OTL logfile created on: 7/29/2011 5:04:03 PM - Run 3 OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\James&Catherine\My Documents\Downloads Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1.50 Gb Total Physical Memory | 0.98 Gb Available Physical Memory | 65.20% Memory free 3.60 Gb Paging File | 2.42 Gb Available in Paging File | 67.17% Paging File free Paging file location(s): C:\pagefile.sys 2301 2301 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 111.72 Gb Total Space | 51.13 Gb Free Space | 45.77% Space Free | Partition Type: NTFS Computer Name: PUMPHREY | User Name: James&Catherine | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2011/07/29 16:52:51 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\James&Catherine\My Documents\Downloads\OTL.scr PRC - [2011/07/29 08:50:34 | 001,915,904 | ---- | M] (AVAST Software) -- C:\Documents and Settings\James&Catherine\My Documents\Downloads\aswMBR.exe PRC - [2011/07/02 13:16:24 | 002,424,192 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE PRC - [2011/05/24 08:35:35 | 000,490,112 | ---- | M] (RealNetworks, Inc.) -- c:\Program Files\Real\RealPlayer\realplay.exe PRC - [2011/05/24 08:35:27 | 000,273,544 | ---- | M] (RealNetworks, Inc.) -- c:\Program Files\Real\RealPlayer\Update\realsched.exe PRC - [2011/04/18 17:40:08 | 002,334,560 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgtray.exe PRC - [2011/04/18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe PRC - [2011/04/14 05:36:42 | 001,080,672 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgnsx.exe PRC - [2011/03/29 10:47:46 | 000,170,624 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealUpgrade\realupgrade.exe PRC - [2011/03/28 03:00:52 | 000,351,072 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgcsrvx.exe PRC - [2011/03/16 16:05:14 | 000,656,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgchsvx.exe PRC - [2011/02/28 19:44:14 | 000,391,432 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\BingBar.exe PRC - [2011/02/28 19:44:14 | 000,259,336 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\BingApp.exe PRC - [2011/02/25 11:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE PRC - [2011/02/10 07:55:18 | 001,148,256 | ---- | M] () -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe PRC - [2011/02/08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe PRC - [2011/02/08 05:33:20 | 000,658,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgrsx.exe PRC - [2010/10/27 20:17:52 | 000,207,424 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe PRC - [2010/08/25 12:27:44 | 000,309,824 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac PRC - [2010/03/18 12:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe PRC - [2010/01/27 10:40:58 | 000,323,584 | ---- | M] (Eastman Kodak Company) -- C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe PRC - [2009/05/29 17:58:46 | 000,479,232 | ---- | M] (Nikon Corporation) -- C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe PRC - [2009/01/30 11:34:44 | 001,347,584 | ---- | M] (AWS Convergence Technologies, Inc.) -- C:\Program Files\AWS\WeatherBug\Weather.exe PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007/11/01 19:12:52 | 001,252,232 | ---- | M] () -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe PRC - [2003/08/20 10:09:18 | 003,371,520 | ---- | M] (WASEO) -- C:\Program Files\ClickTray Calendar\ClickTray.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2011/07/29 16:52:51 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\James&Catherine\My Documents\Downloads\OTL.scr MOD - [2011/05/24 08:36:22 | 000,043,520 | ---- | M] (RealNetworks, Inc.) -- C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchrome10browserrecordhelper.dll MOD - [2011/04/18 22:51:18 | 000,653,136 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_31a54e43\msvcr90.dll MOD - [2011/04/18 22:51:18 | 000,569,680 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_31a54e43\msvcp90.dll MOD - [2010/08/23 12:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Disabled | Stopped] -- -- (HidServ) SRV - File not found [Disabled | Stopped] -- -- (AppMgmt) SRV - [2011/04/18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent) SRV - [2011/02/28 19:44:14 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE -- (BBSvc) SRV - [2011/02/25 11:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE -- (SeaPort) SRV - [2011/02/08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd) SRV - [2010/03/18 12:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon) SRV - [2007/11/01 19:12:52 | 001,252,232 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC) SRV - [2007/01/09 22:59:32 | 000,108,648 | ---- | M] (Symantec Corporation) [Auto | Stopped] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (CLTNetCnService) SRV - [2006/08/10 04:11:14 | 000,057,344 | ---- | M] (Sonic Solutions) [Disabled | Stopped] -- C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe -- (Roxio UPnP Renderer 9) SRV - [2006/08/10 04:10:50 | 000,294,912 | ---- | M] (Sonic Solutions) [Disabled | Stopped] -- C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe -- (Roxio Upnp Server 9) SRV - [2003/03/03 15:33:40 | 000,143,360 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\NCS\Sync\NetSvc.exe -- (NetSvc) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2011/04/14 21:28:42 | 000,134,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSDriver.sys -- (AVGIDSDriver) DRV - [2011/04/05 00:59:56 | 000,297,168 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\avgtdix.sys -- (Avgtdix) DRV - [2011/03/16 16:03:20 | 000,032,592 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86) DRV - [2011/03/01 14:25:18 | 000,034,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\avgmfx86.sys -- (Avgmfx86) DRV - [2011/02/22 08:13:02 | 000,022,992 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH) DRV - [2011/02/10 07:53:54 | 000,027,216 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSShim.sys -- (AVGIDSShim) DRV - [2011/02/10 07:53:52 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSFilter.sys -- (AVGIDSFilter) DRV - [2011/01/07 06:41:46 | 000,248,656 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\avgldx86.sys -- (Avgldx86) DRV - [2010/05/10 14:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL) DRV - [2010/02/17 14:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV) DRV - [2009/11/19 01:03:18 | 000,803,328 | R--- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\rt2870.sys -- (rt2870) DRV - [2009/04/15 07:34:00 | 000,519,168 | R--- | M] (Atheros Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\WlanGZXP.sys -- (ZG760_XP) DRV - [2008/04/13 14:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\gameenum.sys -- (gameenum) DRV - [2007/12/05 08:34:01 | 000,123,952 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\SYMEVENT.SYS -- (SymEvent) DRV - [2007/10/30 20:55:38 | 000,191,536 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI) DRV - [2007/10/30 20:55:34 | 000,027,696 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV) DRV - [2007/10/30 20:55:28 | 000,039,856 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMIDS.SYS -- (SYMIDS) DRV - [2007/10/30 20:55:24 | 000,035,120 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMNDIS.SYS -- (SYMNDIS) DRV - [2007/10/30 20:55:20 | 000,145,968 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMFW.SYS -- (SYMFW) DRV - [2007/10/30 20:55:14 | 000,012,848 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMDNS.SYS -- (SYMDNS) DRV - [2007/08/30 04:00:00 | 000,395,312 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl) DRV - [2007/01/11 14:10:04 | 000,029,184 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\goprot51.sys -- (GoProto) DRV - [2006/08/09 04:30:42 | 000,050,688 | ---- | M] (Sonic Solutions) [File_System | Disabled | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\RxFilter.sys -- (RxFilter) DRV - [2006/08/08 09:18:50 | 000,009,432 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DLA\DLADResM.SYS -- (DLADResM) DRV - [2006/08/08 09:18:28 | 000,035,128 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DLA\DLABMFSM.SYS -- (DLABMFSM) DRV - [2006/08/08 09:18:26 | 000,097,880 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DLA\DLAUDF_M.SYS -- (DLAUDF_M) DRV - [2006/08/08 09:18:26 | 000,094,680 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DLA\DLAUDFAM.SYS -- (DLAUDFAM) DRV - [2006/08/08 09:18:24 | 000,026,136 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DLA\DLAOPIOM.SYS -- (DLAOPIOM) DRV - [2006/08/08 09:18:22 | 000,032,504 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DLA\DLABOIOM.SYS -- (DLABOIOM) DRV - [2006/08/08 09:18:20 | 000,104,504 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DLA\DLAIFS_M.SYS -- (DLAIFS_M) DRV - [2006/08/08 09:18:20 | 000,014,552 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DLA\DLAPoolM.SYS -- (DLAPoolM) DRV - [2006/08/01 20:06:20 | 000,012,952 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\DLACDBHM.SYS -- (DLACDBHM) DRV - [2006/08/01 20:06:18 | 000,028,216 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\DLARTL_M.SYS -- (DLARTL_M) DRV - [2006/01/07 11:46:46 | 000,010,344 | ---- | M] (Symantec Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\symlcbrd.sys -- (symlcbrd) DRV - [2005/04/07 17:18:34 | 000,003,840 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\BANTExt.sys -- (BANTExt) DRV - [2004/08/04 01:29:49 | 000,019,455 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys -- (iAimFP4) DRV - [2004/08/04 01:29:47 | 000,012,063 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys -- (iAimFP3) DRV - [2004/08/04 01:29:45 | 000,023,615 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys -- (iAimTV4) DRV - [2004/08/04 01:29:43 | 000,033,599 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys -- (iAimTV3) DRV - [2004/08/04 01:29:42 | 000,019,551 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys -- (iAimTV1) DRV - [2004/08/04 01:29:41 | 000,029,311 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys -- (iAimTV0) DRV - [2004/08/04 01:29:37 | 000,012,415 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys -- (iAimFP0) DRV - [2004/08/04 01:29:37 | 000,012,127 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys -- (iAimFP1) DRV - [2004/08/04 01:29:37 | 000,011,775 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys -- (iAimFP2) DRV - [2004/08/04 01:29:36 | 000,161,020 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys -- (i81x) DRV - [2003/11/06 12:04:24 | 000,068,320 | ---- | M] (PACE Anti-Piracy, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\TPkd.sys -- (TPkd) DRV - [2003/09/22 12:43:06 | 001,330,048 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\P16X.sys -- (P16X) Creative SB Live! Series (WDM) DRV - [2003/09/22 08:48:06 | 000,130,192 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ctsfm2k.sys -- (ctsfm2k) DRV - [2003/09/22 08:47:38 | 000,178,672 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ctoss2k.sys -- (ossrv) DRV - [2003/08/29 04:59:24 | 001,101,696 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\BCMSM.sys -- (BCMModem) DRV - [2003/03/05 12:19:28 | 000,015,840 | ---- | M] (Creative Technology Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\PFMODNT.SYS -- (PfModNT) DRV - [2002/11/08 15:45:06 | 000,017,217 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys -- (omci) DRV - [2002/05/13 20:59:20 | 000,004,272 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\bvrp_pci.sys -- (bvrp_pci) DRV - [2001/08/17 14:11:06 | 000,066,591 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS -- (EL90XBC) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://ms101.mysearch.com/sa/srchlft.html IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ms101.mysearch.com/sa/srchlft.html IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-800477755-3333981516-2174538972-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://ms101.mysearch.com/sa/srchlft.html IE - HKU\S-1-5-21-800477755-3333981516-2174538972-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ IE - HKU\S-1-5-21-800477755-3333981516-2174538972-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-800477755-3333981516-2174538972-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost;*.local [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultenginename: "MyStart Search" FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-sunm&p=" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/" FF - prefs.js..extensions.enabledItems: {C0D0F6D1-9FC9-4b0a-B485-D5E13AF40D51}:2.3.54 FF - prefs.js..extensions.enabledItems: {A6A0B3F6-6D2D-4c55-96C1-7481BEA2EBF8}:2.1.73 FF - prefs.js..extensions.enabledItems: {9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA}:0.6.0.3 FF - prefs.js..extensions.enabledItems: myTimeZone@smartgamez.org:1.9.0.18 FF - prefs.js..extensions.enabledItems: {d37dc5d0-431d-44e5-8c91-49419370caa1}:2.7.82 FF - prefs.js..extensions.enabledItems: {ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}:2.7.2 FF - prefs.js..extensions.enabledItems: user@imagiris.txt:1.2 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: kodak-companion@mozilla.com:2.1 FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:7 FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.2 FF - prefs.js..extensions.enabledItems: foxmarks@kei.com:3.9.10 FF - prefs.js..extensions.enabledItems: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:2.9.3.1 FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.3 FF - prefs.js..extensions.enabledItems: amznUWL@amazon.com:2.12 FF - prefs.js..extensions.enabledItems: RAWThumbnailViewer@arcsoft.com.cn:2.0.0.11 FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1387 FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.5.1 FF - prefs.js..network.proxy.no_proxies_on: "localhost" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Documents and Settings\James&Catherine\Application Data\Move Networks\plugins\npqmp071505000011.dll (Move Networks) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.647: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.647: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@real.com/RhapsodyPlayerEngine,version=1.1: C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@umediaserver.net/UMediaPlayer: C:\Program Files\UnrealMediaPlayer5Plugin\npUMediaPlayer5.dll (C Systems - Creative Software Solutions since 1996) FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll () FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Documents and Settings\James&Catherine\Application Data\Facebook\npfbplugin_1_0_3.dll ( ) FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Documents and Settings\James&Catherine\Application Data\Move Networks\plugins\npqmp071505000011.dll (Move Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/11/19 13:50:30 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}: C:\Program Files\ArcSoft\Video Downloader\Plugin_FireFox [2010/11/19 16:22:12 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\RAWThumbnailViewer@arcsoft.com.cn: C:\Program Files\ArcSoft\RAW Thumbnail Viewer\FireFox Extension [2010/11/19 16:23:21 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/07/12 09:00:31 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/05/24 08:36:26 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/07/07 12:37:53 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/07/26 16:16:14 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\moveplayer@movenetworks.com: C:\Documents and Settings\James&Catherine\Application Data\Move Networks [2009/11/18 12:22:47 | 000,000,000 | -H-D | M] [2008/06/17 22:34:23 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Extensions [2011/07/27 12:03:34 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions [2011/06/25 10:31:54 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2011/06/25 10:32:03 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}-trash [2010/04/27 02:49:19 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011/07/27 12:03:34 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2009/07/22 23:10:51 | 000,000,000 | ---D | M] (Date Picker/Calendar) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\{A6A0B3F6-6D2D-4c55-96C1-7481BEA2EBF8} [2010/02/11 10:24:53 | 000,000,000 | ---D | M] (Answers) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\{C0D0F6D1-9FC9-4b0a-B485-D5E13AF40D51} [2011/07/11 12:38:05 | 000,000,000 | ---D | M] (FoxClocks) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1} [2011/07/07 12:35:17 | 000,000,000 | ---D | M] (FoxLingo) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66} [2007/03/08 21:50:08 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\{fa5fc832-506e-4e98-b01c-2862ce15b7f6}-trash [2011/03/12 11:29:33 | 000,000,000 | ---D | M] ("Amazon Toolbar") -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\amznUWL@amazon.com [2011/06/25 10:32:09 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\engine@conduit.com [2011/07/13 10:45:31 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\foxmarks@kei.com [2011/03/30 09:50:12 | 000,000,000 | ---D | M] (Kodak EasyShare Gallery Companion) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\kodak-companion@mozilla.com [2009/09/20 16:16:15 | 000,000,000 | ---D | M] (eBay enHancer) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\myTimeZone@smartgamez.org [2011/03/12 11:29:37 | 000,000,000 | ---D | M] (Personas) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\personas@christopher.beard [2009/10/11 19:50:54 | 000,000,000 | ---D | M] (imagiris) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\user@imagiris.txt [2010/12/29 13:10:20 | 000,001,820 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\searchplugins\bing.xml [2009/07/02 22:15:45 | 000,002,246 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\searchplugins\espn.xml [2011/07/27 01:26:23 | 000,001,941 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\searchplugins\goodsearch.xml [2011/07/27 01:26:23 | 000,002,143 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\searchplugins\marketwatch.xml [2011/03/22 10:32:15 | 000,002,195 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\searchplugins\MyStart Search.xml [2011/01/16 11:38:36 | 000,001,742 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\searchplugins\search-the-web.xml [2009/04/10 14:51:20 | 000,002,137 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\searchplugins\yahoo-search.xml [2011/07/26 16:16:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2011/07/26 16:16:17 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} File not found (No name found) -- [2011/07/12 09:00:31 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG10\FIREFOX4 [2009/06/16 11:12:42 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2011/07/07 12:37:51 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2009/11/06 12:37:19 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll [2011/05/04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2009/11/06 12:37:20 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll [2002/09/27 08:59:00 | 000,090,112 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\NpPopup.dll [2011/07/07 12:37:45 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml O1 HOSTS File: ([2010/09/03 10:42:14 | 000,419,433 | R--- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.123topsearch.com O1 - Hosts: 127.0.0.1 123topsearch.com O1 - Hosts: 127.0.0.1 www.132.com O1 - Hosts: 127.0.0.1 132.com O1 - Hosts: 127.0.0.1 www.136136.net O1 - Hosts: 127.0.0.1 136136.net O1 - Hosts: 127.0.0.1 www.163ns.com O1 - Hosts: 127.0.0.1 163ns.com O1 - Hosts: 14474 more lines... O2 - BHO: (IEPlugin Class) - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\Program Files\ArcSoft\Video Downloader\ArcURLRecord.dll (ArcSoft, Inc.) O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\MNYSIDE.DLL (Microsoft Corporation) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (ToolbarBHO Class) - {9519AF7E-638D-4933-BAD6-D33D23C79FE5} - C:\Program Files\ArcSoft\RAW Thumbnail Viewer\EXIFToolBar.dll (ArcSoft Inc.) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (RAW Thumbnail Viewer) - {F301665A-12F8-4331-804A-5BCBD379668C} - C:\Program Files\ArcSoft\RAW Thumbnail Viewer\EXIFToolBar.dll (ArcSoft Inc.) O3 - HKU\S-1-5-21-800477755-3333981516-2174538972-1007\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.) O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [Nikon Transfer Monitor] C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [TkBellExe] c:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.) O4 - HKU\S-1-5-21-800477755-3333981516-2174538972-1007..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe (AWS Convergence Technologies, Inc.) O4 - HKU\S-1-5-21-800477755-3333981516-2174538972-1007..\RunServicesOnce: [washindex] File not found O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe (Eastman Kodak Company) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Wireless N-lite USB Adapter Utility.lnk = C:\Program Files\ZyXEL\N220\Common\N220.exe (ZyXEL Technology, Corp.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = _ [binary data] O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-800477755-3333981516-2174538972-1007\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-800477755-3333981516-2174538972-1007\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKU\S-1-5-21-800477755-3333981516-2174538972-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0 O7 - HKU\S-1-5-21-800477755-3333981516-2174538972-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-800477755-3333981516-2174538972-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Read EXIF - C:\Program Files\ArcSoft\RAW Thumbnail Viewer\ArcEXIFM.htm () O9 - Extra Button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\MNYSIDE.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O15 - HKU\S-1-5-21-800477755-3333981516-2174538972-1007\..Trusted Domains: ([]msn in My Computer) O15 - HKU\S-1-5-21-800477755-3333981516-2174538972-1007\..Trusted Domains: gamehouse.com ([]* in Trusted sites) O15 - HKU\S-1-5-21-800477755-3333981516-2174538972-1007\..Trusted Domains: gamehouse.com ([www] http in Trusted sites) O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} http://housecall60.trendmicro.com/housecall/xscan60.cab (Reg Error: Key error.) O16 - DPF: {0585238B-9CA6-4CCB-A9B2-FE4BA495E880} http://www.smilecam.com/home/ezwebcam/eng5/common/AXWebMonProj1.cab (Reg Error: Key error.) O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB (Reg Error: Key error.) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool) O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} http://www.pcpitstop.com/internet/pcpConnCheck.cab (Reg Error: Key error.) O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} https://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISDataManager.CAB (Reg Error: Key error.) O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab (Reg Error: Key error.) O16 - DPF: {31150A86-0BBA-409F-BEB4-F3922D10BF34} http://213.139.220.50/xplug.ocx (Reg Error: Key error.) O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab (Reg Error: Key error.) O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} http://www.imgag.com/cp/install/AxCtp.cab (Create & Print ActiveX Plug-in) O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc.cab (Office Update Installation Engine) O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsi.cab (Reg Error: Value error.) O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} https://www-secure.symantec.com/techsupp/asa/ctrl/tgctlsr.cab (Reg Error: Value error.) O16 - DPF: {49232000-16E4-426C-A231-62846947304B} http://ipgweb.cce.hp.com/rdqna/downloads/sysinfo.cab (Reg Error: Key error.) O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-17.cab (Reg Error: Key error.) O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab (Reg Error: Key error.) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1147493282437 (MUWebControl Class) O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (Reg Error: Key error.) O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} http://144.122.47.203/activex/AMC.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {90051A81-3018-4826-8B38-DD60B6B53F9C} http://www.snapfish.com/SnapfishUpload.cab (Reg Error: Key error.) O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} http://194.168.163.96/activex/AxisCamControl.cab (Reg Error: Key error.) O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} https://rtc1.webresponse.one.microsoft.com/media/xp/TLIEFlash.CAB (Reg Error: Key error.) O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} http://a19.g.akamai.net/7/19/7125/4058/ftp.coupons.com/r3302/Coupons.cab (Reg Error: Key error.) O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} http://www.dlink.com/products/livedemo/plugin/h263ctrl.cab (Reg Error: Key error.) O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://zone.msn.com/binFramework/v10/ZIntro.cab27513.cab (Reg Error: Key error.) O16 - DPF: {B991DA79-51F7-4011-98D2-1F2592E82A56} http://204.118.132.145/2_0/ACNePlayer.cab (ACNPlayer2 Class) O16 - DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697} http://di.imgag.com/imgag/cp/install/AxCtp2.cab (Reg Error: Key error.) O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} http://www.imgag.com/cp/install/Crusher.cab (Creative Toolbox Plug-in) O16 - DPF: {CA11EB7C-1C85-4577-8A49-9E28EFB30184} http://www.umediaserver.net/bin/UMediaControl4.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.4.0/jinstall-1_4_0-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} https://www-secure.symantec.com/techsupp/asa/SymAData.cab (Reg Error: Key error.) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash5r42.cab (Shockwave Flash Object) O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://www.popcap.com/games/popcaploader_v6.cab (Reg Error: Key error.) O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab (Reg Error: Key error.) O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} http://liveca12.custhelp.com/7530-b327h/rnl/java/RntX.cab (Reg Error: Key error.) O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab (Reg Error: Key error.) O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} http://h30155.www3.hp.com/ediags/hpfix/aio/en/check/qdiagh.cab?326 (QDiagHUpdateObj Class) O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} http://www2.incredimail.com/contents/setup/downloader/imloader.cab (IMDownloader Class) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O16 - DPF: PackageCab http://ak.imgag.com/imgag/cp/install/AxCtp2.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.) O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com) O24 - Desktop WallPaper: C:\Documents and Settings\James&Catherine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\James&Catherine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2005/05/09 17:49:58 | 000,000,659 | ---- | M] () - C:\autoAlbum.log -- [ NTFS ] O32 - AutoRun File - [2002/09/03 10:59:58 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{01d25ad1-f082-11dc-a6ac-000cf1737c84}\Shell\AutoRun\command - "" = Launch.exe O33 - MountPoints2\{65ac5b26-7811-11dc-98f8-000cf1737c84}\Shell - "" = AutoRun O33 - MountPoints2\{65ac5b26-7811-11dc-98f8-000cf1737c84}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{65ac5b26-7811-11dc-98f8-000cf1737c84}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) - File not found O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.) O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: AppMgmt - File not found NetSvcs: HidServ - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found CREATERESTOREPOINT Restore point Set: OTL Restore Point [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2011/07/28 10:56:37 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\James&Catherine\Recent [2011/07/26 16:17:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun [2011/07/26 16:17:28 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2011/07/06 10:19:39 | 000,000,000 | -HSD | C] -- C:\found.000 [2007/01/11 14:05:29 | 003,993,088 | ---- | C] (Linksys, a Division of Cisco Systems, Inc.) -- C:\Program Files\LinksysConnectPC.exe [2006/07/11 14:29:00 | 000,028,672 | R--- | C] ( ) -- C:\WINDOWS\System32\DivXGraphBuilderCallback.dll [28 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2011/07/29 17:04:01 | 000,000,306 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-800477755-3333981516-2174538972-1007.job [2011/07/29 17:04:01 | 000,000,298 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-800477755-3333981516-2174538972-1007.job [2011/07/29 16:24:23 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\prvlcl.dat [2011/07/29 16:19:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2011/07/29 14:19:00 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2011/07/29 10:45:29 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\James&Catherine\My Documents\MBR.dat [2011/07/29 10:37:28 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Desktop\MBR.dat [2011/07/29 08:56:09 | 126,055,670 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm [2011/07/28 13:51:05 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2011/07/28 12:30:18 | 000,172,575 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\census.cache [2011/07/28 12:30:13 | 000,264,193 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\ars.cache [2011/07/28 12:16:58 | 000,000,036 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\housecall.guid.cache [2011/07/26 09:52:38 | 000,000,456 | ---- | M] () -- C:\WINDOWS\tasks\EasyShare Registration Task.job [2011/07/19 11:07:29 | 000,000,020 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT [2011/07/17 12:17:18 | 000,165,646 | ---- | M] () -- C:\Documents and Settings\James&Catherine\My Documents\0717111200.jpg [2011/07/13 03:26:50 | 000,001,170 | ---- | M] () -- C:\WINDOWS\System32\WPA.DBL [2011/07/13 03:24:43 | 000,029,204 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2011/07/13 03:24:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT [2011/07/13 03:24:06 | 000,461,232 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2011/07/13 03:24:04 | 1609,633,792 | -HS- | M] () -- C:\hiberfil.sys [2011/07/12 09:00:32 | 000,000,690 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk [2011/07/07 15:14:14 | 000,222,497 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\iavichjg.avm [2011/06/30 20:09:31 | 000,005,146 | ---- | M] () -- C:\Documents and Settings\James&Catherine\My Documents\joe 2.aspx.htm [28 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2011/07/29 10:45:29 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\James&Catherine\My Documents\MBR.dat [2011/07/29 10:37:28 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Desktop\MBR.dat [2011/07/28 12:30:18 | 000,172,575 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\census.cache [2011/07/28 12:30:13 | 000,264,193 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\ars.cache [2011/07/28 12:16:58 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\housecall.guid.cache [2011/07/17 12:25:00 | 000,165,646 | ---- | C] () -- C:\Documents and Settings\James&Catherine\My Documents\0717111200.jpg [2011/07/07 12:37:57 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk [2011/06/30 20:09:29 | 000,005,146 | ---- | C] () -- C:\Documents and Settings\James&Catherine\My Documents\joe 2.aspx.htm [2011/06/13 15:41:06 | 000,013,931 | R--- | C] () -- C:\WINDOWS\System32\RaCoInst.dat [2011/06/11 09:59:35 | 000,400,578 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-800477755-3333981516-2174538972-1007-0.dat [2010/12/27 11:28:42 | 000,400,578 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat [2010/11/19 13:36:41 | 000,207,001 | ---- | C] () -- C:\WINDOWS\hpoins46.dat [2010/11/19 13:36:41 | 000,000,574 | ---- | C] () -- C:\WINDOWS\hpomdl46.dat [2010/03/17 20:01:35 | 000,000,121 | ---- | C] () -- C:\WINDOWS\Sansa Media Converter.INI [2010/03/06 11:15:09 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\prvlcl.dat [2010/03/03 10:06:00 | 000,044,032 | ---- | C] () -- C:\WINDOWS\unwash.exe [2008/09/14 16:04:03 | 000,269,824 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\rx_audio.Cache [2008/03/12 22:24:04 | 000,003,072 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Application Data\DMX.bmk [2008/03/12 18:55:24 | 000,056,056 | ---- | C] () -- C:\WINDOWS\System32\DLAAPI_W.DLL [2008/01/14 18:47:06 | 000,099,712 | ---- | C] () -- C:\WINDOWS\HPBroker.dll [2007/12/26 19:59:58 | 000,000,268 | RH-- | C] () -- C:\Documents and Settings\All Users\Application Data\Helper Scripts [2007/12/26 19:59:58 | 000,000,268 | RH-- | C] () -- C:\Documents and Settings\James&Catherine\Application Data\Guitars [2007/12/26 19:59:58 | 000,000,020 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT [2007/12/26 19:59:58 | 000,000,012 | RH-- | C] () -- C:\Documents and Settings\All Users\Application Data\Hybrid Basic [2007/11/15 09:47:56 | 000,000,031 | -H-- | C] () -- C:\WINDOWS\uccspecc.sys [2007/10/11 11:17:58 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2007/07/19 13:25:34 | 000,000,022 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\kodakpcd.ini [2007/02/18 17:57:12 | 000,000,414 | ---- | C] () -- C:\WINDOWS\videoimp.ini [2007/02/18 17:56:24 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll [2007/02/18 17:55:14 | 000,032,528 | ---- | C] () -- C:\WINDOWS\AMCAP.EXE [2007/02/08 13:51:43 | 000,063,730 | ---- | C] () -- C:\Program Files\viewsonicinstruct_xp.pdf [2007/02/08 13:51:09 | 000,000,085 | ---- | C] () -- C:\WINDOWS\VSWizard.ini [2007/01/10 14:12:34 | 000,000,214 | ---- | C] () -- C:\WINDOWS\HP_48BitScanUpdatePatch.ini [2006/11/23 17:27:07 | 020,119,552 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\rx_image.Cache [2006/11/16 12:44:17 | 000,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache [2006/11/13 10:46:08 | 000,006,659 | ---- | C] () -- C:\WINDOWS\mozver.dat [2006/10/27 15:42:21 | 000,002,150 | ---- | C] () -- C:\WINDOWS\System32\tmmute.ini [2006/10/09 14:56:55 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\DRM [2006/09/28 15:52:04 | 000,002,696 | ---- | C] () -- C:\WINDOWS\MIXDEF.INI [2006/09/10 18:09:24 | 000,003,840 | ---- | C] () -- C:\WINDOWS\System32\drivers\BANTExt.sys [2006/09/04 17:56:13 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI [2006/08/16 14:47:38 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini [2006/08/09 04:19:50 | 000,520,192 | ---- | C] () -- C:\WINDOWS\System32\CddbPlaylist2Roxio.dll [2006/08/09 04:19:50 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\CddbFileTaggerRoxio.dll [2006/08/09 01:00:00 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\besch.exe [2006/08/09 01:00:00 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\besched.dll [2005/08/26 16:28:34 | 000,143,360 | ---- | C] () -- C:\WINDOWS\unzip.exe [2005/08/26 16:28:20 | 000,024,576 | ---- | C] () -- C:\WINDOWS\shortcut.exe [2005/08/26 16:27:58 | 000,045,056 | ---- | C] () -- C:\WINDOWS\devenum.exe [2005/08/23 10:38:51 | 000,000,208 | ---- | C] () -- C:\WINDOWS\HpBestModeUpdatePatchLog.ini [2005/08/20 22:25:52 | 000,000,004 | ---- | C] () -- C:\WINDOWS\RM_RESULT.DAT [2005/08/20 22:25:15 | 000,000,170 | ---- | C] () -- C:\WINDOWS\GetServer.ini [2005/08/02 17:35:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2005/08/02 17:35:00 | 001,519,616 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe [2005/08/02 17:35:00 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2005/08/02 17:35:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe [2005/08/02 17:35:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2005/08/02 17:35:00 | 000,540,672 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll [2005/08/02 17:35:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2005/08/02 17:35:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe [2005/08/02 17:35:00 | 000,393,216 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe [2005/08/02 17:35:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2005/07/15 14:36:35 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\DivXsm.exe [2005/07/15 14:35:56 | 000,831,488 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll [2005/07/15 14:35:56 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll [2005/07/15 14:35:24 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2005/07/10 15:37:10 | 000,189,952 | ---- | C] () -- C:\WINDOWS\System32\Qcard32.dll [2005/05/09 18:56:38 | 000,000,000 | ---- | C] () -- C:\WINDOWS\hpqEmlSz.INI [2005/05/09 18:29:50 | 000,104,253 | ---- | C] () -- C:\WINDOWS\hpoins04.dat.temp [2005/05/07 13:27:03 | 000,000,044 | ---- | C] () -- C:\WINDOWS\liveup.ini [2005/05/03 11:44:44 | 000,025,157 | ---- | C] () -- C:\WINDOWS\RMAgentOutput.dll [2005/05/03 11:43:44 | 000,126,976 | ---- | C] () -- C:\WINDOWS\dllTSCLIBMT.dll [2005/04/30 13:49:30 | 000,000,020 | ---- | C] () -- C:\WINDOWS\viewer.ini [2005/04/28 14:36:22 | 000,100,724 | ---- | C] () -- C:\WINDOWS\cpeins04.dat [2005/04/28 14:36:22 | 000,017,176 | ---- | C] () -- C:\WINDOWS\hpomdl04.dat.temp [2005/03/19 18:13:22 | 000,000,211 | ---- | C] () -- C:\WINDOWS\btw.ini [2005/03/19 18:13:19 | 000,111,104 | ---- | C] () -- C:\WINDOWS\System32\MVCL13N.DLL [2005/03/19 18:11:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Launcher.INI [2005/03/19 18:11:20 | 000,000,384 | ---- | C] () -- C:\WINDOWS\SIERRA.INI [2005/03/03 16:16:42 | 000,000,256 | ---- | C] () -- C:\WINDOWS\aucfg.ini [2005/03/03 16:04:23 | 000,012,344 | ---- | C] () -- C:\WINDOWS\cdplayer.ini [2004/10/14 10:54:47 | 000,037,027 | ---- | C] () -- C:\WINDOWS\atmoUn.exe [2004/10/04 20:41:04 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat [2004/10/04 03:54:12 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2004/10/01 17:33:46 | 000,000,679 | ---- | C] () -- C:\WINDOWS\TSC.ini [2004/09/21 00:51:54 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2004/08/12 16:45:02 | 000,000,051 | ---- | C] () -- C:\WINDOWS\popcinfo.dat [2004/08/09 17:21:55 | 000,000,351 | ---- | C] () -- C:\WINDOWS\27463468.exe [2004/07/12 11:36:21 | 000,000,022 | ---- | C] () -- C:\WINDOWS\kodakpcd.James&Catherine.ini [2004/07/10 19:55:38 | 000,252,416 | ---- | C] () -- C:\WINDOWS\System32\wsiShared.dll [2004/03/10 23:29:34 | 000,000,138 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\fusioncache.dat [2004/02/11 19:26:36 | 000,000,004 | ---- | C] () -- C:\WINDOWS\uccspecb.sys [2004/01/26 18:23:06 | 000,000,000 | ---- | C] () -- C:\WINDOWS\MSDraw.ini [2004/01/04 22:05:04 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini [2003/12/31 23:28:42 | 000,146,432 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2003/12/31 18:59:42 | 000,004,272 | ---- | C] () -- C:\WINDOWS\System32\drivers\bvrp_pci.sys [2003/12/30 00:06:02 | 000,000,174 | ---- | C] () -- C:\WINDOWS\System32\mcini.ini [2003/12/13 04:18:27 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2003/12/13 04:14:33 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE [2003/12/13 04:11:35 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2003/12/13 04:11:28 | 001,048,576 | ---- | C] () -- C:\WINDOWS\System32\SFMAN.DAT [2003/12/13 04:11:28 | 000,000,231 | ---- | C] () -- C:\WINDOWS\AC3API.INI [2003/12/13 04:11:14 | 000,047,616 | ---- | C] () -- C:\WINDOWS\System32\P16X.dll [2003/12/13 04:11:14 | 000,002,516 | ---- | C] () -- C:\WINDOWS\System32\P16X.ini [2003/12/13 04:11:14 | 000,000,026 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini [2003/12/13 04:11:13 | 000,000,064 | ---- | C] () -- C:\WINDOWS\P16x.ini [2003/12/13 04:10:45 | 000,000,245 | ---- | C] () -- C:\WINDOWS\SBWIN.INI [2003/12/13 04:09:34 | 000,000,928 | ---- | C] () -- C:\WINDOWS\wininit.ini [2003/12/13 04:05:51 | 000,000,891 | ---- | C] () -- C:\WINDOWS\orun32.ini [2003/12/13 03:52:16 | 000,002,048 | --S- | C] () -- C:\WINDOWS\BOOTSTAT.DAT [2003/12/13 03:50:53 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2003/12/13 03:50:08 | 000,483,004 | ---- | C] () -- C:\WINDOWS\System32\PERFH009.DAT [2003/12/13 03:50:08 | 000,080,408 | ---- | C] () -- C:\WINDOWS\System32\PERFC009.DAT [2003/12/13 03:38:50 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI [2003/10/02 01:00:00 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lockout.dll [2003/10/02 01:00:00 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\lockres.dll [2003/04/04 12:59:08 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\ACNePlayer.dll [2002/09/30 07:15:30 | 000,461,232 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2002/09/30 07:10:58 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2002/09/03 10:59:14 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2002/09/03 10:56:30 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2002/09/03 10:31:46 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\OEMBIOS.BIN [2002/09/03 10:31:44 | 000,004,594 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2002/08/29 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\MLANG.DAT [2002/08/29 07:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\PERFI009.DAT [2002/08/29 07:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\DSSEC.DAT [2002/08/29 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\MIB.BIN [2002/08/29 07:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\PERFD009.DAT [2002/08/29 07:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2002/08/29 07:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\NOISE.DAT [2002/07/04 15:05:34 | 000,000,269 | ---- | C] () -- C:\WINDOWS\tmupdate.ini [2002/03/14 12:00:26 | 000,038,567 | ---- | C] () -- C:\WINDOWS\System32\pcpbios.exe [2001/12/14 13:34:46 | 000,164,864 | ---- | C] () -- C:\WINDOWS\patchw32.dll [1999/07/23 13:46:48 | 000,000,116 | ---- | C] () -- C:\WINDOWS\AuHCcup1.ini [1999/07/23 10:53:20 | 000,129,536 | ---- | C] () -- C:\WINDOWS\AuHCcup1.dll [1999/05/21 21:10:00 | 000,115,200 | ---- | C] () -- C:\WINDOWS\System32\UnzDll.dll [1999/01/22 14:46:56 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL [1998/08/16 05:00:00 | 000,004,096 | ---- | C] () -- C:\WINDOWS\System32\sysres.dll [1980/01/01 02:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll [color=#E56717]========== LOP Check ==========[/color] [2010/10/21 09:40:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG10 [2010/10/21 09:28:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9 [2003/12/13 04:09:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BVRP Software [2010/10/21 09:39:39 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files [2007/12/26 19:59:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EnterNHelp [2010/05/11 14:45:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GARMIN [2008/05/11 09:58:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Grisoft [2007/01/21 10:52:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Hallmark [2008/04/29 12:21:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IM [2008/04/29 12:19:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IncrediMail [2011/04/15 00:31:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData [2007/12/26 20:00:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nikon [2006/10/09 14:56:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy [2011/03/22 10:34:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Photo Notifier and Animation Creator [2010/04/08 08:48:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PhotoMail [2004/08/24 14:57:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap [2008/05/03 12:43:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sony [2010/11/24 11:47:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP [2007/12/26 19:59:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ultima_T15 [2008/03/18 17:31:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint [2010/11/19 14:41:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Visan [2009/04/02 14:45:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3} [2010/05/06 15:47:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2009/10/12 17:10:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD} [2009/04/09 14:19:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} [2005/06/04 14:32:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\123 Free Solitaire [2007/07/07 19:09:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Aim [2010/10/21 09:40:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\AVG10 [2008/10/01 10:31:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2009/04/13 18:11:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Dealio [2008/01/09 15:43:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\EA [2006/01/05 18:29:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\EarthLink [2010/06/21 18:21:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Facebook [2010/05/11 14:40:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\GARMIN [2006/10/06 01:56:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\IrfanView [2003/12/29 19:50:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Leadertech [2008/05/11 12:30:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\LimeWire [2007/02/13 11:50:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\MailWasherPro [2006/03/22 14:24:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Musicmatch [2007/12/26 20:03:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Nikon [2006/11/08 13:48:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Ofoto [2007/08/18 10:42:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\pixelStorm [2008/11/07 16:12:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Skinux [2008/05/03 12:43:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Sony [2009/11/18 19:54:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Spamihilator [2006/12/01 11:47:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Thunderbird [2008/02/09 11:24:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Uniblue [2010/04/20 09:36:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Unreal Streaming [2008/03/18 17:31:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Viewpoint [2005/12/02 20:54:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Walgreens [2009/07/07 09:26:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\WeatherBug [2007/01/01 11:31:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\WinPatrol [2008/02/09 11:25:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\wsInspector [2011/07/26 09:52:38 | 000,000,456 | ---- | M] () -- C:\WINDOWS\Tasks\EasyShare Registration Task.job [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Custom Scans ==========[/color] [color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color] [color=#A23BEC]< MD5 for: EXPLORER.EXE >[/color] [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe [2007/06/13 07:26:03 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe [2007/06/13 06:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe [color=#A23BEC]< MD5 for: SVCHOST.EXE >[/color] [2002/08/29 07:00:00 | 000,012,800 | ---- | M] (Microsoft Corporation) MD5=0F7D9C87B0CE1FA520473119752C6F79 -- C:\I386\SVCHOST.EXE [2008/04/13 20:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe [2008/04/13 20:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\SYSTEM32\svchost.exe [2004/08/04 03:56:57 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe [color=#A23BEC]< MD5 for: USERINIT.EXE >[/color] [2004/08/04 03:56:57 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe [2008/04/13 20:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe [2008/04/13 20:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\SYSTEM32\userinit.exe [2002/08/29 07:00:00 | 000,022,016 | ---- | M] (Microsoft Corporation) MD5=E931E0A2B8BF0019DB902E98D03662CB -- C:\I386\USERINIT.EXE [color=#A23BEC]< MD5 for: WINLOGON.EXE >[/color] [2004/08/04 03:56:57 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [2002/08/29 07:00:00 | 000,516,608 | ---- | M] (Microsoft Corporation) MD5=2246D8D8F4714A2CEDB21AB9B1849ABB -- C:\I386\WINLOGON.EXE [2008/04/13 20:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [2008/04/13 20:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\SYSTEM32\winlogon.exe [color=#A23BEC]< %systemroot%\*. /mp /s >[/color] [color=#A23BEC]< hklm\software\clients\startmenuinternet|command /rs >[/color] HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2011/07/07 12:37:45 | 000,712,976 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2011/07/07 12:37:45 | 000,712,976 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2011/07/07 12:37:45 | 000,712,976 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2011/07/07 12:37:49 | 000,924,632 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2011/07/07 12:37:49 | 000,924,632 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2011/07/07 12:37:49 | 000,924,632 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ShowIconsCommand: "C:\Program Files\Google\Chrome\Application\chrome.exe" --show-icons [2011/07/09 00:51:19 | 001,012,792 | ---- | M] (Google Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\HideIconsCommand: "C:\Program Files\Google\Chrome\Application\chrome.exe" --hide-icons [2011/07/09 00:51:19 | 001,012,792 | ---- | M] (Google Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ReinstallCommand: "C:\Program Files\Google\Chrome\Application\chrome.exe" --make-default-browser [2011/07/09 00:51:19 | 001,012,792 | ---- | M] (Google Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\shell\open\command\\: "C:\Program Files\Google\Chrome\Application\chrome.exe" [2011/07/09 00:51:19 | 001,012,792 | ---- | M] (Google Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2011/04/25 08:01:34 | 000,173,568 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2011/04/25 08:01:34 | 000,173,568 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2011/04/25 08:01:34 | 000,173,568 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\MSN Explorer\shell\open\command\\: "C:\Program Files\MSN\MSNCoreFiles\MSN6.EXE" [2002/08/29 07:00:00 | 000,094,208 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\InstallInfo\\ReinstallCommand: "C:\Program Files\Safari\Safari.exe" /reinstall [2011/02/15 23:18:16 | 002,388,264 | ---- | M] (Apple Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\InstallInfo\\HideIconsCommand: "C:\Program Files\Safari\Safari.exe" /hideicons [2011/02/15 23:18:16 | 002,388,264 | ---- | M] (Apple Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\InstallInfo\\ShowIconsCommand: "C:\Program Files\Safari\Safari.exe" /showicons [2011/02/15 23:18:16 | 002,388,264 | ---- | M] (Apple Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\shell\open\command\\: "C:\Program Files\Safari\Safari.exe" [2011/02/15 23:18:16 | 002,388,264 | ---- | M] (Apple Inc.) [color=#A23BEC]< hklm\software\clients\startmenuinternet|command /64 /rs >[/color] HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2011/07/07 12:37:45 | 000,712,976 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2011/07/07 12:37:45 | 000,712,976 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2011/07/07 12:37:45 | 000,712,976 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2011/07/07 12:37:49 | 000,924,632 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2011/07/07 12:37:49 | 000,924,632 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2011/07/07 12:37:49 | 000,924,632 | ---- | M] (Mozilla Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ShowIconsCommand: "C:\Program Files\Google\Chrome\Application\chrome.exe" --show-icons [2011/07/09 00:51:19 | 001,012,792 | ---- | M] (Google Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\HideIconsCommand: "C:\Program Files\Google\Chrome\Application\chrome.exe" --hide-icons [2011/07/09 00:51:19 | 001,012,792 | ---- | M] (Google Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ReinstallCommand: "C:\Program Files\Google\Chrome\Application\chrome.exe" --make-default-browser [2011/07/09 00:51:19 | 001,012,792 | ---- | M] (Google Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\shell\open\command\\: "C:\Program Files\Google\Chrome\Application\chrome.exe" [2011/07/09 00:51:19 | 001,012,792 | ---- | M] (Google Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2011/04/25 08:01:34 | 000,173,568 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2011/04/25 08:01:34 | 000,173,568 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2011/04/25 08:01:34 | 000,173,568 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\MSN Explorer\shell\open\command\\: "C:\Program Files\MSN\MSNCoreFiles\MSN6.EXE" [2002/08/29 07:00:00 | 000,094,208 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\InstallInfo\\ReinstallCommand: "C:\Program Files\Safari\Safari.exe" /reinstall [2011/02/15 23:18:16 | 002,388,264 | ---- | M] (Apple Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\InstallInfo\\HideIconsCommand: "C:\Program Files\Safari\Safari.exe" /hideicons [2011/02/15 23:18:16 | 002,388,264 | ---- | M] (Apple Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\InstallInfo\\ShowIconsCommand: "C:\Program Files\Safari\Safari.exe" /showicons [2011/02/15 23:18:16 | 002,388,264 | ---- | M] (Apple Inc.) HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Safari.exe\shell\open\command\\: "C:\Program Files\Safari\Safari.exe" [2011/02/15 23:18:16 | 002,388,264 | ---- | M] (Apple Inc.) [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 873 bytes -> C:\Documents and Settings\James&Catherine\Cookies:XYMm9uXG2BnOdoSRlodeP1 @Alternate Data Stream - 782 bytes -> C:\Documents and Settings\All Users\Application Data\DRM:13KGIHDRiVMotKR7G50Lmp @Alternate Data Stream - 76 bytes -> C:\Documents and Settings\James&Catherine\My Documents\Back UP For CC Cleaner:Roxio EMC Stream @Alternate Data Stream - 179 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:68E05C43 @Alternate Data Stream - 159 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0CA18B9C @Alternate Data Stream - 154 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6122E243 @Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4 < End of report >