404 Not Found nginx on search sites only [Closed]

Getting 404 Not Found nginx in IE8 and Firefox 9 on search site google, bing, yahoo, etc.
Hosts file looks completely normal.
Scanned with MS Security Essentials, MBAM, AdAware, MS Safety Scan, Spybot
Ran full scan in safe mode.
Any thoughts?
Thanks.

HijackThis Log:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:37:07 PM, on 1/22/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\WINDOWS\ehome\ehSched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\WINDOWS\LTMSG.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Eric Miller\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.accuweather.com/us/ny/bellmore/…=1&metric=0
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\Hewlett-Packard\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Virtual Account Numbers Helper - {17424104-1444-4810-85D7-B4DA413C5A9A} - C:\Program Files\Virtual Account Numbers\CitiVANHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\Hewlett-Packard\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Virtual Account Numbers - {7A21A046-B886-4A62-9D69-EF2059B0A27B} - C:\Program Files\Virtual Account Numbers\CitiVANToolbar.dll
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Squeezebox Server Tray Tool.lnk = C:\Program Files\Squeezebox\SqueezeTray.exe
O4 - Global Startup: Task Manager.lnk = C:\WINDOWS\system32\taskmgr.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_02\bin\npjpi141_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_02\bin\npjpi141_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\Hewlett-Packard\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) -
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/Dcode/ActiveX/MSDcode.cab
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} -
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase6770.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1177864000921
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1273550783156
O16 - DPF: {A5A76EA0-7B92-4707-9DBF-6F6FE56A6800} (Pure Networks Security Scan) - http://scan.networkmagic.com/nmscan/downlo…-ship-WD.V1.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O18 - Filter hijack: text/html - {a2c55bcc-375c-4820-8afd-cfdae24ce740} - (no file)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft Limited - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\system32\HPHipm11.exe

–
End of file - 9393 bytes

Thanks for getting back to me. Here are the two files: . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 Run by [removed] at 20:16:23 on 2012-01-24 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2559.1959 [GMT -5:00] . AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095} . ============== Running Processes =============== . C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe svchost.exe C:\WINDOWS\ehome\ehSched.exe C:\WINDOWS\system32\svchost.exe -k hpdevmgmt C:\WINDOWS\system32\svchost.exe -k HPService C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Multimedia Card Reader\shwicon2k.exe C:\WINDOWS\LTMSG.exe C:\HP\KBD\KBD.EXE C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqbam08.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgpc01.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.accuweather.com/us/ny/bellmore/11710/forecast.asp?partner=accuweather&traveler=1&metric=0 uInternet Settings,ProxyOverride = localhost mWinlogon: Userinit=c:\windows\system32\userinit.exe BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hewlett-packard\digital imaging\smart web printing\hpswp_printenhancer.dll BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: Virtual Account Numbers Helper: {17424104-1444-4810-85d7-b4da413c5a9a} - c:\program files\virtual account numbers\CitiVANHelper.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hewlett-packard\digital imaging\smart web printing\hpswp_BHO.dll TB: HP View: {b2847e28-5d7d-4deb-8b67-05d28bcf79f5} - c:\program files\hewlett-packard\digital imaging\bin\hpdtlk02.dll TB: Virtual Account Numbers: {7a21a046-b886-4a62-9d69-ef2059b0a27b} - c:\program files\virtual account numbers\CitiVANToolbar.dll TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hewlett-packard\digital imaging\smart web printing\hpswp_bho.dll EB: {8F4902B6-6C04-4ade-8052-AA58578A21BD} - No File EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [CamMonitor] c:\program files\hewlett-packard\digital imaging\unload\hpqcmon.exe mRun: [HPHUPD05] c:\program files\hewlett-packard\{45b6180b-dcab-4093-8ee8-6164457517f0}\hphupd05.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [Sunkist2k] c:\program files\multimedia card reader\shwicon2k.exe mRun: [LTMSG] LTMSG.exe 7 mRun: [KBD] c:\hp\kbd\KBD.EXE mRun: [HPHUPD04] "c:\program files\hp photosmart 11\hphinstall\unipatch\hphupd04.exe" mRun: [Share-to-Web Namespace Daemon] c:\program files\hewlett-packard\hp share-to-web\hpgs2wnd.exe mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent mRun: [RIMBBLaunchAgent.exe] c:\program files\common files\research in motion\usb drivers\RIMBBLaunchAgent.exe mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpqtra08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\squeez~1.lnk - c:\program files\squeezebox\SqueezeTray.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\taskma~1.lnk - c:\windows\system32\taskmgr.exe uPolicies-system: EnableProfileQuota = 1 (0x1) IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hewlett-packard\digital imaging\smart web printing\hpswp_BHO.dll DPF: {00134F72-5284-44F7-95A8-52A619F70751} DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://support.microsoft.com/Dcode/ActiveX/MSDcode.cab DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6770.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177864000921 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1273550783156 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/1.4/jinstall-14_02-windows-i586.cab DPF: {A5A76EA0-7B92-4707-9DBF-6F6FE56A6800} - hxxp://scan.networkmagic.com/nmscan/download/WebDiag.4.5.8056.1-ship-WD.V1.cab DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} - hxxps://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/1.4/jinstall-14_02-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: DhcpNameServer = [removed] [removed] 192.168.1.1 TCP: Interfaces\{E8434A76-B489-4C6A-B5EF-F9FF4B5C8FFF} : DhcpNameServer = [removed] [removed] 192.168.1.1 Notify: AtiExtEvent - Ati2evxx.dll Notify: igfxcui - igfxsrvc.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\eric miller\application data\mozilla\firefox\profiles\bkrft1sn.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - component: c:\program files\virtual account numbers\components\SlimOrbAddonCitiVAN.dll FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll FF - plugin: c:\documents and settings\eric miller\local settings\application data\facebook\video\skype\npFacebookVideoCalling.dll FF - plugin: c:\documents and settings\eric miller\local settings\application data\google\update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: c:\program files\amazon\mp3 downloader\npAmazonMP3DownloaderPlugin.dll FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll FF - plugin: c:\program files\real\realone player\netscape6\nppl3260.dll FF - plugin: c:\program files\real\realone player\netscape6\nprjplug.dll FF - plugin: c:\program files\real\realone player\netscape6\nprpjplug.dll . ============= SERVICES / DRIVERS =============== . R0 $sys$cor;$sys$cor;c:\windows\system32\drivers\$sys$cor.sys [2004-10-6 18432] R1 $sys$crater;$sys$crater;c:\windows\system32\$sys$filesystem\crater.sys [2004-10-7 11904] R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648] R3 EvcapMaui;Emuzed EvcapMaui Device;c:\windows\system32\drivers\EvcapMau.sys [2003-8-15 177664] R3 P0630VID;Creative WebCam Live!;c:\windows\system32\drivers\P0630Vid.sys [2007-5-14 91830] S1 MpKsl0743d717;MpKsl0743d717;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e7dd0906-8e31-4c55-b50f-0dfcbd11bb89}\mpksl0743d717.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e7dd0906-8e31-4c55-b50f-0dfcbd11bb89}\MpKsl0743d717.sys [?] S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2010-12-30 36608] S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2011-12-23 2152152] S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2011-12-23 15232] S3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\drivers\sscebus.sys [2010-12-30 98560] S3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\drivers\sscemdfl.sys [2010-12-30 14848] S3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\drivers\sscemdm.sys [2010-12-30 123648] S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520] S4 BlackICE;BlackICE;c:\program files\network ice\blackice\blackd.exe [2007-4-29 651264] S4 CD_Proxy;XCP CD Proxy;c:\windows\cdproxyserv.exe –> c:\windows\CDProxyServ.exe [?] S4 FlipShareServer;FlipShare Server;c:\program files\flip video\flipshareserver\FlipShareServer.exe [2011-5-6 1085440] S4 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-12-30 238952] . =============== Created Last 30 ================ . 2012-01-25 00:44:24 6557240 —-a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{941f2bbe-34a9-4ed5-b5a1-9b07b19861a2}\mpengine.dll 2012-01-21 07:35:38 16432 —-a-w- c:\windows\system32\lsdelete.exe 2012-01-21 01:57:25 101720 —-a-w- c:\windows\system32\drivers\SBREDrv.sys 2012-01-21 01:54:56 ——– d—–w- c:\program files\Lavasoft 2012-01-19 03:49:18 ——– d—–w- c:\documents and settings\eric miller\local settings\application data\NPE 2012-01-19 03:49:18 ——– d—–w- c:\documents and settings\all users\application data\Norton 2012-01-14 13:40:25 6557240 —-a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll 2012-01-14 04:40:23 222080 ——w- c:\windows\system32\MpSigStub.exe 2012-01-14 04:38:23 ——– d—–w- c:\program files\Microsoft Security Client 2012-01-11 03:46:06 ——– d—–w- c:\documents and settings\eric miller\local settings\application data\HandlerMapsvc 2012-01-09 03:17:47 626688 —-a-w- c:\program files\mozilla firefox\msvcr80.dll 2012-01-09 03:17:47 548864 —-a-w- c:\program files\mozilla firefox\msvcp80.dll 2012-01-09 03:17:47 479232 —-a-w- c:\program files\mozilla firefox\msvcm80.dll 2012-01-09 03:17:47 43992 —-a-w- c:\program files\mozilla firefox\mozutils.dll 2012-01-02 22:23:56 5632 —-a-w- c:\windows\system32\ptpusb.dll 2012-01-02 22:23:51 159232 —-a-w- c:\windows\system32\ptpusd.dll 2012-01-02 22:16:51 ——– d—–w- c:\program files\iPod 2012-01-02 22:10:12 ——– d—–w- c:\program files\Bonjour . ==================== Find3M ==================== . 2012-01-23 04:08:45 26112 —-a-w- c:\windows\system32\userinit.exe 2011-12-10 20:24:06 20464 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-11-25 21:57:19 293376 —-a-w- c:\windows\system32\winsrv.dll 2011-11-23 13:25:32 1859584 —-a-w- c:\windows\system32\win32k.sys 2011-11-18 12:35:08 60416 —-a-w- c:\windows\system32\packager.exe 2011-11-17 03:33:56 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-11-04 19:20:51 916992 —-a-w- c:\windows\system32\wininet.dll 2011-11-04 19:20:51 43520 —-a-w- c:\windows\system32\licmgr10.dll 2011-11-04 19:20:51 1469440 ——w- c:\windows\system32\inetcpl.cpl 2011-11-04 11:23:59 385024 —-a-w- c:\windows\system32\html.iec 2011-11-03 15:28:36 386048 —-a-w- c:\windows\system32\qdvd.dll 2011-11-03 15:28:36 1292288 —-a-w- c:\windows\system32\quartz.dll 2011-11-01 16:07:10 1288704 —-a-w- c:\windows\system32\ole32.dll 2011-10-28 05:31:48 33280 —-a-w- c:\windows\system32\csrsrv.dll 2003-08-27 18:19:18 36963 ——w- c:\program files\common files\SM1updtr.dll . ============= FINISH: 20:19:18.84 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume2 Install Date: 4/29/2007 9:45:56 AM System Uptime: 1/24/2012 7:33:09 PM (1 hours ago) . Motherboard: ASUSTeK Computer INC. | | Yale Processor: Intel® Pentium® 4 CPU 2.80GHz | CPU 1 | 2800/200mhz . ==== Disk Partitions ========================= . A: is Removable C: is FIXED (NTFS) - 293 GiB total, 179.197 GiB free. D: is FIXED (FAT32) - 5 GiB total, 0.901 GiB free. E: is CDROM () F: is CDROM () G: is Removable H: is Removable I: is Removable J: is Removable K: is Removable . ==== Disabled Device Manager Items ============= . Class GUID: {6BDD1FC6-810F-11D0-BEC7-08002BE2092F} Description: Photosmart Prem C310 series Device ID: ROOT\IMAGE\0000 Manufacturer: HP Name: Prem C310,192.168.1.101 PNP Device ID: ROOT\IMAGE\0000 Service: StillCam . Class GUID: {4D36E971-E325-11CE-BFC1-08002BE10318} Description: Photosmart Prem C310 series Device ID: ROOT\MULTIFUNCTION\0000 Manufacturer: HP Name: Photosmart Prem C310 series PNP Device ID: ROOT\MULTIFUNCTION\0000 Service: . ==== System Restore Points =================== . RP1231: 10/28/2011 9:08:44 PM - System Checkpoint RP1232: 10/30/2011 7:05:35 PM - System Checkpoint RP1233: 11/1/2011 10:16:17 PM - System Checkpoint RP1234: 11/3/2011 9:38:01 PM - System Checkpoint RP1235: 11/5/2011 1:39:11 AM - System Checkpoint RP1236: 11/6/2011 8:51:52 PM - System Checkpoint RP1237: 11/7/2011 9:09:53 PM - System Checkpoint RP1238: 11/8/2011 11:19:54 PM - System Checkpoint RP1239: 11/9/2011 7:40:44 PM - Software Distribution Service 3.0 RP1240: 11/10/2011 9:11:34 PM - System Checkpoint RP1241: 11/11/2011 12:47:00 AM - Software Distribution Service 3.0 RP1242: 11/13/2011 6:51:53 PM - System Checkpoint RP1243: 11/14/2011 7:25:43 PM - System Checkpoint RP1244: 11/20/2011 10:38:58 AM - System Checkpoint RP1245: 11/21/2011 8:32:12 PM - System Checkpoint RP1246: 11/23/2011 4:54:52 PM - System Checkpoint RP1247: 11/24/2011 7:44:36 PM - System Checkpoint RP1248: 11/26/2011 7:23:22 PM - System Checkpoint RP1249: 11/29/2011 7:21:45 PM - System Checkpoint RP1250: 12/3/2011 2:21:09 PM - System Checkpoint RP1251: 12/4/2011 7:08:49 PM - System Checkpoint RP1252: 12/6/2011 7:45:18 PM - System Checkpoint RP1253: 12/7/2011 10:46:25 PM - System Checkpoint RP1254: 12/9/2011 11:46:06 PM - System Checkpoint RP1255: 12/11/2011 7:37:22 PM - System Checkpoint RP1256: 12/12/2011 8:10:33 PM - System Checkpoint RP1257: 12/13/2011 8:51:41 PM - System Checkpoint RP1258: 12/15/2011 6:19:29 PM - Software Distribution Service 3.0 RP1259: 12/16/2011 7:30:32 PM - System Checkpoint RP1260: 12/19/2011 8:27:21 PM - System Checkpoint RP1261: 12/20/2011 11:18:04 PM - System Checkpoint RP1262: 12/21/2011 11:24:20 PM - System Checkpoint RP1263: 12/23/2011 6:27:48 PM - System Checkpoint RP1264: 12/25/2011 9:00:47 AM - System Checkpoint RP1265: 12/29/2011 6:48:02 PM - System Checkpoint RP1266: 12/31/2011 9:26:54 AM - System Checkpoint RP1267: 1/1/2012 2:29:30 PM - System Checkpoint RP1268: 1/2/2012 11:00:07 AM - Removed Bonjour RP1269: 1/2/2012 11:01:35 AM - Removed Documents To Go RP1270: 1/2/2012 11:07:14 AM - Removed MUSICMATCH Media Center RP1271: 1/2/2012 11:09:11 AM - Removed Netflix Movie Viewer RP1272: 1/3/2012 10:24:20 PM - System Checkpoint RP1273: 1/7/2012 5:13:07 PM - System Checkpoint RP1274: 1/9/2012 10:26:17 PM - Software Distribution Service 3.0 RP1275: 1/10/2012 11:48:11 PM - Software Distribution Service 3.0 RP1276: 1/13/2012 10:47:41 AM - System Checkpoint RP1277: 1/13/2012 11:40:22 PM - Software Distribution Service 3.0 RP1278: 1/14/2012 5:56:09 AM - Microsoft Antimalware Checkpoint RP1279: 1/14/2012 8:39:59 AM - Software Distribution Service 3.0 RP1280: 1/15/2012 10:19:19 AM - Software Distribution Service 3.0 RP1281: 1/15/2012 1:20:57 PM - Removed Sonic Update Manager RP1282: 1/16/2012 7:55:00 PM - Software Distribution Service 3.0 RP1283: 1/18/2012 4:25:13 AM - System Checkpoint RP1284: 1/18/2012 6:27:17 AM - Software Distribution Service 3.0 RP1285: 1/18/2012 10:14:51 PM - Software Distribution Service 3.0 RP1286: 1/18/2012 11:21:47 PM - Norton_Power_Eraser_20120118232140125 RP1287: 1/19/2012 9:52:02 PM - Software Distribution Service 3.0 RP1288: 1/20/2012 8:54:08 PM - Installed Ad-Aware RP1289: 1/20/2012 8:54:53 PM - Installed Ad-Aware RP1290: 1/21/2012 8:50:04 AM - Software Distribution Service 3.0 RP1291: 1/22/2012 12:44:00 PM - Software Distribution Service 3.0 RP1292: 1/23/2012 7:29:20 PM - Software Distribution Service 3.0 RP1293: 1/24/2012 7:44:22 PM - Software Distribution Service 3.0 . ==== Installed Programs ====================== . Sansa Media Converter 32 Bit HP CIO Components Installer 3ivx MPEG-4 5.0.3 (remove only) AAC Decoder Ad-Aware Adobe Flash Player 10 ActiveX Adobe Flash Player 11 Plugin Adobe Reader 7.0.9 Amazon MP3 Downloader 1.0.15 AnyDVD AOL Instant Messenger Apple Application Support Apple Mobile Device Support Apple Software Update ArcSoft Multimedia Email ArcSoft PhotoImpression 5 ArcSoft ShowBiz 2 ATI - Software Uninstall Utility ATI Control Panel ATI Display Driver AutoUpdate Avanquest update BlackBerry Desktop Software 6.1 Bluetooth Stack for Windows Bonjour BufferChm C310 CardRecovery 5.30 Cisco Connect CloneDVD2 Compatibility Pack for the 2007 Office system Creative WebCam Center Creative WebCam Live! Driver (1.01.01.0730) Creative WebCam Live! User's Guide (English) CreativeProjects CutePDF Writer 2.8 Cypress USB Mass Storage Driver Installation Destinations DeviceDiscovery DivX Codec DivX Player DivX Plus DirectShow Filters DivX Version Checker DivX Web Player DVD Decrypter (Remove Only) DVD Shrink 3.2 Enhanced Multimedia Keyboard Solution Facebook Video Calling 1.1.0.13 Family Lawyer Deluxe 8.0 FlipShare Google Chrome Google Earth GPBaseService2 H.264 Decoder HijackThis 1.99.1 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows XP (KB2443685) Hotfix for Windows XP (KB2570791) Hotfix for Windows XP (KB2633952) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976098-v2) Hotfix for Windows XP (KB979306) Hotfix for Windows XP (KB981793) HP Deskjet Preloaded Printer Drivers HP Imaging Device Functions 14.0 HP Instant Support HP Photo & Imaging 3.0 HP Photo and Imaging 2.0 - Photosmart Cameras HP Photo and Imaging 2.0 - Photosmart Printer Series HP Photo Creations HP Photosmart Prem C310 All-In-One Driver Software 14.0 Rel. 7 HP Smart Web Printing 4.60 HP Solution Center 14.0 HP Unload DLL Patch HP Update HPAppStudio HPDiagnosticAlert HPImageZone HPIZ Fix2 hpmdtab HPProductAssistant HpSdpAppCoreApp HPSystemDiagnostics InstantShare InstantShareAlert Intel® Extreme Graphics 2 Driver InterVideo WinDVD Player iTunes Java 2 Runtime Environment, SE v1.4.1_02 Java Web Start Logitech Music Anywhere Settings Malwarebytes Anti-Malware version 1.60.0.1800 Memories Disc Creator 2.0 Microsoft .NET Framework 1.0 Hotfix (KB2572066) Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB2656353) Microsoft .NET Framework 1.1 Security Update (KB979906) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Antimalware Microsoft Application Error Reporting Microsoft Internationalized Domain Names Mitigation APIs Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft Kernel-Mode Driver Framework Feature Pack 1.9 Microsoft National Language Support Downlevel APIs Microsoft Office 2000 Premium Microsoft Office File Validation Add-In Microsoft Office Small Business Edition 2003 Microsoft Plus! Digital Media Edition Microsoft Security Client Microsoft Security Essentials Microsoft Silverlight Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual J# .NET Redistributable Package 1.1 Microsoft Works 7.0 MKV Splitter MobileMe Control Panel Mozilla Firefox 9.0.1 (x86 en-US) MSVC80_x86_v2 MSVC90_x86 MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 6 Service Pack 2 (KB973686) Multimedia Card Reader muvee Plugin 1.0 Network NewsBin Pro Orban/Coding Technologies AAC/aacPlus Player Plugin™ 1.0 Palm PC-Doctor for Windows PC Connectivity Solution PhotoGallery Photosmart 130,230,7150,7345,7350,7550 (Remove only) Photosmart 140,240,7200,7600,7700,7900 Series PocketMirror (Standard Edition) 4.3.0 PrintScreen PS_AIO_07_C310_SW_Min PS2 PSShortcutsP Python 2.2 combined Win32 extensions QFolder Quicken 2009 QuickPar 0.9 QuickProjects QuickTime QuickTransfer RealNetworks - Microsoft Visual C++ 2008 Runtime RealPlayer Realtek AC'97 Audio RealUpgrade 1.1 RecordNow! Roxio Burn Engine Roxio Easy Media Creator 7 Samsung New PC Studio SAMSUNG USB Driver for Mobile Phones Savings Bond Wizard Scan Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft Windows (KB2564958) Security Update for Step By Step Interactive Training (KB898458) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows Internet Explorer 7 (KB929969) Security Update for Windows Internet Explorer 7 (KB931768) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows Internet Explorer 7 (KB937143) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB939653) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Internet Explorer 7 (KB963027) Security Update for Windows Internet Explorer 8 (KB2482017) Security Update for Windows Internet Explorer 8 (KB2497640) Security Update for Windows Internet Explorer 8 (KB2510531) Security Update for Windows Internet Explorer 8 (KB2530548) Security Update for Windows Internet Explorer 8 (KB2544521) Security Update for Windows Internet Explorer 8 (KB2559049) Security Update for Windows Internet Explorer 8 (KB2586448) Security Update for Windows Internet Explorer 8 (KB2618444) Security Update for Windows Internet Explorer 8 (KB969897) Security Update for Windows Internet Explorer 8 (KB971961) Security Update for Windows Internet Explorer 8 (KB972260) Security Update for Windows Internet Explorer 8 (KB974455) Security Update for Windows Internet Explorer 8 (KB976325) Security Update for Windows Internet Explorer 8 (KB978207) Security Update for Windows Internet Explorer 8 (KB981332) Security Update for Windows Internet Explorer 8 (KB982381) Security Update for Windows Media Player (KB2378111) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player (KB975558) Security Update for Windows Media Player (KB978695) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 10 (KB936782) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows XP (KB2079403) Security Update for Windows XP (KB2115168) Security Update for Windows XP (KB2121546) Security Update for Windows XP (KB2229593) Security Update for Windows XP (KB2259922) Security Update for Windows XP (KB2296011) Security Update for Windows XP (KB2347290) Security Update for Windows XP (KB2360937) Security Update for Windows XP (KB2387149) Security Update for Windows XP (KB2393802) Security Update for Windows XP (KB2412687) Security Update for Windows XP (KB2419632) Security Update for Windows XP (KB2423089) Security Update for Windows XP (KB2440591) Security Update for Windows XP (KB2443105) Security Update for Windows XP (KB2476490) Security Update for Windows XP (KB2476687) Security Update for Windows XP (KB2478960) Security Update for Windows XP (KB2478971) Security Update for Windows XP (KB2479628) Security Update for Windows XP (KB2479943) Security Update for Windows XP (KB2481109) Security Update for Windows XP (KB2483185) Security Update for Windows XP (KB2485376) Security Update for Windows XP (KB2485663) Security Update for Windows XP (KB2491683) Security Update for Windows XP (KB2503658) Security Update for Windows XP (KB2503665) Security Update for Windows XP (KB2506212) Security Update for Windows XP (KB2506223) Security Update for Windows XP (KB2507618) Security Update for Windows XP (KB2507938) Security Update for Windows XP (KB2508272) Security Update for Windows XP (KB2508429) Security Update for Windows XP (KB2509553) Security Update for Windows XP (KB2511455) Security Update for Windows XP (KB2524375) Security Update for Windows XP (KB2535512) Security Update for Windows XP (KB2536276-v2) Security Update for Windows XP (KB2536276) Security Update for Windows XP (KB2544893-v2) Security Update for Windows XP (KB2544893) Security Update for Windows XP (KB2555917) Security Update for Windows XP (KB2562937) Security Update for Windows XP (KB2566454) Security Update for Windows XP (KB2567053) Security Update for Windows XP (KB2567680) Security Update for Windows XP (KB2570222) Security Update for Windows XP (KB2570947) Security Update for Windows XP (KB2584146) Security Update for Windows XP (KB2592799) Security Update for Windows XP (KB2598479) Security Update for Windows XP (KB2603381) Security Update for Windows XP (KB2618451) Security Update for Windows XP (KB2619339) Security Update for Windows XP (KB2620712) Security Update for Windows XP (KB2624667) Security Update for Windows XP (KB2631813) Security Update for Windows XP (KB2633171) Security Update for Windows XP (KB2639417) Security Update for Windows XP (KB2646524) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971468) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975561) Security Update for Windows XP (KB975562) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB977165) Security Update for Windows XP (KB977816) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978037) Security Update for Windows XP (KB978251) Security Update for Windows XP (KB978262) Security Update for Windows XP (KB978338) Security Update for Windows XP (KB978542) Security Update for Windows XP (KB978601) Security Update for Windows XP (KB978706) Security Update for Windows XP (KB979309) Security Update for Windows XP (KB979482) Security Update for Windows XP (KB979559) Security Update for Windows XP (KB979683) Security Update for Windows XP (KB979687) Security Update for Windows XP (KB980195) Security Update for Windows XP (KB980218) Security Update for Windows XP (KB980232) Security Update for Windows XP (KB980436) Security Update for Windows XP (KB981322) Security Update for Windows XP (KB981997) Security Update for Windows XP (KB982132) Security Update for Windows XP (KB982214) Security Update for Windows XP (KB982665) SkinsHP1 SkinsHP2 SmartWebPrinting SolutionCenter Spybot - Search & Destroy Squeezebox Server 7.6.0 Status Toolbox TrayApp Unload Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Windows Internet Explorer 8 (KB972636) Update for Windows Internet Explorer 8 (KB976662) Update for Windows Internet Explorer 8 (KB976749) Update for Windows Internet Explorer 8 (KB980182) Update for Windows XP (KB2141007) Update for Windows XP (KB2345886) Update for Windows XP (KB2541763) Update for Windows XP (KB2607712) Update for Windows XP (KB2616676) Update for Windows XP (KB2641690) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB955839) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971029) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) USB Storage Adapter FX (SM1) VC80CRTRedist - 8.0.50727.762 Virtual Account Numbers Visual J# .NET Redistributable Package WeatherBug WebFldrs XP WebReg Winamp Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage Validation Tool (KB892130) Windows Imaging Component Windows Internet Explorer 8 Windows Live ID Sign-in Assistant Windows Live OneCare safety scanner Windows Media Format Runtime Windows Media Player 10 Windows Presentation Foundation Windows XP Service Pack 3 WinRAR archiver XML Paper Specification Shared Components Pack 1.0 . ==== Event Viewer Messages From Past Week ======== . 1/21/2012 11:46:25 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 1/21/2012 11:46:18 PM, error: Service Control Manager [7034] - The Lavasoft Ad-Aware Service service terminated unexpectedly. It has done this 1 time(s). 1/20/2012 7:49:02 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 1/19/2012 9:49:46 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 1/19/2012 9:49:45 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s). 1/19/2012 11:06:51 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD cdudf_xp Cinemsup ElbyCDIO Fips intelppm IPSec MpFilter MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip Tosrfcom 1/19/2012 11:06:51 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning. 1/19/2012 11:06:51 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 1/19/2012 11:06:51 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBT service which failed to start because of the following error: A device attached to the system is not functioning. 1/19/2012 11:06:51 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 1/19/2012 11:06:32 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E} 1/18/2012 11:31:01 PM, error: Print [19] - Sharing printer failed + 1722, Printer HP Photosmart Prem C310 series share name Printer6. . ==== End Of File ===========================

Hi itpro52d,

your logs indicate a few minor items but nothing so far that explains the symptoms that you described so I think we should take a deeper look.


Step 1
Back up registry with ERUNT

• Please download ERUNT by Lars Hederer and save it to your desktop. alternate download
• Double click erunt-setup-exe and follow the prompts to install ERUNT using the default settings.
• When asked if you want to add ERUNT to the Start-up folder select NO
• Make sure the box marked launch ERUNT is checked and click Finish
• Follow the prompts to create a backup to the default location.
• under backup options make sure both the following are selected:
  
  • System registry.
  • Current user registry.
• When you see a pop up message saying Registry backup is complete! click OK to finish. If you do not see this message DO NOT continue let me know.

Step 2
MGADiag.exe

• Please download MGA Diagnostic Tool and save it to your Desktop.
• Double click on MGADiag.exe to run it.
• Click Continue.
• The program will run. It takes a while to finish the diagnosis, please be patient.
• Once done, click on Copy.
• Open Notepad and paste the contents in the window.
• Save this file and copy/paste it in your next reply.

Step 3
OTL
Please download OTL … by Old Timer . Save it to your Desktop.

• Double click on OTL.exe to run it.
• Click the Scan All Users checkbox.
  Leave the remaining selections to the default settings.
• Click on Run Scan at the top left hand corner.
• When done, two Notepad files will open.
  
  • OTL.txt <– Will be opened, maximized
  • Extras.txt <– Will be minimized on task bar.
• Please post the contents of both OTL.txt and Extras.txt files in your next reply.

Step 4
TDSSKiller
Please download the TDSSKiller.exe by Kaspersky… save it to your Desktop. Note: It is VERY IMPORTANT to run this from your desktop.

• Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
  If TDSSKiller does not run… rename it. Right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. abc123.com).
• Click the Start Scan button. Do not use the computer during the scan!
• If the scan completes with nothing found, click Close to exit.
• If any suspicious or malicious objects are detected ensure Skip is selected then click Continue. Do not attempt to fix anything yet!
• A log file named TDSSKiller_version_dd.mm.yyyy_hh.mm.ss_log.txt will be created and saved to the root directory. (usually Local Disk C:).
• Copy and paste the contents of that file in your next reply.

What is this computer used for?


Please include in your next reply:

• MGADiag log
• OTL.txt
• Extras.txt
• TDSSKiller log
• Answer to my question

There has been some minor behavior changes. On occasion, Google will work for a day.
Also, there is some link redirects taking place.
OTL gave an error, but continued. See the error in the OTL section.
Kapersky identified a virus.
The PC is used for MS Office, Finances, browsing and music

================================================================================
====================

Diagnostic Report (1.9.0027.0):
—————————————–
Windows Validation Data–>
Validation Status: Genuine
Validation Code: 0
Cached Validation Code: N/A
Windows Product Key: *****-*****-9TCCK-JPCBM-B2FQ8
Windows Product Key Hash: B/IohRcCzV6LJrex8WpCdnxgTvg=
Windows Product ID: 55274-OEM-2211906-00803
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 5.1.2600.2.00010100.3.0.med
ID: {B192608D-BBE2-4BF5-AFD7-900CD8FB7D01}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: Registered, 1.7.69.2
Signed By: Microsoft
Product Name: N/A
Architecture: N/A
Build lab: N/A
TTS Error: N/A
Validation Diagnostic: 025D1FF3-230-1
Resolution Status: N/A

Vista WgaER Data–>
ThreatID(s): N/A
Version: N/A

Windows XP Notifications Data–>
Cached Result: 0
File Exists: Yes
Version: 1.7.18.5
WgaTray.exe Signed By: Microsoft
WgaLogon.dll Signed By: Microsoft

OGA Notifications Data–>
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data–>
Office Status: 100 Genuine
Microsoft Office Small Business Edition 2003 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-230-1_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005

Browser Data–>
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data–>

Other data–>
Office Details: {B192608D-BBE2-4BF5-AFD7-900CD8FB7D01}1.9.0027.05.1.2600.2.00010100.3.0.medx32*****-*****-*****-*****-B2FQ855274-OEM-2211906-008032S-1-5-21-4222450123-4265029411-704048292HP Pavilion 061DN108A-ABA m385cAmerican Megatrends Inc.3.28 20040827000000.000000+000HP PAVILION5ABD35EF0184807304090409Eastern Standard Time(GMT-05:00)02Hewlett-PackardPavilion100

Licensing Data–>
N/A

Windows Activation Technologies–>
N/A

HWID Data–>
N/A

OEM Activation 1.0 Data–>
BIOS string matches: yes
Marker string from BIOS: 14979:GENUINE C&C; INC|104FF:Hewlett-Packard Company
Marker string from OEMBIOS.DAT: HP PAVILION

OEM Activation 2.0 Data–>
N/A

===========================================================================
OTL gave the following error:
Exception Processing Message c0000013 Parameters 75b6f7c 4 75b6bf7c 75b6bf7c
After clicking Continue several times, it continued to run.

OTL logfile created on: 1/30/2012 10:25:50 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Eric Miller\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.50 Gb Total Physical Memory | 1.96 Gb Available Physical Memory | 78.35% Memory free
3.10 Gb Paging File | 2.55 Gb Available in Paging File | 82.16% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 293.15 Gb Total Space | 175.82 Gb Free Space | 59.98% Space Free | Partition Type: NTFS
Drive D: | 4.92 Gb Total Space | 0.90 Gb Free Space | 18.30% Space Free | Partition Type: FAT32

Computer Name: COMPUTERROOM | User Name: Eric Miller | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/01/30 22:24:59 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Eric Miller\Desktop\OTL.exe
PRC - [2012/01/08 22:17:46 | 000,924,632 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/06/15 15:16:48 | 000,997,920 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2011/04/27 15:39:26 | 000,011,736 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2010/04/16 02:39:12 | 000,565,096 | —- | M] (Hewlett-Packard Co.) – C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqbam08.exe
PRC - [2010/04/16 02:39:12 | 000,174,952 | —- | M] (Hewlett-Packard Co.) – C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe
PRC - [2009/11/18 04:42:52 | 000,275,072 | —- | M] (Hewlett-Packard Co.) – C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
PRC - [2009/11/17 20:49:08 | 000,366,720 | —- | M] (Hewlett-Packard) – C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgpc01.exe
PRC - [2009/10/14 19:52:56 | 000,329,088 | —- | M] (Intuit Inc.) – C:\Program Files\Quicken\qw.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2003/08/09 10:27:16 | 000,139,264 | —- | M] (Alcor Micro, Corp.) – C:\Program Files\Multimedia Card Reader\shwicon2k.exe
PRC - [2003/07/14 09:52:44 | 000,040,960 | —- | M] (Agere Systems) – C:\WINDOWS\ltmsg.exe
PRC - [2002/10/07 09:23:20 | 000,090,112 | —- | M] () – C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqCmon.exe
PRC - [2002/04/17 09:49:16 | 000,077,824 | —- | M] () – C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
PRC - [2002/04/17 09:42:56 | 000,069,632 | —- | M] (Hewlett-Packard) – C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe


========== Modules (No Company Name) ==========

MOD - [2012/01/08 22:17:45 | 002,124,760 | —- | M] () – C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011/09/27 06:23:00 | 000,087,912 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/09/27 06:22:40 | 001,242,472 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2009/11/05 07:39:40 | 000,087,552 | —- | M] () – C:\WINDOWS\system32\cpwmon2k.dll
MOD - [2008/08/19 09:46:52 | 000,490,272 | —- | M] () – C:\Program Files\Quicken\alrtint8.dll
MOD - [2008/04/13 19:11:51 | 000,059,904 | —- | M] () – C:\WINDOWS\system32\devenum.dll
MOD - [2006/09/13 23:20:24 | 000,126,464 | —- | M] () – C:\Program Files\WinRAR\RarExt.dll
MOD - [2005/03/08 19:50:22 | 000,172,032 | —- | M] () – C:\Program Files\Roxio\Easy Media Creator 7\Creator Classic\TargetFinder.dll
MOD - [2004/07/20 16:04:02 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\TosBtHcrpAPI.dll
MOD - [2003/06/17 01:57:56 | 000,163,840 | —- | M] () – C:\Program Files\Hewlett-Packard\Digital Imaging\bin\HpqUtil.dll
MOD - [2002/10/07 09:23:20 | 000,090,112 | —- | M] () – C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqCmon.exe
MOD - [2002/07/04 08:38:00 | 000,053,248 | —- | M] () – C:\Program Files\ArcSoft\PhotoImpression 5\Share\PIHook.dll
MOD - [2002/04/17 09:49:22 | 000,024,576 | —- | M] () – C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnfps.dll
MOD - [2002/04/17 09:49:16 | 000,077,824 | —- | M] () – C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] – – (CD_Proxy)
SRV - [2012/01/20 20:57:14 | 002,152,152 | —- | M] (Lavasoft Limited) [On_Demand | Stopped] – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe – (Lavasoft Ad-Aware Service)
SRV - [2011/05/06 12:07:18 | 000,460,144 | —- | M] () [Disabled | Stopped] – C:\Program Files\Flip Video\FlipShare\FlipShareService.exe – (FlipShare Service)
SRV - [2011/05/06 11:58:52 | 001,085,440 | —- | M] () [Disabled | Stopped] – C:\Program Files\Flip Video\FlipShareServer\FlipShareServer.exe – (FlipShareServer)
SRV - [2011/04/27 15:39:26 | 000,011,736 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe – (MsMpSvc)
SRV - [2010/07/04 19:07:40 | 000,238,952 | —- | M] (Teruten) [Disabled | Stopped] – C:\WINDOWS\system32\FsUsbExService.Exe – (FsUsbExService)
SRV - [2010/06/14 14:07:14 | 000,615,936 | —- | M] (Nokia) [Disabled | Stopped] – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe – (ServiceLayer)
SRV - [2010/01/29 23:40:52 | 000,700,032 | —- | M] (Hewlett-Packard Co.) [Auto | Running] – C:\Program Files\Hewlett-Packard\Digital Imaging\bin\HPSLPSVC32.DLL – (HPSLPSVC)
SRV - [2009/11/18 04:16:42 | 000,253,568 | —- | M] (Hewlett-Packard Co.) [On_Demand | Running] – C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqcxs08.dll – (hpqcxs08)
SRV - [2009/11/18 04:16:42 | 000,137,344 | —- | M] (Hewlett-Packard Co.) [Auto | Running] – C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqddsvc.dll – (hpqddsvc)
SRV - [2002/11/22 14:49:22 | 000,077,824 | —- | M] (HP) [On_Demand | Stopped] – C:\WINDOWS\system32\hphipm11.exe – (Pml Driver HPH11)
SRV - [2001/12/19 13:54:44 | 000,651,264 | R— | M] (Internet Security Systems, Inc.) [Disabled | Stopped] – C:\Program Files\Network ICE\BlackICE\blackd.exe – (BlackICE)


========== Driver Services (SafeList) ==========

DRV - [2011/12/23 07:12:10 | 000,015,232 | —- | M] () [Kernel | On_Demand | Stopped] – C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys – (Lavasoft Kernexplorer)
DRV - [2010/06/14 09:32:54 | 000,036,608 | —- | M] () [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\FsUsbExDisk.Sys – (FsUsbExDisk)
DRV - [2010/04/26 21:25:20 | 000,123,648 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\sscemdm.sys – (sscemdm)
DRV - [2010/04/26 21:25:20 | 000,098,560 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\sscebus.sys – (sscebus) SAMSUNG USB Composite Device V2 driver (WDM)
DRV - [2010/04/26 21:25:20 | 000,014,848 | —- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\sscemdfl.sys – (sscemdfl)
DRV - [2008/05/06 15:06:00 | 000,011,520 | —- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\wdcsam.sys – (WDC_SAM)
DRV - [2008/04/13 13:45:34 | 000,046,592 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\irbus.sys – (IrBus)
DRV - [2007/10/11 11:27:37 | 000,096,832 | —- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AnyDVD.sys – (AnyDVD)
DRV - [2007/06/18 19:18:26 | 000,023,680 | —- | M] (Motorola) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\motmodem.sys – (motmodem)
DRV - [2007/05/14 21:35:59 | 000,022,768 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\usbsermpt.sys – (usbsermpt)
DRV - [2007/05/14 20:57:23 | 000,016,694 | —- | M] (PalmSource, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\PalmUSBD.sys – (PalmUSBD)
DRV - [2007/04/29 11:23:36 | 000,043,672 | —- | M] (Oak Technology Inc.) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\AFS2K.SYS – (AFS2K)
DRV - [2007/03/07 18:51:00 | 000,009,464 | —- | M] (Sonic Solutions) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\cdralw2k.sys – (Cdralw2k)
DRV - [2007/03/07 18:51:00 | 000,009,336 | —- | M] (Sonic Solutions) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\cdr4_xp.sys – (Cdr4_xp)
DRV - [2007/02/15 19:56:49 | 000,011,984 | —- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ElbyDelay.sys – (ElbyDelay)
DRV - [2006/03/16 09:45:12 | 000,037,632 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\tosrfbnp.sys – (tosrfbnp)
DRV - [2006/03/15 09:52:40 | 000,052,864 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\tosrfsnd.sys – (TosRfSnd)
DRV - [2006/02/24 00:37:00 | 000,040,192 | —- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\tosrfusb.sys – (Tosrfusb)
DRV - [2006/02/21 19:46:26 | 001,505,792 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ati2mtag.sys – (ati2mtag)
DRV - [2006/02/10 10:17:46 | 000,047,488 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tosporte.sys – (tosporte)
DRV - [2006/02/08 16:33:34 | 000,062,848 | —- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\tosrfhid.sys – (Tosrfhid)
DRV - [2006/02/02 22:16:08 | 000,108,928 | —- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\tosrfbd.sys – (tosrfbd)
DRV - [2005/12/12 16:27:00 | 000,019,072 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\PS2.sys – (Ps2)
DRV - [2005/08/01 15:45:08 | 000,064,896 | —- | M] (TOSHIBA Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\tosrfcom.sys – (Tosrfcom)
DRV - [2005/07/11 17:58:56 | 000,003,712 | —- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\toshidpt.sys – (toshidpt)
DRV - [2005/07/04 07:52:50 | 000,018,432 | —- | M] (First 4 Internet) [Kernel | Boot | Running] – C:\WINDOWS\System32\Drivers\$sys$cor.sys – ($sys$cor)
DRV - [2005/07/04 05:51:37 | 000,011,904 | —- | M] (First 4 Internet) [Kernel | System | Running] – C:\WINDOWS\system32\$sys$filesystem\crater.sys – ($sys$crater)
DRV - [2005/03/08 20:15:10 | 000,291,456 | —- | M] (Sonic Solutions) [File_System | System | Running] – C:\WINDOWS\System32\drivers\Cdudf_xp.sys – (cdudf_xp)
DRV - [2005/03/08 20:14:44 | 000,024,064 | —- | M] (Sonic Solutions) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\drivers\dvd_2k.sys – (dvd_2K)
DRV - [2005/03/08 20:05:30 | 000,141,184 | —- | M] (Windows ® 2000 DDK provider) [File_System | System | Running] – C:\WINDOWS\System32\drivers\DVDVRRdr_xp.sys – (DVDVRRdr_xp)
DRV - [2005/03/08 19:54:48 | 000,202,496 | —- | M] (Sonic Solutions) [File_System | System | Running] – C:\WINDOWS\System32\drivers\Udfreadr.sys – (UDFReadr)
DRV - [2005/03/08 19:53:56 | 000,023,808 | —- | M] (Sonic Solutions) [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\drivers\mmc_2k.sys – (mmc_2K)
DRV - [2005/03/08 19:38:32 | 000,117,760 | —- | M] (Sonic Solutions) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\Pwd_2k.sys – (pwd_2k)
DRV - [2005/01/06 12:42:42 | 000,018,612 | —- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\tosrfnds.sys – (tosrfnds)
DRV - [2004/10/01 09:24:00 | 002,279,424 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ALCXWDM.SYS – (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2004/07/29 20:55:48 | 000,091,830 | R— | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\P0630Vid.sys – (P0630VID)
DRV - [2003/12/19 01:00:00 | 000,006,656 | —- | M] (Sonic Solutions) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\cinemsup.sys – (Cinemsup)
DRV - [2003/12/12 18:03:10 | 000,652,689 | —- | M] (Agere Systems) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ltmdmnt.sys – (ltmodem5)
DRV - [2003/10/01 16:41:28 | 000,177,664 | —- | M] (Emuzed, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\EvcapMau.sys – (EvcapMaui)
DRV - [2003/09/03 09:01:22 | 000,010,368 | —- | M] (Padus, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\pfc.sys – (pfc)
DRV - [2003/08/09 09:49:44 | 000,029,436 | —- | M] (Alcor Micro Corp.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\sunkfiltp.sys – (Sunkfiltp)
DRV - [2002/11/22 14:49:22 | 000,050,896 | —- | M] (HP) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\hphid411.sys – (Dot4 HPH11)
DRV - [2002/11/22 14:49:22 | 000,050,276 | —- | M] (Hewlett-Packard) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\hphs2k11.sys – (Dot4Storage HPH11) Storage Class Driver for IEEE-1284.4 (HPH11)
DRV - [2002/11/22 14:49:22 | 000,018,928 | —- | M] (HP) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\hphius11.sys – (Dot4Usb HPH11)
DRV - [2002/11/22 14:49:22 | 000,016,112 | —- | M] (HP) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\hphipr11.sys – (Dot4Print HPH11)
DRV - [2002/10/04 19:04:10 | 000,046,976 | —- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\R8139n51.sys – (rtl8139)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-4222450123-4265029411-704048292-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.accuweather.com/us/ny/bellmore/…=1&metric;=0
IE - HKU\S-1-5-21-4222450123-4265029411-704048292-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-4222450123-4265029411-704048292-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.3.2
FF - prefs.js..extensions.enabledItems: citius@orbiscom:[removed]
FF - prefs.js..extensions.enabledItems: {888d99e7-e8b5-46a3-851e-1ec45da1e644}:4.0.2
FF - prefs.js..network.proxy.no_proxies_on: "localhost"

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.666: c:\program files\real\realone player\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.666: c:\program files\real\realone player\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.666: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.666: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.666: c:\program files\real\realone player\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\Eric Miller\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Eric Miller\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Eric Miller\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\citius@orbiscom: C:\Program Files\Virtual Account Numbers [2011/01/05 20:22:49 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Hewlett-Packard\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/02/28 23:40:27 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/09/03 15:59:19 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/01/08 22:17:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/01/02 17:06:53 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Hewlett-Packard\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/02/28 23:40:27 | 000,000,000 | —D | M]

[2008/09/02 20:31:35 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Eric Miller\Application Data\Mozilla\Extensions
[2012/01/17 23:39:53 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Eric Miller\Application Data\Mozilla\Firefox\Profiles\bkrft1sn.default\extensions
[2010/04/27 20:05:59 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Eric Miller\Application Data\Mozilla\Firefox\Profiles\bkrft1sn.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/01/17 23:39:53 | 000,000,000 | —D | M] (FEBE) – C:\Documents and Settings\Eric Miller\Application Data\Mozilla\Firefox\Profiles\bkrft1sn.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2009/07/10 17:26:08 | 000,002,257 | —- | M] () – C:\Documents and Settings\Eric Miller\Application Data\Mozilla\Firefox\Profiles\bkrft1sn.default\searchplugins\askcom.xml
[2010/03/22 21:01:41 | 000,005,500 | —- | M] () – C:\Documents and Settings\Eric Miller\Application Data\Mozilla\Firefox\Profiles\bkrft1sn.default\searchplugins\foodtv.xml
[2008/06/25 21:15:34 | 000,000,908 | —- | M] () – C:\Documents and Settings\Eric Miller\Application Data\Mozilla\Firefox\Profiles\bkrft1sn.default\searchplugins\IMDB.xml
[2008/06/25 21:15:34 | 000,001,108 | —- | M] () – C:\Documents and Settings\Eric Miller\Application Data\Mozilla\Firefox\Profiles\bkrft1sn.default\searchplugins\wikipedia.xml
[2012/01/27 21:48:27 | 000,002,214 | —- | M] () – C:\Documents and Settings\Eric Miller\Application Data\Mozilla\Firefox\Profiles\bkrft1sn.default\searchplugins\yahooligans.xml
[2011/03/23 23:28:55 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
() (No name found) – C:\DOCUMENTS AND SETTINGS\ERIC MILLER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\BKRFT1SN.DEFAULT\EXTENSIONS\{888D99E7-E8B5-46A3-851E-1EC45DA1E644}.XPI
() (No name found) – C:\DOCUMENTS AND SETTINGS\ERIC MILLER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\BKRFT1SN.DEFAULT\EXTENSIONS\{D09E32DF-8610-4B33-B929-1E631B764130}.XPI
[2012/01/08 22:17:47 | 000,121,816 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2005/12/05 22:31:00 | 000,114,688 | —- | M] () – C:\Program Files\mozilla firefox\plugins\npmozax.dll
[2010/01/01 03:00:00 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/11/09 23:24:19 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Documents and Settings\Eric Miller\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\

O1 HOSTS File: ([2012/01/06 23:03:33 | 000,000,736 | RHS- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\Hewlett-Packard\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Virtual Account Numbers Helper) - {17424104-1444-4810-85D7-B4DA413C5A9A} - C:\Program Files\Virtual Account Numbers\CitiVANHelper.dll (Orbiscom Ltd. All rights reserved.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\Hewlett-Packard\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (Virtual Account Numbers) - {7A21A046-B886-4A62-9D69-EF2059B0A27B} - C:\Program Files\Virtual Account Numbers\CitiVANToolbar.dll (Orbiscom Ltd. All rights reserved.)
O3 - HKLM\..\Toolbar: (HP View) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll (Hewlett-Packard Company)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-4222450123-4265029411-704048292-1007\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-4222450123-4265029411-704048292-1007\..\Toolbar\ShellBrowser: (HP View) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll (Hewlett-Packard Company)
O3 - HKU\S-1-5-21-4222450123-4265029411-704048292-1007\..\Toolbar\WebBrowser: (HP View) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll (Hewlett-Packard Company)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqCmon.exe ()
O4 - HKLM..\Run: [HPHUPD04] C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe (Hewlett-Packard)
O4 - HKLM..\Run: [LTMSG] C:\WINDOWS\ltmsg.exe (Agere Systems)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe (Hewlett-Packard)
O4 - HKLM..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe (Alcor Micro, Corp.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Squeezebox Server Tray Tool.lnk = C:\Program Files\Squeezebox\SqueezeTray.exe (SlimDevices - A Logitech Company)
O4 - Startup: C:\Documents and Settings\Default User\Start Menu\Programs\Startup\mod_sm.lnk = C:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-4222450123-4265029411-704048292-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-4222450123-4265029411-704048292-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableProfileQuota = 1
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)
O9 - Extra Button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\Hewlett-Packard\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} Reg Error: Value error. (ObjWinNTCheck Class)
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} https://support.microsoft.com/Dcode/ActiveX/MSDcode.cab (Microsoft Data Collection Control)
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} Reg Error: Value error. (Reg Error: Value error.)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2…78f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase6770.cab (Windows Live Safety Center Base Module)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1177864000921 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1273550783156 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/products/plugin/1.4/ji…indows-i586.cab (Java Plug-in 1.4.1_02)
O16 - DPF: {A5A76EA0-7B92-4707-9DBF-6F6FE56A6800} http://scan.networkmagic.com/nmscan/downlo…-ship-WD.V1.cab (Pure Networks Security Scan)
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx (Get_ActiveX Control)
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} http://java.sun.com/products/plugin/1.4/ji…indows-i586.cab (Java Plug-in 1.4.1_02)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/shock…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E8434A76-B489-4C6A-B5EF-F9FF4B5C8FFF}: DhcpNameServer = [removed] [removed] 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Eric Miller\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Eric Miller\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/22 21:28:35 | 000,000,050 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 06:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2002/09/11 03:02:32 | 000,000,045 | -HS- | M] () - D:\Autorun.inf – [ FAT32 ]
O33 - MountPoints2\{a9f24db4-23df-11df-a09d-806d6172696f}\Shell\AutoRun\command - "" = G:\Info.exe folder.htt 480 480
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKU\S-1-5-21-4222450123-4265029411-704048292-1007..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKU\S-1-5-21-4222450123-4265029411-704048292-1007\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/01/30 22:25:04 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Eric Miller\Desktop\OTL.exe
[2012/01/30 22:24:12 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
[2012/01/30 22:23:25 | 002,031,992 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Eric Miller\Desktop\MGADiag.exe
[2012/01/30 22:22:58 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2012/01/30 22:22:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\ERUNT
[2012/01/30 22:22:15 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2012/01/24 20:16:24 | 000,000,000 | R–D | C] – C:\Documents and Settings\Eric Miller\Start Menu\Programs\Administrative Tools
[2012/01/22 21:29:47 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Eric Miller\Desktop\HiJackThis.exe
[2012/01/20 20:57:25 | 000,101,720 | —- | C] (Sunbelt Software) – C:\WINDOWS\System32\drivers\SBREDrv.sys
[2012/01/20 20:54:56 | 000,000,000 | —D | C] – C:\Program Files\Lavasoft
[2012/01/20 20:54:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Lavasoft
[2012/01/20 20:54:55 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Lavasoft
[2012/01/18 22:49:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Eric Miller\Local Settings\Application Data\NPE
[2012/01/18 22:49:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Norton
[2012/01/13 23:40:23 | 000,236,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MpSigStub.exe
[2012/01/13 23:38:23 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Security Client
[2012/01/10 22:46:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Eric Miller\Local Settings\Application Data\HandlerMapsvc
[2012/01/02 17:23:56 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ptpusb.dll
[2012/01/02 17:23:51 | 000,159,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ptpusd.dll
[2012/01/02 17:18:33 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2012/01/02 17:16:51 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2012/01/02 17:10:12 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2012/01/02 17:06:40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\QuickTime
[2007/04/29 21:47:46 | 000,036,963 | —- | C] (Cypress Semiconductor) – C:\Program Files\Common Files\SM1updtr.dll
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/01/30 22:24:59 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Eric Miller\Desktop\OTL.exe
[2012/01/30 22:24:14 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/01/30 22:23:23 | 002,031,992 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Eric Miller\Desktop\MGADiag.exe
[2012/01/30 22:22:21 | 000,000,603 | —- | M] () – C:\Documents and Settings\Eric Miller\Desktop\ERUNT.lnk
[2012/01/30 22:16:01 | 000,001,022 | —- | M] () – C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-4222450123-4265029411-704048292-1007UA.job
[2012/01/30 22:08:03 | 000,001,002 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4222450123-4265029411-704048292-1007UA.job
[2012/01/30 21:17:03 | 000,000,404 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{715FCA55-B235-404B-BB2B-9678504E3994}.job
[2012/01/30 21:13:27 | 000,000,282 | —- | M] () – C:\WINDOWS\tasks\HP Usg Login.job
[2012/01/30 21:13:26 | 000,000,282 | —- | M] () – C:\WINDOWS\tasks\HP Usg Daily.job
[2012/01/30 21:13:22 | 000,000,290 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-4222450123-4265029411-704048292-1007.job
[2012/01/30 21:09:46 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/01/29 23:55:29 | 000,000,012 | —- | M] () – C:\WINDOWS\bthservsdp.dat
[2012/01/29 23:19:17 | 000,000,566 | —- | M] () – C:\hpfr5550.xml
[2012/01/29 23:10:13 | 000,000,682 | —- | M] () – C:\WINDOWS\PSTUDIO.INI
[2012/01/29 20:08:00 | 000,000,950 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4222450123-4265029411-704048292-1007Core.job
[2012/01/29 10:16:00 | 000,001,000 | —- | M] () – C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-4222450123-4265029411-704048292-1007Core.job
[2012/01/25 23:10:21 | 000,002,341 | —- | M] () – C:\Documents and Settings\Eric Miller\Desktop\Google Chrome.lnk
[2012/01/25 23:10:21 | 000,002,319 | —- | M] () – C:\Documents and Settings\Eric Miller\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/01/24 00:06:02 | 000,000,298 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-4222450123-4265029411-704048292-1007.job
[2012/01/23 20:55:00 | 000,000,486 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2012/01/22 23:08:45 | 000,026,112 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\userinit.exe
[2012/01/22 23:08:37 | 000,000,064 | —- | M] () – C:\WINDOWS\System32\rp_stats.dat
[2012/01/22 23:08:37 | 000,000,044 | —- | M] () – C:\WINDOWS\System32\rp_rules.dat
[2012/01/22 21:28:38 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Eric Miller\Desktop\HiJackThis.exe
[2012/01/20 20:57:24 | 000,101,720 | —- | M] (Sunbelt Software) – C:\WINDOWS\System32\drivers\SBREDrv.sys
[2012/01/20 20:57:23 | 000,016,432 | —- | M] () – C:\WINDOWS\System32\lsdelete.exe
[2012/01/20 20:55:06 | 000,000,808 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2012/01/18 23:21:57 | 000,000,289 | RHS- | M] () – C:\boot.ini
[2012/01/15 13:08:45 | 000,000,125 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\.zreglib
[2012/01/14 17:58:00 | 000,074,496 | -H– | M] () – C:\WINDOWS\System32\mlfcache.dat
[2012/01/13 23:39:35 | 000,001,945 | —- | M] () – C:\WINDOWS\epplauncher.mif
[2012/01/10 23:54:21 | 000,001,809 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/01/09 22:29:22 | 000,445,836 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/01/09 22:29:22 | 000,073,042 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/01/08 22:02:06 | 000,000,944 | —- | M] () – C:\Documents and Settings\Eric Miller\Desktop\Spybot - Search & Destroy.lnk
[2012/01/06 23:03:33 | 000,000,736 | RHS- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2012/01/06 22:25:58 | 000,000,761 | RHS- | M] () – C:\WINDOWS\System32\drivers\etc\hostsold
[2012/01/04 04:26:22 | 000,236,576 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MpSigStub.exe
[2012/01/03 23:52:01 | 000,133,282 | —- | M] () – C:\Documents and Settings\Eric Miller\Desktop\sexy-male-fitness-model.jpg
[2012/01/02 17:18:33 | 000,001,553 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2012/01/02 10:20:18 | 000,000,795 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/01/30 22:22:21 | 000,000,603 | —- | C] () – C:\Documents and Settings\Eric Miller\Desktop\ERUNT.lnk
[2012/01/30 21:13:25 | 000,000,282 | —- | C] () – C:\WINDOWS\tasks\HP Usg Daily.job
[2012/01/22 17:27:38 | 000,000,282 | —- | C] () – C:\WINDOWS\tasks\HP Usg Login.job
[2012/01/21 23:45:58 | 000,000,064 | —- | C] () – C:\WINDOWS\System32\rp_stats.dat
[2012/01/21 23:45:58 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\rp_rules.dat
[2012/01/21 02:35:38 | 000,016,432 | —- | C] () – C:\WINDOWS\System32\lsdelete.exe
[2012/01/20 20:55:14 | 000,000,486 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2012/01/20 20:55:06 | 000,000,808 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2012/01/16 21:58:22 | 000,000,870 | —- | C] () – C:\Documents and Settings\Eric Miller\Desktop\Spybot-S&D; (advanced mode).lnk
[2012/01/14 17:58:00 | 000,074,496 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2012/01/13 23:38:35 | 000,001,691 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Security Essentials.lnk
[2012/01/03 23:51:57 | 000,133,282 | —- | C] () – C:\Documents and Settings\Eric Miller\Desktop\sexy-male-fitness-model.jpg
[2012/01/02 17:18:33 | 000,001,553 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2012/01/02 10:20:18 | 000,000,795 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2011/06/16 23:11:19 | 001,493,368 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/06/13 20:50:21 | 000,005,336 | -HS- | C] () – C:\Documents and Settings\Eric Miller\Local Settings\Application Data\sewu82yv4ua2vd263021pp88mv7sq2h7vn6d1er4a6b
[2011/06/13 20:50:21 | 000,005,336 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\sewu82yv4ua2vd263021pp88mv7sq2h7vn6d1er4a6b
[2011/03/28 21:43:06 | 000,011,454 | -HS- | C] () – C:\Documents and Settings\Eric Miller\Local Settings\Application Data\ytif2bmlq0q1b345rc6j
[2011/03/28 21:43:06 | 000,011,454 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\ytif2bmlq0q1b345rc6j
[2011/02/28 23:25:21 | 000,206,480 | —- | C] () – C:\WINDOWS\hpoins49.dat
[2011/02/28 23:25:21 | 000,001,241 | —- | C] () – C:\WINDOWS\hpomdl49.dat
[2011/01/16 19:36:33 | 000,087,552 | —- | C] () – C:\WINDOWS\System32\cpwmon2k.dll
[2010/12/30 21:34:29 | 000,036,608 | —- | C] () – C:\WINDOWS\System32\FsUsbExDisk.Sys
[2010/12/30 21:34:28 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\FsUsbExDevice.Dll
[2010/12/30 21:34:20 | 000,002,528 | —- | C] () – C:\Documents and Settings\Eric Miller\Application Data\$_hpcst$.hpc
[2010/10/28 22:32:46 | 000,000,000 | —- | C] () – C:\WINDOWS\tosOBEX.INI
[2010/10/22 22:32:47 | 000,000,012 | —- | C] () – C:\WINDOWS\bthservsdp.dat
[2010/07/18 13:47:29 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/01/24 22:34:50 | 000,000,125 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\.zreglib
[2009/09/08 20:40:13 | 000,000,118 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2009/07/04 11:06:38 | 000,010,752 | —- | C] () – C:\WINDOWS\DCEBoot.exe
[2009/05/11 19:20:49 | 000,000,030 | —- | C] () – C:\WINDOWS\Showbiz20.ini
[2009/01/14 22:44:20 | 000,037,208 | —- | C] () – C:\Documents and Settings\Eric Miller\Application Data\Comma Separated Values (Windows).ADR
[2008/10/30 20:45:34 | 000,000,120 | —- | C] () – C:\WINDOWS\PbkUser.INI
[2008/06/17 20:25:39 | 000,083,949 | —- | C] () – C:\WINDOWS\REG_QEP.EXE
[2008/06/17 20:25:39 | 000,000,507 | —- | C] () – C:\WINDOWS\PARSONS.INI
[2008/03/05 23:47:09 | 000,000,113 | —- | C] () – C:\WINDOWS\wininit.ini
[2008/02/19 01:33:34 | 000,446,352 | —- | C] () – C:\WINDOWS\System32\OpenQuicktimeLib.dll
[2008/02/08 21:47:00 | 000,073,360 | —- | C] () – C:\Documents and Settings\Eric Miller\Local Settings\Application Data\audioCache8_UNI.db
[2007/11/24 10:17:52 | 000,000,682 | —- | C] () – C:\WINDOWS\PSTUDIO.INI
[2007/10/25 17:26:10 | 000,005,632 | —- | C] () – C:\WINDOWS\System32\drivers\StarOpen.sys
[2007/07/27 23:35:19 | 000,001,757 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/05/26 09:16:15 | 000,000,119 | —- | C] () – C:\Documents and Settings\Eric Miller\Application Data\FixVTS.ini
[2007/05/16 22:36:14 | 004,599,228 | —- | C] () – C:\Documents and Settings\Eric Miller\Local Settings\Application Data\imageCache7.db
[2007/05/16 22:36:14 | 000,068,096 | —- | C] () – C:\Documents and Settings\Eric Miller\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/05/16 22:06:24 | 000,000,134 | —- | C] () – C:\Documents and Settings\Eric Miller\Local Settings\Application Data\fusioncache.dat
[2007/05/14 20:49:43 | 000,000,021 | —- | C] () – C:\WINDOWS\PI5_SETUP.ini
[2007/05/14 20:48:20 | 000,000,021 | —- | C] () – C:\WINDOWS\ME_setup.ini
[2007/05/01 19:32:53 | 000,000,031 | —- | C] () – C:\WINDOWS\warhead.ini
[2007/04/29 20:15:24 | 000,000,034 | —- | C] () – C:\WINDOWS\hpfsched.ini
[2007/04/29 19:50:03 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2007/04/29 19:29:09 | 000,000,165 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2007/04/29 19:11:00 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2007/04/29 19:10:49 | 000,004,351 | —- | C] () – C:\WINDOWS\mozver.dat
[2007/04/29 16:51:12 | 000,516,096 | —- | C] () – C:\WINDOWS\System32\ati2sgag.exe
[2007/04/29 16:45:11 | 000,156,672 | —- | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2007/04/29 16:45:11 | 000,040,448 | —- | C] () – C:\WINDOWS\System32\ChCfg.exe
[2007/04/29 12:13:09 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2007/04/29 11:13:18 | 000,000,224 | —- | C] () – C:\WINDOWS\System32\tbhi.dat
[2007/04/29 03:23:59 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2007/04/29 03:23:58 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2007/04/29 03:23:55 | 000,004,490 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2007/04/29 03:23:51 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2007/04/29 03:23:45 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2007/04/29 03:23:24 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2007/04/29 03:23:23 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2007/04/29 03:22:24 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2007/04/29 03:21:55 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2006/02/13 12:29:26 | 000,121,995 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2005/09/02 13:44:08 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\TosBtAcc.dll
[2005/07/22 20:30:20 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\TosCommAPI.dll
[2005/02/28 14:17:16 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/11/30 03:10:00 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\besch.exe
[2004/11/30 03:10:00 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\besched.dll
[2004/10/26 17:39:05 | 003,375,104 | —- | C] () – C:\WINDOWS\System32\qt-mt331.dll
[2004/07/20 16:04:02 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\TosBtHcrpAPI.dll
[2004/01/15 13:43:28 | 000,114,688 | —- | C] () – C:\WINDOWS\System32\TBTMonUI.dll
[2003/12/19 01:00:00 | 000,013,387 | —- | C] () – C:\WINDOWS\System32\CinemSup.sys
[2003/11/12 02:54:00 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2003/10/02 00:00:00 | 000,208,896 | —- | C] () – C:\WINDOWS\System32\lockout.dll
[2003/10/02 00:00:00 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\lockres.dll
[2003/08/26 21:22:43 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2003/08/16 00:32:45 | 000,028,775 | —- | C] () – C:\WINDOWS\System32\javaw.exe
[2003/08/16 00:32:45 | 000,024,677 | —- | C] () – C:\WINDOWS\System32\java.exe
[2003/08/16 00:30:08 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\JAWTAccessBridge.dll
[2003/08/16 00:29:47 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2003/08/16 00:29:47 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2003/08/16 00:22:46 | 000,167,936 | —- | C] () – C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2003/08/16 00:15:01 | 000,090,112 | R— | C] () – C:\WINDOWS\bwUnin-6.2.3.66.exe
[2003/08/16 00:14:14 | 000,025,449 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2003/08/16 00:13:42 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\syscontr.dll
[2003/08/16 00:13:08 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2003/08/15 23:43:09 | 000,006,848 | —- | C] () – C:\WINDOWS\System32\hphmon05.dat
[2003/08/15 23:42:55 | 000,018,403 | —- | C] () – C:\WINDOWS\HPHins01.dat
[2003/08/15 23:42:55 | 000,004,308 | —- | C] () – C:\WINDOWS\hphmdl01.dat
[2003/08/15 23:33:36 | 000,014,598 | —- | C] () – C:\WINDOWS\hpdins01.dat
[2003/08/15 23:33:36 | 000,000,000 | —- | C] () – C:\WINDOWS\hpzmdl01.dat
[2003/08/15 23:24:16 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2003/08/15 23:21:32 | 000,098,384 | —- | C] () – C:\WINDOWS\System32\EzRating.dll
[2003/08/15 22:39:52 | 000,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM22.dll
[2003/08/15 22:39:52 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes22.dll
[2003/08/15 22:39:32 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2003/08/15 20:36:19 | 000,000,813 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/08/15 20:34:22 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2003/08/15 20:27:57 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2003/08/15 20:17:54 | 000,000,667 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2003/08/15 20:17:05 | 000,445,836 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2003/08/15 20:17:05 | 000,073,042 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2003/08/15 13:22:17 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2003/08/15 13:21:24 | 000,328,296 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2003/02/01 03:10:16 | 000,051,980 | R— | C] () – C:\WINDOWS\OFCSCAN.INI
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/11/22 14:50:06 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\hpodinet.dll
[2002/11/22 14:49:18 | 000,036,864 | —- | C] () – C:\WINDOWS\hpfsched.exe
[2002/11/22 14:48:32 | 000,004,760 | —- | C] () – C:\WINDOWS\hphmdl11.dat
[1999/01/22 08:46:58 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL

========== Alternate Data Streams ==========

@Alternate Data Stream - 72 bytes -> C:\WINDOWS:245FED763BD0ECA1
@Alternate Data Stream - 40 bytes -> C:\WINDOWS\system32:112292f8.zreglib
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C39E55C5

< End of report >


OTL Extras logfile created on: 1/30/2012 10:25:50 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Eric Miller\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.50 Gb Total Physical Memory | 1.96 Gb Available Physical Memory | 78.35% Memory free
3.10 Gb Paging File | 2.55 Gb Available in Paging File | 82.16% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 293.15 Gb Total Space | 175.82 Gb Free Space | 59.98% Space Free | Partition Type: NTFS
Drive D: | 4.92 Gb Total Space | 0.90 Gb Free Space | 18.30% Space Free | Partition Type: FAT32

Computer Name: COMPUTERROOM | User Name: Eric Miller | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_USERS\S-1-5-21-4222450123-4265029411-704048292-1007\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
http [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"9000:TCP" = 9000:TCP:*:Enabled:Squeezebox Server 9000 tcp (UI)
"9001:TCP" = 9001:TCP:*:Enabled:Squeezebox Server 9001 tcp (UI)
"9002:TCP" = 9002:TCP:*:Enabled:Squeezebox Server 9002 tcp (UI)
"9003:TCP" = 9003:TCP:*:Enabled:Squeezebox Server 9003 tcp (UI)
"9004:TCP" = 9004:TCP:*:Enabled:Squeezebox Server 9004 tcp (UI)
"9005:TCP" = 9005:TCP:*:Enabled:Squeezebox Server 9005 tcp (UI)
"9006:TCP" = 9006:TCP:*:Enabled:Squeezebox Server 9006 tcp (UI)
"9007:TCP" = 9007:TCP:*:Enabled:Squeezebox Server 9007 tcp (UI)
"9008:TCP" = 9008:TCP:*:Enabled:Squeezebox Server 9008 tcp (UI)
"9009:TCP" = 9009:TCP:*:Enabled:Squeezebox Server 9009 tcp (UI)
"9010:TCP" = 9010:TCP:*:Enabled:Squeezebox Server 9010 tcp (UI)
"9100:TCP" = 9100:TCP:*:Enabled:Squeezebox Server 9100 tcp (UI)
"8000:TCP" = 8000:TCP:*:Enabled:Squeezebox Server 8000 tcp (UI)
"10000:TCP" = 10000:TCP:*:Enabled:Squeezebox Server 10000 tcp (UI)
"9090:TCP" = 9090:TCP:*:Enabled:Squeezebox Server 9090 tcp (UI)
"3483:UDP" = 3483:UDP:*:Enabled:Squeezebox Server 3483 udp
"3483:TCP" = 3483:TCP:*:Enabled:Squeezebox Server 3483 tcp
"427:TCP" = 427:TCP:LocalSubNet:Enabled:SLP_Port(427)_TCP
"427:UDP" = 427:UDP:LocalSubNet:Enabled:SLP_Port(427)_UDP

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"9000:TCP" = 9000:TCP:*:Enabled:Squeezebox Server 9000 tcp (UI)
"9001:TCP" = 9001:TCP:*:Enabled:Squeezebox Server 9001 tcp (UI)
"9002:TCP" = 9002:TCP:*:Enabled:Squeezebox Server 9002 tcp (UI)
"9003:TCP" = 9003:TCP:*:Enabled:Squeezebox Server 9003 tcp (UI)
"9004:TCP" = 9004:TCP:*:Enabled:Squeezebox Server 9004 tcp (UI)
"9005:TCP" = 9005:TCP:*:Enabled:Squeezebox Server 9005 tcp (UI)
"9006:TCP" = 9006:TCP:*:Enabled:Squeezebox Server 9006 tcp (UI)
"9007:TCP" = 9007:TCP:*:Enabled:Squeezebox Server 9007 tcp (UI)
"9008:TCP" = 9008:TCP:*:Enabled:Squeezebox Server 9008 tcp (UI)
"9009:TCP" = 9009:TCP:*:Enabled:Squeezebox Server 9009 tcp (UI)
"9010:TCP" = 9010:TCP:*:Enabled:Squeezebox Server 9010 tcp (UI)
"9100:TCP" = 9100:TCP:*:Enabled:Squeezebox Server 9100 tcp (UI)
"8000:TCP" = 8000:TCP:*:Enabled:Squeezebox Server 8000 tcp (UI)
"10000:TCP" = 10000:TCP:*:Enabled:Squeezebox Server 10000 tcp (UI)
"9090:TCP" = 9090:TCP:*:Enabled:Squeezebox Server 9090 tcp (UI)
"3483:UDP" = 3483:UDP:*:Enabled:Squeezebox Server 3483 udp
"3483:TCP" = 3483:TCP:*:Enabled:Squeezebox Server 3483 tcp
"427:TCP" = 427:TCP:LocalSubNet:Enabled:SLP_Port(427)_TCP
"427:UDP" = 427:UDP:LocalSubNet:Enabled:SLP_Port(427)_UDP
"24726:TCP" = 24726:TCP:*:Enabled:FlipShareServer
"24727:TCP" = 24727:TCP:*:Enabled:FlipShareServer
"4481:TCP" = 4481:TCP:LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync data transfer
"4481:UDP" = 4481:UDP:LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync discovery
"4482:TCP" = 4482:TCP:LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync data transfer
"4482:UDP" = 4482:UDP:LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync discovery

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"E:\setup\hpznui01.exe" = E:\setup\hpznui01.exe:*:Enabled:hpznui01.exe
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe – (Hewlett-Packard Co.)
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe – (Hewlett-Packard Co.)
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposid01.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – (Hewlett-Packard Co.)
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqkygrp.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe – (Hewlett-Packard Co.)
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpfcCopy.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe – (Hewlett-Packard Co.)
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe – (Hewlett-Packard Co.)
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe – (Hewlett-Packard Co.)
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe – (Hewlett-Packard Co.)
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgpc01.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgpc01.exe:*:Enabled:hpqgpc01.exe – (Hewlett-Packard)
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqusgm.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqusgh.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe
"C:\Program Files\Hewlett-Packard\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe – (Hewlett-Packard Co.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\BearShare\BearShare.exe" = C:\Program Files\BearShare\BearShare.exe:*:Enabled:BearShare – (Free Peers, Inc.)
"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger – (America Online, Inc.)
"C:\Program Files\Soulseek\slsk.exe" = C:\Program Files\Soulseek\slsk.exe:*:Enabled:SoulSeek – ()
"C:\Documents and Settings\Eric Miller\Application Data\Facebook\facebook.exe" = C:\Documents and Settings\Eric Miller\Application Data\Facebook\facebook.exe:*:Enabled:facebook
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox – (Mozilla Corporation)
"C:\Program Files\BearShare Test\BearShare.exe" = C:\Program Files\BearShare Test\BearShare.exe:*:Enabled:BearShare – (Free Peers, Inc.)
"C:\Program Files\PFPortChecker\PFPortChecker.exe" = C:\Program Files\PFPortChecker\PFPortChecker.exe:*:Disabled:PFPortchecker by portforward.com helps check if your ports are properly forwarded.
"C:\Program Files\SAMSUNG\Samsung New PC Studio\npsasvr.exe" = C:\Program Files\SAMSUNG\Samsung New PC Studio\npsasvr.exe:*:Enabled:KTF MUSIC AoD Server – (PeeringPortal)
"C:\Program Files\SAMSUNG\Samsung New PC Studio\npsvsvr.exe" = C:\Program Files\SAMSUNG\Samsung New PC Studio\npsvsvr.exe:*:Enabled:KTF MUSIC VoD Server – (PeeringPortal)
"E:\setup\hpznui01.exe" = E:\setup\hpznui01.exe:*:Enabled:hpznui01.exe
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe – (Hewlett-Packard Co.)
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe – (Hewlett-Packard Co.)
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposid01.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – (Hewlett-Packard Co.)
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqkygrp.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe – (Hewlett-Packard Co.)
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpfcCopy.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe – (Hewlett-Packard Co.)
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe – (Hewlett-Packard Co.)
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe – (Hewlett-Packard Co.)
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe – (Hewlett-Packard Co.)
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgpc01.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgpc01.exe:*:Enabled:hpqgpc01.exe – (Hewlett-Packard)
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqusgm.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe
"C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqusgh.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe
"C:\Program Files\Hewlett-Packard\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = C:\Program Files\Hewlett-Packard\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe – (Hewlett-Packard Co.)
"C:\Program Files\Nortel Networks\Extranet.exe" = C:\Program Files\Nortel Networks\Extranet.exe:*:Disabled:Contivity VPN Client
"C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" = C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe:*:Disabled:Nokia Ovi Suite 2
"C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe" = C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe:*:Disabled:Nokia Service Layer Host Process
"C:\Program Files\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe" = C:\Program Files\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe:*:Enabled:BlackBerry Desktop Software – (Research In Motion)
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit – (Apple Inc.)
"C:\Documents and Settings\Eric Miller\Local Settings\Application Data\Facebook\Video\Skype\FacebookVideoCalling.exe" = C:\Documents and Settings\Eric Miller\Local Settings\Application Data\Facebook\Video\Skype\FacebookVideoCalling.exe:*:Enabled:Facebook Video Calling Plugin – (Skype Limited)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{069730C2-755A-485B-A205-27A1AAFA836A}" = InstantShareAlert
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{097CDB1E-07C9-40F1-9972-F0F9F3A287E4}" = Network
"{098637A9-C208-4398-8374-853151D35200}" = SkinsHP2
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{0D396571-7BBD-44CE-ABB3-518BF86B72F7}" = HP Photo and Imaging 2.0 - Photosmart Printer Series
"{11946FA8-329A-4DDF-B867-A32781FED8EE}" = HPImageZone
"{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery
"{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1A655D51-1423-48A3-B748-8F5A0BE294C8}" = Microsoft Visual J# .NET Redistributable Package 1.1
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{1F7CCFA3-D926-4882-B2A5-A0217ED25597}" = PC-Doctor for Windows
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox
"{2A267BC6-F77F-4DD4-825F-7AEB1F68B4B1}" = HpSdpAppCoreApp
"{2A329709-A0F3-11D0-9501-444553540000}_is1" = PocketMirror (Standard Edition) 4.3.0
"{2E0695EE-ED29-4D96-BD77-2A9A17EDF0D6}" = Cypress USB Mass Storage Driver Installation
"{2E132061-C78A-48D4-A899-1D13B9D189FA}" = Memories Disc Creator 2.0
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{305B23E7-F8D8-4B92-83AA-5AE0D0090DE7}" = Unload
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{42948B02-7191-40CF-92AA-4E330869B28B}" = HPIZ Fix2
"{45B6180B-DCAB-4093-8EE8-6164457517F0}" = Photosmart 140,240,7200,7600,7700,7900 Series
"{45DF6D99-666D-41FA-8D62-0E183B6240F3}" = PC Connectivity Solution
"{4E484899-4F93-4086-88BA-56BDDF47A776}" = HP Photosmart Prem C310 All-In-One Driver Software 14.0 Rel. 7
"{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client
"{565E7B0E-B76B-4EAD-9753-F1E72A5CF12E}" = HPAppStudio
"{582BA1F1-FAB4-41AD-A5E3-4A9535343461}" = PS_AIO_07_C310_SW_Min
"{595D0DE8-C38A-4432-B851-47DECC1A99BD}" = HP Unload DLL Patch
"{5B025634-7D5B-4B8D-BE2A-7943C1CF2D5D}" = Status
"{5D7F0A0E-369E-46C0-9F99-FAB21A064781}" = HP Photo and Imaging 2.0 - Photosmart Cameras
"{624E54D0-E4F4-434F-9EF6-D4D066EE4348}" = Facebook Video Calling 1.1.1.1
"{62B3B82F-B9B1-4D8C-B5D1-C3DAEA1F73AA}" = PhotoGallery
"{642B473F-2584-4C21-AB10-6D1EF28BD601}" = QuickProjects
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{710BF966-43C8-4216-A8EC-BC4E169FF7C1}" = MobileMe Control Panel
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{745A92AF-53B4-41A7-91C3-9B026B1D5897}" = InstantShare
"{75157F34-02C6-4831-BD66-3BC49E7A8394}" = BlackBerry Desktop Software 6.1
"{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}" = Microsoft Works 7.0
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{791B20D4-AE59-4DE9-B45F-BA01F3D0A493}" = ArcSoft ShowBiz 2
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7BBD57D6-09B1-4CC3-9664-A0D53EE25247}" = PSShortcutsP
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{82CA0A0C-A3EC-4167-B694-909205B2EDEC}" = muvee Plugin 1.0
"{84464E93-0222-42E5-8CCE-A618F86210F3}" = SkinsHP1
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{88D68A69-D247-466B-90DD-575F6BE16230}_is1" = CardRecovery 5.30
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics 2 Driver
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8E9976D2-E563-43DE-A51F-5AEBC38D1F08}" = Ad-Aware
"{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90AD8C11-ED4A-4AE7-BB70-7740C452C999}" = Visual J# .NET Redistributable Package
"{91CA0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Small Business Edition 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = RecordNow!
"{97C658D2-61FB-027F-0D76-E9CDC84AFEC7}" = FlipShare
"{98386532-89B5-42FF-AC49-60C0D9DBD8B1}" = CreativeProjects
"{9860A9CF-7E71-43AC-888F-0B4D3EA212D1}" = Roxio Burn Engine
"{98E8A2EF-4EAE-43B8-A172-74842B764777}" = InterVideo WinDVD Player
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C411DC9-B8B8-45F3-B688-073BF4B59094}" = Virtual Account Numbers
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A80FA752-C491-4ED9-ABF0-4278563160B2}" = 32 Bit HP CIO Components Installer
"{A896773E-B722-4B4C-A466-CAF3B328B0EB}" = Logitech Music Anywhere Settings
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{A99C6296-A311-4D6C-9602-53B4241921D5}" = Roxio Easy Media Creator 7
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1033-7B44-A70900000002}" = Adobe Reader 7.0.9
"{ADAED43C-BBD9-42C5-8B21-F4FBFA81E3C3}" = Palm
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B7DBF6E8-0D17-4BE4-853B-ACD6EFBD4A1F}" = iTunes
"{B9266252-00CB-4140-B740-DE88FC0F7609}" = hpmdtab
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2
"{BC5DD87B-0143-4D14-AAE6-97109614DC6B}" = SolutionCenter
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C224DBAC-57F4-40FD-BB83-09DB532CCD68}" = HPSystemDiagnostics
"{C6A7AF96-4EB1-4AAE-8318-1AB393C64F88}" = Microsoft Plus! Digital Media Edition
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows
"{CFD1B282-555D-494d-8231-4175C2AF08C2}" = PrintScreen
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{DB0A8A2A-4EA7-4FE3-802E-8A6DEE32696C}_is1" = Orban/Coding Technologies AAC/aacPlus Player Plugin™ 1.0
"{DD54CF66-090B-43E7-97C1-110EF526474D}" = ArcSoft Multimedia Email
"{DE700910-58F7-4D2E-B7E6-3BA2DA1B6806}" = Virtual Account Numbers
"{E05895C5-FE97-4334-8D73-B0089FD07CE3}" = Multimedia Card Reader
"{E517094C-06B6-419F-8FFD-EF4F57972130}" = QuickTransfer
"{ED2A3C11-3EA8-4380-B59C-F2C1832731B0}" = Quicken 2009
"{EFCE5837-FC21-11D6-9D24-00010240CE95}" = Java 2 Runtime Environment, SE v1.4.1_02
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F419D20A-7719-4639-8E30-C073A040D878}" = HP Deskjet Preloaded Printer Drivers
"{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FC053571-8507-44E4-8B6D-AACEAB8CA57C}" = Sansa Media Converter
"{FC888095-A35E-4993-A9E0-366BF6F0CCE0}" = ArcSoft PhotoImpression 5
"{FE651900-D014-482F-AEBC-2928F57D1FB0}" = C310
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"3ivx MPEG-4 5.0.3" = 3ivx MPEG-4 5.0.3 (remove only)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"All ATI Software" = ATI - Software Uninstall Utility
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.15
"AnyDVD" = AnyDVD
"AOL Instant Messenger" = AOL Instant Messenger
"ATI Display Driver" = ATI Display Driver
"BearShare" = BearShare
"BearShare Test" = BearShare Test
"BlackBerry_Desktop" = BlackBerry Desktop Software 6.1
"Cisco Connect" = Cisco Connect
"CloneDVD2" = CloneDVD2
"Creative PD0630" = Creative WebCam Live! Driver (1.01.01.0730)
"Creative WebCam Center" = Creative WebCam Center
"Creative WebCam Live! User's Guide English" = Creative WebCam Live! User's Guide (English)
"CutePDF Writer Installation" = CutePDF Writer 2.8
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DVD Decrypter" = DVD Decrypter (Remove Only)
"DVD Shrink_is1" = DVD Shrink 3.2
"ERUNT_is1" = ERUNT 1.1j
"HijackThis" = HijackThis 1.99.1
"HP Imaging Device Functions" = HP Imaging Device Functions 14.0
"HP Instant Support" = HP Instant Support
"HP Photo & Imaging" = HP Photo & Imaging 3.0
"HP Photo Creations" = HP Photo Creations
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0
"hphuni04" = Photosmart 130,230,7150,7345,7350,7550 (Remove only)
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"InstallShield_{E05895C5-FE97-4334-8D73-B0089FD07CE3}" = Multimedia Card Reader
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"Java Web Start" = Java Web Start
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.60.0.1800
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 9.0.1 (x86 en-US)" = Mozilla Firefox 9.0.1 (x86 en-US)
"NewsBin5" = NewsBin Pro
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PS2" = PS2
"Python 2.2 combined Win32 extensions" = Python 2.2 combined Win32 extensions
"Quicken Family Lawyer Deluxe" = Family Lawyer Deluxe 8.0
"QuickPar" = QuickPar 0.9
"RealPlayer 12.0" = RealPlayer
"Savings Bond Wizard" = Savings Bond Wizard
"SM1FX_AT" = USB Storage Adapter FX (SM1)
"Soulseek" = SoulSeek Client 156c
"Squeezebox Server_is1" = Squeezebox Server 7.6.0
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"WeatherBug" = WeatherBug
"WIC" = Windows Imaging Component
"Winamp" = Winamp
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-4222450123-4265029411-704048292-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/14/2012 6:44:55 AM | Computer Name = COMPUTERROOM | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 0, P2 moaccapability, P3 3.0.8402.0, P4
0, P5 0, P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10 NIL.

Error - 1/17/2012 11:16:06 AM | Computer Name = COMPUTERROOM | Source = Google Update | ID = 20
Description =

Error - 1/17/2012 2:16:05 PM | Computer Name = COMPUTERROOM | Source = Google Update | ID = 20
Description =

Error - 1/17/2012 5:16:05 PM | Computer Name = COMPUTERROOM | Source = Google Update | ID = 20
Description =

Error - 1/17/2012 7:54:32 PM | Computer Name = COMPUTERROOM | Source = Application Hang | ID = 1002
Description = Hanging application qw.exe, version 18.1.7.8, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 1/19/2012 12:03:13 AM | Computer Name = COMPUTERROOM | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 1/19/2012 12:03:13 AM | Computer Name = COMPUTERROOM | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 1/21/2012 2:16:10 AM | Computer Name = COMPUTERROOM | Source = Google Update | ID = 20
Description =

Error - 1/21/2012 5:16:06 AM | Computer Name = COMPUTERROOM | Source = Google Update | ID = 20
Description =

Error - 1/21/2012 8:16:05 AM | Computer Name = COMPUTERROOM | Source = Google Update | ID = 20
Description =

[ System Events ]
Error - 1/22/2012 9:53:00 PM | Computer Name = COMPUTERROOM | Source = Service Control Manager | ID = 7034
Description = The Lavasoft Ad-Aware Service service terminated unexpectedly. It
has done this 1 time(s).

Error - 1/23/2012 12:12:31 AM | Computer Name = COMPUTERROOM | Source = Service Control Manager | ID = 7001
Description = The DHCP Client service depends on the NetBT service which failed
to start because of the following error: %%31

Error - 1/23/2012 12:12:31 AM | Computer Name = COMPUTERROOM | Source = Service Control Manager | ID = 7001
Description = The DNS Client service depends on the TCP/IP Protocol Driver service
which failed to start because of the following error: %%31

Error - 1/23/2012 12:12:31 AM | Computer Name = COMPUTERROOM | Source = Service Control Manager | ID = 7001
Description = The TCP/IP NetBIOS Helper service depends on the AFD Networking Support
Environment service which failed to start because of the following error: %%31

Error - 1/23/2012 12:12:31 AM | Computer Name = COMPUTERROOM | Source = Service Control Manager | ID = 7001
Description = The Apple Mobile Device service depends on the TCP/IP Protocol Driver
service which failed to start because of the following error: %%31

Error - 1/23/2012 12:12:31 AM | Computer Name = COMPUTERROOM | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AFD cdudf_xp Cinemsup ElbyCDIO Fips intelppm IPSec MpFilter MRxSmb NetBIOS NetBT RasAcd Rdbss
Tcpip
Tosrfcom

Error - 1/23/2012 12:12:50 AM | Computer Name = COMPUTERROOM | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 1/23/2012 12:13:11 AM | Computer Name = COMPUTERROOM | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 1/23/2012 8:54:31 AM | Computer Name = COMPUTERROOM | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 1/29/2012 4:38:05 PM | Computer Name = COMPUTERROOM | Source = Cdrom | ID = 262155
Description = The driver detected a controller error on \Device\CdRom0.


< End of report >


22:42:41.0390 3468 TDSS rootkit removing tool 2.7.8.0 Jan 30 2012 16:39:36
22:42:41.0625 3468 ============================================================
22:42:41.0625 3468 Current date / time: 2012/01/30 22:42:41.0625
22:42:41.0625 3468 SystemInfo:
22:42:41.0625 3468
22:42:41.0625 3468 OS Version: 5.1.2600 ServicePack: 3.0
22:42:41.0625 3468 Product type: Workstation
22:42:41.0625 3468 ComputerName: COMPUTERROOM
22:42:41.0625 3468 UserName: Eric Miller
22:42:41.0625 3468 Windows directory: C:\WINDOWS
22:42:41.0625 3468 System windows directory: C:\WINDOWS
22:42:41.0625 3468 Processor architecture: Intel x86
22:42:41.0625 3468 Number of processors: 2
22:42:41.0625 3468 Page size: 0x1000
22:42:41.0625 3468 Boot type: Normal boot
22:42:41.0625 3468 ============================================================
22:42:43.0812 3468 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
22:42:44.0109 3468 \Device\Harddisk0\DR0:
22:42:44.0109 3468 MBR used
22:42:44.0109 3468 \Device\Harddisk0\DR0\Partition0: MBR, Type 0xB, StartLBA 0x3F, BlocksNum 0x9DDD45
22:42:44.0109 3468 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x9DDD84, BlocksNum 0x24A4BA7C
22:42:44.0140 3468 Initialize success
22:42:44.0140 3468 ============================================================
22:43:21.0859 0476 ============================================================
22:43:21.0859 0476 Scan started
22:43:21.0859 0476 Mode: Manual;
22:43:21.0859 0476 ============================================================
22:43:22.0484 0476 $sys$cor (53b049da317117645068f41ff6a6a80c) C:\WINDOWS\system32\Drivers\$sys$cor.sys
22:43:22.0484 0476 $sys$cor - ok
22:43:22.0546 0476 $sys$crater (1a5e7c6cbaed64159c6b39be64f4c2ff) C:\WINDOWS\system32\$sys$filesystem\crater.sys
22:43:22.0546 0476 $sys$crater - ok
22:43:22.0578 0476 Abiosdsk - ok
22:43:22.0609 0476 abp480n5 - ok
22:43:22.0656 0476 ACPI (d8fb7d1c3f5bfa3f53fe9cc6367e9e99) C:\WINDOWS\system32\DRIVERS\ACPI.sys
22:43:22.0671 0476 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\ACPI.sys. Real md5: d8fb7d1c3f5bfa3f53fe9cc6367e9e99, Fake md5: 8fd99680a539792a30e97944fdaecf17
22:43:22.0671 0476 ACPI ( Virus.Win32.Rloader.a ) - infected
22:43:22.0671 0476 ACPI - detected Virus.Win32.Rloader.a (0)
22:43:22.0718 0476 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
22:43:22.0718 0476 ACPIEC - ok
22:43:22.0734 0476 adpu160m - ok
22:43:22.0796 0476 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
22:43:22.0796 0476 aec - ok
22:43:22.0843 0476 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
22:43:22.0843 0476 AFD - ok
22:43:22.0875 0476 AFS2K (c685cc27a2e637f0dcb5a45e67cc6f74) C:\WINDOWS\system32\drivers\AFS2K.sys
22:43:22.0875 0476 AFS2K - ok
22:43:22.0906 0476 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
22:43:22.0906 0476 agp440 - ok
22:43:22.0921 0476 Aha154x - ok
22:43:22.0953 0476 aic78u2 - ok
22:43:22.0968 0476 aic78xx - ok
22:43:23.0125 0476 ALCXWDM (8d6c30e515717248e0e52b85fd7ac466) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
22:43:23.0343 0476 ALCXWDM - ok
22:43:23.0390 0476 AliIde - ok
22:43:23.0406 0476 amsint - ok
22:43:23.0437 0476 AnyDVD (98a8e0b0fa9dd13d55ad133ae4ce787c) C:\WINDOWS\system32\Drivers\AnyDVD.sys
22:43:23.0453 0476 AnyDVD - ok
22:43:23.0531 0476 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
22:43:23.0531 0476 Arp1394 - ok
22:43:23.0578 0476 asc - ok
22:43:23.0593 0476 asc3350p - ok
22:43:23.0625 0476 asc3550 - ok
22:43:23.0687 0476 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
22:43:23.0687 0476 AsyncMac - ok
22:43:23.0718 0476 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
22:43:23.0718 0476 atapi - ok
22:43:23.0750 0476 Atdisk - ok
22:43:23.0828 0476 ati2mtag (07ac9a98ea70b5a6655a5797174bd282) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
22:43:23.0843 0476 ati2mtag - ok
22:43:23.0875 0476 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
22:43:23.0890 0476 Atmarpc - ok
22:43:23.0906 0476 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
22:43:23.0906 0476 audstub - ok
22:43:23.0953 0476 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
22:43:23.0953 0476 Beep - ok
22:43:24.0031 0476 BthEnum (b279426e3c0c344893ed78a613a73bde) C:\WINDOWS\system32\DRIVERS\BthEnum.sys
22:43:24.0031 0476 BthEnum - ok
22:43:24.0078 0476 BthPan (80602b8746d3738f5886ce3d67ef06b6) C:\WINDOWS\system32\DRIVERS\bthpan.sys
22:43:24.0078 0476 BthPan - ok
22:43:24.0140 0476 BTHPORT (662bfd909447dd9cc15b1a1c366583b4) C:\WINDOWS\system32\Drivers\BTHport.sys
22:43:24.0156 0476 BTHPORT - ok
22:43:24.0203 0476 BTHUSB (61364cd71ef63b0f038b7e9df00f1efa) C:\WINDOWS\system32\Drivers\BTHUSB.sys
22:43:24.0203 0476 BTHUSB - ok
22:43:24.0234 0476 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
22:43:24.0234 0476 cbidf2k - ok
22:43:24.0281 0476 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
22:43:24.0281 0476 CCDECODE - ok
22:43:24.0312 0476 cd20xrnt - ok
22:43:24.0328 0476 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
22:43:24.0328 0476 Cdaudio - ok
22:43:24.0359 0476 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
22:43:24.0359 0476 Cdfs - ok
22:43:24.0390 0476 Cdr4_xp (837eef65af62d4e8a37c41d3879f7274) C:\WINDOWS\system32\drivers\Cdr4_xp.sys
22:43:24.0406 0476 Cdr4_xp - ok
22:43:24.0421 0476 Cdralw2k (579da2f9f5401f55dae2cf8779d61dfc) C:\WINDOWS\system32\drivers\Cdralw2k.sys
22:43:24.0421 0476 Cdralw2k - ok
22:43:24.0453 0476 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
22:43:24.0453 0476 Cdrom - ok
22:43:24.0515 0476 cdudf_xp (66b9f9c62721f2347211c0c9bcce4e98) C:\WINDOWS\system32\drivers\cdudf_xp.sys
22:43:24.0515 0476 cdudf_xp - ok
22:43:24.0546 0476 Changer - ok
22:43:24.0578 0476 Cinemsup (f6a0f51706cb4b0d5b8718ff69f831ba) C:\WINDOWS\system32\drivers\Cinemsup.sys
22:43:24.0593 0476 Cinemsup - ok
22:43:24.0671 0476 CmdIde - ok
22:43:24.0703 0476 Cpqarray - ok
22:43:24.0734 0476 dac2w2k - ok
22:43:24.0750 0476 dac960nt - ok
22:43:24.0781 0476 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
22:43:24.0796 0476 Disk - ok
22:43:24.0859 0476 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
22:43:24.0890 0476 dmboot - ok
22:43:24.0906 0476 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
22:43:24.0921 0476 dmio - ok
22:43:24.0937 0476 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
22:43:24.0937 0476 dmload - ok
22:43:24.0984 0476 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
22:43:24.0984 0476 DMusic - ok
22:43:25.0031 0476 Dot4 HPH11 (a93ae4414505a8095ec4820c4312b5df) C:\WINDOWS\system32\DRIVERS\hphid411.sys
22:43:25.0031 0476 Dot4 HPH11 - ok
22:43:25.0062 0476 Dot4Print HPH11 (4f8681519ea48757148895811f2aa051) C:\WINDOWS\system32\DRIVERS\hphipr11.sys
22:43:25.0062 0476 Dot4Print HPH11 - ok
22:43:25.0078 0476 Dot4Storage HPH11 (df0a7516e9f803c1c64796b81605495c) C:\WINDOWS\system32\Drivers\hphs2k11.sys
22:43:25.0078 0476 Dot4Storage HPH11 - ok
22:43:25.0125 0476 Dot4Usb HPH11 (c6608b2afb2567f0fa6b4bd8837f1660) C:\WINDOWS\system32\drivers\hphius11.sys
22:43:25.0125 0476 Dot4Usb HPH11 - ok
22:43:25.0140 0476 dpti2o - ok
22:43:25.0203 0476 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
22:43:25.0203 0476 drmkaud - ok
22:43:25.0218 0476 drvmcdb (7df2e645fbda7cde94fcabba7f0de4c2) C:\WINDOWS\system32\DRIVERS\drvmcdb.sys
22:43:25.0218 0476 drvmcdb - ok
22:43:25.0250 0476 dsNcAdpt - ok
22:43:25.0296 0476 DVDVRRdr_xp (1d5eda9961b16b8e800639038d7492ad) C:\WINDOWS\system32\drivers\DVDVRRdr_xp.sys
22:43:25.0296 0476 DVDVRRdr_xp - ok
22:43:25.0328 0476 dvd_2K (df112f6f01efedc21c9bc5ce822ce1d3) C:\WINDOWS\system32\drivers\dvd_2K.sys
22:43:25.0328 0476 dvd_2K - ok
22:43:25.0375 0476 ElbyCDIO (178cc9403816c082d22a1d47fa1f9c85) C:\WINDOWS\system32\Drivers\ElbyCDIO.sys
22:43:25.0375 0476 ElbyCDIO - ok
22:43:25.0421 0476 ElbyDelay (e205c313417da6fa7afe85912a310a65) C:\WINDOWS\system32\Drivers\ElbyDelay.sys
22:43:25.0421 0476 ElbyDelay - ok
22:43:25.0468 0476 EvcapMaui (944dece098cd7d280de8faba917e9d2c) C:\WINDOWS\system32\DRIVERS\EvcapMau.sys
22:43:25.0468 0476 EvcapMaui - ok
22:43:25.0500 0476 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
22:43:25.0515 0476 Fastfat - ok
22:43:25.0562 0476 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
22:43:25.0562 0476 Fdc - ok
22:43:25.0593 0476 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
22:43:25.0593 0476 Fips - ok
22:43:25.0625 0476 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
22:43:25.0640 0476 Flpydisk - ok
22:43:25.0718 0476 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
22:43:25.0718 0476 FltMgr - ok
22:43:25.0765 0476 FsUsbExDisk (cbe5f69a5e5b918225f420ba748f3742) C:\WINDOWS\system32\FsUsbExDisk.SYS
22:43:25.0765 0476 FsUsbExDisk - ok
22:43:25.0812 0476 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
22:43:25.0812 0476 Fs_Rec - ok
22:43:25.0828 0476 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
22:43:25.0843 0476 Ftdisk - ok
22:43:25.0890 0476 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
22:43:25.0890 0476 GEARAspiWDM - ok
22:43:25.0937 0476 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
22:43:25.0937 0476 Gpc - ok
22:43:26.0000 0476 HidIr (bb1a6fb7d35a91e599973fa74a619056) C:\WINDOWS\system32\DRIVERS\hidir.sys
22:43:26.0000 0476 HidIr - ok
22:43:26.0046 0476 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
22:43:26.0046 0476 HidUsb - ok
22:43:26.0062 0476 hpn - ok
22:43:26.0140 0476 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
22:43:26.0140 0476 HTTP - ok
22:43:26.0171 0476 i2omgmt - ok
22:43:26.0187 0476 i2omp - ok
22:43:26.0218 0476 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
22:43:26.0218 0476 i8042prt - ok
22:43:26.0265 0476 ialm (50d909fdaf6df35b04c6b6a4bcb6d675) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
22:43:26.0281 0476 ialm - ok
22:43:26.0328 0476 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
22:43:26.0328 0476 Imapi - ok
22:43:26.0359 0476 ini910u - ok
22:43:26.0390 0476 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\System32\DRIVERS\intelide.sys
22:43:26.0390 0476 IntelIde - ok
22:43:26.0421 0476 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
22:43:26.0421 0476 intelppm - ok
22:43:26.0453 0476 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
22:43:26.0453 0476 ip6fw - ok
22:43:26.0500 0476 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
22:43:26.0500 0476 IpFilterDriver - ok
22:43:26.0546 0476 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
22:43:26.0546 0476 IpInIp - ok
22:43:26.0593 0476 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
22:43:26.0593 0476 IpNat - ok
22:43:26.0625 0476 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
22:43:26.0625 0476 IPSec - ok
22:43:26.0656 0476 IPSECSHM - ok
22:43:26.0703 0476 IrBus (b43b36b382aea10861f7c7a37f9d4ae2) C:\WINDOWS\system32\DRIVERS\IrBus.sys
22:43:26.0703 0476 IrBus - ok
22:43:26.0734 0476 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
22:43:26.0734 0476 IRENUM - ok
22:43:26.0781 0476 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
22:43:26.0781 0476 isapnp - ok
22:43:26.0812 0476 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
22:43:26.0812 0476 Kbdclass - ok
22:43:26.0828 0476 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
22:43:26.0828 0476 kbdhid - ok
22:43:26.0859 0476 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
22:43:26.0859 0476 kmixer - ok
22:43:26.0937 0476 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
22:43:26.0937 0476 KSecDD - ok
22:43:27.0031 0476 Lavasoft Kernexplorer (6c4a3804510ad8e0f0c07b5be3d44ddb) C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys
22:43:27.0031 0476 Lavasoft Kernexplorer - ok
22:43:27.0062 0476 lbrtfdc - ok
22:43:27.0140 0476 ltmodem5 (3070246fba35aa2e0c2251d55f5848f8) C:\WINDOWS\system32\DRIVERS\ltmdmnt.sys
22:43:27.0140 0476 ltmodem5 - ok
22:43:27.0171 0476 mmc_2K (a52ed33515755e825d090a47793b773f) C:\WINDOWS\system32\drivers\mmc_2K.sys
22:43:27.0187 0476 mmc_2K - ok
22:43:27.0218 0476 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
22:43:27.0218 0476 mnmdd - ok
22:43:27.0265 0476 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
22:43:27.0265 0476 Modem - ok
22:43:27.0328 0476 motmodem (fe80c18ba448ddd76b7bead9eb203d37) C:\WINDOWS\system32\DRIVERS\motmodem.sys
22:43:27.0328 0476 motmodem - ok
22:43:27.0343 0476 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
22:43:27.0359 0476 Mouclass - ok
22:43:27.0390 0476 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
22:43:27.0390 0476 mouhid - ok
22:43:27.0406 0476 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
22:43:27.0406 0476 MountMgr - ok
22:43:27.0453 0476 MpFilter (fee0baded54222e9f1dae9541212aab1) C:\WINDOWS\system32\DRIVERS\MpFilter.sys
22:43:27.0453 0476 MpFilter - ok
22:43:27.0562 0476 MpKsl63faad98 (a69630d039c38018689190234f866d77) c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E3282DE6-C4EE-486B-9D60-6E3179E97875}\MpKsl63faad98.sys
22:43:27.0562 0476 MpKsl63faad98 - ok
22:43:27.0593 0476 mraid35x - ok
22:43:27.0625 0476 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
22:43:27.0640 0476 MRxDAV - ok
22:43:27.0687 0476 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
22:43:27.0703 0476 MRxSmb - ok
22:43:27.0734 0476 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
22:43:27.0734 0476 Msfs - ok
22:43:27.0796 0476 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
22:43:27.0796 0476 MSKSSRV - ok
22:43:27.0859 0476 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
22:43:27.0859 0476 MSPCLOCK - ok
22:43:27.0890 0476 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
22:43:27.0906 0476 MSPQM - ok
22:43:27.0921 0476 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
22:43:27.0921 0476 mssmbios - ok
22:43:27.0968 0476 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
22:43:27.0968 0476 MSTEE - ok
22:43:28.0046 0476 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
22:43:28.0046 0476 Mup - ok
22:43:28.0078 0476 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
22:43:28.0078 0476 NABTSFEC - ok
22:43:28.0109 0476 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
22:43:28.0109 0476 NDIS - ok
22:43:28.0171 0476 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
22:43:28.0171 0476 NdisIP - ok
22:43:28.0218 0476 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
22:43:28.0218 0476 NdisTapi - ok
22:43:28.0250 0476 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
22:43:28.0250 0476 Ndisuio - ok
22:43:28.0281 0476 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
22:43:28.0281 0476 NdisWan - ok
22:43:28.0343 0476 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
22:43:28.0343 0476 NDProxy - ok
22:43:28.0375 0476 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
22:43:28.0390 0476 NetBIOS - ok
22:43:28.0421 0476 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
22:43:28.0421 0476 NetBT - ok
22:43:28.0484 0476 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
22:43:28.0484 0476 NIC1394 - ok
22:43:28.0531 0476 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
22:43:28.0531 0476 Npfs - ok
22:43:28.0562 0476 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
22:43:28.0578 0476 Ntfs - ok
22:43:28.0640 0476 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
22:43:28.0640 0476 Null - ok
22:43:28.0687 0476 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
22:43:28.0687 0476 NwlnkFlt - ok
22:43:28.0703 0476 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
22:43:28.0703 0476 NwlnkFwd - ok
22:43:28.0750 0476 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
22:43:28.0750 0476 ohci1394 - ok
22:43:28.0812 0476 P0630VID (68cb569ede9cfb3b0bf17966428df025) C:\WINDOWS\system32\DRIVERS\P0630Vid.sys
22:43:28.0812 0476 P0630VID - ok
22:43:28.0859 0476 PalmUSBD (240c0d4049a833b16b63b636acf01672) C:\WINDOWS\system32\drivers\PalmUSBD.sys
22:43:28.0859 0476 PalmUSBD - ok
22:43:28.0906 0476 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
22:43:28.0906 0476 Parport - ok
22:43:28.0937 0476 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
22:43:28.0937 0476 PartMgr - ok
22:43:29.0015 0476 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
22:43:29.0015 0476 ParVdm - ok
22:43:29.0046 0476 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
22:43:29.0046 0476 PCI - ok
22:43:29.0078 0476 PCIDump - ok
22:43:29.0093 0476 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
22:43:29.0093 0476 PCIIde - ok
22:43:29.0140 0476 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
22:43:29.0140 0476 Pcmcia - ok
22:43:29.0187 0476 PDCOMP - ok
22:43:29.0203 0476 PDFRAME - ok
22:43:29.0234 0476 PDRELI - ok
22:43:29.0250 0476 PDRFRAME - ok
22:43:29.0281 0476 perc2 - ok
22:43:29.0296 0476 perc2hib - ok
22:43:29.0359 0476 pfc (e5ac9f8c128b597dd7919af96b84172e) C:\WINDOWS\system32\drivers\pfc.sys
22:43:29.0359 0476 pfc - ok
22:43:29.0437 0476 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
22:43:29.0437 0476 PptpMiniport - ok
22:43:29.0468 0476 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
22:43:29.0468 0476 Processor - ok
22:43:29.0515 0476 Ps2 (390c204ced3785609ab24e9c52054a84) C:\WINDOWS\system32\DRIVERS\PS2.sys
22:43:29.0515 0476 Ps2 - ok
22:43:29.0546 0476 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
22:43:29.0546 0476 PSched - ok
22:43:29.0562 0476 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
22:43:29.0562 0476 Ptilink - ok
22:43:29.0609 0476 pwd_2k (62d29677f6a7f018c5d49119cea67de5) C:\WINDOWS\system32\drivers\pwd_2k.sys
22:43:29.0609 0476 pwd_2k - ok
22:43:29.0640 0476 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\DRIVERS\PxHelp20.sys
22:43:29.0640 0476 PxHelp20 - ok
22:43:29.0671 0476 ql1080 - ok
22:43:29.0687 0476 Ql10wnt - ok
22:43:29.0718 0476 ql12160 - ok
22:43:29.0734 0476 ql1240 - ok
22:43:29.0765 0476 ql1280 - ok
22:43:29.0781 0476 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
22:43:29.0781 0476 RasAcd - ok
22:43:29.0828 0476 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
22:43:29.0828 0476 Rasl2tp - ok
22:43:29.0859 0476 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
22:43:29.0875 0476 RasPppoe - ok
22:43:29.0890 0476 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
22:43:29.0890 0476 Raspti - ok
22:43:29.0921 0476 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
22:43:29.0937 0476 Rdbss - ok
22:43:29.0953 0476 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
22:43:29.0953 0476 RDPCDD - ok
22:43:29.0984 0476 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
22:43:30.0000 0476 rdpdr - ok
22:43:30.0046 0476 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
22:43:30.0062 0476 RDPWD - ok
22:43:30.0109 0476 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
22:43:30.0109 0476 redbook - ok
22:43:30.0171 0476 RFCOMM (851c30df2807fcfa21e4c681a7d6440e) C:\WINDOWS\system32\DRIVERS\rfcomm.sys
22:43:30.0171 0476 RFCOMM - ok
22:43:30.0234 0476 RimUsb (616eac1b0e48b236a5a9b8ae07fdb81c) C:\WINDOWS\system32\Drivers\RimUsb.sys
22:43:30.0234 0476 RimUsb - ok
22:43:30.0265 0476 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\WINDOWS\system32\DRIVERS\RimSerial.sys
22:43:30.0265 0476 RimVSerPort - ok
22:43:30.0328 0476 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
22:43:30.0328 0476 ROOTMODEM - ok
22:43:30.0375 0476 rtl8139 (2ef9c0dc26b30b2318b1fc3faa1f0ae7) C:\WINDOWS\system32\DRIVERS\R8139n51.SYS
22:43:30.0375 0476 rtl8139 - ok
22:43:30.0453 0476 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
22:43:30.0453 0476 Secdrv - ok
22:43:30.0500 0476 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
22:43:30.0500 0476 serenum - ok
22:43:30.0531 0476 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
22:43:30.0531 0476 Serial - ok
22:43:30.0593 0476 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
22:43:30.0593 0476 Sfloppy - ok
22:43:30.0656 0476 Simbad - ok
22:43:30.0703 0476 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
22:43:30.0703 0476 SLIP - ok
22:43:30.0734 0476 Sparrow - ok
22:43:30.0781 0476 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
22:43:30.0781 0476 splitter - ok
22:43:30.0828 0476 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
22:43:30.0828 0476 sr - ok
22:43:30.0890 0476 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
22:43:30.0906 0476 Srv - ok
22:43:30.0953 0476 sscebus (b2063ce662af3ab20045121a5b716df6) C:\WINDOWS\system32\DRIVERS\sscebus.sys
22:43:30.0953 0476 sscebus - ok
22:43:30.0984 0476 sscemdfl (66799dc0afe3dcaf8368cae17394a762) C:\WINDOWS\system32\DRIVERS\sscemdfl.sys
22:43:30.0984 0476 sscemdfl - ok
22:43:31.0015 0476 sscemdm (cbf03ffc08f8db547bab2f79aa663d16) C:\WINDOWS\system32\DRIVERS\sscemdm.sys
22:43:31.0015 0476 sscemdm - ok
22:43:31.0078 0476 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys
22:43:31.0078 0476 StillCam - ok
22:43:31.0140 0476 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
22:43:31.0140 0476 streamip - ok
22:43:31.0156 0476 SunkFilt - ok
22:43:31.0250 0476 Sunkfiltp (bea99d9682ebe7d8b4eaf12971810ad1) C:\WINDOWS\System32\Drivers\sunkfiltp.sys
22:43:31.0250 0476 Sunkfiltp - ok
22:43:31.0296 0476 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
22:43:31.0296 0476 swenum - ok
22:43:31.0328 0476 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
22:43:31.0328 0476 swmidi - ok
22:43:31.0359 0476 symc810 - ok
22:43:31.0375 0476 symc8xx - ok
22:43:31.0406 0476 sym_hi - ok
22:43:31.0437 0476 sym_u3 - ok
22:43:31.0484 0476 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
22:43:31.0484 0476 sysaudio - ok
22:43:31.0546 0476 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
22:43:31.0562 0476 Tcpip - ok
22:43:31.0609 0476 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
22:43:31.0609 0476 TDPIPE - ok
22:43:31.0656 0476 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
22:43:31.0656 0476 TDTCP - ok
22:43:31.0687 0476 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
22:43:31.0687 0476 TermDD - ok
22:43:31.0765 0476 toshidpt (e362d54fd394999c4178936396664e57) C:\WINDOWS\system32\drivers\Toshidpt.sys
22:43:31.0765 0476 toshidpt - ok
22:43:31.0812 0476 TosIde - ok
22:43:31.0859 0476 tosporte (b2842672056ca33f0a4aab3e5cbbf181) C:\WINDOWS\system32\DRIVERS\tosporte.sys
22:43:31.0859 0476 tosporte - ok
22:43:31.0906 0476 tosrfbd (0ec5206059d97a8dc785be73fb457ec7) C:\WINDOWS\system32\DRIVERS\tosrfbd.sys
22:43:31.0906 0476 tosrfbd - ok
22:43:31.0953 0476 tosrfbnp (1ae2ba74b2a4f5a358b13fcd35258c30) C:\WINDOWS\system32\Drivers\tosrfbnp.sys
22:43:31.0953 0476 tosrfbnp - ok
22:43:32.0000 0476 Tosrfcom (5ba1ca3b3cddb1ddc67df473f05d1ec2) C:\WINDOWS\system32\Drivers\tosrfcom.sys
22:43:32.0000 0476 Tosrfcom - ok
22:43:32.0031 0476 Tosrfhid (5dbf390aab62dd0d4d43a9278614e001) C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys
22:43:32.0031 0476 Tosrfhid - ok
22:43:32.0078 0476 tosrfnds (c52fd27b9adf3a1f22cb90e6bcf9b0cb) C:\WINDOWS\system32\DRIVERS\tosrfnds.sys
22:43:32.0078 0476 tosrfnds - ok
22:43:32.0109 0476 TosRfSnd (ab6fd13d7efa2634fa6bdf84c7ef0696) C:\WINDOWS\system32\drivers\tosrfsnd.sys
22:43:32.0125 0476 TosRfSnd - ok
22:43:32.0171 0476 Tosrfusb (d870fd6ce9060b73289f47e88630ee0e) C:\WINDOWS\system32\DRIVERS\tosrfusb.sys
22:43:32.0171 0476 Tosrfusb - ok
22:43:32.0265 0476 UDFReadr (fd0b16f8828f360390135031d8924ccd) C:\WINDOWS\system32\drivers\UDFReadr.sys
22:43:32.0265 0476 UDFReadr - ok
22:43:32.0312 0476 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
22:43:32.0312 0476 Udfs - ok
22:43:32.0343 0476 ultra - ok
22:43:32.0421 0476 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
22:43:32.0437 0476 Update - ok
22:43:32.0500 0476 USBAAPL (83cafcb53201bbac04d822f32438e244) C:\WINDOWS\system32\Drivers\usbaapl.sys
22:43:32.0500 0476 USBAAPL - ok
22:43:32.0531 0476 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
22:43:32.0546 0476 usbaudio - ok
22:43:32.0593 0476 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
22:43:32.0593 0476 usbccgp - ok
22:43:32.0625 0476 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
22:43:32.0625 0476 usbehci - ok
22:43:32.0640 0476 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
22:43:32.0656 0476 usbhub - ok
22:43:32.0703 0476 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
22:43:32.0703 0476 usbprint - ok
22:43:32.0734 0476 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
22:43:32.0734 0476 usbscan - ok
22:43:32.0796 0476 usbsermpt (caad3467fbfae8a380f67e9c7150a85e) C:\WINDOWS\system32\DRIVERS\usbsermpt.sys
22:43:32.0796 0476 usbsermpt - ok
22:43:32.0906 0476 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
22:43:32.0906 0476 USBSTOR - ok
22:43:32.0937 0476 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
22:43:32.0937 0476 usbuhci - ok
22:43:32.0968 0476 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
22:43:32.0968 0476 VgaSave - ok
22:43:33.0000 0476 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\System32\DRIVERS\viaide.sys
22:43:33.0015 0476 ViaIde - ok
22:43:33.0046 0476 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
22:43:33.0046 0476 VolSnap - ok
22:43:33.0109 0476 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
22:43:33.0109 0476 Wanarp - ok
22:43:33.0171 0476 WDC_SAM (d6efaf429fd30c5df613d220e344cce7) C:\WINDOWS\system32\DRIVERS\wdcsam.sys
22:43:33.0171 0476 WDC_SAM - ok
22:43:33.0234 0476 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
22:43:33.0250 0476 Wdf01000 - ok
22:43:33.0281 0476 WDICA - ok
22:43:33.0312 0476 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
22:43:33.0312 0476 wdmaud - ok
22:43:33.0421 0476 WpdUsb (c1b3d9d75c3fb735f5fa3a5806aded57) C:\WINDOWS\system32\Drivers\wpdusb.sys
22:43:33.0421 0476 WpdUsb - ok
22:43:33.0468 0476 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
22:43:33.0468 0476 WSTCODEC - ok
22:43:33.0562 0476 {6080A529-897E-4629-A488-ABA0C29B635E} (1a301c3c65a3d119803fbac5ab65897f) C:\WINDOWS\system32\drivers\ialmsbw.sys
22:43:33.0562 0476 {6080A529-897E-4629-A488-ABA0C29B635E} - ok
22:43:33.0609 0476 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} (4afee4b1625d5146b16526e48953d7a6) C:\WINDOWS\system32\drivers\ialmkchw.sys
22:43:33.0609 0476 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} - ok
22:43:33.0640 0476 MBR (0x1B8) (b716b775fcbdabf0e2ddff76f15c6790) \Device\Harddisk0\DR0
22:43:33.0671 0476 \Device\Harddisk0\DR0 - ok
22:43:33.0671 0476 Boot (0x1200) (266269dda60001e730d59eabdf5cabc2) \Device\Harddisk0\DR0\Partition0
22:43:33.0671 0476 \Device\Harddisk0\DR0\Partition0 - ok
22:43:33.0703 0476 Boot (0x1200) (4defc0fe4b64604c960c83ac1ea57f23) \Device\Harddisk0\DR0\Partition1
22:43:33.0703 0476 \Device\Harddisk0\DR0\Partition1 - ok
22:43:33.0703 0476 ============================================================
22:43:33.0703 0476 Scan finished
22:43:33.0718 0476 ============================================================
22:43:33.0734 3408 Detected object count: 1
22:43:33.0734 3408 Actual detected object count: 1
22:44:25.0375 3408 ACPI ( Virus.Win32.Rloader.a ) - skipped by user
22:44:25.0375 3408 ACPI ( Virus.Win32.Rloader.a ) - User select action: Skip

Thanks for you reply. So since I'm doomed to reinstall Windows, I figured I'd let TDSSKiller perform the cure action after I did a restore point. It did and the problem is gone. Sounds like you are not comfortable that the problem is in fact gone. That begs the question why would anyone need or trust Kapersky if its just an analytical tool and not meant to fix and repair viruses? Regardless, I followed the link to "How to Reformat and Reinstall Windows". There are actually no instructions there on how to do this. More like recommendations on what to do after you've restored your system. By reformat do you mean to format the user partition before laying down a fresh copy of Windows? The PC in question is an HP machine that offers a Destructive system restore where all files are lost. I assume it gets its image from the D:\ drive. How would I know that the OS image on D:\ is not compromised? So that begs the question, do I have to install Windows from a CD? Thanks, Eric