bad case of system check [Solved]

Good morning Oldman 960,
I did not find a user.js file but I did find prefs.js
the only other JScript file is sessionstore.js and i've included that as well,
I hope it's helpful
Patrick

# Mozilla User Preferences

/* Do not edit this file.
*
* If you make changes to this file while the application is running,
* the changes will be overwritten when the application exits.
*
* To make a manual change to preferences, you can visit the URL about:config
* For more information, see http://www.mozilla.org/unix/customizing.html#prefs
*/

user_pref("accessibility.typeaheadfind.flashBar", 0);
user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1329437639);
user_pref("app.update.lastUpdateTime.background-update-timer", 1329437999);
user_pref("app.update.lastUpdateTime.blocklist-background-update-timer", 1329437759);
user_pref("app.update.lastUpdateTime.microsummary-generator-update-timer", 1313016420);
user_pref("app.update.lastUpdateTime.personas-data-refresh-timer", 1329438119);
user_pref("app.update.lastUpdateTime.personas-favorites-refresh-timer", 1329437879);
user_pref("app.update.lastUpdateTime.places-maintenance-timer", 1307465951);
user_pref("app.update.lastUpdateTime.restart-nag-timer", 1240426096);
user_pref("app.update.lastUpdateTime.search-engine-update-timer", 1329506868);
user_pref("app.update.never.4.0.1", true);
user_pref("avg.toolbar.activityIndex", "[]");
user_pref("avg.toolbar.avg-SearchTerms", "");
user_pref("avg.toolbar.avg_newtabinfo", false);
user_pref("avg.toolbar.buttons_hidden", "false,false,false,false,false,false,false,false");
user_pref("avg.toolbar.buttons_hidden_init", "false,false,false,false,false,false,false,false");
user_pref("avg.toolbar.buttons_icon", ",,chrome://avg/skin/safesurf.png,chrome://avg/skin/safesurf.png,chrome://avg/skin/safesearch.png,chrome://avg/skin/avglinks.png,chrome://avg/skin/avglinks.png,");
user_pref("avg.toolbar.buttons_id", "avg-SearchTerms,avg-SearchTerms-Button,avg-SurfSafe,avg-SurfSafeFree,avg-SearchShield,avg-Avginfo,avg-AvginfoFree,avg-Getmore");
user_pref("avg.toolbar.buttons_label", ",Search,Active Surf-Shield,Active Surf-Shield,Search-Shield,AVG Info ,AVG Info ,Get More");
user_pref("avg.toolbar.clientId", "4FD8EA56198F40768E4C3BC3CEEB34F1");
user_pref("avg.toolbar.first_installation", true);
user_pref("avg.toolbar.fourOFourError", true);
user_pref("avg.toolbar.last_location", "http://gurochan.net/g/5.html");
user_pref("avg.toolbar.last_location_count", 0);
user_pref("avg.toolbar.ntObserve_MENUCHECK", true);
user_pref("avg.toolbar.search.textbox.width", 221);
user_pref("avg.toolbar.search_type", "yahoo");
user_pref("avg.toolbar.settings", "{searchMenu1:'',searchMenu2:'',searchChoice:null,'icon-text':'icon-text'}");
user_pref("avg.toolbar.settings.icon-text", true);
user_pref("avg.toolbar.settings.newwin", false);
user_pref("avg.toolbar.settings.search.autorunhist", true);
user_pref("avg.toolbar.settings.search.crossb", true);
user_pref("avg.toolbar.settings.search.dropdlist", true);
user_pref("avg.toolbar.timeId", "fe80::4df:aee:3f57:fef8%1420081229202602");
user_pref("avg.toolbar.timerSTATPOSTING", 1268795238);
user_pref("avg.toolbar.version", "2.0.20080718");
user_pref("avg.toolbar.websearchlink", "http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb");
user_pref("browser.anchor_color", "#3366FF");
user_pref("browser.cache.disk.capacity", 1048576);
user_pref("browser.cache.disk.smart_size.first_run", false);
user_pref("browser.cache.disk.smart_size_cached_value", 788480);
user_pref("browser.display.foreground_color", "#999999");
user_pref("browser.display.use_system_colors", true);
user_pref("browser.download.dir", "C:\\Users\\Ana\\Downloads");
user_pref("browser.download.lastDir", "F:");
user_pref("browser.download.manager.alertOnEXEOpen", true);
user_pref("browser.download.save_converter_index", 0);
user_pref("browser.download.useDownloadDir", false);
user_pref("browser.feeds.showFirstRunUI", false);
user_pref("browser.fixup.alternate.enabled", false);
user_pref("browser.history_expire_days.mirror", 180);
user_pref("browser.history_expire_days_min", 30);
user_pref("browser.migration.version", 5);
user_pref("browser.places.importBookmarksHTML", false);
user_pref("browser.places.importDefaults", false);
user_pref("browser.places.leftPaneFolderId", -1);
user_pref("browser.places.migratePostDataAnnotations", false);
user_pref("browser.places.smartBookmarksVersion", 2);
user_pref("browser.places.updateRecentTagsUri", false);
user_pref("browser.preferences.advanced.selectedTabIndex", 1);
user_pref("browser.rights.3.shown", true);
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.sessionstore.resume_from_crash", false);
user_pref("browser.shell.checkDefaultBrowser", false);
user_pref("browser.startup.homepage", "http://www.meebo.com/|http://www.menewsha.com/|http://crysandrea.com/");
user_pref("browser.startup.homepage_override.buildID", "20120208060813");
user_pref("browser.startup.homepage_override.mstone", "rv:10.0.1");
user_pref("browser.syncPromoViewsLeft", 0);
user_pref("browser.visited_color", "#990000");
user_pref("extensions.blocklist.pingCountTotal", 149);
user_pref("extensions.blocklist.pingCountVersion", 5);
user_pref("extensions.bootstrappedAddons", "{}");
user_pref("extensions.databaseSchema", 11);
user_pref("extensions.enabledAddons", "[removed]:1.6.2,[removed]:0.9.11,{AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.99,{972ce4c6-7e08-4474-a285-3208198ce6fd}:10.0.1");
user_pref("extensions.enabledItems", "{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15,{20a82645-c095-46ed-80e3-08825760534b}:1.2.1,[removed]:0.9.11,{AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.81,{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17,[removed]:1.6.2,{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20,{3f963a5b-e555-4543-90e2-c3908898db71}:10.0.0.1151,[removed]:1.2,{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23,{3112ca9c-de6d-4884-a869-9855de68056c}:7.1.20101113Wb1,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.17");
user_pref("extensions.installCache", "[{\"name\":\"winreg-app-global\",\"addons\":{\"{20a82645-c095-46ed-80e3-08825760534b}\":{\"descriptor\":\"c:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v3.5\\\\Windows Presentation Foundation\\\\DotNetAssistantExtension\",\"mtime\":1251878463103}}},{\"name\":\"app-global\",\"addons\":{\"{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\":{\"descriptor\":\"C:\\\\Program Files\\\\Mozilla Firefox\\\\extensions\\\\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\",\"mtime\":1311127068747},\"{972ce4c6-7e08-4474-a285-3208198ce6fd}\":{\"descriptor\":\"C:\\\\Program Files\\\\Mozilla Firefox\\\\extensions\\\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\",\"mtime\":1329151042365}}},{\"name\":\"app-profile\",\"addons\":{\"[removed]\":{\"descriptor\":\"C:\\\\Users\\\\Ana\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\d5btn3lz.default\\\\extensions\\\\[removed]\",\"mtime\":1329150958203},\"[removed]\":{\"descriptor\":\"C:\\\\Users\\\\Ana\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\d5btn3lz.default\\\\extensions\\\\[removed]\",\"mtime\":1267114036844},\"[removed]\":{\"descriptor\":\"C:\\\\Users\\\\Ana\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\d5btn3lz.default\\\\extensions\\\\[removed]\",\"mtime\":1294025604858},\"{20a82645-c095-46ed-80e3-08825760534b}\":{\"descriptor\":\"C:\\\\Users\\\\Ana\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\d5btn3lz.default\\\\extensions\\\\{20a82645-c095-46ed-80e3-08825760534b}\",\"mtime\":1274192757151},\"{3112ca9c-de6d-4884-a869-9855de68056c}\":{\"descriptor\":\"C:\\\\Users\\\\Ana\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\d5btn3lz.default\\\\extensions\\\\{3112ca9c-de6d-4884-a869-9855de68056c}\",\"mtime\":1297541371340},\"{AE93811A-5C9A-4d34-8462-F7B864FC4696}\":{\"descriptor\":\"C:\\\\Users\\\\Ana\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\d5btn3lz.default\\\\extensions\\\\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi\",\"mtime\":1329007278194}}}]");
user_pref("extensions.lastAppVersion", "10.0.1");
user_pref("extensions.lastPlatformVersion", "10.0.1");
user_pref("extensions.pendingOperations", false);
user_pref("extensions.personas.current", "{\"id\":\"105723\",\"name\":\"Blood Red Moon\",\"headerURL\":\"http://getpersonas-cdn.mozilla.net/static/2/3/105723/BloodRedMoon.png?1266556164\",\"footerURL\":\"http://getpersonas-cdn.mozilla.net/static/2/3/105723/Untitled1.png?1266556164\",\"iconURL\":\"http://getpersonas-cdn.mozilla.net/static/2/3/105723/preview_small.jpg?1266556164\",\"previewURL\":\"http://getpersonas-cdn.mozilla.net/static/2/3/105723/preview.jpg?1266556164\",\"author\":\"DragonCurse4\",\"updateURL\":\"https://www.getpersonas.com/en-US/update_check/105723\"}");
user_pref("extensions.personas.lastselected0", "{\"id\":\"105723\",\"name\":\"Blood Red Moon\",\"headerURL\":\"http://getpersonas-cdn.mozilla.net/static/2/3/105723/BloodRedMoon.png?1266556164\",\"footerURL\":\"http://getpersonas-cdn.mozilla.net/static/2/3/105723/Untitled1.png?1266556164\",\"iconURL\":\"http://getpersonas-cdn.mozilla.net/static/2/3/105723/preview_small.jpg?1266556164\",\"previewURL\":\"http://getpersonas-cdn.mozilla.net/static/2/3/105723/preview.jpg?1266556164\",\"author\":\"DragonCurse4\",\"updateURL\":\"https://www.getpersonas.com/en-US/update_check/105723\"}");
user_pref("extensions.personas.lastselected1", "{\"id\":\"25608\",\"name\":\"red blood\",\"headerURL\":\"http://getpersonas-cdn.mozilla.net/static/0/8/25608/2.jpg?1260925626\",\"footerURL\":\"http://getpersonas-cdn.mozilla.net/static/0/8/25608/1.jpg?1260925626\",\"textcolor\":\"#bf0707\",\"accentcolor\":\"#666666\",\"iconURL\":\"http://getpersonas-cdn.mozilla.net/static/0/8/25608/preview_small.jpg?1260925626\",\"previewURL\":\"http://getpersonas-cdn.mozilla.net/static/0/8/25608/preview.jpg?1260925626\",\"author\":\"escamia14\",\"description\":\"this is made by Eduardo Escamilla if you like this Personas for Firefox contact my on my myspace.com/eaescamia\",\"updateURL\":\"https://www.getpersonas.com/en-US/update_check/25608\"}");
user_pref("extensions.personas.lastselected2", "{\"id\":\"141882\",\"name\":\"kanagawa wave\",\"headerURL\":\"http://getpersonas-cdn.mozilla.net/static/8/2/141882/kanagawa_top.jpg?1269193346\",\"footerURL\":\"http://getpersonas-cdn.mozilla.net/static/8/2/141882/kanagawa_bottom.jpg?1269193346\",\"textcolor\":\"#000000\",\"accentcolor\":\"#b3b3b3\",\"iconURL\":\"http://getpersonas-cdn.mozilla.net/static/8/2/141882/preview_small.jpg?1269193346\",\"previewURL\":\"http://getpersonas-cdn.mozilla.net/static/8/2/141882/preview.jpg?1269193346\",\"author\":\"i.santos\",\"updateURL\":\"https://www.getpersonas.com/en-US/update_check/141882\"}");
user_pref("extensions.personas.lastselected3", "{\"id\":\"6490\",\"name\":\"Bloodstains\",\"accentcolor\":\"#000000\",\"textcolor\":\"#fcfcfc\",\"description\":\"this is my first layout..\\u000d\\u000akinda bloody.. >\",\"author\":\"Griever\",\"headerURL\":\"http://getpersonas-cdn.mozilla.net/static/9/0/6490/bloodh.jpg?1260925626\",\"footerURL\":\"http://getpersonas-cdn.mozilla.net/static/9/0/6490/bloodf.jpg?1260925626\",\"previewURL\":\"http://getpersonas-cdn.mozilla.net/static/9/0/6490/preview.jpg?1260925626\",\"iconURL\":\"http://getpersonas-cdn.mozilla.net/static/9/0/6490/preview_small.jpg?1260925626\",\"updateURL\":\"https://www.getpersonas.com/en-US/update_check/6490\"}");
user_pref("extensions.personas.lastselected4", "{\"id\":\"33\",\"name\":\"Groovy Blue\",\"accentcolor\":\"#6699ff\",\"textcolor\":\"#07188d\",\"header\":\"3/3/33/tbox-groovy_blue.jpg\",\"footer\":\"3/3/33/stbar-groovy_blue.jpg\",\"category\":\"Abstract\",\"description\":null,\"author\":\"Lee.Tom\",\"username\":\"Lee.Tom\",\"detailURL\":\"http://www.getpersonas.com/persona/33\",\"headerURL\":\"http://www.getpersonas.com/static/3/3/33/tbox-groovy_blue.jpg\",\"footerURL\":\"http://www.getpersonas.com/static/3/3/33/stbar-groovy_blue.jpg\",\"previewURL\":\"http://www.getpersonas.com/static/3/3/33/preview.jpg\",\"iconURL\":\"http://www.getpersonas.com/static/3/3/33/preview_small.jpg\",\"dataurl\":\"data:image/png;base64,/9j/4AAQSkZJRgABAQEASABIAAD/2wBDAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQICAQECAQEBAgICAgICAgICAQIC
AgICAgICAgL/2wBDAQEBAQEBAQEBAQECAQEBAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC
AgICAgICAgL/wAARCAAQABADAREAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAABAcICv/EACAQAAIDAAEFAQEAAAAAAAAAAAMEAQIFBgcIERIjEyX/xAAZAQACAwEAAAAAAAAAAAAAAAADCAQFBwn/xAAlEQACAQMCBgMBAAAAAAAAAAABAgMEERIAIQUGExQiMQcyM1L/2gAMAwEAAhEDEQA/AL9p21L52peGctNVXkGbWsGZhNZlXBWo0sHVSVucA9BryNibVm9Iq3ahWLengV+g03yTMyl+6aV1YE45
YmTZsGsCVxBUjx+psovuFgi5IjlgRUhI7RjYHyJy93Y5EKxBW+9wrKN9wjsft65bGnnPK4+kTguZqqKcd
JstEzbuzyTdErUtSFqszqY4uR7lQGdQ+q13rML1vWIrN1U/I1N2FTG6oKipx6pUlijxRM+ICsRE8scbuqSDEqCvsAiRJyNRvUBHqcq9I5XdFTxaNbKcmxdWMcYRSt/IqokK5a0NdQOicaI0cEnGi6eWiWTKvqghltgpT1GECpZj+DYQmXSG97SAtxBkXibk9Ul4TzXMk3dSV6w
Mga6MSDshAuB+xYiNQVs4F8jZV1u9RwmCKGdKWneSorMFJGPTQGRWkYljZVAyKqQRckAG+i+M9rHGtTUI
31CU3dwGWRG+GN7lTWmhe4VpCxNRnr+y47Wm9qxSwigg5A0YJT6yDifOtS0MS8Km6JmDdZelgASbgeyrE
fUtdg4VXKoSU0bhlDJStUxz00KgWWORAuboP6IAIBIywKgKSRd7Btf/2Q==\"}");
user_pref("extensions.personas.lastversion", "1.6.2");
user_pref("extensions.personas.persona.lastChanged", "1301350716424");
user_pref("extensions.personas.toolbarButtonInstalled", true);
user_pref("[removed]-event-fired", true);
user_pref("extensions.searchtoolbar.installed", "1");
user_pref("[removed]-event-fired", true);
user_pref("extensions.shownSelectionUI", true);
user_pref("extensions.update.notifyUser", false);
user_pref("font.name.serif.x-western", "Papyrus");
user_pref("general.useragent.extra.microsoftdotnet", "( .NET CLR 3.5.30729; .NET4.0C)");
user_pref("general.useragent.extra.searchtoolbar", "SearchToolbar/1.2");
user_pref("gfx.blacklist.layers.direct3d9", 3);
user_pref("google.toolbar.auto_page_translate.blacklist.counter", "{\"sw\":1,\"de\":1,\"cy\":1}");
user_pref("google.toolbar.auto_page_translate.rules.blacklist", "en");
user_pref("google.toolbar.auto_page_translate.rules.whitelist", "");
user_pref("google.toolbar.auto_page_translate.whitelist.counter", "{\"it\":1}");
user_pref("google.toolbar.button_option.cached.gtbCountrySearch", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbCountrySearch\" tooltip=\"gtbMultilineTooltip\" label=\"USA\" fullText=\"USA\" hassearch=\"true\" class=\"gtb-custombutton gtbHelperIcon gtbSimpleCustomButton\"/>");
user_pref("google.toolbar.button_option.cached.gtbFeelingLucky", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbFeelingLucky\" tooltip=\"gtbMultilineTooltip\" label=\"I'm Feeling Lucky\" fullText=\"I'm Feeling Lucky\" hassearch=\"true\" class=\"gtb-custombutton gtbHelperIcon gtbSimpleCustomButton\"/>");
user_pref("google.toolbar.button_option.cached.gtbSearchBlogs", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchBlogs\" tooltip=\"gtbMultilineTooltip\" label=\"Google Blog Search\" fullText=\"Google Blog Search\" image=\"data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAYBJREFUeNqUkjtOA0EMhr1LRD
YUtCCliKiQ4AB0CIkLQIkENHCgiAMgIeAAiANQ86iQoEcUqSkSsrvjMX7MLLME8bBi2Zkdf/49MxkRwcndMU0QYeLYMXH97yH9Ng756PAmA7Z8eHtEpfdQewIkc07NQSKZg0X+cQaweLopATpClaKKKy
ry4Dh3lMJmgaKaFBMA8rFmFaKkUjWmyPk2DIMS5P1o9QLwSnVBQYUJiMRJYwS5ZFQDODRA8CpRImNFNRK
jItcCoAGwAVAzTonfQHSfqVbAmBUQRABwFyuKSspUUVAosHAEpkBOFQGaGWvdLOdBbUBy3dE6ktpVQjNG
PNB0lAiSNbEizzVm+f4a7e6t6gMZTafwVjuFSKflogvzeWY3odfqG+mP16+A509ZJvLnDtZ1fWNnwJBSF
fR7BdxfvYD0kZ72Aj+l08WzPmUFRFu53KZ3ljtY6MEDF0sH+MXyrwv9XvfPxTO2dLZFciYU3jvnP+5P1Z
ucfxRHwIcAAwAX2fYcgJ+EGwAAAABJRU5ErkJggg==\" hassearch=\"true\" class=\"gtb-custombutton gtbHelperIcon gtbSimpleCustomButton\"/>");
user_pref("google.toolbar.button_option.cached.gtbSearchBooks", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchBooks\" tooltip=\"gtbMultilineTooltip\" label=\"Google Books\" fullText=\"Google Books\" image=\"data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAiNJREFUeNp0kztvE0EUhc/Ya5uEFCsiiJQiwjJIiAaLAkSFRUPrAgpqfgBQUSL/gkBBDRJFCpB4SBFNikAVCRE5giISTmQkjCP8iNfG6915MjO7fuKMdKTdO3O/e+beXXJzSxXWs/U8gAda57VKWk+v5lY7mFi7B7/N3hOt4iBkL299WHsfPMY20QB1xhG4d7aDC6fo8LxJfmZA8ftDU4AL6W5WM3jxLYUjL0BYWiGO2W3zJJ7
Xl5HLUNx2e7i4SN242hWtgpTK/dpI4tX+Asq1EIzqQioiO8OSSgf2+2l895ZxbWmAG66PS0u0uNdO4u2hg51fCjTwIQVGyRYgRPQuJWCeO
Qc+Nxew8amOQesYK+kuFnOXIZiwRZScykeCMWhLWiySAXANCrwuglYDYevIwodSk9nGAWVR0EiYQyICKG
NHMhDJpwByHsB4MhvDQyYXgoMIaiE2Fmt2OSxuqJoBKE5BeADi0Cgu/rc/vkIMUEOAqcRDENbXgMAC51WfuoKauQaoD0J7IKnIwUnLCX3dKCc1auQY0Eci9EAyBGpepm6uHWN752PH
r/20I6TxKBmPHUg2t6r0/oAe7Np/JaGblfV/fCn9LW+BHjfsCE+yrPwuWHUPvF4p6SllTYyMdu+8Nn/besJdLTpreSTLG0CzgnNuGvL6fdQqh5C95jt95hHe3K1Gn7+aAIxBBQvig7y5ZzqVQEBOl+PE7SlHGvB
PgAEAhIhYJbvKryMAAAAASUVORK5CYII=\" hassearch=\"true\" class=\"gtb-custombutton gtbHelperIcon gtbSimpleCustomButton\"/>");
user_pref("google.toolbar.button_option.cached.gtbSearchCalendar", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchCalendar\" tooltip=\"gtbMultilineTooltip\" label=\"Google Calendar\" fullText=\"Google Calendar\" image=\"data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAldJREFUeNp8U01oU0EQ/t4zeU00iWLxr2nFXlSohyCkrTcv6kH0VAVPiiBeBfHmoUfBn4NHEQTxZKugN0FQNFiEgBfbElQkmor2x
6bv2TQvb3fH2d2X0ODPwDCbt/N9M9/sxCEipK4pgpIgdsiIXYBky5xJcBQhR+uImiB2df+YAzbXgElBfXsLURqH+l4Gf4Ax0tE6LVdAlQeglQ/myjnzxCS5ujKUwoa5F1CLM5xQhSbUboiYRHeJxg9QUIW39tkSky2SMG1zcqZ4Ef37D+JnuoAgVIbUkJO
9zw2OonfPdiyG29DyQ1tEExjNXCmQPfCTh4CWYCDPQAPj7nQMGoAv8ka/BVObQMStKgz1ClwoNJHPCLypEm6VWAaTjfYrDPc5mHynUFtSdtgdCXraZmAKp/f+wtHdLdQbLVwa8fCFk7NJhauHHUjpYuojobYgbGexuUYCPxVxvPEqwsjtOm5yVJyUz0hMfQowUa7zb9
sNccdt/bYD/c7xtH1KoHo5Z6au/dl0gJl5F5PTCZw4oCyYSdYbdxB2LcqpO1XcLS2ZiueKPXaZ2IWUJra1dwgoCjvbdmQwgu/uwMRsmjUr7Mooc0ci4lnrTe0GxxLC+EUUzhaSGB5wjURd8d7rBT7omTlQ9CfYbKR7/iW11za/cRXFnWvIplw8n13FXCNnNGc9iX2b66isbOElcztgejjmJBB6INc3BLW6g9pyyr6z2sTfIpOoQeX5rd2V
KW0l9PmP4Q2NQbaXY92W/cuSSQ/N94/4dJyJGDRw8sr/EX+xr0+vm7/zbwEGAAc7ldeFiLAmAAAAAElFTkSuQmCC\" hassend=\"true\" hassearch=\"true\" type=\"menu-button\" class=\"gtb-custombutton gtbHelperIcon gtbButtonWithSeparateMenu\">");
user_pref("google.toolbar.button_option.cached.gtbSearchDocs", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchDocs\" tooltip=\"gtbMultilineTooltip\" label=\"Google Documents\" fullText=\"Google Documents\" image=\"data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAfxJREFUeNqEU8tOFEEUPcXMII
I6gisxkogkGk0gceUs3bHgB4wkfAD/IIlbl/yBBj/ApTEhIS5MXBAzhhiBlTIsZoQZm+7pqdf1VlV3T08YY3Vu30pVnXNPnaoSRIS8vW6CzhRwJkP0uD93BVi
7Dazfh8jXCRG6DlvNB7cPQJK5tAWMyxwp95s9oMLzFQI9XwokDpiTTOQEkQaOv+3jYPc94iSBZLDKwqlp
pcC7IwzlZq0gcHK/f97F8dcvqHZb6JugYMDRVYGgTJJvvSA450X1Rw3MP1xBdOMOYiaIWZUj6rGcVn9IslNSUnjgZFYfNCCX
gFMG/WHCCyaQ2uBXfIFuPIGalRwKkzrBUfsWbTXqQuRSnn0EObmpq8wRMUGfHTVawqoBrB74bFTIc5NAe/OxKBR0BmwYBYLEhMrWKAbKLGvOGpRFx+2vvIWODEeorYW1AUweJD0JcSbNY26c5y95kEieIMuTHMZwVr
6S9SCZKZFeBUqnWRAYmWLqpIna+QmixaewlZqv5mVrlSlhY7jI2HtgZR/Xfuyh3mpiWbTZqDSYlxs4BjyqgAG9hSdYnJY4pBnvtjfMar8lXL6EowRXSSKaXcCe8yF2fphgFo0H3py
qjRJc//QG91Y3PMB9/yhYtN8f3vJ/GaL8nO++ePkf2LD93Hnln+NfAQYAumFzRInKlVsAAAAASUVORK5CYII=\" hassearch=\"true\" class=\"gtb-custombutton gtbHelperIcon gtbSimpleCustomButton\"/>");
user_pref("google.toolbar.button_option.cached.gtbSearchFinance", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchFinance\" tooltip=\"gtbMultilineTooltip\" label=\"Google Finance\" fullText=\"Google Finance\" image=\"data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAbBJREFUeNp8U8tKw0AUPVOmD6
RKbX1S7MaCLxRXoi79BTf+k0vBr/AHXLnSjY+VLkShUNwJtrZqm8zLm8mkmcbiwM3NZHIecyZhxhiw8wODaBi/6KKpa+qKuqIuqURa5vSBMZztp+DoEnXt5j44SxBSBRrcLiCjnJBk1aUHDrXtudHCpPLs1koFNOszY+DG
QpkcSKcIz3bUVeLAYLteQXGugLvOJ7CUB16H2F2r4auaJ4JwwhZ0bLuYy+FoZxnPYoCnCByNCkdjbw5tI
v/oDFKCldkpNBfLuH55Rxgo1Gm+s17F7WcP3VBYzliAoR0GtC1GIgx8c34aG40K+kzhbTDEyuoMykOGqWo
R150ufqSiXZrUoQ03BkMSQWm5hPvvPqLvQVEJqo+8RtAN6JS0fZaCWUwgXZEL3vr+iSOweRmrJhzQ+NlY
VVhVW8I56AmZZpiAgPFgE7DywGHOrnFrMQvyAotPxBEIBw7ccxo8uUkJ2N/AJDxlF6AbnKtonWW+BaegM7ZFqmzBFDaXVz0cHjdoyjL2PQcJmWFjZm8uW2D2dz7ZMv/mkIlp9NrFI/sVYAAImD1GaD1GagAAAABJRU5ErkJggg==\" hassearch=\"true\" class=\"gtb-custombutton gtbHelperIcon gtbSimpleCustomButton\"/>");
user_pref("google.toolbar.button_option.cached.gtbSearchFroogle", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchFroogle\" tooltip=\"gtbMultilineTooltip\" label=\"Google Product Search\" fullText=\"Google Product Search\" hassearch=\"true\" class=\"gtb-custombutton gtbHelperIcon gtbSimpleCustomButton\"/>");
user_pref("google.toolbar.button_option.cached.gtbSearchGroups", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchGroups\" tooltip=\"gtbMultilineTooltip\" label=\"Google Groups\" fullText=\"Google Groups\" hassearch=\"true\" class=\"gtb-custombutton gtbHelperIcon gtbSimpleCustomButton\"/>");
user_pref("google.toolbar.button_option.cached.gtbSearchImages", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchImages\" tooltip=\"gtbMultilineTooltip\" label=\"Google Images\" fullText=\"Google Images\" hassearch=\"true\" class=\"gtb-custombutton gtbHelperIcon gtbSimpleCustomButton\"/>");
user_pref("google.toolbar.button_option.cached.gtbSearchLocal", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchLocal\" tooltip=\"gtbMultilineTooltip\" label=\"Google Maps\" fullText=\"Google Maps\" hassearch=\"true\" class=\"gtb-custombutton gtbHelperIcon gtbSimpleCustomButton\"/>");
user_pref("google.toolbar.button_option.cached.gtbSearchNews", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchNews\" tooltip=\"gtbMultilineTooltip\" label=\"Google News\" fullText=\"Google News\" hassearch=\"true\" type=\"menu-button\" class=\"gtb-custombutton gtbHelperIcon gtbGadgetButtonWithSeparateMenu\"/>");
user_pref("google.toolbar.button_option.cached.gtbSearchPatents", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchPatents\" tooltip=\"gtbMultilineTooltip\" label=\"Google Patents\" fullText=\"Google Patents\" image=\"data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAe1JREFUeNp8U01PE1EUPa8t6W
ChHwqEREhMjLrABYSEhWxcu2LDip/ABoIrE/UPaKoL3bvRJWxxpTG6kkA0QgxIalpooZ2kHxRC38xcz0yZpl/jTe68O+/ec+65b+YpEYFvSqlWLH+WpqGPnsMqlaHzr9WMudPKtWO6CST7ZBp2LQ3r9CEJQDAYA87ZJzjhVTVn7QQ
S4O/yLT63YZeTsIpNoOcmCTTENsqwBmfUvJnxISG0my6k0cgluRJUAoncztSs6WHGA0nRg+l2SKSTILcAsVh
8AQzcBCZecZPv2RXI2QFDA9IYXmiHdCk4ZhFn1idAbA4w7tGnSPaoCdbXgMYQggm8ea+k1z5zrfK9CjG3
3M6QywTPIYrAEYoFweiYwxHIW/0O2V0EzmME5tg9RZIYSpU6xoMU7O/FPZmihwga5qEl2MKNRwl2pSscFrMdCjo/I+3byxGZnYojEopCGRMkuYRTcaAtG9uZfTxYK6ngM6C5BVu/OPfFdWZZq2refj9wD4H/KzcLFUKpPEKJDGVWkS/YqSuFwSP4BF9f3MD9ydsSv/ubI9RR+zGCn6b2kvOPzf/fBd8Ojk0vUamft9KzdyZ7LlPPGfj2bn0TkbBCzIhi4+MXz/uay+Z79/6ztx/k6Zv34sZc+2L+CTAA7m0R8VXjGbYAAAAASUVORK5CYII=\" hassearch=\"true\" class=\"gtb-custombutton gtbHelperIcon gtbSimpleCustomButton\"/>");
user_pref("google.toolbar.button_option.cached.gtbSearchPhotos", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchPhotos\" tooltip=\"gtbMultilineTooltip\" label=\"Picasa Web Albums\" fullText=\"Picasa Web Albums\" image=\"data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAt9JREFUeNpcU01ME0EU/rbdtvzTghWKFCPhRyQShaiRHz2YeECTwsnEgx48wQkTMJwkHIwHOaAXPBhvJkZjQAU5eCLBkyYmBYuJR
iihECgtULptd2d3xzdbStCXvMzs5H0/782shCORTsXcnPMRnWkD+C90XR3nJh8tP167mzujWki5j0w63sM0dVLspcVvMKKbYEuL4P5a8NaLQFmZ
VSdB6vVW1k/9Q3AITnJoW8twvH4GlspAVzJglGrnNfh6KqHKzWCSVwB7K3yNU4LAlla23QLM4xyxl2vYeW9D6spdGDY
Zpm6CGyZJAQ4WROn+Y8j6CiRJmtyIhNxC3CZ6Fpv42wipaqSoIT5fAPN6H4yiEpjMADeJiG1AyiyhZHc4
NwALZzMMfSC9kIQaI8tUbBiGRbL50wbnENX4TmRd6FHKCOxqEPLeG9hlhzVo2ZrBugLGmKVkUDH3SzgWq
IBcXIjC4YfgUQIbnykZKUvQk6tAadaILAaRXlNIncE0qdk6O6punYTT6SSXpFxQgMIaP3gkH1wrBkw7Sp
xhJA5uzyYm5KhxkQMdyoV8fOlqIrDDAgvywzXtgZmspPRhR20lp3rWQWI/Aaffhc3LxRh1n4MzrOB2jUq0/ICAW60lHR2QmFPcADL5TTBT6SzBysofNJ85i/FYNULbHC0uDV9jQUyvzyFFA02Ssz2dIanRbbA8NLh8eFTRiuVwGLV1RBBc+IH6ugYMnOKYX8+jFlWE9s
KYi4ag6AYSOhFoDEwjOVXCvfNXIUYlcB2d3bD19Q1J7yYn0e7leNW2g2pysE+gjYyKLVWlfrPgIjMPT1v
uoLvxEj7OfILAWU9b9ChiYuIJ7w0E6G1zfN/+jee/ZrGqxFDl8KC9/DS6/W3wFnnwYXrGAlO9WLPvQMTBocUWuHkDL7rui9dm3YKqaaQ6e1h39C+VxVRzLhQl5RkcHNnNER0NARwbG
3UfuEV//wPLwV8BBgAilqQLWMIqvAAAAABJRU5ErkJggg==\" hassearch=\"true\" class=\"gtb-custombutton gtbHelperIcon gtbSimpleCustomButton\"/>");
user_pref("google.toolbar.button_option.cached.gtbSearchScholar", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchScholar\" tooltip=\"gtbMultilineTooltip\" label=\"Google Scholar\" fullText=\"Google Scholar\" image=\"data:image/x-icon;base64,AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAQAQAAAAAAAAA
AAAAAAAAAAAAAAD//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////4yMjP9OV1r/PktM/7W1tf////////////////////////////////////////////////////////////////8hJCj/ZL72/1Oezf9ra2v/////////////////////////////////////////////////////////////////SkpK/1Oi1f9Dhqz/lJSU/////////////////97e3v/39/f//////////////////////////////////////4yMjP9Lkrz/MmqM/+fn5////////////56Zl/+QQTD/bktF/8bHxv////////////////////////////////+cnJz/Q4a0/ylVa//Nzc3/kIyM/3dHPv/eXDn//2xC//9sQv+tTDH/hGRb/5eXl/+1tbX/3t7e////////////ra2t/0OGrP9LboT/lC8h/95UMf/3XDn//2xC//9sQv//bEL//2xC//dgOf/GRDH/czAh/5SUlP///////////97e3v9Afpj/X3mH/3ssGP/nUDH/91g5/7VMMf+cQCn/nDsp/61IKf/3WDH/71Ax/0oYEP/n5+f////////////39/f/GDhS/21vcv8wHxf/nDMh/5wzIf/eTDH//1Q5//9UOf/nTDH/pTch/4wrGP9EJh//////////////////jIyM/zFJWv9SLCn/zkQx//9UOf//VDn//1Q5//9UOf//VDn//1Q5//9UOf//VDn/pTMh/0w3Mf+xsLH//v7+/z4fF//GQCn/xkxC/71QSv+cREL/pURC/3swMf9rJBj/vUAp//9UOf//VDn//1Q5//9UOf//UDn/ShgQ/zAzMP/v7+//jIyM/2ZBN/+MKyH/70wx//9UOf//VDn/xkAp/85EMf//VDn//1Q5/95IMf97KBj/Nh8Y/4SGhP/n5+f/////////////////xsbG/1dVUv9wJx//xkAp//9QOf/GOyn/cyQY/1IzMP9zc3P/xsbG////////////////////////////////////////////5+fn/4SEhP82LCn/e3t7/97e3v//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAA==\" hassearch=\"true\" class=\"gtb-custombutton gtbHelperIcon gtbSimpleCustomButton\"/>");
user_pref("google.toolbar.button_option.cached.gtbSearchSite", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchSite\" tooltip=\"gtbMultilineTooltip\" label=\"Search Site\" fullText=\"Search Site\" hassearch=\"true\" class=\"gtb-custombutton gtbHelperIcon gtbSimpleCustomButton\"/>");
user_pref("google.toolbar.button_option.cached.gtbSearchVideo", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchVideo\" tooltip=\"gtbMultilineTooltip\" label=\"Google Video\" fullText=\"Google Video\" image=\"data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAghJREFUeNpsksFrE0EUxr83M7
ubpkK0tLYB9VArUolHvfUgvXn3Ih79Q/wL/AMURNSrQs8eBEF67E3sIbSUpralIDQsscnOjO/NzCZd6ZKXmd2d7zff93bIe4/tr8f+sF/i90GJvKXRe7QAbQhyfdsaYH93iLVeBxtPu+HZqKzw4fUu3n/fJPr8tu/zQoUX5bDCYL+EQNcedKaQnR9n2Ps1xK3VeTx+cjM8G/+1+PJuD3p9+cWrG4sFslxBQNoonByOcHo0wlK3BaUJ3TvtAO//PMf5nzFu370W1t172AE9v//Ri7g9b1BfsngydijmNObaevr8ZDAK7hYWWxw1ujbLvdWwuxG7RHDWoc3iauK5XCiBTXgsVuL87ILHIb/juZEFznlMSACA57nc20rKwVq+ryu986kcuzFC1JyTYr/YIuJCFohYNqgh9j8Q+Bcd2CZActYCcVKJEx5d1QQpRdGBUhKfmoDaRTWDXAbJuoy/2hUA34hxGRJANkaSMxKaL52k8EVijBowbaaNO4Z+iAP+OnI25MTm0YFlQNxd/n0dw/mmi+REcou44DJZikDpE14JSBDvEGznRRRnWTpI7oLzKhfVwKwPLkIEJhGlYSIOtpMYrDVHfgvr158F0Q
wQR4mmpUxdKkSQzTS73j7+BBJhb+XlTJ2aQampYc4TcUFoXjsHb+ifAAMAoBeO3DWt6ZQAAAAASUVORK5
CYII=\" hassearch=\"true\" type=\"menu-button\" class=\"gtb-custombutton gtbHelperIcon gtbButtonWithSeparateMenu\">");
user_pref("google.toolbar.button_option.cached.gtbSearchWebhistory", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchWebhistory\" tooltip=\"gtbMultilineTooltip\" label=\"Web History\" fullText=\"Web History\" hassearch=\"true\" class=\"gtb-custombutton gtbHelperIcon gtbSimpleCustomButton\"/>");
user_pref("google.toolbar.button_option.cached.gtbstoolbar-google-com_CTK0Y7F4MTG6NKYH03WT-xml", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbstoolbar-google-com_CTK0Y7F4MTG6NKYH03WT-xml\" tooltip=\"gtbMultilineTooltip\" label=\"orkut\" fullText=\"orkut\" image=\"data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAqlJREFUeNpcU89PE0EU/na67bZIYkmlCoIKRBSCgjH8BcZo4gGayMV40cR48FJvxkSB/4DEkxrjzcSkCTXxwkUvKD+MgqjBA4SSEvAH0G1oty2dmfXNLF3RSWbe7M77vve992YM7BtL999HhRDDv
FodrHJ+giyqVQ6yGbJpIfjoxZfX7Zq/67owah8rD2YGCfyccx7VQK6BHgH3iWw6v3Fl/Gb6HwIFllKOEwE5c+S2t5HNZmDbNiJ1dTgUa4RlRXxCUpIYfH07rQmUbMVBBFHBBaanJsGPC5y61INQf
QiOXcDH1AwCawF0dfYQQZWIuM2FaBuauGObKmdiihIBZqbeofVaO/qu9kNKAUFTCo6TF7owl5rF12ef0dnRBUn+rpTDFPguI8ZkTbaKrMGuhCJ01SSZap5NnIc4JlEo7uj/jLGkSp+JvWJls6voHfIiS6qFtj6BR3hm4Bw2c7/1XqWiCThJVIWx87m/sn2wVHJp79J/idABC06hoM8M5jXQ5MqJVAQC5l507svWYCE1WNlS3kE4EtFnLMA8BW9fTIAqiqNNLbpQKpo3pQ9W3VE+
317NoyEaAwyD2i08ArVIQ1Kfw3AWiphPfdBgQWAF8sHpOYgVjpBpwbRMrM2teCkE60Jj5WIpaRBrT3cfF
p58QmZ6Gd0DfZqonC9h6c13FBd20NF+WoOUstowRiK3omErnOu93A+xS7eMCuo4Rfz4uU7XeVfXJhaL68
iqcGY4iOXJRVQqlYaHzmObjZSe2uVKObE0u0gAao1pIBiy0HykFa3NbWiKt8AKerKZybD+ZVWBE5Zl6Ud
lqoUUpLc2NhPF7cJ4Y9th1McPglkBGJLpgql7kd/IYSvzqwZO+ynsf84qHQPGMDkk8d/YrVTGXGBURb5nP/Kf8x8BBgBz4u2PF2RV9wAAAABJRU5ErkJggg==\" hassearch=\"true\" class=\"gtb-custombutton gtbHelperIcon gtbSimpleCustomButton\"/>");
user_pref("google.toolbar.button_option.cached.gtbstoolbar-google-com_J66T77NJDBMW4FEUU7FA-xml", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbstoolbar-google-com_J66T77NJDBMW4FEUU7FA-xml\" tooltip=\"gtbMultilineTooltip\" label=\"Gmail\" fullText=\"Gmail\" image=\"data:image/x-icon;base64,AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAQAQAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAADg42v84ONr/p6f5/6en+f+np/n/p6f5/6en+f+np/n/p6f5/6en+f+np/n/p6f5/6en+f+np/n/ODja/zg42v84ONr/ODja/+Li////////////////////////////////////////////////////////4uL//zg42v84ONr/ODja/zg42v+np/n/4uL/////////////////////////////////////////////4uL//6en+f84ONr/ODja/zg42v84ONr/4uL//6en+f/i4v////////////+BgfL/gYHy////////////4uL//6en+f/i4v//ODja/zg42v84ONr/ODja///////i4v//p6f5/7a2//+BgfL/Wlrp/1pa6f+BgfL/trb//6en+f/i4v///////zg42v84ONr/ODja/zg42v///////////7a2//+BgfL/Wlrp/zg42v84ONr/Wlrp/4GB8v+2tv////////////84ONr/ODja/zg42v84ONr///////////+BgfL/Wlrp/zg42v+2tv//trb//zg42v9aWun/gYHy////////////ODja/zg42v84ONr/ODja//////+BgfL/Wlrp/zg42v+2tv////////////+2tv//ODja/1pa6f+BgfL//////zg42v84ONr/ODja/zg42v+BgfL/Wlrp/zg42v+2tv///////////////////////7a2//84ONr/Wlrp/4GB8v84ONr/ODja/zg42v84ONr/ODja/zg42v+2tv//////////////////////////////////trb//zg42v84ONr/ODja/zg42v84ONr/ODja/zg42v+BgfL/p6f5/6en+f+np/n/p6f5/6en+f+np/n/p6f5/6en+f+BgfL/ODja/zg42v84ONr/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAA//8AAP//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP//AAD//wAA//8AAA==\" hassearch=\"true\" type=\"menu-button\" class=\"gtb-custombutton gtbHelperIcon gtbButtonWithSeparateMenu\">");
user_pref("google.toolbar.button_option.cached.gtbstoolbar-google-com_O8Y91YHB24Z6SR0SGYSK-xml", "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbstoolbar-google-com_O8Y91YHB24Z6SR0SGYSK-xml\" tooltip=\"gtbMultilineTooltip\" label=\"Button Gallery\" fullText=\"Button Gallery\" image=\"data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAcNJREFUeNpsU7tOAzEQXF8uCg
LCQ+IHkICa74ACISEaOh4SNeIXqGmgA0o+AAlqhBDiG6CkoQHEI+Tu/FhmbcdJjlia2+TsnZ0d7ykaWMzs49Y98XtFJHgDPiqmtw2lZE+FkM5ngwSyuf9IbMBje8B7B7QvuzyY3
FtZ/UWB02UECpNGdM5JORq1Mq5tdAxR1waiArGSXBAwWxrVbi6P3QdmqfiLMz8m4DcSVVYkGGJraezslZ0uy
OnSd+wfm3fg5lBJEoTkG8nfmugLZmitkV8iqfKJnsD/Bw6XVS5O29hrEVV0ogpjLCqbCI1WEJ0NYBdakGtyQsDBOFHRRWULyc5UHmz0MAl+90xNBCaqMJIoFaxI
1yFGJDXOJTPz6aajT5A0ieGopR9fuS/bJ0NFA5XHc4eZQKU8o5lWHq6xON2jSSqprQqgosyWwSSPfgsZa5oGwUwrJDevjsPwyX0ure6kYXhZPwo
meakmSDdBzcLtSZL+dH2u0hz07lQWromT07Fn55Jp/2Y5q8/3/ATTbG5pKjM01UBsMs2NNWhhtjV0DqppJOPiyjabtQOqj3jsWT3fXAyNsxo134Oe1Huuf85/AgwABNSAmdF/QsEAAAAASUVORK5CYII=\" type=\"menu\" class=\"gtb-custombutton gtbHelperIcon gtbWholeMenuGadgetButton\"/>");
user_pref("google.toolbar.button_option.gtbAutoFill", true);
user_pref("google.toolbar.button_option.gtbBookmarks", true);
user_pref("google.toolbar.button_option.gtbPageRank", false);
user_pref("google.toolbar.button_option.gtbSearchBookmarks", true);
user_pref("google.toolbar.button_option.gtbSearchGoogle", true);
user_pref("google.toolbar.button_option.gtbSidewiki", false);
user_pref("google.toolbar.button_option.gtbSpellCheck", false);
user_pref("google.toolbar.button_option.gtbTranslate", true);
user_pref("google.toolbar.button_option.gtbstoolbar-google-com_J66T77NJDBMW4FEUU7FA-xml", true);
user_pref("google.toolbar.button_option.gtbstoolbar-google-com_J66T77NJDBMW4FEUU7FA-xml.feedUpdate", 1308848424);
user_pref("google.toolbar.button_option.gtbstoolbar-google-com_O8Y91YHB24Z6SR0SGYSK-xml", true);
user_pref("google.toolbar.button_option.gtbstoolbar-google-com_O8Y91YHB24Z6SR0SGYSK-xml.feedUpdate", 1308934227);
user_pref("google.toolbar.button_option.gtbstoolbar-google-com_O8Y91YHB24Z6SR0SGYSK-xml.feedWasRead", true);
user_pref("google.toolbar.component.bundled.dictionaries_config.json", "7.1.20101113");
user_pref("google.toolbar.component.bundled.share_providers.json", "7.1.20101113");
user_pref("google.toolbar.component.bundled.suggest_window.html", "7.1.20101113");
user_pref("google.toolbar.custombuttons.list", "gtbSearchImages,gtbCountrySearch,gtbSearchLocal,gtbSearchSite,gtbSearchNews
,gtbSearchVideo,gtbSearchWebhistory,gtbFeelingLucky,gtbSearchGroups,gtbSearchFroo
gle,gtbstoolbar-google-com_CTK0Y7F4MTG6NKYH03WT-xml,gtbSearchBlogs,gtbSearchBooks,gtbSearchCalendar,gtbSearchDocs,gtbSearchFinan
ce,gtbSearchPatents,gtbSearchPhotos,gtbSearchScholar,gtbstoolbar-google-com_O8Y91YHB24Z6SR0SGYSK-xml,gtbstoolbar-google-com_J66T77NJDBMW4FEUU7FA-xml");
user_pref("google.toolbar.custombuttons.migrated", "true");
user_pref("google.toolbar.custombuttons.order.migrated.to.v6", false);
user_pref("google.toolbar.custombuttons.version", 1);
user_pref("google.toolbar.done_page_shown", "7.1.20101113");
user_pref("google.toolbar.enhanced_features.week", -1);
user_pref("google.toolbar.first_search", false);
user_pref("google.toolbar.first_search_ping_retires", 1);
user_pref("google.toolbar.firstrun.done", true);
user_pref("google.toolbar.google_home", "www.google.com");
user_pref("google.toolbar.google_home.default", "www.google.com");
user_pref("google.toolbar.id", "XZQ5UC54WJXRC9WX5FBZ4LFHTZZLBAES86XTWQF9HBC3T3XPX8");
user_pref("google.toolbar.install_id", "XZQ5UC54WJXRC9WX5FBZ4LFHTZZLBAES86XTWQF9HBC3T3XPX8");
user_pref("google.toolbar.install_ping_acked", true);
user_pref("google.toolbar.install_ping_retires", 1);
user_pref("google.toolbar.last_ping_attempt", "1308847831462");
user_pref("google.toolbar.linkdoctor.backup.browser.fixup.alternate.enabled", false);
user_pref("google.toolbar.mailto.gmail.configured", true);
user_pref("google.toolbar.never_show_done_page", false);
user_pref("google.toolbar.opted_into_advanced_features_1", false);
user_pref("google.toolbar.rlz", "1B3GGLL_enUS418");
user_pref("google.toolbar.safebrowsing.keyupdatetime", 1308934223);
user_pref("google.toolbar.search-icon", "data:image/x-icon;base64,AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAA7PT7/3zF6/9Ptu//RbHx/0227/+Tzvb/9vv5/97h0f9JeBz/NHoA/z98Av9AfAD/PHsA/0F6AP8AAAAA/vz7/1+33/8Mp+z/FrHw/xWy8f8bs/T/Hqrx/3zE7v////7/t8qp/zF2A/87gwH/P4ID/z59AP8+egD/Q3kA/97s8v8botj/ELn3/wy58f8PtfL/D7Lw/xuz9P8vq+f/8/n///779v9KhR3/OYYA/0GFAv88hgD/QIAC/z17AP/0+/j/N6bM/wC07/8Cxf7/CsP7/wm+9v8Aqur/SrDb//7+/v///P7/VZEl/zSJAP87jQD/PYYA/0OBBf8+fQH///3//9Dp8/84sM7/CrDf/wC14/8CruL/KqnW/9ns8f/8/v//4OjX/z+GDf85kAD/PIwD/z2JAv8+hQD/PoEA/9C7pv/97uv////+/9Xw+v+w3ej/ls/e/+rz9///////+/z6/22mSf8qjQH/OJMA/zuQAP85iwL/PIgA/zyFAP+OSSL/nV44/7J+Vv/AkG7/7trP//7//f/9//7/6/Lr/2uoRv8tjQH/PJYA/zuTAP87kwD/PY8A/z2KAP89hAD/olkn/6RVHP+eSgj/mEgR//Ho3//+/v7/5Ozh/1GaJv8tlAD/OZcC/zuXAv84lAD/O5IC/z2PAf89iwL/OIkA/6hWFf+cTxD/pm9C/76ihP/8/v//+////8nav/8fdwL/NZsA/zeZAP83mgD/PJQB/zyUAf84jwD/PYsB/z6HAf+fXif/1r6s//79///58u//3r+g/+3i2v/+//3/mbiF/yyCAP87mgP/OpgD/zeWAP85lgD/OpEB/z+TAP9ChwH/7eHb/////v/28ej/tWwo/7tUAP+5XQ7/5M+5/////v+bsZn/IHAd/zeVAP89lgP/O5MA/zaJCf8tZTr/DyuK//3////9////0qmC/7lTAP/KZAT/vVgC/8iQWf/+//3///j//ygpx/8GGcL/ESax/xEgtv8FEMz/AALh/wAB1f///f7///z//758O//GXQL/yGYC/8RaAv/Ojlf/+/////////9QU93/BAD0/wAB//8DAP3/AAHz/wAA5f8DAtr///////v7+/+2bCT/yGMA/89mAP/BWQD/0q+D///+/////P7/Rkbg/wEA+f8AA/z/AQH5/wMA8P8AAev/AADf///7/P////7/uINQ/7lXAP/MYwL/vGIO//Lm3P/8/v//1dT2/woM5/8AAP3/AwH+/wAB/f8AAfb/BADs/wAC4P8AAAAA//z7/+LbzP+mXyD/oUwE/9Gshv/8//3/7/H5/zo/w/8AAdX/AgL6/wAA/f8CAP3/AAH2/wAA7v8AAAAAgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAgAEAAA==");
user_pref("google.toolbar.searchdomaincheck.done", true);
user_pref("google.toolbar.sent", "1");
user_pref("google.toolbar.sentfs", "1");
user_pref("google.toolbar.sharing.button-promotion-shown", 3);
user_pref("google.toolbar.spell_check.dictionary.words2", "");
user_pref("google.toolbar.spell_check.lang", "en");
user_pref("google.toolbar.spell_check.last_lang", "en");
user_pref("google.toolbar.tbsync.promotions", 0);
user_pref("google.toolbar.thumbnail.clean-counter", 0);
user_pref("google.toolbar.thumbnail.clearing", 404);
user_pref("google.toolbar.translate.hover.learn_more_count", 3);
user_pref("google.toolbar.translate.target_lang", "en");
user_pref("google.toolbar.translate.updateFlag", true);
user_pref("google.toolbar.usage_stats.default", true);
user_pref("idle.lastDailyNotification", 1329352117);
user_pref("intl.charsetmenu.browser.cache", "ISO-8859-15, ISO-8859-1, UTF-8, Shift_JIS, windows-1252");
user_pref("keyword.URL", "http://www.google.com/search?sourceid=navclient&hl;=en&q;=");
user_pref("lightweightThemes.isThemeSelected", true);
user_pref("lightweightThemes.persisted.footerURL", true);
user_pref("lightweightThemes.persisted.headerURL", true);
user_pref("lightweightThemes.usedThemes", "[{\"id\":\"105723\",\"name\":\"Blood Red Moon\",\"headerURL\":\"http://getpersonas-cdn.mozilla.net/static/2/3/105723/BloodRedMoon.png?1266556164\",\"footerURL\":\"http://getpersonas-cdn.mozilla.net/static/2/3/105723/Untitled1.png?1266556164\",\"iconURL\":\"http://getpersonas-cdn.mozilla.net/static/2/3/105723/preview_small.jpg?1266556164\",\"previewURL\":\"http://getpersonas-cdn.mozilla.net/static/2/3/105723/preview.jpg?1266556164\",\"author\":\"DragonCurse4\",\"updateURL\":\"https://www.getpersonas.com/en-US/update_check/105723\",\"version\":\"1266556164\"},{\"id\":\"54404\",\"name\":\"Disturbed Thoughts\",\"headerURL\":\"http://getpersonas-cdn.mozilla.net/static/0/4/54404/Disturbed-Header.jpeg?1260925626\",\"footerURL\":\"http://getpersonas-cdn.mozilla.net/static/0/4/54404/Disturbed-Footer.jpg?1260925626\",\"textcolor\":\"#a09d9c\",\"accentcolor\":\"#a09d9c\",\"iconURL\":\"http://getpersonas-cdn.mozilla.net/static/0/4/54404/preview_small.jpg?1260925626\",\"previewURL\":\"http://getpersonas-cdn.mozilla.net/static/0/4/54404/preview.jpg?1260925626\",\"author\":\"Shamanski Designs\",\"updateURL\":\"https://www.getpersonas.com/en-US/update_check/54404\",\"version\":\"1260925626\"},{\"id\":\"25608\",\"name\":\"red blood\",\"headerURL\":\"http://getpersonas-cdn.mozilla.net/static/0/8/25608/2.jpg?1260925626\",\"footerURL\":\"http://getpersonas-cdn.mozilla.net/static/0/8/25608/1.jpg?1260925626\",\"textcolor\":\"#bf0707\",\"accentcolor\":\"#666666\",\"iconURL\":\"http://getpersonas-cdn.mozilla.net/static/0/8/25608/preview_small.jpg?1260925626\",\"previewURL\":\"http://getpersonas-cdn.mozilla.net/static/0/8/25608/preview.jpg?1260925626\",\"author\":\"escamia14\",\"description\":\"this is made by Eduardo Escamilla if you like this Personas for Firefox contact my on my myspace.com/eaescamia\",\"updateURL\":\"https://www.getpersonas.com/en-US/update_check/25608\",\"version\":\"1260925626\"},{\"id\":\"141882\",\"name\":\"kanagawa wave\",\"headerURL\":\"http://getpersonas-cdn.mozilla.net/static/8/2/141882/kanagawa_top.jpg?1269193346\",\"footerURL\":\"http://getpersonas-cdn.mozilla.net/static/8/2/141882/kanagawa_bottom.jpg?1269193346\",\"textcolor\":\"#000000\",\"accentcolor\":\"#b3b3b3\",\"iconURL\":\"http://getpersonas-cdn.mozilla.net/static/8/2/141882/preview_small.jpg?1269193346\",\"previewURL\":\"http://getpersonas-cdn.mozilla.net/static/8/2/141882/preview.jpg?1269193346\",\"author\":\"i.santos\",\"updateURL\":\"https://www.getpersonas.com/en-US/update_check/141882\"},{\"id\":\"6490\",\"name\":\"Bloodstains\",\"description\":\"this is my first layout..\\u000d\\u000akinda bloody.. >\",\"author\":\"Griever\",\"headerURL\":\"http://getpersonas-cdn.mozilla.net/static/9/0/6490/bloodh.jpg?1260925626\",\"footerURL\":\"http://getpersonas-cdn.mozilla.net/static/9/0/6490/bloodf.jpg?1260925626\",\"previewURL\":\"http://getpersonas-cdn.mozilla.net/static/9/0/6490/preview.jpg?1260925626\",\"iconURL\":\"http://getpersonas-cdn.mozilla.net/static/9/0/6490/preview_small.jpg?1260925626\",\"accentcolor\":\"#000000\",\"textcolor\":\"#fcfcfc\",\"updateURL\":\"https://www.getpersonas.com/en-US/update_check/6490\",\"version\":\"1260925626\"},{\"id\":\"33\",\"name\":\"Groovy Blue\",\"accentcolor\":\"#6699ff\",\"textcolor\":\"#07188d\",\"header\":\"3/3/33/tbox-groovy_blue.jpg\",\"footer\":\"3/3/33/stbar-groovy_blue.jpg\",\"category\":\"Abstract\",\"description\":null,\"author\":\"Lee.Tom\",\"username\":\"Lee.Tom\",\"detailURL\":\"http://www.getpersonas.com/persona/33\",\"headerURL\":\"http://www.getpersonas.com/static/3/3/33/tbox-groovy_blue.jpg\",\"footerURL\":\"http://www.getpersonas.com/static/3/3/33/stbar-groovy_blue.jpg\",\"previewURL\":\"http://www.getpersonas.com/static/3/3/33/preview.jpg\",\"iconURL\":\"http://www.getpersonas.com/static/3/3/33/preview_small.jpg\",\"dataurl\":\"data:image/png;base64,/9j/4AAQSkZJRgABAQEASABIAAD/2wBDAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQICAQECAQEBAgICAgICAgICAQIC
AgICAgICAgL/2wBDAQEBAQEBAQEBAQECAQEBAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC
AgICAgICAgL/wAARCAAQABADAREAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAABAcICv/EACAQAAIDAAEFAQEAAAAAAAAAAAMEAQIFBgcIERIjEyX/xAAZAQACAwEAAAAAAAAAAAAAAAADCAQFBwn/xAAlEQACAQMCBgMBAAAAAAAAAAABAgMEERIAIQUGExQiMQcyM1L/2gAMAwEAAhEDEQA/AL9p21L52peGctNVXkGbWsGZhNZlXBWo0sHVSVucA9BryNibVm9Iq3ahWLengV+g03yTMyl+6aV1YE45
YmTZsGsCVxBUjx+psovuFgi5IjlgRUhI7RjYHyJy93Y5EKxBW+9wrKN9wjsft65bGnnPK4+kTguZqqKcd
JstEzbuzyTdErUtSFqszqY4uR7lQGdQ+q13rML1vWIrN1U/I1N2FTG6oKipx6pUlijxRM+ICsRE8scbuqSDEqCvsAiRJyNRvUBHqcq9I5XdFTxaNbKcmxdWMcYRSt/IqokK5a0NdQOicaI0cEnGi6eWiWTKvqghltgpT1GECpZj+DYQmXSG97SAtxBkXibk9Ul4TzXMk3dSV6w
Mga6MSDshAuB+xYiNQVs4F8jZV1u9RwmCKGdKWneSorMFJGPTQGRWkYljZVAyKqQRckAG+i+M9rHGtTUI
31CU3dwGWRG+GN7lTWmhe4VpCxNRnr+y47Wm9qxSwigg5A0YJT6yDifOtS0MS8Km6JmDdZelgASbgeyrE
fUtdg4VXKoSU0bhlDJStUxz00KgWWORAuboP6IAIBIywKgKSRd7Btf/2Q==\"}]");
user_pref("metrics.client-id", "bLMSDNY3BSTjCMX+1lEyzA==");
user_pref("metrics.event-count", 128);
user_pref("metrics.last-session-id", 187);
user_pref("metrics.upload.enable", true);
user_pref("microsoft.CLR.auto_install", false);
user_pref("network.cookie.lifetimePolicy", 2);
user_pref("network.cookie.prefsMigrated", true);
user_pref("network.proxy.http", "127.0.0.1");
user_pref("network.proxy.http_port", 56525);
user_pref("network.proxy.type", 0);
user_pref("oldKeyword", "chrome://browser-region/locale/region.properties");
user_pref("places.database.lastMaintenance", 1329006087);
user_pref("places.history.expiration.transient_current_max_pages", 50273);
user_pref("places.last_vacuum", 1302380321);
user_pref("pref.advanced.images.disable_button.view_image", false);
user_pref("pref.browser.homepage.disable_button.bookmark_page", false);
user_pref("pref.browser.homepage.disable_button.current_page", false);
user_pref("pref.privacy.disable_button.cookie_exceptions", false);
user_pref("pref.privacy.disable_button.view_cookies", false);
user_pref("privacy.popups.showBrowserMessage", false);
user_pref("privacy.sanitize.migrateFx3Prefs", true);
user_pref("privacy.sanitize.timeSpan", 0);
user_pref("security.warn_viewing_mixed", false);
user_pref("services.sync.clients.lastSync", "0");
user_pref("services.sync.clients.lastSyncLocal", "0");
user_pref("services.sync.migrated", true);
user_pref("services.sync.tabs.lastSync", "0");
user_pref("services.sync.tabs.lastSyncLocal", "0");
user_pref("spellchecker.dictionary", "en-US");
user_pref("storage.vacuum.last.index", 1);
user_pref("storage.vacuum.last.places.sqlite", 1329006083);
user_pref("stumble.8811883.activity_time_s", "1322017669");
user_pref("stumble.8811883.autocomplete_type", "tag,query");
user_pref("stumble.8811883.autologout", false);
user_pref("stumble.8811883.bad_stumble", false);
user_pref("stumble.8811883.bm_folderid", 2433);
user_pref("stumble.8811883.bm_suvid_itemid", 4912);
user_pref("stumble.8811883.c.0", "{\"contactid\":\"8107602\",\"nickname\":\"CoMudou\",\"mutual\":1,\"_t\":\"c\",\"_r\":0,\"iconpic\":1252970892}");
user_pref("stumble.8811883.c_ai", 1);
user_pref("stumble.8811883.d.0", "{\"domain\":\"wikipedia.org\",\"name\":\"Wikipedia\",\"_t\":\"d\",\"_r\":0,\"sort_name\":\"wikipedia\"}");
user_pref("stumble.8811883.d.1", "{\"domain\":\"flickr.com\",\"name\":\"Flickr\",\"_t\":\"d\",\"_r\":1,\"sort_name\":\"flickr\"}");
user_pref("stumble.8811883.d.10", "{\"domain\":\"bbc.co.uk\",\"name\":\"BBC\",\"_t\":\"d\",\"_r\":10,\"sort_name\":\"bbc\"}");
user_pref("stumble.8811883.d.11", "{\"domain\":\".gov\",\"name\":\"US Gov Sites\",\"_t\":\"d\",\"_r\":11,\"sort_name\":\"us gov sites\"}");
user_pref("stumble.8811883.d.12", "{\"domain\":\".edu\",\"name\":\"University Sites\",\"_t\":\"d\",\"_r\":12,\"sort_name\":\"university sites\"}");
user_pref("stumble.8811883.d.13", "{\"domain\":\"break.com\",\"name\":\"Break.com\",\"_t\":\"d\",\"_r\":13,\"sort_name\":\"breakcom\"}");
user_pref("stumble.8811883.d.14", "{\"domain\":\"metacafe.com\",\"name\":\"Metacafe\",\"_t\":\"d\",\"_r\":14,\"sort_name\":\"metacafe\"}");
user_pref("stumble.8811883.d.15", "{\"domain\":\"wired.com\",\"name\":\"Wired\",\"_t\":\"d\",\"_r\":15,\"sort_name\":\"wired\"}");
user_pref("stumble.8811883.d.16", "{\"domain\":\"huffingtonpost.com\",\"name\":\"Huffington Post\",\"_t\":\"d\",\"_r\":16,\"sort_name\":\"huffington post\"}");
user_pref("stumble.8811883.d.17", "{\"domain\":\"howstuffworks.com\",\"name\":\"HowStuffWorks\",\"_t\":\"d\",\"_r\":17,\"sort_name\":\"howstuffworks\"}");
user_pref("stumble.8811883.d.18", "{\"domain\":\"rollingstone.com\",\"name\":\"Rolling Stone\",\"_t\":\"d\",\"_r\":18,\"sort_name\":\"rolling stone\"}");
user_pref("stumble.8811883.d.19", "{\"domain\":\"sciam.com\",\"name\":\"Scientific American\",\"_t\":\"d\",\"_r\":19,\"sort_name\":\"scientific american\"}");
user_pref("stumble.8811883.d.2", "{\"domain\":\"myspace.com\",\"name\":\"MySpace\",\"_t\":\"d\",\"_r\":2,\"sort_name\":\"myspace\"}");
user_pref("stumble.8811883.d.20", "{\"domain\":\"funnyordie.com\",\"name\":\"Funny Or DIE\",\"_t\":\"d\",\"_r\":20,\"sort_name\":\"funny or die\"}");
user_pref("stumble.8811883.d.21", "{\"domain\":\"collegehumor.com\",\"name\":\"CollegeHumor\",\"_t\":\"d\",\"_r\":21,\"sort_name\":\"collegehumor\"}");
user_pref("stumble.8811883.d.3", "{\"domain\":\"youtube.com\",\"name\":\"YouTube\",\"_t\":\"d\",\"_r\":3,\"sort_name\":\"youtube\"}");
user_pref("stumble.8811883.d.4", "{\"domain\":\"blogspot.com\",\"name\":\"Blogspot\",\"_t\":\"d\",\"_r\":4,\"sort_name\":\"blogspot\"}");
user_pref("stumble.8811883.d.5", "{\"domain\":\"wordpress.com\",\"name\":\"Wordpress\",\"_t\":\"d\",\"_r\":5,\"sort_name\":\"wordpress\"}");
user_pref("stumble.8811883.d.6", "{\"domain\":\"theonion.com\",\"name\":\"The Onion\",\"_t\":\"d\",\"_r\":6,\"sort_name\":\"the onion\"}");
user_pref("stumble.8811883.d.7", "{\"domain\":\"pbs.org\",\"name\":\"PBS\",\"_t\":\"d\",\"_r\":7,\"sort_name\":\"pbs\"}");
user_pref("stumble.8811883.d.8", "{\"domain\":\"physorg.com\",\"name\":\"PhysOrg\",\"_t\":\"d\",\"_r\":8,\"sort_name\":\"physorg\"}");
user_pref("stumble.8811883.d.9", "{\"domain\":\"cnn.com\",\"name\":\"CNN\",\"_t\":\"d\",\"_r\":9,\"sort_name\":\"cnn\"}");
user_pref("stumble.8811883.d_ai", 22);
user_pref("stumble.8811883.dd_rec_label", "[rec label]");
user_pref("stumble.8811883.dd_rec_rating", false);
user_pref("stumble.8811883.default_thru_domain_list", "");
user_pref("stumble.8811883.download_favs_state", "a");
user_pref("stumble.8811883.facebook_added", false);
user_pref("stumble.8811883.facebook_homeprompt_optout", false);
user_pref("stumble.8811883.facebook_homeprompt_time_s", 0);
user_pref("stumble.8811883.facebook_supr_linked", false);
user_pref("stumble.8811883.form", 8193);
user_pref("stumble.8811883.great_stumble", false);
user_pref("stumble.8811883.has_avatars", true);
user_pref("stumble.8811883.has_favicons", true);
user_pref("stumble.8811883.icons", "text-icons");
user_pref("stumble.8811883.imported_contacts_time_s", 0);
user_pref("stumble.8811883.interests", "500 521 193 173 509 159 279 179 261 135 267 470 13 296 27 441 199 1521 363 192 310 326 12 167 102 178 71 127 397 152 16 21 455 235 305 256 412 15 162 416 262 73 195 104 83 259 318 211 164 336 421 114 218 378 390 139 10 286 20 346 435 438 353 460 456 495 289 22 151 25 46 47 56 74 425 462 185 290 426 14 429 377 110 269 ");
user_pref("stumble.8811883.intro_count", 15);
user_pref("stumble.8811883.last_incat", "0");
user_pref("stumble.8811883.last_stumble", "1322017668032");
user_pref("stumble.8811883.migrate_places_state", "d");
user_pref("stumble.8811883.migration_state", 62914559);
user_pref("stumble.8811883.newmessage", false);
user_pref("stumble.8811883.nick", "Fushigi");
user_pref("stumble.8811883.poll_state", "h");
user_pref("stumble.8811883.poll_time_s", "1329003847");
user_pref("stumble.8811883.prefetch", true);
user_pref("stumble.8811883.prefetcher_fetch_depth_in_topic", 3);
user_pref("stumble.8811883.prefetcher_pass_1_timeout_ms", 10000);
user_pref("stumble.8811883.prefetcher_pass_2_timeout_ms", 30000);
user_pref("stumble.8811883.prefetcher_pass_3_timeout_ms", 120000);
user_pref("stumble.8811883.prefetcher_pass_max", 3);
user_pref("stumble.8811883.prefetcher_skip_resources", false);
user_pref("stumble.8811883.prev_stumble_stats", "{\"publicid\":\"2UsOcc\",\"stumbleRequest\":1322017668033,\"stumbleResponse\":1322017669229,\"startLoad\":1322017669426,\"response\":1322017675248,\"load\":1322017680300,\"pageHide\":1322017717478}");
user_pref("stumble.8811883.process_rarely_timestamp", "1325357160081");
user_pref("stumble.8811883.rate_new_window", false);
user_pref("stumble.8811883.recently_seen", "");
user_pref("stumble.8811883.recently_seen_publicids", "2QlPYR.1N3AI9.4ElqvK.8ybEvc.1bumIt.1rluuk.6YntJM.26DUHW.7CFpKj.2H8inq.8QXbH
q.1FFDp4.179pFz.23k3qS.1HlxcH.2xrv3Q.1eKEeA.2goqDz.2Dp6ow.1nnMbu.3NVmYd.1H9qEm.40
dxwj.2JgxFH.Ac1oUz.2dAsbc.21F5KZ.2wnzJA.2Auhra.4DAkna.1wwLWl.8zAfKY.8vUwTE.169erO
.1fWE51.2ZGv2Y.2UCFQb.1gqHJ8.1Pu4Rp.9HZIy4.1PYDZi.1wNGWy.2qbfeQ.4ZneB1.9MLxA5.2Ri
RBf.2COYtk.1K8SSG.2eukEL.2UsOcc");
user_pref("stumble.8811883.recently_seen_referralids", "");
user_pref("stumble.8811883.referral_throbber_interval_ms", 5000);
user_pref("stumble.8811883.review_new_window", false);
user_pref("stumble.8811883.s_ai", 1956);
user_pref("stumble.8811883.search_clear_queries", false);
user_pref("stumble.8811883.sendtos_menu_depth", 16);
user_pref("stumble.8811883.shortcut_referrals", "");
user_pref("stumble.8811883.shortcut_reviews", "Alt+VK_3");
user_pref("stumble.8811883.shortcut_stumble", "Alt+VK_BACK_QUOTE");
user_pref("stumble.8811883.shortcut_tag", "ALT+VK_SLASH");
user_pref("stumble.8811883.shortcut_thumbdown", "Alt+VK_2");
user_pref("stumble.8811883.shortcut_thumbup", "Alt+VK_1");
user_pref("stumble.8811883.shortcut_toolbar", "Ctrl+VK_F11");
user_pref("stumble.8811883.shortcuts_enabled", false);
user_pref("stumble.8811883.show_aboutme", false);
user_pref("stumble.8811883.show_fbshare", true);
user_pref("stumble.8811883.show_field", false);
user_pref("stumble.8811883.show_filter", false);
user_pref("stumble.8811883.show_firstrater_label_always", false);
user_pref("stumble.8811883.show_friends", true);
user_pref("stumble.8811883.show_friends_user_changed", true);
user_pref("stumble.8811883.show_groups", false);
user_pref("stumble.8811883.show_home", true);
user_pref("stumble.8811883.show_home_user_changed", true);
user_pref("stumble.8811883.show_info", true);
user_pref("stumble.8811883.show_info_user_changed", true);
user_pref("stumble.8811883.show_legacy_forums", false);
user_pref("stumble.8811883.show_legacy_network", false);
user_pref("stumble.8811883.show_matches", false);
user_pref("stumble.8811883.show_messages", false);
user_pref("stumble.8811883.show_mode", false);
user_pref("stumble.8811883.show_mode_friends", true);
user_pref("stumble.8811883.show_mode_more", true);
user_pref("stumble.8811883.show_mode_news", true);
user_pref("stumble.8811883.show_mode_photo", true);
user_pref("stumble.8811883.show_mode_search", false);
user_pref("stumble.8811883.show_mode_stumbler", true);
user_pref("stumble.8811883.show_mode_stumblers", false);
user_pref("stumble.8811883.show_mode_video", true);
user_pref("stumble.8811883.show_mode_wiki", false);
user_pref("stumble.8811883.show_myinfo", false);
user_pref("stumble.8811883.show_referral", true);
user_pref("stumble.8811883.show_referral_user_changed", true);
user_pref("stumble.8811883.show_searchlinks_comment_icon", false);
user_pref("stumble.8811883.show_searchlinks_friends", true);
user_pref("stumble.8811883.show_searchlinks_logo", true);
user_pref("stumble.8811883.show_searchlinks_score", true);
user_pref("stumble.8811883.show_searchlinks_topic", false);
user_pref("stumble.8811883.show_separators", true);
user_pref("stumble.8811883.show_tag", false);
user_pref("stumble.8811883.show_topics", true);
user_pref("stumble.8811883.show_tutorial_info", true);
user_pref("stumble.8811883.shown_find_friends", true);
user_pref("stumble.8811883.shown_find_friends_optout", false);
user_pref("stumble.8811883.shown_find_friends_time_s", 1252972219);
user_pref("stumble.8811883.shown_photo_info", false);
user_pref("stumble.8811883.shown_rate_info", false);
user_pref("stumble.8811883.shown_reviews_info", false);
user_pref("stumble.8811883.shown_searchlinks", true);
user_pref("stumble.8811883.shown_searchlinks_dialog", true);
user_pref("stumble.8811883.shown_thru_domain_info_count", 0);
user_pref("stumble.8811883.shown_thru_domain_info_list", "");
user_pref("stumble.8811883.slidfstats", "0:0:0:0:0:0:0:0:0:0");
user_pref("stumble.8811883.slistats", "4:4:4:4:4:4:4:4:4:4");
user_pref("stumble.8811883.slstats", "");
user_pref("stumble.8811883.stumble_count", 517);
user_pref("stumble.8811883.stumble_last_report", "1322017669406");
user_pref("stumble.8811883.stumble_report_lastfail", 0);
user_pref("stumble.8811883.stumble_report_retrycount", 0);
user_pref("stumble.8811883.stumble_report_started", "0");
user_pref("stumble.8811883.stumble_topics", false);
user_pref("stumble.8811883.stumble_topics_style", 1);
user_pref("stumble.8811883.stumblestats", "");
user_pref("stumble.8811883.sync_bm_adult", false);
user_pref("stumble.8811883.sync_bm_meta", true);
user_pref("stumble.8811883.sync_cur_q", 0);
user_pref("stumble.8811883.sync_cur_s", "");
user_pref("stumble.8811883.sync_cur_t", "");
user_pref("stumble.8811883.sync_pre_q", 0);
user_pref("stumble.8811883.sync_pre_s", "");
user_pref("stumble.8811883.sync_pre_t", "");
user_pref("stumble.8811883.sync_retry", 0);
user_pref("stumble.8811883.sync_time_s", 0);
user_pref("stumble.8811883.thumbdown_count", 5);
user_pref("stumble.8811883.thumbup_count", 137);
user_pref("stumble.8811883.token", "QrLnxNQapJ%2BM3m5npg5XfJjzP5Y%3D");
user_pref("stumble.8811883.twitter_supr_linked", false);
user_pref("stumble.8811883.undelivered_count", 0);
user_pref("stumble.8811883.version", "mozbar 3.99 xpi 2011122202 AM-0");
user_pref("stumble.8811883.ycc", "");
user_pref("stumble.ab_bits", 0);
user_pref("stumble.auto_cookie_exceptions", true);
user_pref("stumble.clear_favicons", false);
user_pref("stumble.click_throttle_ms", 1500);
user_pref("stumble.client_migration_state", 31);
user_pref("stumble.client_version", "mozbar 3.99 xpi 2011122202 AM-0");
user_pref("stumble.clientid", "4c76cd69a9aa6");
user_pref("stumble.comscore_enabled", true);
user_pref("stumble.current_user", "8811883");
user_pref("stumble.db_visitedurls_fail", false);
user_pref("stumble.dd_display_message", false);
user_pref("stumble.dd_links_m", "");
user_pref("stumble.dd_uc", false);
user_pref("stumble.enable_ga_exit_event", true);
user_pref("stumble.enable_refer", true);
user_pref("stumble.enable_secure_store_auth", false);
user_pref("stumble.enable_server_counts", true);
user_pref("stumble.enable_slstats", true);
user_pref("stumble.enable_visitedurls_failsafe", true);
user_pref("stumble.facebook_user", true);
user_pref("stumble.google_is_timeout_ms", 1000);
user_pref("stumble.id_list", "8811883:");
user_pref("stumble.installed", "1252970889");
user_pref("stumble.latch-to-sidebar", false);
user_pref("stumble.log_communication", false);
user_pref("stumble.log_prefetch_progress", false);
user_pref("stumble.min_links_separation_ms", 0);
user_pref("stumble.position-group", "drop");
user_pref("stumble.recommend_timeout_ms", 60000);
user_pref("stumble.report_error_count", 0);
user_pref("stumble.report_error_count_max", 3);
user_pref("stumble.report_phishing", true);
user_pref("stumble.search-width", 156);
user_pref("stumble.stumble_action_timeout_ms", 15000);
user_pref("stumble.stumble_max_visited_urls", 50);
user_pref("stumble.stumble_report_interval_ms", 60000);
user_pref("stumble.stumble_submission_timeout_ms", 60000);
user_pref("stumble.supr_domain", "su.pr");
user_pref("stumble.toolbar-position", "stumbleupon");
user_pref("stumble.toolbar-visible", true);
user_pref("stumble.toolbar_toggle_visible", false);
user_pref("stumble.userfile_write_failed", false);
user_pref("stumble.whitelist_upon_load", false);
user_pref("toolkit.telemetry.prompted", 2);
user_pref("urlclassifier.keyupdatetime.https://sb-ssl.google.com/safebrowsing/newkey", 1331595848);
user_pref("xpinstall.whitelist.add", "");
user_pref("xpinstall.whitelist.add.103", "");
user_pref("xpinstall.whitelist.add.36", "");

Below is the sessionstore.js


{"windows":[{"tabs":[{"entries":[{"url":"http://www.meebo.com/","ID":3,"docshellID":9,"docIdentifier":3},{"url":"http://forums.whatthetech.com/index.php?showtopic=122313&st;=15","title":"bad case of system check","ID":6,"docshellID":9,"docIdentifier":6},{"url":"http://forums.whatthetech.com/index.php?showtopic=122313&st;=30","title":"bad case of system check","ID":17,"docshellID":9,"referrer":"http://forums.whatthetech.com/index.php?showtopic=122313&st;=15","docIdentifier":17},{"url":"http://forums.whatthetech.com/index.php?act=post&do;=reply_post&f;=27&t;=122313","title":"Board Message","ID":27,"docshellID":9,"referrer":"http://forums.whatthetech.com/index.php?showtopic=122313&st;=30","docIdentifier":27},{"url":"http://forums.whatthetech.com/index.php","title":"Please stand by…","cacheKey":1329451191,"ID":31,"docshellID":9,"referrer":"http://forums.whatthetech.com/index.php?act=post&do;=reply_post&f;=27&t;=122313","docIdentifier":31},{"url":"http://forums.whatthetech.com/index.php?act=post&do;=reply_post&f;=27&t;=122313","title":"Replying in bad case of system check - What the Tech","ID":32,"docshellID":9,"referrer":"http://forums.whatthetech.com/index.php","docIdentifier":32},{"url":"http://forums.whatthetech.com/index.php?showtopic=122313&st;=30&gopid;=773783&#entry773783","title":"bad case of system check","ID":34,"docshellID":9,"referrer":"http://forums.whatthetech.com/index.php?act=post&do=reply_post&f=27&t=122313","docIdentifier":34,"formdata":{"//xhtml:span[@id='intelliTxt']/xhtml:div[4]/xhtml:div/xhtml:div/xhtml:form[@name='jumpmenu']/xhtml:select[@name='f']":4,"//xhtml:table[@id='gfooter']/xhtml:tbody/xhtml:tr/xhtml:td/xhtml:form[@name='skinselectorbox']/xhtml:select[@name='skinid']":1,"#MST_Tgt":9},"scroll":"0,15829"}],"index":7,"hidden":false,"attributes":{"image":"http://forums.whatthetech.com/favicon.ico"}}],"selected":1,"_closedTabs":[{"state":{"entries":[{"url":"http://crysandrea.com/","ID":4,"docshellID":13,"docIdentifier":4,"scroll":"0,0"}],"index":1,"userTypedValue":"http://crysandrea.com/","userTypedClear":0,"hidden":false,"attributes":{"image":"chrome://global/skin/icons/warning-16.png"}},"title":"Problem loading page","image":"chrome://global/skin/icons/warning-16.png","pos":1},{"state":{"entries":[{"url":"http://www.menewsha.com/","ID":5,"docshellID":12,"docIdentifier":5,"scroll":"0,0"}],"index":1,"userTypedValue":"http://www.menewsha.com/","userTypedClear":0,"hidden":false,"attributes":{"image":"chrome://global/skin/icons/warning-16.png"}},"title":"Problem loading page","image":"chrome://global/skin/icons/warning-16.png","pos":1}],"width":"1456","height":"886","screenX":"-8","screenY":"-8","sizemode":"maximized","cookies":[{"host":".whatthetech.com","value":"ID=befb1a286c8ad40d:T=1329451230:S=ALNI_Mbi30ahcS5AaGQPTRmhqmKzjJbsUA","path":"/","name":"__gads","expiry":1392523230},{"host":".whatthetech.com","value":"P0-306223281-1329451226912","path":"/","name":"__qca","expiry":1487131226},{"host":"forums.whatthetech.com","value":"99546","path":"/","name":"TCmember_id","httponly":true,"expiry":1360987273},{"host":"forums.whatthetech.com","value":"0","path":"/","name":"TCcoppa"},{"host":"forums.whatthetech.com","value":"%2C","path":"/","name":"TCmqtids"},{"host":"forums.whatthetech.com","value":"open","path":"/","name":"TCrte-sidepanel","expiry":1577836800},{"host":"forums.whatthetech.com","value":"b01aee12e7932d2a9ddfabf288c7871c","path":"/","name":"TCpass_hash","httponly":true,"expiry":1332103689},{"host":"forums.whatthetech.com","value":"62ed4830e0e20411bd5a7a39f50542a3","path":"/","name":"TCsession_id","httponly":true},{"host":"forums.whatthetech.com","value":"a%3A1%3A%7Bi%3A122313%3Bi%3A1329511692%3B%7D","path":"/","name":"TCtopicsread"},{"host":"forums.whatthetech.com","value":"1.1817966620.1329451224.1329451224.1329511690.2","path":"/","name":"__utma","expiry":1392583690},{"host":"forums.whatthetech.com","value":"1.1.10.1329511690","path":"/","name":"__utmb","expiry":1329513490},{"host":"forums.whatthetech.com","value":"1","path":"/","name":"__utmc"},{"host":"forums.whatthetech.com","value":"1.1329451224.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)","path":"/","name":"__utmz","expiry":1345279690}],"title":"bad case of system check"}],"selectedWindow":0,"_closedWindows":[{"tabs":[{"entries":[{"url":"http://www.meebo.com/","ID":0,"docshellID":8,"docIdentifier":0,"scroll":"0,0"}],"index":1,"hidden":false,"attributes":{"image":"chrome://global/skin/icons/warning-16.png"}},{"entries":[{"url":"http://www.menewsha.com/","ID":2,"docshellID":10,"docIdentifier":2,"scroll":"0,0"}],"index":1,"userTypedValue":"http://www.menewsha.com/","userTypedClear":0,"hidden":false,"attributes":{"image":"chrome://global/skin/icons/warning-16.png"}},{"entries":[{"url":"http://crysandrea.com/","ID":1,"docshellID":11,"docIdentifier":1,"scroll":"0,0"}],"index":1,"userTypedValue":"http://crysandrea.com/","userTypedClear":0,"hidden":false,"attributes":{"image":"chrome://global/skin/icons/warning-16.png"}}],"selected":1,"_closedTabs":[],"width":"1456","height":"886","screenX":"-8","screenY":"-8","sizemode":"maximized","title":"Problem loading page"}],"session":{"state":"stopped","lastUpdate":1329512754446,"startTime":1329451193874,"recentCrashes":0},"scratchpads":[]}

Ok, here is the OTL.txt file

OTL logfile created on: 2/19/2012 3:02:06 PM - Run 5
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Ana\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.87 Gb Total Physical Memory | 0.99 Gb Available Physical Memory | 52.73% Memory free
3.99 Gb Paging File | 2.52 Gb Available in Paging File | 63.30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 138.03 Gb Total Space | 36.97 Gb Free Space | 26.78% Space Free | Partition Type: NTFS
Drive D: | 11.02 Gb Total Space | 1.49 Gb Free Space | 13.56% Space Free | Partition Type: NTFS
Drive G: | 778.49 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: TOBE | User Name: Ana | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\Ana\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Ana\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation)
PRC - C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation)
PRC - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files\Tablet\Pen\Pen_Tablet.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\Tablet\Pen\Pen_TouchUser.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\Tablet\Pen\Pen_TabletUser.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\Tablet\Pen\Pen_TouchService.exe (Wacom Technology, Corp.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
PRC - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
PRC - C:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
PRC - C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe ()


========== Modules (No Company Name) ==========

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\8b5f54e3b382fc1720c76557ef8c8bc3\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5c3bfd69e0c268baff0d169e11a6a784\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\7fd6c62196829d1e2dce5a253145d51a\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d9f0f1dc8cbdb81f1ba122d77a6ab710\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\137696d0416b65dbc1561152971488b4\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\029217106fa24787ff7a61b754f8ebf7\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\d48e106e015d0f8cb2d5295015cee508\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\56df3488472318c59d0a08ed10a065d3\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\3951e0a359c004cd6ba268ff78ac62aa\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1e258a951222c818540b33880ca45f2e\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c50133cb67d7c013fa31e1ffb942060b\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\8056d047225d4a9c2e4c6b096563d93d\UIAutomationTypes.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll ()
MOD - C:\Program Files\Tablet\Pen\libxml2.dll ()
MOD - C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll ()
MOD - C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECLibrary.dll ()
MOD - C:\Program Files\Hewlett-Packard\HP Advisor\MessagingServer.dll ()
MOD - C:\Program Files\Hewlett-Packard\HP Advisor\MessagingClients.dll ()
MOD - C:\Program Files\Hewlett-Packard\HP Advisor\RemotingClient.dll ()
MOD - C:\Program Files\Hewlett-Packard\HP Advisor\MessagingInterface.dll ()
MOD - C:\Program Files\Hewlett-Packard\HP Advisor\MessagingMessages.dll ()
MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\HP.ActiveSupportLibrary\2.0.0.1__01a974bc1760f423\HP.ActiveSupportLibrary.dll ()
MOD - C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe ()


========== Win32 Services (SafeList) ==========

SRV - (PlugPlay32) – File not found
SRV - (nvUpdatusService) – C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (sdCoreService) – C:\Program Files\PC Tools Security\pctsSvc.exe (PC Tools)
SRV - (TabletServicePen) – C:\Program Files\Tablet\Pen\Pen_Tablet.exe (Wacom Technology, Corp.)
SRV - (TouchServicePen) – C:\Program Files\Tablet\Pen\Pen_TouchService.exe (Wacom Technology, Corp.)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (sdAuxService) – C:\Program Files\PC Tools Security\pctsAuxs.exe (PC Tools)
SRV - (aawservice) – C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (PCTCore) – C:\Windows\system32\drivers\PCTCore.sys (PC Tools)
DRV - (wacomvhid) – C:\Windows\System32\drivers\wacomvhid.sys (Wacom Technology)
DRV - (pctDS) – C:\Windows\system32\drivers\pctDS.sys (PC Tools)
DRV - (sptd) – C:\Windows\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (wacmoumonitor) – C:\Windows\System32\drivers\wacmoumonitor.sys (Wacom Technology)
DRV - (WacomVTHid) – C:\Windows\System32\drivers\WacomVTHid.sys (Wacom Technology)
DRV - (mcdbus) – C:\Windows\System32\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (nvrd32) – C:\Windows\system32\drivers\nvrd32.sys (NVIDIA Corporation)
DRV - (nvstor32) – C:\Windows\system32\DRIVERS\nvstor32.sys (NVIDIA Corporation)
DRV - (PCD5SRVC{BD6912E3-AC9D80E8-05040000}) – C:\Program Files\PC-Doctor for Windows\pcd5srvc.pkms (PC-Doctor, Inc.)
DRV - (nvsmu) – C:\Windows\system32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (HSXHWBS3) – C:\Windows\System32\drivers\HSXHWBS3.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) – C:\Windows\System32\drivers\HSX_DP.sys (Conexant Systems, Inc.)
DRV - (XAudio) – C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (MRV6X32P) – C:\Windows\System32\drivers\MRVW13B.sys (Marvell Semiconductor, Inc)
DRV - (wacommousefilter) – C:\Windows\System32\drivers\wacommousefilter.sys (Wacom Technology)
DRV - (Ps2) – C:\Windows\System32\drivers\PS2.sys (Hewlett-Packard Company)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cndt


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:56303

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:56303

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = E7 4E B6 01 10 F2 F7 42 A0 83 DB DB 0C 31 F6 0E [binary data]

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = E7 4E B6 01 10 F2 F7 42 A0 83 DB DB 0C 31 F6 0E [binary data]

IE - HKU\S-1-5-21-3397783422-3384463677-1815793419-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?pc=ZUGO&form;=ZGAPHP
IE - HKU\S-1-5-21-3397783422-3384463677-1815793419-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3397783422-3384463677-1815793419-1000\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = E7 4E B6 01 10 F2 F7 42 A0 83 DB DB 0C 31 F6 0E [binary data]
IE - HKU\S-1-5-21-3397783422-3384463677-1815793419-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3397783422-3384463677-1815793419-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cndt
IE - HKU\S-1-5-21-3397783422-3384463677-1815793419-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cndt
IE - HKU\S-1-5-21-3397783422-3384463677-1815793419-1001\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3397783422-3384463677-1815793419-1001\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 4E 99 7A 01 DA AC ED 48 B7 16 22 EE 73 AD 1D 6B [binary data]
IE - HKU\S-1-5-21-3397783422-3384463677-1815793419-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3397783422-3384463677-1815793419-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cndt
IE - HKU\S-1-5-21-3397783422-3384463677-1815793419-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cndt
IE - HKU\S-1-5-21-3397783422-3384463677-1815793419-1002\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = E7 4E B6 01 10 F2 F7 42 A0 83 DB DB 0C 31 F6 0E [binary data]

========== FireFox ==========

FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 56525
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.5: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKCU\Software\MozillaPlugins\@soe.sony.com/installer,version=1.0.3: C:\PROGRA~1\SONYON~1\npsoe.dll File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Ana\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Ana\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1d5287d1-8a92-0001-1f31-1cec198018d8}: C:\Program Files\AVG\AVG8\ToolbarFF
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/02/19 12:00:06 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/06/09 10:19:51 | 000,000,000 | —D | M]

[2008/12/29 19:29:21 | 000,000,000 | —D | M] (No name found) – C:\Users\Ana\AppData\Roaming\mozilla\Extensions
[2012/02/14 16:53:09 | 000,000,000 | —D | M] (No name found) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions
[2010/05/18 08:25:57 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/02/12 14:09:31 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009/03/25 10:50:02 | 000,000,000 | —D | M] (No name found) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}-trash
[2011/03/28 16:13:41 | 000,000,000 | —D | M] (Personas) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\[removed]
[2010/02/25 10:07:16 | 000,000,000 | —D | M] (Panda3D Game Engine Plug-In) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\[removed]
[2011/01/02 21:33:24 | 000,000,000 | —D | M] (Search Toolbar) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\[removed]
[2012/02/19 12:00:06 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/07/19 19:57:48 | 000,000,000 | —D | M] (Skype extension) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
() (No name found) – C:\USERS\ANA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D5BTN3LZ.DEFAULT\EXTENSIONS\{AE93811A-5C9A-4D34-8462-F7B864FC4696}.XPI
[2012/02/16 08:40:42 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/07/19 04:05:25 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/03/20 19:52:56 | 000,238,776 | —- | M] (Pando Networks) – C:\Program Files\mozilla firefox\plugins\npPandoWebInst.dll
[2012/02/16 04:42:53 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/02/16 04:42:53 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Ana\AppData\Local\Google\Chrome\Application\17.0.963.56\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Users\Ana\AppData\Local\Google\Chrome\Application\17.0.963.56\gears.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Ana\AppData\Local\Google\Chrome\Application\17.0.963.56\gcswf32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java™ Platform SE 6 U20 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Windows Genuine Advantage (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll
CHR - plugin: Pando Web Installer (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Wacom Dynamic Link Library (Enabled) = C:\Program Files\TabletPlugins\npwacom.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Ana\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.50917.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Skype Extension = C:\Users\Ana\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.5.0.7896_0\
CHR - Extension: AT_WesCravenV2 = C:\Users\Ana\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahooofggegjbnodalhoibemeabkapop\3\

O1 HOSTS File: ([2012/02/16 07:27:32 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll File not found
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKU\S-1-5-21-3397783422-3384463677-1815793419-1000\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [DPService] C:\Program Files\HP\DVDPlay\DPService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
O4 - HKU\S-1-5-21-3397783422-3384463677-1815793419-1000..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
O4 - HKU\S-1-5-21-3397783422-3384463677-1815793419-1001..\Run: [HPADVISOR] File not found
O4 - HKU\S-1-5-21-3397783422-3384463677-1815793419-1002..\Run: [HPADVISOR] File not found
O4 - HKU\S-1-5-21-3397783422-3384463677-1815793419-1001..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil11e_Plugin.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Users\Ana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Ana\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Ana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3397783422-3384463677-1815793419-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3397783422-3384463677-1815793419-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-3397783422-3384463677-1815793419-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3397783422-3384463677-1815793419-1002\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O15 - HKU\S-1-5-21-3397783422-3384463677-1815793419-1001\..Trusted Ranges: Range1 ([http] in Local intranet)
O15 - HKU\S-1-5-21-3397783422-3384463677-1815793419-1002\..Trusted Ranges: Range1 ([http] in )
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_27)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1C3EFEE7-B1F5-406C-9ACB-9AABE3B7F973}: DhcpNameServer = 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1C517DEB-59CF-4806-A1BA-A71265252F3D}: DhcpNameServer = 192.168.0.1 [removed]
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (MrvGINA.dll) - File not found
O20 - HKU\.DEFAULT Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKU\S-1-5-18 Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Ana\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Ana\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/08/25 07:12:57 | 000,000,074 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2007/08/04 09:54:31 | 000,000,000 | —D | M] - G:\AutoRun – [ CDFS ]
O32 - AutoRun File - [2007/08/04 09:54:31 | 000,700,416 | R— | M] (Electronic Arts Inc.) - G:\AutoRun.exe – [ CDFS ]
O32 - AutoRun File - [2007/08/04 08:09:54 | 000,659,456 | R— | M] (Electronic Arts Inc.) - G:\AutoRunGUI.dll – [ CDFS ]
O32 - AutoRun File - [2007/08/04 10:00:52 | 000,000,152 | R— | M] () - G:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKU\S-1-5-21-3397783422-3384463677-1815793419-1000\…com [@ = ComFile] – Reg Error: Key error. File not found

========== Files/Folders - Created Within 30 Days ==========

[2012/02/19 03:07:22 | 000,193,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2012/02/19 03:07:21 | 001,383,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2012/02/19 03:07:21 | 000,671,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2012/02/19 03:07:21 | 000,471,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2012/02/19 03:07:21 | 000,180,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2012/02/19 03:07:21 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2012/02/19 03:07:21 | 000,027,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2012/02/19 03:07:20 | 000,389,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2012/02/19 03:07:20 | 000,380,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dll
[2012/02/17 22:17:26 | 000,000,000 | —D | C] – C:\Users\Ana\Desktop\RK_Quarantine
[2012/02/17 14:54:37 | 000,000,000 | —D | C] – C:\Users\Ana\Desktop\GETxPUD
[2012/02/17 12:57:19 | 000,066,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\packager.dll
[2012/02/17 12:57:17 | 000,376,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winsrv.dll
[2012/02/17 12:57:13 | 002,044,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2012/02/16 21:55:48 | 000,000,000 | —D | C] – C:\TDSSKiller_Quarantine
[2012/02/16 20:41:25 | 002,060,336 | —- | C] (Kaspersky Lab ZAO) – C:\Users\Ana\Desktop\tdsskiller.exe
[2012/02/16 07:34:40 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/02/16 07:34:23 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/02/16 07:31:23 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\temp
[2012/02/15 21:20:51 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/02/15 17:40:11 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/02/15 17:40:11 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/02/15 17:39:35 | 000,000,000 | —D | C] – C:\Qoobox
[2012/02/15 17:37:49 | 004,404,931 | R— | C] (Swearware) – C:\Users\Ana\Desktop\ComboFix.exe
[2012/02/15 17:31:39 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{D599B5D8-9F77-4267-8BEC-976E9C1DF647}
[2012/02/15 17:31:36 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{6A86C66B-A280-49DE-A88F-3FBDDBA60C30}
[2012/02/13 18:23:31 | 004,733,440 | —- | C] (AVAST Software) – C:\Users\Ana\Desktop\aswMBR.exe
[2012/02/13 08:48:05 | 000,000,000 | —D | C] – C:\_OTL
[2012/02/12 14:06:29 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2011
[2012/02/12 11:57:37 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\Ana\Desktop\OTL.exe
[2012/02/12 03:07:37 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mciseq.dll
[2012/02/12 03:03:38 | 001,314,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quartz.dll
[2012/02/12 03:03:38 | 000,497,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qdvd.dll
[2012/02/11 19:02:42 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Roaming\Malwarebytes
[2012/02/11 19:02:35 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2012/02/11 17:55:04 | 000,656,320 | —- | C] (PC Tools) – C:\Windows\System32\drivers\pctEFA.sys
[2012/02/11 17:55:04 | 000,338,880 | —- | C] (PC Tools) – C:\Windows\System32\drivers\pctDS.sys
[2012/02/11 17:55:01 | 000,251,560 | —- | C] (PC Tools) – C:\Windows\System32\drivers\pctgntdi.sys
[2012/02/11 17:55:01 | 000,103,232 | —- | C] (PC Tools) – C:\Windows\System32\drivers\pctwfpfilter.sys
[2012/02/11 17:54:55 | 000,239,168 | —- | C] (PC Tools) – C:\Windows\System32\drivers\PCTCore.sys
[2012/02/11 17:54:55 | 000,160,448 | —- | C] (PC Tools) – C:\Windows\System32\drivers\PCTAppEvent.sys
[2012/02/11 17:54:52 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Tools Security
[2012/02/11 17:54:49 | 000,070,536 | —- | C] (PC Tools) – C:\Windows\System32\drivers\pctplsg.sys
[2012/02/11 17:54:41 | 000,000,000 | —D | C] – C:\Program Files\PC Tools Security
[2012/02/11 17:54:41 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Roaming\PC Tools
[2012/02/11 17:54:41 | 000,000,000 | —D | C] – C:\Program Files\Common Files\PC Tools
[2012/02/11 17:47:36 | 000,000,000 | —D | C] – C:\ProgramData\PC Tools
[2012/02/11 17:01:29 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{D15A6F1B-B210-44A7-8F82-D124A3AEF183}

========== Files - Modified Within 30 Days ==========

[2012/02/19 14:32:00 | 000,000,900 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3397783422-3384463677-1815793419-1000UA1cce9256ef622a0.job
[2012/02/19 13:29:40 | 000,003,616 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/02/19 13:29:40 | 000,003,616 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/02/19 12:00:07 | 000,000,832 | —- | M] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/02/19 12:00:07 | 000,000,808 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/02/19 03:29:47 | 002,243,000 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/02/19 03:29:31 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/02/19 03:02:52 | 000,604,264 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/02/19 03:02:52 | 000,103,964 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/02/18 19:43:12 | 000,000,414 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{613A91CE-67C1-4421-90F1-050F3F9C0DEE}.job
[2012/02/18 19:32:00 | 000,000,848 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3397783422-3384463677-1815793419-1000Core1cce9256e479320.job
[2012/02/18 12:14:29 | 000,168,723 | —- | M] () – C:\Users\Ana\Desktop\screen5.jpg
[2012/02/17 22:22:18 | 001,251,328 | —- | M] () – C:\Users\Ana\Desktop\RogueKiller.exe
[2012/02/17 21:19:28 | 000,000,512 | —- | M] () – C:\Users\Ana\Desktop\MBR.dat
[2012/02/17 20:01:22 | 000,159,380 | —- | M] () – C:\Users\Ana\Desktop\screen 4.jpg
[2012/02/17 14:53:59 | 000,497,272 | —- | M] () – C:\Users\Ana\Desktop\GETxPUD.exe
[2012/02/16 20:41:30 | 002,060,336 | —- | M] (Kaspersky Lab ZAO) – C:\Users\Ana\Desktop\tdsskiller.exe
[2012/02/16 07:27:32 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2012/02/15 22:34:49 | 000,002,070 | —- | M] () – C:\Users\Ana\Desktop\Google Chrome.lnk
[2012/02/15 22:34:49 | 000,002,032 | —- | M] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/02/15 21:08:00 | 000,000,176 | —- | M] () – C:\Users\Ana\defogger_reenable
[2012/02/15 21:06:32 | 000,050,477 | —- | M] () – C:\Users\Ana\Desktop\Defogger.exe
[2012/02/15 17:37:54 | 004,404,931 | R— | M] (Swearware) – C:\Users\Ana\Desktop\ComboFix.exe
[2012/02/15 17:32:49 | 000,000,931 | —- | M] () – C:\Users\Ana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012/02/15 17:32:48 | 000,000,951 | —- | M] () – C:\Users\Ana\Desktop\Dropbox.lnk
[2012/02/14 06:47:38 | 000,001,356 | —- | M] () – C:\Users\Ana\AppData\Local\d3d9caps.dat
[2012/02/13 18:23:52 | 004,733,440 | —- | M] (AVAST Software) – C:\Users\Ana\Desktop\aswMBR.exe
[2012/02/13 10:47:23 | 261,136,407 | —- | M] () – C:\Windows\MEMORY.DMP
[2012/02/12 11:57:38 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Ana\Desktop\OTL.exe
[2012/02/11 21:40:04 | 000,000,314 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForAna.job
[2012/02/11 17:54:52 | 000,001,748 | —- | M] () – C:\Users\Public\Desktop\Spyware Doctor.lnk

========== Files Created - No Company Name ==========

[2012/02/19 12:00:07 | 000,000,832 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/02/19 12:00:07 | 000,000,808 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/02/19 12:00:06 | 000,000,820 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/02/18 12:14:29 | 000,168,723 | —- | C] () – C:\Users\Ana\Desktop\screen5.jpg
[2012/02/17 21:19:28 | 000,000,512 | —- | C] () – C:\Users\Ana\Desktop\MBR.dat
[2012/02/17 20:01:21 | 000,159,380 | —- | C] () – C:\Users\Ana\Desktop\screen 4.jpg
[2012/02/17 14:53:58 | 000,497,272 | —- | C] () – C:\Users\Ana\Desktop\GETxPUD.exe
[2012/02/15 21:07:47 | 000,000,176 | —- | C] () – C:\Users\Ana\defogger_reenable
[2012/02/15 21:06:32 | 000,050,477 | —- | C] () – C:\Users\Ana\Desktop\Defogger.exe
[2012/02/15 17:40:11 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/02/15 17:40:11 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/02/15 17:40:11 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/02/15 17:40:11 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/02/15 17:40:11 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/02/12 14:06:31 | 000,001,987 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Live Messenger .lnk
[2012/02/12 14:06:31 | 000,000,940 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2012/02/12 14:06:31 | 000,000,778 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2012/02/12 14:06:30 | 000,002,032 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/02/12 14:06:30 | 000,001,081 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/02/12 14:06:30 | 000,000,945 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/02/12 14:06:30 | 000,000,258 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2012/02/12 14:06:30 | 000,000,240 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2012/02/12 14:04:48 | 001,251,328 | —- | C] () – C:\Users\Ana\Desktop\RogueKiller.exe
[2012/02/11 19:27:07 | 000,000,900 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3397783422-3384463677-1815793419-1000UA1cce9256ef622a0.job
[2012/02/11 19:27:06 | 000,000,848 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3397783422-3384463677-1815793419-1000Core1cce9256e479320.job
[2012/02/11 17:54:52 | 000,001,748 | —- | C] () – C:\Users\Public\Desktop\Spyware Doctor.lnk
[2010/12/20 20:45:23 | 000,018,604 | —- | C] () – C:\Users\Ana\AppData\Roaming\UserTile.png
[2010/11/10 19:20:54 | 000,000,000 | —- | C] () – C:\Users\Ana\AppData\Local\prvlcl.dat
[2010/10/05 20:14:29 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2010/10/05 20:13:44 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2010/06/29 23:12:16 | 000,013,312 | —- | C] () – C:\Windows\LPRES.DLL
[2009/10/15 19:30:35 | 000,003,584 | —- | C] () – C:\Users\Ana\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/03 14:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 14:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/05/26 22:39:53 | 000,069,632 | —- | C] () – C:\Windows\System32\xmltok.dll
[2009/05/26 22:39:53 | 000,036,864 | —- | C] () – C:\Windows\System32\xmlparse.dll
[2009/03/25 20:50:37 | 000,000,604 | —- | C] () – C:\Users\Ana\AppData\Local\Notes.stt
[2009/03/25 20:50:37 | 000,000,008 | —- | C] () – C:\Users\Ana\AppData\Local\Reminders.stt
[2009/01/09 09:31:30 | 000,000,446 | —- | C] () – C:\Windows\Sierra.ini
[2008/12/30 01:59:36 | 000,016,976 | —- | C] () – C:\Users\Ana\AppData\Roaming\wklnhst.dat
[2008/12/29 20:11:08 | 000,001,356 | —- | C] () – C:\Users\Ana\AppData\Local\d3d9caps.dat
[2008/12/29 19:36:36 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/08/25 07:13:58 | 000,107,357 | —- | C] () – C:\Windows\hpqins13.dat
[2008/08/25 06:46:22 | 000,327,680 | —- | C] () – C:\Windows\System32\pythoncom25.dll
[2008/08/25 06:46:22 | 000,102,400 | —- | C] () – C:\Windows\System32\pywintypes25.dll
[2008/05/16 10:58:04 | 000,012,632 | —- | C] () – C:\Windows\System32\lsdelete.exe
[2006/11/02 06:53:49 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 06:44:53 | 002,243,000 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 04:33:01 | 000,604,264 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 04:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 04:33:01 | 000,103,964 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 04:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 04:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 02:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 02:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 01:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 01:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat

========== LOP Check ==========

[2011/10/25 20:47:14 | 000,000,000 | —D | M] – C:\Users\Ana\AppData\Roaming\.minecraft
[2010/08/12 00:05:47 | 000,000,000 | —D | M] – C:\Users\Ana\AppData\Roaming\.purple
[2010/11/18 14:30:31 | 000,000,000 | —D | M] – C:\Users\Ana\AppData\Roaming\DAEMON Tools Lite
[2009/06/16 18:54:15 | 000,000,000 | —D | M] – C:\Users\Ana\AppData\Roaming\DAEMON Tools Pro
[2012/02/19 11:54:44 | 000,000,000 | —D | M] – C:\Users\Ana\AppData\Roaming\Dropbox
[2011/01/18 10:51:05 | 000,000,000 | —D | M] – C:\Users\Ana\AppData\Roaming\GetRightToGo
[2008/12/31 00:17:40 | 000,000,000 | —D | M] – C:\Users\Ana\AppData\Roaming\iWin
[2010/01/13 09:02:23 | 000,000,000 | —D | M] – C:\Users\Ana\AppData\Roaming\Multi File Downloader
[2010/10/05 11:58:26 | 000,000,000 | —D | M] – C:\Users\Ana\AppData\Roaming\muvee Technologies
[2010/12/20 20:45:22 | 000,000,000 | —D | M] – C:\Users\Ana\AppData\Roaming\PeerNetworking
[2011/07/17 12:55:46 | 000,000,000 | —D | M] – C:\Users\Ana\AppData\Roaming\SystemRequirementsLab
[2008/12/30 01:59:38 | 000,000,000 | —D | M] – C:\Users\Ana\AppData\Roaming\Template
[2011/10/26 09:25:58 | 000,000,000 | —D | M] – C:\Users\Ana\AppData\Roaming\uTorrent
[2009/01/06 20:44:15 | 000,000,000 | —D | M] – C:\Users\Ana\AppData\Roaming\WinBatch
[2010/03/30 21:55:19 | 000,000,000 | —D | M] – C:\Users\Ana\AppData\Roaming\Windows Live Writer
[2010/12/25 13:38:09 | 000,000,000 | —D | M] – C:\Users\Ana\AppData\Roaming\WTouch
[2011/05/02 18:48:27 | 000,000,000 | —D | M] – C:\Users\Brie\AppData\Roaming\.minecraft
[2011/03/20 09:06:55 | 000,000,000 | —D | M] – C:\Users\Brie\AppData\Roaming\Template
[2011/01/13 09:39:02 | 000,000,000 | —D | M] – C:\Users\Brie\AppData\Roaming\WTouch
[2012/02/19 03:27:36 | 000,032,570 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2012/02/18 19:43:12 | 000,000,414 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{613A91CE-67C1-4421-90F1-050F3F9C0DEE}.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 171 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >

HI Oldman960,

I've done as you've asked.
Java has been trying to update for days but I've been putting it of as I did not want to do anything that you didn't suggest.
Reinstalled MBAM, log is below as well as OTL scan log.
Mbam pick up Trojan dropper and I've deleted it.
Haven't noticed any other problems with this machine.

Everyone here at home says that I should go for it, so I think I will sign up for the WTT classroom
Thanks for your input
Patrick


Malwarebytes Anti-Malware (Trial) 1.60.1.1000
www.malwarebytes.org

Database version: v2012.02.20.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 7.0.6002.18005
Ana :: TOBE [administrator]

Protection: Disabled

2/20/2012 6:18:23 PM
mbam-log-2012-02-20 (18-18-23).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 213661
Time elapsed: 6 minute(s), 24 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Windows\System32\config\systemprofile\AppData\Roaming\569F3\02968.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.

(end)




OTL logfile created on: 2/20/2012 6:52:49 PM - Run 6
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Ana\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.87 Gb Total Physical Memory | 0.94 Gb Available Physical Memory | 50.32% Memory free
3.98 Gb Paging File | 2.90 Gb Available in Paging File | 72.72% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 138.03 Gb Total Space | 36.07 Gb Free Space | 26.13% Space Free | Partition Type: NTFS
Drive D: | 11.02 Gb Total Space | 1.49 Gb Free Space | 13.56% Space Free | Partition Type: NTFS
Drive G: | 778.49 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: TOBE | User Name: Ana | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\Ana\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Ana\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation)
PRC - C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation)
PRC - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files\Tablet\Pen\Pen_Tablet.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\Tablet\Pen\Pen_TouchUser.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\Tablet\Pen\Pen_TabletUser.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\Tablet\Pen\Pen_TouchService.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
PRC - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
PRC - C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
PRC - C:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
PRC - C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe ()


========== Modules (No Company Name) ==========

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\8b5f54e3b382fc1720c76557ef8c8bc3\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5c3bfd69e0c268baff0d169e11a6a784\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\7fd6c62196829d1e2dce5a253145d51a\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d9f0f1dc8cbdb81f1ba122d77a6ab710\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\65450889f3742aada2a6c0cf8e6173e3\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\137696d0416b65dbc1561152971488b4\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\029217106fa24787ff7a61b754f8ebf7\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\d48e106e015d0f8cb2d5295015cee508\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\56df3488472318c59d0a08ed10a065d3\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\3951e0a359c004cd6ba268ff78ac62aa\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1e258a951222c818540b33880ca45f2e\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c50133cb67d7c013fa31e1ffb942060b\System.ni.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\8056d047225d4a9c2e4c6b096563d93d\UIAutomationTypes.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll ()
MOD - C:\Program Files\Tablet\Pen\libxml2.dll ()
MOD - C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll ()
MOD - C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECLibrary.dll ()
MOD - C:\Program Files\Hewlett-Packard\HP Advisor\MessagingServer.dll ()
MOD - C:\Program Files\Hewlett-Packard\HP Advisor\MessagingClients.dll ()
MOD - C:\Program Files\Hewlett-Packard\HP Advisor\RemotingClient.dll ()
MOD - C:\Program Files\Hewlett-Packard\HP Advisor\MessagingInterface.dll ()
MOD - C:\Program Files\Hewlett-Packard\HP Advisor\MessagingMessages.dll ()
MOD - C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\HP.ActiveSupportLibrary\2.0.0.1__01a974bc1760f423\HP.ActiveSupportLibrary.dll ()
MOD - C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe ()


========== Win32 Services (SafeList) ==========

SRV - (PlugPlay32) – File not found
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (nvUpdatusService) – C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (sdCoreService) – C:\Program Files\PC Tools Security\pctsSvc.exe (PC Tools)
SRV - (TabletServicePen) – C:\Program Files\Tablet\Pen\Pen_Tablet.exe (Wacom Technology, Corp.)
SRV - (TouchServicePen) – C:\Program Files\Tablet\Pen\Pen_TouchService.exe (Wacom Technology, Corp.)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (sdAuxService) – C:\Program Files\PC Tools Security\pctsAuxs.exe (PC Tools)
SRV - (aawservice) – C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (MBAMProtector) – C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (PCTCore) – C:\Windows\system32\drivers\PCTCore.sys (PC Tools)
DRV - (wacomvhid) – C:\Windows\System32\drivers\wacomvhid.sys (Wacom Technology)
DRV - (pctDS) – C:\Windows\system32\drivers\pctDS.sys (PC Tools)
DRV - (sptd) – C:\Windows\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (wacmoumonitor) – C:\Windows\System32\drivers\wacmoumonitor.sys (Wacom Technology)
DRV - (WacomVTHid) – C:\Windows\System32\drivers\WacomVTHid.sys (Wacom Technology)
DRV - (mcdbus) – C:\Windows\System32\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (nvrd32) – C:\Windows\system32\drivers\nvrd32.sys (NVIDIA Corporation)
DRV - (nvstor32) – C:\Windows\system32\DRIVERS\nvstor32.sys (NVIDIA Corporation)
DRV - (PCD5SRVC{BD6912E3-AC9D80E8-05040000}) – C:\Program Files\PC-Doctor for Windows\pcd5srvc.pkms (PC-Doctor, Inc.)
DRV - (nvsmu) – C:\Windows\system32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (HSXHWBS3) – C:\Windows\System32\drivers\HSXHWBS3.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) – C:\Windows\System32\drivers\HSX_DP.sys (Conexant Systems, Inc.)
DRV - (XAudio) – C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (MRV6X32P) – C:\Windows\System32\drivers\MRVW13B.sys (Marvell Semiconductor, Inc)
DRV - (wacommousefilter) – C:\Windows\System32\drivers\wacommousefilter.sys (Wacom Technology)
DRV - (Ps2) – C:\Windows\System32\drivers\PS2.sys (Hewlett-Packard Company)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cndt

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?pc=ZUGO&form;=ZGAPHP
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = E7 4E B6 01 10 F2 F7 42 A0 83 DB DB 0C 31 F6 0E [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..network.proxy.http: ""
FF - prefs.js..network.proxy.http_port: ""
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.5: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKCU\Software\MozillaPlugins\@soe.sony.com/installer,version=1.0.3: C:\PROGRA~1\SONYON~1\npsoe.dll File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Ana\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Ana\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1d5287d1-8a92-0001-1f31-1cec198018d8}: C:\Program Files\AVG\AVG8\ToolbarFF
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/02/19 12:00:06 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/06/09 10:19:51 | 000,000,000 | —D | M]

[2008/12/29 19:29:21 | 000,000,000 | —D | M] (No name found) – C:\Users\Ana\AppData\Roaming\mozilla\Extensions
[2012/02/14 16:53:09 | 000,000,000 | —D | M] (No name found) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions
[2010/05/18 08:25:57 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/02/12 14:09:31 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009/03/25 10:50:02 | 000,000,000 | —D | M] (No name found) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}-trash
[2011/03/28 16:13:41 | 000,000,000 | —D | M] (Personas) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\[removed]
[2010/02/25 10:07:16 | 000,000,000 | —D | M] (Panda3D Game Engine Plug-In) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\[removed]
[2011/01/02 21:33:24 | 000,000,000 | —D | M] (Search Toolbar) – C:\Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\[removed]
[2012/02/20 06:20:47 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/07/19 19:57:48 | 000,000,000 | —D | M] (Skype extension) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/02/20 06:20:47 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
() (No name found) – C:\USERS\ANA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\D5BTN3LZ.DEFAULT\EXTENSIONS\{AE93811A-5C9A-4D34-8462-F7B864FC4696}.XPI
[2012/02/16 08:40:42 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/02/20 06:20:34 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/03/20 19:52:56 | 000,238,776 | —- | M] (Pando Networks) – C:\Program Files\mozilla firefox\plugins\npPandoWebInst.dll
[2012/02/16 04:42:53 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/02/16 04:42:53 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Ana\AppData\Local\Google\Chrome\Application\17.0.963.56\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Users\Ana\AppData\Local\Google\Chrome\Application\17.0.963.56\gears.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Ana\AppData\Local\Google\Chrome\Application\17.0.963.56\gcswf32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java™ Platform SE 6 U20 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Windows Genuine Advantage (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll
CHR - plugin: Pando Web Installer (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Wacom Dynamic Link Library (Enabled) = C:\Program Files\TabletPlugins\npwacom.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Ana\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.50917.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Skype Extension = C:\Users\Ana\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.5.0.7896_0\
CHR - Extension: AT_WesCravenV2 = C:\Users\Ana\AppData\Local\Google\Chrome\User Data\Default\Extensions\nahooofggegjbnodalhoibemeabkapop\3\

O1 HOSTS File: ([2012/02/16 07:27:32 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll File not found
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [DPService] C:\Program Files\HP\DVDPlay\DPService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
O4 - Startup: C:\Users\Ana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Ana\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Ana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1C3EFEE7-B1F5-406C-9ACB-9AABE3B7F973}: DhcpNameServer = 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1C517DEB-59CF-4806-A1BA-A71265252F3D}: DhcpNameServer = 192.168.0.1 [removed]
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (MrvGINA.dll) - File not found
O24 - Desktop WallPaper: C:\Users\Ana\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Ana\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/08/25 07:12:57 | 000,000,074 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2007/08/04 09:54:31 | 000,000,000 | —D | M] - G:\AutoRun – [ CDFS ]
O32 - AutoRun File - [2007/08/04 09:54:31 | 000,700,416 | R— | M] (Electronic Arts Inc.) - G:\AutoRun.exe – [ CDFS ]
O32 - AutoRun File - [2007/08/04 08:09:54 | 000,659,456 | R— | M] (Electronic Arts Inc.) - G:\AutoRunGUI.dll – [ CDFS ]
O32 - AutoRun File - [2007/08/04 10:00:52 | 000,000,152 | R— | M] () - G:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/02/20 18:15:09 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/02/20 18:15:08 | 000,020,464 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2012/02/20 18:15:08 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2012/02/20 06:21:13 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2012/02/19 03:07:22 | 000,193,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2012/02/19 03:07:21 | 001,383,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2012/02/19 03:07:21 | 000,671,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2012/02/19 03:07:21 | 000,471,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2012/02/19 03:07:21 | 000,180,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2012/02/19 03:07:21 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2012/02/19 03:07:21 | 000,027,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2012/02/19 03:07:20 | 000,389,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2012/02/19 03:07:20 | 000,380,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dll
[2012/02/17 14:54:37 | 000,000,000 | —D | C] – C:\Users\Ana\Desktop\GETxPUD
[2012/02/17 12:57:19 | 000,066,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\packager.dll
[2012/02/17 12:57:17 | 000,376,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winsrv.dll
[2012/02/17 12:57:13 | 002,044,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2012/02/16 21:55:48 | 000,000,000 | —D | C] – C:\TDSSKiller_Quarantine
[2012/02/16 20:41:25 | 002,060,336 | —- | C] (Kaspersky Lab ZAO) – C:\Users\Ana\Desktop\tdsskiller.exe
[2012/02/16 07:34:40 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/02/16 07:34:23 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/02/16 07:31:23 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\temp
[2012/02/15 21:20:51 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/02/15 17:40:11 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/02/15 17:40:11 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/02/15 17:39:35 | 000,000,000 | —D | C] – C:\Qoobox
[2012/02/15 17:37:49 | 004,404,931 | R— | C] (Swearware) – C:\Users\Ana\Desktop\ComboFix.exe
[2012/02/15 17:31:39 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{D599B5D8-9F77-4267-8BEC-976E9C1DF647}
[2012/02/15 17:31:36 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{6A86C66B-A280-49DE-A88F-3FBDDBA60C30}
[2012/02/13 18:23:31 | 004,733,440 | —- | C] (AVAST Software) – C:\Users\Ana\Desktop\aswMBR.exe
[2012/02/13 08:48:05 | 000,000,000 | —D | C] – C:\_OTL
[2012/02/12 14:06:29 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2011
[2012/02/12 11:57:37 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\Ana\Desktop\OTL.exe
[2012/02/12 03:07:37 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mciseq.dll
[2012/02/12 03:03:38 | 001,314,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quartz.dll
[2012/02/12 03:03:38 | 000,497,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qdvd.dll
[2012/02/11 19:02:42 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Roaming\Malwarebytes
[2012/02/11 19:02:35 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2012/02/11 17:55:04 | 000,656,320 | —- | C] (PC Tools) – C:\Windows\System32\drivers\pctEFA.sys
[2012/02/11 17:55:04 | 000,338,880 | —- | C] (PC Tools) – C:\Windows\System32\drivers\pctDS.sys
[2012/02/11 17:55:01 | 000,251,560 | —- | C] (PC Tools) – C:\Windows\System32\drivers\pctgntdi.sys
[2012/02/11 17:55:01 | 000,103,232 | —- | C] (PC Tools) – C:\Windows\System32\drivers\pctwfpfilter.sys
[2012/02/11 17:54:55 | 000,239,168 | —- | C] (PC Tools) – C:\Windows\System32\drivers\PCTCore.sys
[2012/02/11 17:54:55 | 000,160,448 | —- | C] (PC Tools) – C:\Windows\System32\drivers\PCTAppEvent.sys
[2012/02/11 17:54:52 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Tools Security
[2012/02/11 17:54:49 | 000,070,536 | —- | C] (PC Tools) – C:\Windows\System32\drivers\pctplsg.sys
[2012/02/11 17:54:41 | 000,000,000 | —D | C] – C:\Program Files\PC Tools Security
[2012/02/11 17:54:41 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Roaming\PC Tools
[2012/02/11 17:54:41 | 000,000,000 | —D | C] – C:\Program Files\Common Files\PC Tools
[2012/02/11 17:47:36 | 000,000,000 | —D | C] – C:\ProgramData\PC Tools

========== Files - Modified Within 30 Days ==========

[2012/02/20 18:48:36 | 000,003,616 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/02/20 18:48:35 | 000,003,616 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/02/20 18:48:28 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/02/20 18:32:01 | 000,000,900 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3397783422-3384463677-1815793419-1000UA1cce9256ef622a0.job
[2012/02/20 18:15:10 | 000,000,868 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/02/20 17:55:31 | 000,000,414 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{613A91CE-67C1-4421-90F1-050F3F9C0DEE}.job
[2012/02/20 06:20:34 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\deployJava1.dll
[2012/02/20 06:20:34 | 000,157,472 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2012/02/20 06:20:34 | 000,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2012/02/20 06:20:34 | 000,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2012/02/19 12:00:07 | 000,000,832 | —- | M] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/02/19 12:00:07 | 000,000,808 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/02/19 03:29:47 | 002,243,000 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/02/19 03:02:52 | 000,604,264 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/02/19 03:02:52 | 000,103,964 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/02/18 19:32:00 | 000,000,848 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3397783422-3384463677-1815793419-1000Core1cce9256e479320.job
[2012/02/17 22:22:18 | 001,251,328 | —- | M] () – C:\Users\Ana\Desktop\RogueKiller.exe
[2012/02/17 14:53:59 | 000,497,272 | —- | M] () – C:\Users\Ana\Desktop\GETxPUD.exe
[2012/02/16 20:41:30 | 002,060,336 | —- | M] (Kaspersky Lab ZAO) – C:\Users\Ana\Desktop\tdsskiller.exe
[2012/02/16 07:27:32 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2012/02/15 22:34:49 | 000,002,070 | —- | M] () – C:\Users\Ana\Desktop\Google Chrome.lnk
[2012/02/15 22:34:49 | 000,002,032 | —- | M] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/02/15 21:08:00 | 000,000,176 | —- | M] () – C:\Users\Ana\defogger_reenable
[2012/02/15 21:06:32 | 000,050,477 | —- | M] () – C:\Users\Ana\Desktop\Defogger.exe
[2012/02/15 17:37:54 | 004,404,931 | R— | M] (Swearware) – C:\Users\Ana\Desktop\ComboFix.exe
[2012/02/15 17:32:49 | 000,000,931 | —- | M] () – C:\Users\Ana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012/02/15 17:32:48 | 000,000,951 | —- | M] () – C:\Users\Ana\Desktop\Dropbox.lnk
[2012/02/14 06:47:38 | 000,001,356 | —- | M] () – C:\Users\Ana\AppData\Local\d3d9caps.dat
[2012/02/13 18:23:52 | 004,733,440 | —- | M] (AVAST Software) – C:\Users\Ana\Desktop\aswMBR.exe
[2012/02/13 10:47:23 | 261,136,407 | —- | M] () – C:\Windows\MEMORY.DMP
[2012/02/12 11:57:38 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Ana\Desktop\OTL.exe
[2012/02/11 21:40:04 | 000,000,314 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForAna.job
[2012/02/11 17:54:52 | 000,001,748 | —- | M] () – C:\Users\Public\Desktop\Spyware Doctor.lnk

========== Files Created - No Company Name ==========

[2012/02/20 18:15:10 | 000,000,868 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/02/19 12:00:07 | 000,000,832 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/02/19 12:00:07 | 000,000,808 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/02/19 12:00:06 | 000,000,820 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/02/17 14:53:58 | 000,497,272 | —- | C] () – C:\Users\Ana\Desktop\GETxPUD.exe
[2012/02/15 21:07:47 | 000,000,176 | —- | C] () – C:\Users\Ana\defogger_reenable
[2012/02/15 21:06:32 | 000,050,477 | —- | C] () – C:\Users\Ana\Desktop\Defogger.exe
[2012/02/15 17:40:11 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/02/15 17:40:11 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/02/15 17:40:11 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/02/15 17:40:11 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/02/15 17:40:11 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/02/12 14:06:31 | 000,001,987 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Live Messenger .lnk
[2012/02/12 14:06:31 | 000,000,940 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2012/02/12 14:06:31 | 000,000,778 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2012/02/12 14:06:30 | 000,002,032 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/02/12 14:06:30 | 000,001,081 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/02/12 14:06:30 | 000,000,945 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/02/12 14:06:30 | 000,000,258 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2012/02/12 14:06:30 | 000,000,240 | —- | C] () – C:\Users\Ana\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2012/02/12 14:04:48 | 001,251,328 | —- | C] () – C:\Users\Ana\Desktop\RogueKiller.exe
[2012/02/11 19:27:07 | 000,000,900 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3397783422-3384463677-1815793419-1000UA1cce9256ef622a0.job
[2012/02/11 19:27:06 | 000,000,848 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3397783422-3384463677-1815793419-1000Core1cce9256e479320.job
[2012/02/11 17:54:52 | 000,001,748 | —- | C] () – C:\Users\Public\Desktop\Spyware Doctor.lnk
[2010/12/20 20:45:23 | 000,018,604 | —- | C] () – C:\Users\Ana\AppData\Roaming\UserTile.png
[2010/11/10 19:20:54 | 000,000,000 | —- | C] () – C:\Users\Ana\AppData\Local\prvlcl.dat
[2010/10/05 20:14:29 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2010/10/05 20:13:44 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2010/06/29 23:12:16 | 000,013,312 | —- | C] () – C:\Windows\LPRES.DLL
[2009/10/15 19:30:35 | 000,003,584 | —- | C] () – C:\Users\Ana\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/03 14:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 14:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/05/26 22:39:53 | 000,069,632 | —- | C] () – C:\Windows\System32\xmltok.dll
[2009/05/26 22:39:53 | 000,036,864 | —- | C] () – C:\Windows\System32\xmlparse.dll
[2009/03/25 20:50:37 | 000,000,604 | —- | C] () – C:\Users\Ana\AppData\Local\Notes.stt
[2009/03/25 20:50:37 | 000,000,008 | —- | C] () – C:\Users\Ana\AppData\Local\Reminders.stt
[2009/01/09 09:31:30 | 000,000,446 | —- | C] () – C:\Windows\Sierra.ini
[2008/12/30 01:59:36 | 000,016,976 | —- | C] () – C:\Users\Ana\AppData\Roaming\wklnhst.dat
[2008/12/29 20:11:08 | 000,001,356 | —- | C] () – C:\Users\Ana\AppData\Local\d3d9caps.dat
[2008/12/29 19:36:36 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/08/25 07:13:58 | 000,107,357 | —- | C] () – C:\Windows\hpqins13.dat
[2008/08/25 06:46:22 | 000,327,680 | —- | C] () – C:\Windows\System32\pythoncom25.dll
[2008/08/25 06:46:22 | 000,102,400 | —- | C] () – C:\Windows\System32\pywintypes25.dll
[2008/05/16 10:58:04 | 000,012,632 | —- | C] () – C:\Windows\System32\lsdelete.exe
[2006/11/02 06:53:49 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 06:44:53 | 002,243,000 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 04:33:01 | 000,604,264 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 04:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 04:33:01 | 000,103,964 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 04:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 04:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 02:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 02:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 01:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 01:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat

========== Alternate Data Streams ==========

@Alternate Data Stream - 171 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >