Disabled WiFi and IE Compromised

Hi,

I recently and foolishly executed a d/l file by the name of zdr.exe (I think) and it immediately compromised my IE8, I get occasional popups and also when I google something and then click on a link from within the search results it takes me to an entirely different site as to what it should have done.

Shortly afterwards my wifi kept disabling itself intermittently, it would register as having been switched off at the switch even though the switch hasn't been moved. It would then turn itself on and off repeatedly before staying on for a few minutes and then back off again for about 20 mins or so. I could find no way to manually re-activate it during this period.

Any starting points of what to do please? Thanks.

HIJACK THIS log

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:30:52, on 22/07/2010
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v8.00 (8.00.6001.18904)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
C:\Windows\V0230Mon.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Users\Jason\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\Jason\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Registry Mechanic\regmech.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Users\Jason\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jason\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jason\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jason\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jason\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\System32\notepad.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: localhost
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
O4 - HKLM\..\Run: [V0230Mon.exe] C:\Windows\V0230Mon.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Control Center] C:\Program Files\ASUS\WLAN Card Utilities\CenterAgent.exe
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SSDMonitor] C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [TOSCDSPD] TOSCDSPD.EXE
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Jason\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [EPSON Stylus Photo R2880] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICXA.EXE /FU "C:\Windows\TEMP\E_SA21D.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [JDK5SWFMZY] C:\Users\Jason\AppData\Local\Temp\Zdr.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RMTray.exe /H
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?EN (file missing)
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASUS Wireless Card Service (ASWLCCSvc) - Unknown owner - C:\Program Files\ASUS\WLAN Card Utilities\ASWLCCSVC.exe
O23 - Service: Autorun CDROM Monitor - Unknown owner - C:\Windows\system32\TDSupportApp\cdrom_mon.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c9c85e2945a180) (gupdate1c9c85e2945a180) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 13956 bytes


MALWARE BYTES Log shortly after infection:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4316

Windows 6.0.6000
Internet Explorer 8.0.6001.18904

15/07/2010 21:45:04
mbam-log-2010-07-15 (21-45-04).txt

Scan type: Quick scan
Objects scanned: 131135
Time elapsed: 10 minute(s), 31 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\W34BCG2GRJ (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\JDK5SWFMZY (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jdk5swfmzy (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Users\Jason\AppData\Local\Temp\Zdr.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job (Trojan.Downloader) -> Delete on reboot.

Update, I've just started my laptop in safe mode with networking and the wifi works fine, so it seems it's not a hardware issue. It seems something is mucking about with it normally, it just flashes on and off at random.

Oh, and I did the combofix thingy and here is the log:

ComboFix 10-07-21.04 - Jason 22/07/2010 16:49:47.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.44.1033.18.2038.1088 [GMT 1:00]
Running from: c:\users\Jason\Downloads\ComboFix.exe
AV: Norton Internet Security *On-access scanning enabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
SP: Norton Internet Security *enabled* (Outdated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\feed.txt
c:\users\Jason\AppData\Local\Windows Server
c:\users\Jason\AppData\Local\Windows Server\flags.ini
c:\users\Jason\AppData\Local\Windows Server\uses32.dat
c:\windows\TEMP\logishrd\LVPrcInj02.dll

.
((((((((((((((((((((((((( Files Created from 2010-06-22 to 2010-07-22 )))))))))))))))))))))))))))))))
.

2010-07-22 15:58 . 2010-07-22 16:03 -------- d-----w- c:\users\Jason\AppData\Local\temp
2010-07-22 15:58 . 2010-07-22 15:58 -------- d-----w- c:\users\Guest\AppData\Local\temp
2010-07-22 15:58 . 2010-07-22 15:58 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-07-22 12:16 . 2010-07-22 12:16 -------- d-----w- c:\program files\Trend Micro
2010-07-22 11:35 . 2010-07-22 11:35 -------- d-----w- c:\users\Guest\AppData\Local\Toshiba
2010-07-22 11:31 . 2010-07-22 11:31 -------- d-----w- c:\users\Guest\AppData\Local\Google
2010-07-22 11:30 . 2010-07-22 11:30 -------- d-----w- c:\users\Guest\AppData\Roaming\Nokia
2010-07-19 19:09 . 2004-08-04 06:00 506368 ----a-w- c:\windows\system32\msxml.dll
2010-07-19 19:09 . 2010-07-19 19:09 -------- d-----w- c:\program files\Common Files\PC Tools
2010-07-15 17:05 . 2010-07-15 17:05 75776 --sha-r- c:\windows\system32\msjint40E.dll
2010-06-28 00:13 . 2010-06-28 00:12 411368 ----a-w- c:\windows\system32\deployJava1.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-22 16:04 . 2010-02-16 00:11 -------- d-----w- c:\program files\Common Files\Akamai
2010-07-22 12:16 . 2010-07-22 12:16 388096 ----a-r- c:\users\Jason\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-07-22 11:39 . 2010-04-25 00:12 -------- d-----w- c:\users\Jason\AppData\Roaming\Toshiba
2010-07-22 11:29 . 2010-07-22 11:29 76704 ----a-w- c:\users\Guest\AppData\Local\GDIPFONTCACHEV1.DAT
2010-07-22 11:29 . 2010-07-22 11:29 -------- d-----w- c:\users\Guest\AppData\Roaming\PC Suite
2010-07-03 01:44 . 2010-04-20 23:40 439816 ----a-w- c:\users\Jason\AppData\Roaming\Real\Update\setup3.11\setup.exe
2010-07-01 08:56 . 2008-09-19 01:22 -------- d-----w- c:\program files\Yahoo!
2010-06-28 12:55 . 2007-03-07 16:32 -------- d-----w- c:\program files\Common Files\Java
2010-06-28 00:12 . 2007-03-07 16:32 -------- d-----w- c:\program files\Java
2010-06-22 23:42 . 2010-05-01 18:27 -------- d-----w- c:\program files\PhotoScape
2010-06-19 17:55 . 2010-06-19 17:55 -------- d-----w- c:\users\Jason\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2010-06-19 17:55 . 2010-06-19 17:55 -------- d-----w- c:\users\Jason\AppData\Roaming\Adobe Mini Bridge CS5
2010-06-19 02:05 . 2010-06-08 14:19 -------- d-----w- c:\programdata\Microsoft Help
2010-06-17 23:55 . 2007-09-21 17:36 76704 ----a-w- c:\users\Jason\AppData\Local\GDIPFONTCACHEV1.DAT
2010-06-17 23:53 . 2010-06-17 23:53 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
2010-06-17 23:49 . 2007-03-07 17:29 -------- d-----w- c:\program files\Common Files\Adobe
2010-06-17 23:44 . 2010-06-17 23:44 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-06-17 23:44 . 2010-07-22 11:29 38784 ----a-w- c:\users\Guest\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-17 23:44 . 2010-06-17 23:44 38784 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-17 02:06 . 2010-06-08 14:25 -------- d-----w- c:\program files\Microsoft Works
2010-06-11 17:59 . 2010-06-11 17:45 -------- d-----w- c:\programdata\EPSON
2010-06-10 12:50 . 2010-06-10 12:50 50354 ----a-w- c:\users\Jason\AppData\Roaming\Facebook\uninstall.exe
2010-06-10 12:50 . 2010-06-10 12:50 -------- d-----w- c:\users\Jason\AppData\Roaming\Facebook
2010-06-08 14:35 . 2010-06-08 13:39 -------- d-----w- c:\users\Jason\AppData\Roaming\GetRightToGo
2010-06-08 14:23 . 2010-06-08 14:23 -------- d-----w- c:\program files\Microsoft.NET
2010-06-08 12:31 . 2010-03-08 00:57 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-06-08 09:35 . 2010-06-08 09:35 0 ----a-w- c:\windows\nsreg.dat
2010-06-07 10:18 . 2010-03-23 01:13 -------- d-----w- c:\users\Jason\AppData\Roaming\uTorrent
2010-06-03 11:58 . 2010-06-03 11:55 -------- d-----w- c:\program files\EPSON
2010-06-03 11:25 . 2010-06-03 11:25 -------- d-----w- c:\program files\Belarc
2010-05-26 18:20 . 2010-05-26 18:20 -------- d-----w- c:\program files\Panasonic
2010-05-25 00:25 . 2008-06-13 11:36 -------- d-----w- c:\users\Jason\AppData\Roaming\Etux
2010-05-25 00:25 . 2010-05-25 00:25 -------- d-----w- c:\program files\QuickGamma
2010-05-21 13:14 . 2009-10-06 00:06 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-04-29 14:39 . 2010-05-03 17:49 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 14:39 . 2010-05-03 17:49 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-13 1232896]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 2159104]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-29 39408]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"Creative Live! Cam Manager"="c:\program files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2006-09-06 143360]
"Google Update"="c:\users\Jason\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-05-13 133104]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"RegistryMechanic"="c:\program files\Registry Mechanic\RMTray.exe" [2010-04-08 292824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2007-09-21 1006264]
"RtHDVCpl"="RtHDVCpl.exe" [2007-01-18 4349952]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-19 411768]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2006-12-07 55416]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2007-01-29 509496]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2007-01-17 534648]
"KeNotify"="c:\program files\TOSHIBA\Utilities\KeNotify.exe" [2006-11-06 34352]
"HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2006-11-01 413696]
"SVPWUTIL"="c:\program files\TOSHIBA\Utilities\SVPWUTIL.exe" [2006-11-01 438272]
"NDSTray.exe"="NDSTray.exe" [BU]
"topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-03-02 577536]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-01-13 90191]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-01-13 7766016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-01-13 81920]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-28 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-28 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-11-28 81920]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2006-09-11 180224]
"Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2007-02-19 571024]
"AVFX Engine"="c:\program files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2006-08-16 24576]
"V0230Mon.exe"="c:\windows\V0230Mon.exe" [2006-09-06 32768]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-08-14 2407184]
"NSLauncher"="c:\program files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2007-10-01 3104768]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-16 202256]
"Control Center"="c:\program files\ASUS\WLAN Card Utilities\CenterAgent.exe" [2009-05-21 544256]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"SSDMonitor"="c:\program files\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2010-04-08 104408]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-4-28 66864]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R2 gupdate1c9c85e2945a180;Google Update Service (gupdate1c9c85e2945a180);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-29 133104]
R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 84832]
R3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2009-06-30 729088]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TpChoice;Touch Pad Detection Filter driver;c:\windows\system32\DRIVERS\TpChoice.sys [x]
R3 V0230Vfx;V0230Vfx;c:\windows\system32\DRIVERS\V0230Vfx.sys [2006-03-23 6272]
R3 V0230VID;Live! Cam Video IM Pro;c:\windows\system32\DRIVERS\V0230VID.sys [2006-09-28 500480]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2006-11-02 22016]
S2 ASWLCCSvc;ASUS Wireless Card Service;c:\program files\ASUS\WLAN Card Utilities\ASWLCCSVC.exe [2009-05-21 172032]
S2 Autorun CDROM Monitor;Autorun CDROM Monitor;c:\windows\system32\TDSupportApp\cdrom_mon.exe [2007-10-06 81920]
S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [2010-04-08 632792]
S2 PLCNDIS5;PLCNDIS5 NDIS Protocol Driver;c:\windows\system32\plcndis5.sys [2004-05-17 17280]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder

2010-07-22 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]

2010-07-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-29 00:05]

2010-07-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-29 00:05]

2010-07-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1462146042-3541615459-1316551158-1000Core.job
- c:\users\Jason\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-21 01:01]

2010-07-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1462146042-3541615459-1316551158-1000UA.job
- c:\users\Jason\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-21 01:01]

2010-07-22 c:\windows\Tasks\User_Feed_Synchronization-{2EF4932C-CCD5-4095-803C-0A6EF70F8FA2}.job
- c:\windows\system32\msfeedssync.exe [2010-03-30 04:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {{C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?EN
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\z92i33p2.default\
FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff36\gears.dll
FF - component: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll
FF - plugin: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: c:\users\Jason\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\users\Jason\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-TOSCDSPD - TOSCDSPD.EXE
HKCU-Run-AdobeBridge - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-22 17:05
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b4

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(9476)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\program files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\system32\rundll32.exe
c:\windows\RtHDVCpl.exe
c:\program files\TOSHIBA\ConfigFree\NDSTray.exe
c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Apoint2K\ApMsgFwd.exe
c:\users\Jason\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe
c:\program files\Registry Mechanic\regmech.exe
c:\program files\Apoint2K\Apntex.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\ASUS\WLAN Card Utilities\Center.exe
c:\program files\Google\Update\1.2.183.29\GoogleCrashHandler.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\windows\system32\TODDSrv.exe
c:\program files\TOSHIBA\Power Saver\TosCoSrv.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2010-07-22 17:12:54 - machine was rebooted
ComboFix-quarantined-files.txt 2010-07-22 16:12

Pre-Run: 12,376,608,768 bytes free
Post-Run: 16,311,496,704 bytes free

- - End Of File - - E1009DAB8829CB4162264553F83710B0

Hello, and welcome to GeekPolice.

Please note the following information about the malware forum:

• Only Tech Officers, Global Moderators, Administrators, and Malware Advisors are allowed to give advice on removing malware from your computer.
  
• From this point on, please do not make any more changes to your computer; such as install/uninstall programs, use special fix tools, delete files, edit the registry, etc. - unless advised by the staff I noted above.
  
• Please do not ask for help elsewhere (in this site or other sites). Doing so can result in system changes, which may not show up in the logs you post.
  
• If you have already asked for help somewhere, please post the link to the topic you were helped.
  
• We try our best to reply quickly, but for any reason we do not reply in two days, do one of two things:
  
  Reply to this topic with the word BUMP, or
  see this topic.
  
  
• Lastly, keep in mind that we are volunteers, so you do not have to pay for malware removal. Persist in this topic until its close, and your computer is declared clean.

---

Please download OTL to your Desktop. (If you already have it downloaded, then just follow the instructions below).

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• Under the Custom Scan box paste this in
  
  %systemroot%\*. /mp /s
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\system32\*.exe /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %systemroot%\System32\config\*.sav
  %systemroot%\system32\*.sys
  %systemroot%\system32\drivers\*.dll
  %systemroot%\system32\drivers\*.ini
  %systemroot%\system32\drivers\*.exe
  %systemroot%\system32\Spool\prtprocs\w32x86\*.dll
  %SYSTEMDRIVE%\*.*
  %PROGRAMFILES%\*.
  %appdata%\*.*
  netsvcs
  msconfig
  safebootminimal
  safebootnetwork
  activex
  drivers32
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  ahcix86.sys
  KR10N.sys
  disk.sys
  nvstor32.sys
  ahcix86s.sys
  nvrd32.sys
  symmpi.sys
  adp3132.sys
  mv61xx.sys
  usbstor.sys
  /md5stop
  CREATERESTOREPOINT
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) and paste (Edit->Paste) the contents of these files, one at a time

Note: in the event that OTL fails to run, please use alternate download links to try again:

http://oldtimer.geekstogo.com/OTL.com
http://oldtimer.geekstogo.com/OTL.scr

Hi Jay,

I can't paste the files as they are above the character limit.

I have tried to attach them to this post.

OK so the attachements didnt work! I've split the log file up:

OTL.txt

OTL logfile created on: 23/07/2010 18:31:49 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Jason\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 45.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 60.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 73.06 Gb Total Space | 15.11 Gb Free Space | 20.68% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HONEYSUCKLE
Current User Name: Jason
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/07/23 18:30:43 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Jason\Desktop\OTL.exe
PRC - [2010/06/17 12:37:52 | 003,233,096 | ---- | M] (PC Tools) -- C:\Program Files\Registry Mechanic\RegMech.exe
PRC - [2010/06/17 02:39:20 | 000,134,808 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\1.2.183.29\GoogleCrashHandler.exe
PRC - [2010/06/15 01:15:35 | 000,134,808 | ---- | M] (Google Inc.) -- C:\Users\Jason\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe
PRC - [2010/04/08 09:14:22 | 000,632,792 | ---- | M] (PC Tools) -- C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
PRC - [2010/04/08 09:14:20 | 000,104,408 | ---- | M] (PC Tools) -- C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
PRC - [2010/03/16 03:04:44 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2010/03/06 04:04:24 | 000,310,224 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
PRC - [2010/02/16 19:28:32 | 000,655,624 | ---- | M] (Acresso Software Inc.) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
PRC - [2009/09/10 16:29:33 | 000,168,960 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmplayer.exe
PRC - [2009/09/01 17:01:14 | 001,790,464 | ---- | M] (ASUSTeK COMPUTER INC.) -- C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
PRC - [2009/05/21 15:09:04 | 000,172,032 | ---- | M] () -- C:\Program Files\ASUS\WLAN Card Utilities\ASWLCCSVC.exe
PRC - [2009/04/29 03:10:22 | 000,039,408 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2009/04/28 15:59:56 | 000,066,864 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
PRC - [2008/10/29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/09/19 12:14:08 | 050,840,880 | ---- | M] (Adobe Systems, Incorporated) -- C:\Program Files\Adobe\Adobe Photoshop CS4\Photoshop.exe
PRC - [2008/08/14 17:15:46 | 002,407,184 | ---- | M] () -- C:\Program Files\Logitech\QuickCam\Quickcam.exe
PRC - [2008/08/14 17:11:48 | 000,565,008 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
PRC - [2008/08/14 17:11:14 | 000,447,248 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2008/07/26 08:25:36 | 000,150,040 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
PRC - [2008/07/26 08:23:42 | 000,186,904 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
PRC - [2007/10/06 15:56:10 | 000,081,920 | R--- | M] () -- C:\Windows\System32\TDSupportApp\cdrom_mon.exe
PRC - [2007/10/01 11:29:40 | 003,104,768 | ---- | M] () -- C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe
PRC - [2007/09/21 19:30:01 | 001,006,264 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2007/03/02 15:10:34 | 000,577,536 | ---- | M] (TOSHIBA) -- C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe
PRC - [2007/02/08 16:13:46 | 000,212,480 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
PRC - [2007/02/02 15:56:52 | 000,118,784 | ---- | M] (TOSHIBA CORPORATION) -- c:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe
PRC - [2007/01/29 12:43:44 | 000,509,496 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
PRC - [2007/01/18 14:46:56 | 004,349,952 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007/01/17 14:46:32 | 000,534,648 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
PRC - [2006/12/20 00:16:44 | 000,411,768 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
PRC - [2006/12/20 00:15:44 | 000,428,152 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
PRC - [2006/11/14 23:02:36 | 001,372,160 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
PRC - [2006/11/14 22:19:42 | 000,405,504 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
PRC - [2006/11/14 21:33:10 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
PRC - [2006/11/06 18:14:44 | 000,034,352 | ---- | M] () -- C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
PRC - [2006/10/05 12:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe
PRC - [2006/09/06 18:01:00 | 000,032,768 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\V0230Mon.exe
PRC - [2006/09/06 09:42:00 | 000,143,360 | ---- | M] (Creative Technology Ltd.) -- C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
PRC - [2006/08/23 17:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
PRC - [2006/08/16 01:12:00 | 000,024,576 | ---- | M] (Creative Technology Ltd.) -- C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
PRC - [2006/05/25 19:30:16 | 000,114,688 | ---- | M] (TOSHIBA Corporation) -- C:\Windows\System32\TODDSrv.exe


========== Modules (SafeList) ==========

MOD - [2010/07/23 18:30:43 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Jason\Desktop\OTL.exe
MOD - [2010/03/16 03:05:45 | 000,040,960 | ---- | M] () -- C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll
MOD - [2010/03/16 03:04:48 | 000,348,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msvcr71.dll
MOD - [2008/07/26 08:25:24 | 000,109,080 | ---- | M] (Logitech Inc.) -- C:\Windows\temp\logishrd\LVPrcInj01.dll
MOD - [2006/11/02 10:44:49 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx
MOD - [2006/11/02 10:38:57 | 001,648,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll
MOD - [2006/07/11 18:35:42 | 000,503,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msvcp71.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (CLTNetCnService)
SRV - [2010/07/01 12:41:51 | 002,561,624 | ---- | M] () [Auto | Running] -- c:\Program Files\Common Files\Akamai\rswin_3725.dll -- (Akamai)
SRV - [2010/04/08 09:14:22 | 000,632,792 | ---- | M] (PC Tools) [Auto | Running] -- C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe -- (PCToolsSSDMonitorSvc)
SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010/02/16 19:28:32 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Running] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009/05/21 15:09:04 | 000,172,032 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\WLAN Card Utilities\ASWLCCSVC.exe -- (ASWLCCSvc)
SRV - [2008/07/26 08:25:36 | 000,150,040 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2008/07/26 08:23:42 | 000,186,904 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe -- (LVCOMSer)
SRV - [2007/10/25 16:27:54 | 000,266,240 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe -- (WLSetupSvc)
SRV - [2007/10/18 12:31:54 | 000,098,328 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Messenger\usnsvc.exe -- (usnjsvc)
SRV - [2007/10/06 15:56:10 | 000,081,920 | R--- | M] () [Auto | Running] -- C:\Windows\System32\TDSupportApp\cdrom_mon.exe -- (Autorun CDROM Monitor)
SRV - [2007/09/21 19:30:01 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/02/08 16:13:46 | 000,212,480 | ---- | M] (Nokia.) [On_Demand | Running] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2007/02/02 15:56:52 | 000,118,784 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- c:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
SRV - [2006/12/20 00:15:44 | 000,428,152 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV - [2006/11/14 21:33:10 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe -- (CFSvcs)
SRV - [2006/10/05 12:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2006/08/23 17:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)
SRV - [2006/05/25 19:30:16 | 000,114,688 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\TpChoice.sys -- (TpChoice)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2009/06/30 18:15:34 | 000,729,088 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netr28u.sys -- (netr28u)
DRV - [2008/08/14 08:57:42 | 000,074,720 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\adfs.sys -- (adfs)
DRV - [2008/07/26 16:26:44 | 004,658,584 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC) Logitech QuickCam Pro 9000(UVC)
DRV - [2008/07/26 16:26:22 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2008/07/26 16:25:48 | 000,627,864 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2008/07/26 08:25:02 | 000,025,624 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2007/10/12 10:03:42 | 000,101,120 | ---- | M] (ZTE Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV - [2007/10/12 10:03:42 | 000,101,120 | ---- | M] (ZTE Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV - [2007/10/12 10:03:40 | 000,101,120 | ---- | M] (ZTE Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV - [2007/02/22 10:15:56 | 000,137,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcd.sys -- (nmwcd)
DRV - [2007/02/22 10:15:14 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdcm.sys -- (nmwcdcm)
DRV - [2007/02/22 10:15:14 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdcj.sys -- (nmwcdcj)
DRV - [2007/02/22 10:15:14 | 000,008,320 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdc.sys -- (nmwcdc)
DRV - [2007/01/23 16:25:36 | 000,689,664 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2007/01/18 18:56:56 | 001,729,632 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007/01/18 15:47:18 | 000,211,072 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\kr10n.sys -- (KR10N)
DRV - [2007/01/18 15:40:56 | 000,219,392 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\kr10i.sys -- (KR10I)
DRV - [2007/01/13 09:40:00 | 004,452,288 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2006/11/28 21:46:28 | 000,052,800 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\PCASp50.sys -- (PCASp50)
DRV - [2006/11/28 21:39:52 | 001,476,096 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx)
DRV - [2006/11/28 21:39:52 | 001,476,096 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\igdkmd32.sys -- (ialm)
DRV - [2006/11/28 15:11:00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006/11/04 09:35:50 | 000,059,392 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2006/11/02 10:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 10:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 10:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 10:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 10:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2006/11/02 10:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 10:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 10:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 10:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 10:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 10:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 10:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2006/11/02 10:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 10:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 10:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2006/11/02 10:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 10:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 10:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 10:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 10:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2006/11/02 10:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 10:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 10:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 10:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 10:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 10:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 10:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 10:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 10:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 10:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 10:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2006/11/02 10:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2006/11/02 10:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2006/11/02 09:55:04 | 000,071,552 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2006/11/02 09:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 09:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 09:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 09:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 09:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 09:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 08:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 08:30:54 | 001,781,760 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2006/11/02 08:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2006/10/23 17:32:20 | 000,009,216 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfec.sys -- (tosrfec)
DRV - [2006/10/18 12:50:04 | 000,016,128 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV - [2006/10/05 23:22:14 | 000,016,768 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS -- (TVALZ)
DRV - [2006/09/28 18:01:00 | 000,500,480 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\V0230VID.sys -- (V0230VID)
DRV - [2006/08/30 09:35:58 | 000,140,800 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2006/07/28 17:25:26 | 000,019,456 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\LPCFilter.sys -- (LPCFilter)
DRV - [2006/07/06 13:44:00 | 000,168,448 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tifm21.sys -- (tifm21)
DRV - [2006/03/23 18:00:00 | 000,006,272 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\V0230Vfx.sys -- (V0230Vfx)
DRV - [2004/05/17 11:21:54 | 000,017,280 | ---- | M] (Intellon, Inc.) [Kernel | Auto | Running] -- C:\Windows\system32\plcndis5.sys -- (PLCNDIS5)
DRV - [2002/07/17 16:20:32 | 000,084,832 | ---- | M] (Adaptec) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ASPI32.SYS -- (ASPI)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - HKLM\software\mozilla\Firefox\Extensions\\{000a9d1c-beef-4f90-9363-039d445309b8}: C:\Program Files\Google\Google Gears\Firefox\ [2010/03/06 04:54:31 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/16 03:05:46 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/17 19:19:04 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/06/30 03:18:18 | 000,000,000 | ---D | M]

[2010/06/08 10:35:49 | 000,000,000 | ---D | M] -- C:\Users\Jason\AppData\Roaming\mozilla\Extensions
[2010/07/22 13:27:48 | 000,000,000 | ---D | M] -- C:\Users\Jason\AppData\Roaming\mozilla\Firefox\Profiles\z92i33p2.default\extensions
[2010/06/08 10:36:15 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Jason\AppData\Roaming\mozilla\Firefox\Profiles\z92i33p2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/22 13:27:48 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/06/28 01:13:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/06/28 01:12:30 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/07/22 17:03:17 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O2 - BHO: (Windows Live Toolbar Helper) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O2 - BHO: (Google Gears Helper) - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O4 - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [Control Center] C:\Program Files\ASUS\WLAN Card Utilities\CenterAgent.exe ()
O4 - HKLM..\Run: [HSON] C:\Program Files\TOSHIBA\TBS\HSON.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe (TOSHIBA Electronics, Inc.)
O4 - HKLM..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe ()
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
O4 - HKLM..\Run: [NDSTray.exe] File not found
O4 - HKLM..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SSDMonitor] C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe (PC Tools)
O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe (TOSHIBA)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe (TOSHIBA)
O4 - HKLM..\Run: [Toshiba Registration] C:\Program Files\TOSHIBA\Registration\ToshibaRegistration.exe (Toshiba)
O4 - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [V0230Mon.exe] C:\Windows\V0230Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Creative Live! Cam Manager] C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe (Creative Technology Ltd.)
O4 - HKCU..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RMTray.exe (PC Tools )
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\Jason\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Jason\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/03 20:31:43 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found


SafeBootMin: AppMgmt - C:\Windows\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - C:\Windows\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {41CAF903-FCA8-60D3-0315-39329784AE6D} - Java (Sun)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows script 5.8
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {7EACE882-F857-EFA2-CA27-FB6F1F6C1597} - Themes Setup
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

Drivers32: msacm.dvacm - C:\Program Files\Common Files\Ulead Systems\vio\DVACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.XVID - C:\Windows\System32\xvidvfw.dll ()

CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 30 Days ==========

[2010/07/23 18:29:55 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\Jason\Desktop\OTL.exe
[2010/07/22 17:03:24 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2010/07/22 16:58:50 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010/07/22 16:58:50 | 000,000,000 | ---D | C] -- C:\Users\Jason\AppData\Local\temp
[2010/07/22 16:46:49 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010/07/22 16:46:49 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2010/07/22 16:46:49 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2010/07/22 16:46:49 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2010/07/22 16:46:44 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010/07/22 16:39:37 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/07/22 16:39:13 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW
[2010/07/22 13:24:48 | 000,000,000 | ---D | C] -- C:\Users\Jason\Desktop\drv
[2010/07/22 13:16:13 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2010/07/19 20:09:13 | 001,101,824 | ---- | C] (Woodbury Associates Limited) -- C:\Windows\System32\UniBox210.ocx
[2010/07/19 20:09:13 | 000,880,640 | ---- | C] (Woodbury Associates Limited) -- C:\Windows\System32\UniBox10.ocx
[2010/07/19 20:09:13 | 000,506,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxml.dll
[2010/07/19 20:09:13 | 000,212,992 | ---- | C] (Woodbury Associates Limited) -- C:\Windows\System32\UniBoxVB12.ocx
[2010/07/19 20:09:12 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2010/07/19 20:09:10 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2010/07/19 20:09:10 | 000,000,000 | ---D | C] -- C:\Program Files\Registry Mechanic
[2010/07/16 11:44:22 | 000,000,000 | ---D | C] -- C:\Users\Jason\Desktop\Adobe_CS5_InstallMAC
[2010/07/16 11:44:03 | 000,000,000 | ---D | C] -- C:\Users\Jason\AppData\Roaming\WinRAR
[2010/07/16 11:43:50 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2010/07/01 16:31:55 | 000,000,000 | ---D | C] -- C:\Users\Jason\Desktop\gRunGE
[2010/06/29 18:01:47 | 000,000,000 | ---D | C] -- C:\Users\Jason\Desktop\Catherine
[2010/06/28 13:55:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2010/06/28 01:13:09 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll
[2010/06/28 01:13:09 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2010/06/28 01:13:08 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2010/06/28 01:13:08 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2010/06/27 19:59:25 | 000,000,000 | ---D | C] -- C:\Users\Jason\Desktop\Karen
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/07/23 18:34:06 | 003,932,160 | -HS- | M] () -- C:\Users\Jason\ntuser.dat
[2010/07/23 18:30:43 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Jason\Desktop\OTL.exe
[2010/07/23 18:30:17 | 000,000,418 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{2EF4932C-CCD5-4095-803C-0A6EF70F8FA2}.job
[2010/07/23 18:23:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/07/23 18:23:26 | 000,003,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/07/23 18:23:25 | 000,003,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/07/23 02:44:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/23 02:43:59 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/23 02:20:00 | 000,000,906 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1462146042-3541615459-1316551158-1000UA.job
[2010/07/23 02:10:00 | 000,000,254 | ---- | M] () -- C:\Windows\tasks\Check Updates for Windows Live Toolbar.job
[2010/07/23 01:20:00 | 000,000,854 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1462146042-3541615459-1316551158-1000Core.job
[2010/07/22 19:11:18 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/07/22 18:58:48 | 000,001,356 | ---- | M] () -- C:\Users\Jason\AppData\Local\d3d9caps.dat
[2010/07/22 17:03:29 | 000,000,215 | ---- | M] () -- C:\Windows\system.ini
[2010/07/22 17:03:17 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010/07/22 13:16:13 | 000,001,948 | ---- | M] () -- C:\Users\Jason\Desktop\HiJackThis.lnk
[2010/07/22 11:24:42 | 033,892,676 | ---- | M] () -- C:\Users\Jason\Desktop\CHURCHILLCANVAS.psd
[2010/07/22 10:53:40 | 000,263,744 | ---- | M] () -- C:\Users\Jason\Desktop\union_jack_flag-1920x1080.jpg
[2010/07/22 10:48:11 | 000,270,340 | ---- | M] () -- C:\Users\Jason\Desktop\big_421(main)_Winston_Churchill_inspecting_a_Tommy_gun_Print_Mounted.jpg
[2010/07/22 10:26:49 | 000,716,948 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/07/22 10:26:49 | 000,623,342 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/07/22 10:26:49 | 000,108,526 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/07/20 19:28:49 | 000,050,688 | ---- | M] () -- C:\Users\Jason\Desktop\100720ORDER.xls
[2010/07/19 20:09:14 | 000,000,910 | ---- | M] () -- C:\Users\Public\Desktop\Registry Mechanic.lnk
[2010/07/19 19:48:47 | 000,000,036 | ---- | M] () -- C:\Users\Jason\AppData\Local\housecall.guid.cache
[2010/07/18 23:34:47 | 000,174,646 | ---- | M] () -- C:\Users\Jason\Desktop\WhitleyHall.jpg
[2010/07/18 23:34:47 | 000,001,456 | ---- | M] () -- C:\Users\Jason\AppData\Local\Adobe Save for Web 12.0 Prefs
[2010/07/18 18:25:41 | 000,258,312 | ---- | M] () -- C:\Users\Jason\Desktop\J HAiGH.pdf
[2010/07/16 11:41:20 | 000,693,888 | ---- | M] () -- C:\Users\Jason\Desktop\Adobe_CS5_InstallMAC.rar
[2010/07/15 18:05:30 | 000,075,776 | RHS- | M] () -- C:\Windows\System32\msjint40E.dll
[2010/07/08 19:29:09 | 000,374,569 | ---- | M] () -- C:\Users\Jason\Desktop\Lift.jpg
[2010/07/08 19:27:56 | 000,121,427 | ---- | M] () -- C:\Users\Jason\Desktop\photo.jpg
[2010/07/07 02:50:47 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt18.sqm
[2010/07/07 02:50:47 | 000,000,232 | -H-- | M] () -- C:\sqmdata18.sqm
[2010/07/01 09:26:06 | 000,086,528 | ---- | M] () -- C:\Users\Jason\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/28 01:12:29 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2010/06/28 01:12:29 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2010/06/28 01:12:29 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2010/06/28 01:12:28 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/22 16:46:49 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010/07/22 16:46:49 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010/07/22 16:46:49 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010/07/22 16:46:49 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010/07/22 16:46:49 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010/07/22 13:16:13 | 000,001,948 | ---- | C] () -- C:\Users\Jason\Desktop\HiJackThis.lnk
[2010/07/22 11:24:39 | 033,892,676 | ---- | C] () -- C:\Users\Jason\Desktop\CHURCHILLCANVAS.psd
[2010/07/22 10:53:40 | 000,263,744 | ---- | C] () -- C:\Users\Jason\Desktop\union_jack_flag-1920x1080.jpg
[2010/07/22 10:48:10 | 000,270,340 | ---- | C] () -- C:\Users\Jason\Desktop\big_421(main)_Winston_Churchill_inspecting_a_Tommy_gun_Print_Mounted.jpg
[2010/07/20 19:28:49 | 000,050,688 | ---- | C] () -- C:\Users\Jason\Desktop\100720ORDER.xls
[2010/07/19 20:09:14 | 000,000,910 | ---- | C] () -- C:\Users\Public\Desktop\Registry Mechanic.lnk
[2010/07/19 19:48:47 | 000,000,036 | ---- | C] () -- C:\Users\Jason\AppData\Local\housecall.guid.cache
[2010/07/18 23:34:46 | 000,174,646 | ---- | C] () -- C:\Users\Jason\Desktop\WhitleyHall.jpg
[2010/07/18 18:25:23 | 000,258,312 | ---- | C] () -- C:\Users\Jason\Desktop\J HAiGH.pdf
[2010/07/16 11:41:14 | 000,693,888 | ---- | C] () -- C:\Users\Jason\Desktop\Adobe_CS5_InstallMAC.rar
[2010/07/15 18:05:30 | 000,075,776 | RHS- | C] () -- C:\Windows\System32\msjint40E.dll
[2010/07/08 19:29:05 | 000,374,569 | ---- | C] () -- C:\Users\Jason\Desktop\Lift.jpg
[2010/07/08 19:27:54 | 000,121,427 | ---- | C] () -- C:\Users\Jason\Desktop\photo.jpg
[2009/04/28 15:59:14 | 000,066,482 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2008/07/26 08:25:02 | 000,025,624 | ---- | C] () -- C:\Windows\System32\drivers\LVPr2Mon.sys
[2007/12/23 00:55:34 | 000,000,000 | ---- | C] () -- C:\Windows\ToDisc.INI
[2007/03/07 18:17:49 | 000,204,800 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll
[2007/03/07 18:17:49 | 000,200,704 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll
[2007/03/07 18:17:49 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll
[2007/03/07 18:17:49 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll
[2007/03/07 18:17:49 | 000,188,416 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll
[2007/03/07 18:17:49 | 000,020,480 | ---- | C] () -- C:\Windows\System32\IVIresize.dll
[2007/03/07 18:07:11 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI
[2007/03/07 17:47:02 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini
[2007/03/07 17:47:02 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll
[2007/03/07 17:47:02 | 000,010,150 | ---- | C] () -- C:\Windows\System32\tosmreg.ini
[2007/03/07 17:47:02 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini
[2007/03/07 17:33:30 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1132.dll
[2007/03/07 17:33:30 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2007/03/07 17:33:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\oemdspif.dll
[2007/03/07 17:33:28 | 000,077,824 | ---- | C] () -- C:\Windows\System32\hccutils.dll
[2006/12/05 14:05:06 | 000,114,688 | ---- | C] () -- C:\Windows\System32\TosBtAcc.dll
[2006/11/24 08:48:44 | 000,036,864 | ---- | C] () -- C:\Windows\System32\HWS_Ctrl.dll
[2006/11/02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/02/28 21:17:30 | 000,159,744 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2005/12/30 20:10:30 | 000,761,856 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2005/11/23 15:55:42 | 000,024,576 | ---- | C] () -- C:\Windows\System32\SPCtl.dll
[2005/07/22 22:30:20 | 000,065,536 | ---- | C] () -- C:\Windows\System32\TosCommAPI.dll
[2004/01/14 07:46:34 | 000,172,032 | ---- | C] () -- C:\Windows\System32\tifmicon.dll

========== Custom Scans ==========


< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/03/08 12:31:42 | 000,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtmsft.dll
[2009/03/08 12:31:37 | 000,216,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtrans.dll
[2010/07/15 18:05:30 | 000,075,776 | RHS- | M] () Unable to obtain MD5 -- C:\Windows\System32\msjint40E.dll
[2006/11/02 10:46:10 | 001,376,528 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\msvbvm60.dll
[2006/11/02 10:47:18 | 000,228,968 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2007/09/28 18:47:10 | 000,223,232 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll

< %systemroot%\system32\*.exe /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2007/03/07 16:58:46 | 006,602,752 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2007/03/07 16:58:45 | 000,102,400 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2007/03/07 16:58:47 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2007/03/07 16:58:55 | 015,556,608 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2007/03/07 16:58:57 | 006,008,832 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %systemroot%\system32\*.sys >
[2006/11/02 08:09:42 | 000,009,029 | ---- | M] () -- C:\Windows\System32\ANSI.SYS
[2002/09/09 19:54:06 | 000,016,269 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) -- C:\Windows\System32\ASNDIS5.sys
[2007/01/23 16:25:36 | 000,689,664 | ---- | M] (Atheros Communications, Inc.) -- C:\Windows\System32\athr.sys
[2008/02/17 22:24:23 | 000,224,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\clfs.sys
[2006/11/02 08:09:45 | 000,027,097 | ---- | M] () -- C:\Windows\System32\country.sys
[2006/11/02 08:09:41 | 000,004,768 | ---- | M] () -- C:\Windows\System32\HIMEM.SYS
[2006/11/02 08:09:44 | 000,042,809 | ---- | M] () -- C:\Windows\System32\KEY01.SYS
[2006/11/02 08:09:44 | 000,042,537 | ---- | M] () -- C:\Windows\System32\KEYBOARD.SYS
[2006/11/02 08:09:29 | 000,027,866 | ---- | M] () -- C:\Windows\System32\NTDOS.SYS
[2006/11/02 08:09:35 | 000,029,146 | ---- | M] () -- C:\Windows\System32\NTDOS404.SYS
[2006/11/02 08:09:38 | 000,029,370 | ---- | M] () -- C:\Windows\System32\NTDOS411.SYS
[2006/11/02 08:09:40 | 000,029,274 | ---- | M] () -- C:\Windows\System32\NTDOS412.SYS
[2006/11/02 08:09:31 | 000,029,146 | ---- | M] () -- C:\Windows\System32\NTDOS804.SYS
[2006/11/02 08:09:20 | 000,033,952 | ---- | M] () -- C:\Windows\System32\NTIO.SYS
[2006/11/02 08:09:23 | 000,034,672 | ---- | M] () -- C:\Windows\System32\NTIO404.SYS
[2006/11/02 08:09:24 | 000,035,776 | ---- | M] () -- C:\Windows\System32\NTIO411.SYS
[2006/11/02 08:09:26 | 000,035,536 | ---- | M] () -- C:\Windows\System32\NTIO412.SYS
[2006/11/02 08:09:22 | 000,034,672 | ---- | M] () -- C:\Windows\System32\NTIO804.SYS
[2004/05/17 11:21:54 | 000,017,280 | ---- | M] (Intellon, Inc.) -- C:\Windows\System32\plcndis5.sys
[2009/08/14 15:01:34 | 002,031,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys

< %systemroot%\system32\drivers\*.dll >

< %systemroot%\system32\drivers\*.ini >

< %systemroot%\system32\drivers\*.exe >

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2006/11/02 13:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll

< %SYSTEMDRIVE%\*.* >
[2009/04/03 20:31:43 | 000,000,074 | ---- | M] () -- C:\autoexec.bat
[2006/11/02 10:53:57 | 000,438,840 | RHS- | M] () -- C:\bootmgr
[2007/03/07 16:58:59 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2010/07/22 17:12:55 | 000,022,118 | ---- | M] () -- C:\ComboFix.txt
[2006/09/18 22:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2010/04/04 21:10:58 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/04/04 21:10:58 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2010/07/22 19:11:03 | 2451,046,400 | -HS- | M] () -- C:\pagefile.sys
[2007/03/07 17:40:40 | 000,000,345 | ---- | M] () -- C:\RHDSetup.log
[2008/07/23 23:27:51 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
[2008/07/25 22:46:31 | 000,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
[2008/07/25 22:55:30 | 000,000,268 | -H-- | M] () -- C:\sqmdata02.sqm
[2008/07/31 02:00:29 | 000,000,268 | -H-- | M] () -- C:\sqmdata03.sqm
[2008/08/15 01:35:28 | 000,000,268 | -H-- | M] () -- C:\sqmdata04.sqm
[2008/08/15 22:27:13 | 000,000,268 | -H-- | M] () -- C:\sqmdata05.sqm
[2008/08/16 00:10:22 | 000,000,268 | -H-- | M] () -- C:\sqmdata06.sqm
[2008/08/18 01:15:47 | 000,000,268 | -H-- | M] () -- C:\sqmdata07.sqm
[2008/08/18 19:48:32 | 000,000,268 | -H-- | M] () -- C:\sqmdata08.sqm
[2008/09/01 23:01:01 | 000,000,268 | -H-- | M] () -- C:\sqmdata09.sqm
[2008/10/11 00:08:50 | 000,000,268 | -H-- | M] () -- C:\sqmdata10.sqm
[2008/10/15 20:01:17 | 000,000,268 | -H-- | M] () -- C:\sqmdata11.sqm
[2008/10/16 00:14:08 | 000,000,268 | -H-- | M] () -- C:\sqmdata12.sqm
[2008/11/10 17:56:10 | 000,000,232 | -H-- | M] () -- C:\sqmdata13.sqm
[2009/01/20 23:53:13 | 000,000,232 | -H-- | M] () -- C:\sqmdata14.sqm
[2009/07/16 14:02:45 | 000,000,232 | -H-- | M] () -- C:\sqmdata15.sqm
[2010/03/01 01:03:34 | 000,000,232 | -H-- | M] () -- C:\sqmdata16.sqm
[2010/06/07 14:51:24 | 000,000,232 | -H-- | M] () -- C:\sqmdata17.sqm
[2010/07/07 02:50:47 | 000,000,232 | -H-- | M] () -- C:\sqmdata18.sqm
[2008/07/23 22:43:06 | 000,000,268 | -H-- | M] () -- C:\sqmdata19.sqm
[2008/07/23 23:27:51 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
[2008/07/25 22:46:31 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
[2008/07/25 22:55:30 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt02.sqm
[2008/07/31 02:00:29 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt03.sqm
[2008/08/15 01:35:27 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt04.sqm
[2008/08/15 22:27:13 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt05.sqm
[2008/08/16 00:10:22 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt06.sqm
[2008/08/18 01:15:47 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt07.sqm
[2008/08/18 19:48:32 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt08.sqm
[2008/09/01 23:01:01 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt09.sqm
[2008/10/11 00:08:50 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt10.sqm
[2008/10/15 20:01:17 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt11.sqm
[2008/10/16 00:14:08 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt12.sqm
[2008/11/10 17:56:10 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt13.sqm
[2009/01/20 23:53:13 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt14.sqm
[2009/07/16 14:02:45 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt15.sqm
[2010/03/01 01:03:33 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt16.sqm
[2010/06/07 14:51:24 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt17.sqm
[2010/07/07 02:50:47 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt18.sqm
[2008/07/23 22:43:06 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt19.sqm
[2007/03/20 14:24:18 | 000,000,547 | -H-- | M] () -- C:\SWSTAMP.TXT
[2007/09/21 20:25:28 | 000,470,582 | ---- | M] () -- C:\vcredist_x86.log

< %PROGRAMFILES%\*. >
[2010/06/18 00:50:45 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2010/02/16 19:37:17 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe Media Player
[2010/03/18 03:21:45 | 000,000,000 | ---D | M] -- C:\Program Files\AnvSoft
[2007/09/21 20:29:00 | 000,000,000 | ---D | M] -- C:\Program Files\Apoint2K
[2009/09/07 19:16:13 | 000,000,000 | ---D | M] -- C:\Program Files\Apple Software Update
[2010/04/04 20:57:11 | 000,000,000 | ---D | M] -- C:\Program Files\ASUS
[2007/09/21 20:27:57 | 000,000,000 | ---D | M] -- C:\Program Files\Atheros
[2010/06/03 12:25:55 | 000,000,000 | ---D | M] -- C:\Program Files\Belarc
[2009/09/07 19:19:40 | 000,000,000 | ---D | M] -- C:\Program Files\Bonjour
[2010/07/22 16:54:36 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2009/04/03 20:28:34 | 000,000,000 | ---D | M] -- C:\Program Files\Creative
[2010/03/31 12:32:19 | 000,000,000 | ---D | M] -- C:\Program Files\devolo
[2009/05/14 14:59:37 | 000,000,000 | ---D | M] -- C:\Program Files\Easy Video Splitter
[2010/06/03 12:58:36 | 000,000,000 | ---D | M] -- C:\Program Files\EPSON
[2010/02/17 22:18:42 | 000,000,000 | ---D | M] -- C:\Program Files\Free DVD Ripper
[2010/02/17 22:28:17 | 000,000,000 | ---D | M] -- C:\Program Files\freestar
[2010/03/06 04:54:30 | 000,000,000 | ---D | M] -- C:\Program Files\Google
[2007/03/07 18:33:36 | 000,000,000 | ---D | M] -- C:\Program Files\IDM
[2010/04/04 20:57:07 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2010/05/04 03:40:06 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2007/09/21 20:25:59 | 000,000,000 | ---D | M] -- C:\Program Files\InterVideo
[2009/10/06 00:33:09 | 000,000,000 | ---D | M] -- C:\Program Files\iPod
[2007/03/20 14:00:06 | 000,000,000 | ---D | M] -- C:\Program Files\ISP
[2009/10/06 00:33:55 | 000,000,000 | ---D | M] -- C:\Program Files\iTunes
[2010/06/28 01:12:17 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2009/04/28 15:59:42 | 000,000,000 | ---D | M] -- C:\Program Files\Logitech
[2007/03/07 17:47:01 | 000,000,000 | ---D | M] -- C:\Program Files\ltmoh
[2010/05/03 18:49:53 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2007/12/27 12:18:01 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2006/11/02 13:37:34 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Games
[2010/06/08 15:24:43 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
[2010/06/17 03:06:52 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Works
[2010/06/08 15:23:55 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft.NET
[2010/03/11 04:24:42 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2010/06/30 03:18:31 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2006/11/02 13:37:34 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
[2006/11/02 13:37:34 | 000,000,000 | ---D | M] -- C:\Program Files\MSN
[2007/09/21 19:04:24 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 4.0
[2009/04/03 20:31:16 | 000,000,000 | ---D | M] -- C:\Program Files\muvee Technologies
[2007/03/07 17:56:49 | 000,000,000 | ---D | M] -- C:\Program Files\My Company Name
[2009/05/14 09:28:42 | 000,000,000 | ---D | M] -- C:\Program Files\Nokia
[2010/05/26 19:20:55 | 000,000,000 | ---D | M] -- C:\Program Files\Panasonic
[2009/05/14 09:25:55 | 000,000,000 | ---D | M] -- C:\Program Files\PC Connectivity Solution
[2010/03/07 20:47:03 | 000,000,000 | ---D | M] -- C:\Program Files\PhotomatixPro3
[2010/05/03 17:51:48 | 000,000,000 | ---D | M] -- C:\Program Files\PhotomatixPro325
[2010/06/23 00:42:46 | 000,000,000 | ---D | M] -- C:\Program Files\PhotoScape
[2010/05/25 01:25:26 | 000,000,000 | ---D | M] -- C:\Program Files\QuickGamma
[2009/10/06 00:29:19 | 000,000,000 | ---D | M] -- C:\Program Files\QuickTime
[2010/03/16 03:05:30 | 000,000,000 | ---D | M] -- C:\Program Files\Real
[2007/03/07 17:44:03 | 000,000,000 | ---D | M] -- C:\Program Files\Realtek
[2006/11/02 13:37:34 | 000,000,000 | ---D | M] -- C:\Program Files\Reference Assemblies
[2010/07/19 20:09:43 | 000,000,000 | ---D | M] -- C:\Program Files\Registry Mechanic
[2009/04/03 20:30:03 | 000,000,000 | ---D | M] -- C:\Program Files\SightSpeed
[2007/09/21 20:27:42 | 000,000,000 | ---D | M] -- C:\Program Files\TOSHIBA
[2010/07/22 13:16:13 | 000,000,000 | ---D | M] -- C:\Program Files\Trend Micro
[2007/03/07 18:14:26 | 000,000,000 | ---D | M] -- C:\Program Files\Ulead Systems
[2006/11/02 14:01:55 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
[2010/03/23 02:14:27 | 000,000,000 | ---D | M] -- C:\Program Files\uTorrent
[2010/03/22 01:45:44 | 000,000,000 | ---D | M] -- C:\Program Files\Virtual Earth 3D
[2007/09/22 19:45:19 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Calendar
[2006/11/02 13:42:32 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Collaboration
[2007/09/22 19:45:15 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Defender
[2006/11/02 13:42:32 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Journal
[2007/12/24 18:00:27 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live
[2007/12/24 18:01:49 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live Favorites
[2007/12/24 18:02:15 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live Toolbar
[2010/04/15 03:23:37 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Mail
[2007/03/07 18:17:27 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Components
[2009/10/31 04:01:05 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2006/11/02 13:37:34 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2006/11/02 13:42:32 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Photo Gallery
[2008/01/13 19:57:07 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Sidebar
[2010/07/16 11:43:54 | 000,000,000 | ---D | M] -- C:\Program Files\WinRAR
[2010/07/01 09:56:09 | 000,000,000 | ---D | M] -- C:\Program Files\Yahoo!
[2008/11/22 18:34:44 | 000,000,000 | ---D | M] -- C:\Program Files\ZTE Mobile Connection

< %appdata%\*.* >
[2008/06/17 09:25:07 | 000,031,007 | ---- | M] () -- C:\Users\Jason\AppData\Roaming\UserTile.png


< MD5 for: AGP440.SYS >
[2008/01/19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\SoftwareDistribution\Download\a58fa8f1a78b89e6c2a670e288053b8b\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2006/11/02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\ERDNT\cache\AGP440.sys
[2006/11/02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006/11/02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/01/19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\SoftwareDistribution\Download\a58fa8f1a78b89e6c2a670e288053b8b\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008/02/17 22:22:26 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\ERDNT\cache\atapi.sys
[2008/02/17 22:22:26 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\drivers\atapi.sys
[2008/02/17 22:22:26 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008/02/17 22:22:26 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008/02/17 22:22:25 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\ERDNT\cache\cngaudit.dll
[2006/11/02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006/11/02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: DISK.SYS >
[2008/01/19 08:42:20 | 000,055,352 | ---- | M] (Microsoft Corporation) MD5=64109E623ABD6955C8FB110B592E68B7 -- C:\Windows\SoftwareDistribution\Download\a58fa8f1a78b89e6c2a670e288053b8b\x86_disk.inf_31bf3856ad364e35_6.0.6001.18000_none_f9c681e4742c835a\disk.sys
[2006/11/02 10:49:51 | 000,052,840 | ---- | M] (Microsoft Corporation) MD5=841AF4C4D41D3E3B2F244E976B0F7963 -- C:\Windows\System32\drivers\disk.sys
[2006/11/02 10:49:51 | 000,052,840 | ---- | M] (Microsoft Corporation) MD5=841AF4C4D41D3E3B2F244E976B0F7963 -- C:\Windows\System32\DriverStore\FileRepository\disk.inf_e0b0b355\disk.sys

< MD5 for: IASTORV.SYS >
[2008/01/19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\SoftwareDistribution\Download\a58fa8f1a78b89e6c2a670e288053b8b\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006/11/02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006/11/02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: KR10N.SYS >
[2007/01/18 15:47:18 | 000,211,072 | ---- | M] (TOSHIBA CORPORATION) MD5=6E9922332386C2A49936B30B2B6FD298 -- C:\Toshiba\Drivers\Raid\Kr10i\KR10N.sys
[2007/01/18 15:47:18 | 000,211,072 | ---- | M] (TOSHIBA CORPORATION) MD5=6E9922332386C2A49936B30B2B6FD298 -- C:\Toshiba\Drivers\Raid\Kr10n\KR10N.sys
[2007/01/18 15:47:18 | 000,211,072 | ---- | M] (TOSHIBA CORPORATION) MD5=6E9922332386C2A49936B30B2B6FD298 -- C:\Windows\System32\drivers\KR10N.sys
[2007/01/18 15:47:18 | 000,211,072 | ---- | M] (TOSHIBA CORPORATION) MD5=6E9922332386C2A49936B30B2B6FD298 -- C:\Windows\System32\DriverStore\FileRepository\kr10.inf_95888b8d\KR10N.sys

< MD5 for: NETLOGON.DLL >
[2006/11/02 10:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\ERDNT\cache\netlogon.dll
[2006/11/02 10:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\System32\netlogon.dll
[2006/11/02 10:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2008/01/19 08:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\SoftwareDistribution\Download\a58fa8f1a78b89e6c2a670e288053b8b\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2006/11/02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006/11/02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008/01/19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\SoftwareDistribution\Download\a58fa8f1a78b89e6c2a670e288053b8b\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: SCECLI.DLL >
[2008/01/19 08:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\SoftwareDistribution\Download\a58fa8f1a78b89e6c2a670e288053b8b\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006/11/02 10:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\ERDNT\cache\scecli.dll
[2006/11/02 10:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\System32\scecli.dll
[2006/11/02 10:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

< MD5 for: USBSTOR.SYS >
[2007/09/21 19:27:03 | 000,055,296 | ---- | M] (Microsoft Corporation) MD5=7887CE56934E7F104E98C975F47353C5 -- C:\Windows\System32\drivers\USBSTOR.SYS
[2007/09/21 19:27:03 | 000,055,296 | ---- | M] (Microsoft Corporation) MD5=7887CE56934E7F104E98C975F47353C5 -- C:\Windows\System32\DriverStore\FileRepository\usbstor.inf_8416e98e\USBSTOR.SYS
[2007/09/21 19:27:03 | 000,055,296 | ---- | M] (Microsoft Corporation) MD5=7887CE56934E7F104E98C975F47353C5 -- C:\Windows\winsxs\x86_usbstor.inf_31bf3856ad364e35_6.0.6000.16478_none_465c5f209ade1e53\USBSTOR.SYS
[2007/09/21 19:27:03 | 000,055,296 | ---- | M] (Microsoft Corporation) MD5=7DA1833F2B2500C755AB6C81C5ABFC88 -- C:\Windows\winsxs\x86_usbstor.inf_31bf3856ad364e35_6.0.6000.20588_none_46db2bffb403da0e\USBSTOR.SYS
[2008/01/19 06:53:22 | 000,055,296 | ---- | M] (Microsoft Corporation) MD5=87BA6B83C5D19B69160968D07D6E2982 -- C:\Windows\SoftwareDistribution\Download\a58fa8f1a78b89e6c2a670e288053b8b\x86_usbstor.inf_31bf3856ad364e35_6.0.6001.18000_none_48864eb697d31b43\USBSTOR.SYS
[2006/11/02 09:55:05 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=FDBAABF07244C60B0F4E0A6E71A107C6 -- C:\Windows\System32\DriverStore\FileRepository\usbstor.inf_bb2778a0\USBSTOR.SYS

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-07-22 15:37:10

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:D1B5B4F1
< End of report >

OTL Extras logfile created on: 23/07/2010 18:31:54 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Jason\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 45.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 60.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 73.06 Gb Total Space | 15.11 Gb Free Space | 20.68% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HONEYSUCKLE
Current User Name: Jason
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
"DoNotAllowExceptions" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0B7DDA73-0971-41A5-8A28-7FA70B8C4FB8}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{0C301C0F-9845-4E9B-A052-5577CB0FA9D5}" = lport=2869 | protocol=6 | dir=in | app=system |
"{0C976871-C60A-4164-9A68-DA718FEB0040}" = lport=137 | protocol=17 | dir=in | app=system |
"{189F75A3-2C04-4794-AC54-3BB3C384B54D}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 |
"{2B401717-BBB1-4387-BADF-44257CD9CC7A}" = lport=445 | protocol=6 | dir=in | app=system |
"{32F5EAB5-1CFC-40C6-8B63-0297CA90CA95}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{34774B5B-3980-4DC8-94F0-6C1740444E1B}" = lport=2869 | protocol=6 | dir=in | name=tcp 2869 |
"{3914C96F-904D-4F61-B6F7-DD0E1A57C7B2}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3B6319CD-C425-408A-ADA4-B9CA646AC69B}" = rport=10243 | protocol=6 | dir=out | app=system |
"{4172E8AA-091D-4F26-898D-91688FEE8BED}" = rport=137 | protocol=17 | dir=out | app=system |
"{45F10F86-6889-4B5F-A35E-B8C958478DC2}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6439D029-ED47-42C6-BCCC-C8AE09D82110}" = rport=138 | protocol=17 | dir=out | app=system |
"{6C17B065-7442-4235-BFCA-6851CA247128}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6CC88445-6A19-4FF3-9082-51918A9493FB}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{7458DB06-365C-45C9-B587-AB7F67F5CC3C}" = lport=139 | protocol=6 | dir=in | app=system |
"{7DAFB302-0B0A-4D1C-9B99-F116B787ECF6}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{8516AEA4-90F3-43CA-87E2-DAF41873277A}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8F0DF91F-38BB-4F02-B806-91569FDFBE8E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A7136B2B-CE6D-48F7-AB7A-E2750023E49F}" = lport=1900 | protocol=17 | dir=in | name=udp 1900 |
"{A9247A3C-B8C2-4BBA-B01D-FB0B1167DA8E}" = lport=10243 | protocol=6 | dir=in | app=system |
"{AEC950D8-531E-4E66-997B-295989AF1F1C}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BB4740F2-0BDE-4810-8FD7-CF03197CE918}" = lport=138 | protocol=17 | dir=in | app=system |
"{DB10413C-A207-4A63-8A74-DF8BFDFEA71E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{DF4E1E02-7FA6-4517-8293-992040C93422}" = lport=2869 | protocol=6 | dir=in | app=system |
"{E06D3C1D-ED15-4B0F-85AE-DCB022520CF5}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E5D5DF2E-2566-4C13-B01D-4FF99878D741}" = rport=445 | protocol=6 | dir=out | app=system |
"{E9DA6287-CFC2-4841-8C4C-CD2A200D2A74}" = rport=139 | protocol=6 | dir=out | app=system |
"{FE098812-71EC-49C5-BC08-95B230F9A349}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{024DCB4F-22F7-4D04-9A83-F0BACAD50E6C}" = protocol=17 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{0983563C-BAE4-44C9-B004-54808EB91BF1}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{0AE6BC4C-0968-469B-A456-02105551A3EA}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"{1133F9CA-9A55-4016-ADFE-D5C7F75B9194}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{13004897-44B3-461D-8A30-C3E01E37A65D}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"{146616F7-3A8B-4E1C-B974-AB757F7EB226}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{1759B842-EE36-4E44-87A3-B89AA71FD693}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{1B57E182-F9FA-4F57-AA84-7E8A33AB9C05}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1F0DFA4D-1683-419C-8B0B-1231B024CEBD}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"{2437953A-B370-4635-A17E-1C64EB7F8EA3}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{2AB13EAF-002C-4272-91E9-3DC5A038BB4D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{309540E2-C797-4FB9-A50A-B239084A624B}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{35FF602F-1EEF-4C42-BF7A-0534B8C557FE}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{38036970-EE9F-42C7-B82A-8A4093DAFF5C}" = protocol=17 | dir=in | app=c:\program files\sightspeed\sightspeed.exe |
"{3BA51483-9F46-4E37-A0E1-F4A2D4417DAD}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"{3C8B3195-4F53-4509-9F81-040246787864}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{403A1A96-E8EC-4405-8593-4A2092F0E6AF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{511A1830-02DB-4F31-A9BA-1AFEE2117063}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{5345852C-AE9A-4BBB-939F-1FBA49B76E78}" = protocol=6 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{57B1D607-8150-4B81-A9CD-4430BB5E2E4F}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{5DFDA773-4E21-4017-B225-67C479835C4B}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{60C1976C-4C31-4888-BA27-493D0EFCC85B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6F3A7173-0DC7-4AD9-953E-C2F2F8B450EC}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{7156EE9E-1095-4BB0-AD80-44501E042108}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{72F2BD3D-84B2-4129-8EC0-3C4563CE28A8}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{7F4EA716-4736-45C6-A6F9-84779173CE17}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{8E51E103-2311-4669-87CB-72507031E4E4}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{9BA51861-101D-4E59-8FED-F68FF2F11049}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{A0553037-0064-45BC-9F66-146230C6BC96}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A073C58D-0219-42D5-A2AD-0006965B1851}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{AFB32DB9-EA7E-4594-99B3-42A421992474}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{B063AB1F-88D1-4FA5-8C29-DAD7649B0819}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{CDA446E9-A6AF-4753-9FE9-846B992B3900}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D5B10C79-E795-42DD-961E-8861C584988C}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"{DAC52CE4-06A0-446A-B418-498739B321EE}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{DDB1CA8F-EB34-486D-A093-8804A6718CB2}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{E16C0B96-6EBE-405E-8CFD-3EF7AF1EF82A}" = protocol=6 | dir=in | app=c:\program files\sightspeed\sightspeed.exe |
"{E2125C32-24A8-4DAD-B440-3D99E291AB4B}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{FBE25D97-2AC6-4B7B-9AFC-6A9FC117F343}" = protocol=6 | dir=out | app=system |
"{FC842329-C734-4878-98C4-70F35EA190E2}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe |
"{FD7822FD-1B33-4155-A5BF-26E282792490}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"TCP Query User{33181E7C-F2C4-4D84-9F8D-9CD4A5272A51}C:\program files\windows sidebar\sidebar.exe" = protocol=6 | dir=in | app=c:\program files\windows sidebar\sidebar.exe |
"TCP Query User{D569A132-6533-4A3D-BE8A-2FFA8538FFB4}C:\program files\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"UDP Query User{3A9BF1AC-B5CE-4742-9618-EF4BF431A518}C:\program files\itunes\itunes.exe" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"UDP Query User{3DA37624-90F9-478E-874F-0743C2F2C143}C:\program files\windows sidebar\sidebar.exe" = protocol=17 | dir=in | app=c:\program files\windows sidebar\sidebar.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0020FEE2-7CDB-4250-B04B-81D68D3CA18B}" =
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0409969E-BEFB-44D3-90B9-63BE50FBAE5E}" = TIPCI
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{098A2A49-7CF3-4F08-A38D-FB879117152A}" = Adobe Color NA Extra Settings CS4
"{0C34B801-6AEC-4667-B053-03A67E2D0415}" = Apple Application Support
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup
"{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}" = Adobe Color EU Recommended Settings CS4
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver
"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1E04F83B-2AB9-4301-9EF7-E86307F79C72}" = Google Earth
"{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD for TOSHIBA
"{2290A680-4083-410A-ADCC-7092C67FC052}" = Toshiba Online Product Information
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23DD8A17-65DB-4D49-A2E0-164C6F460E3F}" = Adobe Photoshop Lightroom 3
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Driver Installation Program
"{2D87E961-577B-492B-AD54-1368680FB9A7}" = Bing Maps 3D
"{2FA41EBB-3F5A-35C3-85D6-51EC72A11FBD}" = Google Gears
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
"{341201D4-4F61-4ADB-987E-9CCE4D83A58D}" = Windows Live Toolbar Extension (Windows Live Toolbar)
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3AF8FCCD-F51A-4014-9002-F195E1CBC876}" = Logitech QuickCam
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{41BBDC08-ACFF-48C2-BD81-CA154C841351}" = Nokia Software Launcher
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{508CE775-4BA4-4748-82DF-FE28DA9F03B0}" = Windows Live Messenger
"{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password
"{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"{5980B928-1C95-4B3E-957B-B02D8147FF9E}" = Desktop SMS
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{6094AB91-4CC8-498E-9DFF-134CC0B159DE}" = PC Connectivity Solution
"{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{76B78008-3832-42FD-AE55-C8F946ED3C7E}" = muvee autoProducer 4.1
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7745B7A9-F323-4BB9-9811-01BF57A028DA}" = Map Button (Windows Live Toolbar)
"{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}" = Windows Live Favorites for Windows Live Toolbar
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
"{8F722FA9-B994-4C9B-B292-FD32D6206EDF}" = ASUS WLAN Card Utilities/Driver
"{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{903F2FE9-1751-4894-9D10-702F3AA0D6D5}" = Nokia NSeries Application Installer
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{972B1D9B-0EAD-49E8-B7D6-3B83FD5665B1}" = Nokia Connectivity Cable Driver
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A5C4AD72-25FE-4899-B6DF-6D8DF63C93CF}" = Highlight Viewer (Windows Live Toolbar)
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}" = Windows Live installer
"{A817131B-177D-4FB9-8317-C91138013600}" = Nokia NSeries One Touch Access
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1033-7B44-A70900000002}" = Adobe Reader 7.0.9
"{B0CC883F-D14A-4EBA-9355-4D23B223CF05}" = Nokia NSeries System Utilities
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BBC12E6C-C32F-470A-BF15-5A8C21066D1A}" = Nokia NSeries Content Copier
"{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}" = TOSHIBA ConfigFree
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C5C38AA6-C887-4B31-8B76-77C1CC40FFC7}" = ZTE Mobile Connection
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D5A145FC-D00C-4F1A-9119-EB4D9D659750}" = Windows Live Toolbar
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DA34FE93-5DC5-48E0-ACC8-A5389E05BB51}" = iTunes
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E4848436-0345-47E2-B648-8B522FCDA623}" = Adobe Photoshop CS4
"{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities
"{F084395C-40FB-4DB3-981C-B51E74E1E83D}" = Smart Menus (Windows Live Toolbar)
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}" = DVD MovieFactory for TOSHIBA
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe Extendscript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe_faf656ef605427ee2f42989c3ad31b8" = Adobe Photoshop CS4
"Advanced Video FX Engine" = Advanced Video FX Engine
"Akamai" = Akamai NetSession Interface
"Any Video Converter_is1" = Any Video Converter 3.0.3
"Belarc Advisor" = Belarc Advisor 8.1
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Creative Live! Cam Center" = Creative Live! Cam Center
"Creative Live! Cam Manager" = Creative Live! Cam Manager
"Creative Live! Cam Video IM Pro User's Guide English" = Creative Live! Cam Video IM Pro User's Guide (English)
"Creative Photo Calendar" = Creative Photo Calendar
"Creative Photo Manager" = Creative Photo Manager
"Creative VF0230" = Creative Live! Cam Video IM Pro Driver (1.01.03.0928)
"dlanconf" = devolo dLAN Configuration Wizard
"dslmon" = devolo Informer
"Easy Video Splitter_is1" = Easy Video Splitter 1.28
"easyclean" = devolo EasyClean
"easyshare" = devolo EasyShare
"EPSON Printer and Utilities" = EPSON Printer Software
"Free DVD Ripper 2.25_is1" = Free DVD Ripper Version 2.25
"FreeStar Free DVD Ripper" = FreeStar Free DVD Ripper 3.0.1
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007 Trial
"InstallShield_{0409969E-BEFB-44D3-90B9-63BE50FBAE5E}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD for TOSHIBA
"InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password
"InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility
"InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
"lvdrivers_11.80" = Logitech QuickCam Driver Package
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.6)" = Mozilla Firefox (3.6.6)
"Nokia NSeries Application Installer" = Nokia NSeries Application Installer 6.82.17
"Nokia NSeries Content Copier" = Nokia NSeries Content Copier 6.82.17
"Nokia NSeries One Touch Access" = Nokia NSeries One Touch Access 6.82.17
"Nokia NSeries System Utilities" = Nokia NSeries System Utilities 6.82.17
"NVIDIA Drivers" = NVIDIA Drivers
"PhotomatixPro3Betax32_is1" = Photomatix Pro version 3.2.5
"PhotoScape" = PhotoScape
"QuickGamma_is1" = QuickGamma 3.0.0.1
"RealPlayer 12.0" = RealPlayer
"Registry Mechanic_is1" = Registry Mechanic 9.0
"SightSpeed" = SightSpeed (remove only)
"SysInfo" = Creative System Information
"TOSHIBA Software Modem" = TOSHIBA Software Modem
"uTorrent" = µTorrent
"Windows Live Toolbar" = Windows Live Toolbar
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"WinRAR archiver" = WinRAR archiver

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 15/07/2010 13:19:20 | Computer Name = Honeysuckle | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 16/07/2010 06:20:45 | Computer Name = Honeysuckle | Source = Google Update | ID = 20
Description =

Error - 16/07/2010 06:28:32 | Computer Name = Honeysuckle | Source = Application Error | ID = 1000
Description = Faulting application Explorer.EXE, version 6.0.6000.16771, time stamp
0x4907deda, faulting module ntdll.dll, version 6.0.6000.16386, time stamp 0x4549bdc9,
exception code 0xc0000005, fault offset 0x00062086, process id 0x618, application
start time 0x01cb247336f75fbf.

Error - 17/07/2010 13:57:02 | Computer Name = Honeysuckle | Source = Application Error | ID = 1000
Description = Faulting application lightroom.exe, version 3.0.0.10, time stamp 0x4bf6e2de,
faulting module ui.dll, version 3.0.0.10, time stamp 0x4bf6e2e0, exception code
0xc0000005, fault offset 0x0007bc76, process id 0x2d54, application start time 0x01cb25d949c9e450.

Error - 19/07/2010 14:49:33 | Computer Name = Honeysuckle | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 20/07/2010 19:09:26 | Computer Name = Honeysuckle | Source = Google Update | ID = 20
Description =

Error - 20/07/2010 19:09:27 | Computer Name = Honeysuckle | Source = Google Update | ID = 20
Description =

Error - 22/07/2010 07:29:04 | Computer Name = Honeysuckle | Source = Application Error | ID = 1000
Description = Faulting application LVPrcSrv.exe, version 11.80.1048.0, time stamp
0x488b3c0e, faulting module USER32.dll, version 6.0.6000.16386, time stamp 0x4549bdc9,
exception code 0xc0000142, fault offset 0x00008fc7, process id 0x1558, application
start time 0x01cb29911645690d.

Error - 22/07/2010 07:36:50 | Computer Name = Honeysuckle | Source = Application Error | ID = 1000
Description = Faulting application LVPrcSrv.exe, version 11.80.1048.0, time stamp
0x488b3c0e, faulting module USER32.dll, version 6.0.6000.16386, time stamp 0x4549bdc9,
exception code 0xc0000142, fault offset 0x00008fc7, process id 0x1c04, application
start time 0x01cb29922c27903d.

Error - 22/07/2010 13:56:31 | Computer Name = Honeysuckle | Source = EventSystem | ID = 4609
Description =

[ Media Center Events ]
Error - 10/03/2009 19:07:00 | Computer Name = Karen-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.SqmFlushSession failed; Win32 GetLastError
returned 0D Process: DefaultDomain Object Name: Media Center Guide

Error - 10/03/2009 19:12:00 | Computer Name = Karen-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.SqmFlushSession failed; Win32 GetLastError
returned 0D Process: DefaultDomain Object Name: Media Center Guide

Error - 10/03/2009 19:17:00 | Computer Name = Karen-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.SqmFlushSession failed; Win32 GetLastError
returned 0D Process: DefaultDomain Object Name: Media Center Guide

Error - 10/03/2009 19:22:01 | Computer Name = Karen-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.SqmFlushSession failed; Win32 GetLastError
returned 0D Process: DefaultDomain Object Name: Media Center Guide

Error - 10/03/2009 19:27:00 | Computer Name = Karen-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.SqmFlushSession failed; Win32 GetLastError
returned 0D Process: DefaultDomain Object Name: Media Center Guide

Error - 10/03/2009 19:32:00 | Computer Name = Karen-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.SqmFlushSession failed; Win32 GetLastError
returned 0D Process: DefaultDomain Object Name: Media Center Guide

Error - 10/03/2009 19:37:00 | Computer Name = Karen-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.SqmFlushSession failed; Win32 GetLastError
returned 0D Process: DefaultDomain Object Name: Media Center Guide

Error - 10/03/2009 19:42:00 | Computer Name = Karen-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.SqmFlushSession failed; Win32 GetLastError
returned 0D Process: DefaultDomain Object Name: Media Center Guide

[ System Events ]
Error - 22/07/2010 13:55:37 | Computer Name = Honeysuckle | Source = EventLog | ID = 6008
Description = The previous system shutdown at 17:14:38 on 22/07/2010 was unexpected.

Error - 22/07/2010 13:56:23 | Computer Name = Honeysuckle | Source = DCOM | ID = 10005
Description =

Error - 22/07/2010 13:56:31 | Computer Name = Honeysuckle | Source = DCOM | ID = 10005
Description =

Error - 22/07/2010 13:56:34 | Computer Name = Honeysuckle | Source = DCOM | ID = 10005
Description =

Error - 22/07/2010 13:56:40 | Computer Name = Honeysuckle | Source = DCOM | ID = 10005
Description =

Error - 22/07/2010 13:56:46 | Computer Name = Honeysuckle | Source = Service Control Manager | ID = 7001
Description =

Error - 22/07/2010 13:56:46 | Computer Name = Honeysuckle | Source = Service Control Manager | ID = 7026
Description =

Error - 22/07/2010 14:01:20 | Computer Name = Honeysuckle | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.66 for the Network Card with network
address 001B9E05EC49 has been denied by the DHCP server 0.0.0.0 (The DHCP Server
sent a DHCPNACK message).

Error - 22/07/2010 14:11:19 | Computer Name = Honeysuckle | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.2.7 for the Network Card with network
address 001B9E05EC49 has been denied by the DHCP server 0.0.0.0 (The DHCP Server
sent a DHCPNACK message).

Error - 22/07/2010 14:13:36 | Computer Name = Honeysuckle | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.8 for the Network Card with network
address 001B9E05EC49 has been denied by the DHCP server 0.0.0.0 (The DHCP Server
sent a DHCPNACK message).


< End of report >

Please download Malwarebytes Anti-Malware from Malwarebytes.org.
Alternate link: BleepingComputer.com.
(Note: if you already have the program installed, just follow the directions. No need to re-download or re-install!)

Double Click mbam-setup.exe to install the application.

(Note: if you already have the program installed, open Malwarebytes from the Start Menu or Desktop shortcut, click the Update tab, and click Check for Updates, before doing the scan as instructed below!)

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. If you are prompted to restart, please allow it to restart your computer. Failure to do this, will cause the infection to still be active on the computer.
  
• Please save the log to a location you will remember.
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• The log can also be found at C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
  
• Copy and paste the entire report in your next reply.

Hi Jay, I have already done a MalwareBytes log in my first post. Would you like me to do another?

Sure.

Hi Jay, been away a few days, here is the scan log:


Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4316

Windows 6.0.6000
Internet Explorer 8.0.6001.18904

31/07/2010 13:35:23
mbam-log-2010-07-31 (13-35-23).txt

Scan type: Full scan (C:\|)
Objects scanned: 16023
Time elapsed: 2 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

ESET Online Scan

Please run a free online scan with the ESET Online Scanner

• Tick the box next to YES, I accept the Terms of Use
  
• Click Start
  
• When asked, allow the ActiveX control to install
  
• Click Start
  
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  
• Click Scan (This scan can take several hours, so please be patient)
  
• Once the scan is completed, you may close the window
  
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  
• Copy and paste that log as a reply to this topic

Here's the log mate, looks like it found something and killed it. My wifi is still knacked though...


ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=8cffc00b4000554dadeb1abea6bcb055
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-08-01 07:43:11
# local_time=2010-08-01 08:43:11 (+0000, GMT Daylight Time)
# country="United Kingdom"
# lang=1033
# osver=6.0.6000 NT
# compatibility_mode=512 16777215 100 0 883272 883272 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=5892 16776573 100 100 238760 118216973 0 0
# compatibility_mode=8192 67108863 100 0 168 168 0 0
# scanned=142902
# found=4
# cleaned=4
# scan_time=7546
C:\Users\Guest\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe Win32/Tenga.gen virus (cleaned - quarantined) 00000000000000000000000000000000 C
C:\Users\Jason\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\454aa3e3-65337d98 multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
C:\Users\Jason\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\556445eb-1b7d4370 probably a variant of Win32/Agent trojan (deleted - quarantined) 00000000000000000000000000000000 C
C:\Users\Jason\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\5473416c-66a15e6e multiple threats (deleted - quarantined) 00000000000000000000000000000000 C

Clear your Java Cache

• Click on Start-> Control Panel (Classic View)-> Java (looks like a coffee cup)
  • On the General tab, under Temporary Internet Files, click the Settings button.
  • Next, click on the Delete Files button
  • There are two options in the window to clear the cache - Leave BOTH Checked
    
    
    Applications and Applets
    Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.

---

Please download MySystem-Search from one of the following links:

Download mirror 1 Download mirror 2

• Save the file to your Desktop.
• Double-click on mss.exe
• Allow it to run, and follow the prompts.
• Once done, it will launch a log.
• Post it in your next reply.

Note: the logs are long. Please use more than one post, if necessary.

MySystem-Search


MSS v1.6


Basic System Information

Username: Jason - Date: 03/08/2010 - Time: 2:45:18

Microsoft Windows [Version 6.0.6000]
Processor type: x86 Family 6 Model 14 Stepping 12, GenuineIntel
Total processors: 2
Computer Name: HONEYSUCKLE
Logon Server: \\HONEYSUCKLE


CD Emulation Drivers running?



Peer-to-Peer applications?

uTorrent found!


File associations

.exe=exefile
.scr=scrfile
.pif=piffile
.com=ComFile
.bat=batfile
.cmd=cmdfile
.log=txtfile
.txt=txtfile
.reg=regfile
.sys=sysfile
.dll=dllfile
.ini=inifile
.inf=inffile


Running processes


Image Name PID Session Name Session# Mem Usage
========================= ======== ================ =========== ============
System Idle Process 0 Services 0 16 K
System 4 Services 0 2,568 K
smss.exe 492 Services 0 524 K
csrss.exe 588 Services 0 3,480 K
wininit.exe 628 Services 0 2,888 K
csrss.exe 640 Console 1 7,772 K
services.exe 672 Services 0 4,368 K
lsass.exe 684 Services 0 2,704 K
lsm.exe 692 Services 0 3,288 K
winlogon.exe 764 Console 1 4,056 K
svchost.exe 880 Services 0 5,716 K
PresentationFontCache.exe 920 Services 0 5,352 K
svchost.exe 960 Services 0 5,616 K
svchost.exe 1016 Services 0 26,004 K
svchost.exe 1096 Services 0 9,064 K
svchost.exe 1124 Services 0 66,372 K
svchost.exe 1148 Services 0 24,192 K
audiodg.exe 1204 Services 0 11,840 K
svchost.exe 1296 Services 0 3,480 K
SLsvc.exe 1312 Services 0 3,644 K
svchost.exe 1360 Services 0 11,524 K
svchost.exe 1480 Services 0 12,436 K
spoolsv.exe 1808 Services 0 10,164 K
svchost.exe 1844 Services 0 11,576 K
agrsmsvc.exe 296 Services 0 1,916 K
svchost.exe 436 Services 0 9,124 K
AppleMobileDeviceService. 500 Services 0 3,004 K
ASWLCCSVC.exe 568 Services 0 2,780 K
cdrom_mon.exe 12 Services 0 1,984 K
mDNSResponder.exe 576 Services 0 3,660 K
CFSvcs.exe 620 Services 0 680 K
LVComSer.exe 1760 Services 0 4,216 K
LVPrcSrv.exe 868 Services 0 3,672 K
GoogleUpdate.exe 2092 Services 0 2,412 K
StartManSvc.exe 2104 Services 0 4,720 K
GoogleCrashHandler.exe 2140 Services 0 524 K
LVComSer.exe 2152 Console 1 3,844 K
svchost.exe 2252 Services 0 3,996 K
dwm.exe 2300 Console 1 112,164 K
svchost.exe 2372 Services 0 4,936 K
TODDSrv.exe 2436 Services 0 2,728 K
explorer.exe 2496 Console 1 57,396 K
TosCoSrv.exe 2544 Services 0 2,460 K
TosBtSrv.exe 2576 Services 0 2,756 K
ULCDRSvr.exe 2636 Services 0 1,232 K
svchost.exe 2668 Services 0 2,804 K
SearchIndexer.exe 2724 Services 0 13,944 K
taskeng.exe 3132 Services 0 4,968 K
taskeng.exe 3244 Console 1 9,844 K
MSASCui.exe 3476 Console 1 5,312 K
RtHDVCpl.exe 3540 Console 1 5,040 K
TPwrMain.exe 3636 Console 1 4,292 K
SmoothView.exe 3732 Console 1 2,660 K
TCrdMain.exe 3784 Console 1 16,908 K
KeNotify.exe 3804 Console 1 4,496 K
NDSTray.exe 3860 Console 1 5,712 K
TOPI.exe 3896 Console 1 12,052 K
igfxtray.exe 3996 Console 1 3,436 K
hkcmd.exe 4020 Console 1 3,496 K
igfxpers.exe 4080 Console 1 3,752 K
Apoint.exe 2224 Console 1 6,864 K
StartFX.exe 2772 Console 1 3,636 K
V0230Mon.exe 2784 Console 1 3,596 K
Communications_Helper.exe 2332 Console 1 6,484 K
Quickcam.exe 3004 Console 1 7,144 K
rundll32.exe 2940 Console 1 3,300 K
NSLauncher.exe 1920 Console 1 7,380 K
iTunesHelper.exe 3724 Console 1 6,208 K
ApMsgFwd.exe 4240 Console 1 2,416 K
jusched.exe 4576 Console 1 2,900 K
SSDMonitor.exe 4612 Console 1 2,496 K
sidebar.exe 4652 Console 1 22,660 K
GoogleToolbarNotifier.exe 4716 Console 1 4,396 K
ehtray.exe 4768 Console 1 1,436 K
CTLCMgr.exe 4804 Console 1 5,312 K
GoogleUpdate.exe 4828 Console 1 2,480 K
Center.exe 4928 Console 1 8,760 K
wmpnscfg.exe 4976 Console 1 4,072 K
ApntEx.exe 4988 Console 1 2,948 K
LogitechDesktopMessenger. 5072 Console 1 4,200 K
GoogleCrashHandler.exe 5176 Console 1 2,484 K
ehmsas.exe 5288 Console 1 2,960 K
wmpnetwk.exe 5468 Services 0 13,632 K
RegMech.exe 5804 Console 1 7,024 K
sidebar.exe 5924 Console 1 12,912 K
CFSwMgr.exe 3880 Console 1 5,524 K
COCIManager.exe 2188 Console 1 5,816 K
iPodService.exe 4220 Services 0 3,900 K
unsecapp.exe 4312 Console 1 5,064 K
WmiPrvSE.exe 5140 Services 0 4,612 K
ServiceLayer.exe 4072 Services 0 5,584 K
mmc.exe 4524 Console 1 8,400 K
Keygen.exe 4560 Console 1 7,508 K
Photoshop.exe 1104 Console 1 97,608 K
FNPLicensingService.exe 4044 Services 0 2,416 K
wuauclt.exe 6280 Console 1 4,368 K
lightroom.exe 5456 Console 1 118,348 K
wisptis.exe 6164 Console 1 5,656 K
realsched.exe 10180 Console 1 208 K
WerFault.exe 9132 Console 1 11,108 K
AAM Updates Notifier.exe 8352 Console 1 10,776 K
SearchProtocolHost.exe 9040 Services 0 9,316 K
chrome.exe 9116 Console 1 57,204 K
chrome.exe 8772 Console 1 33,760 K
mss.exe 6796 Console 1 4,284 K
cmd.exe 8380 Console 1 3,088 K
SearchFilterHost.exe 6516 Services 0 4,704 K
tasklist.exe 10056 Console 1 4,644 K
WmiPrvSE.exe 8388 Services 0 5,668 K


Hidden objects

PATH: C:\windows

Installer
msdownld.tmp
QTFont.qfn
WindowsShell.Manifest


PATH: C:\windows\system32

7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
desktop.ini
msjint40E.dll


PATH: C:\windows\system32\drivers

Msft_Kernel_Apfiltr_01001.Wdf
Msft_Kernel_TpChoice_01005.Wdf
TOSHIBA_EQUIUM A200_05140-AV_PSAE2E-00D00.MRK


PATH: C:\

bootmgr
Documents and Settings
IO.SYS
MSDOS.SYS
pagefile.sys
sqmdata00.sqm
sqmdata01.sqm
sqmdata02.sqm
sqmdata03.sqm
sqmdata04.sqm
sqmdata05.sqm
sqmdata06.sqm
sqmdata07.sqm
sqmdata08.sqm
sqmdata09.sqm
sqmdata10.sqm
sqmdata11.sqm
sqmdata12.sqm
sqmdata13.sqm
sqmdata14.sqm
sqmdata15.sqm
sqmdata16.sqm
sqmdata17.sqm
sqmdata18.sqm
sqmdata19.sqm
sqmnoopt00.sqm
sqmnoopt01.sqm
sqmnoopt02.sqm
sqmnoopt03.sqm
sqmnoopt04.sqm
sqmnoopt05.sqm
sqmnoopt06.sqm
sqmnoopt07.sqm
sqmnoopt08.sqm
sqmnoopt09.sqm
sqmnoopt10.sqm
sqmnoopt11.sqm
sqmnoopt12.sqm
sqmnoopt13.sqm
sqmnoopt14.sqm
sqmnoopt15.sqm
sqmnoopt16.sqm
sqmnoopt17.sqm
sqmnoopt18.sqm
sqmnoopt19.sqm
SWSTAMP.TXT
System Volume Information


User Profile check

Guest
Jason
Public


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
ProfilesDirectory REG_EXPAND_SZ %SystemDrive%\Users
Default REG_EXPAND_SZ %SystemDrive%\Users\Default
Public REG_EXPAND_SZ %SystemDrive%\Users\Public
ProgramData REG_EXPAND_SZ %SystemDrive%\ProgramData

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
Flags REG_DWORD 0xc
State REG_DWORD 0x0
RefCount REG_DWORD 0x1
Sid REG_BINARY 010100000000000512000000
ProfileImagePath REG_EXPAND_SZ %systemroot%\system32\config\systemprofile

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19
ProfileImagePath REG_EXPAND_SZ %SystemRoot%\ServiceProfiles\LocalService
Flags REG_DWORD 0x0
State REG_DWORD 0x0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20
ProfileImagePath REG_EXPAND_SZ %SystemRoot%\ServiceProfiles\NetworkService
Flags REG_DWORD 0x0
State REG_DWORD 0x0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1462146042-3541615459-1316551158-1000
ProfileImagePath REG_EXPAND_SZ C:\Users\Jason
Flags REG_DWORD 0x0
State REG_DWORD 0x100
Sid REG_BINARY 010500000000000515000000FA93265763C318D3F6F9784EE8030000
ProfileLoadTimeLow REG_DWORD 0x0
ProfileLoadTimeHigh REG_DWORD 0x0
RefCount REG_DWORD 0x1
RunLogonScriptSync REG_DWORD 0x0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1462146042-3541615459-1316551158-501
ProfileImagePath REG_EXPAND_SZ C:\Users\Guest
Flags REG_DWORD 0x0
State REG_DWORD 0x284
Sid REG_BINARY 010500000000000515000000FA93265763C318D3F6F9784EF5010000
ProfileLoadTimeLow REG_DWORD 0x0
ProfileLoadTimeHigh REG_DWORD 0x0
RefCount REG_DWORD 0x0
RunLogonScriptSync REG_DWORD 0x0



Current Scheduled Tasks

PATH: C:\Windows\Tasks

Check Updates for Windows Live Toolbar.job
GoogleUpdateTaskMachineCore.job
GoogleUpdateTaskMachineUA.job
GoogleUpdateTaskUserS-1-5-21-1462146042-3541615459-1316551158-1000Core.job
GoogleUpdateTaskUserS-1-5-21-1462146042-3541615459-1316551158-1000UA.job
SCHEDLGU.TXT
SA.DAT
User_Feed_Synchronization-{2EF4932C-CCD5-4095-803C-0A6EF70F8FA2}.job


Windows Drivers and NT-Services

Volume in drive C is Vista
Volume Serial Number is 9CA1-81C4

Directory of C:\Windows\System32\Drivers

21/09/2007 20:29 0 Msft_Kernel_Apfiltr_01001.Wdf
07/03/2007 18:30 0 Msft_Kernel_TpChoice_01005.Wdf
21/09/2007 20:24 0 TOSHIBA_EQUIUM A200_05140-AV_PSAE2E-00D00.MRK
3 File(s) 0 bytes
0 Dir(s) 12,484,825,088 bytes free
Volume in drive C is Vista
Volume Serial Number is 9CA1-81C4

Directory of C:\Windows\System32\Drivers

17/07/2002 16:20 84,832 ASPI32.SYS
10/08/2005 02:16 3,716 V0230FwF.bin
10/08/2005 02:16 3,716 V0230FwH.bin
23/03/2006 18:00 6,272 V0230Vfx.sys
06/07/2006 13:44 168,448 tifm21.sys
28/07/2006 17:25 19,456 LPCFilter.sys
30/08/2006 09:35 140,800 Apfiltr.sys
18/09/2006 22:26 3,440,660 gm.dls
18/09/2006 22:26 646 gmreadme.txt
18/09/2006 22:43 3 MsftWdf_Kernel_01005_Inbox_Critical.Wdf
28/09/2006 18:01 500,480 V0230VID.sys
05/10/2006 23:22 16,768 TVALZ_O.SYS
18/10/2006 12:50 16,128 tdcmdpst.sys
23/10/2006 17:32 9,216 tosrfec.sys
02/11/2006 07:37 20,480 secdrv.sys
02/11/2006 08:16 551,936 spsys.sys
02/11/2006 08:30 1,781,760 NETw3v32.sys
02/11/2006 08:30 117,760 E1G60I32.sys
02/11/2006 08:36 235,520 HdAudio.sys
02/11/2006 08:36 20,608 ntrigdigi.sys
02/11/2006 09:24 62,336 BrSerWdm.sys
02/11/2006 09:24 12,160 BrUsbMdm.sys
02/11/2006 09:24 13,568 BrFiltLo.sys
02/11/2006 09:24 5,248 BrFiltUp.sys
02/11/2006 09:24 11,904 BrUsbSer.sys
02/11/2006 09:25 71,808 BrSerId.sys
02/11/2006 09:30 40,960 amdk8.sys
02/11/2006 09:30 39,424 intelppm.sys
02/11/2006 09:30 38,400 processr.sys
02/11/2006 09:30 38,912 amdk7.sys
02/11/2006 09:30 38,912 crusoe.sys
02/11/2006 09:30 39,424 viac7.sys
02/11/2006 09:30 142,336 fastfat.sys
02/11/2006 09:30 70,144 cdfs.sys
02/11/2006 09:30 22,528 msfs.sys
02/11/2006 09:30 225,280 udfs.sys
02/11/2006 09:30 34,816 npfs.sys
02/11/2006 09:31 74,752 dfsc.sys
02/11/2006 09:31 69,632 bowser.sys
02/11/2006 09:31 222,208 rdbss.sys
02/11/2006 09:32 27,648 filetrace.sys
02/11/2006 09:33 83,456 luafv.sys
02/11/2006 09:35 11,264 wmiacpi.sys
02/11/2006 09:37 32,256 watchdog.sys
02/11/2006 09:38 13,312 dxapi.sys
02/11/2006 09:38 76,288 dxg.sys
02/11/2006 09:42 65,536 IPMIDrv.sys
02/11/2006 09:51 6,144 beep.sys
02/11/2006 09:51 4,608 null.sys
02/11/2006 09:51 15,872 mouhid.sys
02/11/2006 09:51 15,872 kbdhid.sys
02/11/2006 09:51 5,888 mspclock.sys
02/11/2006 09:51 6,016 mstee.sys
02/11/2006 09:51 5,504 mspqm.sys
02/11/2006 09:51 8,192 mskssrv.sys
02/11/2006 09:51 8,704 parvdm.sys
02/11/2006 09:51 17,920 serenum.sys
02/11/2006 09:51 17,408 smclib.sys
02/11/2006 09:51 79,360 parport.sys
02/11/2006 09:51 83,456 serial.sys
02/11/2006 09:51 20,480 flpydisk.sys
02/11/2006 09:51 25,088 fdc.sys
02/11/2006 09:51 19,456 Diskdump.sys
02/11/2006 09:51 12,800 sffp_mmc.sys
02/11/2006 09:51 13,312 sfloppy.sys
02/11/2006 09:51 67,072 cdrom.sys
02/11/2006 09:51 24,576 tape.sys
02/11/2006 09:52 18,944 mcd.sys
02/11/2006 09:52 20,608 wacompen.sys
02/11/2006 09:53 25,088 vga.sys
02/11/2006 09:53 26,112 vgapnp.sys
02/11/2006 09:54 109,056 videoprt.sys
02/11/2006 09:54 51,712 WUDFPf.sys
02/11/2006 09:54 82,560 WUDFRd.sys
02/11/2006 09:54 5,632 drmkaud.sys
02/11/2006 09:55 25,472 hidparse.sys
02/11/2006 09:55 52,864 stream.sys
02/11/2006 09:55 38,912 hidclass.sys
02/11/2006 09:55 12,288 hidusb.sys
02/11/2006 09:55 21,504 hidir.sys
02/11/2006 09:55 167,424 portcls.sys
02/11/2006 09:55 71,552 USBAUDIO.sys
02/11/2006 09:55 19,456 usbohci.sys
02/11/2006 09:55 35,328 circlass.sys
02/11/2006 09:55 25,728 USBCAMD.sys
02/11/2006 09:55 25,728 USBCAMD2.sys
02/11/2006 09:55 68,608 usbcir.sys
02/11/2006 09:55 53,376 1394bus.sys
02/11/2006 09:55 62,080 ohci1394.sys
02/11/2006 09:55 132,352 usbvideo.sys
02/11/2006 09:55 29,184 hidbth.sys
02/11/2006 09:55 7,168 umpass.sys
02/11/2006 09:55 39,936 bthmodem.sys
02/11/2006 09:55 34,816 umbus.sys
02/11/2006 09:56 60,416 rspndr.sys
02/11/2006 09:56 47,104 lltdio.sys
02/11/2006 09:57 13,312 irenum.sys
02/11/2006 09:57 95,744 irda.sys
02/11/2006 09:57 66,048 smb.sys
02/11/2006 09:57 184,320 netbt.sys
02/11/2006 09:57 16,896 ndisuio.sys
02/11/2006 09:57 35,840 netbios.sys
02/11/2006 09:57 84,992 FWPKCLNT.SYS
02/11/2006 09:57 16,384 nsiproxy.sys
02/11/2006 09:57 68,096 tdx.sys
02/11/2006 09:57 27,648 tcpipreg.sys
02/11/2006 09:57 32,768 RNDISMP.sys
02/11/2006 09:57 14,848 usb8023.sys
02/11/2006 09:58 47,104 ipfltdrv.sys
02/11/2006 09:58 99,840 ipnat.sys
02/11/2006 09:58 17,408 asyncmac.sys
02/11/2006 09:58 41,472 raspppoe.sys
02/11/2006 09:58 11,776 rasacd.sys
02/11/2006 09:58 75,776 rasl2tp.sys
02/11/2006 09:58 118,784 ndiswan.sys
02/11/2006 09:58 61,440 raspptp.sys
02/11/2006 09:58 15,872 ws2ifsl.sys
02/11/2006 09:58 270,336 afd.sys
02/11/2006 09:58 20,992 tdi.sys
02/11/2006 09:58 8,192 rootmdm.sys
02/11/2006 09:58 31,744 modem.sys
02/11/2006 10:02 17,920 tdpipe.sys
02/11/2006 10:02 28,672 tdtcp.sys
02/11/2006 10:02 6,144 RDPCDD.sys
02/11/2006 10:02 6,144 RDPENCDD.sys
02/11/2006 10:02 23,552 tssecsrv.sys
02/11/2006 10:02 160,256 rdpwd.sys
02/11/2006 10:03 242,688 rdpdr.sys
02/11/2006 10:04 39,936 WpdUsb.sys
02/11/2006 10:04 878,080 PEAuth.sys
02/11/2006 10:14 18,944 usbprint.sys
02/11/2006 10:20 130,048 drmk.sys
02/11/2006 10:23 93,184 bridge.sys
02/11/2006 10:49 13,928 msisadrv.sys
02/11/2006 10:49 12,776 swenum.sys
02/11/2006 10:49 13,416 pciide.sys
02/11/2006 10:49 14,952 aliide.sys
02/11/2006 10:49 16,488 i2omgmt.sys
02/11/2006 10:49 15,464 amdide.sys
02/11/2006 10:49 15,464 wmilib.sys
02/11/2006 10:49 16,488 cmdide.sys
02/11/2006 10:49 17,512 viaide.sys
02/11/2006 10:49 18,536 spldr.sys
02/11/2006 10:49 19,560 wd.sys
02/11/2006 10:49 22,632 crcdisk.sys
02/11/2006 10:49 23,144 msahci.sys
02/11/2006 10:49 26,728 Dumpata.sys
02/11/2006 10:49 27,752 i2omp.sys
02/11/2006 10:49 52,840 disk.sys
02/11/2006 10:49 53,352 SISAGP.SYS
02/11/2006 10:49 53,864 AGP440.sys
02/11/2006 10:49 54,376 VIAAGP.SYS
02/11/2006 10:49 28,776 megasas.sys
02/11/2006 10:49 28,776 mssmbios.sys
02/11/2006 10:49 31,848 sym_hi.sys
02/11/2006 10:49 54,888 mountmgr.sys
02/11/2006 10:49 56,424 fileinfo.sys
02/11/2006 10:49 54,888 AMDAGP.SYS
02/11/2006 10:49 33,384 Mraid35x.sys
02/11/2006 10:49 56,936 UAGP35.SYS
02/11/2006 10:50 33,384 crashdmp.sys
02/11/2006 10:50 34,920 sym_u3.sys
02/11/2006 10:50 58,472 ULIAGPKX.SYS
02/11/2006 10:50 58,984 GAGP30KX.SYS
02/11/2006 10:50 65,640 lsi_fc.sys
02/11/2006 10:50 35,944 symc8xx.sys
02/11/2006 10:50 65,640 lsi_sas.sys
02/11/2006 10:50 35,944 iteatapi.sys
02/11/2006 10:50 35,944 iteraid.sys
02/11/2006 10:50 67,688 arc.sys
02/11/2006 10:50 65,640 lsi_scsi.sys
02/11/2006 10:50 37,480 HpCISSs.sys
02/11/2006 10:50 38,504 sisraid2.sys
02/11/2006 10:50 67,688 arcsas.sys
02/11/2006 10:50 71,272 djsvs.sys
02/11/2006 10:50 40,040 nvstor.sys
02/11/2006 10:50 76,392 sbp2port.sys
02/11/2006 10:50 71,784 sisraid4.sys
02/11/2006 10:50 78,952 mpio.sys
02/11/2006 10:50 41,576 iirsp.sys
02/11/2006 10:50 80,488 msdsm.sys
02/11/2006 10:50 45,160 nfrd960.sys
02/11/2006 10:50 49,256 partmgr.sys
02/11/2006 10:50 47,208 isapnp.sys
02/11/2006 10:50 46,696 mup.sys
02/11/2006 10:50 50,280 volmgr.sys
02/11/2006 10:50 88,680 nvraid.sys
02/11/2006 10:50 50,792 termdd.sys
02/11/2006 10:50 98,408 ulsata.sys
02/11/2006 10:50 98,408 adpu160m.sys
02/11/2006 10:50 106,088 ql40xx.sys
02/11/2006 10:50 106,600 NV_AGP.SYS
02/11/2006 10:50 112,232 vsmraid.sys
02/11/2006 10:50 115,816 ulsata2.sys
02/11/2006 10:50 117,864 Storport.sys
02/11/2006 10:50 125,032 Classpnp.sys
02/11/2006 10:50 140,392 pci.sys
02/11/2006 10:50 140,392 scsiport.sys
02/11/2006 10:51 147,048 adpu320.sys
02/11/2006 10:51 160,872 msrpc.sys
02/11/2006 10:51 167,528 pcmcia.sys
02/11/2006 10:51 168,552 msiscsi.sys
02/11/2006 10:51 183,912 fltMgr.sys
02/11/2006 10:51 232,040 iaStorV.sys
02/11/2006 10:51 235,112 uliahci.sys
02/11/2006 10:51 290,408 volmgrx.sys
02/11/2006 10:51 297,576 adpahci.sys
02/11/2006 10:51 316,520 elxstor.sys
02/11/2006 10:51 420,968 adp94xx.sys
02/11/2006 10:51 500,840 ndis.sys
02/11/2006 10:51 900,712 ql2300.sys
02/11/2006 13:34 31,232 qwavedrv.sys
02/11/2006 13:34 132,200 ecache.sys
02/11/2006 13:34 12,288 bdasup.sys
04/11/2006 09:35 59,392 Rtlh86.sys
28/11/2006 15:11 1,161,888 AGRSM.sys
28/11/2006 21:39 1,476,096 igdkmd32.sys
28/11/2006 21:46 41,280 PCASp50a64.sys
28/11/2006 21:46 52,800 PCASp50.sys
13/01/2007 09:40 4,452,288 nvlddmkm.sys
18/01/2007 15:40 219,392 KR10I.sys
18/01/2007 15:47 211,072 KR10N.sys
18/01/2007 18:56 1,729,632 RTKVHDA.sys
23/01/2007 16:25 689,664 athr.sys
04/02/2007 20:37 176 RTHDAEQ0.dat
07/02/2007 17:16 176 RTHDAEQ1.dat
22/02/2007 10:15 12,288 nmwcdcj.sys
22/02/2007 10:15 12,288 nmwcdcm.sys
22/02/2007 10:15 8,320 nmwcdc.sys
22/02/2007 10:15 137,216 nmwcd.sys
21/09/2007 19:04 12,800 fs_rec.sys
21/09/2007 19:09 53,760 hdaudbus.sys
21/09/2007 19:15 82,432 sdbus.sys
21/09/2007 19:15 13,312 sffdisk.sys
21/09/2007 19:15 12,800 sffp_sd.sys
21/09/2007 19:23 63,488 mpsdrv.sys
21/09/2007 19:27 55,296 USBSTOR.SYS
22/09/2007 19:29 619,008 dxgkrnl.sys
22/09/2007 19:29 70,144 pacer.sys
22/09/2007 19:29 61,952 wanarp.sys
22/09/2007 19:29 48,640 ndproxy.sys
22/09/2007 19:29 20,480 ndistapi.sys
12/10/2007 10:03 101,120 ZTEusbmdm6k.sys
12/10/2007 10:03 101,120 ZTEusbnmea.sys
12/10/2007 10:03 101,120 ZTEusbser6k.sys
27/11/2007 00:01 73,216 usbccgp.sys
27/11/2007 00:01 224,768 usbport.sys
27/11/2007 00:01 38,400 usbehci.sys
27/11/2007 00:01 23,040 usbuhci.sys
27/11/2007 00:01 193,536 usbhub.sys
27/11/2007 00:01 5,888 usbd.sys
27/11/2007 00:02 28,344 battc.sys
27/11/2007 00:02 14,208 CmBatt.sys
27/11/2007 00:02 258,232 acpi.sys
27/11/2007 00:02 20,920 compbatt.sys
13/01/2008 19:38 211,000 volsnap.sys
17/02/2008 22:22 154,624 nwifi.sys
17/02/2008 22:22 17,464 intelide.sys
17/02/2008 22:22 109,624 ataport.sys
17/02/2008 22:22 45,112 pciidex.sys
17/02/2008 22:22 21,560 atapi.sys
17/02/2008 22:24 54,784 i8042prt.sys
17/02/2008 22:24 35,384 kbdclass.sys
17/02/2008 22:24 34,360 mouclass.sys
17/02/2008 22:24 19,968 sermouse.sys
17/02/2008 22:24 495,160 Wdf01000.sys
17/02/2008 22:24 35,384 WdfLdr.sys
17/02/2008 22:26 110,080 mrxdav.sys
08/03/2008 03:14 148,992 ks.sys
12/03/2008 03:00 9,072 cdr4_xp.sys
12/03/2008 03:00 9,200 cdralw2k.sys
14/03/2008 09:38 41,984 monitor.sys
14/03/2008 09:38 1,060,920 ntfs.sys
10/05/2008 02:21 113,664 rmcast.sys
26/07/2008 07:44 146,680 LVFeL001.cfg
26/07/2008 07:44 69,592 LVFaL000.cfg
26/07/2008 07:44 227,172 LVFeL000.cfg
26/07/2008 07:44 85,302 LVFeL002.cfg
26/07/2008 08:25 25,624 LVPr2Mon.sys
26/07/2008 16:25 627,864 lvrs.sys
26/07/2008 16:26 41,752 LVUSBSta.sys
26/07/2008 16:26 4,658,584 lvuvc.sys
14/08/2008 08:57 74,720 adfs.sys
17/04/2009 03:00 44,944 pxhelp20.sys
18/05/2009 14:17 26,600 GEARAspiWDM.sys
15/06/2009 19:12 408,136 ksecdd.sys
30/06/2009 18:15 729,088 netr28u.sys
14/08/2009 18:16 213,592 netio.sys
28/08/2009 19:42 40,448 usbaapl.sys
14/09/2009 10:50 130,048 srv2.sys
06/10/2009 20:06 0 lvuvc.hs
11/12/2009 13:15 84,992 srvnet.sys
11/12/2009 13:15 306,688 srv.sys
12/02/2010 04:02 en-US
18/02/2010 13:04 15,360 TUNMP.SYS
18/02/2010 13:04 25,088 tunnel.sys
18/02/2010 13:05 815,104 tcpip.sys
20/02/2010 22:30 396,800 http.sys
23/02/2010 14:14 102,400 mrxsmb.sys
23/02/2010 14:14 58,368 mrxsmb20.sys
23/02/2010 14:14 211,968 mrxsmb10.sys
04/04/2010 21:00 21,419 AegisP.sys
29/04/2010 15:39 20,952 mbam.sys
29/04/2010 15:39 38,224 mbamswissarmy.sys
04/05/2010 03:40 UMDF
22/07/2010 17:03 etc
02/08/2010 01:00 .
02/08/2010 01:00 ..
303 File(s) 46,348,170 bytes
5 Dir(s) 12,484,808,704 bytes free


Virtual drives found?



Environment variables

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Jason\AppData\Roaming
CHROME_RESTART=Google Chrome|Whoa! Google Chrome has crashed. Restart now?|LEFT_TO_RIGHT
CHROME_VERSION=5.0.375.125
CLASSPATH=.;C:\Program Files\Java\jre1.6.0\lib\ext\QTJava.zip
com.adobe.versioncue.client.applocale=en_US
com.adobe.versioncue.client.appname=AdobeDrive
com.adobe.versioncue.client.appversion=1.0.0
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=HONEYSUCKLE
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Jason
LOCALAPPDATA=C:\Users\Jason\AppData\Local
LOGONSERVER=\\HONEYSUCKLE
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\Users\Jason\AppData\Local\Google\Chrome\Application;C:\Windows\system32;C:\Windows;C:\Windows\system32\wbem;C:\Program Files\PC Connectivity Solution;C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG;C:\Program Files\QuickTime\QTSystem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 14 Stepping 12, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0e0c
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
PROMPT=$P$G
PUBLIC=C:\Users\Public
QTJAVA=C:\Program Files\Java\jre1.6.0\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Jason\AppData\Local\Temp
TMP=C:\Users\Jason\AppData\Local\Temp
USERDOMAIN=HONEYSUCKLE
USERNAME=Jason
USERPROFILE=C:\Users\Jason
windir=C:\Windows


Stealth malware?


Internet Explorer


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
Start Page REG_SZ http://go.microsoft.com/fwlink/?LinkId=69157
AutoHide REG_SZ yes
Default_Page_URL REG_SZ http://go.microsoft.com/fwlink/?LinkId=69157
Default_Secondary_Page_URL REG_MULTI_SZ
Default_Search_URL REG_SZ http://go.microsoft.com/fwlink/?LinkId=54896
Search Page REG_SZ http://go.microsoft.com/fwlink/?LinkId=54896
Extensions Off Page REG_SZ about:NoAdd-ons
Security Risk Page REG_SZ about:SecurityRisk
Enable_Disk_Cache REG_SZ yes
Cache_Percent_of_Disk REG_BINARY 0A000000
Delete_Temp_Files_On_Exit REG_SZ yes
Local Page REG_SZ C:\Windows\System32\blank.htm
Anchor_Visitation_Horizon REG_BINARY 01000000
Use_Async_DNS REG_SZ yes
Placeholder_Width REG_BINARY 1A000000
Placeholder_Height REG_BINARY 1A000000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\ErrorThresholds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\UrlTemplate

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
IE5_UA_Backup_Flag REG_SZ 5.0
User Agent REG_SZ Mozilla/4.0 (compatible; MSIE 8.0; Win32)
EmailName REG_SZ IEUser@
AutoConfigProxy REG_SZ wininet.dll
MimeExclusionListForCache REG_SZ multipart/mixed multipart/x-mixed-replace multipart/x-byteranges
UseSchannelDirectly REG_BINARY 01000000
EnableHttp1_1 REG_DWORD 0x1
PrivDiscUiShown REG_DWORD 0x1
WarnOnIntranet REG_DWORD 0x1
EnableNegotiate REG_DWORD 0x1
WarnOnPost REG_BINARY 01000000
UrlEncoding REG_DWORD 0x0
SecureProtocols REG_DWORD 0xa0
PrivacyAdvanced REG_DWORD 0x0
DisableCachingOfSSLPages REG_DWORD 0x0
WarnonZoneCrossing REG_DWORD 0x0
CertificateRevocation REG_DWORD 0x1
MigrateProxy REG_DWORD 0x1
ProxyEnable REG_DWORD 0x0
ZonesSecurityUpgradeDone REG_DWORD 0x1
EnableAutodial REG_DWORD 0x0
NoNetAutodial REG_DWORD 0x0
GlobalUserOffline REG_DWORD 0x0
SyncMode5 REG_DWORD 0x4
ProxyHttp1.1 REG_DWORD 0x1
ShowPunycode REG_DWORD 0x0
EnablePunycode REG_DWORD 0x1
DisableIDNPrompt REG_DWORD 0x0
WarnonBadCertRecving REG_DWORD 0x1
WarnOnPostRedirect REG_DWORD 0x0
ProxyOverride REG_SZ *.local
ZonesSecurityUpgrade REG_BINARY AC27640D33AFCA01
5 REG_BINARY C29403C22559147FF329355432F301880FF730478C9D8F2249541BE88F11DA9E34CBBAB756E1331827555F980DB86A9E0C7F380DDBFC9B6472E0C5B032993C6018AF
4 REG_BINARY 519608D38AA62DBB4A64C51EF50B9F99B7E8E7D3A12D091644E6BE4D473EFFC3A5D63B7CBDB31D0B6B10D69112E8D27E490C3A895AAD18F1910E8591D692D9A8B838953ADFEACE80C974B93A7D76A24FFE5F458F496C173446CD29F0E81286C409FD767CA3A50CE0557B724FB823796563C35EAA54D57277F2B1DE1A125E4AD9CE218FBC75E9B88754C3433A7B7726BA568D33AE40536E3CDFCD8948158198DB3CF83B0C11CAF64D09ADBFEA82AD1087FBBD49EF39C9C06362944655A8EFFA3D98C78BB06829C80AC06C9B9B05D63DE995924A4FFFDEE13068019CF0A293407CB73577A3D75323CAEE3EED07D624874560602055D532288D663FC635C0A0A9C313717CBF1026760CD00473551413FA693CA847D6D5C19538381A77097F77D3C03AE7F554A9DC2EB6FE917C9CACD9E6EB49B55823D1ABBB226E9EA8B573D030FCE53779B07E3F2BDEC506342C5FA74CE6B3EE23971626686D691BA9F5C00B08FE5063F295967B8D9D9B15F173004F831D15346F0A6253C3C90F62A2FD4E04E95CF56843296507DCA1EF4673D1C7DA707C85CFEAB495AC63EA68176B54085586C58ABB56186A9A89FC6C09DAB97AE113BF25ED5769A25D9121B9EAFAB282606C711B8729B3815950E6CFE7320BDEA0FBA6A7C915808F803586CA9E23C6E97400E7541A4538B79EB3B1F2A96617428E55281FE4603D5A82E6D67B031BC4FE7B0CAA819CD1499935309C1AFF59225686EA578B8DADA6A9572C79A2FC269253CD828F0256644279C51338D8B89C95E584827537551F8DC06C574983A44491D25A1E52B861C46903939C66276591444334154357C7776ADF7815909C08A1F79215D5A342844A592808BE6CD1F07BAF6AC9E7D80EE016F3DF77D8461C4D3A33D77828F7D67807EC714E6B37BE1261CB6A029FE8264B308FBE7D1E352D9EB257CE640EDA330CE9BFCAEDCF6A0E3F2D746E24BFCD082D6BE000CC4749A40749A3BCE011661E79F8FDF94498C779725024CC32866E52CBA64B7EAE63887097AC3E4722C3EF5CE10844C88539F795BF05F8EEE08700C71439E75A818A27384111E471F8E137652CF7076862067D76A65FC621B1C3B02EBA5F47EBA33379B96279B5E675C39FC63C90ABD9BDC47AF565044186CFD70EF6DEB5880EEA66226BC871528E84C87E21BC88595222648314F8273DE933214D50E827FF61B6C727DF437937521B155626D55D09599BE96E87562B3B042ADD33A8959F2D911681064E9BE7E9FB496FD8279B9DA5843556D762494A20998A6EF4632EAAE853408A441266551390FEE8D8CAD9CA6D873A37C0819A3E920F5F27F5974E560961A7590242EC85AFF2C203D825061CBD299CE8164FB47CA2A20DEBF9B1008D30ACBDD7B09176245A40B0A03D40EFCF5471589957319B591AE94AFA738CE9F276B1451B6E57D66E1B151A809E2DC9F370DFC8E3224B66792C3FF9FA8D38088356C23AE1C368E7808C2F17060E72ABB29AD665D932C78AD48A816F67435F4F908F6160E6466EF55D1B5E32E6F4B59227437D701C0246313069014C73199E0B6C80D1186FB6308FD424AC781E4EADBAB628F5A40E843A7D6780CDE4255783B63E6DDC6B2474B556441FFB87C969CE51449F0A5C81D3A809340ECDA76271C20ECBA1ECC5D027A4945ED8C849A554B232F11ADAF6FFED9FB0F8BB2E249AE60F443B5AF5255B771E48AD143DC145A5BF3E13EF1BA14E69FBF4B69C2FFCE77ACDBA94A5A0050930D3CFBA36971580F62AC49CE0594E1B0AE283E24239E32677226700D80A00FB405966C27F4EED9A1455AFBF26AB31B1E6175FEA32475F96BB08EF785177A24440762E83CA908B479173CEFBC789B3FDC2F483842B22934C454BBF847CC77A0D228C8BDFE6DA22B2E4028276E294CD6DEFE09CB6732ED6AE684BF9AC31C992684F2B1E80BF0A88D21A60F4E0CC9FA5E5BFBB24996BB33D3013C7E03A693EC4061F474F1043321A4309BC59C6D564BAC995EFB06640F872D8DD0C14C93499B35455515EFB9CBB1727F7BD3684A3AEA385520D6574F96087B6F463297ECA501D910CBE2F8C7652E0E949A356719274BF35E1CADC882BB322305B2D25368B1E05C825D06BB68FF3FDA98A7188D99E5BF5ED2180630BC2B28289C0EA79C5ADAC10C3A30372A6B20FE060C8DB1706B6FBCC747C5F21CEF90A85A1C05A289C428EE82384BFF7B9A19AA24CF3CCAF8C99EEFDEB6B01CF12AE65E61CFED5ED8818500698F4F1A5313D24A57FEFBC83E6D2A78ED531C629E07718A746BAF4465468111371804A490DD66472790424EAB731401A1A3D66710DB6AF0B8AF9BFEC29072515653CA510741129C231EDB8E5105245783305172F0A3195923E38C7763B322CC30019AE0D33A0CF3E387343496753D98803729559683E4485FBBDD19D694D151E479043219622CB9548BB41A5365090673314BE1088A85CB39934930F46D9DB4C34F340B38FA99B789D07CC8FF8E72843599569F9F594B21BADC41F2731393486FF1680B3D50E7C2FF92C981F768EFA23017C70FF0352FADE89C34532F1F13B59E508BFDF706CEE69505A95A3CC15E5EDA9E86D9764DBA731273749F0117FE92AD152B8444A52EB4E6BD16CC84B5D25EBD1445768836318B6663BCA2549348D644B933EF67789CA6C69FA1BF72022761A49913766403D18DBF976B31D2B62E5638F4E09D4D11D581F5FE701E6EA1C2C8CD2E19E8040C28CC359CA9F294CD8898251C4F1DD1AD5C162BC48CA7D021C918643DE86F89CCF556E90071BE537D14E6774EE8F25A32ECC806ADC3A905477751857EB479E57FC209B6A26A36EC1C631F369D1600D05D460CB3ADBA930B9AC78CE61D3D13C3722A0FDE5648529AD39036F385FC67A08FD730F00BFCAF88F96F9A4666FB4A0CE39555E549CB991CA74154DC3AA3F52DD1D2D989F11CF29F599001CCAAB4C23F37CFD307037BC19EF3ACB77C96DB3B2058D0ECC486C37C0658EE0848822079DAAB3548D21E9ACD1A305EC114DCF52CF1B3066CB2C374B4E3EA0C434DC4F78087264555D84ACDB247B49BDB6504A28B7BF368C36035EEF1641156F8ED62414842F560F313DFCE90489330E9918CF6B23413FCFCB656A08BDA29A219E83C433F85435F9F3CDDDA63883FD52F4AAB5FC7A92B00CA8FC45C775210D6CB7171ED8379F0BD55E0CFCEE14048F372608604F7F6D700FC598573A8A8865A6D9D6DEDBCF24C8C812C76DF9576914BA7C312C8A05E28D75AE959F2DE1C607A497F346877520386FB1E6E2BDE05895C1111E90FD23C09C00D70E1532536A746CF8F97D2927AC57B431F187C9C9797ADDB9120F3A511FD314B60765262189D6AF9E5888BEDACCF21CCE46D2014C293B98AD65AC07A1697ED75FCAD68C3899394721692806A4BFF3DD22AF8DB8BD284A45898D4F2DA5298AD4DDABD2A7F9E49B1A26D89A36F122AD889384558C68FC25F9DDDD16514112E2842BB949FBDC1EA5A7068E8E8C63E54E66B3925D1E4B8888EC31023941F624DCA277F06407BC8D20028718758A348CC8081AA0847E6D0B0C4EC5541EA12AD3723B281EB13998F084CBE46050ABA3912EDD482B68C99F7542E9F45169DD8EA9B1183D83D18D16E42D821F4EF7D34EF3333BCD23998414A5CE3366D113F080362D42C61AB9BDD7FC6BEB4FBDD39E286B3F78F5E813CC902E822FCC4B6C63AA05920FE47688E9E56EF04FAF8C285F3C0C57821752026DB23A532072EE45E038F0715B9B8CCF81C907E36EDA84122593FBCEE1C3899EE56EE57BD8A93AB2E2434E584E675197EE88FCFEA5744A28D2ABF94104E09C784E9AA30F6AD5F91EB7B80E31F3CE5447CD559D9118D96C6DB7285C6A1332C04634606D29D883EE91088E423FD1808D956FD29536AE371568EE91EFD5DDFDCF0CAF24ABE980A2A28F6B52DF98BB8452F6278E8FFD821EAF760C65ED153CB140440F2B7864654EA15D8F42606525EEEC73839732DA6BB03941CBC34ABDAAB61D4A3DA651CCA208FDAD07346474EF4C6806A0E8826F4AAD6BFCB1E1BD9DEE8D5CAC27F6CF5686458E3B97908594B91406423E0F9DCCB9D3279D759CB1D3D4D6901814D6635A28BE72296DCC8CE0F3E0AA2C0C756F70CBA2C199A8287540E8084708C1BD62A6A71BD55455F17F109B8CDDFB56FD7484064EDEA22D208C14D6249B854127C704A35E602FAEA1AECABB88A86A4FD56FD57642E06D1DEDEFADA41CB73304B7CEF749AEC95BAB68DC06D912C99128EF192FF980AED9477AE9FB134E98686523F611F78FFBA97225BBA6CB05421BEEE1BE8F8927B90C7908B58B5F3385F06022EED7C790595B76E86A60729E78CA0D742AC70ADE9DA9FFDE6F3B832860F1C4803BDBAD2E069AD343F93D9C7EBC76ED63304AB9B02BE17F29AF8438B8DF3327828B86556ED28703F502618F9AC81200FDE88DDEE5023398B2EFAB53084AC17FBD6DE5EA8BBA30266ADDE108B51487C848E64F23159A50829D522AF28A5E83DB713E28DAA12AE66E3BD4B8965CDBA2F31DC0BFA23C5203E7D1D4E205AD04DC7EDD7AF463F2F606BD3CD1FCEA744A90CDFF5FAE6DBA1E39B81F88DB2CA60C24D885B5AD7534FA405F2BF23F52307B0E37E45CEAF56E4207CD7C48197FF3088B89E9B4B521A6599A201AE0B2F321F912B3DCFF2D7FF7EF4611BEE837239851A493DEACCD052B4A787ECDFD592655103E85441C2F00752633558B231BD79B43013DA46BED9C4675B4BA4C2494251DC8ABA1F15B446EFB56D74F441568B054ACC2736BBF17463371DB48FB23B563BFAFD713F46439A7BBB531112125C659BDBCEE06420AA1D99708F58009457080721F3BBAF4B7C420C5D0BE5CC53CB365F5F27795DB8549C2A0DEE0DAB0DB643449133B5205705060565CF54B1000AD952B14F3C245A225065FA2A8DD585993A8ED9B773E6FDE9FB24D3C1F59532D39CE8FEE02173593FEEF2E84A128E1685F7A39C574C09E02CA45CC5805ADF6F55B9F62EA5BDA7109C892350CBA818B3842125AD989A242EE4038EADBC41C63E6D29B23AD38FD84D17065FCDA0BA64A16608E794841814EC41E77B82470BD48090ABD3E36480AC4372D3DB2CE53A5A09FA59F50989440F7B7EBC3B71447D4066E5764822E64F036385085E1D13FEEEC4AE57D1F7866FE3E7A2616619FE41B2F20DCDDECB4FF356958EEDB58FAF413F6A57BB60422FDD963611D209C1CC6C31FF9E1BEFA4FE1D76371EB402DBEEC71B4864CC6100601C4BAC69E83E715F353757A5902CCFC3B4444B0C7CCC9666D93000ED96FB18FAD162F0F208A95172371F44A8F0EA165CBDF39B20B0F0A80502008227A731F87579B6B5997420351C135FB35568C9B0CEADC7BFF4EA41536832287C36788AEAD98F6F983F0F5B52B3CA8C951093EC3F91E964FF8709DD34B6156FD7F359BC7198F8D19020D59B74361CED109855140D2D23E23DC91874DDDD6185CBD3BA6E7590473F32A18F53886F5C7D167781378F5EA82B13615245BD00E5558CD47D8315B99DA3EBD649D0CEF4A28FBD5FA3AF301EB1BED6469F81D81460B3863342D31A1EDD7CF4DA09404632C3FFC569F09A26B17AAC1842AA6F516AD82F2B6E9E5F3360119E09E5512466C5CC7B7193EB36E07B3C86B307363ADF376823EE66E5B210D167ECE4B0BA5F41B0175DC269F42334D89BD7DCDDBA41FB99B5E4597069087CEBEF2D66E65FBF880540129CFEAEB51A4BDEED87C45F351ACB7228338D37DD531DBB0E8D90DF4F42A60E45333F171B6B1E7D497E9C58604BDE24D68B1CF69D946722B0E83F1419B58F860ADFE3B2C2F3369C6B0B293E5562D045E04A9D2E3F108F6516967891314BCDAF87C925022E28218659ECF3FAE83922656564F155DC19F591DCB9B109892474489DA8B7033E594476AF97B06E66D6FED8418E30395EAB02EC2F092ED45A9A26662038C968ACDFA43860FDE668854965E30A8BF5DC6EC03ACA5E4FD831E9FC8192260D4FBAF31D7D0EDBAD6581F98C12F0A9805AB4E7978BD4D2528735B614ECC6BD2BE1932F76BD304BF6716AF8087A50CD56052298E5A4FDF6FC657C1ACD37C09245A3772B737482EEE3FADDC215BCAF27FC3A52EC67D872C72784FBD767DC694F241F71E21B14589FE50C627979DE8A0ED52178765CB33CB1A4258585872057E8DDE7E9BCCAB9F4BD0611845F5B88E1DA09272565D3E13C1C5DD553A5F29CF8B28E5B96F123F9D65DC4666E87542F537217CE8B80FBB8729BA9C9708CA6161B038D82F0A608D5A0A24F412C566674893609D04A03B569B8A94C58813787016AEB4A70407F15635D2F1310BF94D9DB2D8BE695792F140A47F6FBCE7A62892AB8632C926F737AFD8112F2B3CE85AB45471D4DD7D3894AB0443E8001560F108CE19382821E71EBE449AB01C1858954AC918D86C0459A7E49FEC38243D1250395CE9AEAD1C23B605C5479398BD406385B79AB59CCD84BEC2BC7623BE111571E25D93929EBE4DBFC793C8643D87241E89BCD95C7E9A08AA4ABEA0C4604A22CF309CEABB65EBB667803ED5F933FDBBB35A0F18D14C0F939A0F1ADC7A38323F03C4BAD7FBEC2AC2C5C1BF92C1B61E59618F3A9439EC53EA71343B1E14A6499FA9AA02124B939735BBD7FB37781B78D17266769DC9B119A6B82997219425D8B4AF3DB87E22983A7FD91B9F34117FD9845E67B05812AB5BD65E7A37F349F8CF185E6EFB525A5D96B163705E148ADC8DCDF4FA3581860D4B72A00BCB33781D96627ACE8C42ED94049E52DF0AABF0F68A4C44E8FBB48C09F68A61CB38AB05E2D54B38E2884EECD0B34E37D61F64A10FF296912F28B8BFB0D35180181ADE51F27B1B312F01BBA4EF6F7E7AA55315777535E857E1DBEDF83EAFD47421A44E19965FB268371459E039ACC5E88C4D5805DD55CEA68554E3CAB8531015186021C0881D5DEFC3AA70AE6B51995AB686CDF81DA7DE271D367EAECCCFA076EF05D5593CE75A9F23A1F174989ED2FCBFDD5748D97E12CA624C83BA4A59B91415A4ECA31788CDE4975BB4F3389538A62243B7DF251BC06E96E383DF54988A015CC80DA8E1B10DE2F3419BB5801D69E8F438D6E99EE07155CB5A3B2A73B5C68AFA0B56807F312B71EE15FD046DFF677CDC069A0EA03309C4B37AE5E1AFB0789EBE4032D74C7CC2F22D5F5166AF41AC4E251C6E3311C0A0BA2DF33F62B79F483DB8D049DF49FE6FD174FA1EA097E7BDE775E5DA9CE4419B64CD86F7CAC0FF04C9140ED2F7D1FECA7E2258B96BA49B798DEFF7DE22C472AF056BE9481BEFE8EDECAD8D60EB1BA478A3E4944E5DA6D5631409CB2F20A1C272D56129D69F53B9DD5C68FBB319D4DA70196C80021F66966582CA3F32CB09328F759A9A72AAC031B884035D1E590376A3BD76443AF633356593AFF20F1C744660D7C352DA8872EA19ECD75CF787195F79B438A39F2F2BBA876C28DF8596F512F4E7BC97905BB423E30FB1A503F2BB850B72B08A2E3B44B6E7D8C65573255F21D700E5ED01772E21F88C0A8954DD9AA48299654CF64A9FDAABA1C90534C27CF90D8B4F4F307350E0401EE17FC900E16C8DE6D12AE361E4EA5129D5D7A1908D7F89385FA9FC292B5710F3A66AE39462DFC4D3FE95A758E4BC1CCCD45E93D5D42001A7BEAE4BE46E55C58AC9C727D39BA4600A169EC6911230D32AA02CC0646B8E7157BC3DE83B9288C482C609785E88FA1760DDD33E9C6F59F55A31976F995EB1A3465D75A3391913917E9CF51F0B2AC7C1B64B94F7488DFEA6AA562F745BB1BD10553018FE50A1AB5A1739391A221765EFC2AFF79B92046897EE6C0B47223BC12DDB9B7BD3DCD01CE6E7D4E09BEDC7FD5DF08C1739C5AF9A7D00621B3A6F645458CA102DCB604E1C53D266F3F84E379326F19FD1D026DCFB4011E7334961B22B9CE7A2E3F875BB5B874962E54526EB98450CBA56EF30081974F6837984E6BADCD1A99E4DB915ECAA6A650FA8A75B783C9938DBA889A7016A0E39BFEC1F962CBB6242CC9FF8E8CC359F635FEFE2A8E4A678DD1E71C932C7ED81F5E36394EFFC13F29D10F9FB03A3DC65B5D7E97205317426C00BA1CE1497B22AE3E32A7B7F302AA775DD95049FD4BAC6C80867376A2187535BBA2C9077E19772C289E2127911D5849E64CD866384E929BD0B443F1AD3D5338DF52CE56DC1BC6E0D75AEB76F123B9EB9B313B02D2EFB6E7E7C96D6C537E9FBF2A000C62A6158F983EB943D952BFA808282F2DB49F50D803A5C2849C504D5FB0D7BE0A1027CCACE3195677EE39A94232BA513B971F1DD5284CA08581C24184928F4B27C45CBC0DD81EFA9A0675D7510CDA926F40B07BC18F1A6CE4034EC64D55D728FB9FAD549A29E845060B1B632B07982EBF0DC47EC90FA5D959DE4B04C723A3AC498751A9E11745D54A2163D134C9D3B4A4D422440CCB53B07FAD0C35F1B7D5029DB93B75264F11BE97F78CF267CB3C7F4BFBE773D6DDDA0A092298A34AF1300A34BDA2B872F41DC41C5F0716F4F6FC8D028E5A49F9A5C0DCC8F61559C7798D58205C9590F1B0B58BE93EAD127FB8E8B0412AE3ADB1CD3AB5DD06E9A374F66ABD39E1CB2317378A9AF13855C0B9BA0052919F9E6145DFF97FB455FC57E5932B323875D89C43723090CBDC11003EBD8EAA24DB2D384AA16522CED7505ABA3D5442EC38F12AFC9D00C253958F5D27F7AC01A2A09435516580887807B586620594AF6DE034ED4770CB94D428DB474283C3564228EF3F164FA83B64BD3CC7729D16C4CD5D6B46F48F13D3F5E77F97FAE4CA5708ADCE099BCD11A8DDCFCDFBE6B00FC800859E5B751DCEBD29100CE77215FD77698535B60D4D41A4C545E4F5CBDBC5D4F2C14E3407E517F7F1D77B640E9AEF0C475481E382C281BCECCFDBFDB231A3882D957CE9ADC02F9BCE9C06089DEAE93826D26D30E2AEFFEC18A7A45F6535F1CCE0F9625227FA5F20D468F4B62F74A06C84527E771215D0ED629825121DA72C1754E7862049D414B0F285AD459BCFB77CAA97EB08035EE4EEFA9BF38189B2FBF45860A4485F43BC9F511A212D578EEB181EB6E9B94C58F21BFF0BEB41465FFA05E61037D00E633E62489B052CE7DF5725514BC6865AA68C66A195F6CA7A9CB1EC398B7E2E6CD44A06CF24FDE044683459EC3C9889C754FE8A86E431E3E077782C2B2E9542EBD67537CE5CB661E9705B56EB78BE5F32553BF3373D4EF75171079C6F7E94EAC5A7969AE3BAF6ADE36174AFEEB0F2C46B5E3F25482867523ECE5FB0B1D88140F39C85BBBB1463E4D4DEDD02659AD4454E45017C33A574885C97D9987BE2EBE89970A59F5E2784AD0CB23A0553E8F62E416D16BE5AB1F29C9F6324E2A4D57A4723BE863E0D9716BC45EF70E84BF6F2CA0ADAD619B2760910737451B3A482F195DA88CFF38714B753C00EF884348D268064EE3695084D85DE3CD14605B7B5727BA558571D634703CED2DB39776BBFED5BADDACDA3AB4741647FAB718B782EDD88F0696464C81AB73871BB5B9E14343BFEE8EFF25613FC7840A601EEFC7AA31D7C60D7BDE5795D0B3046345F6D249F2495C7B93268D2AE288AD8B7CBBD8D9D6281E7FB6E228B21761C8C2B675C9A4E64C437CEF0B95275C63444B2029719F51A96E92979CE9331D15FC2D9237457F69EB16DA1203DD3644A4C4F5A5C1DF9E3FC18890DDB3FCF10FDE303F2C1EC4A9DC810C6860B4CA34ECA641D78D9834234AAB5BE6F50167A8C45DE783377F19B50D8493CFCF749239F812780F4F06C3A91391E90EBDDCFF438DD422F5076A64B3B9B53CE08C7A4A56DF16A739201B5543B4EB259DCAF660AB855382CEA5DB041FB787E3E17FC9242A2CD205384E4408AF7B90ECC8FB6AC48DE9E879ECEA37E4D08FDB93B177ABF07425183D181FE8E55B98B374C64A108B54C4BCFC8B9D51E03FE65857F9BE92757AD5CD72D1B7FE233061862670F1844FB1B5B25EE085C8CB7D8E48ED32FE7E8DCB741F2FCFDD8A5C2E932DB2C669A5700D5B9FF75665991CED23A45D898A41789824D6EADF65E856BA0C1554B611
2 REG_BINARY E931EB081DF069302D85D1513364B090146441804747F28C6729F23F7B9727F3D21469EBAD142EF42274C7944B69C7DA28
7 REG_BINARY 90F4FD8549D94F57DDC8A40C6AF1B6C928E66ACE
8 REG_BINARY A9ABA5D8AC8257856C6B2F33033A8EA998D84A7C53B4BE93607583DE7E8E07D31C886F1BAC35DE42B887E398890F641604E221DE943012C8C688307796C7
3 REG_BINARY 760DA3B4B662E5A6A9E07D65991A14D89C4FC42F91A1DEB390189CDFE995CA75C8A5C068497F8FECF824D06E48095EF683CB506E41E86F4BEAAA990F
WarnOnHTTPSToHTTPRedirect REG_DWORD 0x1

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Activities
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Protocols
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Disable Script Debugger REG_SZ yes
Anchor Underline REG_SZ yes
Cache_Update_Frequency REG_SZ Once_Per_Session
Display Inline Images REG_SZ yes
Do404Search REG_BINARY 01000000
Local Page REG_SZ C:\Windows\system32\blank.htm
Save_Session_History_On_Exit REG_SZ no
Show_FullURL REG_SZ no
Show_StatusBar REG_SZ yes
Show_ToolBar REG_SZ yes
Show_URLinStatusBar REG_SZ yes
Show_URLToolBar REG_SZ yes
Use_DlgBox_Colors REG_SZ yes
Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
XMLHTTP REG_DWORD 0x1
NoUpdateCheck REG_DWORD 0x1
UseClearType REG_SZ no
Enable Browser Extensions REG_SZ yes
Play_Background_Sounds REG_SZ yes
Play_Animations REG_SZ yes
Start Page REG_SZ http://www.google.co.uk/
CompatibilityFlags REG_DWORD 0x80000000
StartPageCache REG_DWORD 0x1
FullScreen REG_SZ no
SearchMigrated REG_DWORD 0x0
Window_Placement REG_BINARY 2C0000000200000003000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF2500000025000000450300007D020000
RunOnceComplete REG_DWORD 0x1
RunOnceHasShown REG_DWORD 0x1
Use FormSuggest REG_SZ yes
NotifyDownloadComplete REG_SZ yes
FormSuggest Passwords REG_SZ yes
FormSuggest PW Ask REG_SZ yes
Expand Alt Text REG_SZ no
Move System Caret REG_SZ no
NscSingleExpand REG_DWORD 0x0
DisableScriptDebuggerIE REG_SZ yes
Error Dlg Displayed On Every Error REG_SZ no
Page_Transitions REG_DWORD 0x1
UseThemes REG_DWORD 0x1
EnableSearchPane REG_DWORD 0x0
Force Offscreen Composition REG_DWORD 0x0
AllowWindowReuse REG_DWORD 0x1
Friendly http errors REG_SZ yes
SmoothScroll REG_DWORD 0x1
Enable AutoImageResize REG_SZ yes
Show image placeholders REG_DWORD 0x0
Print_Background REG_SZ no
AutoSearch REG_DWORD 0x4
ShowedCheckBrowser REG_SZ Yes
Check_Associations REG_SZ no
IE8RunOnceLastShown REG_DWORD 0x1
IE8RunOnceLastShown_TIMESTAMP REG_BINARY 5584DC962B06CB01
IE8TourShown REG_DWORD 0x1
IE8TourShownTime REG_BINARY EC4D779833AFCA01
AutoHide REG_SZ yes
AlwaysShowMenus REG_DWORD 0x1
IE8RunOncePerInstallCompleted REG_DWORD 0x1
IE8RunOnceCompletionTime REG_BINARY 152DCCB62B06CB01

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Default Feeds
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search
CustomizeSearch REG_SZ http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
SearchAssistant REG_SZ http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm


HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks
{CFBFAE00-17A6-11D0-99CB-00C04FD64497} REG_SZ


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} REG_BINARY 00
{2318C2B1-4965-11d4-9B18-009027A5CD4F} REG_BINARY 00


HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt
CurrentLiveFavMenuExt REG_SZ Add to Windows &Live Favorites

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&Windows Live Search
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Add to Windows &Live Favorites
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...


Protocol hijack?



Security Center


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
cval REG_DWORD 0x1
FirewallDisableNotify REG_DWORD 0x0
AntiVirusDisableNotify REG_DWORD 0x0
UpdatesDisableNotify REG_DWORD 0x0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring
DisableMonitoring REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
AntiVirusOverride REG_DWORD 0x0
AntiSpywareOverride REG_DWORD 0x0
FirewallOverride REG_DWORD 0x0


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x0
DoNotAllowExceptions REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging



Uninstall List


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player Plugin
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe_faf656ef605427ee2f42989c3ad31b8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced Video FX Engine
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Akamai
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Any Video Converter_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Belarc Advisor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Creative Live! Cam Center
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Creative Live! Cam Manager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Creative Live! Cam Video IM Pro User's Guide English
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Creative Photo Calendar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Creative Photo Manager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Creative VF0230
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dlanconf
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dslmon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Easy Video Splitter_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\easyclean
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\easyshare
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EPSON Printer and Utilities
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ESET Online Scanner
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Free DVD Ripper 2.25_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FreeStar Free DVD Ripper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HDMI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMESTUDENTR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield Uninstall Information
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield_{0409969E-BEFB-44D3-90B9-63BE50FBAE5E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield_{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KB931906
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KB954156
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Logitech VideoCall
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lvdrivers_11.80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Malwarebytes' Anti-Malware_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft .NET Framework 3.5 SP1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox (3.6.6)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Nokia NSeries Application Installer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Nokia NSeries Content Copier
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Nokia NSeries One Touch Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Nokia NSeries System Utilities
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NVIDIA Drivers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PhotomatixPro3Betax32_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PhotoScape
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickGamma_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RealPlayer 12.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Registry Mechanic_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SightSpeed
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SysInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TOSHIBA Software Modem
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Windows Live Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Windows Media Encoder 9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinRAR archiver
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0020FEE2-7CDB-4250-B04B-81D68D3CA18B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0409969E-BEFB-44D3-90B9-63BE50FBAE5E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{05308C4E-7285-4066-BAE3-6B50DA6ED755}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{054EFA56-2AC1-48F4-A883-0AB89874B972}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{07287123-B8AC-41CE-8346-3D777245C35B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{08D2E121-7F6A-43EB-97FD-629B44903403}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{098727E1-775A-4450-B573-3F441F1CA243}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{098A2A49-7CF3-4F08-A38D-FB879117152A}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0C34B801-6AEC-4667-B053-03A67E2D0415}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0D6013AB-A0C7-41DC-973C-E93129C9A29F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0F723FC1-7606-4867-866C-CE80AD292DAF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12B3A009-A080-4619-9A2A-C6DB151D8D67}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{15B3F9F8-4CF9-452A-9AF2-AA8553765DA7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{15FEDA5F-141C-4127-8D7E-B962D1742728}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1618734A-3957-4ADD-8199-F973763109A8}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{16E16F01-2E2D-4248-A42F-76261C147B6C}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{18455581-E099-4BA8-BC6B-F34B2F06600C}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{20471B27-D702-4FE8-8DEC-0702CC8C0A85}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2290A680-4083-410A-ADCC-7092C67FC052}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{23DD8A17-65DB-4D49-A2E0-164C6F460E3F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F83216020FF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{28006915-2739-4EBE-B5E8-49B25D32EB33}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2C81600D-D6C7-4687-9362-DD4A78B3483E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2D87E961-577B-492B-AD54-1368680FB9A7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2FA41EBB-3F5A-35C3-85D6-51EC72A11FBD}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160000}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{341201D4-4F61-4ADB-987E-9CCE4D83A58D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3AF8FCCD-F51A-4014-9002-F195E1CBC876}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3CF0858D-1AC5-4308-9DE7-AD15288A8BDC}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{41BBDC08-ACFF-48C2-BD81-CA154C841351}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{45A66726-69BC-466B-A7A4-12FCBA4883D7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{513D9FB1-27A2-44E4-8F2D-77A6737921A5}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5279374D-87FE-4879-9385-F17278EBB9D3}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5980B928-1C95-4B3E-957B-B02D8147FF9E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5CDDF96A-BC34-4D72-9ABA-E1FFF0C39977}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5DA0E02F-970B-424B-BF41-513A5018E4C0}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6094AB91-4CC8-498E-9DFF-134CC0B159DE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{617C36FD-0CBE-4600-84B2-441CEB12FADF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{620BBA5E-F848-4D56-8BDA-584E44584C5E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{622E6F16-0904-49B6-BBE1-4CC836314CCF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{63C24A08-70F3-4C8E-B9FB-9F21A903801D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{67F0E67A-8E93-4C2C-B29D-47C48262738A}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{68243FF8-83CA-466B-B2B8-9F99DA5479C4}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{697AFC77-F318-4CD4-BF16-F50F4C1072DA}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6BE926E5-66F4-4166-A5E5-E14D7A165BBD}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{76B78008-3832-42FD-AE55-C8F946ED3C7E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{770657D0-A123-3C07-8E44-1C83EC895118}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7745B7A9-F323-4BB9-9811-01BF57A028DA}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{83877DB1-8B77-45BC-AB43-2BAC22E093E0}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{842B4B72-9E8F-4962-B3C1-1C422A5C4434}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8F722FA9-B994-4C9B-B292-FD32D6206EDF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0409-0000-0000000FF1CE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{199DF7B6-169C-448C-B511-1054101BE9C9}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0409-0000-0000000FF1CE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{397B1D4F-ED7B-4ACA-A637-43B670843876}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0409-0000-0000000FF1CE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{80E762AA-C921-4839-9D7D-DB62A72C0726}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-040C-0000-0000000FF1CE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0C0A-0000-0000000FF1CE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0409-0000-0000000FF1CE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AB365889-0395-4FAD-B702-CA5985D53D42}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0409-0000-0000000FF1CE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2744EF05-38E1-4D5D-B333-E021EDAEA245}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0115-0409-0000-0000000FF1CE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{903F2FE9-1751-4894-9D10-702F3AA0D6D5}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0112C750-A06F-4F92-9C40-E5C1EA9A70EB}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{1D53FB73-9826-4541-B2E0-A239C6EBA718}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{329050A9-EF80-40F9-B633-74508F54C1FF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{7F207DCA-3399-40CB-A968-6E5991B1421A}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{8CCB781A-CF6B-4FCB-B6D8-59C64DF5C6DB}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{B0EC5722-241F-4CDA-83B4-AA5846B6F9F4}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C3F9A0DC-A5D1-4BB6-870E-2953E5A2487B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E8766951-2B6C-4022-86E8-80D2D1762B76}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{F5B70033-E79C-4569-90BF-BC9B4E4F3F46}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{FCD742B9-7A55-44BC-A776-F795F21FEDDC}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{931AB7EA-3656-4BB7-864D-022B09E3DD67}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9422C8EA-B0C6-4197-B8FC-DC797658CA00}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{94D398EB-D2FD-4FD1-B8C4-592635E8A191}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{972B1D9B-0EAD-49E8-B7D6-3B83FD5665B1}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A2BCA9F1-566C-4805-97D1-7FDC93386723}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A49F249F-0C91-497F-86DF-B2585E8E76B7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A5C4AD72-25FE-4899-B6DF-6D8DF63C93CF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A644254B-92F6-4970-8635-AB0775371E72}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A78FE97A-C0C8-49CE-89D0-EDD524A17392}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A817131B-177D-4FB9-8317-C91138013600}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A82F10CB-18B5-4EAC-AEF2-FA49CD565626}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A70900000002}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B0CC883F-D14A-4EBA-9355-4D23B223CF05}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B29AD377-CC12-490A-A480-1452337C618D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BB4E33EC-8181-4685-96F7-8554293DEC6A}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BBC12E6C-C32F-470A-BF15-5A8C21066D1A}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C04E32E0-0416-434D-AFB9-6969D703A9EF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C523D256-313D-4866-B36A-F3DE528246EF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C52E3EC1-048C-45E1-8D53-10B0C6509683}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C5C38AA6-C887-4B31-8B76-77C1CC40FFC7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CC75AB5C-2110-4A7F-AF52-708680D22FE8}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB350003
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB953595
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB958484
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB960043
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D1A19B02-817E-4296-A45B-07853FD74D57}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D5A145FC-D00C-4F1A-9119-EB4D9D659750}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D5BA7C09-E523-478C-9C37-A1D86C76383E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DA34FE93-5DC5-48E0-ACC8-A5389E05BB51}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E4848436-0345-47E2-B648-8B522FCDA623}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F084395C-40FB-4DB3-981C-B51E74E1E83D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F0E64E2E-3A60-40D8-A55D-92F6831875DA}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F4F4F84E-804F-4E9A-84D7-C34283F0088F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F93C84A6-0DC6-42AF-89FA-776F7C377353}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FEDD27A0-B306-45EF-BF58-B527406B42C8}

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Facebook Plug-In
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome


Adobe Products

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX
DisplayName REG_SZ Adobe Flash Player 10 ActiveX
DisplayVersion REG_SZ 10.0.22.87
Publisher REG_SZ Adobe Systems Incorporated
URLInfoAbout REG_SZ http://www.adobe.com/go/getflashplayer
VersionMajor REG_SZ 10
VersionMinor REG_SZ 0
HelpLink REG_SZ http://www.adobe.com/go/flashplayer_support/
URLUpdateInfo REG_SZ http://www.adobe.com/go/flashplayer/
DisplayIcon REG_SZ C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
UninstallString REG_SZ C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
RequiresIESysFile REG_SZ 4.70.0.1155
NoModify REG_DWORD 0x1
NoRepair REG_DWORD 0x1


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player Plugin
DisplayName REG_SZ Adobe Flash Player 10 Plugin
DisplayVersion REG_SZ 10.0.45.2
Publisher REG_SZ Adobe Systems Incorporated
URLInfoAbout REG_SZ http://www.adobe.com/go/getflashplayer
DisplayIcon REG_SZ C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
UninstallString REG_SZ C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
NoModify REG_DWORD 0x1
NoRepair REG_DWORD 0x1



Autorun


HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Sidebar REG_SZ C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
WindowsWelcomeCenter REG_SZ rundll32.exe oobefldr.dll,ShowWelcomeCenter
swg REG_SZ "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
ehTray.exe REG_SZ C:\Windows\ehome\ehTray.exe
Creative Live! Cam Manager REG_SZ "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
Google Update REG_SZ "C:\Users\Jason\AppData\Local\Google\Update\GoogleUpdate.exe" /c
RegistryMechanic REG_SZ C:\Program Files\Registry Mechanic\RMTray.exe /H
WMPNSCFG REG_SZ C:\Program Files\Windows Media Player\WMPNSCFG.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\AdobeUpdater

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Windows Defender REG_EXPAND_SZ %ProgramFiles%\Windows Defender\MSASCui.exe -hide
RtHDVCpl REG_SZ RtHDVCpl.exe
TPwrMain REG_EXPAND_SZ %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
HSON REG_EXPAND_SZ %ProgramFiles%\TOSHIBA\TBS\HSON.exe
SmoothView REG_EXPAND_SZ %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
00TCrdMain REG_EXPAND_SZ %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
KeNotify REG_SZ C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
HWSetup REG_SZ C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
SVPWUTIL REG_SZ C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
NDSTray.exe REG_SZ NDSTray.exe
topi REG_SZ C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup
NvSvc REG_SZ RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
NvCplDaemon REG_SZ RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
NvMediaCenter REG_SZ RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
IgfxTray REG_SZ C:\Windows\system32\igfxtray.exe
HotKeysCmds REG_SZ C:\Windows\system32\hkcmd.exe
Persistence REG_SZ C:\Windows\system32\igfxpers.exe
Apoint REG_SZ C:\Program Files\Apoint2K\Apoint.exe
Toshiba Registration REG_SZ C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
AVFX Engine REG_SZ C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
V0230Mon.exe REG_SZ C:\Windows\V0230Mon.exe
LogitechCommunicationsManager REG_SZ "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
LogitechQuickCamRibbon REG_SZ "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
NSLauncher REG_SZ C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
QuickTime Task REG_SZ "C:\Program Files\QuickTime\QTTask.exe" -atboottime
iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
AdobeCS4ServiceManager REG_SZ "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
TkBellExe REG_SZ "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
Control Center REG_SZ C:\Program Files\ASUS\WLAN Card Utilities\CenterAgent.exe
AdobeAAMUpdater-1.0 REG_SZ "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
SwitchBoard REG_SZ C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
AdobeCS5ServiceManager REG_SZ "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
SunJavaUpdateSched REG_SZ "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
SSDMonitor REG_SZ C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe



Restrictions - Internet Explorer




Restrictions - REGEDIT




Restrictions - Explorer


HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoDrives REG_DWORD 0x0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run


DNS Settings


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{08D31CF9-720A-4C7C-986E-E3C1A7FB34C3}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{43AFB048-DAB8-4693-B075-B8A8D25B3D59}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{CF045E47-4833-4982-8CF7-2248DB810D1E}

Windows IP Configuration

Host Name . . . . . . . . . . . . : Honeysuckle
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : cable.virginmedia.net

Wireless LAN adapter Wireless Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Atheros AR5006EG Wireless Network Adapter
Physical Address. . . . . . . . . : 00-1B-9E-05-EC-49
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : cable.virginmedia.net
Description . . . . . . . . . . . : Realtek RTL8101 Family PCI-E Fast Ethernet NIC (NDIS 6.0)
Physical Address. . . . . . . . . : 00-16-D4-96-E5-E4
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::9524:f406:32ae:de9e%9(Preferred)
IPv4 Address. . . . . . . . . . . : 81.101.176.187(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : 02 August 2010 18:18:38
Lease Expires . . . . . . . . . . : 06 August 2010 19:32:00
Default Gateway . . . . . . . . . : 81.101.176.1
DHCP Server . . . . . . . . . . . : 62.253.131.41
DHCPv6 IAID . . . . . . . . . . . : 218109652
DNS Servers . . . . . . . . . . . : 194.168.4.100
194.168.8.100
NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter Local Area Connection* 6:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 02-00-54-55-4E-01
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 7:

Connection-specific DNS Suffix . : cable.virginmedia.net
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::200:5efe:81.101.176.187%20(Preferred)
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 194.168.4.100
194.168.8.100
NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter Local Area Connection* 12:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #4
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 14:

Connection-specific DNS Suffix . : cable.virginmedia.net
Description . . . . . . . . . . . : Microsoft 6to4 Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Temporary IPv6 Address. . . . . . : 2002:5165:b0bb::5165:b0bb(Preferred)
Default Gateway . . . . . . . . . : 2002:c058:6301::c058:6301
DNS Servers . . . . . . . . . . . : 194.168.4.100
194.168.8.100
NetBIOS over Tcpip. . . . . . . . : Disabled


AppInit DLLs





Shell Service Object Delay Load


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
WebCheck REG_SZ {E6FB5E20-DE35-11CF-9C87-00AA005127ED}




Shell Execute Hooks


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ



Image File Execution Options


HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cqw32.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEInstal.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpwin8.EXE


Security Providers



Local Security Authority


HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
auditbaseobjects REG_DWORD 0x0
auditbasedirectories REG_DWORD 0x0
crashonauditfail REG_DWORD 0x0
fullprivilegeauditing REG_BINARY 00
Bounds REG_BINARY 0030000000200000
LimitBlankPasswordUse REG_DWORD 0x1
LmCompatibilityLevel REG_DWORD 0x3
NoLmHash REG_DWORD 0x1
Notification Packages REG_MULTI_SZ scecli
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0tspkg
Authentication Packages REG_MULTI_SZ msv1_0
LsaPid REG_DWORD 0x2ac
SecureBoot REG_DWORD 0x1
ProductType REG_DWORD 0x3
disabledomaincreds REG_DWORD 0x0
everyoneincludesanonymous REG_DWORD 0x0
forceguest REG_DWORD 0x0
restrictanonymous REG_DWORD 0x0
restrictanonymoussam REG_DWORD 0x1
enabledcom REG_SZ y

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\AccessProviders
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\Audit
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\Credssp
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\Data
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\GBG
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\JD
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\Kerberos
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\MSV1_0
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\Skew1
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\SSO
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\SspiCache


AppCert DLLs



App Paths


HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\AcroRd32.exe
(Default) REG_SZ C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
Path REG_SZ C:\Program Files\Adobe\Acrobat 7.0\Reader\

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\BIP_Camera.exe
Path REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\
(Default) REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\BIP_Camera.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\BIP_Camera1.exe
(Default) REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\BIP_Camera1.exe
Path REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\bridge.exe
(Default) REG_SZ C:\Program Files\Adobe\Adobe Bridge CS5\bridge.exe
Path REG_SZ C:\Program Files\Adobe\Adobe Bridge CS5

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\Bright.exe
Path REG_SZ C:\Program Files\Toshiba\TBS\
(Default) REG_SZ C:\Program Files\Toshiba\TBS\Bright.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\Center.exe
Path REG_SZ C:\Program Files\ASUS\WLAN Card Utilities
(Default) REG_SZ C:\Program Files\ASUS\WLAN Card Utilities\Center.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\CFSServ.exe
Path REG_SZ C:\Program Files\TOSHIBA\ConfigFree

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\chrome.exe
(Default) REG_SZ C:\Users\Jason\AppData\Local\Google\Chrome\Application\chrome.exe
Path REG_SZ C:\Users\Jason\AppData\Local\Google\Chrome\Application

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\cmmgr32.exe
CmstpExtensionDll REG_SZ C:\Windows\system32\cmcfg32.dll
CmNative REG_DWORD 0x2

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\collage.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\combofix.exe
(Default) REG_SZ C:\Users\Jason\Downloads\ComboFix.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\CTLCMgr.exe
Path REG_SZ C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager
(Default) REG_SZ C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\CTPhCal.exe
Path REG_SZ C:\Program Files\Creative\Photo Calendar
(Default) REG_SZ C:\Program Files\Creative\Photo Calendar\CTPhCal.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\CTPM.exe
Path REG_SZ C:\Program Files\Creative\Photo Manager
(Default) REG_SZ C:\Program Files\Creative\Photo Manager\CTPM.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\CTSI.EXE
Path REG_SZ C:\Program Files\Creative\Support\System Information
(Default) REG_SZ C:\Program Files\Creative\Support\System Information\CTSI.EXE

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\dvdmaker.exe
(Default) REG_EXPAND_SZ %ProgramFiles%\Movie Maker\dvdmaker.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\DVDMF.exe
(Default) REG_SZ C:\Program Files\Ulead Systems\DVD MovieFactory for TOSHIBA\Ulead DVD MovieFactory 5\DVDMF.exe
Path REG_SZ C:\Program Files\Ulead Systems\DVD MovieFactory for TOSHIBA\Ulead DVD MovieFactory 5

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\DVDTweakFit.exe
Path REG_SZ c:\program files\ulead systems\dvd moviefactory for toshiba\Ulead DVD Tweak and Fit 2.1
(Default) REG_SZ c:\program files\ulead systems\dvd moviefactory for toshiba\Ulead DVD Tweak and Fit 2.1\DVDTweakFit.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\DVDVR.exe
Path REG_SZ c:\program files\ulead systems\dvd moviefactory for toshiba\Ulead DVD DiscRecorder 2.2
(Default) REG_SZ c:\program files\ulead systems\dvd moviefactory for toshiba\Ulead DVD DiscRecorder 2.2\DVDVR.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\ECCenter.exe
Path REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\
(Default) REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\ECCenter.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\ECCenter1.exe
(Default) REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\ECCenter1.exe
Path REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\excel.exe
(Default) REG_SZ C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE
Path REG_SZ C:\Program Files\Microsoft Office\Office12\
SaveURL REG_SZ 1
useURL REG_SZ 1

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\EyeCatcherEx.dll
(Default) REG_SZ C:\Program Files\Creative\Creative Live! Cam\VideoFX\EyeCatcherEx.dll
Path REG_SZ C:\Program Files\Creative\Creative Live! Cam\VideoFX

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\firefox.exe
(Default) REG_SZ C:\Program Files\Mozilla Firefox\firefox.exe
Path REG_SZ C:\Program Files\Mozilla Firefox

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\free-dvd-ripper.exe
(Default) REG_SZ C:\Program Files\freestar\freedvdripper\free-dvd-ripper.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\HSON.exe
Path REG_SZ C:\Program Files\Toshiba\TBS\
(Default) REG_SZ C:\Program Files\Toshiba\TBS\HSON.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\IEXPLORE.EXE
(Default) REG_SZ C:\Program Files\Internet Explorer\IEXPLORE.EXE
Path REG_SZ C:\Program Files\Internet Explorer;

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\inkball.exe
(Default) REG_EXPAND_SZ %ProgramFiles%\Microsoft Games\inkball\inkball.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\install.exe
BlockOnTSNonInstallMode REG_DWORD 0x1

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\Installer.exe
Path REG_SZ C:\Program Files\Atheros

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\iTunes.exe
(Default) REG_SZ C:\Program Files\iTunes\iTunes.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\javaws.exe
(Default) REG_SZ C:\Program Files\Java\jre6\bin\javaws.exe
Path REG_SZ C:\Program Files\Java\jre6\bin

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\Journal.exe
(Default) REG_EXPAND_SZ %ProgramFiles%\Windows Journal\Journal.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\ldm.exe
Path REG_SZ C:\Program Files\Logitech\Desktop Messenger

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\LiveCam.exe
Path REG_SZ C:\Program Files\Creative\Creative Live! Cam\Live! Cam Center
(Default) REG_SZ C:\Program Files\Creative\Creative Live! Cam\Live! Cam Center\LiveCam.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\mbam.exe
(Default) REG_SZ C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
Path REG_SZ C:\Program Files\Malwarebytes' Anti-Malware

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\migwiz.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\ModelFileHandler.exe
(Default) REG_SZ C:\Program Files\Common Files\Logishrd\LQCVFX\ModelFileHandler.exe
Path REG_SZ C:\Program Files\Common Files\Logishrd\LQCVFX\

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\moviemk.exe
(Default) REG_EXPAND_SZ %ProgramFiles%\Movie Maker\moviemk.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\mplayer2.exe
(Default) REG_EXPAND_SZ %ProgramFiles%\Windows Media Player\wmplayer.exe
Path REG_EXPAND_SZ %ProgramFiles%\Windows Media Player

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\msimn.exe
(Default) REG_EXPAND_SZ %ProgramFiles%\Windows Mail\WinMail.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\MSNMSGR.EXE
(Default) REG_SZ C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
Path REG_SZ C:\Program Files\Windows Live\Messenger\

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\MsoHtmEd.exe
useURL REG_SZ 1

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\msoxmled.exe
(Default) REG_SZ C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLED.EXE
useURL REG_SZ 1

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\NDSTray.exe
Path REG_SZ C:\Program Files\TOSHIBA\ConfigFree
(Default) REG_SZ C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\ois.exe
(Default) REG_SZ C:\PROGRA~1\MICROS~2\Office12\OIS.EXE
Path REG_SZ C:\Program Files\Microsoft Office\Office12\
SaveURL REG_SZ 0
useURL REG_SZ 1

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\OneNote.exe
(Default) REG_SZ C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE
Path REG_SZ C:\Program Files\Microsoft Office\Office12\
SaveURL REG_SZ 1
useURL REG_SZ 1

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\pbrush.exe
(Default) REG_EXPAND_SZ %SystemRoot%\System32\mspaint.exe
Path REG_EXPAND_SZ %SystemRoot%\System32

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\PCDiag.exe
(Default) REG_SZ C:\Program Files\Toshiba\PCDiag\PCDiag.exe
Path REG_SZ C:\Program Files\Toshiba\PCDiag\

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\PhotoScape.exe
(Default) REG_SZ "C:\Program Files\PhotoScape\PhotoScape.exe"
Path REG_SZ "C:\Program Files\PhotoScape\PhotoScape.exe"

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\Photoshop.exe
(Default) REG_SZ C:\Program Files\Adobe\Adobe Photoshop CS5\Photoshop.exe
Path REG_SZ C:\Program Files\Adobe\Adobe Photoshop CS5\

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\PictureViewer.exe
Path REG_SZ C:\Program Files\QuickTime\
(Default) REG_SZ C:\Program Files\QuickTime\PictureViewer.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\powerpnt.exe
(Default) REG_SZ C:\PROGRA~1\MICROS~2\Office12\POWERPNT.EXE
Path REG_SZ C:\Program Files\Microsoft Office\Office12\
useURL REG_SZ 1
SaveURL REG_SZ 1

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\Presentation.exe
Path REG_SZ C:\Program Files\Toshiba\TBS\
(Default) REG_SZ C:\Program Files\Toshiba\TBS\Presentation.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\Quickcam.exe
(Default) REG_SZ C:\Program Files\Logitech\QuickCam\QuickCam.exe
Path REG_SZ C:\Program Files\Logitech\QuickCam\

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\QuickTimePlayer.exe
(Default) REG_SZ C:\Program Files\QuickTime\QuickTimePlayer.exe
Path REG_SZ C:\Program Files\QuickTime\

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\RealConverter.exe
(Default) REG_SZ c:\program files\real\realplayer\converter\RealConverter.exe
Path REG_SZ c:\program files\real\realplayer\converter

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\RealPlay.exe
(Default) REG_SZ C:\Program Files\Real\RealPlayer\realplay.exe
Path REG_SZ C:\Program Files\Real\RealPlayer

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\RealUpgrade.exe
(Default) REG_SZ C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Path REG_SZ C:\Program Files\Real\RealUpgrade

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\rnxproc.exe
(Default) REG_SZ C:\Program Files\Common Files\Real\Update_OB\rnxproc.exe
Path REG_SZ C:\Program Files\Common Files\Real\Update_OB\

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\setup.exe
BlockOnTSNonInstallMode REG_DWORD 0x1

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\sidebar.exe
(Default) REG_EXPAND_SZ "%ProgramFiles%\Windows Sidebar\sidebar.exe"

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\SmoothView.exe
(Default) REG_SZ C:\Program Files\Toshiba\SmoothView\SmoothView.exe
Path REG_SZ C:\Program Files\Toshiba\SmoothView\

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\SnippingTool.exe
(Default) REG_EXPAND_SZ C:\Windows\System32\SnippingTool.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\SpecApp.exe
Path REG_SZ C:\Program Files\Toshiba\TBS\
(Default) REG_SZ C:\Program Files\Toshiba\TBS\SpecApp.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\StartLiveTV.exe
Path REG_SZ C:\Program Files\Toshiba\TBS\
(Default) REG_SZ C:\Program Files\Toshiba\TBS\StartLiveTV.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\stikynot.exe
(Default) REG_EXPAND_SZ C:\Windows\System32\stikynot.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\table30.exe
UseShortName REG_SZ

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\TabTip.exe
(Default) REG_EXPAND_SZ %CommonProgramFiles%\microsoft shared\ink\TabTip.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\TBSbtnSt.exe
Path REG_SZ C:\Program Files\Toshiba\TBS\
(Default) REG_SZ C:\Program Files\Toshiba\TBS\TBSbtnSt.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\TBSMain.exe
Path REG_SZ C:\Program Files\Toshiba\TBS\
(Default) REG_SZ C:\Program Files\Toshiba\TBS\TBSMain.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\TDspBtn.exe
Path REG_SZ C:\Program Files\Toshiba\TBS\
(Default) REG_SZ C:\Program Files\Toshiba\TBS\TDspBtn.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\TInTouch.exe
Path REG_SZ C:\Program Files\TOSHIBA\TOSHIBA Assist
(Default) REG_SZ C:\Program Files\TOSHIBA\TOSHIBA Assist\TInTouch.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\TosBtMng.exe
Path REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\
(Default) REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\TosBtMng1.exe
Path REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\
(Default) REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\TosBtProc.exe
Path REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\
(Default) REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\TosBtProc1.exe
(Default) REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc1.exe
Path REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\TOSCDSPD.exe
Path REG_SZ C:\Program Files\TOSHIBA\TOSCDSPD
(Default) REG_SZ C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\wab.exe
(Default) REG_EXPAND_SZ %ProgramFiles%\Windows Mail\wab.exe
Path REG_EXPAND_SZ %ProgramFiles%\Windows Mail

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\wabmig.exe
(Default) REG_EXPAND_SZ %ProgramFiles%\Windows Mail\wabmig.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\WebcamSnapshot.exe
(Default) REG_SZ C:\Program Files\Logitech\QuickCam\QuickCam.exe
Path REG_SZ C:\Program Files\Logitech\QuickCam\

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\WinCal.exe
(Default) REG_EXPAND_SZ "%ProgramFiles%\Windows Calendar\wincal.exe"

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\WinDVD.exe
(Default) REG_SZ C:\Program Files\InterVideo\DVD8\WinDVD.exe
Path REG_SZ C:\Program Files\InterVideo\DVD8\

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\WinMail.exe
(Default) REG_EXPAND_SZ %ProgramFiles%\Windows Mail\WinMail.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\WinRAR.exe
(Default) REG_SZ C:\Program Files\WinRAR\WinRAR.exe
Path REG_SZ C:\Program Files\WinRAR

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\Winword.exe
(Default) REG_SZ C:\PROGRA~1\MICROS~2\Office12\WINWORD.EXE
Path REG_SZ C:\Program Files\Microsoft Office\Office12\
useURL REG_SZ 1
SaveURL REG_SZ 1

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\WirelessFTP.exe
Path REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\
(Default) REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\WirelessFTP.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\WirelessFTP1.exe
(Default) REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\WirelessFTP1.exe
Path REG_SZ c:\Program Files\Toshiba\Bluetooth Toshiba Stack\

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\wmenc.exe
Path REG_SZ C:\Program Files\Windows Media Components\Encoder\
(Default) REG_SZ C:\Program Files\Windows Media Components\Encoder\WMEnc.exe

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\wmplayer.exe
(Default) REG_EXPAND_SZ %ProgramFiles%\Windows Media Player\wmplayer.exe
Path REG_EXPAND_SZ %ProgramFiles%\Windows Media Player

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\WORDPAD.EXE
(Default) REG_EXPAND_SZ "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE"

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\WRITE.EXE
(Default) REG_EXPAND_SZ "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE"

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\XPSViewer.exe
(Default) REG_SZ "C:\Windows\System32\XPSViewer\XPSViewer.exe"



Mozilla


HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions
{20a82645-c095-46ed-80e3-08825760534b} REG_SZ c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
{000a9d1c-beef-4f90-9363-039d445309b8} REG_SZ C:\Program Files\Google\Google Gears\Firefox\
{ABDE892B-13A8-4d1b-88E6-365A6E755758} REG_SZ C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
(Default) REG_SZ 1.9.2.6
CurrentVersion REG_SZ 3.6.6 (en-US)

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\3.6.6 (en-US)
(Default) REG_SZ 3.6.6 (en-US)

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\3.6.6 (en-US)\Main
Install Directory REG_SZ C:\Program Files\Mozilla Firefox
PathToExe REG_SZ C:\Program Files\Mozilla Firefox\firefox.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\3.6.6 (en-US)\Uninstall
Description REG_SZ Mozilla Firefox (3.6.6)

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.6.6
GeckoVer REG_SZ 1.9.2.6

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.6.6\bin
PathToExe REG_SZ C:\Program Files\Mozilla Firefox\firefox.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.6.6\extensions
Components REG_SZ C:\Program Files\Mozilla Firefox\components
Plugins REG_SZ C:\Program Files\Mozilla Firefox\plugins



Shared Task Scheduler


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
{8C7461EF-2B13-11d2-BE35-3078302C2030} REG_SZ Component Categories cache daemon



SafeBoot



SafeBootMinimal


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppMgmt
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot file system
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EventLog
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Netlogon
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PCI Configuration
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PlugPlay
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PNP Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Primary disk
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SCSI Class
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sermouse.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vga.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinMgmt
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}


SafeBootNetwork


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AFD
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AppInfo
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AppMgmt
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BFE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Boot Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Boot file system
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\bowser
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Browser
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CryptSvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\dfsc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dhcp
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DnsCache
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dot3Svc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Eaphost
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\EventLog
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\File system
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\HelpSvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\IKEEXT
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ipnat.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\KeyIso
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LanmanServer
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LanmanWorkstation
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LmHosts
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Messenger
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MPSDrv
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MPSSvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mrxsmb
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mrxsmb10
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mrxsmb20
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NativeWifiP
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NDIS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NDIS Wrapper
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Ndisuio
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBIOS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBIOSGroup
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBT
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetDDEGroup
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Netlogon
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetMan
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\netprofm
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Network
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetworkProvider
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NlaSvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Nsi
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nsiproxy.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NTDS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PCI Configuration
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PlugPlay
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PNP Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PNP_TDI
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PolicyAgent
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Primary disk
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ProfSvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdbss
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdpencdd.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdsessmgr
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sacsvr
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SCardSvr
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SCSI Class
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sermouse.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SharedAccess
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Streams Drivers
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SWPRV
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TabletInputService
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TBS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Tcpip
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TDI
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TrustedInstaller
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VDS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vga.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vgasave.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\volmgr.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\volmgrx.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinMgmt
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wlansvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{36FC9E60-C465-11CF-8056-444553540000}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{50DD5230-BA8A-11D1-BF5D-0000F805F530}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{533C5B84-EC70-11D2-9505-00C04F79DEAF}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}


File Rename Operations - Session




Known DLLs - Session


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDlls
clbcatq REG_SZ clbcatq.dll
ole32 REG_SZ ole32.dll
advapi32 REG_SZ advapi32.dll
COMDLG32 REG_SZ COMDLG32.dll
DllDirectory REG_EXPAND_SZ %SystemRoot%\system32
gdi32 REG_SZ gdi32.dll
IERTUTIL REG_SZ IERTUTIL.dll
IMAGEHLP REG_SZ IMAGEHLP.dll
IMM32 REG_SZ IMM32.dll
kernel32 REG_SZ kernel32.dll
LPK REG_SZ LPK.dll
MSCTF REG_SZ MSCTF.dll
MSVCRT REG_SZ MSVCRT.dll
NORMALIZ REG_SZ NORMALIZ.dll
NSI REG_SZ NSI.dll
OLEAUT32 REG_SZ OLEAUT32.dll
rpcrt4 REG_SZ rpcrt4.dll
Setupapi REG_SZ Setupapi.dll
SHELL32 REG_SZ SHELL32.dll
SHLWAPI REG_SZ SHLWAPI.dll
URLMON REG_SZ URLMON.dll
user32 REG_SZ user32.dll
USP10 REG_SZ USP10.dll
WININET REG_SZ WININET.dll
WLDAP32 REG_SZ WLDAP32.dll
WS2_32 REG_SZ WS2_32.dll



Downloaded program files (ActiveX)


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}

PATH: C:\windows\Downloaded Program Files

desktop.ini
EPUWALcontrol.dll
erma.inf


Mountpoints


HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{54789207-97ec-11df-9ec9-0016d496e5e4}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{749e2c2b-6877-11dc-aeaf-806e6f6e6963}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{749e2c2e-6877-11dc-aeaf-806e6f6e6963}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a4fa5c93-72fa-11df-a708-0016d496e5e4}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bdec3fbe-cd34-11dd-b6ca-0016d496e5e4}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e4077f4f-6c21-11df-8db4-0016d496e5e4}


Winlogon


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
ReportBootOk REG_SZ 1
Shell REG_SZ Explorer.exe
Userinit REG_SZ C:\Windows\system32\userinit.exe,
VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
AutoRestartShell REG_DWORD 0x1
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PowerdownAfterShutdown REG_SZ 0
ShutdownWithoutLogon REG_SZ 0
cachedlogonscount REG_SZ 10
forceunlocklogon REG_DWORD 0x0
passwordexpirywarning REG_DWORD 0xe
Background REG_SZ 0 0 0
DebugServerCommand REG_SZ no
WinStationsDisabled REG_SZ 0
DisableCAD REG_DWORD 0x1
scremoveoption REG_SZ 0
ShutdownFlags REG_DWORD 0x27
LegalNotice Text REG_SZ
SFCDisable REG_DWORD 0x0
System REG_SZ

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked


Windows Update


HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\windowsupdate\auto update\results\install
LastSuccessTime REG_SZ 2010-08-02 17:24:27
LastError REG_DWORD 0x0



Security Software Information

*Note*: Some security software does not store itself in the WMI.

Antivirus: Norton Internet Security *Scanner enabled* (Alert: Outdated!) {E10A9785-9598-4754-B552-92431C1C35F8}
Antispyware: Windows Defender *Scanner enabled* (Up to date) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
Antispyware: Norton Internet Security *Scanner enabled* (Alert: Outdated!) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
Firewall: Norton Internet Security *Alert: firewall disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}


{END OF FILE}

ESET Online Scan

Please run a free online scan with the ESET Online Scanner

• Tick the box next to YES, I accept the Terms of Use
  
• Click Start
  
• When asked, allow the ActiveX control to install
  
• Click Start
  
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  
• Click Scan (This scan can take several hours, so please be patient)
  
• Once the scan is completed, you may close the window
  
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  
• Copy and paste that log as a reply to this topic

Are you still with us?

Please reply and let us know the progress!

Sorry, I did reply, or so I thought! I'll do it again lol.

Are you able to run the scan?

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=8cffc00b4000554dadeb1abea6bcb055
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-08-01 07:43:11
# local_time=2010-08-01 08:43:11 (+0000, GMT Daylight Time)
# country="United Kingdom"
# lang=1033
# osver=6.0.6000 NT
# compatibility_mode=512 16777215 100 0 883272 883272 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=5892 16776573 100 100 238760 118216973 0 0
# compatibility_mode=8192 67108863 100 0 168 168 0 0
# scanned=142902
# found=4
# cleaned=4
# scan_time=7546
C:\Users\Guest\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe Win32/Tenga.gen virus (cleaned - quarantined) 00000000000000000000000000000000 C
C:\Users\Jason\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\454aa3e3-65337d98 multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
C:\Users\Jason\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\556445eb-1b7d4370 probably a variant of Win32/Agent trojan (deleted - quarantined) 00000000000000000000000000000000 C
C:\Users\Jason\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\5473416c-66a15e6e multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=8cffc00b4000554dadeb1abea6bcb055
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-08-03 11:27:25
# local_time=2010-08-04 12:27:25 (+0000, GMT Daylight Time)
# country="United Kingdom"
# lang=1033
# osver=6.0.6000 NT
# compatibility_mode=512 16777215 100 0 1077060 1077060 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=5892 16776573 100 100 108176 118410761 0 0
# compatibility_mode=8192 67108863 100 0 193956 193956 0 0
# scanned=216
# found=0
# cleaned=0
# scan_time=12
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=8cffc00b4000554dadeb1abea6bcb055
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-08-11 05:21:20
# local_time=2010-08-11 06:21:20 (+0000, GMT Daylight Time)
# country="United Kingdom"
# lang=1033
# osver=6.0.6000 NT
# compatibility_mode=512 16777215 100 0 1680338 1680338 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=5892 16776573 100 100 105342 119014039 0 0
# compatibility_mode=8192 67108863 100 0 797234 797234 0 0
# scanned=145267
# found=0
# cleaned=0
# scan_time=65969

Hiya! Your logs appear to be clean. If there are no more issues, then we shall clean up!

Clean up System Restore

Now, to get you off to a clean start, we will be creating a new Restore Point, then clearing the old ones to make sure you do not get reinfected, in case you need to "restore back."

To manually create a new Restore Point

• Go to Control Panel and select System and Maintenance
  
• Select System
  
• On the left select Advance System Settings and accept the warning if you get one
  
• Select System Protection Tab
  
• Select Create at the bottom
  
• Type in a name i.e. Clean
  
• Select Create

Now we can purge the infected ones

• Go back to the System and Maintenance page
  
• Select Performance Information and Tools
  
• On the left select Open Disk Cleanup
  
• Select Files from all users and accept the warning if you get one
  
• In the drop down box select your main drive i.e. C
  
• For a few moments the system will make some calculations
  
• Select the More Options tab
  
• In the System Restore and Shadow Backups select Clean up
  
• Select Delete on the pop up
  
• Select OK
  
• Select Delete

Run OTC to remove our tools

To remove all of the tools we used and the files and folders they created, please do the following:
Please download OTC.exe by OldTimer:

• Save it to your Desktop.
  
• Double click OTC.exe.
  
• Click the CleanUp! button.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes.

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

Purge old temporary files

Please download TFC by OldTimer to your desktop

• Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  
• It will close all programs when run, so make sure you have saved all your work before you begin.
  
• Click the Start
  button to begin the process. Depending on how often you clean temp
  files, execution time should be anywhere from a few seconds to a minute
  or two. Let it run uninterrupted to completion.
  
• Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

Security Check

Please download Security Check by screen317 from SpywareInfoforum.org or Changelog.fr.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Tell me in your next reply, if you have completed these tasks:

• Cleaned System Restore
  
• Ran OTC
  
• Ran TFC
  
• Ran Security Check

Also, let me know how your computer is running, and don't forget to post the contents of the Security Check log.

Still with us? Please let me know how things are going!