Possible infection/something bad? [Closed]

Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic of your own. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!

> Geeks to Go! » Security » Virus, Spyware and Trojan Removal

Possible infection/something bad? [Closed], running slow, freezes up forcing hard restart

Options

rawbery79 View Member Profile	Aug 3 2009, 01:15 PM Post #1
New Member Posts: 1 OS: Windows Vista	I accidentally deleted my My Documents folder yesterday. I was able to restore it with System Restore, but it's still buggy. I also downloaded something (okay, it was a video and I was stupid to do so) which caused me to get a BSOD that said it was for my computer's own good. I've run all the suggested scans, and tried to run Avast but it got hung up, which was a big red flag for me. I have some know how of this kind of thing, but this has me stumped. I don't have a MBAM logfile, but here's the other ones: Root Repeal: ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/08/03 13:49 Program Version: Version 1.3.3.0 Windows Version: Windows Vista SP1 ================================================== Drivers ------------------- Name: dump_iaStor.sys Image Path: C:\Windows\System32\Drivers\dump_iaStor.sys Address: 0x8A704000 Size: 778240 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\Windows\system32\drivers\rootrepeal.sys Address: 0x8F1EF000 Size: 49152 File Visible: No Signed: - Status: - Processes ------------------- Path: System PID: 4 Status: Locked to the Windows API! Path: C:\Windows\System32\audiodg.exe PID: 1276 Status: Locked to the Windows API! ==EOF== OTL Log: OTL logfile created on: 8/3/2009 1:57:13 PM - Run 1 OTL by OldTimer - Version 3.0.10.4 Folder = C:\Users\Rebecca\Desktop\Laptop Fix Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18813) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 2.00 Gb Total Physical Memory \| 1.85 Gb Available Physical Memory \| 92.60% Memory free 4.00 Gb Paging File \| 4.00 Gb Available in Paging File \| 100.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\Windows \| %ProgramFiles% = C:\Program Files Drive C: \| 298.09 Gb Total Space \| 128.23 Gb Free Space \| 43.02% Space Free \| Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded Drive G: \| 7.50 Gb Total Space \| 3.84 Gb Free Space \| 51.16% Space Free \| Partition Type: FAT32 H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: REBECCA-PC Current User Name: Rebecca Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Windows\System32\WLTRYSVC.EXE () PRC - C:\Windows\System32\bcmwltry.exe (Dell Inc.) PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software) PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software) PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft) PRC - C:\Windows\System32\aestsrv.exe (Andrea Electronics Corporation) PRC - C:\Program Files\AGI\common\win32\PythonService.exe () PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.) PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.) PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation) PRC - C:\Windows\System32\STacSV.exe (IDT, Inc.) PRC - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) PRC - C:\Windows\System32\DRIVERS\xaudio.exe (Conexant Systems, Inc.) PRC - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Microsoft Corporation) PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software) PRC - C:\Windows\System32\wbem\unsecapp.exe (Microsoft Corporation) PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software) PRC - C:\Windows\System32\wbem\wmiprvse.exe (Microsoft Corporation) PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.) PRC - C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Windows\System32\Taskmgr.exe (Microsoft Corporation) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Windows\System32\wbem\unsecapp.exe (Microsoft Corporation) PRC - C:\Users\Rebecca\Desktop\Laptop Fix\OTL.exe (OldTimer Tools) PRC - C:\Program Files\Unlocker\UnlockerAssistant.exe () PRC - C:\Program Files\Windows Media Player\wmplayer.exe (Microsoft Corporation) PRC - C:\Windows\System32\WUDFHost.exe (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (AESTFilters [Auto \| Running]) -- C:\Windows\System32\aestsrv.exe (Andrea Electronics Corporation) SRV - (AGWinService [Auto \| Running]) -- C:\Program Files\AGI\common\win32\PythonService.exe () SRV - (Apple Mobile Device [Auto \| Running]) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.) SRV - (aswUpdSv [Auto \| Running]) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software) SRV - (avast! Antivirus [Auto \| Running]) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software) SRV - (avast! Mail Scanner [On_Demand \| Running]) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software) SRV - (avast! Web Scanner [On_Demand \| Running]) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software) SRV - (Bonjour Service [Auto \| Running]) -- C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.) SRV - (clr_optimization_v2.0.50727_32 [On_Demand \| Stopped]) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (ehRecvr [On_Demand \| Stopped]) -- C:\Windows\ehome\ehRecvr.exe (Microsoft Corporation) SRV - (ehSched [On_Demand \| Stopped]) -- C:\Windows\ehome\ehsched.exe (Microsoft Corporation) SRV - (ehstart [Auto \| Stopped]) -- C:\Windows\ehome\ehstart.dll (Microsoft Corporation) SRV - (Eventlog [Auto \| Running]) -- C:\Windows\System32\wevtsvc.dll (Microsoft Corporation) SRV - (FontCache3.0.0.0 [On_Demand \| Stopped]) -- C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) SRV - (GoogleDesktopManager-110408-113106 [On_Demand \| Stopped]) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) SRV - (gupdate1ca0950745ce880 [Auto \| Stopped]) -- C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.) SRV - (gusvc [Auto \| Stopped]) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google) SRV - (IAANTMON [Auto \| Running]) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation) SRV - (idsvc [Unknown \| Stopped]) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation) SRV - (iPod Service [On_Demand \| Running]) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.) SRV - (Lavasoft Ad-Aware Service [Auto \| Running]) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft) SRV - (NetTcpPortSharing [Disabled \| Stopped]) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation) SRV - (odserv [On_Demand \| Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation) SRV - (ose [On_Demand \| Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (STacSV [Auto \| Running]) -- C:\Windows\System32\STacSV.exe (IDT, Inc.) SRV - (WinDefend [Auto \| Running]) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SRV - (wlidsvc [Auto \| Running]) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) SRV - (wltrysvc [Auto \| Running]) -- C:\Windows\System32\WLTRYSVC.EXE () SRV - (WMPNetworkSvc [Auto \| Running]) -- C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) SRV - (XAudioService [Auto \| Running]) -- C:\Windows\System32\DRIVERS\xaudio.exe (Conexant Systems, Inc.) ========== Driver Services (SafeList) ========== DRV - (adp94xx [Disabled \| Stopped]) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (adpahci [Disabled \| Stopped]) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (adpu160m [Disabled \| Stopped]) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (adpu320 [Disabled \| Stopped]) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (aic78xx [Disabled \| Stopped]) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (aliide [Disabled \| Stopped]) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (ApfiltrService [On_Demand \| Running]) -- C:\Windows\System32\DRIVERS\Apfiltr.sys (Alps Electric Co., Ltd.) DRV - (arc [Disabled \| Stopped]) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (arcsas [Disabled \| Stopped]) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (aswFsBlk [Auto \| Running]) -- C:\Windows\System32\DRIVERS\aswFsBlk.sys (ALWIL Software) DRV - (aswMonFlt [Auto \| Running]) -- C:\Windows\System32\DRIVERS\aswMonFlt.sys (ALWIL Software) DRV - (aswRdr [System \| Running]) -- C:\Windows\System32\drivers\aswRdr.sys (ALWIL Software) DRV - (aswSP [System \| Running]) -- C:\Windows\System32\drivers\aswSP.sys (ALWIL Software) DRV - (aswTdi [System \| Running]) -- C:\Windows\System32\drivers\aswTdi.sys (ALWIL Software) DRV - (BCM43XX [On_Demand \| Running]) -- C:\Windows\System32\DRIVERS\bcmwl6.sys (Broadcom Corp.) DRV - (BrFiltLo [On_Demand \| Stopped]) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrFiltUp [On_Demand \| Stopped]) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (Brserid [Disabled \| Stopped]) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrSerWdm [Disabled \| Stopped]) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm [Disabled \| Stopped]) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (BrUsbSer [On_Demand \| Stopped]) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (cmdide [Disabled \| Stopped]) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (E1G60 [On_Demand \| Stopped]) -- C:\Windows\System32\DRIVERS\E1G60I32.sys (Intel Corporation) DRV - (elxstor [Disabled \| Stopped]) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (GEARAspiWDM [On_Demand \| Running]) -- C:\Windows\System32\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.) DRV - (HpCISSs [Disabled \| Stopped]) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (HSFHWAZL [On_Demand \| Stopped]) -- C:\Windows\System32\DRIVERS\VSTAZL3.SYS (Conexant Systems, Inc.) DRV - (HSF_DPV [On_Demand \| Running]) -- C:\Windows\System32\DRIVERS\HSX_DPV.sys (Conexant Systems, Inc.) DRV - (HSXHWAZL [On_Demand \| Running]) -- C:\Windows\System32\DRIVERS\HSXHWAZL.sys (Conexant Systems, Inc.) DRV - (iaStor [Boot \| Running]) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation) DRV - (iaStorV [Disabled \| Stopped]) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (ICDUSB3 [On_Demand \| Stopped]) -- C:\Windows\System32\Drivers\ICDUSB3.sys (Sony Corporation) DRV - (igfx [On_Demand \| Running]) -- C:\Windows\System32\DRIVERS\igdkmd32.sys (Intel Corporation) DRV - (iirsp [Disabled \| Stopped]) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (IntcHdmiAddService [On_Demand \| Running]) -- C:\Windows\System32\drivers\IntcHdmi.sys (Intel® Corporation) DRV - (iteatapi [Disabled \| Stopped]) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (iteraid [Disabled \| Stopped]) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (Lbd [Boot \| Running]) -- C:\Windows\system32\DRIVERS\Lbd.sys (Lavasoft AB) DRV - (LSI_FC [Disabled \| Stopped]) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (LSI_SAS [Disabled \| Stopped]) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (LSI_SCSI [Disabled \| Stopped]) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (mdmxsdk [Auto \| Running]) -- C:\Windows\System32\DRIVERS\mdmxsdk.sys (Conexant) DRV - (megasas [Disabled \| Stopped]) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation) DRV - (MegaSR [Disabled \| Stopped]) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.) DRV - (Mraid35x [Disabled \| Stopped]) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (nfrd960 [Disabled \| Stopped]) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (ntrigdigi [Disabled \| Stopped]) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (NuidFltr [On_Demand \| Running]) -- C:\Windows\System32\DRIVERS\NuidFltr.sys (Microsoft Corporation) DRV - (nvraid [Disabled \| Stopped]) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nvstor [Disabled \| Stopped]) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (OEM02Dev [On_Demand \| Running]) -- C:\Windows\System32\DRIVERS\OEM02Dev.sys (Creative Technology Ltd.) DRV - (OEM02Vfx [On_Demand \| Running]) -- C:\Windows\System32\DRIVERS\OEM02Vfx.sys (EyePower Games Pte. Ltd.) DRV - (pcouffin [On_Demand \| Running]) -- C:\Windows\System32\Drivers\pcouffin.sys (VSO Software) DRV - (PxHelp20 [Boot \| Running]) -- C:\Windows\System32\Drivers\PxHelp20.sys (Sonic Solutions) DRV - (ql2300 [Disabled \| Stopped]) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (ql40xx [Disabled \| Stopped]) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (rimmptsk [Auto \| Running]) -- C:\Windows\System32\DRIVERS\rimmptsk.sys (REDC) DRV - (rimsptsk [Auto \| Running]) -- C:\Windows\System32\DRIVERS\rimsptsk.sys (REDC) DRV - (rismxdp [Auto \| Running]) -- C:\Windows\System32\DRIVERS\rixdptsk.sys (REDC) DRV - (secdrv [Auto \| Running]) -- C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) DRV - (SiSRaid4 [Disabled \| Stopped]) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (STHDA [On_Demand \| Running]) -- C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.) DRV - (Symc8xx [Disabled \| Stopped]) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (Sym_hi [Disabled \| Stopped]) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (Sym_u3 [Disabled \| Stopped]) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (uliahci [Disabled \| Stopped]) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (UlSata [Disabled \| Stopped]) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (ulsata2 [Disabled \| Stopped]) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (viaide [Disabled \| Stopped]) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (vsmraid [Disabled \| Stopped]) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (winachsf [On_Demand \| Running]) -- C:\Windows\System32\DRIVERS\HSX_CNXT.sys (Conexant Systems, Inc.) DRV - (XAudio [Auto \| Running]) -- C:\Windows\System32\DRIVERS\xaudio.sys (Conexant Systems, Inc.) DRV - (yukonwlh [On_Demand \| Running]) -- C:\Windows\System32\DRIVERS\yk60x86.sys (Marvell) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - URLSearchHook: {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - C:\Program Files\AGI\common\agcutils.dll (TODO: <Company name>) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = .local ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://www.google.com/ig?hl=en&source=iglk" FF - prefs.js..extensions.enabledItems: {DCBD1271-D228-4082-9FBC-36D9B7660B03}:1.1.8 FF - prefs.js..extensions.enabledItems: waybackbutton@lazar.kovacevic:1.2.1 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1 FF - prefs.js..extensions.enabledItems: {987311C6-B504-4aa2-90BF-60CC49808D42}:2.1 FF - prefs.js..extensions.enabledItems: clean_and_close@csb7.com:2.3 FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:3.9.3 FF - prefs.js..extensions.enabledItems: {6AC85730-7D0F-4de0-B3FA-21142DD85326}:2.0.2 FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.4 FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.2 FF - prefs.js..extensions.enabledItems: {d37dc5d0-431d-44e5-8c91-49419370caa1}:2.5.33 FF - prefs.js..extensions.enabledItems: {463F6CA5-EE3C-4be1-B7E6-7FEE11953374}:3.5.5 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}:6.0.12 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13 FF - prefs.js..extensions.enabledItems: {a95d8332-e4b4-6e7f-98ac-20b733364387}:0.4.3 FF - prefs.js..extensions.enabledItems: homo_nudus@livejournal.com:8.7.1 FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.1 FF - prefs.js..extensions.enabledItems: myTimeZone@smartgamez.org:1.7 FF - prefs.js..extensions.enabledItems: {6b2a52f3-07c2-4c37-bf05-efa81b340ea1}:1.04 FF - prefs.js..extensions.enabledItems: {37E4D8EA-8BDA-4831-8EA1-89053939A250}:2.2.0.2 FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.2.1 FF - prefs.js..extensions.enabledItems: {b2509cd4-17cd-45ed-8146-a82af038f493}:1.30 FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0 FF - prefs.js..extensions.enabledItems: enquiries@retailmenot.com:2.3 FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.1 FF - prefs.js..extensions.enabledItems: {AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.38 FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.5 FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.7.4pre.090516 FF - prefs.js..extensions.enabledItems: twitternotifier@naan.net:1.8.3 FF - prefs.js..extensions.enabledItems: twittytunes@extras.foxytunes.com:0.5.4 FF - prefs.js..extensions.enabledItems: twitzerTiny@shorttext.com:1.31 FF - prefs.js..extensions.enabledItems: youtube-comment-snob@efinke.com:1.3 FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.0.4 FF - prefs.js..extensions.enabledItems: {5f991430-50c5-11dd-ae16-0800200c9a66}:1.1pre1 FF - prefs.js..extensions.enabledItems: {d5890af0-d08c-11dd-ad8b-0800200c9a66}:1.0 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.11 FF - prefs.js..extensions.enabledItems: {173487d0-5384-11dd-ae16-0800200c9a66}:0.4 FF - prefs.js..extensions.enabledItems: {BF32D2C8-9C75-404b-ACF4-880DB4679236}:1.1 FF - prefs.js..extensions.enabledItems: {a5df3a10-fc31-11dd-87af-0800200c9a66}:1.0.0.0.1 FF - prefs.js..extensions.enabledItems: {3f757d21-0b80-4009-a796-2b883bee6476}:1.0 FF - prefs.js..extensions.enabledItems: {285da7e0-729d-11db-9fe1-0800200c9a66}:2.121408 FF - prefs.js..extensions.enabledItems: {5A170DD3-63CA-4c58-93B7-DE9FF536C2FF}:1.8.50 FF - prefs.js..extensions.enabledItems: {C288E3D6-3588-4b60-BD4A-7413899D269B}:1.1 FF - prefs.js..extensions.enabledItems: theme@yogurttree.com:0.4 FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/12/09 23:47:34 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/07/08 14:38:47 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/07/14 07:55:23 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/07/14 07:55:23 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.22\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2009/06/24 15:14:30 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.22\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2009/06/02 17:17:48 \| 00,000,000 \| ---D \| M] [2008/12/09 18:21:48 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Extensions [2008/12/09 18:21:48 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009/08/03 03:45:52 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions [2009/03/09 13:40:39 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671} [2009/08/01 14:24:56 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{04CA07AB-7FC3-4110-A83F-EF1E6B75D5B0}(64) [2009/08/02 20:58:21 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2009/08/01 14:25:17 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}(65) [2009/08/01 14:24:57 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{069FB356-C69F-7349-D092-AB28AF836D0E}(66) [2009/01/23 19:11:22 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}(203) [2008/12/09 18:28:51 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{173487d0-5384-11dd-ae16-0800200c9a66} [2009/07/10 14:52:59 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2008/12/17 23:37:25 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{285da7e0-729d-11db-9fe1-0800200c9a66} [2009/05/28 01:48:51 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250} [2008/12/11 16:03:32 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{3f757d21-0b80-4009-a796-2b883bee6476} [2009/05/09 17:11:36 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374} [2009/07/14 19:45:22 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8} [2009/08/03 03:44:58 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3} [2009/08/01 14:25:16 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}(67) [2009/05/28 01:41:39 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{5A170DD3-63CA-4c58-93B7-DE9FF536C2FF} [2009/05/21 23:20:45 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{5f991430-50c5-11dd-ae16-0800200c9a66} [2009/02/14 14:33:16 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326} [2008/12/11 00:22:31 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{6b2a52f3-07c2-4c37-bf05-efa81b340ea1} [2008/12/16 15:43:07 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{987311C6-B504-4aa2-90BF-60CC49808D42} [2009/05/21 23:20:32 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{a5df3a10-fc31-11dd-87af-0800200c9a66} [2009/06/29 18:27:36 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{a95d8332-e4b4-6e7f-98ac-20b733364387} [2009/07/24 16:23:54 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696} [2009/06/29 18:27:43 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{b2509cd4-17cd-45ed-8146-a82af038f493} [2008/12/11 15:57:26 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{BF32D2C8-9C75-404b-ACF4-880DB4679236} [2008/12/10 23:02:24 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{C288E3D6-3588-4b60-BD4A-7413899D269B} [2009/07/14 19:45:11 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2009/05/12 22:06:15 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1} [2009/05/21 23:19:22 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{d5890af0-d08c-11dd-ad8b-0800200c9a66} [2009/06/30 17:03:47 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{dc572301-7619-498c-a57d-39143191b318} [2008/12/28 21:20:20 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{DCBD1271-D228-4082-9FBC-36D9B7660B03} [2009/07/02 22:26:13 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8} [2009/07/25 13:32:22 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\{EE223D7A-F30F-11DD-8F0A-D2AD55D89593} [2009/02/27 16:25:07 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\clean_and_close@csb7.com [2009/05/30 22:58:02 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\enquiries@retailmenot.com [2009/06/29 18:27:42 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\homo_nudus@livejournal.com [2008/12/09 18:28:28 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\instaclick@leahscape.com [2008/12/09 18:28:28 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\myTimeZone@smartgamez.org [2008/12/10 23:23:05 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\OMG@olive [2009/06/30 17:03:47 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\personas@christopher.beard [2009/07/07 21:36:41 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\theme@yogurttree.com [2009/07/17 10:42:33 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\twitternotifier@naan.net [2009/03/10 17:43:50 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\twittytunes@extras.foxytunes.com [2009/07/05 06:06:00 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\twitzerTiny@shorttext.com [2008/12/09 18:28:35 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\waybackbutton@lazar.kovacevic [2009/07/14 19:45:29 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\youtube2mp3@mondayx.de [2008/12/09 18:28:35 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\7y737qrl.default\extensions\youtube-comment-snob@efinke.com [2009/08/02 20:28:53 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions [2009/08/02 20:28:41 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{02450954-cdd9-410f-b1da-db804e18c671} [2009/08/02 20:28:43 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{04CA07AB-7FC3-4110-A83F-EF1E6B75D5B0} [2009/08/02 20:28:40 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{069FB356-C69F-7349-D092-AB28AF836D0E} [2009/08/02 20:28:48 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}(203) [2009/08/02 20:28:45 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{173487d0-5384-11dd-ae16-0800200c9a66} [2009/08/02 20:28:52 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2009/08/02 20:28:27 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{285da7e0-729d-11db-9fe1-0800200c9a66} [2009/08/02 20:28:52 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250} [2009/08/02 20:28:52 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{3f757d21-0b80-4009-a796-2b883bee6476} [2009/08/02 20:28:47 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374} [2009/08/02 20:28:33 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8} [2009/08/02 20:28:46 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3} [2009/08/02 20:28:30 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{5f991430-50c5-11dd-ae16-0800200c9a66} [2009/08/02 20:28:53 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326} [2009/08/02 20:28:35 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{6b2a52f3-07c2-4c37-bf05-efa81b340ea1} [2009/08/02 20:28:47 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{987311C6-B504-4aa2-90BF-60CC49808D42} [2009/08/02 20:28:26 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{a95d8332-e4b4-6e7f-98ac-20b733364387} [2009/08/02 20:28:42 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696} [2009/08/02 20:28:30 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{b2509cd4-17cd-45ed-8146-a82af038f493} [2009/08/02 20:28:52 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{C288E3D6-3588-4b60-BD4A-7413899D269B} [2009/08/02 20:28:51 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2009/08/02 20:28:53 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1} [2009/08/02 20:28:41 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{d5890af0-d08c-11dd-ad8b-0800200c9a66} [2009/08/02 20:28:45 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{dc572301-7619-498c-a57d-39143191b318} [2009/08/02 20:28:20 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{DCBD1271-D228-4082-9FBC-36D9B7660B03} [2009/08/02 20:28:44 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8} [2009/08/02 20:28:35 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\{EE223D7A-F30F-11DD-8F0A-D2AD55D89593} [2009/08/02 20:28:30 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\clean_and_close@csb7.com [2009/08/02 20:28:28 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\enquiries@retailmenot.com [2009/08/02 20:28:20 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\homo_nudus@livejournal.com [2009/08/02 20:28:20 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\myTimeZone@smartgamez.org [2009/08/02 20:28:45 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\theme@yogurttree.com [2009/08/02 20:28:52 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\twitternotifier@naan.net [2009/08/02 20:28:52 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\twittytunes@extras.foxytunes.com [2009/08/02 20:28:27 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\twitzerTiny@shorttext.com [2009/08/02 20:28:21 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\waybackbutton@lazar.kovacevic [2009/08/02 20:28:52 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.backup\extensions\youtube-comment-snob@efinke.com [2009/06/30 16:36:58 \| 00,001,655 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\aeromp3com.xml [2009/07/31 23:40:53 \| 00,002,353 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\allmusic---album.xml [2009/07/31 23:40:53 \| 00,002,367 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\allmusic---artistgroup.xml [2009/07/31 23:40:53 \| 00,002,353 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\allmusic---song.xml [2009/07/02 10:27:18 \| 00,000,958 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\allrecipes.xml [2009/07/14 10:03:03 \| 00,002,164 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\bing.xml [2009/07/31 23:40:53 \| 00,001,137 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\dictionarycom.xml [2009/07/31 23:40:51 \| 00,002,859 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\google-images.xml [2009/07/24 22:35:12 \| 00,001,775 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\google-language-fr.xml [2009/08/01 15:25:19 \| 00,002,563 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\google-maps.xml [2009/08/02 21:08:26 \| 00,002,607 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\google-news---by-date.xml [2009/08/02 21:08:25 \| 00,002,136 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\google-news-fr.xml [2009/07/31 23:40:55 \| 00,002,572 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\halfcom.xml [2009/07/31 23:40:52 \| 00,002,229 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\hulu.xml [2009/07/31 23:40:52 \| 00,002,996 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\imdb.xml [2009/07/31 23:40:54 \| 00,000,957 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\le-conjugueur.xml [2009/07/31 23:40:39 \| 00,002,192 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\ljseek.xml [2009/07/31 23:40:54 \| 00,002,194 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\lyricwiki-direct.xml [2009/07/31 23:40:41 \| 00,002,195 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\lyricwikiorg.xml [2009/07/31 23:40:51 \| 00,000,880 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\merriam-webster-dictionary.xml [2009/07/31 23:40:52 \| 00,001,134 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\mininova.xml [2009/08/02 21:08:27 \| 00,001,942 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\mycroft-project.xml [2009/07/31 23:40:34 \| 00,000,947 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\npr.xml [2009/07/31 23:40:44 \| 00,001,079 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\radio-locator.xml [2009/08/02 21:08:27 \| 00,002,340 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\retailmenot.xml [2009/02/04 00:38:40 \| 00,000,961 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\shareminercom.xml [2009/07/31 23:40:54 \| 00,001,285 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\snopescom.xml [2009/07/31 23:40:46 \| 00,001,913 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\stumbleupon.xml [2009/07/31 23:40:50 \| 00,002,317 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\the-infosphere.xml [2009/07/31 23:40:33 \| 00,002,040 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\the-simpsons-archive.xml [2009/02/25 22:25:10 \| 00,001,281 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\twitter-search.xml [2009/07/31 23:40:46 \| 00,001,536 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\uni-directory.xml [2009/07/31 23:40:54 \| 00,002,643 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\wayback-machine.xml [2009/07/31 23:40:43 \| 00,000,931 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\webster-thesaurus.xml [2009/07/31 23:40:49 \| 00,002,281 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\wikiquote-en-1.xml [2009/07/31 23:40:48 \| 00,002,310 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\wikiquote-en.xml [2008/09/30 16:33:50 \| 00,001,678 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\wr-english-french.xml [2008/09/30 16:33:50 \| 00,001,878 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\wr-french-english.xml [2009/07/31 23:40:52 \| 00,002,431 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Mozilla\FireFox\Profiles\7y737qrl.default\searchplugins\youtube.xml [2009/06/01 15:35:52 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mozilla firefox\extensions [2009/07/14 07:55:23 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009/02/14 14:29:33 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} [2009/03/28 15:32:27 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2009/07/14 07:54:34 \| 00,023,032 \| ---- \| M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll [2009/07/14 07:54:34 \| 00,134,648 \| ---- \| M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll [2008/12/24 06:27:02 \| 00,122,880 \| ---- \| M] (Google) -- C:\Program Files\mozilla firefox\components\GoogleDesktopMozilla.dll [2006/06/15 21:33:58 \| 00,233,472 \| ---- \| M] (C3D) -- C:\Program Files\mozilla firefox\plugins\CrazyTalk4Native.dll [2006/05/25 19:43:32 \| 00,204,895 \| ---- \| M] (Reallusion Inc.) -- C:\Program Files\mozilla firefox\plugins\ctdomemhelper.dll [2005/09/29 15:41:38 \| 00,077,824 \| ---- \| M] (Reallusion Inc.) -- C:\Program Files\mozilla firefox\plugins\ctframeplayerobject.dll [2006/06/19 14:10:42 \| 00,426,081 \| ---- \| M] (Reallusion Inc.) -- C:\Program Files\mozilla firefox\plugins\ctplayerobject.dll [2005/02/02 13:19:12 \| 00,458,752 \| ---- \| M] (BEXTech) -- C:\Program Files\mozilla firefox\plugins\imagickrt.dll [2008/11/24 15:35:00 \| 00,114,688 \| ---- \| M] (Adobe Systems, Inc.) -- C:\Program Files\mozilla firefox\plugins\np32dsw.dll [2009/03/09 05:19:09 \| 00,410,984 \| ---- \| M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeploytk.dll [2009/07/14 07:55:04 \| 00,065,528 \| ---- \| M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll [2006/10/26 21:12:16 \| 00,016,192 \| ---- \| M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2009/02/27 12:13:42 \| 00,103,792 \| ---- \| M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2008/12/09 23:47:29 \| 00,144,960 \| ---- \| M] (RealNetworks, Inc.) -- C:\Program Files\mozilla firefox\plugins\nppl3260.dll [2009/06/02 17:17:47 \| 00,143,360 \| ---- \| M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2009/06/02 17:17:47 \| 00,143,360 \| ---- \| M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2009/06/02 17:17:48 \| 00,143,360 \| ---- \| M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2009/06/02 17:17:48 \| 00,143,360 \| ---- \| M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2009/06/02 17:17:48 \| 00,143,360 \| ---- \| M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2009/06/02 17:17:48 \| 00,143,360 \| ---- \| M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll [2009/06/02 17:17:48 \| 00,143,360 \| ---- \| M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll [2008/12/09 23:47:37 \| 00,008,192 \| ---- \| M] (RealNetworks, Inc.) -- C:\Program Files\mozilla firefox\plugins\nprjplug.dll [2006/01/03 17:00:40 \| 00,069,632 \| ---- \| M] ( ) -- C:\Program Files\mozilla firefox\plugins\npRLCT4Player.dll [2008/12/09 23:47:20 \| 00,094,208 \| ---- \| M] (RealNetworks, Inc.) -- C:\Program Files\mozilla firefox\plugins\nprpjplug.dll [2006/04/10 19:35:38 \| 00,139,264 \| ---- \| M] (Reallusion Inc.) -- C:\Program Files\mozilla firefox\plugins\rlcontentclass.dll [2005/11/09 12:10:06 \| 00,204,800 \| ---- \| M] () -- C:\Program Files\mozilla firefox\plugins\RLMusicPacker.dll [2005/11/09 12:42:52 \| 00,106,496 \| ---- \| M] () -- C:\Program Files\mozilla firefox\plugins\RLMusicUnpacker.dll [2006/01/04 12:22:00 \| 00,212,992 \| ---- \| M] () -- C:\Program Files\mozilla firefox\plugins\RLVoicePacker.dll [2006/01/04 12:21:44 \| 00,167,936 \| ---- \| M] () -- C:\Program Files\mozilla firefox\plugins\RLVoiceUnpacker.dll [2009/07/14 07:55:13 \| 00,001,394 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml [2009/07/14 07:55:13 \| 00,002,193 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml [2009/07/14 07:55:13 \| 00,001,534 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml [2009/07/14 07:55:13 \| 00,002,343 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml [2009/07/14 07:55:13 \| 00,001,706 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2009/07/14 07:55:14 \| 00,001,178 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml [2009/07/14 07:55:14 \| 00,000,792 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml O1 HOSTS File: (289944 bytes) - C:\Windows\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 9987 more lines... O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll (Google Inc.) O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft) O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.) O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [Broadcom Wireless Manager UI] C:\Windows\System32\WLTRAY.exe (Dell Inc.) O4 - HKLM..\Run: [DELL Webcam Manager] C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe (Creative Technology Ltd.) O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) O4 - HKLM..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe (Intel Corporation) O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation) O4 - HKLM..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe (Intel Corporation) O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.) O4 - HKLM..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe (Creative Technology Ltd.) O4 - HKLM..\Run: [Persistence] C:\Windows\System32\igfxpers.exe (Intel Corporation) O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.) O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe (IDT, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (Microsoft Corporation) O4 - HKCU..\Run: [googletalk] C:\Users\Rebecca\AppData\Roaming\Google\Google Talk\googletalk.exe (Google) O4 - HKCU..\Run: [Semagic] C:\Program Files\Semagic\LiveJournalU.exe (Alexey Semenov) O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (Microsoft Corporation) O4 - Startup: C:\Users\Rebecca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskmgr = 0 O8 - Extra context menu item: Copy to Semagic - C:\Program Files\Semagic\copy.htm () O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Semagic - C:\Program Files\Semagic\link.htm () O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O15 - HKLM\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKCU\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} http://173.27.72.195/plugin/h263ctrl.cab (VaPgCtrl Class) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_05) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 134.161.1.39 134.161.1.33 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/09/18 16:43:36 \| 00,000,024 \| ---- \| M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{cc442ee9-05ff-11de-9ec7-00219bda7f48}\Shell - "" = AutoRun O33 - MountPoints2\{cc442ee9-05ff-11de-9ec7-00219bda7f48}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\Windows\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: () - File not found O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe () NetSvcs: FastUserSwitchingCompatibility - Service key not found. File not found NetSvcs: Ias - Service key not found. File not found NetSvcs: Irmon - Service key not found. File not found NetSvcs: Nla - Service key not found. File not found NetSvcs: Ntmssvc - Service key not found. File not found NetSvcs: NWCWorkstation - Service key not found. File not found NetSvcs: Nwsapagent - Service key not found. File not found NetSvcs: SRService - Service key not found. File not found NetSvcs: Wmi - Service key not found. File not found NetSvcs: WmdmPmSp - Service key not found. File not found NetSvcs: LogonHours - Service key not found. File not found NetSvcs: PCAudit - Service key not found. File not found NetSvcs: helpsvc - Service key not found. File not found NetSvcs: uploadmgr - Service key not found. File not found MsConfig - StartUpFolder: C:^Users^Rebecca^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE - (Microsoft Corporation) MsConfig - StartUpFolder: C:^Users^Rebecca^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Webshots.lnk - C:\Program Files\Webshots\Launcher.exe - (Webshots.com) MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.) MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.) MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) MsConfig - StartUpReg: WinampAgent - hkey= - key= - C:\Program Files\Winamp\winampa.exe () MsConfig - State: "services" - 2 MsConfig - State: "startup" - 2 SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: EventLog - C:\Windows\System32\wevtsvc.dll (Microsoft Corporation) SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft) SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: EventLog - C:\Windows\System32\wevtsvc.dll (Microsoft Corporation) SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft) SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0.3 ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0.3 ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error. ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation) Drivers32: MSVideo8 - C:\Windows\System32\VfWWDM32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) ========== Files/Folders - Created Within 30 Days ========== [2009/08/03 13:47:59 \| 00,000,000 \| ---D \| C] -- C:\Rooter$ [2009/08/03 13:46:44 \| 00,000,000 \| ---D \| C] -- C:\Users\Rebecca\Desktop\Laptop Fix [2009/08/03 13:31:33 \| 00,000,000 \| ---D \| C] -- C:\Windows\ERDNT [2009/08/03 13:31:14 \| 00,000,913 \| ---- \| C] () -- C:\Users\Rebecca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk [2009/08/03 13:31:08 \| 00,000,733 \| ---- \| C] () -- C:\Users\Rebecca\Desktop\NTREGOPT.lnk [2009/08/03 13:31:08 \| 00,000,714 \| ---- \| C] () -- C:\Users\Rebecca\Desktop\ERUNT.lnk [2009/08/03 13:31:06 \| 00,000,000 \| ---D \| C] -- C:\Program Files\ERUNT [2009/08/03 13:27:00 \| 32,107,84768 \| -HS- \| C] () -- C:\hiberfil.sys [2009/08/03 10:39:34 \| 00,172,032 \| ---- \| C] (Intel Corporation) -- C:\Windows\System32\igfxres.dll [2009/08/03 03:56:03 \| 00,000,284 \| ---- \| C] () -- C:\Users\Rebecca\Desktop\Enable_Task_Manager.reg [2009/08/02 19:51:34 \| 00,000,000 \| ---D \| C] -- C:\Users\Rebecca\Documents\July 2009 [2009/08/02 15:23:35 \| 00,000,000 \| ---D \| C] -- C:\Users\Rebecca\Desktop\August 2009 [2009/08/01 10:01:53 \| 00,000,000 \| ---D \| C] -- C:\Users\Rebecca\Desktop\Fabric [2009/07/31 15:35:48 \| 00,806,550 \| ---- \| C] () -- C:\Users\Rebecca\Documents\Bookmarks 2009-07-31.json [2009/07/31 15:34:17 \| 00,002,488 \| ---- \| C] () -- C:\Users\Rebecca\Documents\Results - FEBE 2009 07-31 15.34.17.html [2009/07/31 09:57:57 \| 01,638,912 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2009/07/31 09:57:56 \| 00,206,848 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\occache.dll [2009/07/31 09:57:56 \| 00,025,600 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2009/07/31 09:57:55 \| 00,594,432 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2009/07/31 09:57:55 \| 00,184,320 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2009/07/31 09:57:55 \| 00,055,296 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2009/07/31 09:57:54 \| 00,164,352 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2009/07/31 09:57:54 \| 00,071,680 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2009/07/31 09:57:53 \| 00,915,456 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wininet.dll [2009/07/31 09:57:53 \| 00,055,808 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2009/07/31 09:57:52 \| 01,985,536 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iertutil.dll [2009/07/31 09:57:52 \| 00,173,056 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2009/07/31 09:57:52 \| 00,057,667 \| ---- \| C] () -- C:\Windows\System32\ieuinit.inf [2009/07/31 09:57:52 \| 00,013,312 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2009/07/31 09:57:51 \| 00,386,048 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2009/07/31 09:57:51 \| 00,133,632 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2009/07/31 09:57:51 \| 00,109,056 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll [2009/07/31 09:57:50 \| 01,208,832 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\urlmon.dll [2009/07/31 09:57:49 \| 01,469,440 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2009/07/31 09:57:48 \| 11,067,392 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ieframe.dll [2009/07/31 09:57:46 \| 05,937,152 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.dll [2009/07/31 09:53:32 \| 00,066,560 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mshtmled.dll [2009/07/31 09:53:31 \| 00,072,704 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll [2009/07/31 09:53:31 \| 00,059,904 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\icardie.dll [2009/07/31 09:53:31 \| 00,048,128 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll [2009/07/31 09:53:30 \| 00,156,160 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll [2009/07/31 09:53:30 \| 00,018,944 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\corpol.dll [2009/07/31 09:53:29 \| 00,348,160 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll [2009/07/31 09:53:29 \| 00,125,952 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll [2009/07/31 09:53:29 \| 00,066,560 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\tdc.ocx [2009/07/31 09:53:29 \| 00,034,816 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll [2009/07/31 09:53:28 \| 00,216,064 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll [2009/07/31 09:53:28 \| 00,043,008 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll [2009/07/31 09:53:27 \| 00,236,544 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\webcheck.dll [2009/07/31 09:53:27 \| 00,229,376 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll [2009/07/31 09:53:27 \| 00,193,536 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll [2009/07/31 09:53:27 \| 00,094,720 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll [2009/07/31 09:53:26 \| 00,611,840 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2009/07/31 09:53:26 \| 00,208,384 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\WinFXDocObj.exe [2009/07/31 09:53:26 \| 00,163,840 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll [2009/07/31 09:53:26 \| 00,066,560 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe [2009/07/31 09:53:25 \| 00,128,512 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\advpack.dll [2009/07/31 09:53:25 \| 00,046,592 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll [2009/07/31 09:53:22 \| 00,445,952 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll [2009/07/31 09:53:20 \| 00,726,528 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll [2009/07/31 09:53:20 \| 00,420,352 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll [2009/07/31 09:53:19 \| 00,105,984 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2009/07/31 09:53:13 \| 00,385,024 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2009/07/31 09:53:12 \| 03,698,584 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat [2009/07/31 09:53:12 \| 00,169,472 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe [2009/07/31 09:53:12 \| 00,045,568 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\mshta.exe [2009/07/31 09:53:11 \| 00,109,568 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\PDMSetup.exe [2009/07/31 09:53:11 \| 00,107,520 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe [2009/07/31 09:53:11 \| 00,107,008 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe [2009/07/31 09:53:11 \| 00,103,936 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\SetDepNx.exe [2009/07/28 10:44:22 \| 02,203,716 \| ---- \| C] () -- C:\Users\Rebecca\Desktop\Simple_Sky_by_SloAu.zip [2009/07/23 00:25:21 \| 00,000,000 \| ---D \| C] -- C:\Users\Rebecca\Documents\DestroyToday [2009/07/23 00:25:08 \| 00,000,000 \| ---D \| C] -- C:\Users\Rebecca\AppData\Roaming\app.destroytwitter.23CA2F9B070E2FB8C4472F982F88B1A471F11AE2.1 [2009/07/23 00:10:00 \| 00,000,812 \| ---- \| C] () -- C:\Users\Public\Desktop\DestroyTwitter.lnk [2009/07/23 00:09:59 \| 00,000,000 \| ---D \| C] -- C:\Program Files\DestroyTwitter [2009/07/20 10:55:28 \| 00,000,886 \| ---- \| C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2009/07/20 10:55:26 \| 00,000,882 \| ---- \| C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2009/07/20 10:42:56 \| 00,001,976 \| ---- \| C] () -- C:\Users\Public\Desktop\Google Earth.lnk [2009/07/17 23:40:21 \| 00,000,000 \| ---D \| C] -- C:\Program Files\uTorrent [2009/07/17 23:39:29 \| 00,000,000 \| ---D \| C] -- C:\Users\Rebecca\AppData\Roaming\uTorrent [2009/07/17 17:36:17 \| 00,002,488 \| ---- \| C] () -- C:\Users\Rebecca\Documents\Results - FEBE 2009 07-17 17.36.17.html [2009/07/15 14:26:55 \| 00,000,000 \| ---D \| C] -- C:\Users\Rebecca\Desktop\eBay [2009/07/14 18:58:33 \| 00,773,325 \| ---- \| C] () -- C:\Users\Rebecca\Documents\Bookmarks 2009-07-14.json [2009/07/14 17:42:01 \| 00,156,672 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll [2009/07/14 17:42:00 \| 00,289,792 \| ---- \| C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2009/07/14 17:42:00 \| 00,072,704 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll [2009/07/14 17:42:00 \| 00,010,240 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\dciman32.dll [2009/07/07 20:57:54 \| 00,000,000 \| ---D \| C] -- C:\Program Files\BillyMaysCapsLock [2009/07/07 19:54:46 \| 00,000,000 \| ---D \| C] -- C:\Users\Rebecca\Desktop\July 2009--Music [2009/07/07 19:35:58 \| 00,000,000 \| ---D \| C] -- C:\Program Files\SystemRequirementsLab [2009/07/07 19:35:50 \| 00,000,000 \| ---D \| C] -- C:\Users\Rebecca\AppData\Roaming\SystemRequirementsLab [2009/05/31 00:46:19 \| 01,970,176 \| ---- \| C] () -- C:\Windows\System32\d3dx9.dll [2009/03/31 18:28:37 \| 00,122,880 \| ---- \| C] () -- C:\Windows\System32\trc.dll [2009/03/31 18:27:28 \| 00,005,120 \| ---- \| C] () -- C:\Windows\System32\IcdSptSvps.dll [2009/03/31 18:27:27 \| 00,118,784 \| ---- \| C] () -- C:\Windows\System32\mp3dec.dll [2009/03/31 18:27:27 \| 00,081,920 \| ---- \| C] () -- C:\Windows\System32\dsp_trc.dll [2009/02/20 14:49:52 \| 00,339,968 \| ---- \| C] () -- C:\Windows\System32\pythoncom25.dll [2009/02/20 14:49:51 \| 00,114,688 \| ---- \| C] () -- C:\Windows\System32\pywintypes25.dll [2008/12/09 17:55:25 \| 00,054,784 \| ---- \| C] () -- C:\Windows\System32\bcmwlrmt.dll [2008/12/09 17:53:44 \| 00,016,480 \| ---- \| C] () -- C:\Windows\System32\rixdicon.dll [2008/12/08 19:11:17 \| 01,953,696 \| ---- \| C] () -- C:\Windows\System32\igklg400.dll [2008/12/08 19:11:17 \| 01,533,360 \| ---- \| C] () -- C:\Windows\System32\igklg450.dll [2008/12/08 19:11:17 \| 00,147,456 \| ---- \| C] () -- C:\Windows\System32\igfxCoIn_v1409.dll [2008/12/08 19:11:17 \| 00,104,636 \| ---- \| C] () -- C:\Windows\System32\igmedcompkrn.dll [2008/12/08 19:11:17 \| 00,004,608 \| ---- \| C] () -- C:\Windows\System32\HdmiCoin.dll [2006/11/02 07:35:32 \| 00,005,632 \| ---- \| C] () -- C:\Windows\System32\sysprepMCE.dll [2006/11/02 05:23:31 \| 00,000,219 \| ---- \| C] () -- C:\Windows\win.ini [2006/11/02 05:23:31 \| 00,000,219 \| ---- \| C] () -- C:\Windows\system.ini [2006/11/02 02:40:29 \| 00,013,750 \| ---- \| C] () -- C:\Windows\System32\pacerprf.ini ========== Files - Modified Within 30 Days ========== [2009/08/03 14:00:05 \| 00,000,886 \| ---- \| M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2009/08/03 13:47:26 \| 00,690,960 \| ---- \| M] () -- C:\Windows\System32\PerfStringBackup.INI [2009/08/03 13:47:26 \| 00,595,684 \| ---- \| M] () -- C:\Windows\System32\perfh009.dat [2009/08/03 13:47:26 \| 00,101,350 \| ---- \| M] () -- C:\Windows\System32\perfc009.dat [2009/08/03 13:44:45 \| 00,067,584 \| --S- \| M] () -- C:\Windows\bootstat.dat [2009/08/03 13:31:14 \| 00,000,913 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk [2009/08/03 13:31:08 \| 00,000,733 \| ---- \| M] () -- C:\Users\Rebecca\Desktop\NTREGOPT.lnk [2009/08/03 13:31:08 \| 00,000,714 \| ---- \| M] () -- C:\Users\Rebecca\Desktop\ERUNT.lnk [2009/08/03 13:29:46 \| 00,000,868 \| ---- \| M] () -- C:\Windows\tasks\Google Software Updater.job [2009/08/03 13:27:49 \| 00,000,882 \| ---- \| M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2009/08/03 13:27:17 \| 00,003,712 \| -H-- \| M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2009/08/03 13:27:17 \| 00,003,712 \| -H-- \| M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2009/08/03 13:27:16 \| 00,000,006 \| -H-- \| M] () -- C:\Windows\tasks\SA.DAT [2009/08/03 13:27:00 \| 32,107,84768 \| -HS- \| M] () -- C:\hiberfil.sys [2009/08/03 11:22:35 \| 00,001,356 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Local\d3d9caps.dat [2009/08/03 11:21:21 \| 00,194,560 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009/08/03 03:56:08 \| 00,000,284 \| ---- \| M] () -- C:\Users\Rebecca\Desktop\Enable_Task_Manager.reg [2009/08/03 01:41:51 \| 00,261,176 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Local\GDIPFONTCACHEV1.DAT [2009/08/03 01:40:29 \| 00,754,128 \| ---- \| M] () -- C:\Windows\System32\FNTCACHE.DAT [2009/07/31 15:35:50 \| 00,806,550 \| ---- \| M] () -- C:\Users\Rebecca\Documents\Bookmarks 2009-07-31.json [2009/07/31 15:34:17 \| 00,002,488 \| ---- \| M] () -- C:\Users\Rebecca\Documents\Results - FEBE 2009 07-31 15.34.17.html [2009/07/31 15:34:13 \| 59,382,540 \| ---- \| M] () -- C:\Users\Rebecca\Documents\profileFx3{default}.fbu [2009/07/29 14:26:59 \| 00,000,472 \| ---- \| M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job [2009/07/28 16:42:11 \| 00,000,952 \| ---- \| M] () -- C:\Users\Public\Desktop\Yahoo! Messenger.lnk [2009/07/28 10:44:26 \| 02,203,716 \| ---- \| M] () -- C:\Users\Rebecca\Desktop\Simple_Sky_by_SloAu.zip [2009/07/23 00:10:00 \| 00,000,812 \| ---- \| M] () -- C:\Users\Public\Desktop\DestroyTwitter.lnk [2009/07/21 16:52:28 \| 00,915,456 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\wininet.dll [2009/07/21 16:52:13 \| 01,208,832 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\urlmon.dll [2009/07/21 16:50:46 \| 00,206,848 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\occache.dll [2009/07/21 16:48:31 \| 05,937,152 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.dll [2009/07/21 16:48:27 \| 00,594,432 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2009/07/21 16:48:27 \| 00,055,296 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2009/07/21 16:47:47 \| 00,025,600 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2009/07/21 16:47:41 \| 01,469,440 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2009/07/21 16:47:28 \| 00,164,352 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2009/07/21 16:47:28 \| 00,109,056 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll [2009/07/21 16:47:27 \| 01,985,536 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\iertutil.dll [2009/07/21 16:47:27 \| 00,071,680 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2009/07/21 16:47:26 \| 11,067,392 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\ieframe.dll [2009/07/21 16:47:26 \| 00,184,320 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2009/07/21 16:47:26 \| 00,055,808 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2009/07/21 16:47:21 \| 00,386,048 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2009/07/21 15:13:58 \| 00,133,632 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2009/07/21 15:13:51 \| 00,173,056 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2009/07/21 15:13:15 \| 00,013,312 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2009/07/21 15:12:49 \| 01,638,912 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2009/07/21 13:31:43 \| 00,057,667 \| ---- \| M] () -- C:\Windows\System32\ieuinit.inf [2009/07/20 10:42:56 \| 00,001,976 \| ---- \| M] () -- C:\Users\Public\Desktop\Google Earth.lnk [2009/07/17 17:36:17 \| 00,002,488 \| ---- \| M] () -- C:\Users\Rebecca\Documents\Results - FEBE 2009 07-17 17.36.17.html [2009/07/14 18:58:38 \| 00,773,325 \| ---- \| M] () -- C:\Users\Rebecca\Documents\Bookmarks 2009-07-14.json [2009/07/13 13:36:34 \| 00,038,160 \| ---- \| M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2009/07/13 13:36:12 \| 00,019,096 \| ---- \| M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2009/07/11 08:03:02 \| 00,001,854 \| ---- \| M] () -- C:\Users\Public\Desktop\Safari.lnk [2009/07/07 10:10:56 \| 24,539,592 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\System32\mrt.exe ========== LOP Check ========== [2009/07/23 00:25:08 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming [2008/12/09 18:18:16 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\acccore [2009/02/20 14:51:48 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\agi [2009/02/10 23:49:08 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\aignes [2008/12/09 23:56:03 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\Amazon [2009/07/23 00:25:08 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\app.destroytwitter.23CA2F9B070E2FB8C4472F982F88B1A471F11AE2.1 [2008/12/13 12:16:45 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\Auslogics [2009/04/07 21:02:02 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\com.seesmic.desktop.client.D89F32799270693BEF34AAA36E9B2632B59240FA.1 [2009/02/24 15:32:01 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\de.makesoft.twhirl.0EA062BC275E7ED1E6EC3762EFFD73C7158ADF33.1 [2009/06/30 01:21:02 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\dvdcss [2009/06/21 19:38:38 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\GRLevel3 [2009/04/15 20:17:59 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\gtk-2.0 [2009/06/21 21:44:18 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\iExpert Software [2009/01/07 02:22:05 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\IsolatedStorage [2008/12/23 23:18:11 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\Jasc [2009/01/21 20:48:07 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\Livestation [2006/11/02 07:37:34 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\Media Center Programs [2009/07/07 19:36:06 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\SystemRequirementsLab [2008/12/10 00:52:53 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\Thunderbird [2008/12/09 17:57:52 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\TMP [2009/04/08 23:55:00 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\Trillian [2009/03/11 17:43:42 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1 [2009/03/03 15:48:10 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\U3 [2009/07/19 19:42:01 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\uTorrent [2009/03/18 21:05:01 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\Vso [2009/02/20 14:51:48 \| 00,000,000 \| ---D \| M] -- C:\Users\Rebecca\AppData\Roaming\Webshots [2009/07/29 14:26:59 \| 00,000,472 \| ---- \| M] () -- C:\Windows\Tasks\Ad-Aware Update (Weekly).job [2009/08/03 13:29:46 \| 00,000,868 \| ---- \| M] () -- C:\Windows\Tasks\Google Software Updater.job [2009/08/03 13:27:49 \| 00,000,882 \| ---- \| M] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job [2009/08/03 14:00:05 \| 00,000,886 \| ---- \| M] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job [2009/08/03 13:27:16 \| 00,000,006 \| -H-- \| M] () -- C:\Windows\Tasks\SA.DAT [2009/07/31 10:27:51 \| 00,032,656 \| ---- \| M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %systemroot%\System32\antiwpa.dll > < %systemroot%\SYSTEM32\wpa.dll > < %systemroot%\setup\scripts\biestart.exe > < %systemroot%\system32\drivers\royal.sys > < %systemroot%\system32\oobe\AntiWPA_Crypt.dll > < %TEMP%\antiwpa_crypt.dll > < %TEMP%\antiwpa.dll /s > < %PROGRAMFILES%\antiwpa.dll /s > < %systemroot%\system32\crypt.dll > < %TEMP%\crypt.dll > < %SYSTEMDRIVE%\. > [2009/08/03 13:57:41 \| 00,000,000 \| ---D \| M] -- C: [2008/12/27 18:59:30 \| 00,000,000 \| -HSD \| M] -- C:\$Recycle.Bin [2008/12/09 19:22:12 \| 00,000,000 \| -HSD \| M] -- C:\Boot [2008/12/08 18:45:19 \| 00,000,000 \| ---D \| M] -- C:\dell [2006/11/02 08:02:03 \| 00,000,000 \| -HSD \| M] -- C:\Documents and Settings [2008/12/08 19:20:58 \| 00,000,000 \| ---D \| M] -- C:\Intel [2008/12/09 23:10:30 \| 00,000,000 \| RH-D \| M] -- C:\MSOCache [2009/07/07 19:30:23 \| 00,000,000 \| ---D \| M] -- C:\PerfLogs [2009/08/03 13:31:06 \| 00,000,000 \| R--D \| M] -- C:\Program Files [2009/06/11 16:44:09 \| 00,000,000 \| -H-D \| M] -- C:\ProgramData [2009/08/03 13:48:01 \| 00,000,000 \| ---D \| M] -- C:\Rooter$ [2009/08/03 13:33:21 \| 00,000,000 \| -HSD \| M] -- C:\System Volume Information [2008/12/09 17:38:02 \| 00,000,000 \| R--D \| M] -- C:\Users [2009/08/03 13:31:33 \| 00,000,000 \| ---D \| M] -- C:\Windows < %SYSTEMDRIVE%\.* > [2009/08/03 13:26:58 \| 00,021,724 \| ---- \| M] () -- C:\aaw7boot.log [2008/12/09 22:51:53 \| 00,000,176 \| ---- \| M] () -- C:\aswBoot.log [2006/09/18 16:43:36 \| 00,000,024 \| ---- \| M] () -- C:\autoexec.bat [2008/01/20 21:24:42 \| 00,333,203 \| RHS- \| M] () -- C:\bootmgr [2008/12/09 19:22:13 \| 00,008,192 \| R-S- \| M] () -- C:\BOOTSECT.BAK [2006/09/18 16:43:37 \| 00,000,010 \| ---- \| M] () -- C:\config.sys [2009/08/03 13:27:00 \| 32,107,84768 \| -HS- \| M] () -- C:\hiberfil.sys [2008/12/09 18:17:58 \| 00,000,367 \| -H-- \| M] () -- C:\IPH.PH [2009/03/08 16:12:08 \| 00,022,729 \| ---- \| M] () -- C:\newfile.enc [2009/03/08 16:12:08 \| 00,022,729 \| ---- \| M] () -- C:\newkey [2009/08/03 13:26:58 \| 35,245,87520 \| -HS- \| M] () -- C:\pagefile.sys [2008/12/12 23:01:04 \| 00,004,244 \| ---- \| M] () -- C:\rapport.txt [2009/08/03 13:51:46 \| 00,001,530 \| ---- \| M] () -- C:\RootRepeal report 08-03-09 (13-51-46).txt [2008/12/09 14:57:08 \| 00,000,000 \| ---- \| M] () -- C:\Updates.txt < %PROGRAMFILES%\. > [2009/08/03 13:31:06 \| 00,000,000 \| R--D \| M] -- C:\Program Files [2008/12/10 01:04:55 \| 00,000,000 \| ---D \| M] -- C:\Program Files\7-Zip [2009/03/16 21:39:20 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Adobe [2009/02/20 14:49:41 \| 00,000,000 \| ---D \| M] -- C:\Program Files\AGI [2008/12/09 18:17:56 \| 00,000,000 \| ---D \| M] -- C:\Program Files\AIM6 [2008/12/09 18:24:25 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Alwil Software [2008/12/09 18:15:06 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Amazon [2009/02/10 23:48:55 \| 00,000,000 \| ---D \| M] -- C:\Program Files\AM-DeadLink [2008/12/18 19:23:53 \| 00,000,000 \| ---D \| M] -- C:\Program Files\AMP Font Viewer [2008/12/09 18:22:00 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Apple Software Update [2008/12/21 12:36:35 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Audacity [2008/12/09 23:54:38 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Auslogics [2009/07/07 20:57:55 \| 00,000,000 \| ---D \| M] -- C:\Program Files\BillyMaysCapsLock [2008/12/20 08:59:30 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Bonjour [2009/05/31 01:24:47 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Cheat Engine [2008/12/09 18:09:20 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Cisco [2009/04/08 13:31:37 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Citrix [2009/04/29 20:58:41 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Common Files [2008/12/09 18:01:23 \| 00,000,000 \| ---D \| M] -- C:\Program Files\CONEXANT [2008/12/09 23:46:09 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Creative [2008/12/09 23:44:11 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Creative Live! Cam [2008/12/18 03:32:31 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Dell [2008/12/09 17:55:56 \| 00,000,000 \| ---D \| M] -- C:\Program Files\DellTPad [2009/07/23 00:10:00 \| 00,000,000 \| ---D \| M] -- C:\Program Files\DestroyTwitter [2009/08/03 13:31:14 \| 00,000,000 \| ---D \| M] -- C:\Program Files\ERUNT [2008/12/12 21:56:13 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Exterminate It! [2008/12/09 18:15:58 \| 00,000,000 \| ---D \| M] -- C:\Program Files\GIMP-2.0 [2009/07/20 10:42:14 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Google [2009/05/30 23:29:43 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Governor of Poker [2009/06/21 19:37:02 \| 00,000,000 \| ---D \| M] -- C:\Program Files\GRLevelX [2009/03/31 18:26:38 \| 00,000,000 \| -H-D \| M] -- C:\Program Files\InstallShield Installation Information [2008/12/09 17:59:01 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Intel [2009/07/31 10:27:01 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Internet Explorer [2009/06/11 02:39:04 \| 00,000,000 \| ---D \| M] -- C:\Program Files\iPod [2009/06/05 23:02:18 \| 00,000,000 \| ---D \| M] -- C:\Program Files\iPod(7) [2008/12/09 23:49:48 \| 00,000,000 \| ---D \| M] -- C:\Program Files\IrfanView [2009/06/11 16:44:09 \| 00,000,000 \| ---D \| M] -- C:\Program Files\iTunes [2008/12/23 23:17:16 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Jasc Software Inc [2009/03/28 15:32:16 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Java [2009/06/11 03:35:02 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Last.fm [2009/02/18 15:25:47 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Lavasoft [2009/01/21 20:47:15 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Livestation [2009/01/07 02:21:55 \| 00,000,000 \| ---D \| M] -- C:\Program Files\ljArchive [2009/08/03 03:54:10 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Malwarebytes' Anti-Malware [2008/12/19 22:22:16 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Microangelo Toolset 6 [2009/04/23 18:58:44 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Microsoft [2006/11/02 07:37:34 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Microsoft Games [2008/12/09 23:23:49 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Microsoft Office [2009/08/02 20:39:52 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Microsoft Silverlight [2008/12/09 23:23:37 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Microsoft Visual Studio [2008/12/09 23:17:40 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Microsoft Visual Studio 8 [2009/05/04 13:17:53 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Microsoft Works [2008/12/09 23:21:40 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Microsoft.NET [2008/12/09 18:02:17 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Modem Diagnostic Tool [2008/01/20 21:35:17 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Movie Maker [2008/12/09 18:26:02 \| 00,000,000 \| ---D \| M] -- C:\Program Files\MozBackup [2009/07/14 07:55:23 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Mozilla Firefox [2009/06/24 15:14:34 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Mozilla Thunderbird [2008/12/09 23:24:19 \| 00,000,000 \| ---D \| M] -- C:\Program Files\MSBuild [2008/12/10 15:10:13 \| 00,000,000 \| ---D \| M] -- C:\Program Files\NOS [2009/01/21 20:47:23 \| 00,000,000 \| ---D \| M] -- C:\Program Files\OpenAL [2009/02/21 10:26:59 \| 00,000,000 \| ---D \| M] -- C:\Program Files\PopCap Games [2009/06/02 17:17:47 \| 00,000,000 \| ---D \| M] -- C:\Program Files\QuickTime [2009/01/26 23:09:10 \| 00,000,000 \| ---D \| M] -- C:\Program Files\QuickTime(127) [2008/12/09 23:47:18 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Real [2006/11/02 07:37:34 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Reference Assemblies [2009/07/11 08:03:01 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Safari [2008/12/09 23:37:20 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Semagic [2008/12/09 17:50:18 \| 00,000,000 \| ---D \| M] -- C:\Program Files\SigmaTel [2009/01/20 20:36:00 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Simplify Media [2009/03/31 18:37:48 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Sony [2009/08/02 20:39:53 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Spybot - Search & Destroy [2008/12/13 08:43:19 \| 00,000,000 \| ---D \| M] -- C:\Program Files\SpywareBlaster [2009/04/29 20:58:29 \| 00,000,000 \| ---D \| M] -- C:\Program Files\SUPERAntiSpyware [2009/07/07 19:35:59 \| 00,000,000 \| ---D \| M] -- C:\Program Files\SystemRequirementsLab [2008/12/12 22:39:01 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Trend Micro [2009/06/01 15:37:12 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Trillian [2009/04/03 18:42:04 \| 00,000,000 \| ---D \| M] -- C:\Program Files\twhirl [2006/11/02 08:01:55 \| 00,000,000 \| -H-D \| M] -- C:\Program Files\Uninstall Information [2009/01/27 14:50:20 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Unlocker [2009/07/17 23:40:21 \| 00,000,000 \| ---D \| M] -- C:\Program Files\uTorrent [2008/12/09 18:20:06 \| 00,000,000 \| ---D \| M] -- C:\Program Files\VideoLAN [2008/12/10 17:24:32 \| 00,000,000 \| ---D \| M] -- C:\Program Files\VSO [2009/02/20 14:53:02 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Webshots [2008/12/09 18:21:58 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Winamp [2008/01/20 21:35:18 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Windows Calendar [2008/01/20 21:35:15 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Windows Collaboration [2008/01/20 21:35:09 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Windows Defender [2008/01/20 21:35:14 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Windows Journal [2009/04/23 18:57:55 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Windows Live [2009/05/30 19:02:41 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Windows Live Safety Center [2009/04/23 18:58:25 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Windows Live SkyDrive [2009/07/15 17:08:41 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Windows Mail [2009/03/09 13:26:20 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Windows Media Player [2006/11/02 07:37:34 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Windows NT [2008/01/20 21:35:14 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Windows Photo Gallery [2008/01/20 21:35:17 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Windows Sidebar [2008/12/10 01:04:35 \| 00,000,000 \| ---D \| M] -- C:\Program Files\WinRAR [2008/12/09 23:25:56 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Yahoo! < %systemroot%\.exe > [2008/01/20 21:24:38 \| 00,058,880 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\bfsvc.exe [2007/07/18 20:51:26 \| 00,090,112 \| ---- \| M] (Creative Technology Ltd.) -- C:\Windows\CtDrvIns.exe [2008/10/29 01:29:41 \| 02,927,104 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\explorer.exe [2008/01/20 21:24:28 \| 00,013,312 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\fveupdate.exe [2008/01/20 21:24:02 \| 00,498,176 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\HelpPane.exe [2006/11/02 04:45:13 \| 00,014,848 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\hh.exe [2008/01/20 21:23:41 \| 00,151,040 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\notepad.exe [2007/10/11 02:02:00 \| 00,028,672 \| ---- \| M] (Creative Technology Ltd.) -- C:\Windows\OEM02Cfg.exe [2007/05/10 02:01:00 \| 00,036,864 \| ---- \| M] (Creative Technology Ltd.) -- C:\Windows\OEM02Mon.exe [2008/01/20 21:24:53 \| 00,134,656 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\regedit.exe [2006/11/02 07:34:41 \| 00,049,680 \| ---- \| M] (Twain Working Group) -- C:\Windows\twunk_16.exe [2006/11/02 07:34:41 \| 00,031,232 \| ---- \| M] (Twain Working Group) -- C:\Windows\twunk_32.exe [2006/09/18 16:43:37 \| 00,256,192 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\winhelp.exe [2006/11/02 04:45:57 \| 00,009,216 \| ---- \| M] (Microsoft Corporation) -- C:\Windows\winhlp32.exe < %systemroot%\system32\drivers\.exe > [2006/08/04 17:39:20 \| 00,386,560 \| ---- \| M] (Conexant Systems, Inc.) -- C:\Windows\system32\drivers\XAudio.exe < %systemroot%\system32\drivers\.dat > < %systemroot%\system\.exe > < %PROGRAMFILES%\.* > [2008/01/20 21:43:21 \| 00,000,174 \| -HS- \| M] () -- C:\Program Files\desktop.ini < %APPDATA%\. > [2008/12/10 17:24:44 \| 00,087,608 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\inst.exe [2008/12/10 17:24:44 \| 00,007,887 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\pcouffin.cat [2008/12/10 17:24:44 \| 00,001,144 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\pcouffin.inf [2008/12/10 17:26:29 \| 00,000,034 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\pcouffin.log [2008/12/10 17:24:44 \| 00,047,360 \| ---- \| M] (VSO Software) -- C:\Users\Rebecca\AppData\Roaming\pcouffin.sys [2009/03/18 21:05:00 \| 00,213,195 \| ---- \| M] () -- C:\Users\Rebecca\AppData\Roaming\vso_ts_preview.xml < set /c > ALLUSERSPROFILE=C:\ProgramData APPDATA=C:\Users\Rebecca\AppData\Roaming CLASSPATH=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=REBECCA-PC ComSpec=C:\Windows\system32\cmd.exe DFSTRACINGON=FALSE FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Users\Rebecca LOCALAPPDATA=C:\Users\Rebecca\AppData\Local LOGONSERVER=\\REBECCA-PC NUMBER_OF_PROCESSORS=2 OS=Windows_NT Path=C:\Program Files\Common Files\Microsoft Shared\Windows Live;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Common Files\Microsoft Shared\Windows Live PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 13, GenuineIntel PROCESSOR_LEVEL=6 PROCESSOR_REVISION=0f0d ProgramData=C:\ProgramData ProgramFiles=C:\Program Files PROMPT=$P$G PUBLIC=C:\Users\Public QTJAVA=C:\Program Files\Java\jre6\lib\ext\QTJava.zip SystemDrive=C: SystemRoot=C:\Windows TEMP=C:\Users\Rebecca\AppData\Local\Temp TMP=C:\Users\Rebecca\AppData\Local\Temp TRACE_FORMAT_SEARCH_PATH=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat USERDOMAIN=Rebecca-PC USERNAME=Rebecca USERPROFILE=C:\Users\Rebecca windir=C:\Windows < End of report > Any help you can give me would be SUPER!! Thanks in advance.

emeraldnzl View Member Profile	Aug 5 2009, 10:57 PM Post #2
Trusted Helper Posts: 8,065 OS: XP Pro	Hello rawbery79, Some essential files missing there. I wonder if you can repair them before we look for the malware I think it likely your machine has. Go to Vista Automatic Repair for information on how to repair/restore your computer. Come back if you run into difficulties. Assuming you are successful, please post a fresh OTL log.

emeraldnzl View Member Profile	Aug 13 2009, 05:14 PM Post #3
Trusted Helper Posts: 8,065 OS: XP Pro	Due to lack of feedback, this topic has been closed. If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.

« Next Oldest · Virus, Spyware and Trojan Removal · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies / Views	Topic Information
Virus, Spyware and Trojan Removal Possible infection on a new laptop? [CLOSED]	2 / 260	11th August 2007 - 01:22 PM shinakuma9 started - last by RiP
Virus, Spyware and Trojan Removal Possible infection? Major issues with Vista Ultimate [Closed]	4 / 281	31st January 2009 - 03:07 PM Kevc66 started - last by Rorschach112
Virus, Spyware and Trojan Removal Bad Infection Please Help [Closed]	6 / 398	5th May 2009 - 07:38 AM kommie started - last by fenzodahl512
Virus, Spyware and Trojan Removal Possible infection? Slow opening / lagging Programs. [Closed]	2 / 96	14th October 2009 - 12:48 AM pvtbrawdy started - last by emeraldnzl