:OTL
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\ShopperReports@ShopperReports.com: C:\Program Files (x86)\ShopperReports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions [2010/12/11 14:38:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\ClickPotatoLite@ClickPotatoLite.com: C:\Program Files (x86)\ClickPotatoLite\bin\10.0.628.0\firefox\extensions [2010/12/11 14:38:25 | 000,000,000 | ---D | M]
[2010/12/11 14:38:45 | 000,000,000 | ---D | M] (ResultBar) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{34EFA911-B536-4C08-BECE-CD5E55C875B0}
[2010/06/14 19:14:54 | 000,000,000 | ---D | M] (Starfield Zoom) -- C:\Program Files (x86)\Mozilla Firefox\extensions\zoomext@starfield
[2009/11/20 13:34:44 | 000,218,624 | ---- | M] (Starfield Technology, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwbe.dll
[2010/12/31 09:37:58 | 000,001,215 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Mp3Tube.xml
O3 - HKU\Ellen_ON_C\..\Toolbar\WebBrowser: (no name) - {46897C77-E7A6-4C33-BFFB-E9C2E2718942} - No CLSID value found.
O4 - HKU\Ellen_ON_C..\Run: [Security Protection] C:\Users\Ellen\AppData\Roaming\defender.exe (Heaventools Software)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
[2011/09/01 23:22:32 | 000,858,624 | ---- | C] (Heaventools Software) -- C:\Users\Ellen\AppData\Roaming\defender.exe
[2011/08/29 17:57:15 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{E84BEB7A-E0CF-4F0F-8F59-7EE8D9FA357D}
[2011/08/28 10:17:18 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{ECE602BC-AD98-4459-B04D-C7F5B913ADB6}
[2011/08/28 10:17:07 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{159DBED8-2E43-42D3-832D-783BBE4FF9FD}
[2011/08/27 22:13:33 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{026944E2-64AE-4380-A749-E38880703412}
[2011/08/27 22:13:17 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{DDDF78E2-A901-4B4F-A74D-D97B8BD82951}
[2011/08/24 18:59:11 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{7C80BB5B-9BFE-48C4-A9BA-DD838AEA101E}
[2011/08/24 18:59:01 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{E532CCD7-12D9-42B6-BB98-6CE89234EA57}
[2011/08/24 13:11:11 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{3C32C7CB-BDE6-410C-9596-3EF636267E9B}
[2011/08/24 13:10:58 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{76BC5BDE-6815-4431-B3DC-2D0CE4A3EA81}
[2011/08/20 17:43:14 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{71EA42B5-7DEC-44FB-9438-54FE8280C454}
[2011/08/20 17:43:00 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{4C88D849-9B5B-4900-97C8-F693C7431902}
[2011/08/19 12:29:44 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{79356D27-6C3A-4DAE-AB50-958A9ADF3F39}
[2011/08/19 12:29:34 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{508DAB8A-E398-4E84-BEAE-4C8AC97BE90A}
[2011/08/18 21:44:48 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{310EABB1-619C-4B71-8D06-50C36650924D}
[2011/08/18 21:44:38 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{0EC0ACC6-7D9A-477B-94CE-022769C1500A}
[2011/08/16 15:12:37 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{3AE65083-CE55-4F3C-8940-57055D723CDA}
[2011/08/16 15:12:27 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{21B01B43-3319-46CE-AFF8-35DAEC1ADD79}
[2011/08/10 20:12:04 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{3AB15D42-76CB-4DD0-85AB-DDA8FC6DFB14}
[2011/08/10 20:11:47 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{44649A46-6440-434B-AF24-DAFFD31217CC}
[2011/08/10 03:23:22 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{BB4387D8-C50D-489D-8DE1-87AEF15039A7}
[2011/08/10 03:23:09 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{95679D6E-2B56-4848-8FB5-31C3338FB54E}
[2011/08/09 19:05:49 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{EF1A11C9-748D-4153-8D69-C18A6771D3FE}
[2011/08/09 19:05:37 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{CEFDC681-FA3B-4888-BA14-B7CDDB361262}
[2011/08/07 10:44:23 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{227BC5E3-C373-4811-9E55-21DCCA94FC8E}
[2011/08/07 10:44:12 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{5E7568C8-65C9-4D08-B4F9-E182ACB4EE2F}
[2011/08/04 21:51:41 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{650211A0-86CB-4E06-B2D7-A7E1E3192574}
[2011/08/04 09:51:18 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{8A2E9E6A-8F15-419F-9C51-4969068EC1D4}
[2011/08/03 13:07:24 | 000,000,000 | ---D | C] -- C:\Users\Ellen\AppData\Local\{66B5F827-B5A3-4E80-9C59-E4948291C2AF}
[2011/09/01 23:22:32 | 000,858,624 | ---- | M] (Heaventools Software) -- C:\Users\Ellen\AppData\Roaming\defender.exe
[2011/09/01 23:22:32 | 000,000,688 | ---- | M] () -- C:\Users\Ellen\Desktop\Security Protection.lnk
[2011/09/01 23:22:32 | 000,000,688 | ---- | C] () -- C:\Users\Ellen\Desktop\Security Protection.lnk
[2010/12/11 14:38:24 | 000,000,000 | ---D | M] -- C:\Users\Ellen\AppData\Roaming\ClickPotatoLite
[2010/12/11 14:38:14 | 000,000,000 | ---D | M] -- C:\Users\Ellen\AppData\Roaming\ShopperReports3
[2010/12/11 14:38:25 | 000,000,000 | ---D | M] -- C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
[2010/12/11 14:38:25 | 000,000,000 | ---D | M] -- C:\ProgramData\ClickPotatoLiteSA
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1028.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1031.txt
[2007/11/07 08:00:40 | 000,010,134 | ---- | M] () -- C:\eula.1033.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1036.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1040.txt
[2007/11/07 08:00:40 | 000,000,118 | ---- | M] () -- C:\eula.1041.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1042.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.2052.txt
[2007/11/07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.3082.txt
[2007/11/07 08:00:40 | 000,001,110 | ---- | M] () -- C:\globdata.ini
[2007/11/07 08:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe
[2007/11/07 08:00:40 | 000,000,843 | ---- | M] () -- C:\install.ini
[2007/11/07 08:03:18 | 000,076,304 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll
[2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll
[2007/11/07 08:03:18 | 000,091,152 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll
[2007/11/07 08:03:18 | 000,097,296 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll
[2007/11/07 08:03:18 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll
[2007/11/07 08:03:18 | 000,081,424 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll
[2007/11/07 08:03:18 | 000,079,888 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll
[2007/11/07 08:03:18 | 000,075,792 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll
[2007/11/07 08:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll
[2007/11/07 08:00:40 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp
[2007/11/07 08:09:22 | 001,442,522 | ---- | M] () -- C:\VC_RED.cab
[2007/11/07 08:12:28 | 000,232,960 | ---- | M] () -- C:\VC_RED.MSI

:Services

:Reg

:Files

:Commands
[purity]
[resethosts]
[emptytemp]
[EMPTYFLASH]
[Reboot]