


========== Win32 Services (SafeList) ==========

SRV - (NOF) – C:\Program Files\Norton Online\Engine\2.2.0.20\ccSvcHst.exe (Symantec Corporation)
SRV - (N360) – C:\Program Files\Norton 360\Engine\5.1.0.29\ccSvcHst.exe (Symantec Corporation)
SRV - (GameConsoleService) – C:\Program Files\HP Games\HP Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (AgereModemAudio) – C:\Program Files\LSI SoftModem\agrsmsvc.exe (LSI Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (SMR200) – C:\Windows\System32\drivers\SMR200.SYS (Symantec Corporation)
DRV - (SymEvent) – C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20110817.038\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20110817.038\NAVENG.SYS (Symantec Corporation)
DRV - (IDSVix86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20110817.030\IDSvix86.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (BHDrvx86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20110812.001\BHDrvx86.sys (Symantec Corporation)
DRV - (ccSet_NOF) – C:\Windows\system32\drivers\NOF\0202000.014\ccSetx86.sys (Symantec Corporation)
DRV - (SYMRDR_{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}) – C:\Windows\system32\drivers\NSM\0202000.01C\SymRdr.SYS (Symantec Corporation)
DRV - (SRTSP) – C:\Windows\System32\Drivers\N360\0501000.01D\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\system32\drivers\N360\0501000.01D\SRTSPX.SYS (Symantec Corporation)
DRV - (SYMTDIv) – C:\Windows\System32\Drivers\N360\0501000.01D\SYMTDIV.SYS (Symantec Corporation)
DRV - (SymEFA) – C:\Windows\system32\drivers\N360\0501000.01D\SYMEFA.SYS (Symantec Corporation)
DRV - (SymDS) – C:\Windows\system32\drivers\N360\0501000.01D\SYMDS.SYS (Symantec Corporation)
DRV - (SymIRON) – C:\Windows\system32\drivers\N360\0501000.01D\Ironx86.SYS (Symantec Corporation)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (LSI Corporation)
DRV - (USBCCID) – C:\Windows\System32\drivers\usbccid.sys (Microsoft Corporation)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (PCDSRVC{4F253FFC-7957E8FC-06000000}_0) – c:\Program Files\PC-Doctor for Windows\pcdsrvc.pkms (PC-Doctor, Inc.)
DRV - (nvrd32) – C:\Windows\system32\drivers\nvrd32.sys (NVIDIA Corporation)
DRV - (nvstor32) – C:\Windows\system32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (MHIKEY10) – C:\Windows\System32\drivers\MHIKEY10.sys (Generic USB smartcard reader)
DRV - (nvsmu) – C:\Windows\system32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (dsiarhwprog) – C:\Windows\System32\drivers\dsiarhwprog.sys (Thesycon GmbH, Germany)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…rio&pf=cndt
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…rio&pf=cndt
IE - HKLM\..\URLSearchHook: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files\NCH\tbNCH.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…rio&pf=cndt
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ldsscripturemastery.net/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 98 7D 03 02 CE 6E E2 4D 9F 26 81 EE 65 AF 76 3D [binary data]
IE - HKCU\..\URLSearchHook: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files\NCH\tbNCH.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "www.google.com"
FF - prefs.js..browser.search.defaultthis.engineName: "www.google.com"
FF - prefs.js..browser.search.defaulturl: "www.google.com"
FF - prefs.js..browser.search.order.1: "google"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.ldsscripturemastery.net/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: [removed]:5.0.1
FF - prefs.js..extensions.enabledItems: [removed]:2.3
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:4.6
FF - prefs.js..extensions.enabledItems: [removed]:1.0.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {000F1EA4-5E08-4564-A29B-29076F63A37A}:[removed]
FF - prefs.js..extensions.enabledItems: {6D5C8FC4-DE46-41bf-9092-93F0F78E9115}:2.1.0.51
FF - prefs.js..keyword.URL: "http://search.google.com"
FF - prefs.js..network.proxy.type: 0


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Musicnotes.com/Musicnotes Viewer,version=1.18.9: C:\Program Files\Musicnotes\npmusicn.dll (Musicnotes, Inc.)
FF - HKLM\Software\MozillaPlugins\@Sibelius.com/Scorch Plugin,version=6.2.0.88: C:\Program Files\Musicnotes\npsibelius.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@soe.sony.com/installer,version=1.0.3: C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}\plugins\npsoe.dll ()
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\jtmeserole\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\IPSFFPlgn\ [2011/08/17 20:37:30 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\coFFPlgn_2011_7_1_3 [2011/08/17 20:37:28 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6D5C8FC4-DE46-41bf-9092-93F0F78E9115}: C:\ProgramData\Norton\{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}\NSM_2.2.0.28\coFFFw\ [2011/08/10 19:27:08 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/03/28 10:30:49 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/08/12 13:01:55 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/08/12 13:01:55 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/03/28 10:30:49 | 000,000,000 | —D | M]

[2011/04/24 13:35:40 | 000,000,000 | —D | M] (No name found) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Extensions
[2011/08/16 09:42:11 | 000,000,000 | —D | M] (No name found) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions
[2011/02/19 18:48:33 | 000,000,000 | —D | M] () – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}
[2010/09/27 21:35:19 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/08/16 08:33:14 | 000,000,000 | —D | M] (XUL Cache) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}
[2011/08/16 09:22:17 | 000,000,000 | —D | M] (XUL Cache) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}
[2011/08/16 09:42:11 | 000,000,000 | —D | M] (BitDefender QuickScan) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2010/09/27 21:35:19 | 000,000,000 | —D | M] (United States English Spellchecker) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\[removed]
[2010/09/20 15:59:14 | 000,000,000 | —D | M] (KidZui) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\[removed]
[2011/08/01 23:22:25 | 000,000,000 | —D | M] (Yontoo Layers) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\[removed]
[2010/12/01 18:51:50 | 000,000,927 | —- | M] () – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\searchplugins\conduit.xml
[2011/05/03 11:52:57 | 000,002,469 | —- | M] () – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\searchplugins\safesearch.xml
[2010/12/09 10:17:40 | 000,005,529 | —- | M] () – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\searchplugins\SearchquWebSearch.xml
[2011/08/02 11:16:23 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/02/12 22:17:53 | 000,000,000 | —D | M] (Skype extension) – C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/09/20 16:21:10 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/12/15 08:14:34 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
File not found (No name found) –
[2011/08/17 20:37:28 | 000,000,000 | —D | M] (Norton Toolbar) – C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\COFFPLGN_2011_7_1_3
[2011/08/17 20:37:30 | 000,000,000 | —D | M] (Symantec IPS) – C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\IPSFFPLGN
[2011/08/10 19:27:08 | 000,000,000 | —D | M] (Norton Safety Minder) – C:\PROGRAMDATA\NORTON\{78CA3BF0-9C3B-40E1-B46D-38C877EF059A}\NSM_2.2.0.28\COFFFW
() (No name found) – C:\USERS\JTMESEROLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\TKUCY2AP.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\JTMESEROLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\TKUCY2AP.DEFAULT\EXTENSIONS\[removed]
[2011/08/12 01:58:50 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/07/13 16:52:56 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2010/09/15 05:50:38 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/07/13 16:52:58 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2010/03/31 11:09:22 | 010,437,264 | —- | M] (PDFTron Systems Inc.) – C:\Program Files\mozilla firefox\plugins\PDFNetC.dll
[2010/04/08 13:36:02 | 000,107,760 | —- | M] () – C:\Program Files\mozilla firefox\plugins\ScorchPDFWrapper.dll
[2011/08/01 23:22:34 | 000,002,226 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2011/08/12 01:58:47 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010/12/09 10:17:40 | 000,005,529 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\SearchquWebSearch.xml

O1 HOSTS File: ([2006/09/18 16:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\5.1.0.29\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\5.1.0.29\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - File not found
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Norton Safety Minder BHO) - {B8E07826-0971-4f16-B133-047B88034E89} - C:\Program Files\Norton Online\AddOns\Norton Safety Minder\Engine\2.2.0.28\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (NCH Toolbar) - {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files\NCH\tbNCH.dll (Conduit Ltd.)
O2 - BHO: (Microsoft Live Search Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files\MSN\Toolbar\3.0.0552.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers Runtime\YontooIEClient.dll (Yontoo LLC)
O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files\MSN\Toolbar\3.0.0552.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\5.1.0.29\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - File not found
O3 - HKLM\..\Toolbar: (NCH Toolbar) - {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files\NCH\tbNCH.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\5.1.0.29\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (NCH Toolbar) - {C2DB4FE6-8409-45CE-8010-189A7B5CCE86} - C:\Program Files\NCH\tbNCH.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [UpdateLBPShortCut] c:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] c:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDIRShortCut] c:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] c:\Program Files\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Save video on Savevid.com - C:\Program Files\Savevid\redirect.htm ()
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} http://quickscan.bitdefender.com/qsax/qsax.cab (BitDefender QuickScan Control)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/…can8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.254.254
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img31.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img31.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2008/06/27 10:31:18 | 000,000,000 | —D | M] - F:\autorun – [ FAT32 ]
O33 - MountPoints2\{e37d2225-ffbb-11df-8eaa-0026184acf44}\Shell - "" = AutoRun
O33 - MountPoints2\{e37d2225-ffbb-11df-8eaa-0026184acf44}\Shell\AutoRun\command - "" = M:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/08/17 20:23:26 | 001,404,720 | —- | C] (Kaspersky Lab ZAO) – C:\Users\jtmeserole\Desktop\12345.com.exe
[2011/08/17 08:40:53 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis
[2011/08/17 08:40:52 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2011/08/16 10:01:28 | 000,083,064 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\SMR200.SYS
[2011/08/16 09:51:45 | 000,000,000 | —D | C] – C:\Users\jtmeserole\AppData\Local\NPE
[2011/08/14 18:16:03 | 000,029,184 | —- | C] (Thesycon GmbH, Germany) – C:\Windows\System32\drivers\dsiarhwprog.sys
[2011/08/14 18:15:50 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Action Replay DSi Code Manager
[2011/08/14 18:15:49 | 000,000,000 | —D | C] – C:\Users\jtmeserole\Documents\Datel
[2011/08/14 18:15:49 | 000,000,000 | —D | C] – C:\Program Files\Datel
[2011/08/13 20:05:10 | 000,000,000 | —D | C] – C:\Users\jtmeserole\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hotel Dash 2 - Lost Luxuries
[2011/08/13 20:05:10 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotel Dash 2 - Lost Luxuries
[2011/08/13 20:05:10 | 000,000,000 | —D | C] – C:\Program Files\Hotel Dash 2 - Lost Luxuries
[2011/08/12 13:01:55 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupons
[2011/08/12 13:01:54 | 000,000,000 | —D | C] – C:\Program Files\Coupons
[2011/08/11 03:30:44 | 000,000,000 | -HSD | C] – C:\found.000
[2011/08/10 19:25:42 | 000,196,600 | R— | C] (Symantec Corporation) – C:\Windows\System32\drivers\NSM\0202000.01C\symrdr.sys
[2011/08/10 19:25:39 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\NSM
[2011/08/10 19:25:39 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\NSM\0202000.01C
[2011/08/10 19:25:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Safety Minder
[2011/08/10 19:25:32 | 000,131,208 | R— | C] (Symantec Corporation) – C:\Windows\System32\drivers\NOF\0202000.014\ccSetx86.sys
[2011/08/10 19:25:31 | 000,000,000 | —D | C] – C:\Program Files\Norton Online
[2011/08/10 19:25:31 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\NOF
[2011/08/10 19:25:31 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\NOF\0202000.014
[2011/08/10 07:18:34 | 000,375,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winsrv.dll
[2011/08/10 07:18:06 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/08/10 07:18:05 | 000,174,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/08/10 07:18:05 | 000,105,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/08/10 07:18:04 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/08/10 07:18:04 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/08/10 07:18:04 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/08/10 07:18:04 | 000,602,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/08/10 07:18:04 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/08/10 07:18:04 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/08/10 07:18:04 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/08/10 07:18:04 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/08/10 07:18:04 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/08/10 07:18:04 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/08/10 07:18:04 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2011/08/10 07:18:04 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2011/08/10 07:18:04 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/08/10 07:18:04 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/08/10 07:18:04 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/08/10 07:17:54 | 003,602,832 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2011/08/10 07:17:54 | 003,550,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2011/08/05 10:35:53 | 000,000,000 | —D | C] – C:\ProgramData\353D
[2011/08/04 18:13:18 | 000,000,000 | —D | C] – C:\Users\jtmeserole\AppData\Local\{7893C5B3-22A5-4313-9200-09D3904199FD}
[2011/08/04 15:19:12 | 000,000,000 | —D | C] – C:\Users\jtmeserole\AppData\Local\{2A55ADE4-B348-4698-AFF6-3745CFD2AFBA}
[2011/08/04 15:18:55 | 000,000,000 | —D | C] – C:\Users\jtmeserole\AppData\Local\{D76D61AB-2654-425A-B2EF-5C73E0AEE7E9}
[2011/08/01 23:22:24 | 000,000,000 | —D | C] – C:\Program Files\Yontoo Layers Runtime
[2011/08/01 23:22:24 | 000,000,000 | —D | C] – C:\ProgramData\Tarma Installer
[2011/08/01 23:20:39 | 000,000,000 | —D | C] – C:\Users\jtmeserole\Documents\DownVision
[2011/08/01 23:20:18 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DownVision
[2011/08/01 23:20:18 | 000,000,000 | —D | C] – C:\Program Files\DownVision
[2011/08/01 23:20:06 | 003,461,616 | —- | C] (DownVision ) – C:\Users\jtmeserole\AppData\Local\setup.exe
[2011/07/29 10:09:28 | 000,000,000 | —D | C] – C:\Users\jtmeserole\AppData\Local\{20E2DF52-2062-4011-8EC8-BDDEE4A6B010}
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\jtmeserole\Desktop\*.tmp files -> C:\Users\jtmeserole\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/08/18 09:41:00 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/08/18 08:02:44 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/08/18 08:02:44 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/08/18 06:02:50 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/08/17 22:52:28 | 000,030,720 | —- | M] () – C:\Users\jtmeserole\Documents\Eagle reference letter.wps
[2011/08/17 22:52:28 | 000,018,026 | —- | M] () – C:\Users\jtmeserole\AppData\Roaming\wklnhst.dat
[2011/08/17 20:37:23 | 000,000,890 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/08/17 20:37:16 | 000,000,308 | —- | M] () – C:\Windows\tasks\iMeshNAG.job
[2011/08/17 20:37:09 | 3085,332,480 | -HS- | M] () – C:\hiberfil.sys
[2011/08/17 20:23:28 | 001,404,720 | —- | M] (Kaspersky Lab ZAO) – C:\Users\jtmeserole\Desktop\12345.com.exe
[2011/08/17 18:30:51 | 000,000,115 | —- | M] () – C:\Users\jtmeserole\webct_upload_applet.properties
[2011/08/17 18:29:00 | 000,000,639 | —- | M] () – C:\Users\jtmeserole\Documents\blackboardmailassignment.rtf
[2011/08/17 16:49:32 | 000,000,428 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{603BFFA8-7EC1-4955-9700-1432478DC130}.job
[2011/08/17 16:49:09 | 000,604,264 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/08/17 16:49:09 | 000,103,964 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/08/17 08:40:53 | 000,001,880 | —- | M] () – C:\Users\jtmeserole\Desktop\HijackThis.lnk
[2011/08/17 06:57:41 | 000,040,957 | —- | M] () – C:\Users\jtmeserole\Desktop\obama-fail1.jpg
[2011/08/16 10:01:28 | 000,083,064 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\SMR200.SYS
[2011/08/15 22:18:55 | 000,000,088 | —- | M] () – C:\Windows\System32\2051346082
[2011/08/15 01:03:28 | 000,000,632 | RHS- | M] () – C:\Users\jtmeserole\ntuser.pol
[2011/08/14 18:15:51 | 000,001,033 | —- | M] () – C:\Users\jtmeserole\Desktop\Action Replay DSi Code Manager.lnk
[2011/08/13 20:05:24 | 000,001,906 | —- | M] () – C:\Users\Public\Desktop\Play Hotel Dash 2 - Lost Luxuries.lnk
[2011/08/13 20:05:24 | 000,001,222 | —- | M] () – C:\Users\Public\Desktop\More Great Games.lnk
[2011/08/10 19:25:46 | 000,127,096 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\SYMEVENT.SYS
[2011/08/10 19:25:46 | 000,007,510 | —- | M] () – C:\Windows\System32\drivers\SYMEVENT.CAT
[2011/08/10 19:25:46 | 000,000,806 | —- | M] () – C:\Windows\System32\drivers\SYMEVENT.INF
[2011/08/10 19:25:43 | 000,002,584 | —- | M] () – C:\Users\Public\Desktop\Norton Online Family.lnk
[2011/08/04 18:39:40 | 000,274,108 | —- | M] () – C:\Users\jtmeserole\Desktop\phys hlth eval3.jpg
[2011/08/04 18:37:14 | 000,467,889 | —- | M] () – C:\Users\jtmeserole\Desktop\physicians hlth eval2.jpg
[2011/08/04 18:35:56 | 000,389,980 | —- | M] () – C:\Users\jtmeserole\Desktop\physicians health eval1.jpg
[2011/08/04 18:33:00 | 000,152,908 | —- | M] () – C:\Users\jtmeserole\Desktop\miss add hlth hist2.jpg
[2011/08/04 18:31:18 | 000,516,931 | —- | M] () – C:\Users\jtmeserole\Desktop\miss add health hist.jpg
[2011/08/04 18:29:58 | 000,517,489 | —- | M] () – C:\Users\jtmeserole\Desktop\health history2.jpg
[2011/08/04 18:27:34 | 000,633,879 | —- | M] () – C:\Users\jtmeserole\Desktop\health history1.jpg
[2011/08/04 18:13:52 | 000,404,098 | —- | M] () – C:\Users\jtmeserole\Desktop\employer statement of earnings for meesha.jpg
[2011/08/04 15:19:20 | 000,757,098 | —- | M] () – C:\Users\jtmeserole\Desktop\dentist form (2).jpg
[2011/08/04 15:13:46 | 011,928,954 | —- | M] () – C:\Users\jtmeserole\Desktop\dentist form.bmp
[2011/08/01 23:20:20 | 000,000,834 | —- | M] () – C:\Users\Public\Desktop\DownVision.lnk
[2011/08/01 23:20:12 | 003,461,616 | —- | M] (DownVision ) – C:\Users\jtmeserole\AppData\Local\setup.exe
[2011/07/31 13:17:59 | 000,000,552 | —- | M] () – C:\Windows\tasks\PCDRScheduledMaintenance.job
[2011/07/31 10:00:42 | 000,001,356 | —- | M] () – C:\Users\jtmeserole\AppData\Local\d3d9caps.dat
[2011/07/26 18:43:29 | 000,002,305 | —- | M] () – C:\Users\jtmeserole\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/07/25 21:25:07 | 000,017,408 | —- | M] () – C:\Users\jtmeserole\Documents\Latin translations.wps
[2011/07/23 22:51:20 | 000,017,920 | —- | M] () – C:\Users\jtmeserole\Documents\talk about pioneers.wps
[2011/07/23 06:04:18 | 000,105,984 | —- | M] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/07/23 06:01:07 | 000,611,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/07/23 06:00:36 | 000,602,112 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/07/23 06:00:36 | 000,055,296 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/07/23 06:00:05 | 000,043,520 | —- | M] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/07/23 05:59:57 | 000,025,600 | —- | M] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/07/23 05:59:52 | 001,469,440 | —- | M] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/07/23 05:59:35 | 000,164,352 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/07/23 05:59:34 | 000,184,320 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/07/23 05:59:34 | 000,109,056 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/07/23 05:59:34 | 000,071,680 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2011/07/23 05:59:34 | 000,055,808 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2011/07/23 05:59:29 | 000,387,584 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/07/23 05:03:47 | 000,385,024 | —- | M] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/07/23 04:27:04 | 000,133,632 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/07/23 04:26:52 | 000,174,080 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/07/23 04:26:12 | 000,013,312 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/07/23 04:25:38 | 001,638,912 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/07/23 00:21:43 | 000,019,968 | —- | M] () – C:\Users\jtmeserole\Documents\Route 2832.wps
[2011/07/20 07:58:26 | 000,000,912 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\jtmeserole\Desktop\*.tmp files -> C:\Users\jtmeserole\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/08/17 22:52:28 | 000,030,720 | —- | C] () – C:\Users\jtmeserole\Documents\Eagle reference letter.wps
[2011/08/17 18:30:51 | 000,000,115 | —- | C] () – C:\Users\jtmeserole\webct_upload_applet.properties
[2011/08/17 18:29:00 | 000,000,639 | —- | C] () – C:\Users\jtmeserole\Documents\blackboardmailassignment.rtf
[2011/08/17 08:40:53 | 000,001,880 | —- | C] () – C:\Users\jtmeserole\Desktop\HijackThis.lnk
[2011/08/17 06:57:41 | 000,040,957 | —- | C] () – C:\Users\jtmeserole\Desktop\obama-fail1.jpg
[2011/08/16 10:00:48 | 3085,332,480 | -HS- | C] () – C:\hiberfil.sys
[2011/08/15 22:18:53 | 000,000,088 | —- | C] () – C:\Windows\System32\2051346082
[2011/08/14 18:15:51 | 000,001,033 | —- | C] () – C:\Users\jtmeserole\Desktop\Action Replay DSi Code Manager.lnk
[2011/08/13 20:05:24 | 000,001,906 | —- | C] () – C:\Users\Public\Desktop\Play Hotel Dash 2 - Lost Luxuries.lnk
[2011/08/10 19:25:43 | 000,002,584 | —- | C] () – C:\Users\Public\Desktop\Norton Online Family.lnk
[2011/08/10 19:25:40 | 000,001,482 | R— | C] () – C:\Windows\System32\drivers\NSM\0202000.01C\SymRdr.inf
[2011/08/10 19:25:39 | 000,001,106 | R— | C] () – C:\Windows\System32\drivers\NSM\0202000.01C\symrdr.cat
[2011/08/10 19:25:31 | 000,007,510 | R— | C] () – C:\Windows\System32\drivers\NOF\0202000.014\ccSetx86.cat
[2011/08/10 19:25:31 | 000,000,784 | R— | C] () – C:\Windows\System32\drivers\NOF\0202000.014\ccSetx86.inf
[2011/08/10 19:25:31 | 000,000,172 | —- | C] () – C:\Windows\System32\drivers\NOF\0202000.014\isolate.ini
[2011/08/04 18:39:40 | 000,274,108 | —- | C] () – C:\Users\jtmeserole\Desktop\phys hlth eval3.jpg
[2011/08/04 18:37:14 | 000,467,889 | —- | C] () – C:\Users\jtmeserole\Desktop\physicians hlth eval2.jpg
[2011/08/04 18:35:56 | 000,389,980 | —- | C] () – C:\Users\jtmeserole\Desktop\physicians health eval1.jpg
[2011/08/04 18:33:00 | 000,152,908 | —- | C] () – C:\Users\jtmeserole\Desktop\miss add hlth hist2.jpg
[2011/08/04 18:31:18 | 000,516,931 | —- | C] () – C:\Users\jtmeserole\Desktop\miss add health hist.jpg
[2011/08/04 18:29:58 | 000,517,489 | —- | C] () – C:\Users\jtmeserole\Desktop\health history2.jpg
[2011/08/04 18:27:34 | 000,633,879 | —- | C] () – C:\Users\jtmeserole\Desktop\health history1.jpg
[2011/08/04 18:13:52 | 000,404,098 | —- | C] () – C:\Users\jtmeserole\Desktop\employer statement of earnings for meesha.jpg
[2011/08/04 15:19:20 | 000,757,098 | —- | C] () – C:\Users\jtmeserole\Desktop\dentist form (2).jpg
[2011/08/04 15:13:46 | 011,928,954 | —- | C] () – C:\Users\jtmeserole\Desktop\dentist form.bmp
[2011/08/01 23:20:20 | 000,000,834 | —- | C] () – C:\Users\Public\Desktop\DownVision.lnk
[2011/07/25 21:25:07 | 000,017,408 | —- | C] () – C:\Users\jtmeserole\Documents\Latin translations.wps
[2011/07/23 22:17:13 | 000,017,920 | —- | C] () – C:\Users\jtmeserole\Documents\talk about pioneers.wps
[2011/05/22 17:10:50 | 000,069,632 | —- | C] () – C:\Windows\System32\MobOlExt.dll
[2011/05/15 19:27:51 | 000,000,092 | -HS- | C] () – C:\Windows\WSYS049.SYS
[2011/05/15 19:26:24 | 000,199,297 | —- | C] () – C:\Windows\Photo Pos Pro Uninstaller.exe
[2011/03/28 10:52:04 | 000,171,321 | —- | C] () – C:\Windows\hpwins27.dat.temp
[2011/03/28 10:52:04 | 000,000,385 | —- | C] () – C:\Windows\hpwmdl27.dat.temp
[2011/03/28 10:20:22 | 000,170,596 | —- | C] () – C:\Windows\hpwins27.dat
[2011/02/12 22:26:46 | 000,000,048 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2011/01/11 20:33:13 | 000,262,144 | —- | C] () – C:\Windows\System32\lame_enc.dll
[2010/09/25 19:46:40 | 000,051,200 | —- | C] () – C:\Users\jtmeserole\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/24 12:10:20 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2010/09/24 12:10:20 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2010/09/22 23:41:23 | 000,018,026 | —- | C] () – C:\Users\jtmeserole\AppData\Roaming\wklnhst.dat
[2010/09/20 13:18:13 | 000,001,356 | —- | C] () – C:\Users\jtmeserole\AppData\Local\d3d9caps.dat
[2010/04/06 05:10:15 | 000,225,411 | —- | C] () – C:\Windows\System32\PosPrKpLib.dll
[2010/04/06 05:10:07 | 000,020,480 | —- | C] () – C:\Windows\System32\PosTickerLib.dll
[2009/08/18 11:11:03 | 000,000,385 | —- | C] () – C:\Windows\hpwmdl27.dat
[2009/05/18 15:36:28 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/05/18 15:06:49 | 000,354,816 | —- | C] () – C:\Windows\System32\pythoncom26.dll
[2009/05/18 15:06:49 | 000,108,032 | —- | C] () – C:\Windows\System32\pywintypes26.dll
[2009/01/05 16:44:10 | 000,053,248 | —- | C] () – C:\Windows\bdoscandel.exe
[2009/01/05 16:44:10 | 000,000,453 | —- | C] () – C:\Windows\bdoscandellang.ini
[2006/11/02 07:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 07:47:37 | 000,346,080 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 07:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 05:33:01 | 000,604,264 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 05:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 05:33:01 | 000,103,964 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 05:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 05:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 03:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 03:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 02:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 02:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2005/09/23 06:52:14 | 000,078,848 | —- | C] () – C:\Windows\System32\OneWay.dll
[2002/06/02 09:05:40 | 000,038,912 | —- | C] () – C:\Windows\System32\1Way.dll

========== LOP Check ==========

[2011/03/02 20:50:37 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\2monkeys
[2011/05/30 17:30:34 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Chessmaster Challenge
[2011/04/10 14:35:53 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Farm Mania 2.1
[2011/01/24 21:48:39 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\freshgames
[2011/01/29 00:17:48 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Guitar Pro 6
[2011/05/13 16:38:35 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\KidZui
[2011/03/03 13:06:46 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Mean Hamster
[2011/03/01 11:52:31 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\MSNInstaller
[2010/10/15 17:58:10 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\MusE
[2010/11/05 18:54:16 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\MusicNet
[2011/02/12 12:24:20 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\NCH Swift Sound
[2010/12/15 14:38:17 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Oberon Games
[2010/09/20 13:12:56 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\PictureMover
[2011/08/13 20:07:06 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\PlayFirst
[2011/08/18 08:00:23 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\QuickScan
[2010/10/19 11:23:24 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Skunk Studios
[2011/01/25 21:26:00 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Supermarket Mania 2
[2010/09/22 23:41:24 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Template
[2010/09/22 11:22:41 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Tific
[2010/09/27 15:17:15 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\Unity
[2010/10/18 07:10:46 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\WildTangent
[2010/10/15 20:20:28 | 000,000,000 | —D | M] – C:\Users\jtmeserole\AppData\Roaming\YoudaGames
[2011/08/17 20:37:16 | 000,000,308 | —- | M] () – C:\Windows\Tasks\iMeshNAG.job
[2011/07/31 13:17:59 | 000,000,552 | —- | M] () – C:\Windows\Tasks\PCDRScheduledMaintenance.job
[2011/08/17 20:36:01 | 000,032,542 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2011/08/17 16:49:32 | 000,000,428 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{603BFFA8-7EC1-4955-9700-1432478DC130}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2006/09/18 16:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/11 01:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2009/05/18 15:28:11 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2006/09/18 16:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2011/08/17 20:37:09 | 3085,332,480 | -HS- | M] () – C:\hiberfil.sys
[2011/08/17 20:37:07 | 3399,237,632 | -HS- | M] () – C:\pagefile.sys
[2011/08/17 20:34:46 | 000,065,814 | —- | M] () – C:\TDSSKiller.2.5.15.0_17.08.2011_20.33.13_log.txt
[2009/05/18 15:31:49 | 000,000,349 | —- | M] () – C:\updatedatfix.log
[2008/08/26 07:37:52 | 000,000,458 | —- | M] () – C:\Windows Sidebar

< %systemroot%\Fonts\*.com >
[2006/11/02 07:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 07:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 07:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2010/12/21 12:24:56 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 16:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/04/20 12:23:48 | 000,315,904 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\hpfpp70w.dll
[2008/01/20 21:23:14 | 000,089,600 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006/11/02 07:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 20:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/11/10 02:28:46 | 000,301,936 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/01/20 21:43:21 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2008/01/20 22:14:18 | 016,846,848 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2008/01/20 22:14:08 | 000,106,496 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2008/01/20 22:14:18 | 000,020,480 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 05:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 05:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/09/29 11:35:44 | 000,000,351 | -HS- | M] () – C:\Users\jtmeserole\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/08/17 20:23:28 | 001,404,720 | —- | M] (Kaspersky Lab ZAO) – C:\Users\jtmeserole\Desktop\12345.com.exe
[1 C:\Users\jtmeserole\Desktop\*.tmp files -> C:\Users\jtmeserole\Desktop\*.tmp -> ]

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-08-11 08:11:10

========== Alternate Data Streams ==========

@Alternate Data Stream - 249 bytes -> C:\ProgramData\Temp:EAEE7554
@Alternate Data Stream - 241 bytes -> C:\ProgramData\Temp:05F547A9
@Alternate Data Stream - 235 bytes -> C:\ProgramData\Temp:4B244549
@Alternate Data Stream - 232 bytes -> C:\ProgramData\Temp:76466F4C
@Alternate Data Stream - 228 bytes -> C:\ProgramData\Temp:453190EC
@Alternate Data Stream - 226 bytes -> C:\ProgramData\Temp:2C678471
@Alternate Data Stream - 225 bytes -> C:\ProgramData\Temp:CFF6B3FF
@Alternate Data Stream - 225 bytes -> C:\ProgramData\Temp:217A2A36
@Alternate Data Stream - 223 bytes -> C:\ProgramData\Temp:162E02F7
@Alternate Data Stream - 221 bytes -> C:\ProgramData\Temp:ED9B661E
@Alternate Data Stream - 215 bytes -> C:\ProgramData\Temp:CF61CE5A
@Alternate Data Stream - 214 bytes -> C:\ProgramData\Temp:90015502
@Alternate Data Stream - 213 bytes -> C:\ProgramData\Temp:517B507A
@Alternate Data Stream - 208 bytes -> C:\ProgramData\Temp:FEEEFFAD
@Alternate Data Stream - 208 bytes -> C:\ProgramData\Temp:969C0C96
@Alternate Data Stream - 207 bytes -> C:\ProgramData\Temp:C60FAC5D
@Alternate Data Stream - 207 bytes -> C:\ProgramData\Temp:10D98D98
@Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:9D03192E
@Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:A1023D41
@Alternate Data Stream - 142 bytes -> C:\ProgramData\Temp:4149A170
@Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:C9B27A06
@Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:8CCDAB14
@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:073139EC
@Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:8DD36B71
@Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:08801FDB
@Alternate Data Stream - 110 bytes -> C:\ProgramData\Temp:E73B14E2

< End of report >

OTL Extras logfile created on: 8/18/2011 9:51:01 AM - Run 1
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Users\jtmeserole\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19120)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.87 Gb Total Physical Memory | 1.68 Gb Available Physical Memory | 58.61% Memory free
5.95 Gb Paging File | 4.93 Gb Available in Paging File | 82.86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 286.80 Gb Total Space | 182.58 Gb Free Space | 63.66% Space Free | Partition Type: NTFS
Drive D: | 11.28 Gb Total Space | 1.59 Gb Free Space | 14.08% Space Free | Partition Type: NTFS
Drive F: | 298.02 Gb Total Space | 178.19 Gb Free Space | 59.79% Space Free | Partition Type: FAT32

Computer Name: JTMESEROLE-PC | User Name: jtmeserole | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1"
https [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1"
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{B233142D-9D39-4251-B949-268C9BF4E98D}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{D735A0B5-E349-4096-A8C2-A6086B2D2663}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0A01AB01-E568-4347-8D24-30AFAA09BBDC}" = protocol=6 | dir=in | app=c:\program files\imesh applications\imesh\imesh.exe |
"{30D5582A-806C-4576-86C0-BA4710D34EFD}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpzwiz01.exe |
"{33CE8D40-970C-4AD3-B3D0-A90C8AE9EC2C}" = protocol=6 | dir=in | app=c:\program files\imesh applications\imesh\imesh.exe |
"{39BE8C4D-2FE0-4A83-95A1-0FD5FC782C41}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe |
"{3AE88328-BEFA-4BF9-A61F-61F29CDB807A}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe |
"{461DAA71-6FB3-4A50-98DA-DCC443A6CA20}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe |
"{4698EACC-1810-4C66-9880-AC452F943984}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe |
"{47C4D73B-5ADF-44D4-949C-F790C0CF06C6}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe |
"{4A964099-63FE-4787-A1E3-F6F8E451D265}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpofxs08.exe |
"{5392C678-ED81-4679-AFA4-75457A234DE6}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe |
"{539D015A-DEDC-4664-A2F0-1BE83F282F1C}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{5FEB64E7-3583-49CA-A28F-32627241784F}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe |
"{63090AE1-3CDF-42AF-A07D-F9332787B7D4}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6D08AE45-DFC7-4085-BBAD-B0FA2A5971DC}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqfxt08.exe |
"{75657E49-C1E5-4F45-9334-F81C9A464301}" = dir=in | app=c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe |
"{8E39346B-9997-49AB-8BCE-7F5916E6BFAA}" = protocol=17 | dir=in | app=c:\program files\imesh applications\imesh\imesh.exe |
"{8EFF84B3-0333-4FB4-B208-178D32185F3C}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe |
"{93AC7A78-60DF-4B94-B000-61AB858BDE91}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
"{9B2CB987-BDC4-4115-8CC6-EAB380916153}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{AC229239-AE20-4721-8B13-14AC4270EAE6}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{B2E3A4A6-8891-417B-9BA6-B5FC7D8274D4}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe |
"{B388B647-BE05-41D4-BEC9-55B90E554C5E}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{B39F120E-0363-483E-97BC-80F042173A41}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpofxm08.exe |
"{B401841D-C59E-4B99-93D0-D19867A1F7AF}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposfx08.exe |
"{B5787722-B6AB-496B-8FD1-358223092623}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{CDC43877-897C-4B60-BD5D-806B2AC173BB}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe |
"{D7D99986-DCBE-4050-B65D-3F8887A59E30}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe |
"{DB9276BA-290F-4D25-BDF5-F44194173CA1}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe |
"{E9F63A19-C9BA-4318-AF5B-DADF2BB59860}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{EDDED172-A45C-411B-8A0E-520E3FC901A3}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{F1126A22-4750-4BC7-8819-E404F379B55D}" = protocol=17 | dir=in | app=c:\program files\imesh applications\imesh\imesh.exe |
"{FBA1CD45-86BB-4DF8-A222-95B6DEFB393A}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0295F89F-F698-4101-9A7D-49F407EC2D82}" = HP Active Support Library
"{07FB17D8-7DB6-4F06-80C4-8BE1719CB6A1}" = hpWLPGInstaller
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{10ABE49D-343A-463E-9753-C4C5A05ECEF9}" = Sibelius Scorch (Firefox, Opera, Netscape only)
"{14A487F2-1259-4E6C-AE3C-3C888DDBCB60}_is1" = Guitar Pro 6 Demo
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{1896E712-2B3D-45eb-BCE9-542742A51032}" = PictureMover
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1CC069FA-1A86-402E-9787-3F04E652C67A}" = HP Support Information
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{25A9983D-4BE4-4B25-B66A-1434ECB926A7}" = Microsoft Live Search Toolbar
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java™ 6 Update 22
"{294BF709-D758-4363-8D75-01479AD20927}" = Windows Live Family Safety
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{328687A2-2504-49FA-AE3E-08B0DEDB51EC}" = MSRedist
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{353FE16B-30FE-469A-BF55-B978F4218003}" = iTunes
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EB6F78A-66E3-434f-BD0E-76C7D078DB5E}" = 4500G510af_Software_Min
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{440B915A-0C85-45DB-92AE-75AE14704A64}" = Fax
"{47F36D92-E58E-456D-B73C-3382737E4C42}" = HP Update
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}" = SmartWebPrinting
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6B9B0C6F-E5FA-4633-A640-AB98A272ECCA}" = Safari
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{73A43E42-3658-4DD9-8551-FACDA3632538}" = HP Advisor
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{784BEA84-FA66-4B19-BB80-7B545F248AC6}" = HP Total Care Setup
"{7F10292C-A190-4176-A665-A1ED3478DF86}" = LightScribe System Software
"{853A4763-6643-4604-8D64-28BDD8925F4C}" = Apple Application Support
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo Layers Runtime 1.10.01
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B9F50F9-BA6F-47c5-990B-76A74A1C68B0}" = 4500G510af
"{8D15E1B2-D2B7-4A17-B44B-D2DDE5981405}" = SaveVid Plug-in
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8FB495A1-4A3F-4C1D-BD27-3F3AB2E66763}" = iMesh
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
"{92A51949-EE4C-466D-AAF0-99E74A49A63F}" = DocMgr
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B362566-EC1B-4700-BB9C-EC661BDE2175}" = DocProc
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9CC89170-000B-457D-91F1-53691F85B223}" = Python 2.6.1
"{A0640EC2-B97E-4FC1-AD14-227C9E386BB4}" = HP Recovery Manager RSS
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{A9E27FF5-6294-46A8-B8FD-77B1DECA3021}" = Wizard101
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.3
"{AE469025-08BA-4B2A-915D-CC7765132419}" = Default Manager
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{B84739A3-F943-47E4-95D8-96381EF5AC48}" = HP Customer Experience Enhancements
"{B8AC1A89-FFD1-4F97-8051-E505A160F562}" = HP Odometer
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C175D5B0-ED04-42C9-B23F-D8BD406173E7}" = 4500_G510af_Help
"{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C75CDBA2-3C86-481e-BD10-BDDA758F9DFF}" = hpPrintProjects
"{C98517B6-DCE9-49B7-B19E-E384178D3986}" = HP Officejet 4500 G510a-f
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DF802C05-4660-418c-970C-B988ADB1D316}" = Microsoft Live Search Toolbar
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{E9E34215-82EF-4909-BE2F-F581F0DC9062}" = DirectX for Managed Code Update (Summer 2004)
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F53D678E-238F-4A71-9742-08BB6774E9DC}" = Windows Live Family Safety
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Action Replay DSi Code Manager_is1" = Action Replay DSi Code Manager
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Agere Systems Soft Modem" = Agere Systems PCI-SV92EX Soft Modem
"ALCATEL PC Suite_is1" = ALCATEL PC Suite V6.3.22
"Aleks 3.14" = Aleks 3.14
"BFG-1 Penguin 100 Cases" = 1 Penguin 100 Cases
"BFG-Avenue Flo - Special Delivery" = Avenue Flo: Special Delivery
"BFGC" = Big Fish Games: Game Manager
"BFG-Chessmaster Challenge" = Chessmaster Challenge
"BFG-Chocolatier" = Chocolatier
"BFG-Cooking Dash 3 - Thrills and Spills" = Cooking Dash 3: Thrills and Spills
"BFG-Farm Frenzy - Ancient Rome" = Farm Frenzy: Ancient Rome
"BFG-Farm Frenzy - Gone Fishing" = Farm Frenzy: Gone Fishing
"BFG-Farm Mania - Hot Vacation" = Farm Mania: Hot Vacation
"BFG-Farmers Market" = Farmers Market
"BFG-Flux Family Secrets - The Ripple Effect" = Flux Family Secrets: The Ripple Effect
"BFG-Garden Dash" = Garden Dash
"BFG-Gold Miner Vegas" = Gold Miner Vegas
"BFG-Hotel Dash 2 - Lost Luxuries" = Hotel Dash 2: Lost Luxuries
"BFG-Plantasia" = Plantasia
"BFG-Ranch Rush 2 - Sara's Island Experiment" = Ranch Rush 2 - Sara's Island Experiment
"BFG-Roads of Rome II" = Roads of Rome II
"BFG-Royal Envoy" = Royal Envoy
"BFG-Supermarket Mania 2" = Supermarket Mania ® 2
"BFG-The Great Chocolate Chase" = The Great Chocolate Chase
"BFG-Turbo Fiesta" = Turbo Fiesta
"BFG-Turbo Pizza" = Turbo Pizza
"BFG-Turbo Subs" = Turbo Subs
"BFG-War Chess" = War Chess
"BFG-Wedding Dash 4-Ever" = Wedding Dash 4-Ever
"BFG-Ye Olde Sandwich Shoppe" = Ye Olde Sandwich Shoppe
"BFG-Youda Sushi Chef" = Youda Sushi Chef
"conduitEngine" = Conduit Engine
"Coupon Printer for Windows5.0.0.1" = Coupon Printer for Windows
"Crescendo" = Crescendo Music Notation Editor
"Debut" = Debut Video Capture Software
"DownVision_is1" = DownVision
"ExpressBurn" = Express Burn Disc Burning Software
"Forte Standard" = Forte Standard 2.0
"HijackThis" = HijackThis 2.0.2
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Document Manager" = HP Document Manager 2.0
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Print Projects" = HP Print Projects 1.0
"HP Smart Web Printing" = HP Smart Web Printing 4.5
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"HPOCR" = OCR Software by I.R.I.S. 13.0
"iMesh" = iMesh
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"Kidzui" = Kidzui
"LSI Soft Modem" = LSI PCI-SV92EX Soft Modem
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 5.0 (x86 en-US)" = Mozilla Firefox 5.0 (x86 en-US)
"MSNINST" = MSN
"MuseScore" = MuseScore 0.9.6.3 MuseScore score typesetter
"Musicnotes Combined Installer_is1" = Musicnotes Software Suite 1.5.3
"N360" = Norton 360
"NCH Toolbar" = NCH Toolbar
"NOF" = Norton Online
"NSM" = Norton Safety Minder
"NVIDIA Drivers" = NVIDIA Drivers
"PC-Doctor for Windows" = Hardware Diagnostic Tools
"Photo Pos Pro" = Photo Pos Pro
"Prism" = Prism Video File Converter
"pywin32-py2.6" = Python 2.6 pywin32-212
"SaveVid Plug-in" = SaveVid Plug-in
"Shop for HP Supplies" = Shop for HP Supplies
"TwelveKeys" = TwelveKeys Music Transcription Software
"VideoPad" = VideoPad Video Editor
"VLC media player" = VLC media player 0.9.9
"WavePad" = WavePad Sound Editor
"WildTangent hp Master Uninstall" = HP Games
"WinLiveSuite" = Windows Live Essentials

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"SOE-Free Realms" = Free Realms
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 8/13/2011 4:45:19 AM | Computer Name = jtmeserole-PC | Source = EventSystem | ID = 4609
Description =

Error - 8/13/2011 5:35:13 AM | Computer Name = jtmeserole-PC | Source = WinMgmt | ID = 10
Description =

Error - 8/14/2011 7:16:05 PM | Computer Name = jtmeserole-PC | Source = Windows Installer 3.1 | ID = 921877
Description =

Error - 8/15/2011 12:45:28 AM | Computer Name = jtmeserole-PC | Source = RasClient | ID = 20227
Description =

Error - 8/15/2011 2:11:33 AM | Computer Name = jtmeserole-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 8/15/2011 4:31:31 AM | Computer Name = jtmeserole-PC | Source = EventSystem | ID = 4621
Description =

Error - 8/15/2011 5:24:50 AM | Computer Name = jtmeserole-PC | Source = WinMgmt | ID = 10
Description =

Error - 8/15/2011 4:25:06 PM | Computer Name = jtmeserole-PC | Source = WinMgmt | ID = 10
Description =

Error - 8/15/2011 4:26:35 PM | Computer Name = jtmeserole-PC | Source = Application Hang | ID = 1002
Description = The program firefox.exe version 5.0.0.4183 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 1198 Start Time: 01cc5b897f6636bd Termination Time: 16

Error - 8/16/2011 7:05:32 AM | Computer Name = jtmeserole-PC | Source = WinMgmt | ID = 10
Description =

[ Media Center Events ]
Error - 12/19/2010 7:44:34 PM | Computer Name = jtmeserole-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsTemplate.

[ OSession Events ]
Error - 1/11/2011 9:42:09 PM | Computer Name = jtmeserole-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 5869
seconds with 660 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 2/6/2011 2:48:49 PM | Computer Name = jtmeserole-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 2/7/2011 10:57:53 PM | Computer Name = jtmeserole-PC | Source = Service Control Manager | ID = 7000
Description =


< End of report >

————————————————————————————————————————————————————————

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:17:50 AM, on 8/18/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.19120)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Norton 360\Engine\5.1.0.29\ccSvcHst.exe
C:\Program Files\Norton Online\Engine\2.2.0.20\ccSvcHst.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Users\jtmeserole\Downloads\OTL.exe
C:\Windows\notepad.exe
C:\Windows\notepad.exe
C:\Users\jtmeserole\Downloads\HiJackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…rio&pf=cndt
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ldsscripturemastery.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…rio&pf=cndt
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…rio&pf=cndt
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: NCH Toolbar - {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files\NCH\tbNCH.dll
O1 - Hosts: ::1 localhost
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\5.1.0.29\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\5.1.0.29\IPS\IPSBHO.DLL
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WI0498~1\ToolBar\searchqudtx.dll (file missing)
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Norton Safety Minder BHO - {B8E07826-0971-4f16-B133-047B88034E89} - C:\Program Files\Norton Online\AddOns\Norton Safety Minder\Engine\2.2.0.28\coIEPlg.dll
O2 - BHO: NCH Toolbar - {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files\NCH\tbNCH.dll
O2 - BHO: Microsoft Live Search Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files\MSN\Toolbar\3.0.0552.0\msneshellx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers Runtime\YontooIEClient.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files\MSN\Toolbar\3.0.0552.0\msneshellx.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\5.1.0.29\coIEPlg.dll
O3 - Toolbar: NCH Toolbar - {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files\NCH\tbNCH.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O3 - Toolbar: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WI0498~1\ToolBar\searchqudtx.dll (file missing)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "c:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "c:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [UpdateLBPShortCut] "c:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "c:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
O4 - HKLM\..\Run: [UpdatePDIRShortCut] "c:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "c:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "SOFTWARE\CyberLink\PowerDirector\7.0"
O4 - HKLM\..\Run: [UpdatePSTShortCut] "c:\Program Files\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe" "c:\Program Files\CyberLink\CyberLink DVD Suite Deluxe" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
O4 - HKLM\..\Run: [Microsoft Default Manager] "c:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Save video on Savevid.com - C:\Program Files\Savevid\redirect.htm
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O15 - Trusted Zone: *.clonewarsadventures.com
O15 - Trusted Zone: *.freerealms.com
O15 - Trusted Zone: *.soe.com
O15 - Trusted Zone: *.sony.com
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} (BitDefender QuickScan Control) - http://quickscan.bitdefender.com/qsax/qsax.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/…can8/oscan8.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - LSI Corporation - C:\Program Files\LSI SoftModem\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\HP Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\5.1.0.29\ccSvcHst.exe
O23 - Service: Norton Online (NOF) - Symantec Corporation - C:\Program Files\Norton Online\Engine\2.2.0.20\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

–
End of file - 11989 bytes
———————————————————————————————————————————————————-

.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 8.0.6001.19120 BrowserJavaVersion: 1.6.0_22
Run by [removed] at 10:11:34 on 2011-08-18
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2942.1365 [GMT -5:00]
.
AV: Norton 360 *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton 360 *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton 360 *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\rundll32.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k hpdevmgmt
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\Norton 360\Engine\5.1.0.29\ccSvcHst.exe
C:\Program Files\Norton Online\Engine\2.2.0.20\ccSvcHst.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Norton 360\Engine\5.1.0.29\ccSvcHst.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Norton Online\Engine\2.2.0.20\ccSvcHst.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\wuauclt.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Users\jtmeserole\Downloads\OTL.exe
C:\Windows\notepad.exe
C:\Windows\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Users\jtmeserole\Downloads\HiJackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.ldsscripturemastery.net/
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=93&bd=Presario&pf=cndt
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=93&bd=Presario&pf=cndt
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=93&bd=Presario&pf=cndt
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: NCH Toolbar: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - c:\program files\nch\tbNCH.dll
mURLSearchHooks: NCH Toolbar: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - c:\program files\nch\tbNCH.dll
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton 360\engine\5.1.0.29\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton 360\engine\5.1.0.29\ips\IPSBHO.DLL
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - c:\progra~1\wi0498~1\toolbar\searchqudtx.dll
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Norton Safety Minder BHO: {b8e07826-0971-4f16-b133-047b88034e89} - c:\program files\norton online\addons\norton safety minder\engine\2.2.0.28\coIEPlg.dll
BHO: NCH Toolbar: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - c:\program files\nch\tbNCH.dll
BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0552.0\msneshellx.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Yontoo Layers: {fd72061e-9fde-484d-a58a-0bab4151cad8} - c:\program files\yontoo layers runtime\YontooIEClient.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Microsoft Live Search Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0552.0\msneshellx.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton 360\engine\5.1.0.29\coIEPlg.dll
TB: NCH Toolbar: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - c:\program files\nch\tbNCH.dll
TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
TB: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - c:\progra~1\wi0498~1\toolbar\searchqudtx.dll
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [UpdateP2GoShortCut] "c:\program files\cyberlink\power2go\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\power2go" updatewithcreateonce "software\cyberlink\power2go\6.0"
mRun: [UpdateLBPShortCut] "c:\program files\cyberlink\labelprint\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\labelprint" updatewithcreateonce "software\cyberlink\labelprint\2.5"
mRun: [UpdatePDIRShortCut] "c:\program files\cyberlink\powerdirector\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\powerdirector" updatewithcreateonce "software\cyberlink\powerdirector\7.0"
mRun: [UpdatePSTShortCut] "c:\program files\cyberlink\cyberlink dvd suite deluxe\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\cyberlink dvd suite deluxe" updatewithcreateonce "software\cyberlink\PowerStarter"
mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
mRun: [WPCUMI] c:\windows\system32\WpcUmi.exe
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
IE: Save video on Savevid.com - c:\program files\savevid\redirect.htm
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mi1933~1\office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
LSP: c:\windows\system32\wpclsp.dll
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://www.pcpitstop.com/betapit/PCPitStop.CAB
DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} - hxxp://quickscan.bitdefender.com/qsax/qsax.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
TCP: DhcpNameServer = 192.168.254.254
TCP: Interfaces\{DC2E7865-5ADB-466A-9527-0EFA9B7FF184} : DhcpNameServer = 192.168.254.254
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\jtmeserole\appdata\roaming\mozilla\firefox\profiles\tkucy2ap.default\
FF - prefs.js: browser.search.defaulturl - www.google.com
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.ldsscripturemastery.net/
FF - prefs.js: keyword.URL - hxxp://search.google.com
FF - prefs.js: network.proxy.type - 0
FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.1.0.32\coffplgn\components\coFFPlgn.dll
FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.1.0.32\ipsffplgn\components\IPSFFPl.dll
FF - component: c:\programdata\norton\{78ca3bf0-9c3b-40e1-b46d-38c877ef059a}\nsm_2.1.0.51\cofffw\components\coFFFw.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll
FF - plugin: c:\program files\musicnotes\npmusicn.dll
FF - plugin: c:\program files\musicnotes\NPSibelius.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\jtmeserole\appdata\locallow\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\users\jtmeserole\appdata\roaming\mozilla\firefox\profiles\tkucy2ap.default\extensions\{000f1ea4-5e08-4564-a29b-29076f63a37a}\plugins\npsoe.dll
FF - plugin: c:\users\jtmeserole\appdata\roaming\mozilla\firefox\profiles\tkucy2ap.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
.
—- FIREFOX POLICIES —-
FF - user.js: extentions.y2layers.installId - 1132a82e-f3dd-43a0-b9bf-af81c9d2c769
.
============= SERVICES / DRIVERS ===============
.
R0 SMR200;Symantec SMR Utility Service 2.0.0;c:\windows\system32\drivers\SMR200.SYS [2011-8-16 83064]
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\n360\0501000.01d\symds.sys [2011-5-2 340088]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0501000.01d\symefa.sys [2011-5-2 744568]
R1 BHDrvx86;BHDrvx86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\definitions\bashdefs\20110812.001\BHDrvx86.sys [2011-8-15 815736]
R1 ccSet_NOF;Norton Online Settings Manager;c:\windows\system32\drivers\nof\0202000.014\ccSetx86.sys [2011-8-10 131208]
R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_5.0.0.125\definitions\ipsdefs\20110817.030\IDSvix86.sys [2011-8-17 367736]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\n360\0501000.01d\ironx86.sys [2011-5-2 136312]
R1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\system32\drivers\n360\0501000.01d\symtdiv.sys [2011-5-2 331384]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
R2 N360;Norton 360;c:\program files\norton 360\engine\5.1.0.29\ccsvchst.exe [2011-5-2 130008]
R2 NOF;Norton Online;c:\program files\norton online\engine\2.2.0.20\ccSvcHst.exe [2011-8-10 138760]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2011-8-11 105592]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-2-10 136176]
S3 dsiarhwprog;dsiarhwprog;c:\windows\system32\drivers\dsiarhwprog.sys [2011-8-14 29184]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2011-1-26 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-9-23 1493352]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-2-10 136176]
S3 MHIKEY10;MHIKEY10;c:\windows\system32\drivers\MHIKEY10.sys [2008-5-27 50560]
S3 PCDSRVC{4F253FFC-7957E8FC-06000000}_0;PCDSRVC{4F253FFC-7957E8FC-06000000}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\pc-doctor for windows\pcdsrvc.pkms [2009-2-2 20848]
S3 SYMRDR_{78CA3BF0-9C3B-40e1-B46D-38C877EF059A};Symantec Redirector - Norton Safety Minder;c:\windows\system32\drivers\nsm\0202000.01c\symrdr.sys [2011-8-10 196600]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2011-08-17 13:40:52 ——– d—–w- c:\program files\Trend Micro
2011-08-16 15:01:28 83064 —-a-w- c:\windows\system32\drivers\SMR200.SYS
2011-08-16 14:51:45 ——– d—–w- c:\users\jtmeserole\appdata\local\NPE
2011-08-14 23:16:03 29184 —-a-w- c:\windows\system32\drivers\dsiarhwprog.sys
2011-08-14 23:15:49 ——– d—–w- c:\program files\Datel
2011-08-14 01:05:10 ——– d—–w- c:\program files\Hotel Dash 2 - Lost Luxuries
2011-08-12 18:01:54 ——– d—–w- c:\program files\Coupons
2011-08-12 06:58:50 2106216 —-a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll
2011-08-12 06:58:49 1998168 —-a-w- c:\program files\mozilla firefox\d3dx9_43.dll
2011-08-11 08:30:44 ——– d-sh–w- C:\found.000
2011-08-11 00:25:42 196600 —-a-r- c:\windows\system32\drivers\nsm\0202000.01c\symrdr.sys
2011-08-11 00:25:39 ——– d—–w- c:\windows\system32\drivers\nsm\0202000.01C
2011-08-11 00:25:39 ——– d—–w- c:\windows\system32\drivers\NSM
2011-08-11 00:25:32 131208 —-a-r- c:\windows\system32\drivers\nof\0202000.014\ccSetx86.sys
2011-08-11 00:25:31 ——– d—–w- c:\windows\system32\drivers\nof\0202000.014
2011-08-11 00:25:31 ——– d—–w- c:\windows\system32\drivers\NOF
2011-08-11 00:25:31 ——– d—–w- c:\program files\Norton Online
2011-08-10 12:17:54 3602832 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-08-10 12:17:54 3550096 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-08-10 12:17:52 905104 —-a-w- c:\windows\system32\drivers\tcpip.sys
2011-08-05 15:35:53 ——– d—–w- c:\programdata\353D
2011-08-04 23:13:18 ——– d—–w- c:\users\jtmeserole\appdata\local\{7893C5B3-22A5-4313-9200-09D3904199FD}
2011-08-04 20:19:12 ——– d—–w- c:\users\jtmeserole\appdata\local\{2A55ADE4-B348-4698-AFF6-3745CFD2AFBA}
2011-08-04 20:18:55 ——– d—–w- c:\users\jtmeserole\appdata\local\{D76D61AB-2654-425A-B2EF-5C73E0AEE7E9}
2011-08-02 04:22:24 ——– d—–w- c:\programdata\Tarma Installer
2011-08-02 04:22:24 ——– d—–w- c:\program files\Yontoo Layers Runtime
2011-08-02 04:20:18 ——– d—–w- c:\program files\DownVision
2011-08-02 04:20:06 3461616 —-a-w- c:\users\jtmeserole\appdata\local\setup.exe
2011-07-29 15:09:28 ——– d—–w- c:\users\jtmeserole\appdata\local\{20E2DF52-2062-4011-8EC8-BDDEE4A6B010}
.
==================== Find3M ====================
.
2011-08-11 00:25:46 127096 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2011-07-23 11:04:29 916480 —-a-w- c:\windows\system32\wininet.dll
2011-07-23 11:00:05 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-07-23 10:59:52 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2011-07-23 10:59:34 71680 —-a-w- c:\windows\system32\iesetup.dll
2011-07-23 10:59:34 109056 —-a-w- c:\windows\system32\iesysprep.dll
2011-07-23 10:03:47 385024 —-a-w- c:\windows\system32\html.iec
2011-07-23 09:27:04 133632 —-a-w- c:\windows\system32\ieUnatt.exe
2011-07-23 09:25:38 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-07-13 21:52:54 71072 —-a-w- c:\windows\CouponPrinter.ocx
2011-07-07 00:52:42 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-07 00:52:42 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-07-06 15:31:47 214016 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-06-30 17:17:03 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-17 16:03:18 375808 —-a-w- c:\windows\system32\winsrv.dll
2011-06-02 13:34:49 2043392 —-a-w- c:\windows\system32\win32k.sys
.
============= FINISH: 10:11:59.60 ===============

I disabled my antivirus and firewall but combofix kept telling me that it was still active. I am not sure if there was something else I was supposed to do to disable it other than right clicking on the icon and disabling the firewall and disabling the "antivirus auto-protect". Anyway, it seemed to find a few things to delete…




ComboFix 11-08-18.03 - jtmeserole 08/19/2011 8:41.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2942.1837 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Norton 360 *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton 360 *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton 360 *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Mozilla Firefox\searchplugins\SearchquWebSearch.xml
c:\programdata\Tarma Installer
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico
c:\users\jtmeserole\AppData\Local\setup.exe
c:\users\jtmeserole\AppData\Roaming\Adobe\plugs
c:\users\jtmeserole\AppData\Roaming\Adobe\shed
c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}
c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}\chrome.manifest
c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}\chrome\xulcache.jar
c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}\defaults\preferences\xulcache.js
c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}\install.rdf
c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}
c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}\chrome.manifest
c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}\chrome\xulcache.jar
c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}\defaults\preferences\xulcache.js
c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}\install.rdf
c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\searchplugins\SearchquWebSearch.xml
c:\users\Nice\AppData\Roaming\Mozilla\Firefox\Profiles\s7luh2p0.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}
c:\users\Nice\AppData\Roaming\Mozilla\Firefox\Profiles\s7luh2p0.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}\chrome.manifest
c:\users\Nice\AppData\Roaming\Mozilla\Firefox\Profiles\s7luh2p0.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}\chrome\xulcache.jar
c:\users\Nice\AppData\Roaming\Mozilla\Firefox\Profiles\s7luh2p0.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}\defaults\preferences\xulcache.js
c:\users\Nice\AppData\Roaming\Mozilla\Firefox\Profiles\s7luh2p0.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}\install.rdf
c:\users\Nice\AppData\Roaming\Mozilla\Firefox\Profiles\s7luh2p0.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}
c:\users\Nice\AppData\Roaming\Mozilla\Firefox\Profiles\s7luh2p0.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}\chrome.manifest
c:\users\Nice\AppData\Roaming\Mozilla\Firefox\Profiles\s7luh2p0.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}\chrome\xulcache.jar
c:\users\Nice\AppData\Roaming\Mozilla\Firefox\Profiles\s7luh2p0.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}\defaults\preferences\xulcache.js
c:\users\Nice\AppData\Roaming\Mozilla\Firefox\Profiles\s7luh2p0.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}\install.rdf
c:\users\safe kids\AppData\Roaming\Mozilla\Firefox\Profiles\g5wejlrl.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}
c:\users\safe kids\AppData\Roaming\Mozilla\Firefox\Profiles\g5wejlrl.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}\chrome.manifest
c:\users\safe kids\AppData\Roaming\Mozilla\Firefox\Profiles\g5wejlrl.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}\chrome\xulcache.jar
c:\users\safe kids\AppData\Roaming\Mozilla\Firefox\Profiles\g5wejlrl.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}\defaults\preferences\xulcache.js
c:\users\safe kids\AppData\Roaming\Mozilla\Firefox\Profiles\g5wejlrl.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}\install.rdf
c:\users\safe kids\AppData\Roaming\Mozilla\Firefox\Profiles\g5wejlrl.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}
c:\users\safe kids\AppData\Roaming\Mozilla\Firefox\Profiles\g5wejlrl.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}\chrome.manifest
c:\users\safe kids\AppData\Roaming\Mozilla\Firefox\Profiles\g5wejlrl.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}\chrome\xulcache.jar
c:\users\safe kids\AppData\Roaming\Mozilla\Firefox\Profiles\g5wejlrl.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}\defaults\preferences\xulcache.js
c:\users\safe kids\AppData\Roaming\Mozilla\Firefox\Profiles\g5wejlrl.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}\install.rdf
c:\users\What\AppData\Roaming\Mozilla\Firefox\Profiles\4ojrzcn9.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}
c:\users\What\AppData\Roaming\Mozilla\Firefox\Profiles\4ojrzcn9.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}\chrome.manifest
c:\users\What\AppData\Roaming\Mozilla\Firefox\Profiles\4ojrzcn9.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}\chrome\xulcache.jar
c:\users\What\AppData\Roaming\Mozilla\Firefox\Profiles\4ojrzcn9.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}\defaults\preferences\xulcache.js
c:\users\What\AppData\Roaming\Mozilla\Firefox\Profiles\4ojrzcn9.default\extensions\{505a484d-d6ee-4588-932a-f37c3b5a5904}\install.rdf
c:\users\What\AppData\Roaming\Mozilla\Firefox\Profiles\4ojrzcn9.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}
c:\users\What\AppData\Roaming\Mozilla\Firefox\Profiles\4ojrzcn9.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}\chrome.manifest
c:\users\What\AppData\Roaming\Mozilla\Firefox\Profiles\4ojrzcn9.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}\chrome\xulcache.jar
c:\users\What\AppData\Roaming\Mozilla\Firefox\Profiles\4ojrzcn9.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}\defaults\preferences\xulcache.js
c:\users\What\AppData\Roaming\Mozilla\Firefox\Profiles\4ojrzcn9.default\extensions\{769802fa-f853-45f8-a426-0578d90a667f}\install.rdf
c:\windows\Fonts\verdanaz.ttf
.
.
((((((((((((((((((((((((( Files Created from 2011-07-19 to 2011-08-19 )))))))))))))))))))))))))))))))
.
.
2011-08-19 13:53 . 2011-08-19 13:53 ——– d—–w- c:\users\safe kids\AppData\Local\temp
2011-08-19 13:53 . 2011-08-19 13:53 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-08-18 21:03 . 2011-08-18 21:03 ——– d—–w- c:\program files\CCleaner
2011-08-17 13:40 . 2011-08-17 13:40 ——– d—–w- c:\program files\Trend Micro
2011-08-16 14:51 . 2011-08-18 01:39 ——– d—–w- c:\users\jtmeserole\AppData\Local\NPE
2011-08-15 06:09 . 2011-08-15 06:09 ——– d—–w- c:\users\Nice
2011-08-14 23:16 . 2007-02-08 13:45 29184 —-a-w- c:\windows\system32\drivers\dsiarhwprog.sys
2011-08-14 23:15 . 2011-08-14 23:15 ——– d—–w- c:\program files\Datel
2011-08-14 01:05 . 2011-08-14 01:05 ——– d—–w- c:\program files\Hotel Dash 2 - Lost Luxuries
2011-08-13 05:14 . 2011-08-13 05:14 ——– d—–w- c:\users\What
2011-08-12 18:01 . 2011-08-12 18:01 ——– d—–w- c:\program files\Coupons
2011-08-12 06:58 . 2011-08-12 06:58 2106216 —-a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-08-12 06:58 . 2011-08-12 06:58 1998168 —-a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-08-11 08:30 . 2011-08-11 08:30 ——– d—–w- C:\found.000
2011-08-11 00:25 . 2011-08-11 00:25 ——– d—–w- c:\windows\system32\drivers\NSM
2011-08-11 00:25 . 2011-08-11 00:25 ——– d—–w- c:\program files\Norton Online
2011-08-11 00:25 . 2011-08-11 00:25 ——– d—–w- c:\windows\system32\drivers\NOF
2011-08-10 12:17 . 2011-06-20 08:54 3602832 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-08-10 12:17 . 2011-06-20 08:54 3550096 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-08-10 12:17 . 2011-06-17 20:13 905104 —-a-w- c:\windows\system32\drivers\tcpip.sys
2011-08-05 15:35 . 2011-08-05 15:35 ——– d—–w- c:\programdata\353D
2011-08-02 04:22 . 2011-08-02 04:22 ——– d—–w- c:\program files\Yontoo Layers Runtime
2011-08-02 04:20 . 2011-08-02 04:20 ——– d—–w- c:\program files\DownVision
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-11 00:25 . 2010-09-22 16:15 127096 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2011-07-13 21:52 . 2011-02-14 22:05 71072 —-a-w- c:\windows\CouponPrinter.ocx
2011-07-07 00:52 . 2010-11-26 20:52 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-07 00:52 . 2010-11-26 20:52 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-06-30 17:17 . 2011-06-30 17:17 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-02 13:34 . 2011-07-13 12:21 2043392 —-a-w- c:\windows\system32\win32k.sys
2010-03-31 16:09 . 2010-03-31 16:09 10437264 —-a-w- c:\program files\mozilla firefox\plugins\PDFNetC.dll
2010-04-08 18:36 . 2010-04-08 18:36 107760 —-a-w- c:\program files\mozilla firefox\plugins\ScorchPDFWrapper.dll
2011-08-12 06:58 . 2011-03-24 15:54 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{c2db4fe6-8409-45ce-8010-189a7b5cce86}"= "c:\program files\NCH\tbNCH.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{c2db4fe6-8409-45ce-8010-189a7b5cce86}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-12-09 18:51 3911776 —-a-w- c:\program files\ConduitEngine\ConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c2db4fe6-8409-45ce-8010-189a7b5cce86}]
2010-12-09 18:51 3911776 —-a-w- c:\program files\NCH\tbNCH.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]
2011-07-15 04:46 195360 —-a-w- c:\program files\Yontoo Layers Runtime\YontooIEClient.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{c2db4fe6-8409-45ce-8010-189a7b5cce86}"= "c:\program files\NCH\tbNCH.dll" [2010-12-09 3911776]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{c2db4fe6-8409-45ce-8010-189a7b5cce86}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{C2DB4FE6-8409-45CE-8010-189A7B5CCE86}"= "c:\program files\NCH\tbNCH.dll" [2010-12-09 3911776]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{c2db4fe6-8409-45ce-8010-189a7b5cce86}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-08 13687328]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-08 92704]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-12-04 218408]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-12-04 218408]
"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-12-04 218408]
"UpdatePSTShortCut"="c:\program files\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe" [2009-02-02 210216]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-06 224616]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-07-07 1047656]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-02-11 136176]
R3 dsiarhwprog;dsiarhwprog;c:\windows\system32\Drivers\dsiarhwprog.sys [2007-02-08 29184]
R3 EraserUtilDrvI10;EraserUtilDrvI10;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI10.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-02-11 136176]
R3 MHIKEY10;MHIKEY10;c:\windows\system32\Drivers\MHIKEY10.sys [2008-05-27 50560]
R3 PCDSRVC{4F253FFC-7957E8FC-06000000}_0;PCDSRVC{4F253FFC-7957E8FC-06000000}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\pc-doctor for windows\pcdsrvc.pkms [2009-02-02 20848]
R3 SYMRDR_{78CA3BF0-9C3B-40e1-B46D-38C877EF059A};Symantec Redirector - Norton Safety Minder;c:\windows\system32\drivers\NSM\0202000.01C\SymRdr.SYS [2011-05-10 196600]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0501000.01D\SYMDS.SYS [2011-01-27 340088]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0501000.01D\SYMEFA.SYS [2011-03-15 744568]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20110812.001\BHDrvx86.sys [2011-07-23 815736]
S1 ccSet_NOF;Norton Online Settings Manager;c:\windows\system32\drivers\NOF\0202000.014\ccSetx86.sys [2011-05-24 131208]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20110818.030\IDSvix86.sys [2011-08-02 367736]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0501000.01D\Ironx86.SYS [2010-11-16 136312]
S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\N360\0501000.01D\SYMTDIV.SYS [2011-03-22 331384]
S2 N360;Norton 360;c:\program files\Norton 360\Engine\5.1.0.29\ccSvcHst.exe [2011-04-17 130008]
S2 NOF;Norton Online;c:\program files\Norton Online\Engine\2.2.0.20\ccSvcHst.exe [2011-05-25 138760]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-08-02 105592]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-11 01:23]
.
2011-08-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-11 01:23]
.
2011-07-31 c:\windows\Tasks\PCDRScheduledMaintenance.job
- c:\program files\PC-Doctor for Windows\pcdr5cuiw32.exe [2009-02-02 19:00]
.
2011-08-18 c:\windows\Tasks\User_Feed_Synchronization-{603BFFA8-7EC1-4955-9700-1432478DC130}.job
- c:\windows\system32\msfeedssync.exe [2011-08-10 09:26]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.ldsscripturemastery.net/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=93&bd=Presario&pf=cndt
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Save video on Savevid.com - c:\program files\Savevid\redirect.htm
LSP: c:\windows\system32\wpclsp.dll
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.254.254
FF - ProfilePath - c:\users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\
FF - prefs.js: browser.search.defaulturl - www.google.com
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.ldsscripturemastery.net/
FF - prefs.js: keyword.URL - hxxp://search.google.com
FF - prefs.js: network.proxy.type - 0
FF - user.js: extentions.y2layers.installId - 1132a82e-f3dd-43a0-b9bf-af81c9d2c769
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-10 - (no file)
AddRemove-Agere Systems Soft Modem - c:\windows\agrsmdel
AddRemove-LSI Soft Modem - c:\windows\agrsmdel
AddRemove-{889DF117-14D1-44EE-9F31-C5FB5D47F68B} - c:\progra~2\TARMAI~1\{889DF~1\Setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-19 08:53
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton 360\Engine\5.1.0.29\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\5.1.0.29\diMaster.dll\" /prefetch:1"
–
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NOF]
"ImagePath"="\"c:\program files\Norton Online\Engine\2.2.0.20\ccSvcHst.exe\" /s \"NOF\" /m \"c:\program files\Norton Online\Engine\2.2.0.20\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCDSRVC{4F253FFC-7957E8FC-06000000}_0]
"ImagePath"="\??\c:\program files\pc-doctor for windows\pcdsrvc.pkms"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2011-08-19 09:00:37
ComboFix-quarantined-files.txt 2011-08-19 14:00
.
Pre-Run: 195,561,160,704 bytes free
Post-Run: 195,622,469,632 bytes free
.
- - End Of File - - 5DCBC2992493E86852936D60AF332EBE

As far as I can tell the google redirect problem is resolved. We shall see, though because it came and went unpredictably. Computer is still a little slow.


OTL logfile created on: 8/20/2011 3:15:07 PM - Run 2
OTL by OldTimer - Version 3.2.26.5 Folder = c:\Users\jtmeserole\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19120)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.87 Gb Total Physical Memory | 1.78 Gb Available Physical Memory | 62.03% Memory free
5.96 Gb Paging File | 4.16 Gb Available in Paging File | 69.85% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 286.80 Gb Total Space | 182.50 Gb Free Space | 63.63% Space Free | Partition Type: NTFS
Drive D: | 11.28 Gb Total Space | 1.59 Gb Free Space | 14.08% Space Free | Partition Type: NTFS
Drive F: | 298.02 Gb Total Space | 178.19 Gb Free Space | 59.79% Space Free | Partition Type: FAT32

Computer Name: JTMESEROLE-PC | User Name: jtmeserole | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - c:\Users\jtmeserole\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\bfgclient\bfggameservices.exe ()
PRC - C:\Program Files\Norton Online\Engine\2.2.0.20\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Norton 360\Engine\5.1.0.29\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files\LSI SoftModem\agrsmsvc.exe (LSI Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\wpcumi.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files\bfgclient\bfggameservices.exe ()
MOD - C:\Program Files\bfgclient\bfgcommon.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files\Norton Online\AddOns\Norton Safety Minder\Engine\2.2.0.28\wincfi36.dll ()


========== Win32 Services (SafeList) ==========

SRV - (NOF) – C:\Program Files\Norton Online\Engine\2.2.0.20\ccSvcHst.exe (Symantec Corporation)
SRV - (N360) – C:\Program Files\Norton 360\Engine\5.1.0.29\ccSvcHst.exe (Symantec Corporation)
SRV - (GameConsoleService) – C:\Program Files\HP Games\HP Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (AgereModemAudio) – C:\Program Files\LSI SoftModem\agrsmsvc.exe (LSI Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (SymEvent) – C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20110819.068\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20110819.068\NAVENG.SYS (Symantec Corporation)
DRV - (IDSVix86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20110819.030\IDSvix86.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (BHDrvx86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20110812.001\BHDrvx86.sys (Symantec Corporation)
DRV - (ccSet_NOF) – C:\Windows\system32\drivers\NOF\0202000.014\ccSetx86.sys (Symantec Corporation)
DRV - (SYMRDR_{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}) – C:\Windows\system32\drivers\NSM\0202000.01C\SymRdr.SYS (Symantec Corporation)
DRV - (SRTSP) – C:\Windows\System32\Drivers\N360\0501000.01D\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\system32\drivers\N360\0501000.01D\SRTSPX.SYS (Symantec Corporation)
DRV - (SYMTDIv) – C:\Windows\System32\Drivers\N360\0501000.01D\SYMTDIV.SYS (Symantec Corporation)
DRV - (SymEFA) – C:\Windows\system32\drivers\N360\0501000.01D\SYMEFA.SYS (Symantec Corporation)
DRV - (SymDS) – C:\Windows\system32\drivers\N360\0501000.01D\SYMDS.SYS (Symantec Corporation)
DRV - (SymIRON) – C:\Windows\system32\drivers\N360\0501000.01D\Ironx86.SYS (Symantec Corporation)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (LSI Corporation)
DRV - (USBCCID) – C:\Windows\System32\drivers\usbccid.sys (Microsoft Corporation)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (PCDSRVC{4F253FFC-7957E8FC-06000000}_0) – c:\Program Files\PC-Doctor for Windows\pcdsrvc.pkms (PC-Doctor, Inc.)
DRV - (nvrd32) – C:\Windows\system32\drivers\nvrd32.sys (NVIDIA Corporation)
DRV - (nvstor32) – C:\Windows\system32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (MHIKEY10) – C:\Windows\System32\drivers\MHIKEY10.sys (Generic USB smartcard reader)
DRV - (nvsmu) – C:\Windows\system32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (dsiarhwprog) – C:\Windows\System32\drivers\dsiarhwprog.sys (Thesycon GmbH, Germany)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…rio&pf=cndt
IE - HKLM\..\URLSearchHook: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files\NCH\tbNCH.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ldsscripturemastery.net/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 98 7D 03 02 CE 6E E2 4D 9F 26 81 EE 65 AF 76 3D [binary data]
IE - HKCU\..\URLSearchHook: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files\NCH\tbNCH.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "www.google.com"
FF - prefs.js..browser.search.defaultthis.engineName: "www.google.com"
FF - prefs.js..browser.search.defaulturl: "www.google.com"
FF - prefs.js..browser.search.order.1: "google"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.ldsscripturemastery.net/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: [removed]:5.0.1
FF - prefs.js..extensions.enabledItems: [removed]:2.3
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:4.6
FF - prefs.js..extensions.enabledItems: [removed]:1.0.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {000F1EA4-5E08-4564-A29B-29076F63A37A}:[removed]
FF - prefs.js..extensions.enabledItems: {6D5C8FC4-DE46-41bf-9092-93F0F78E9115}:2.1.0.51
FF - prefs.js..keyword.URL: "http://search.google.com"
FF - prefs.js..network.proxy.type: 0


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Musicnotes.com/Musicnotes Viewer,version=1.18.9: C:\Program Files\Musicnotes\npmusicn.dll (Musicnotes, Inc.)
FF - HKLM\Software\MozillaPlugins\@Sibelius.com/Scorch Plugin,version=6.2.0.88: C:\Program Files\Musicnotes\npsibelius.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@soe.sony.com/installer,version=1.0.3: C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}\plugins\npsoe.dll ()
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\jtmeserole\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\IPSFFPlgn\ [2011/08/17 20:37:30 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\coFFPlgn_2011_7_1_3 [2011/08/18 15:16:28 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6D5C8FC4-DE46-41bf-9092-93F0F78E9115}: C:\ProgramData\Norton\{78CA3BF0-9C3B-40e1-B46D-38C877EF059A}\NSM_2.2.0.28\coFFFw\ [2011/08/10 19:27:08 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/03/28 10:30:49 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/08/12 13:01:55 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/08/12 13:01:55 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/03/28 10:30:49 | 000,000,000 | —D | M]

[2011/04/24 13:35:40 | 000,000,000 | —D | M] (No name found) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Extensions
[2011/08/19 08:49:06 | 000,000,000 | —D | M] (No name found) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions
[2011/02/19 18:48:33 | 000,000,000 | —D | M] () – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}
[2010/09/27 21:35:19 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/08/16 09:42:11 | 000,000,000 | —D | M] (BitDefender QuickScan) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2010/09/27 21:35:19 | 000,000,000 | —D | M] (United States English Spellchecker) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\[removed]
[2010/09/20 15:59:14 | 000,000,000 | —D | M] (KidZui) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\[removed]
[2011/08/01 23:22:25 | 000,000,000 | —D | M] (Yontoo Layers) – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\extensions\[removed]
[2010/12/01 18:51:50 | 000,000,927 | —- | M] () – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\searchplugins\conduit.xml
[2011/05/03 11:52:57 | 000,002,469 | —- | M] () – C:\Users\jtmeserole\AppData\Roaming\Mozilla\Firefox\Profiles\tkucy2ap.default\searchplugins\safesearch.xml
[2011/08/02 11:16:23 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/02/12 22:17:53 | 000,000,000 | —D | M] (Skype extension) – C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/09/20 16:21:10 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/12/15 08:14:34 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
File not found (No name found) –
[2011/08/18 15:16:28 | 000,000,000 | —D | M] (Norton Toolbar) – C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\COFFPLGN_2011_7_1_3
[2011/08/17 20:37:30 | 000,000,000 | —D | M] (Symantec IPS) – C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\IPSFFPLGN
[2011/08/10 19:27:08 | 000,000,000 | —D | M] (Norton Safety Minder) – C:\PROGRAMDATA\NORTON\{78CA3BF0-9C3B-40E1-B46D-38C877EF059A}\NSM_2.2.0.28\COFFFW
() (No name found) – C:\USERS\JTMESEROLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\TKUCY2AP.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\JTMESEROLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\TKUCY2AP.DEFAULT\EXTENSIONS\[removed]
[2011/08/12 01:58:50 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/07/13 16:52:56 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2010/09/15 05:50:38 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/07/13 16:52:58 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2010/03/31 11:09:22 | 010,437,264 | —- | M] (PDFTron Systems Inc.) – C:\Program Files\mozilla firefox\plugins\PDFNetC.dll
[2010/04/08 13:36:02 | 000,107,760 | —- | M] () – C:\Program Files\mozilla firefox\plugins\ScorchPDFWrapper.dll
[2011/08/01 23:22:34 | 000,002,226 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2011/08/12 01:58:47 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/08/19 08:53:35 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\5.1.0.29\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\5.1.0.29\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Norton Safety Minder BHO) - {B8E07826-0971-4f16-B133-047B88034E89} - C:\Program Files\Norton Online\AddOns\Norton Safety Minder\Engine\2.2.0.28\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (NCH Toolbar) - {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files\NCH\tbNCH.dll (Conduit Ltd.)
O2 - BHO: (Microsoft Live Search Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files\MSN\Toolbar\3.0.0552.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files\MSN\Toolbar\3.0.0552.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\5.1.0.29\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (NCH Toolbar) - {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files\NCH\tbNCH.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\5.1.0.29\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (NCH Toolbar) - {C2DB4FE6-8409-45CE-8010-189A7B5CCE86} - C:\Program Files\NCH\tbNCH.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [UpdateLBPShortCut] c:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] c:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDIRShortCut] c:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] c:\Program Files\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Save video on Savevid.com - C:\Program Files\Savevid\redirect.htm ()
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} http://quickscan.bitdefender.com/qsax/qsax.cab (BitDefender QuickScan Control)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/…can8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.254.254
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img31.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img31.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2008/06/27 10:31:18 | 000,000,000 | —D | M] - F:\autorun – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/08/19 21:24:23 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/08/19 09:00:52 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/08/19 08:38:39 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/08/19 08:38:39 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/08/19 08:38:39 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/08/19 08:38:33 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2011/08/19 08:37:54 | 000,000,000 | —D | C] – C:\Qoobox
[2011/08/18 16:03:14 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2011/08/17 20:23:26 | 001,404,720 | —- | C] (Kaspersky Lab ZAO) – C:\Users\jtmeserole\Desktop\12345.com.exe
[2011/08/17 08:40:53 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis
[2011/08/17 08:40:52 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2011/08/16 09:51:45 | 000,000,000 | —D | C] – C:\Users\jtmeserole\AppData\Local\NPE
[2011/08/14 18:16:03 | 000,029,184 | —- | C] (Thesycon GmbH, Germany) – C:\Windows\System32\drivers\dsiarhwprog.sys
[2011/08/14 18:15:50 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Action Replay DSi Code Manager
[2011/08/14 18:15:49 | 000,000,000 | —D | C] – C:\Users\jtmeserole\Documents\Datel
[2011/08/14 18:15:49 | 000,000,000 | —D | C] – C:\Program Files\Datel
[2011/08/13 20:05:10 | 000,000,000 | —D | C] – C:\Users\jtmeserole\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hotel Dash 2 - Lost Luxuries
[2011/08/13 20:05:10 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotel Dash 2 - Lost Luxuries
[2011/08/13 20:05:10 | 000,000,000 | —D | C] – C:\Program Files\Hotel Dash 2 - Lost Luxuries
[2011/08/12 13:01:55 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupons
[2011/08/12 13:01:54 | 000,000,000 | —D | C] – C:\Program Files\Coupons
[2011/08/11 03:30:44 | 000,000,000 | —D | C] – C:\found.000
[2011/08/10 19:25:42 | 000,196,600 | R— | C] (Symantec Corporation) – C:\Windows\System32\drivers\NSM\0202000.01C\symrdr.sys
[2011/08/10 19:25:39 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\NSM
[2011/08/10 19:25:39 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\NSM\0202000.01C
[2011/08/10 19:25:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Safety Minder
[2011/08/10 19:25:32 | 000,131,208 | R— | C] (Symantec Corporation) – C:\Windows\System32\drivers\NOF\0202000.014\ccSetx86.sys
[2011/08/10 19:25:31 | 000,000,000 | —D | C] – C:\Program Files\Norton Online
[2011/08/10 19:25:31 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\NOF
[2011/08/10 19:25:31 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\NOF\0202000.014
[2011/08/10 07:18:34 | 000,375,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winsrv.dll
[2011/08/10 07:18:06 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/08/10 07:18:05 | 000,174,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/08/10 07:18:05 | 000,105,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/08/10 07:18:04 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/08/10 07:18:04 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/08/10 07:18:04 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/08/10 07:18:04 | 000,602,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/08/10 07:18:04 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/08/10 07:18:04 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/08/10 07:18:04 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/08/10 07:18:04 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/08/10 07:18:04 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/08/10 07:18:04 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/08/10 07:18:04 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2011/08/10 07:18:04 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2011/08/10 07:18:04 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/08/10 07:18:04 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/08/10 07:18:04 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/08/10 07:17:54 | 003,602,832 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2011/08/10 07:17:54 | 003,550,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2011/08/05 10:35:53 | 000,000,000 | —D | C] – C:\ProgramData\353D
[2011/08/04 18:13:18 | 000,000,000 | —D | C] – C:\Users\jtmeserole\AppData\Local\{7893C5B3-22A5-4313-9200-09D3904199FD}
[2011/08/04 15:19:12 | 000,000,000 | —D | C] – C:\Users\jtmeserole\AppData\Local\{2A55ADE4-B348-4698-AFF6-3745CFD2AFBA}
[2011/08/04 15:18:55 | 000,000,000 | —D | C] – C:\Users\jtmeserole\AppData\Local\{D76D61AB-2654-425A-B2EF-5C73E0AEE7E9}
[2011/08/01 23:22:24 | 000,000,000 | —D | C] – C:\Program Files\Yontoo Layers Runtime
[2011/08/01 23:20:39 | 000,000,000 | —D | C] – C:\Users\jtmeserole\Documents\DownVision
[2011/08/01 23:20:18 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DownVision
[2011/08/01 23:20:18 | 000,000,000 | —D | C] – C:\Program Files\DownVision
[2011/07/29 10:09:28 | 000,000,000 | —D | C] – C:\Users\jtmeserole\AppData\Local\{20E2DF52-2062-4011-8EC8-BDDEE4A6B010}
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\jtmeserole\Desktop\*.tmp files -> C:\Users\jtmeserole\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/08/20 15:06:12 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/08/20 15:06:12 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/08/20 14:41:00 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/08/20 13:06:17 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/08/20 09:17:42 | 000,000,890 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/08/19 19:13:41 | 000,053,248 | —- | M] () – C:\Users\jtmeserole\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/08/19 19:11:11 | 000,077,941 | —- | M] () – C:\Users\jtmeserole\Desktop\derek-cardigan-7003-black-fr-XL.gif
[2011/08/19 18:11:35 | 000,000,428 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{603BFFA8-7EC1-4955-9700-1432478DC130}.job
[2011/08/19 08:53:35 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2011/08/18 21:34:15 | 000,215,426 | —- | M] () – C:\Users\jtmeserole\Documents\blacboardcert.pdf
[2011/08/18 21:14:40 | 000,000,115 | —- | M] () – C:\Users\jtmeserole\webct_upload_applet.properties
[2011/08/18 15:16:07 | 3085,406,208 | -HS- | M] () – C:\hiberfil.sys
[2011/08/18 10:09:10 | 000,000,846 | —- | M] () – C:\Users\jtmeserole\Desktop\HiJackThis.exe - Shortcut.lnk
[2011/08/17 22:52:28 | 000,030,720 | —- | M] () – C:\Users\jtmeserole\Documents\Eagle reference letter.wps
[2011/08/17 22:52:28 | 000,018,026 | —- | M] () – C:\Users\jtmeserole\AppData\Roaming\wklnhst.dat
[2011/08/17 20:23:28 | 001,404,720 | —- | M] (Kaspersky Lab ZAO) – C:\Users\jtmeserole\Desktop\12345.com.exe
[2011/08/17 18:29:00 | 000,000,639 | —- | M] () – C:\Users\jtmeserole\Documents\blackboardmailassignment.rtf
[2011/08/17 16:49:09 | 000,604,264 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/08/17 16:49:09 | 000,103,964 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/08/17 08:40:53 | 000,001,880 | —- | M] () – C:\Users\jtmeserole\Desktop\HijackThis.lnk
[2011/08/15 22:18:55 | 000,000,088 | —- | M] () – C:\Windows\System32\2051346082
[2011/08/15 01:03:28 | 000,000,632 | RHS- | M] () – C:\Users\jtmeserole\ntuser.pol
[2011/08/14 18:15:51 | 000,001,033 | —- | M] () – C:\Users\jtmeserole\Desktop\Action Replay DSi Code Manager.lnk
[2011/08/13 20:05:24 | 000,001,906 | —- | M] () – C:\Users\Public\Desktop\Play Hotel Dash 2 - Lost Luxuries.lnk
[2011/08/13 20:05:24 | 000,001,222 | —- | M] () – C:\Users\Public\Desktop\More Great Games.lnk
[2011/08/10 19:25:46 | 000,127,096 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\SYMEVENT.SYS
[2011/08/10 19:25:46 | 000,007,510 | —- | M] () – C:\Windows\System32\drivers\SYMEVENT.CAT
[2011/08/10 19:25:46 | 000,000,806 | —- | M] () – C:\Windows\System32\drivers\SYMEVENT.INF
[2011/08/10 19:25:43 | 000,002,584 | —- | M] () – C:\Users\Public\Desktop\Norton Online Family.lnk
[2011/08/04 18:39:40 | 000,274,108 | —- | M] () – C:\Users\jtmeserole\Desktop\phys hlth eval3.jpg
[2011/08/04 18:37:14 | 000,467,889 | —- | M] () – C:\Users\jtmeserole\Desktop\physicians hlth eval2.jpg
[2011/08/04 18:35:56 | 000,389,980 | —- | M] () – C:\Users\jtmeserole\Desktop\physicians health eval1.jpg
[2011/08/04 18:33:00 | 000,152,908 | —- | M] () – C:\Users\jtmeserole\Desktop\miss add hlth hist2.jpg
[2011/08/04 18:31:18 | 000,516,931 | —- | M] () – C:\Users\jtmeserole\Desktop\miss add health hist.jpg
[2011/08/04 18:29:58 | 000,517,489 | —- | M] () – C:\Users\jtmeserole\Desktop\health history2.jpg
[2011/08/04 18:27:34 | 000,633,879 | —- | M] () – C:\Users\jtmeserole\Desktop\health history1.jpg
[2011/08/04 18:13:52 | 000,404,098 | —- | M] () – C:\Users\jtmeserole\Desktop\employer statement of earnings for meesha.jpg
[2011/08/04 15:19:20 | 000,757,098 | —- | M] () – C:\Users\jtmeserole\Desktop\dentist form (2).jpg
[2011/08/04 15:13:46 | 011,928,954 | —- | M] () – C:\Users\jtmeserole\Desktop\dentist form.bmp
[2011/08/01 23:20:20 | 000,000,834 | —- | M] () – C:\Users\Public\Desktop\DownVision.lnk
[2011/07/31 13:17:59 | 000,000,552 | —- | M] () – C:\Windows\tasks\PCDRScheduledMaintenance.job
[2011/07/31 10:00:42 | 000,001,356 | —- | M] () – C:\Users\jtmeserole\AppData\Local\d3d9caps.dat
[2011/07/26 18:43:29 | 000,002,305 | —- | M] () – C:\Users\jtmeserole\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/07/25 21:25:07 | 000,017,408 | —- | M] () – C:\Users\jtmeserole\Documents\Latin translations.wps
[2011/07/23 22:51:20 | 000,017,920 | —- | M] () – C:\Users\jtmeserole\Documents\talk about pioneers.wps
[2011/07/23 06:04:18 | 000,105,984 | —- | M] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/07/23 06:01:07 | 000,611,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/07/23 06:00:36 | 000,602,112 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/07/23 06:00:36 | 000,055,296 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/07/23 06:00:05 | 000,043,520 | —- | M] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/07/23 05:59:57 | 000,025,600 | —- | M] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/07/23 05:59:52 | 001,469,440 | —- | M] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/07/23 05:59:35 | 000,164,352 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/07/23 05:59:34 | 000,184,320 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/07/23 05:59:34 | 000,109,056 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/07/23 05:59:34 | 000,071,680 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2011/07/23 05:59:34 | 000,055,808 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2011/07/23 05:59:29 | 000,387,584 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/07/23 05:03:47 | 000,385,024 | —- | M] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/07/23 04:27:04 | 000,133,632 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/07/23 04:26:52 | 000,174,080 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/07/23 04:26:12 | 000,013,312 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/07/23 04:25:38 | 001,638,912 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/07/23 00:21:43 | 000,019,968 | —- | M] () – C:\Users\jtmeserole\Documents\Route 2832.wps
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\jtmeserole\Desktop\*.tmp files -> C:\Users\jtmeserole\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/08/19 19:11:05 | 000,077,941 | —- | C] () – C:\Users\jtmeserole\Desktop\derek-cardigan-7003-black-fr-XL.gif
[2011/08/19 08:38:39 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2011/08/19 08:38:39 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2011/08/19 08:38:39 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/08/19 08:38:39 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/08/19 08:38:39 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/08/18 21:34:15 | 000,215,426 | —- | C] () – C:\Users\jtmeserole\Documents\blacboardcert.pdf
[2011/08/18 10:09:10 | 000,000,846 | —- | C] () – C:\Users\jtmeserole\Desktop\HiJackThis.exe - Shortcut.lnk
[2011/08/17 22:52:28 | 000,030,720 | —- | C] () – C:\Users\jtmeserole\Documents\Eagle reference letter.wps
[2011/08/17 18:30:51 | 000,000,115 | —- | C] () – C:\Users\jtmeserole\webct_upload_applet.properties
[2011/08/17 18:29:00 | 000,000,639 | —- | C] () – C:\Users\jtmeserole\Documents\blackboardmailassignment.rtf
[2011/08/17 08:40:53 | 000,001,880 | —- | C] () – C:\Users\jtmeserole\Desktop\HijackThis.lnk
[2011/08/16 10:00:48 | 3085,406,208 | -HS- | C] () – C:\hiberfil.sys
[2011/08/15 22:18:53 | 000,000,088 | —- | C] () – C:\Windows\System32\2051346082
[2011/08/14 18:15:51 | 000,001,033 | —- | C] () – C:\Users\jtmeserole\Desktop\Action Replay DSi Code Manager.lnk
[2011/08/13 20:05:24 | 000,001,906 | —- | C] () – C:\Users\Public\Desktop\Play Hotel Dash 2 - Lost Luxuries.lnk
[2011/08/10 19:25:43 | 000,002,584 | —- | C] () – C:\Users\Public\Desktop\Norton Online Family.lnk
[2011/08/10 19:25:40 | 000,001,482 | R— | C] () – C:\Windows\System32\drivers\NSM\0202000.01C\SymRdr.inf
[2011/08/10 19:25:39 | 000,001,106 | R— | C] () – C:\Windows\System32\drivers\NSM\0202000.01C\symrdr.cat
[2011/08/10 19:25:31 | 000,007,510 | R— | C] () – C:\Windows\System32\drivers\NOF\0202000.014\ccSetx86.cat
[2011/08/10 19:25:31 | 000,000,784 | R— | C] () – C:\Windows\System32\drivers\NOF\0202000.014\ccSetx86.inf
[2011/08/10 19:25:31 | 000,000,172 | —- | C] () – C:\Windows\System32\drivers\NOF\0202000.014\isolate.ini
[2011/08/04 18:39:40 | 000,274,108 | —- | C] () – C:\Users\jtmeserole\Desktop\phys hlth eval3.jpg
[2011/08/04 18:37:14 | 000,467,889 | —- | C] () – C:\Users\jtmeserole\Desktop\physicians hlth eval2.jpg
[2011/08/04 18:35:56 | 000,389,980 | —- | C] () – C:\Users\jtmeserole\Desktop\physicians health eval1.jpg
[2011/08/04 18:33:00 | 000,152,908 | —- | C] () – C:\Users\jtmeserole\Desktop\miss add hlth hist2.jpg
[2011/08/04 18:31:18 | 000,516,931 | —- | C] () – C:\Users\jtmeserole\Desktop\miss add health hist.jpg
[2011/08/04 18:29:58 | 000,517,489 | —- | C] () – C:\Users\jtmeserole\Desktop\health history2.jpg
[2011/08/04 18:27:34 | 000,633,879 | —- | C] () – C:\Users\jtmeserole\Desktop\health history1.jpg
[2011/08/04 18:13:52 | 000,404,098 | —- | C] () – C:\Users\jtmeserole\Desktop\employer statement of earnings for meesha.jpg
[2011/08/04 15:19:20 | 000,757,098 | —- | C] () – C:\Users\jtmeserole\Desktop\dentist form (2).jpg
[2011/08/04 15:13:46 | 011,928,954 | —- | C] () – C:\Users\jtmeserole\Desktop\dentist form.bmp
[2011/08/01 23:20:20 | 000,000,834 | —- | C] () – C:\Users\Public\Desktop\DownVision.lnk
[2011/07/25 21:25:07 | 000,017,408 | —- | C] () – C:\Users\jtmeserole\Documents\Latin translations.wps
[2011/07/23 22:17:13 | 000,017,920 | —- | C] () – C:\Users\jtmeserole\Documents\talk about pioneers.wps
[2011/05/22 17:10:50 | 000,069,632 | —- | C] () – C:\Windows\System32\MobOlExt.dll
[2011/05/15 19:27:51 | 000,000,092 | -HS- | C] () – C:\Windows\WSYS049.SYS
[2011/05/15 19:26:24 | 000,199,297 | —- | C] () – C:\Windows\Photo Pos Pro Uninstaller.exe
[2011/03/28 10:52:04 | 000,171,321 | —- | C] () – C:\Windows\hpwins27.dat.temp
[2011/03/28 10:52:04 | 000,000,385 | —- | C] () – C:\Windows\hpwmdl27.dat.temp
[2011/03/28 10:20:22 | 000,170,596 | —- | C] () – C:\Windows\hpwins27.dat
[2011/02/12 22:26:46 | 000,000,048 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2011/01/11 20:33:13 | 000,262,144 | —- | C] () – C:\Windows\System32\lame_enc.dll
[2010/09/25 19:46:40 | 000,053,248 | —- | C] () – C:\Users\jtmeserole\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/24 12:10:20 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2010/09/24 12:10:20 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2010/09/22 23:41:23 | 000,018,026 | —- | C] () – C:\Users\jtmeserole\AppData\Roaming\wklnhst.dat
[2010/09/20 13:18:13 | 000,001,356 | —- | C] () – C:\Users\jtmeserole\AppData\Local\d3d9caps.dat
[2010/04/06 05:10:15 | 000,225,411 | —- | C] () – C:\Windows\System32\PosPrKpLib.dll
[2010/04/06 05:10:07 | 000,020,480 | —- | C] () – C:\Windows\System32\PosTickerLib.dll
[2009/08/18 11:11:03 | 000,000,385 | —- | C] () – C:\Windows\hpwmdl27.dat
[2009/05/18 15:36:28 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/05/18 15:06:49 | 000,354,816 | —- | C] () – C:\Windows\System32\pythoncom26.dll
[2009/05/18 15:06:49 | 000,108,032 | —- | C] () – C:\Windows\System32\pywintypes26.dll
[2009/01/05 16:44:10 | 000,053,248 | —- | C] () – C:\Windows\bdoscandel.exe
[2009/01/05 16:44:10 | 000,000,453 | —- | C] () – C:\Windows\bdoscandellang.ini
[2006/11/02 07:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 07:47:37 | 000,346,080 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 07:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 05:33:01 | 000,604,264 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 05:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 05:33:01 | 000,103,964 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 05:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 05:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 03:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 03:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 02:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 02:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2005/09/23 06:52:14 | 000,078,848 | —- | C] () – C:\Windows\System32\OneWay.dll
[2002/06/02 09:05:40 | 000,038,912 | —- | C] () – C:\Windows\System32\1Way.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 249 bytes -> C:\ProgramData\Temp:EAEE7554
@Alternate Data Stream - 241 bytes -> C:\ProgramData\Temp:05F547A9
@Alternate Data Stream - 235 bytes -> C:\ProgramData\Temp:4B244549
@Alternate Data Stream - 232 bytes -> C:\ProgramData\Temp:76466F4C
@Alternate Data Stream - 228 bytes -> C:\ProgramData\Temp:453190EC
@Alternate Data Stream - 226 bytes -> C:\ProgramData\Temp:2C678471
@Alternate Data Stream - 225 bytes -> C:\ProgramData\Temp:CFF6B3FF
@Alternate Data Stream - 225 bytes -> C:\ProgramData\Temp:217A2A36
@Alternate Data Stream - 223 bytes -> C:\ProgramData\Temp:162E02F7
@Alternate Data Stream - 221 bytes -> C:\ProgramData\Temp:ED9B661E
@Alternate Data Stream - 215 bytes -> C:\ProgramData\Temp:CF61CE5A
@Alternate Data Stream - 214 bytes -> C:\ProgramData\Temp:90015502
@Alternate Data Stream - 213 bytes -> C:\ProgramData\Temp:517B507A
@Alternate Data Stream - 208 bytes -> C:\ProgramData\Temp:FEEEFFAD
@Alternate Data Stream - 208 bytes -> C:\ProgramData\Temp:969C0C96
@Alternate Data Stream - 207 bytes -> C:\ProgramData\Temp:C60FAC5D
@Alternate Data Stream - 207 bytes -> C:\ProgramData\Temp:10D98D98
@Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:9D03192E
@Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:A1023D41
@Alternate Data Stream - 142 bytes -> C:\ProgramData\Temp:4149A170
@Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:C9B27A06
@Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:8CCDAB14
@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:073139EC
@Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:8DD36B71
@Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:08801FDB
@Alternate Data Stream - 110 bytes -> C:\ProgramData\Temp:E73B14E2

< End of report >