HEUR/HTML, just saw another hpqhr, lots going on

. DDS (Ver_11-03-05.01) - NTFSx86 Run by [removed] at 15:42:31.77 on Fri 09/30/2011 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26 Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.1978.860 [GMT -4:00] . AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\WLANExt.exe C:\Windows\System32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\Windows\system32\svchost.exe -k apphost C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\DirecTV\DirecTV\Kernel\DMP\CLDTVHNService.exe C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe C:\Windows\System32\svchost.exe -k LPDService C:\Program Files\Common Files\NeatReceipts\DB Controller\NeatReceiptsDBController.exe C:\Program Files\Avira\AntiVir Desktop\avshadow.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\SMINST\BLService.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\system32\svchost.exe -k iissvcs C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\HP\HP Software Update\hpwuschd2.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\system32\taskeng.exe C:\Windows\System32\alg.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\TIFFANY\Desktop\dds.scr C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uDefault_Search_URL = hxxp://www.google.com/ie uStart Page = hxxp://www.google.com/ mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=en_us&c;=83&bd;=Presario&pf;=cnnb uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s uURLSearchHooks: Coupons.com Toolbar: {37153479-1976-43c3-a1ee-557513977b64} - c:\program files\coupons.com\prxtbCou0.dll mURLSearchHooks: Coupons.com Toolbar: {37153479-1976-43c3-a1ee-557513977b64} - c:\program files\coupons.com\prxtbCou0.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Coupons.com Toolbar: {37153479-1976-43c3-a1ee-557513977b64} - c:\program files\coupons.com\prxtbCou0.dll BHO: Spybot-S&D; IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: Coupons.com Toolbar: {37153479-1976-43c3-a1ee-557513977b64} - c:\program files\coupons.com\prxtbCou0.dll TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File {555d4d79-4bd2-4094-a395-cfc534424a05} uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200 IE: E&xport; to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll Trusted Zone: plaxo.com\www DPF: Garmin Communicator Plug-In DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll Notify: igfxcui - igfxdev.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\users\tiffany\appdata\roaming\mozilla\firefox\profiles\b0edoz9b.default\ FF - prefs.js: browser.search.selectedEngine - Bing FF - prefs.js: browser.startup.homepage - hxxp://en-US.google.mozilla.com/firefox?client=firefox-a&rls;=com.google:en-US:official FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4cb9011f&v;=6.011.025.001&i;=23&tp;=ab&iy;=&ychte;=us&lng;=en-US&q;= FF - component: c:\users\tiffany\appdata\roaming\mozilla\firefox\profiles\b0edoz9b.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll FF - component: c:\users\tiffany\appdata\roaming\mozilla\firefox\profiles\b0edoz9b.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} FF - Ext: LoudMo Contextual Ad Assistant: {3cc7f70e-8ed1-9b5c-cba0-a81ecb3f75fd} - c:\program files\mozilla firefox\extensions\{3cc7f70e-8ed1-9b5c-cba0-a81ecb3f75fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} . ============= SERVICES / DRIVERS =============== . R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2011-6-6 64952] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2011-2-27 136360] R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2011-2-27 269480] R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-2-27 66616] R2 CLDTVHNService;CLDTVHNService;c:\program files\directv\directv\kernel\dmp\CLDTVHNService.exe [2009-9-17 75048] R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504] R2 NeatReceipts Database Controller;NeatReceipts Database Controller;c:\program files\common files\neatreceipts\db controller\NeatReceiptsDBController.exe [2008-2-5 228480] R2 ntk_dtv;ntk_dtv;c:\program files\directv\directv\kernel\dmp\ntk_dtv.sys [2009-9-17 119792] R2 Recovery Service for Windows;Recovery Service for Windows;c:\windows\sminst\BLService.exe [2008-7-26 361808] R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-6-14 1153368] R3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2008-7-26 193840] R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-6-30 112128] R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\drivers\WSDPrint.sys [2008-1-20 16896] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-12-21 135664] S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [2008-4-1 19456] S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2010-10-21 39272] S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2011-5-13 1492840] S3 gbridge;Gbridge Virtual Miniport;c:\windows\system32\drivers\gbridge.sys [2009-5-10 41216] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-12-21 135664] S3 MSSQL$NR2007;SQL Server (NR2007);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2010-12-10 29293408] S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [2009-8-28 17408] S3 phc700;USB PC Camera (SPC700NC);c:\windows\system32\drivers\phc700.sys [2011-1-4 644864] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] . =============== Created Last 30 ================ . 2011-09-30 17:05:47 56200 —-a-w- c:\progra~2\microsoft\windows defender\definition updates\{a744e4b2-6b5e-4ad8-821c-7f3896fceb76}\offreg.dll 2011-09-30 17:05:43 7269712 —-a-w- c:\progra~2\microsoft\windows defender\definition updates\{a744e4b2-6b5e-4ad8-821c-7f3896fceb76}\mpengine.dll 2011-09-30 12:04:26 ——– d—–w- c:\users\tiffany\appdata\local\{8C2D9AAB-9D65-4D19-8F2A-6BCFCDCF7FA5} 2011-09-30 12:04:06 ——– d—–w- c:\users\tiffany\appdata\local\{50FD267B-02D8-4F75-A788-0070A8515C4A} 2011-09-30 00:03:38 ——– d—–w- c:\users\tiffany\appdata\local\{E59B7F74-AD8C-4EDE-A9EB-A411F34836DF} 2011-09-30 00:03:17 ——– d—–w- c:\users\tiffany\appdata\local\{014466BF-3E5A-47B2-9984-FD045221F100} 2011-09-29 12:02:48 ——– d—–w- c:\users\tiffany\appdata\local\{FBEA6667-F070-4FB2-92E2-CCEEEB90206E} 2011-09-29 12:02:25 ——– d—–w- c:\users\tiffany\appdata\local\{F659B33C-BE38-4A1D-A732-42D13999F251} 2011-09-28 22:42:03 ——– d—–w- c:\users\tiffany\appdata\local\{1EB6360B-662A-4531-9B6A-E5E4A4CC772E} 2011-09-28 22:41:41 ——– d—–w- c:\users\tiffany\appdata\local\{F72DC351-3600-4A86-9E80-6CBCDCD37C42} 2011-09-28 10:40:12 ——– d—–w- c:\users\tiffany\appdata\local\{1E2B4612-FCE3-4973-B315-B44B0C689C4A} 2011-09-28 10:37:26 ——– d—–w- c:\users\tiffany\appdata\local\{228B66DF-B2D2-4A62-83AE-D10FB66AFE8A} 2011-09-27 22:37:10 ——– d—–w- c:\users\tiffany\appdata\local\{BAFC9105-1FCF-4E2B-88CC-4641AE7A9961} 2011-09-27 22:36:48 ——– d—–w- c:\users\tiffany\appdata\local\{D2F5FDB0-52BB-49C0-B67F-7155F6ED0807} 2011-09-27 10:36:12 ——– d—–w- c:\users\tiffany\appdata\local\{FBB5B24C-491B-48FF-9530-3C004C5565EF} 2011-09-27 10:35:59 ——– d—–w- c:\users\tiffany\appdata\local\{7C1FB5FF-A782-4A8C-8900-DCD977EEF569} 2011-09-27 04:36:18 ——– d—–w- c:\program files\Conduit 2011-09-27 04:35:58 ——– d—–w- c:\program files\Coupons.com 2011-09-26 12:56:08 ——– d—–w- c:\users\tiffany\appdata\local\temp 2011-09-26 12:52:25 ——– d-sh–w- C:\$RECYCLE.BIN 2011-09-26 12:31:47 98816 —-a-w- c:\windows\sed.exe 2011-09-26 12:31:47 518144 —-a-w- c:\windows\SWREG.exe 2011-09-26 12:31:47 256000 —-a-w- c:\windows\PEV.exe 2011-09-26 12:31:47 208896 —-a-w- c:\windows\MBR.exe 2011-09-26 11:52:57 ——– d—–w- c:\users\tiffany\appdata\local\{FA883FB7-2981-4B73-A164-1F1B0B3A9287} 2011-09-26 11:52:45 ——– d—–w- c:\users\tiffany\appdata\local\{7CF0BE8F-22FA-43B2-931E-339D3B32C925} 2011-09-25 14:39:01 ——– d—–w- c:\users\tiffany\appdata\local\{B4F596CE-52F3-441D-936C-495F1847D221} 2011-09-25 14:38:50 ——– d—–w- c:\users\tiffany\appdata\local\{C4F5B9F1-CC0F-4A47-B780-3265175E4EF4} 2011-09-23 23:58:09 ——– d—–w- c:\users\tiffany\appdata\local\{553FB7E7-C7DC-4ED4-BDCB-4AA92A2D00A6} 2011-09-23 23:57:47 ——– d—–w- c:\users\tiffany\appdata\local\{3727530E-07EC-42AB-952D-1F79EA01F161} 2011-09-23 03:48:07 ——– d—–w- c:\users\tiffany\appdata\local\{3AFF3BAA-EF71-4A03-961D-FB0442EAFF84} 2011-09-23 03:47:57 ——– d—–w- c:\users\tiffany\appdata\local\{68A106E0-5BB2-4ADF-A38F-6E221C006818} 2011-09-22 13:53:05 ——– d—–w- c:\users\tiffany\appdata\local\{23EA913B-520C-4FAA-BB16-F33729C6B5D1} 2011-09-22 13:52:54 ——– d—–w- c:\users\tiffany\appdata\local\{C002F51F-B28D-4DFA-9982-9F4B9E2D753A} 2011-09-22 13:52:43 ——– d—–w- c:\users\tiffany\appdata\local\{D95EF860-FAEA-4615-9C2A-A9D1C4A6564A} 2011-09-22 13:52:29 ——– d—–w- c:\users\tiffany\appdata\local\{86523CCE-0AA9-4509-8A3E-BDCAB0818945} 2011-09-22 01:51:42 ——– d—–w- c:\users\tiffany\appdata\local\{72C86BCD-B7EC-4D31-B142-FE939891D680} 2011-09-22 01:51:31 ——– d—–w- c:\users\tiffany\appdata\local\{2214F633-E5E3-4FC2-9BC1-F200061F1746} 2011-09-21 12:58:10 ——– d—–w- c:\users\tiffany\appdata\local\{3E418B4C-97DB-4330-9B71-0C5A87193B03} 2011-09-21 12:57:40 ——– d—–w- c:\users\tiffany\appdata\local\{0F2A546E-61B2-408F-8E05-F44D8A074A7B} 2011-09-21 05:38:46 ——– d—–w- c:\program files\TweakUAC 2011-09-21 00:56:53 ——– d—–w- c:\users\tiffany\appdata\local\{9EC94429-1596-4018-9B18-A3D6E96363B5} 2011-09-21 00:56:31 ——– d—–w- c:\users\tiffany\appdata\local\{7E432CEF-1A5D-484E-81D6-4B8ED879B3E5} 2011-09-20 12:55:42 ——– d—–w- c:\users\tiffany\appdata\local\{2224C4E3-6EB7-47CB-8CC5-3BE7C59730A2} 2011-09-20 12:55:16 ——– d—–w- c:\users\tiffany\appdata\local\{4E1BCAC1-3C12-4EAF-B4C9-81EB73156581} 2011-09-20 00:54:35 ——– d—–w- c:\users\tiffany\appdata\local\{B58B27E9-5E0F-435B-B8C2-5FC405459B5D} 2011-09-20 00:54:26 ——– d—–w- c:\users\tiffany\appdata\local\{F6FA469B-49C4-4881-A38F-5554AE2CB220} 2011-09-20 00:54:15 ——– d—–w- c:\users\tiffany\appdata\local\{473CB9F3-9773-4C22-AADD-2CB2E1BD9813} 2011-09-20 00:53:53 ——– d—–w- c:\users\tiffany\appdata\local\{9B59CE06-CB29-4C37-936E-3C12FBAF3BE6} 2011-09-19 12:53:13 ——– d—–w- c:\users\tiffany\appdata\local\{C1D25BA1-DE3C-4197-B825-3BC032AA9733} 2011-09-19 12:53:01 ——– d—–w- c:\users\tiffany\appdata\local\{7E0CC5DE-606B-49CC-89F7-EC1B7E7A6ECE} 2011-09-18 21:28:48 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-09-18 16:25:08 ——– d—–w- c:\users\tiffany\appdata\local\ElevatedDiagnostics 2011-09-18 13:17:07 ——– d—–w- c:\users\tiffany\appdata\local\{18D8527C-F1AB-4E21-B57A-43336BC82877} 2011-09-18 13:16:49 ——– d—–w- c:\users\tiffany\appdata\local\{5461DF4B-D8D4-485A-97AD-774381A63A19} 2011-09-17 22:45:37 ——– d—–w- c:\users\tiffany\appdata\local\{579823E5-7A7A-443A-B16B-B154CB9B3BF8} 2011-09-17 22:45:22 ——– d—–w- c:\users\tiffany\appdata\local\{07C652E4-88B2-4B7F-A637-E2D53936CC82} 2011-09-15 13:17:07 ——– d—–w- c:\users\tiffany\appdata\local\{C958E5EB-980E-4924-83E4-5235702DE110} 2011-09-15 13:16:56 ——– d—–w- c:\users\tiffany\appdata\local\{CA70B1CB-7E34-46BA-8417-AD12BEEBEE35} 2011-09-14 23:31:49 ——– d—–w- c:\users\tiffany\appdata\local\{0C9C687A-2E16-4B43-AA7D-D4EC42EEDBEA} 2011-09-14 23:31:27 ——– d—–w- c:\users\tiffany\appdata\local\{0FFA048D-513C-4441-B5E0-59E06F6990F3} 2011-09-14 12:02:46 2409784 —-a-w- c:\program files\windows mail\OESpamFilter.dat 2011-09-14 00:26:38 ——– d—–w- c:\users\tiffany\appdata\local\{31025E93-5414-44F0-B315-7E3AD3897567} 2011-09-14 00:26:16 ——– d—–w- c:\users\tiffany\appdata\local\{0C170361-4309-4C6B-84C1-B1F9EEEEBAD1} 2011-09-13 18:23:46 ——– d—–w- c:\users\tiffany\appdata\local\{C472542B-1667-4948-B922-213ABD203BC2} 2011-09-13 06:23:32 ——– d—–w- c:\users\tiffany\appdata\local\{47BFA577-5235-4C3D-BD98-CBCCE9D12C34} 2011-09-13 06:23:10 ——– d—–w- c:\users\tiffany\appdata\local\{2819F226-85ED-41A8-A32F-336FAAC193E1} 2011-09-12 18:22:17 ——– d—–w- c:\users\tiffany\appdata\local\{8218C7D0-198B-484A-9088-6AD3D56DC33C} 2011-09-12 18:21:46 ——– d—–w- c:\users\tiffany\appdata\local\{0AA4BF52-B3FB-441E-90EF-EB6B38969023} 2011-09-12 06:21:26 ——– d—–w- c:\users\tiffany\appdata\local\{50850204-7779-4A2A-A0E1-2FDD48E3FB4A} 2011-09-12 06:21:15 ——– d—–w- c:\users\tiffany\appdata\local\{F47C22F1-5493-4401-BAD6-F69C84292A3D} 2011-09-12 06:21:03 ——– d—–w- c:\users\tiffany\appdata\local\{AB7C4E64-1AA0-42B0-8C8E-BAC6132CE50A} 2011-09-12 06:20:41 ——– d—–w- c:\users\tiffany\appdata\local\{62E93D8F-079B-4A07-A29A-4DE4223692D9} 2011-09-11 18:20:16 ——– d—–w- c:\users\tiffany\appdata\local\{37EDFA95-D405-405F-AAB2-E7D48E9C7E94} 2011-09-11 18:20:06 ——– d—–w- c:\users\tiffany\appdata\local\{DECC6529-5C4E-42BD-97D3-11B0B3C8A285} 2011-09-11 18:19:55 ——– d—–w- c:\users\tiffany\appdata\local\{60C7544C-DA04-4C32-A450-142B276C3946} 2011-09-11 06:19:36 ——– d—–w- c:\users\tiffany\appdata\local\{9561AC79-F5BB-4FF9-B420-A1C730415EAC} 2011-09-11 06:19:12 ——– d—–w- c:\users\tiffany\appdata\local\{F8DCE9F2-93E6-47D2-B0C7-D698746F6C6B} 2011-09-10 18:18:58 ——– d—–w- c:\users\tiffany\appdata\local\{20827E64-A151-43A1-987B-D58CD6EEA894} 2011-09-10 18:18:48 ——– d—–w- c:\users\tiffany\appdata\local\{76266C8E-DA1B-4060-9C81-AA7E881FF28F} 2011-09-10 18:18:38 ——– d—–w- c:\users\tiffany\appdata\local\{15566F8C-0E2E-4CE5-AB23-8938673D5264} 2011-09-10 18:18:16 ——– d—–w- c:\users\tiffany\appdata\local\{12006419-DE0D-4CC5-BF40-4BAEA93EEE25} 2011-09-10 06:17:57 ——– d—–w- c:\users\tiffany\appdata\local\{BD5E6B58-015B-4E69-B13E-A29F066F6F89} 2011-09-10 06:17:35 ——– d—–w- c:\users\tiffany\appdata\local\{6178B31D-25B2-4358-9000-A823FCFD6DB3} 2011-09-09 18:17:21 ——– d—–w- c:\users\tiffany\appdata\local\{AE5A2D1F-2D21-461D-AE61-B4AD9E2538B2} 2011-09-09 18:16:59 ——– d—–w- c:\users\tiffany\appdata\local\{5109254B-40E4-4CCE-BA02-8351B9A3CCDE} 2011-09-09 15:02:31 ——– d—–w- c:\program files\iPod 2011-09-09 15:02:28 ——– d—–w- c:\program files\iTunes 2011-09-09 14:49:10 ——– d—–w- c:\program files\Bonjour 2011-09-09 06:16:12 ——– d—–w- c:\users\tiffany\appdata\local\{D776DB01-E03C-4B46-9E87-E42145B56A3D} 2011-09-09 06:15:42 ——– d—–w- c:\users\tiffany\appdata\local\{AC7348E5-369A-41A3-BC04-625C74964792} 2011-09-08 18:15:28 ——– d—–w- c:\users\tiffany\appdata\local\{E66A9C99-50C3-47AD-9F5D-F38DBA71B904} 2011-09-08 18:15:07 ——– d—–w- c:\users\tiffany\appdata\local\{D99FD6AC-07EA-4A48-935B-4FF60DBE5928} 2011-09-08 06:14:53 ——– d—–w- c:\users\tiffany\appdata\local\{360B851D-1E59-4D64-9582-40DA72113FC7} 2011-09-08 06:14:43 ——– d—–w- c:\users\tiffany\appdata\local\{F6EF6240-1A1A-4A22-8860-D32C5032091B} 2011-09-07 18:14:26 ——– d—–w- c:\users\tiffany\appdata\local\{1E55EAC1-425C-4440-8923-0B5FFBAB19B8} 2011-09-07 18:14:04 ——– d—–w- c:\users\tiffany\appdata\local\{C585F4EF-6B5A-4EE5-925D-C65D897B0D7F} 2011-09-07 06:11:15 ——– d—–w- c:\users\tiffany\appdata\local\{BCFF3516-B865-4134-9681-82A7ED779903} 2011-09-06 18:09:25 ——– d—–w- c:\users\tiffany\appdata\local\{13860FC8-AA92-4473-85DD-CFD2D31D286E} 2011-09-06 18:09:13 ——– d—–w- c:\users\tiffany\appdata\local\{E6496ADD-4553-40BE-8CDF-B20658E42AEF} 2011-09-06 18:09:03 ——– d—–w- c:\users\tiffany\appdata\local\{8F5607C1-0626-4E80-8C26-804898AF973F} 2011-09-06 06:08:23 ——– d—–w- c:\users\tiffany\appdata\local\{3C558DBD-A304-4743-9DA9-61001146B9E6} 2011-09-05 18:07:47 ——– d—–w- c:\users\tiffany\appdata\local\{7550F73A-F78F-41D6-82C3-E60327F5A972} 2011-09-05 18:07:37 ——– d—–w- c:\users\tiffany\appdata\local\{6F90FCBF-1E02-436B-BC13-3E9A10D0ECDC} 2011-09-05 18:07:26 ——– d—–w- c:\users\tiffany\appdata\local\{BAA6D1D1-7459-4B75-B167-BCFF46916900} 2011-09-05 17:04:56 183696 —-a-w- c:\program files\mozilla firefox\plugins\nppdf32.dll 2011-09-05 17:04:56 183696 —-a-w- c:\program files\internet explorer\plugins\nppdf32.dll 2011-09-05 06:06:51 ——– d—–w- c:\users\tiffany\appdata\local\{7FD10398-8CE4-4C65-A5F1-0CFE9AE94D15} 2011-09-05 06:06:41 ——– d—–w- c:\users\tiffany\appdata\local\{B2A0B73B-583F-4FED-BE4C-03CE40BDFA8D} 2011-09-05 06:06:31 ——– d—–w- c:\users\tiffany\appdata\local\{314D7F61-5714-47BE-B46F-06F9EC808FE1} 2011-09-04 18:05:55 ——– d—–w- c:\users\tiffany\appdata\local\{2F1A0B83-4898-480F-A32C-819147C53F2C} 2011-09-04 18:05:45 ——– d—–w- c:\users\tiffany\appdata\local\{0C1A2D0A-F691-4CE0-8011-DD4FEBC0A7C6} 2011-09-04 18:05:35 ——– d—–w- c:\users\tiffany\appdata\local\{F43871A3-7C95-45C7-8C53-AC868813E998} 2011-09-04 06:04:58 ——– d—–w- c:\users\tiffany\appdata\local\{EB98BADE-FA12-4AC8-999D-3E3884FE910E} 2011-09-04 06:04:48 ——– d—–w- c:\users\tiffany\appdata\local\{D65206F7-CA55-4765-80E9-E69FB278DC2B} 2011-09-04 06:04:38 ——– d—–w- c:\users\tiffany\appdata\local\{C6C826CD-1D72-41A7-8BAF-A59C63CFD709} 2011-09-03 18:03:49 ——– d—–w- c:\users\tiffany\appdata\local\{55EC643C-8232-4669-BCDD-CB4BFCDB9CF7} 2011-09-03 18:03:38 ——– d—–w- c:\users\tiffany\appdata\local\{89DC500E-DC83-4AE8-B4AD-63FF71AF84FA} 2011-09-03 06:03:10 ——– d—–w- c:\users\tiffany\appdata\local\{94BFF87C-277A-461F-8C23-B4BB1BA622DE} 2011-09-02 18:02:34 ——– d—–w- c:\users\tiffany\appdata\local\{6539A3DC-1CB4-403D-BAB1-A8AEC5EA3099} 2011-09-02 18:02:23 ——– d—–w- c:\users\tiffany\appdata\local\{1EC9D15C-6C00-43C3-95F1-2E1AA7D6B979} 2011-09-02 05:29:16 ——– d—–w- c:\users\tiffany\appdata\local\{22378196-8E09-49EF-89C3-1FDBC1B3B682} 2011-09-02 05:28:53 ——– d—–w- c:\users\tiffany\appdata\local\{C8762677-0602-4647-B817-66F00371FF9F} 2011-09-01 17:28:37 ——– d—–w- c:\users\tiffany\appdata\local\{A3AFD788-029F-43D3-96D2-72762FBC43A4} 2011-09-01 17:28:27 ——– d—–w- c:\users\tiffany\appdata\local\{44A48E7A-F54E-4ED6-AF3A-060B18000B95} 2011-09-01 17:28:16 ——– d—–w- c:\users\tiffany\appdata\local\{21404330-0AE7-4C81-A5EB-41410F6C0BC3} 2011-09-01 17:27:54 ——– d—–w- c:\users\tiffany\appdata\local\{6A601C66-8CAE-4A0A-BDCD-759A5F88CD3D} 2011-09-01 05:27:36 ——– d—–w- c:\users\tiffany\appdata\local\{E1D0616E-5786-45C2-9EFC-F2BB5D7A4F4A} 2011-09-01 05:27:13 ——– d—–w- c:\users\tiffany\appdata\local\{2DEC0258-1926-4F15-BD78-0F76551A8F10} . ==================== Find3M ==================== . 2011-07-12 15:20:54 83816 —-a-w- c:\windows\system32\dns-sd.exe 2011-07-12 15:20:54 73064 —-a-w- c:\windows\system32\dnssd.dll 2011-07-11 13:25:35 2048 —-a-w- c:\windows\system32\tzres.dll 2011-07-05 22:37:00 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx 2011-07-05 22:37:00 69632 —-a-w- c:\windows\system32\QuickTime.qts . ============= FINISH: 15:44:31.42 ===============