BankerFox.A

I was unable to update my Java and Acrobat reader unfortunately, but here's the OTL report.

BankerFox.A hit suddenly last night, and the constant error messages made it impossible to do anything. I've been told that Malwarebytes would probably fix it, but I'm unable to access the Malwarebytes page from the infected computer even in safe mode with networking-- although most other pages are loading fine. Similarly any programs I try to download suddenly lose connection. Avast! didn't seem to find anything, although if I am connected to the internet (and not in safe mode) I get constant warnings I am sending out spam from it. I've also tried SmitFraudFix and Sophos Anti-Virus. Sophos found "Mal/keygen-c" and removed it, but BankerFox.A is still alive and kicking. Any help would be super-awesome! Thanks!

OTL logfile created on: 5/18/2010 16:04:19 - Run 1
OTL by OldTimer - Version 3.2.4.1 Folder = C:\Users\Sarah\Downloads
Windows Vista Home Basic Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 81.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 94.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 73.06 Gb Total Space | 5.08 Gb Free Space | 6.95% Space Free | Partition Type: NTFS
Drive D: | 654.81 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: TOSHIKO
Current User Name: Sarah
Logged in as Administrator.

Current Boot Mode: SafeMode with Networking
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/05/18 16:02:40 | 000,571,392 | ---- | M] (OldTimer Tools) -- C:\Users\Sarah\Downloads\OTL.exe
PRC - [2008/10/28 23:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/07/07 09:15:18 | 000,611,664 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe


========== Modules (SafeList) ==========

MOD - [2010/05/18 16:02:40 | 000,571,392 | ---- | M] (OldTimer Tools) -- C:\Users\Sarah\Downloads\OTL.exe
MOD - [2008/01/19 00:33:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx
MOD - [2008/01/19 00:26:34 | 001,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/04/16 16:09:06 | 000,246,520 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2009/11/24 16:51:35 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus)
SRV - [2009/11/24 16:51:21 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner)
SRV - [2009/11/24 16:48:48 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner)
SRV - [2009/11/24 16:43:56 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Stopped] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv)
SRV - [2009/11/10 10:28:08 | 000,112,592 | ---- | M] (Threat Expert Ltd.) [Auto | Stopped] -- C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe -- (Browser Defender Update Service)
SRV - [2008/07/07 09:15:18 | 000,611,664 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe -- (aawservice)
SRV - [2008/01/19 00:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/08/31 17:46:18 | 000,600,912 | ---- | M] (Safer Networking Ltd.) [Auto | Stopped] -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2007/05/23 18:23:38 | 001,862,144 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe -- (GoogleDesktopManager)
SRV - [2007/04/13 09:20:22 | 000,097,432 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)
SRV - [2007/01/25 17:50:26 | 000,063,096 | ---- | M] () [Auto | Stopped] -- c:\TOSHIBA\IVP\swupdate\swupdtmr.exe -- (Swupdtmr)
SRV - [2007/01/25 17:47:50 | 000,136,816 | ---- | M] () [Auto | Stopped] -- C:\TOSHIBA\IVP\ISM\pinger.exe -- (pinger)
SRV - [2006/12/19 23:15:44 | 000,428,152 | ---- | M] (TOSHIBA Corporation) [Auto | Stopped] -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV - [2006/11/14 20:33:10 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Stopped] -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe -- (CFSvcs)
SRV - [2006/10/31 22:40:16 | 000,077,824 | ---- | M] (TOSHIBA CORPORATION) [Auto | Stopped] -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
SRV - [2006/09/12 08:03:20 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Stopped] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2006/08/23 16:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)
SRV - [2006/05/25 18:30:16 | 000,114,688 | ---- | M] (TOSHIBA Corporation) [Auto | Stopped] -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv)
SRV - [2005/11/14 01:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)


========== Driver Services (SafeList) ==========

DRV - [2009/11/24 16:50:12 | 000,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2009/11/24 16:50:00 | 000,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2009/11/24 16:49:48 | 000,053,328 | ---- | M] (ALWIL Software) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2009/11/24 16:49:07 | 000,048,560 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2009/11/24 16:48:57 | 000,023,120 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2009/09/23 16:10:06 | 000,207,280 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\PCTCore.sys -- (PCTCore)
DRV - [2007/07/12 03:58:54 | 000,049,904 | R--- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BVRPMPR5.SYS -- (BVRPMPR5)
DRV - [2007/02/28 18:04:58 | 000,694,784 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2006/11/28 21:39:52 | 001,476,096 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx)
DRV - [2006/11/28 21:39:52 | 001,476,096 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\igdkmd32.sys -- (ialm)
DRV - [2006/11/09 14:32:28 | 000,219,264 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\kr10i.sys -- (KR10I)
DRV - [2006/11/09 14:31:46 | 000,211,072 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\kr10n.sys -- (KR10N)
DRV - [2006/11/08 19:09:24 | 001,647,976 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006/11/04 09:35:50 | 000,059,392 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2006/11/02 02:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 02:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 02:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 02:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 02:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 02:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2006/11/02 02:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 02:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 02:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 02:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 02:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 02:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 02:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2006/11/02 02:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 02:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 02:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 02:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2006/11/02 02:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 02:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 02:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 02:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 02:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2006/11/02 02:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 02:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 02:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 02:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 02:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 02:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 02:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 02:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 02:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 02:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 02:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2006/11/02 02:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2006/11/02 02:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2006/11/02 01:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 01:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 01:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 01:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 01:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 01:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 00:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 00:30:54 | 001,781,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2006/11/02 00:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2006/10/27 14:14:22 | 000,179,896 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP)
DRV - [2006/10/18 11:50:04 | 000,016,128 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV - [2006/10/05 22:22:14 | 000,016,768 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS -- (TVALZ)
DRV - [2006/09/27 20:06:56 | 000,479,488 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\kr3npxp.sys -- (KR3NPXP)
DRV - [2006/08/31 06:53:00 | 001,161,152 | ---- | M] (Agere Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006/07/28 16:25:26 | 000,019,456 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\LPCFilter.sys -- (LPCFilter)
DRV - [2006/07/06 13:44:00 | 000,168,448 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tifm21.sys -- (tifm21)
DRV - [2005/11/02 17:47:26 | 000,010,368 | R--- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pfc.sys -- (pfc)
DRV - [2005/08/01 16:45:08 | 000,064,896 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\tosrfcom.sys -- (Tosrfcom)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: {D469DA71-A9C6-48f1-B86E-67313AADB588}:3.2.2
FF - prefs.js..extensions.enabledItems: {1650a312-02bc-40ee-977e-83f158701739}:26.6
FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.2
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:2.5.8.6

FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2009/04/13 17:37:35 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/12 17:53:16 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/08 02:20:31 | 000,000,000 | ---D | M]

[2009/03/31 12:44:36 | 000,000,000 | ---D | M] -- C:\Users\Sarah\AppData\Roaming\Mozilla\Extensions
[2009/03/22 12:10:41 | 000,000,000 | ---D | M] -- C:\Users\Sarah\AppData\Roaming\Mozilla\Extensions\celtx@celtx.com
[2010/05/17 23:18:01 | 000,000,000 | ---D | M] -- C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\aahbglie.default\extensions
[2010/05/03 12:12:46 | 000,000,000 | ---D | M] (Zynga Toolbar) -- C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\aahbglie.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
[2009/03/31 12:47:39 | 000,000,000 | ---D | M] (LiveJournal Hook) -- C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\aahbglie.default\extensions\{D469DA71-A9C6-48f1-B86E-67313AADB588}
[2009/10/14 12:35:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\aahbglie.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2010/05/13 12:45:13 | 000,000,851 | ---- | M] () -- C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\aahbglie.default\searchplugins\blingo.xml
[2007/12/09 01:17:16 | 000,002,386 | ---- | M] () -- C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\aahbglie.default\searchplugins\siteadvisor.xml
[2009/03/31 12:44:39 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/05/18 01:48:04 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll ()
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll ()
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [00TCrdMain] C:\Program Files\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [ClamWin] C:\Program Files\ClamWin\bin\ClamTray.exe (alch)
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [HSON] C:\Program Files\Toshiba\TBS\HSON.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe (TOSHIBA Electronics, Inc.)
O4 - HKLM..\Run: [KeNotify] C:\Program Files\Toshiba\Utilities\KeNotify.exe ()
O4 - HKLM..\Run: [LtMoh] C:\Program Files\ltmoh\ltmoh.exe (Agere Systems)
O4 - HKLM..\Run: [NDSTray.exe] C:\Program Files\Toshiba\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe (McAfee, Inc.)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\Toshiba\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe (TOSHIBA)
O4 - HKLM..\Run: [TPwrMain] C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKCU..\Run: [asam] C:\Users\Sarah\AppData\Local\asam.exe ()
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [TOSCDSPD] C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
O4 - HKCU..\Run: [uaadvukc] C:\Users\Sarah\AppData\Local\bnqmxbwgg\bewaryxtssd.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O8 - Extra context menu item: Copy to Semagic - C:\Program Files\Semagic\copy.htm ()
O8 - Extra context menu item: Semagic - C:\Program Files\Semagic\link.htm ()
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll (Sun Microsystems, Inc.)
O9 - Extra Button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 137.82.27.42 142.103.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.109,85.255.112.141
O18 - Protocol\Handler\siteadvisor {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll ()
O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img35.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img35.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 14:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/12/19 10:56:20 | 000,000,000 | ---D | M] - D:\Autorun -- [ CDFS ]
O32 - AutoRun File - [2006/07/20 16:56:36 | 000,253,952 | R--- | M] (Firaxis Games) - D:\autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2006/07/24 11:33:33 | 000,007,974 | R--- | M] () - D:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{0a6766dd-dcc6-11de-8135-001b38a9b2e4}\Shell - "" = AutoRun
O33 - MountPoints2\{0a6766dd-dcc6-11de-8135-001b38a9b2e4}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
O33 - MountPoints2\{0a6c7586-bbab-11dd-ab71-001b38a9b2e4}\Shell - "" = AutoRun
O33 - MountPoints2\{0a6c7586-bbab-11dd-ab71-001b38a9b2e4}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
O33 - MountPoints2\{2fc42822-ec0e-11dc-916f-001b38a9b2e4}\Shell - "" = AutoRun
O33 - MountPoints2\{2fc42822-ec0e-11dc-916f-001b38a9b2e4}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found
O33 - MountPoints2\{98dd04b4-81ea-11dc-b187-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{98dd04b4-81ea-11dc-b187-806e6f6e6963}\Shell\AutoRun\command - "" = D:\autorun.exe -- [2006/07/20 16:56:36 | 000,253,952 | R--- | M] (Firaxis Games)
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias [2009/01/19 16:55:36 | 000,000,000 | ---D | M]
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found


SafeBootMin: aawservice - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: aawservice - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.1.4
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.1.4
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows script 5.6
ActiveX: {5B057F1D-7E57-232F-5795-AE7B7BD2E8E5} - Microsoft Windows Media Player 11.0
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Reg Error: Value error.
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

Drivers32: msacm.dvacm - C:\Program Files\Common Files\Ulead Systems\vio\DVACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 30 Days ==========

[2010/05/18 02:49:23 | 000,000,000 | ---D | C] -- C:\SAV32CLI
[2010/05/18 02:19:26 | 000,000,000 | ---D | C] -- C:\Users\Sarah\AppData\Roaming\.clamwin
[2010/05/18 02:18:58 | 000,000,000 | ---D | C] -- C:\Program Files\ClamWin
[2010/05/18 02:18:58 | 000,000,000 | ---D | C] -- C:\ProgramData\.clamwin
[2010/05/18 02:03:34 | 001,640,400 | ---- | C] (Threat Expert Ltd.) -- C:\Windows\PCTBDCore.dll
[2010/05/18 02:03:34 | 000,165,840 | ---- | C] (Threat Expert Ltd.) -- C:\Windows\PCTBDRes.dll
[2010/05/18 02:03:34 | 000,149,456 | ---- | C] (PC Tools) -- C:\Windows\SGDetectionTool.dll
[2010/05/18 02:03:16 | 000,233,136 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctgntdi.sys
[2010/05/18 02:03:16 | 000,100,136 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctwfpfilter.sys
[2010/05/18 02:03:12 | 000,207,280 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTCore.sys
[2010/05/18 02:03:12 | 000,087,784 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTAppEvent.sys
[2010/05/18 02:03:08 | 000,070,408 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctplsg.sys
[2010/05/18 02:03:02 | 000,000,000 | ---D | C] -- C:\Program Files\Spyware Doctor
[2010/05/18 02:03:02 | 000,000,000 | ---D | C] -- C:\Users\Sarah\AppData\Roaming\PC Tools
[2010/05/18 02:03:02 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2010/05/18 02:03:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2010/05/18 02:02:49 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2010/05/18 02:00:10 | 000,000,000 | ---D | C] -- C:\Temp
[2010/05/18 01:13:53 | 000,289,144 | ---- | C] (S!Ri) -- C:\Windows\System32\VCCLSID.exe
[2010/05/18 01:13:53 | 000,087,552 | ---- | C] (S!Ri.URZ) -- C:\Windows\System32\VACFix.exe
[2010/05/18 01:13:53 | 000,082,944 | ---- | C] (S!Ri.URZ) -- C:\Windows\System32\IEDFix.exe
[2010/05/18 01:13:53 | 000,082,944 | ---- | C] (S!Ri.URZ) -- C:\Windows\System32\IEDFix.C.exe
[2010/05/18 01:13:53 | 000,082,432 | ---- | C] (S!Ri.URZ) -- C:\Windows\System32\404Fix.exe
[2010/05/18 01:13:53 | 000,080,384 | ---- | C] (S!Ri.URZ) -- C:\Windows\System32\o4Patch.exe
[2010/05/18 01:13:53 | 000,078,336 | ---- | C] (S!Ri.URZ) -- C:\Windows\System32\Agent.OMZ.Fix.exe
[2010/05/18 01:13:52 | 000,288,417 | ---- | C] (S!Ri) -- C:\Windows\System32\SrchSTS.exe
[2010/05/18 01:13:52 | 000,135,168 | ---- | C] (SteelWerX) -- C:\Windows\System32\swreg.exe
[2010/05/18 01:13:52 | 000,079,360 | ---- | C] (SteelWerX) -- C:\Windows\System32\swxcacls.exe
[2010/05/18 01:13:52 | 000,053,248 | ---- | C] (http://www.beyondlogic.org) -- C:\Windows\System32\Process.exe
[2010/05/17 23:24:15 | 000,000,000 | ---D | C] -- C:\Users\Sarah\AppData\Local\bnqmxbwgg
[2010/05/14 19:49:44 | 000,000,000 | ---D | C] -- C:\Users\Sarah\AppData\Roaming\Aveyond 3
[2010/05/13 16:13:12 | 000,000,000 | ---D | C] -- C:\Users\Sarah\AppData\Roaming\freshgames
[2010/05/13 13:27:14 | 000,000,000 | ---D | C] -- C:\Users\Sarah\AppData\Roaming\Happyville__
[2010/05/10 23:55:30 | 000,000,000 | ---D | C] -- C:\Users\Sarah\AppData\Roaming\Geneforge 3 Saved Games
[2010/05/10 23:55:28 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2010/05/05 23:17:48 | 000,000,000 | ---D | C] -- C:\Users\Sarah\AppData\Roaming\runic games
[2010/05/03 16:00:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Awem
[2010/04/29 17:37:01 | 000,000,000 | ---D | C] -- C:\Users\Sarah\Documents\Jojos Fashion Show
[2010/04/28 22:28:01 | 000,000,000 | ---D | C] -- C:\Users\Sarah\AppData\Roaming\Hoyle Casino
[2010/04/28 18:15:08 | 000,000,000 | ---D | C] -- C:\Users\Sarah\AppData\Roaming\GameInvest
[2010/04/28 16:09:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Fashion Solitaire 1.2
[2010/04/18 20:48:12 | 000,000,000 | ---D | C] -- C:\Users\Sarah\AppData\Roaming\Hoyle FaceCreator
[2010/04/18 20:48:11 | 000,000,000 | ---D | C] -- C:\Users\Sarah\AppData\Roaming\Hoyle Card Games
[2010/04/18 20:27:55 | 000,000,000 | ---D | C] -- C:\Users\Sarah\Documents\Poker Superstars II Documents
[2010/04/18 20:27:55 | 000,000,000 | ---D | C] -- C:\Users\Sarah\AppData\Roaming\funkitron
[73 C:\Users\Sarah\Documents\*.tmp files -> C:\Users\Sarah\Documents\*.tmp -> ]
[5 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Users\Sarah\Desktop\*.tmp files -> C:\Users\Sarah\Desktop\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/05/18 16:07:54 | 003,932,160 | -HS- | M] () -- C:\Users\Sarah\NTUSER.DAT
[2010/05/18 16:01:49 | 000,690,960 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/05/18 16:01:49 | 000,594,698 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/05/18 16:01:49 | 000,100,766 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/05/18 15:57:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/05/18 15:55:57 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/05/18 15:55:45 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/05/18 15:55:45 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/05/18 15:55:40 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2010/05/18 15:53:57 | 000,524,288 | -HS- | M] () -- C:\Users\Sarah\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000001.regtrans-ms
[2010/05/18 15:53:57 | 000,065,536 | -HS- | M] () -- C:\Users\Sarah\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TM.blf
[2010/05/18 15:52:47 | 003,163,707 | -H-- | M] () -- C:\Users\Sarah\AppData\Local\IconCache.db
[2010/05/18 15:41:06 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/05/18 02:29:04 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/05/18 02:19:19 | 000,000,921 | ---- | M] () -- C:\Users\Public\Desktop\ClamWin Antivirus.lnk
[2010/05/18 02:03:11 | 000,001,770 | ---- | M] () -- C:\Users\Public\Desktop\Spyware Doctor.lnk
[2010/05/18 01:48:07 | 000,000,691 | ---- | M] () -- C:\Users\Sarah\AppData\Roaming\GetValue.vbs
[2010/05/18 01:48:07 | 000,000,035 | ---- | M] () -- C:\Users\Sarah\AppData\Roaming\SetValue.bat
[2010/05/18 01:48:06 | 000,007,590 | ---- | M] () -- C:\Windows\System32\tmp.reg
[2010/05/17 23:48:26 | 000,000,258 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2010/05/17 23:42:23 | 000,059,648 | ---- | M] () -- C:\Users\Sarah\AppData\Local\syssvc.exe
[2010/05/17 23:42:23 | 000,059,648 | ---- | M] () -- C:\Users\Sarah\AppData\Local\asam.exe
[2010/05/17 17:04:21 | 000,025,180 | ---- | M] () -- C:\Users\Sarah\Documents\Roadtrip 5.16.fdr
[2010/04/29 14:03:04 | 000,058,368 | ---- | M] () -- C:\Users\Sarah\Documents\Film AU.doc
[73 C:\Users\Sarah\Documents\*.tmp files -> C:\Users\Sarah\Documents\*.tmp -> ]
[5 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Users\Sarah\Desktop\*.tmp files -> C:\Users\Sarah\Desktop\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/05/18 02:19:19 | 000,000,921 | ---- | C] () -- C:\Users\Public\Desktop\ClamWin Antivirus.lnk
[2010/05/18 02:03:34 | 001,152,444 | ---- | C] () -- C:\Windows\UDB.zip
[2010/05/18 02:03:34 | 000,767,952 | ---- | C] () -- C:\Windows\BDTSupport.dll
[2010/05/18 02:03:34 | 000,000,882 | ---- | C] () -- C:\Windows\RegSDImport.xml
[2010/05/18 02:03:34 | 000,000,880 | ---- | C] () -- C:\Windows\RegISSImport.xml
[2010/05/18 02:03:34 | 000,000,131 | ---- | C] () -- C:\Windows\IDB.zip
[2010/05/18 02:03:16 | 000,007,387 | ---- | C] () -- C:\Windows\System32\drivers\pctgntdi.cat
[2010/05/18 02:03:12 | 000,007,412 | ---- | C] () -- C:\Windows\System32\drivers\PCTAppEvent.cat
[2010/05/18 02:03:12 | 000,007,383 | ---- | C] () -- C:\Windows\System32\drivers\pctcore.cat
[2010/05/18 02:03:11 | 000,001,770 | ---- | C] () -- C:\Users\Public\Desktop\Spyware Doctor.lnk
[2010/05/18 02:03:08 | 000,007,383 | ---- | C] () -- C:\Windows\System32\drivers\pctplsg.cat
[2010/05/18 01:48:07 | 000,000,691 | ---- | C] () -- C:\Users\Sarah\AppData\Roaming\GetValue.vbs
[2010/05/18 01:48:07 | 000,000,035 | ---- | C] () -- C:\Users\Sarah\AppData\Roaming\SetValue.bat
[2010/05/18 01:46:33 | 000,007,590 | ---- | C] () -- C:\Windows\System32\tmp.reg
[2010/05/18 01:13:53 | 000,075,776 | ---- | C] () -- C:\Windows\System32\WS2Fix.exe
[2010/05/18 01:13:52 | 000,051,200 | ---- | C] () -- C:\Windows\System32\dumphive.exe
[2010/05/18 01:13:52 | 000,040,960 | ---- | C] () -- C:\Windows\System32\swsc.exe
[2010/05/17 23:48:26 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010/05/17 23:43:23 | 000,059,648 | ---- | C] () -- C:\Users\Sarah\AppData\Local\asam.exe
[2010/05/17 23:42:22 | 000,059,648 | ---- | C] () -- C:\Users\Sarah\AppData\Local\syssvc.exe
[2010/05/17 16:46:32 | 000,025,180 | ---- | C] () -- C:\Users\Sarah\Documents\Roadtrip 5.16.fdr
[2009/01/21 15:19:28 | 000,000,014 | ---- | C] () -- C:\Windows\System32\systeminfo.dll
[2008/10/07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll
[2008/10/07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2008/03/31 14:25:46 | 000,831,488 | ---- | C] () -- C:\Windows\System32\divx_xx0a.dll
[2008/03/21 13:30:08 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008/03/21 13:28:54 | 000,000,416 | ---- | C] () -- C:\Windows\System32\dtu100.dll.manifest
[2008/03/21 13:28:54 | 000,000,416 | ---- | C] () -- C:\Windows\System32\dpl100.dll.manifest
[2008/03/21 13:28:20 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll
[2008/02/23 10:28:43 | 000,040,960 | ---- | C] () -- C:\Windows\System32\IPPCPUID.DLL
[2008/02/23 10:23:05 | 000,011,776 | ---- | C] () -- C:\Windows\System32\pmsbfn32.dll
[2008/02/23 09:58:50 | 000,000,416 | ---- | C] () -- C:\Windows\MAXLINK.INI
[2007/11/24 15:01:56 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2007/05/24 09:47:37 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI
[2007/05/23 18:00:18 | 000,204,800 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll
[2007/05/23 18:00:18 | 000,200,704 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll
[2007/05/23 18:00:18 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll
[2007/05/23 18:00:18 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll
[2007/05/23 18:00:18 | 000,188,416 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll
[2007/05/23 18:00:18 | 000,020,480 | ---- | C] () -- C:\Windows\System32\IVIresize.dll
[2007/05/23 17:37:03 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini
[2007/05/23 17:37:03 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll
[2007/05/23 17:37:03 | 000,010,150 | ---- | C] () -- C:\Windows\System32\tosmreg.ini
[2007/05/23 17:37:03 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini
[2006/11/28 22:12:18 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1132.dll
[2006/11/28 20:14:48 | 000,053,248 | ---- | C] () -- C:\Windows\System32\oemdspif.dll
[2006/11/28 20:12:28 | 000,077,824 | ---- | C] () -- C:\Windows\System32\hccutils.dll
[2006/11/24 07:48:44 | 000,036,864 | ---- | C] () -- C:\Windows\System32\HWS_Ctrl.dll
[2006/11/02 03:25:21 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2006/11/02 00:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/10/31 17:37:00 | 000,114,688 | ---- | C] () -- C:\Windows\System32\TosBtAcc.dll
[2006/08/10 15:00:52 | 000,094,208 | ---- | C] () -- C:\Windows\System32\TosBtHcrpAPI.dll
[2006/03/09 10:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2005/11/23 14:55:42 | 000,024,576 | ---- | C] () -- C:\Windows\System32\SPCtl.dll
[2005/07/22 21:30:20 | 000,065,536 | ---- | C] () -- C:\Windows\System32\TosCommAPI.dll
[1999/01/22 11:46:58 | 000,065,536 | ---- | C] () -- C:\Windows\System32\MSRTEDIT.DLL

========== Custom Scans ==========


< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[5 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

< %systemroot%\system32\*.exe /lockedfiles >
[5 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2007/05/23 17:55:52 | 006,045,696 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2007/05/23 17:55:50 | 000,098,304 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2007/05/23 17:55:53 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2007/05/23 17:56:03 | 014,671,872 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2007/05/23 17:56:06 | 005,906,432 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %systemroot%\system32\*.sys >
[2006/11/02 00:09:42 | 000,009,029 | ---- | M] () -- C:\Windows\System32\ANSI.SYS
[2007/02/28 18:04:58 | 000,694,784 | ---- | M] (Atheros Communications, Inc.) -- C:\Windows\System32\athr.sys
[2008/01/19 00:42:58 | 000,247,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\clfs.sys
[2006/11/02 00:09:45 | 000,027,097 | ---- | M] () -- C:\Windows\System32\country.sys
[2006/11/02 00:09:41 | 000,004,768 | ---- | M] () -- C:\Windows\System32\HIMEM.SYS
[2006/11/02 00:09:44 | 000,042,809 | ---- | M] () -- C:\Windows\System32\KEY01.SYS
[2006/11/02 00:09:44 | 000,042,537 | ---- | M] () -- C:\Windows\System32\KEYBOARD.SYS
[2006/11/02 00:09:29 | 000,027,866 | ---- | M] () -- C:\Windows\System32\NTDOS.SYS
[2006/11/02 00:09:35 | 000,029,146 | ---- | M] () -- C:\Windows\System32\NTDOS404.SYS
[2006/11/02 00:09:38 | 000,029,370 | ---- | M] () -- C:\Windows\System32\NTDOS411.SYS
[2006/11/02 00:09:40 | 000,029,274 | ---- | M] () -- C:\Windows\System32\NTDOS412.SYS
[2006/11/02 00:09:31 | 000,029,146 | ---- | M] () -- C:\Windows\System32\NTDOS804.SYS
[2006/11/02 00:09:20 | 000,033,952 | ---- | M] () -- C:\Windows\System32\NTIO.SYS
[2006/11/02 00:09:23 | 000,034,672 | ---- | M] () -- C:\Windows\System32\NTIO404.SYS
[2006/11/02 00:09:24 | 000,035,776 | ---- | M] () -- C:\Windows\System32\NTIO411.SYS
[2006/11/02 00:09:26 | 000,035,536 | ---- | M] () -- C:\Windows\System32\NTIO412.SYS
[2006/11/02 00:09:22 | 000,034,672 | ---- | M] () -- C:\Windows\System32\NTIO804.SYS
[2008/09/17 19:16:28 | 002,032,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[5 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

< %systemroot%\system32\drivers\*.dll >

< %systemroot%\system32\drivers\*.ini >

< %systemroot%\system32\drivers\*.exe >

< %SYSTEMDRIVE%\*.* >
[2006/09/18 14:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2008/01/19 00:45:45 | 000,333,203 | RHS- | M] () -- C:\bootmgr
[2007/05/23 17:56:08 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2006/09/18 14:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1028.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1031.txt
[2007/11/07 08:00:40 | 000,010,134 | ---- | M] () -- C:\eula.1033.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1036.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1040.txt
[2007/11/07 08:00:40 | 000,000,118 | ---- | M] () -- C:\eula.1041.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1042.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.2052.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.3082.txt
[2007/11/07 08:00:40 | 000,001,110 | ---- | M] () -- C:\globdata.ini
[2007/11/07 08:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe
[2007/11/07 08:00:40 | 000,000,843 | ---- | M] () -- C:\install.ini
[2007/11/07 08:03:18 | 000,076,304 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll
[2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll
[2007/11/07 08:03:18 | 000,091,152 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll
[2007/11/07 08:03:18 | 000,097,296 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll
[2007/11/07 08:03:18 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll
[2007/11/07 08:03:18 | 000,081,424 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll
[2007/11/07 08:03:18 | 000,079,888 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll
[2007/11/07 08:03:18 | 000,075,792 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll
[2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll
[2008/02/23 10:27:39 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2008/02/23 10:27:39 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2010/05/18 15:56:56 | 2450,919,424 | -HS- | M] () -- C:\pagefile.sys
[2010/05/18 01:49:02 | 000,003,785 | ---- | M] () -- C:\rapport.txt
[2010/05/18 15:39:18 | 000,001,601 | ---- | M] () -- C:\removlog.txt
[2010/05/18 05:12:08 | 000,001,789 | ---- | M] () -- C:\scanlog.txt
[2010/05/18 11:02:47 | 000,001,793 | ---- | M] () -- C:\scanlog1.txt
[2010/05/18 13:17:35 | 000,001,793 | ---- | M] () -- C:\scanlog2.txt
[2009/01/13 11:36:33 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
[2009/01/19 16:36:08 | 000,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
[2009/01/20 04:10:38 | 000,000,268 | -H-- | M] () -- C:\sqmdata02.sqm
[2009/02/05 15:42:53 | 000,000,268 | -H-- | M] () -- C:\sqmdata03.sqm
[2009/04/16 14:02:18 | 000,000,268 | -H-- | M] () -- C:\sqmdata04.sqm
[2009/04/21 15:59:41 | 000,000,268 | -H-- | M] () -- C:\sqmdata05.sqm
[2009/04/27 14:25:40 | 000,000,268 | -H-- | M] () -- C:\sqmdata06.sqm
[2009/05/08 15:25:27 | 000,000,268 | -H-- | M] () -- C:\sqmdata07.sqm
[2009/06/23 19:09:39 | 000,000,268 | -H-- | M] () -- C:\sqmdata08.sqm
[2009/07/14 13:56:09 | 000,000,268 | -H-- | M] () -- C:\sqmdata09.sqm
[2009/07/18 09:34:36 | 000,000,268 | -H-- | M] () -- C:\sqmdata10.sqm
[2009/07/18 12:55:54 | 000,000,268 | -H-- | M] () -- C:\sqmdata11.sqm
[2009/12/24 21:21:59 | 000,000,268 | -H-- | M] () -- C:\sqmdata12.sqm
[2009/01/13 11:36:33 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
[2009/01/19 16:36:08 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
[2009/01/20 04:10:38 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt02.sqm
[2009/02/05 15:42:52 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt03.sqm
[2009/04/16 14:02:18 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt04.sqm
[2009/04/21 15:59:41 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt05.sqm
[2009/04/27 14:25:40 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt06.sqm
[2009/05/08 15:25:27 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt07.sqm
[2009/06/23 19:09:39 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt08.sqm
[2009/07/14 13:56:09 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt09.sqm
[2009/07/18 09:34:35 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt10.sqm
[2009/07/18 12:55:54 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt11.sqm
[2009/12/24 21:21:58 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt12.sqm
[2007/11/07 08:00:40 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp
[2007/11/07 08:09:22 | 001,442,522 | ---- | M] () -- C:\VC_RED.cab
[2007/11/07 08:12:28 | 000,232,960 | ---- | M] () -- C:\VC_RED.MSI
[1 C:\*.tmp files -> C:\*.tmp -> ]

< %PROGRAMFILES%\*. >
[2010/03/10 11:05:36 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2010/04/11 20:27:20 | 000,000,000 | ---D | M] -- C:\Program Files\AGEIA Technologies
[2009/02/05 15:41:07 | 000,000,000 | ---D | M] -- C:\Program Files\Alwil Software
[2008/09/24 22:24:15 | 000,000,000 | ---D | M] -- C:\Program Files\Apple Software Update
[2007/10/23 21:54:47 | 000,000,000 | ---D | M] -- C:\Program Files\Atheros
[2009/01/13 02:05:38 | 000,000,000 | ---D | M] -- C:\Program Files\Azureus
[2009/01/14 01:28:11 | 000,000,000 | ---D | M] -- C:\Program Files\Bonjour
[2008/02/23 09:51:23 | 000,000,000 | ---D | M] -- C:\Program Files\Canon
[2008/01/17 22:06:44 | 000,000,000 | -H-D | M] -- C:\Program Files\CanonBJ
[2009/10/01 12:02:09 | 000,000,000 | ---D | M] -- C:\Program Files\Celtx
[2010/05/18 02:18:59 | 000,000,000 | ---D | M] -- C:\Program Files\ClamWin
[2010/05/18 02:03:02 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2009/01/30 22:04:04 | 000,000,000 | ---D | M] -- C:\Program Files\coolplay
[2007/05/23 18:16:58 | 000,000,000 | ---D | M] -- C:\Program Files\DesktopDialer
[2008/04/13 17:48:18 | 000,000,000 | ---D | M] -- C:\Program Files\DivX
[2008/12/25 11:38:10 | 000,000,000 | ---D | M] -- C:\Program Files\EA GAMES
[2007/11/24 14:28:07 | 000,000,000 | ---D | M] -- C:\Program Files\Final Draft 7
[2007/11/24 14:28:01 | 000,000,000 | ---D | M] -- C:\Program Files\Final Draft Tagger
[2009/12/04 17:08:37 | 000,000,000 | ---D | M] -- C:\Program Files\Firaxis Games
[2008/05/07 18:55:37 | 000,000,000 | ---D | M] -- C:\Program Files\Free iPod Video Converter
[2010/03/09 22:28:04 | 000,000,000 | ---D | M] -- C:\Program Files\Google
[2009/01/30 22:05:54 | 000,000,000 | ---D | M] -- C:\Program Files\HDTVPlayer
[2009/04/13 16:27:29 | 000,000,000 | ---D | M] -- C:\Program Files\Hewlett-Packard
[2009/08/18 15:06:05 | 000,000,000 | ---D | M] -- C:\Program Files\HP
[2007/05/23 18:13:06 | 000,000,000 | ---D | M] -- C:\Program Files\illiminable
[2009/12/04 17:09:07 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2009/01/19 16:56:12 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2007/05/23 18:04:40 | 000,000,000 | ---D | M] -- C:\Program Files\InterVideo
[2009/11/09 19:55:00 | 000,000,000 | ---D | M] -- C:\Program Files\iPod
[2009/11/09 20:07:42 | 000,000,000 | ---D | M] -- C:\Program Files\iTunes
[2007/05/23 18:11:26 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2008/12/02 17:06:23 | 000,000,000 | ---D | M] -- C:\Program Files\Lavasoft
[2007/05/23 17:37:03 | 000,000,000 | ---D | M] -- C:\Program Files\ltmoh
[2008/02/22 13:39:33 | 000,000,000 | ---D | M] -- C:\Program Files\Memorex exPressit Label Design Studio
[2009/12/25 15:47:13 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft
[2008/02/24 04:04:54 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2006/11/02 05:35:51 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Games
[2008/01/24 19:47:44 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
[2008/09/13 00:01:45 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Works
[2009/01/19 16:56:13 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2010/05/18 16:02:13 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2006/11/02 05:35:51 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
[2007/05/23 17:13:31 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 4.0
[2007/05/23 17:53:24 | 000,000,000 | ---D | M] -- C:\Program Files\My Company Name
[2008/02/23 10:20:25 | 000,000,000 | ---D | M] -- C:\Program Files\NewSoft
[2009/04/09 09:29:20 | 000,000,000 | ---D | M] -- C:\Program Files\Picasa2
[2009/11/09 16:58:30 | 000,000,000 | ---D | M] -- C:\Program Files\QuickTime
[2007/05/23 17:34:01 | 000,000,000 | ---D | M] -- C:\Program Files\Realtek
[2006/11/02 05:35:51 | 000,000,000 | ---D | M] -- C:\Program Files\Reference Assemblies
[2008/02/23 09:56:07 | 000,000,000 | ---D | M] -- C:\Program Files\ScanSoft
[2010/04/23 23:56:55 | 000,000,000 | ---D | M] -- C:\Program Files\Semagic
[2007/12/19 11:32:39 | 000,000,000 | ---D | M] -- C:\Program Files\SiteAdvisor
[2008/12/06 17:47:13 | 000,000,000 | ---D | M] -- C:\Program Files\Spybot - Search & Destroy
[2010/05/18 15:43:52 | 000,000,000 | ---D | M] -- C:\Program Files\Spyware Doctor
[2007/10/23 21:57:38 | 000,000,000 | ---D | M] -- C:\Program Files\Synaptics
[2007/05/23 18:29:57 | 000,000,000 | ---D | M] -- C:\Program Files\Toshiba
[2007/05/23 18:28:10 | 000,000,000 | ---D | M] -- C:\Program Files\Toshiba America Information Systems
[2010/05/15 21:12:52 | 000,000,000 | ---D | M] -- C:\Program Files\TOSHIBA Games
[2007/05/23 18:28:51 | 000,000,000 | ---D | M] -- C:\Program Files\Toshiba Registration
[2009/01/19 16:35:40 | 000,000,000 | ---D | M] -- C:\Program Files\Trillian
[2007/05/23 17:57:12 | 000,000,000 | ---D | M] -- C:\Program Files\Ulead Systems
[2006/11/02 05:58:18 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
[2008/02/15 00:00:54 | 000,000,000 | ---D | M] -- C:\Program Files\uTorrent
[2010/03/09 22:31:16 | 000,000,000 | ---D | M] -- C:\Program Files\Virtual Villagers - The Lost Children
[2010/04/03 20:32:08 | 000,000,000 | ---D | M] -- C:\Program Files\WildGames
[2009/01/19 16:56:14 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Calendar
[2009/01/19 16:56:11 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Collaboration
[2009/01/19 16:56:07 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Defender
[2009/12/25 15:46:14 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live
[2009/12/25 15:46:41 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live SkyDrive
[2009/01/19 16:56:14 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Mail
[2009/01/19 16:56:12 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2006/11/02 05:35:51 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2009/01/19 16:56:11 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Photo Gallery
[2009/01/19 16:56:13 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Sidebar
[2008/06/07 13:42:23 | 000,000,000 | ---D | M] -- C:\Program Files\WinRAR
[2010/03/09 22:32:54 | 000,000,000 | ---D | M] -- C:\Program Files\Yahoo!

< %appdata%\*.* >
[2010/05/18 01:48:07 | 000,000,691 | ---- | M] () -- C:\Users\Sarah\AppData\Roaming\GetValue.vbs
[2010/05/18 01:48:07 | 000,000,035 | ---- | M] () -- C:\Users\Sarah\AppData\Roaming\SetValue.bat
[2007/11/23 13:16:08 | 000,000,000 | ---- | M] () -- C:\Users\Sarah\AppData\Roaming\wklnhst.dat


< MD5 for: AGP440.SYS >
[2008/01/19 00:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008/01/19 00:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2006/11/02 02:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006/11/02 02:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/01/19 00:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys
[2008/01/19 00:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008/01/19 00:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/02 02:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008/02/14 04:10:02 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008/02/14 04:10:02 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008/02/14 04:10:02 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 02:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006/11/02 02:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: DISK.SYS >
[2008/01/19 00:42:20 | 000,055,352 | ---- | M] (Microsoft Corporation) MD5=64109E623ABD6955C8FB110B592E68B7 -- C:\Windows\System32\drivers\disk.sys
[2008/01/19 00:42:20 | 000,055,352 | ---- | M] (Microsoft Corporation) MD5=64109E623ABD6955C8FB110B592E68B7 -- C:\Windows\System32\DriverStore\FileRepository\disk.inf_90722180\disk.sys
[2008/01/19 00:42:20 | 000,055,352 | ---- | M] (Microsoft Corporation) MD5=64109E623ABD6955C8FB110B592E68B7 -- C:\Windows\winsxs\x86_disk.inf_31bf3856ad364e35_6.0.6001.18000_none_f9c681e4742c835a\disk.sys
[2006/11/02 02:49:51 | 000,052,840 | ---- | M] (Microsoft Corporation) MD5=841AF4C4D41D3E3B2F244E976B0F7963 -- C:\Windows\System32\DriverStore\FileRepository\disk.inf_e0b0b355\disk.sys

< MD5 for: IASTORV.SYS >
[2008/01/19 00:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008/01/19 00:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006/11/02 02:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006/11/02 02:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: KR10N.SYS >
[2006/11/09 14:31:46 | 000,211,072 | ---- | M] (TOSHIBA CORPORATION) MD5=6A4ADB9186DD0E114E623DAF57E42B31 -- C:\Windows\System32\drivers\KR10N.sys
[2006/11/09 14:31:46 | 000,211,072 | R--- | M] (TOSHIBA CORPORATION) MD5=6A4ADB9186DD0E114E623DAF57E42B31 -- C:\Windows\System32\DriverStore\FileRepository\kr10.inf_c681c175\KR10N.sys
[2005/09/27 16:57:38 | 000,207,104 | ---- | M] (TOSHIBA CORPORATION) MD5=A1963360E74931222A67356C8AD48378 -- C:\Windows\System32\DriverStore\FileRepository\kr10n.inf_f8c77270\KR10N.sys

< MD5 for: NETLOGON.DLL >
[2006/11/02 02:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2008/01/19 00:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll
[2008/01/19 00:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2006/11/02 02:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006/11/02 02:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008/01/19 00:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008/01/19 00:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: SCECLI.DLL >
[2008/01/19 00:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll
[2008/01/19 00:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006/11/02 02:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

< MD5 for: USBSTOR.SYS >
[2007/11/24 11:06:09 | 000,055,296 | ---- | M] (Microsoft Corporation) MD5=7887CE56934E7F104E98C975F47353C5 -- C:\Windows\System32\DriverStore\FileRepository\usbstor.inf_8416e98e\USBSTOR.SYS
[2007/11/24 11:06:09 | 000,055,296 | ---- | M] (Microsoft Corporation) MD5=7887CE56934E7F104E98C975F47353C5 -- C:\Windows\winsxs\x86_usbstor.inf_31bf3856ad364e35_6.0.6000.16478_none_465c5f209ade1e53\USBSTOR.SYS
[2007/11/24 11:06:09 | 000,055,296 | ---- | M] (Microsoft Corporation) MD5=7DA1833F2B2500C755AB6C81C5ABFC88 -- C:\Windows\winsxs\x86_usbstor.inf_31bf3856ad364e35_6.0.6000.20588_none_46db2bffb403da0e\USBSTOR.SYS
[2008/01/18 22:53:22 | 000,055,296 | ---- | M] (Microsoft Corporation) MD5=87BA6B83C5D19B69160968D07D6E2982 -- C:\Windows\System32\drivers\USBSTOR.SYS
[2008/01/18 22:53:22 | 000,055,296 | ---- | M] (Microsoft Corporation) MD5=87BA6B83C5D19B69160968D07D6E2982 -- C:\Windows\System32\DriverStore\FileRepository\usbstor.inf_b9f18584\USBSTOR.SYS
[2008/01/18 22:53:22 | 000,055,296 | ---- | M] (Microsoft Corporation) MD5=87BA6B83C5D19B69160968D07D6E2982 -- C:\Windows\winsxs\x86_usbstor.inf_31bf3856ad364e35_6.0.6001.18000_none_48864eb697d31b43\USBSTOR.SYS
[2006/11/02 01:55:05 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=FDBAABF07244C60B0F4E0A6E71A107C6 -- C:\Windows\System32\DriverStore\FileRepository\usbstor.inf_bb2778a0\USBSTOR.SYS

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2009-01-23 07:41:38

========== Alternate Data Streams ==========

@Alternate Data Stream - 158 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:A8ADE5D8
< End of report >

Hello, and welcome to GeekPolice.

Please note the following information about the malware forum:

• Only Tech Officers, Global Moderators, Administrators, and Malware Advisors are allowed to give advice on removing malware from your computer.
  
• From this point on, please do not make any more changes to your computer; such as install/uninstall programs, use special fix tools, delete files, edit the registry, etc. - unless advised by the staff I noted above.
  
• Please do not ask for help elsewhere (in this site or other sites). Doing so can result in system changes, which may not show up in the logs you post.
  
• If you have already asked for help somewhere, please post the link to the topic you were helped.
  
• We try our best to reply quickly, but for any reason we do not reply in two days, do one of two things:
  
  Reply to this topic with the word BUMP, or
  see this topic.
  
  
• Lastly, keep in mind that we are volunteers, so you do not have to pay for malware removal. Persist in this topic until its close, and your computer is declared clean.

---

Please run OTL

• Under the Custom Scans/Fixes box at the bottom, copy and paste in the following:
  
  :otl
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555
  O4 - HKCU..\Run: [asam] C:\Users\Sarah\AppData\Local\asam.exe ()
  O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
  [2010/05/17 23:24:15 | 000,000,000 | ---D | C] -- C:\Users\Sarah\AppData\Local\bnqmxbwgg
  @Alternate Data Stream - 158 bytes -> C:\ProgramData\TEMP:DFC5A2B2
  @Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:A8ADE5D8
  
  :commands
  [purity]
  [emptytemp]
  [reboot]
  
  
• Then click the Run Fix button at the top.
  
• Note: The fix for OTL automatically hides your Desktop and Start menu so the fix can be completed. Do not be alerted, this is normal.
  
• Please do not exit the program. It might take a while to fix, but allow it to run. If it asks to reboot the computer, allow it to reboot. If the program freezes, and the computer fails to reboot - let me know.
  Lastly, post the contents of the log. (Located at C:\_OTL\Moved Files)

================================

Please visit this webpage for a tutorial on downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

See the area: Using ComboFix, and when done, post the log back here.

OTL Log. ComboFix log coming right up! Thanks again!

All processes killed
========== OTL ==========
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\asam deleted successfully.
C:\Users\Sarah\AppData\Local\asam.exe moved successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\GD\\http deleted successfully.
C:\Users\Sarah\AppData\Local\bnqmxbwgg folder moved successfully.
ADS C:\ProgramData\TEMP:DFC5A2B2 deleted successfully.
ADS C:\ProgramData\TEMP:A8ADE5D8 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 41 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: Sarah
->Temp folder emptied: 11219483 bytes
->Temporary Internet Files folder emptied: 43918401 bytes
->Java cache emptied: 76613291 bytes
->FireFox cache emptied: 50446742 bytes
->Apple Safari cache emptied: 65271295 bytes
->Flash cache emptied: 127241 bytes

%systemdrive% .tmp files removed: 56096 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 527360 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 250968502 bytes
RecycleBin emptied: 268001001 bytes

Total Files Cleaned = 732.00 mb


OTL by OldTimer - Version 3.2.4.1 log created on 05192010_000100

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

ComboFix 10-05-17.03 - Sarah 05/19/2010 0:28.1.1 - x86
Microsoft Windows Vista Home Basic 6.0.6001.1.1252.1.1033.18.2037.1235 [GMT -7:00]
Running from: c:\users\Sarah\Desktop\ComboFix.exe
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\install.exe
c:\program files\coolplay
c:\program files\coolplay\Uninstall.exe
c:\users\Sarah\AppData\Local\syssvc.exe
c:\windows\system32\404Fix.exe
c:\windows\system32\AbaleZip.dll
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\Thumbs.db
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_GAOPDXSERV.SYS
-------\Service_gaopdxserv.sys


((((((((((((((((((((((((( Files Created from 2010-04-19 to 2010-05-19 )))))))))))))))))))))))))))))))
.

2010-05-19 07:44 . 2010-05-19 07:50 -------- d-----w- c:\users\Sarah\AppData\Local\temp
2010-05-19 07:44 . 2010-05-19 07:44 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-05-19 07:01 . 2010-05-19 07:01 -------- d-----w- C:\_OTL
2010-05-18 09:49 . 2010-05-18 09:50 -------- d-----w- C:\SAV32CLI
2010-05-18 09:19 . 2010-05-18 09:20 -------- d-----w- c:\users\Sarah\AppData\Roaming\.clamwin
2010-05-18 09:18 . 2010-05-18 09:18 -------- d-----w- c:\program files\ClamWin
2010-05-18 09:18 . 2010-05-18 09:18 -------- d-----w- c:\programdata\.clamwin
2010-05-18 09:00 . 2010-05-18 09:00 -------- d-----w- C:\Temp
2010-05-15 02:49 . 2010-05-15 02:49 -------- d-----w- c:\users\Sarah\AppData\Roaming\Aveyond 3
2010-05-13 23:13 . 2010-05-13 23:13 -------- d-----w- c:\users\Sarah\AppData\Roaming\freshgames
2010-05-13 20:27 . 2010-05-13 20:27 -------- d-----w- c:\users\Sarah\AppData\Roaming\Happyville__
2010-05-11 06:55 . 2010-05-11 06:55 -------- d-----w- c:\users\Sarah\AppData\Roaming\Geneforge 3 Saved Games
2010-05-11 06:55 . 2010-05-11 06:55 -------- d-----w- c:\windows\Sun
2010-05-06 06:17 . 2010-05-06 06:17 -------- d-----w- c:\users\Sarah\AppData\Roaming\runic games
2010-05-03 23:00 . 2010-05-03 23:00 -------- d-----w- c:\programdata\Awem
2010-04-29 05:28 . 2010-04-29 05:38 -------- d-----w- c:\users\Sarah\AppData\Roaming\Hoyle Casino
2010-04-29 01:15 . 2010-04-29 01:15 -------- d-----w- c:\users\Sarah\AppData\Roaming\GameInvest
2010-04-28 23:09 . 2010-04-29 06:31 -------- d-----w- c:\programdata\Fashion Solitaire 1.2

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-19 07:23 . 2009-04-09 15:23 -------- d-----w- c:\programdata\Google Updater
2010-05-18 22:43 . 2010-05-18 09:03 -------- d-----w- c:\program files\Spyware Doctor
2010-05-18 09:03 . 2010-05-18 09:03 -------- d-----w- c:\program files\Common Files\PC Tools
2010-05-18 09:03 . 2010-05-18 09:03 -------- d-----w- c:\users\Sarah\AppData\Roaming\PC Tools
2010-05-18 09:03 . 2010-05-18 09:03 -------- d-----w- c:\programdata\PC Tools
2010-05-18 08:48 . 2010-05-18 08:48 691 ----a-w- c:\users\Sarah\AppData\Roaming\GetValue.vbs
2010-05-18 08:48 . 2010-05-18 08:48 35 ----a-w- c:\users\Sarah\AppData\Roaming\SetValue.bat
2010-05-18 07:55 . 2007-11-24 00:21 -------- d-----w- c:\users\Sarah\AppData\Roaming\SiteAdvisor
2010-05-17 02:59 . 2007-05-24 01:20 -------- d-----w- c:\programdata\WildTangent
2010-05-16 04:12 . 2007-05-24 01:20 -------- d-----w- c:\program files\TOSHIBA Games
2010-05-13 23:13 . 2008-09-13 06:44 -------- d-----w- c:\programdata\FreshGames
2010-05-01 18:26 . 2008-05-22 04:58 -------- d-----w- c:\users\Sarah\AppData\Roaming\iWin
2010-04-30 00:37 . 2008-09-16 22:42 -------- d-----w- c:\users\Sarah\AppData\Roaming\Gamelab
2010-04-24 06:56 . 2007-11-27 09:13 -------- d-----w- c:\program files\Semagic
2010-04-19 04:22 . 2010-04-19 03:48 -------- d-----w- c:\users\Sarah\AppData\Roaming\Hoyle Card Games
2010-04-19 03:48 . 2010-04-19 03:48 -------- d-----w- c:\users\Sarah\AppData\Roaming\Hoyle FaceCreator
2010-04-19 03:27 . 2010-04-19 03:27 -------- d-----w- c:\users\Sarah\AppData\Roaming\funkitron
2010-04-18 01:15 . 2010-04-18 01:15 -------- d-----w- c:\programdata\Playtonium Games
2010-04-14 07:42 . 2010-04-14 07:42 -------- d-----w- c:\programdata\Nevosoft
2010-04-12 03:27 . 2010-04-12 03:26 -------- d-----w- c:\program files\AGEIA Technologies
2010-04-12 03:26 . 2007-11-24 21:25 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-04-09 05:35 . 2010-04-09 05:35 -------- d-----w- c:\users\Sarah\AppData\Roaming\UNOUndercover
2010-04-07 05:42 . 2010-04-07 05:42 -------- d-----w- c:\users\Sarah\AppData\Roaming\ShinyTales
2010-04-05 05:25 . 2010-04-05 05:25 -------- d-----w- c:\users\Sarah\AppData\Roaming\Skip-Bo
2010-04-04 03:38 . 2010-04-04 03:37 -------- d-----w- c:\users\Sarah\AppData\Roaming\Settlement. Colossus
2010-04-04 03:32 . 2008-12-03 09:38 -------- d-----w- c:\program files\WildGames
2010-04-01 04:44 . 2008-12-04 08:54 -------- d-----w- c:\programdata\Arcade Lab
2010-04-01 02:30 . 2010-04-01 02:30 -------- d-----w- c:\programdata\GAMEON
2010-04-01 01:05 . 2010-04-01 01:05 -------- d-----w- c:\programdata\EdensQuest
2010-04-01 00:28 . 2007-11-23 19:54 -------- d-----w- c:\users\Sarah\AppData\Roaming\PlayFirst
2010-04-01 00:28 . 2007-11-23 19:54 -------- d-----w- c:\programdata\PlayFirst
2010-03-30 09:30 . 2008-06-19 01:55 -------- d-----w- c:\programdata\Sandlot Games
2010-03-28 08:15 . 2010-03-28 08:15 -------- d-----w- c:\users\Sarah\AppData\Roaming\Flood Light Games
2010-03-28 08:15 . 2010-03-28 08:15 -------- d-----w- c:\programdata\Flood Light Games
2010-03-28 05:53 . 2010-03-28 05:53 -------- d-----w- c:\users\Sarah\AppData\Roaming\BlamGames
2010-03-21 16:02 . 2010-03-21 16:02 -------- d-----w- c:\users\Sarah\AppData\Roaming\Go-Go Gourmet Chef of the Year
2010-03-21 06:18 . 2007-11-29 19:38 -------- d-----w- c:\programdata\HipSoft
2010-03-11 01:18 . 2007-11-23 19:47 101664 ----a-w- c:\users\Sarah\AppData\Local\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2006-11-10 417792]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-27 3883856]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-09 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-29 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-29 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-11-29 81920]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 815104]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2006-11-09 3784704]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2005-12-16 188416]
"NDSTray.exe"="c:\program files\Toshiba\ConfigFree\NDSTray.exe" [2006-11-15 1372160]
"HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2006-11-01 413696]
"SVPWUTIL"="c:\program files\TOSHIBA\Utilities\SVPWUTIL.exe" [2006-01-18 421888]
"KeNotify"="c:\program files\TOSHIBA\Utilities\KeNotify.exe" [2006-11-07 34352]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-20 411768]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2006-12-07 55416]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2006-12-12 448632]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2006-12-15 530552]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-05-24 1862144]
"SiteAdvisor"="c:\program files\SiteAdvisor\6253\SiteAdv.exe" [2006-10-18 35928]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-04-04 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]
"ClamWin"="c:\program files\ClamWin\bin\ClamTray.exe" [2010-04-14 86016]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-10-16 214360]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

R2 gupdate1c9b927b0f919e0;Google Update Service (gupdate1c9b927b0f919e0);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-09 133104]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-09-23 207280]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-11-24 20560]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2009-11-24 53328]
S2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [2009-11-10 112592]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2007-09-01 600912]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2010-05-19 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-05-24 15:22]

2010-05-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-09 15:26]

2010-05-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-09 15:26]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride =
IE: Copy to Semagic - c:\program files\Semagic\copy.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Semagic - c:\program files\Semagic\link.htm
LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
FF - ProfilePath - c:\users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\aahbglie.default\
FF - component: c:\program files\SiteAdvisor\6253\FF\components\FFHook.dll
FF - component: c:\users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\aahbglie.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: c:\users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\aahbglie.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava11.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava12.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava13.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava14.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava32.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npoji610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Picasa2\npPicasa2.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-uaadvukc - c:\users\Sarah\AppData\Local\bnqmxbwgg\bewaryxtssd.exe
AddRemove-WT022085 - c:\program files\TOSHIBA Games\Blackhawk Striker 2\Uninstall.exe
AddRemove-WT022086 - c:\program files\TOSHIBA Games\Blasterball 3\Uninstall.exe
AddRemove-WT022090 - c:\program files\TOSHIBA Games\Mah Jong Quest\Uninstall.exe
AddRemove-WT022091 - c:\program files\TOSHIBA Games\Penguins!\Uninstall.exe
AddRemove-WT022092 - c:\program files\TOSHIBA Games\Polar Bowler\Uninstall.exe
AddRemove-WT022093 - c:\program files\TOSHIBA Games\Polar Golfer\Uninstall.exe
AddRemove-WT022571 - c:\program files\TOSHIBA Games\The Apprentice\Uninstall.exe
AddRemove-WT022768 - c:\program files\TOSHIBA Games\Cactus Bruce and The Corporate Monkeys\Uninstall.exe
AddRemove-WT022828 - c:\program files\TOSHIBA Games\Cinema Tycoon\Uninstall.exe
AddRemove-WT022900 - c:\program files\TOSHIBA Games\Cute Knight\Uninstall.exe
AddRemove-WT023117 - c:\program files\TOSHIBA Games\Defender of the Crown - Heroes Live Forever\Uninstall.exe
AddRemove-WT024297 - c:\program files\TOSHIBA Games\Subway Scramble\Uninstall.exe
AddRemove-WT024357 - c:\program files\TOSHIBA Games\Teddy Factory\Uninstall.exe
AddRemove-WT025551 - c:\program files\TOSHIBA Games\Deep Sea Tycoon\Uninstall.exe
AddRemove-WT028721 - c:\program files\TOSHIBA Games\Age of Castles\Uninstall.exe
AddRemove-WT029353 - c:\program files\TOSHIBA Games\Bass Tournament Tycoon\Uninstall.exe
AddRemove-WT030401 - c:\program files\TOSHIBA Games\Gold Miner Vegas\Uninstall.exe
AddRemove-WT030835 - c:\program files\TOSHIBA Games\Lemonade Tycoon 2\Uninstall.exe
AddRemove-WT031756 - c:\program files\TOSHIBA Games\Roller Rush\Uninstall.exe
AddRemove-WT031834 - c:\program files\TOSHIBA Games\Shopmania\Uninstall.exe
AddRemove-WT036270 - c:\program files\TOSHIBA Games\Coffee Tycoon\Uninstall.exe
AddRemove-WT046971 - c:\program files\TOSHIBA Games\Dream Day Wedding\Uninstall.exe
AddRemove-WT048263 - c:\program files\TOSHIBA Games\Princess Bride\Uninstall.exe
AddRemove-WT048651 - c:\program files\TOSHIBA Games\Supermarket Mania\Uninstall.exe
AddRemove-WT049674 - c:\program files\TOSHIBA Games\Hell's Kitchen\Uninstall.exe
AddRemove-WT052280 - c:\program files\TOSHIBA Games\Dream Day Honeymoon\Uninstall.exe
AddRemove-WT053725 - c:\program files\TOSHIBA Games\First Class Flurry\Uninstall.exe
AddRemove-WT053997 - c:\program files\TOSHIBA Games\Fitness Frenzy\Uninstall.exe
AddRemove-WT054051 - c:\program files\TOSHIBA Games\Hell's Kitchen\Uninstall.exe
AddRemove-WT054219 - c:\program files\TOSHIBA Games\Princess Bride\Uninstall.exe
AddRemove-WT054368 - c:\program files\TOSHIBA Games\Supermarket Mania\Uninstall.exe
AddRemove-WT055393 - c:\program files\TOSHIBA Games\Oval Office\Uninstall.exe
AddRemove-WT056284 - c:\program files\TOSHIBA Games\Top Chef\Uninstall.exe
AddRemove-WT056892 - c:\program files\TOSHIBA Games\Daycare Nightmare Mini-Monsters\Uninstall.exe
AddRemove-WT057228 - c:\program files\TOSHIBA Games\World of Goo\Uninstall.exe
AddRemove-WT070196 - c:\program files\TOSHIBA Games\John Deere Drive Green\Uninstall.exe
AddRemove-WT074874 - c:\program files\TOSHIBA Games\Wedding Dash - Ready
AddRemove-WT082563 - c:\program files\TOSHIBA Games\Airport Mania\Uninstall.exe
AddRemove-WT083095 - c:\program files\TOSHIBA Games\Alexandra Fortune - Mystery of the Lunar Archipelago\Uninstall.exe
AddRemove-WT083203 - c:\program files\TOSHIBA Games\Little Folk of Faery\Uninstall.exe
AddRemove-WT084462 - c:\program files\TOSHIBA Games\Petz Dogz 2\Uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-19 00:49
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i?????q??R??????^?8?^?p?^???^???

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pls\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.spx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"

[HKEY_USERS\S-1-5-21-1747305985-1338602461-395944794-1000\Software\SecuROM\License information*]
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(5688)
c:\program files\SiteAdvisor\6253\saHook.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\toshiba\IVP\ISM\pinger.exe
c:\toshiba\IVP\swupdate\swupdtmr.exe
c:\windows\system32\TODDSrv.exe
c:\program files\Toshiba\Power Saver\TosCoSrv.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\RtHDVCpl.exe
c:\program files\Synaptics\SynTP\SynToshiba.exe
c:\program files\Alwil Software\Avast4\ashDisp.exe
c:\windows\System32\spool\drivers\w32x86\3\WrtProc.exe
c:\program files\Toshiba\ConfigFree\CFSwMgr.exe
c:\windows\system32\msiexec.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
.
**************************************************************************
.
Completion time: 2010-05-19 00:59:58 - machine was rebooted
ComboFix-quarantined-files.txt 2010-05-19 07:59

Pre-Run: 5,723,971,584 bytes free
Post-Run: 5,425,266,688 bytes free

- - End Of File - - EFD93617C3CA9560AFBBF38A5683ED56

Please download Malwarebytes Anti-Malware from Malwarebytes.org.
Alternate link: BleepingComputer.com.
(Note: if you already have the program installed, just follow the directions. No need to re-download or re-install!)

Double Click mbam-setup.exe to install the application.

(Note: if you already have the program installed, open Malwarebytes from the Start Menu or Desktop shortcut, click the Update tab, and click Check for Updates, before doing the scan as instructed below!)

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Full Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. If you are prompted to restart, please allow it to restart your computer. Failure to do this, will cause the infection to still be active on the computer.
  
• Please save the log to a location you will remember.
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• The log can also be found at C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
  
• Copy and paste the entire report in your next reply.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4118

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

5/19/2010 23:19:23
mbam-log-2010-05-19 (23-19-23).txt

Scan type: Full scan (C:\|)
Objects scanned: 558823
Time elapsed: 3 hour(s), 15 minute(s), 14 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\{NSINAME} (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\aquaplay (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Users\Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\aquaplay (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Files Infected:
C:\_OTL\MovedFiles\05192010_000100\C_Users\Sarah\AppData\Local\bnqmxbwgg\bewaryxtssd.exe (Rogue.AntispywareSoft) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\coolplay\Uninstall.exe.vir (Rogue.Installer) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\aquaplay\Uninstall.lnk (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Please run a free online scan with the ESET Online Scanner

• Tick the box next to YES, I accept the Terms of Use
  
• Click Start
  
• When asked, allow the ActiveX control to install
  
• Click Start
  
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  
• Click Scan (This scan can take several hours, so please be patient)
  
• Once the scan is completed, you may close the window
  
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  
• Copy and paste that log as a reply to this topic
  

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=e8bfe62f53731a439a094288b94a6f2d
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-05-20 09:25:27
# local_time=2010-05-20 02:25:27 (-0800, Pacific Daylight Time)
# country="United States"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=769 16775165 100 98 0 209744718 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=2817 16777215 100 100 0 2242380 0 0
# compatibility_mode=5892 16776573 100 100 0 110985536 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=463368
# found=3
# cleaned=3
# scan_time=12763
C:\Program Files\TOSHIBA Games\Fashionallia\Fashion.exe probably a variant of Win32/Statik application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Qoobox\Quarantine\C\Users\Sarah\AppData\Local\syssvc.exe.vir Win32/SpamTool.Agent.NEG trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\_OTL\MovedFiles\05192010_000100\C_Users\Sarah\AppData\Local\asam.exe Win32/SpamTool.Agent.NEG trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

To manually create a new Restore Point

• Go to Control Panel and select System and Maintenance
  
• Select System
  
• On the left select Advance System Settings and accept the warning if you get one
  
• Select System Protection Tab
  
• Select Create at the bottom
  
• Type in a name i.e. Clean
  
• Select Create

Now we can purge the infected ones

• Go back to the System and Maintenance page
  
• Select Performance Information and Tools
  
• On the left select Open Disk Cleanup
  
• Select Files from all users and accept the warning if you get one
  
• In the drop down box select your main drive i.e. C
  
• For a few moments the system will make some calculations
  
• Select the More Options tab
  
• In the System Restore and Shadow Backups select Clean up
  
• Select Delete on the pop up
  
• Select OK
  
• Select Delete

You are now done

To remove all of the tools we used and the files and folders they created, please do the following:
Please download OTC.exe by OldTimer:

• Save it to your Desktop.
  
• Double click OTC.exe.
  
• Click the CleanUp! button.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes.
  

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

==

Please download TFC by OldTimer to your desktop

• Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  
• It will close all programs when run, so make sure you have saved all your work before you begin.
  
• Click the Start
  button to begin the process. Depending on how often you clean temp
  files, execution time should be anywhere from a few seconds to a minute
  or two. Let it run uninterrupted to completion.
  
• Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

==

Download Security Check by screen317 from SpywareInfoforum.org or Changelog.fr.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Thanks so much for helping me on this. The only weirdness I'm seeing now is that every time I restart something calling itself "HPPhotoExpress" (I think) keeps trying to install itself. I'll click cancel and it'll pop right back up again-- it usually takes 5-10 times to convince it to go away. If I don't click cancel right away it later insists I need a CD to complete the installation. When I click cancel, it starts the cycle up again and tries to install itself again.

Results of screen317's Security Check version 0.99.4
Windows Vista Service Pack 1 (UAC is disabled!)
Out of date service pack!!
Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Antivirus
ClamWin Free Antivirus 0.96.0.1
WMI entry may not exist for antivirus; attempting automatic update.
avast! successfully updated!
```````````````````````````````
Anti-malware/Other Utilities Check:
Ad-Aware
Malwarebytes' Anti-Malware
Java(TM) SE Runtime Environment 6
Adobe Flash Player 10.0.42.34
Adobe Reader 8.1.4
Out of date Adobe Reader installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSASCui.exe
Ad-Aware AAWService.exe
Ad-Aware AAWTray.exe is disabled!
Alwil Software Avast4 aswUpdSv.exe
Alwil Software Avast4 ashServ.exe
Alwil Software Avast4 ashDisp.exe
Alwil Software Avast4 ashMaiSv.exe
Alwil Software Avast4 ashWebSv.exe
Windows Defender MSASCui.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
  
• Copy the content of the following codebox into the main textfield:
  

  Code:

  :regfind
HPPhotoExpress
  
  
  
• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
  

Note: The log can also be found on your Desktop entitled SystemLook.txt

Sorry, I misremembered-- it was actually HPPhotoSmartEssential

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 20:05 on 20/05/2010 by Sarah (Administrator - Elevation successful)

========== regfind ==========

Searching for "HPPhotoSmartEssential"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6]
"ProductName"="HPPhotosmartEssential"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6]
"ProductName"="HPPhotosmartEssential"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6]
"ProductName"="HPPhotosmartEssential"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6]
"ProductName"="HPPhotosmartEssential"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList]
"PackageName"="HPPhotosmartEssential.msi"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList]
"PackageName"="HPPhotosmartEssential.msi"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6\SourceList\Media]
"MediaPackage"="\setup\HPPhotoSmartEssential\"

-=End Of File=-

Please download OTM

• Save it to your desktop.
  
• Please double-click OTM to run it. (Note for Vista: Right-click on the file and choose Run As Administrator).
  
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL C (or, after highlighting, right-click and choose Copy):
  
  

  :reg [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7E31197DC472B074DB64101B2091FDA6] :Commands [emptytemp] [purity] [Reboot]

  
  
• Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTM and reboot your PC.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and
open the newest .log file present, and copy/paste the contents of that document back here in your next post.