I have to restart into safe mode and works. I can continue to do my work in safe mode but, I don't want my laptop to be in safe mode for the rest of it's life.
Can someone PLEASE help?
Here is the OTS Report.
Thank you!
OTS logfile created on: 6/30/2010 12:36:23 PM - Run 4 OTS by OldTimer - Version 3.1.20.1 Folder = C:\Users\Smashley\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18928) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1,013.00 Mb Total Physical Memory | 579.00 Mb Available Physical Memory | 57.00% Memory free 2.00 Gb Paging File | 2.00 Gb Available in Paging File | 86.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 110.32 Gb Total Space | 52.40 Gb Free Space | 47.50% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: SMASH2THELEY Current User Name: Smashley Logged in as Administrator. Current Boot Mode: SafeMode with Networking Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days [Processes - Safe List] avastui.exe -> C:\Program Files\Alwil Software\Avast5\AvastUI.exe -> [2010/03/09 05:24:10 | 002,769,336 | ---- | M] (ALWIL Software) ots.exe -> C:\Users\Smashley\Downloads\OTS.exe -> [2010/02/07 12:43:50 | 000,632,320 | ---- | M] (OldTimer Tools) unsecapp.exe -> C:\Windows\System32\wbem\unsecapp.exe -> [2009/04/11 01:28:08 | 000,037,888 | ---- | M] (Microsoft Corporation) explorer.exe -> C:\Windows\explorer.exe -> [2009/04/11 01:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) [Modules - Safe List] ots.exe -> C:\Users\Smashley\Downloads\OTS.exe -> [2010/02/07 12:43:50 | 000,632,320 | ---- | M] (OldTimer Tools) comctl32.dll -> C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll -> [2009/04/11 01:21:38 | 001,686,016 | ---- | M] (Microsoft Corporation) [Win32 Services - Safe List] (avg9wd) AVG Free WatchDog [Auto | Stopped] -> C:\Program Files\AVG\AVG9\avgwdsvc.exe -> [2010/06/30 12:25:58 | 000,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) (WPFFontCache_v0400) Windows Presentation Foundation Font Cache 4.0.0.0 [On_Demand | Stopped] -> C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -> [2010/03/18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) (clr_optimization_v4.0.30319_32) Microsoft .NET Framework NGEN v4.0.30319_X86 [Auto | Stopped] -> C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -> [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) (ACDaemon) ArcSoft Connect Daemon [Auto | Stopped] -> C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -> [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) (avast! Web Scanner) avast! Web Scanner [On_Demand | Stopped] -> C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -> [2010/03/09 05:24:08 | 000,040,384 | ---- | M] (ALWIL Software) (avast! Mail Scanner) avast! Mail Scanner [On_Demand | Stopped] -> C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -> [2010/03/09 05:24:08 | 000,040,384 | ---- | M] (ALWIL Software) (avast! Antivirus) avast! Antivirus [Auto | Stopped] -> C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -> [2010/03/09 05:24:08 | 000,040,384 | ---- | M] (ALWIL Software) (FontCache) Windows Font Cache Service [On_Demand | Stopped] -> C:\Windows\System32\FntCache.dll -> [2009/09/24 20:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) (avg8emc) AVG Free8 E-mail Scanner [Auto | Stopped] -> C:\Program Files\AVG\AVG8\avgemc.exe -> [2009/08/28 09:28:50 | 000,908,056 | ---- | M] (AVG Technologies CZ, s.r.o.) (avg8wd) AVG Free8 WatchDog [Auto | Stopped] -> C:\Program Files\AVG\AVG8\avgwdsvc.exe -> [2009/08/28 09:28:39 | 000,297,752 | ---- | M] (AVG Technologies CZ, s.r.o.) (McciCMService) McciCMService [Auto | Stopped] -> C:\Program Files\Common Files\Motive\McciCMService.exe -> [2009/08/14 08:45:34 | 000,319,488 | ---- | M] (Alcatel-Lucent) (EMP_UDSA) EMP_UDSA [Auto | Stopped] -> C:\Program Files\EPSON Projector\EPSON USB Display V1.4\EMP_UDSA.exe -> [2009/04/15 19:16:44 | 000,098,304 | ---- | M] (SEIKO EPSON CORPORATION) (odserv) Microsoft Office Diagnostics Service [On_Demand | Stopped] -> C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -> [2008/11/04 01:06:28 | 000,441,712 | ---- | M] (Microsoft Corporation) (WinDefend) Windows Defender [Auto | Running] -> C:\Program Files\Windows Defender\MpSvc.dll -> [2008/01/19 02:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) (WcesComm) Windows Mobile 2003-based device connectivity [Auto | Stopped] -> C:\Windows\WindowsMobile\wcescomm.dll -> [2008/01/19 02:36:49 | 000,365,568 | ---- | M] (Microsoft Corporation) (RapiMgr) Windows Mobile-based device connectivity [Auto | Stopped] -> C:\Windows\WindowsMobile\rapimgr.dll -> [2008/01/19 02:36:15 | 000,167,936 | ---- | M] (Microsoft Corporation) (WLSetupSvc) Windows Live Setup Service [On_Demand | Stopped] -> C:\Program Files\Windows Live\installer\WLSetupSvc.exe -> [2007/10/25 15:27:54 | 000,266,240 | ---- | M] (Microsoft Corporation) (gusvc) Google Updater Service [On_Demand | Stopped] -> C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -> [2007/05/08 20:30:26 | 000,138,168 | ---- | M] (Google) (TNaviSrv) TOSHIBA Navi Support Service [Auto | Stopped] -> C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe -> [2007/04/27 22:15:46 | 000,114,688 | ---- | M] (TOSHIBA Corporation) (hpqcxs08) hpqcxs08 [On_Demand | Stopped] -> C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll -> [2007/03/13 03:23:18 | 000,225,280 | ---- | M] (Hewlett-Packard Co.) (hpqddsvc) HP CUE DeviceDiscovery Service [Auto | Stopped] -> C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll -> [2007/03/13 03:23:18 | 000,131,072 | ---- | M] (Hewlett-Packard Co.) (TOSHIBA Bluetooth Service) TOSHIBA Bluetooth Service [Auto | Stopped] -> C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -> [2007/02/02 17:56:52 | 000,118,784 | ---- | M] (TOSHIBA CORPORATION) (Swupdtmr) Swupdtmr [Auto | Stopped] -> c:\Toshiba\IVP\swupdate\swupdtmr.exe -> [2007/01/25 20:50:26 | 000,063,096 | ---- | M] () (pinger) pinger [Auto | Stopped] -> C:\Toshiba\IVP\ISM\pinger.exe -> [2007/01/25 20:47:50 | 000,136,816 | ---- | M] () (TosCoSrv) TOSHIBA Power Saver [Auto | Stopped] -> C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe -> [2006/12/20 02:15:44 | 000,428,152 | ---- | M] (TOSHIBA Corporation) (CFSvcs) ConfigFree Service [Auto | Stopped] -> C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe -> [2006/11/14 23:33:10 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) (Pml Driver HPZ12) Pml Driver HPZ12 [Auto | Stopped] -> C:\Windows\System32\HPZipm12.dll -> [2006/11/08 17:35:38 | 000,053,248 | ---- | M] (Hewlett-Packard) (Net Driver HPZ12) Net Driver HPZ12 [Auto | Stopped] -> C:\Windows\System32\HPZinw12.dll -> [2006/11/08 17:35:36 | 000,043,520 | ---- | M] (Hewlett-Packard) (ehstart) Windows Media Center Service Launcher [Auto | Stopped] -> C:\Windows\ehome\ehstart.dll -> [2006/11/02 07:35:29 | 000,013,312 | ---- | M] (Microsoft Corporation) (ose) Office Source Engine [On_Demand | Stopped] -> C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -> [2006/10/26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) (AgereModemAudio) Agere Modem Call Progress Audio [Auto | Stopped] -> C:\Windows\System32\agrsmsvc.exe -> [2006/10/05 14:10:12 | 000,009,216 | ---- | M] (Agere Systems) (UleadBurningHelper) Ulead Burning Helper [Auto | Stopped] -> C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -> [2006/08/23 19:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) (TODDSrv) TOSHIBA Optical Disc Drive Service [Auto | Stopped] -> C:\Windows\System32\TODDSrv.exe -> [2006/05/25 21:30:16 | 000,114,688 | ---- | M] (TOSHIBA Corporation) (IDriverT) InstallDriver Table Manager [On_Demand | Stopped] -> C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -> [2005/11/14 03:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [Driver Services - Safe List] (AvgTdiX) AVG Free Network Redirector [Kernel | System | Stopped] -> C:\Windows\System32\Drivers\avgtdix.sys -> [2010/06/30 12:26:17 | 000,360,584 | ---- | M] (AVG Technologies CZ, s.r.o.) (AvgLdx86) AVG Free AVI Loader Driver x86 [Kernel | System | Stopped] -> C:\Windows\System32\Drivers\avgldx86.sys -> [2010/06/30 12:26:15 | 000,333,192 | ---- | M] (AVG Technologies CZ, s.r.o.) (AvgMfx86) AVG Free On-access Scanner Minifilter Driver x86 [File_System | System | Stopped] -> C:\Windows\System32\Drivers\avgmfx86.sys -> [2010/06/30 12:26:14 | 000,028,424 | ---- | M] (AVG Technologies CZ, s.r.o.) (aswTdi) avast! Network Shield Support [Kernel | System | Stopped] -> C:\Windows\System32\drivers\aswTdi.sys -> [2010/03/09 05:12:54 | 000,046,672 | ---- | M] (ALWIL Software) (aswSP) aswSP [Kernel | System | Stopped] -> C:\Windows\System32\drivers\aswSP.sys -> [2010/03/09 05:12:33 | 000,162,640 | ---- | M] (ALWIL Software) (aswRdr) aswRdr [Kernel | System | Running] -> C:\Windows\System32\drivers\aswRdr.sys -> [2010/03/09 05:09:08 | 000,023,376 | ---- | M] (ALWIL Software) (aswMonFlt) aswMonFlt [File_System | Auto | Stopped] -> C:\Windows\System32\drivers\aswMonFlt.sys -> [2010/03/09 05:08:52 | 000,051,792 | ---- | M] (ALWIL Software) (aswFsBlk) aswFsBlk [File_System | Auto | Stopped] -> C:\Windows\System32\drivers\aswFsBlk.sys -> [2010/03/09 05:08:30 | 000,019,024 | ---- | M] (ALWIL Software) (SASENUM) SASENUM [Kernel | On_Demand | Stopped] -> C:\Program Files\SUPERAntiSpyware\sasenum.sys -> [2010/01/05 08:56:06 | 000,007,408 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) (SASDIFSV) SASDIFSV [Kernel | System | Stopped] -> C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -> [2010/01/05 08:56:04 | 000,009,968 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) (SASKUTIL) SASKUTIL [Kernel | System | Stopped] -> C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -> [2010/01/05 08:56:02 | 000,074,480 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) (prmvmouse) Promethean HID Mouse Service [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\activmouse.sys -> [2009/10/05 17:56:52 | 000,006,144 | ---- | M] (Promethean Technologies Ltd) (ActivHidSerMini) Promethean Serial Board Driver [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\activhidsermini.sys -> [2009/05/05 17:25:12 | 000,055,936 | ---- | M] (Promethean Technologies Ltd) (usb_rndisx) USB RNDIS Adapter [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\usb8023x.sys -> [2009/04/10 23:46:08 | 000,015,872 | ---- | M] (Microsoft Corporation) (PxHelp20) PxHelp20 [Kernel | Boot | Running] -> C:\Windows\System32\Drivers\PxHelp20.sys -> [2008/11/20 14:19:06 | 000,043,872 | ---- | M] (Sonic Solutions) (eppvad_simple) EPSON Projector UD Audio Device [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\EMP_UDAU.sys -> [2008/05/14 20:06:06 | 000,017,664 | ---- | M] (SEIKO EPSON CORPORATION) (NETw4v32) Intel(R) Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\NETw4v32.sys -> [2007/09/26 14:12:22 | 002,251,776 | ---- | M] (Intel Corporation) (tos_sps32) TOSHIBA tos_sps32 Service [Kernel | Boot | Running] -> C:\Windows\system32\DRIVERS\tos_sps32.sys -> [2007/04/27 22:13:58 | 000,285,184 | ---- | M] (TOSHIBA Corporation) (IntcAzAudAddService) Service for Realtek HD Audio (WDM) [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\RTKVHDA.sys -> [2007/02/06 21:44:14 | 001,739,816 | ---- | M] (Realtek Semiconductor Corp.) (SynTP) Synaptics TouchPad Driver [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\SynTP.sys -> [2007/02/02 17:05:18 | 000,182,328 | ---- | M] (Synaptics, Inc.) (tifm21) tifm21 [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\tifm21.sys -> [2007/01/24 17:44:06 | 000,290,304 | ---- | M] (Texas Instruments) (yukonwlh) NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\yk60x86.sys -> [2007/01/09 13:00:00 | 000,221,696 | ---- | M] (Marvell) (KR3NPXP) KR3NPXP [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\kr3npxp.sys -> [2007/01/03 03:43:19 | 000,479,488 | ---- | M] (TOSHIBA CORPORATION) (KR10N) KR10N [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\kr10n.sys -> [2007/01/03 03:43:19 | 000,207,104 | ---- | M] (TOSHIBA CORPORATION) (KR10I) KR10I [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\kr10i.sys -> [2007/01/03 03:43:18 | 000,216,320 | ---- | M] (TOSHIBA CORPORATION) (AgereSoftModem) TOSHIBA V92 Software Modem [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\AGRSM.sys -> [2006/11/28 17:11:00 | 001,161,888 | ---- | M] (Agere Systems) (FwLnk) FwLnk Driver [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\FwLnk.sys -> [2006/11/20 01:11:14 | 000,007,168 | ---- | M] (TOSHIBA Corporation) (ql2300) QLogic Fibre Channel Miniport Driver [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\ql2300.sys -> [2006/11/02 04:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) (adp94xx) adp94xx [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\adp94xx.sys -> [2006/11/02 04:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) (elxstor) elxstor [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\elxstor.sys -> [2006/11/02 04:51:34 | 000,316,520 | ---- | M] (Emulex) (adpahci) adpahci [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\adpahci.sys -> [2006/11/02 04:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) (uliahci) uliahci [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\uliahci.sys -> [2006/11/02 04:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) (iaStorV) Intel RAID Controller Vista [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\iastorv.sys -> [2006/11/02 04:51:25 | 000,232,040 | ---- | M] (Intel Corporation) (adpu320) adpu320 [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\adpu320.sys -> [2006/11/02 04:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) (ulsata2) ulsata2 [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\ulsata2.sys -> [2006/11/02 04:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) (vsmraid) vsmraid [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\vsmraid.sys -> [2006/11/02 04:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) (ql40xx) QLogic iSCSI Miniport Driver [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\ql40xx.sys -> [2006/11/02 04:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) (UlSata) UlSata [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\ulsata.sys -> [2006/11/02 04:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) (adpu160m) adpu160m [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\adpu160m.sys -> [2006/11/02 04:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) (nvraid) nvraid [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\nvraid.sys -> [2006/11/02 04:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) (nfrd960) nfrd960 [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\nfrd960.sys -> [2006/11/02 04:50:19 | 000,045,160 | ---- | M] (IBM Corporation) (iirsp) iirsp [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\iirsp.sys -> [2006/11/02 04:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) (SiSRaid4) SiSRaid4 [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\sisraid4.sys -> [2006/11/02 04:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) (nvstor) nvstor [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\nvstor.sys -> [2006/11/02 04:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) (aic78xx) aic78xx [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\djsvs.sys -> [2006/11/02 04:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) (arcsas) arcsas [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\arcsas.sys -> [2006/11/02 04:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) (LSI_SCSI) LSI_SCSI [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\lsi_scsi.sys -> [2006/11/02 04:50:10 | 000,065,640 | ---- | M] (LSI Logic) (SiSRaid2) SiSRaid2 [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\sisraid2.sys -> [2006/11/02 04:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) (HpCISSs) HpCISSs [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\hpcisss.sys -> [2006/11/02 04:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) (arc) arc [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\arc.sys -> [2006/11/02 04:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) (iteraid) ITERAID_Service_Install [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\iteraid.sys -> [2006/11/02 04:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) (iteatapi) ITEATAPI_Service_Install [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\iteatapi.sys -> [2006/11/02 04:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) (LSI_SAS) LSI_SAS [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\lsi_sas.sys -> [2006/11/02 04:50:05 | 000,065,640 | ---- | M] (LSI Logic) (Symc8xx) Symc8xx [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\symc8xx.sys -> [2006/11/02 04:50:05 | 000,035,944 | ---- | M] (LSI Logic) (LSI_FC) LSI_FC [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\lsi_fc.sys -> [2006/11/02 04:50:04 | 000,065,640 | ---- | M] (LSI Logic) (Sym_u3) Sym_u3 [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\sym_u3.sys -> [2006/11/02 04:50:03 | 000,034,920 | ---- | M] (LSI Logic) (Mraid35x) Mraid35x [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\mraid35x.sys -> [2006/11/02 04:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) (Sym_hi) Sym_hi [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\sym_hi.sys -> [2006/11/02 04:49:56 | 000,031,848 | ---- | M] (LSI Logic) (megasas) megasas [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\megasas.sys -> [2006/11/02 04:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) (viaide) viaide [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\viaide.sys -> [2006/11/02 04:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) (cmdide) cmdide [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\cmdide.sys -> [2006/11/02 04:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) (aliide) aliide [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\aliide.sys -> [2006/11/02 04:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) (Brserid) Brother MFC Serial Port Interface Driver (WDM) [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\brserid.sys -> [2006/11/02 03:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) (BrSerWdm) Brother WDM Serial driver [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\brserwdm.sys -> [2006/11/02 03:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) (BrUsbMdm) Brother MFC USB Fax Only Modem [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\brusbmdm.sys -> [2006/11/02 03:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) (ntrigdigi) N-trig HID Tablet Driver [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\ntrigdigi.sys -> [2006/11/02 02:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) (secdrv) Security Driver [Kernel | Auto | Stopped] -> C:\Windows\System32\drivers\secdrv.sys -> [2006/11/02 01:37:21 | 000,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) (tdcmdpst) TOSHIBA Writing Engine Filter Driver [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\tdcmdpst.sys -> [2006/10/18 14:50:04 | 000,016,128 | ---- | M] (TOSHIBA Corporation.) (TVALZ) TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver [Kernel | Boot | Running] -> C:\Windows\system32\DRIVERS\TVALZ_O.SYS -> [2006/10/06 01:22:14 | 000,016,768 | ---- | M] (TOSHIBA Corporation) [Registry - Safe List] < Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> HKEY_LOCAL_MACHINE\: Search\\"CustomSearch" -> http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr8/*http://www.yahoo.com/ext/search/search.html -> < Internet Explorer Settings [HKEY_USERS\.DEFAULT\] > -> -> HKEY_USERS\.DEFAULT\: URLSearchHooks\\"{A3BC75A2-1F87-4686-AA43-5347D756017C}" [HKLM] -> C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll [AVG Security Toolbar BHO] -> [2009/11/25 13:01:54 | 001,230,080 | ---- | M] () HKEY_USERS\.DEFAULT\: "ProxyEnable" -> 0 -> < Internet Explorer Settings [HKEY_USERS\S-1-5-18\] > -> -> HKEY_USERS\S-1-5-18\: URLSearchHooks\\"{A3BC75A2-1F87-4686-AA43-5347D756017C}" [HKLM] -> C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll [AVG Security Toolbar BHO] -> [2009/11/25 13:01:54 | 001,230,080 | ---- | M] () HKEY_USERS\S-1-5-18\: "ProxyEnable" -> 0 -> < Internet Explorer Settings [HKEY_USERS\S-1-5-19\] > -> -> < Internet Explorer Settings [HKEY_USERS\S-1-5-20\] > -> -> < Internet Explorer Settings [HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\] > -> -> HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\: Main\\"StartPageCache" -> 1 -> HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\: Search\\"Default_Search_URL" -> http://www.google.com/ie -> HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\: SearchURL\\"" -> http://home.microsoft.com/access/autosearch.asp?p=%s -> HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\: URLSearchHooks\\"{A3BC75A2-1F87-4686-AA43-5347D756017C}" [HKLM] -> C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll [AVG Security Toolbar BHO] -> [2009/11/25 13:01:54 | 001,230,080 | ---- | M] () HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\: "ProxyEnable" -> 1 -> HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\: "ProxyOverride" -> <local> -> HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\: "ProxyServer" -> http=127.0.0.1:5577 -> < FireFox Settings [Prefs.js] > -> C:\Users\Smashley\AppData\Roaming\Mozilla\FireFox\Profiles\vtup31pg.default\prefs.js -> browser.search.defaultenginename -> "Yahoo! Search" -> browser.search.defaulturl -> "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=" -> browser.search.selectedEngine -> "Bing" -> browser.search.useDBForOrder -> true -> browser.startup.homepage -> "http://weather.yahoo.com/forecast/USLA0319_f.html" -> extensions.enabledItems -> [email protected]:2.0.6 -> extensions.enabledItems -> [email protected]:1.0.0.07076007 -> extensions.enabledItems -> {5b1fdac4-a239-4933-9c52-b65a2a720b75}:2.3 -> extensions.enabledItems -> {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313 -> extensions.enabledItems -> [email protected]:1.0.176.0 -> extensions.enabledItems -> {c2db4fe6-8409-45ce-8010-189a7b5cce86}:2.6.0.15 -> keyword.URL -> "http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p=" -> network.proxy.type -> 4 -> < FireFox Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla HKLM\software\mozilla\Firefox\Extensions -> -> HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71} -> C:\Program Files\AVG\AVG9\Firefox [C:\PROGRAM FILES\AVG\AVG9\FIREFOX] -> [2010/06/30 12:25:58 | 000,000,000 | ---D | M] HKLM\software\mozilla\Firefox\Extensions\\avg@igeared -> C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [C:\PROGRAM FILES\AVG\AVG9\TOOLBAR\FIREFOX\AVG@IGEARED] -> [2010/06/30 12:26:11 | 000,000,000 | ---D | M] HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions -> -> HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components -> C:\Program Files\Mozilla Firefox\components [C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS] -> [2010/06/29 19:34:40 | 000,000,000 | ---D | M] HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins -> C:\Program Files\Mozilla Firefox\plugins [C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS] -> [2010/06/29 19:34:40 | 000,000,000 | ---D | M] < FireFox Extensions [User Folders] > -> -> C:\Users\Smashley\AppData\Roaming\Mozilla\Extensions -> [2009/03/08 13:09:11 | 000,000,000 | ---D | M] -> C:\Users\Smashley\AppData\Roaming\Mozilla\Extensions\[email protected] -> [2009/03/08 13:09:11 | 000,000,000 | ---D | M] -> C:\Users\Smashley\AppData\Roaming\Mozilla\Firefox\Profiles\vtup31pg.default\extensions -> [2010/06/29 19:45:08 | 000,000,000 | ---D | M] Picnik -> C:\Users\Smashley\AppData\Roaming\Mozilla\Firefox\Profiles\vtup31pg.default\extensions\{5b1fdac4-a239-4933-9c52-b65a2a720b75} -> [2008/08/23 16:46:10 | 000,000,000 | ---D | M] Yahoo! Toolbar -> C:\Users\Smashley\AppData\Roaming\Mozilla\Firefox\Profiles\vtup31pg.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} -> [2010/03/24 19:21:33 | 000,000,000 | ---D | M] NCH Toolbar -> C:\Users\Smashley\AppData\Roaming\Mozilla\Firefox\Profiles\vtup31pg.default\extensions\{c2db4fe6-8409-45ce-8010-189a7b5cce86} -> [2010/04/29 17:24:03 | 000,000,000 | ---D | M] -> C:\Users\Smashley\AppData\Roaming\Mozilla\Firefox\Profiles\vtup31pg.default\extensions\[email protected] -> [2010/05/30 11:25:41 | 000,000,000 | ---D | M] -> C:\Users\Smashley\AppData\Roaming\Mozilla\Firefox\Profiles\vtup31pg.default\extensions\[email protected] -> [2010/04/05 13:51:59 | 000,000,000 | ---D | M] -> C:\Users\Smashley\AppData\Roaming\Mozilla\Firefox\Profiles\vtup31pg.default\extensions\[email protected] -> [2008/02/15 22:28:12 | 000,000,000 | ---D | M] < FireFox SearchPlugins [User Folders] > -> bing.xml -> C:\Users\Smashley\AppData\Roaming\Mozilla\Firefox\Profiles\vtup31pg.default\searchplugins\bing.xml -> [2010/04/06 02:49:06 | 000,001,820 | ---- | M] () photobucket.xml -> C:\Users\Smashley\AppData\Roaming\Mozilla\Firefox\Profiles\vtup31pg.default\searchplugins\photobucket.xml -> [2010/04/06 02:50:35 | 000,002,270 | ---- | M] () siteadvisor.xml -> C:\Users\Smashley\AppData\Roaming\Mozilla\Firefox\Profiles\vtup31pg.default\searchplugins\siteadvisor.xml -> [2007/11/26 06:15:09 | 000,002,386 | ---- | M] () < FireFox Extensions [Program Folders] > -> -> C:\Program Files\Mozilla Firefox\extensions -> [2010/04/26 20:24:47 | 000,000,000 | ---D | M] Smart Notebook Extension -> C:\Program Files\Mozilla Firefox\extensions\{D6D05E6F-D5C1-4e03-8E33-73F92B05E262} -> [2010/01/21 16:04:41 | 000,000,000 | ---D | M] -> C:\Program Files\Mozilla Firefox\extensions\[email protected] -> [2008/08/27 21:15:44 | 000,000,000 | ---D | M] < HOSTS File > (761 bytes and 20 lines) -> C:\Windows\System32\drivers\etc\hosts -> Reset Hosts 127.0.0.1 localhost ::1 localhost < BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [Adobe PDF Reader Link Helper] -> [2010/04/02 07:03:56 | 000,061,888 | ---- | M] (Adobe Systems Incorporated) {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} [HKLM] -> C:\Program Files\AVG\AVG9\avgssie.dll [AVG Safe Search] -> [2010/06/30 12:26:04 | 001,484,056 | ---- | M] (AVG Technologies CZ, s.r.o.) {67BCF957-85FC-4036-8DC4-D4D80E00A77B} [HKLM] -> C:\Program Files\SMART Technologies\Notebook Software\NotebookPlugin.dll [CIEDownload Object] -> [2008/04/03 04:41:02 | 000,599,336 | ---- | M] (SMART Technologies ULC.) {A3BC75A2-1F87-4686-AA43-5347D756017C} [HKLM] -> C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll [AVG Security Toolbar BHO] -> [2009/11/25 13:01:54 | 001,230,080 | ---- | M] () {DBC80044-A445-435b-BC74-9C25C1C588A9} [HKLM] -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [Java(tm) Plug-In 2 SSV Helper] -> [2009/10/11 05:17:29 | 000,041,760 | ---- | M] (Sun Microsystems, Inc.) < Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar -> "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}" [HKLM] -> C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll [AVG Security Toolbar] -> [2009/11/25 13:01:54 | 001,230,080 | ---- | M] () < Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\] > -> HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\Software\Microsoft\Internet Explorer\Toolbar\ -> WebBrowser\\"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}" [HKLM] -> C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll [AVG Security Toolbar] -> [2009/11/25 13:01:54 | 001,230,080 | ---- | M] () < Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> "00TCrdMain" -> C:\Program Files\Toshiba\FlashCards\TCrdMain.exe [%ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe] -> [2007/01/17 16:46:32 | 000,534,648 | ---- | M] (TOSHIBA Corporation) "ActivControl" -> C:\Program Files\Activ Software\ActivDriver\ActivControl2.exe [C:\Program Files\Activ Software\ActivDriver\ActivControl2.exe] -> [2009/10/22 16:44:14 | 001,088,800 | ---- | M] (Promethean Technologies Group Ltd) "Adobe ARM" -> C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe ["C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"] -> [2010/03/24 13:17:47 | 000,952,768 | ---- | M] (Adobe Systems Incorporated) "Adobe Reader Speed Launcher" -> C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe ["C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"] -> [2010/04/02 13:05:30 | 000,040,368 | ---- | M] (Adobe Systems Incorporated) "ArcSoft Connection Service" -> C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe] -> [2010/03/18 11:19:26 | 000,207,360 | ---- | M] (ArcSoft Inc.) "avast5" -> C:\Program Files\Alwil Software\Avast5\AvastUI.exe [C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui] -> [2010/03/09 05:24:10 | 002,769,336 | ---- | M] (ALWIL Software) "AVG9_TRAY" -> C:\Program Files\AVG\AVG9\avgtray.exe [C:\PROGRA~1\AVG\AVG9\avgtray.exe] -> [2010/06/30 12:26:02 | 002,033,432 | ---- | M] (AVG Technologies CZ, s.r.o.) "Camera Assistant Software" -> C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe ["C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe"] -> [2007/02/13 09:30:24 | 000,405,504 | ---- | M] (Chicony) "CamWizard" -> C:\Program Files\Common Files\Logitech\QCDRV\BIN\CamWizrd.exe [C:\Program Files\Common Files\Logitech\QCDRV\BIN\CamWizrd.exe] -> [2005/05/13 13:42:52 | 000,184,320 | ---- | M] (Logitech Inc.) "EPSON_UD_START" -> C:\Program Files\EPSON Projector\EPSON USB Display V1.4\EMP_UD.exe ["C:\Program Files\EPSON Projector\EPSON USB Display V1.4\EMP_UD.exe" -UDCONNECT] -> [2009/04/15 18:47:58 | 000,329,632 | ---- | M] (SEIKO EPSON CORPORATION) "GoBoingo" -> C:\Program Files\Alltel\GoBoingo\AlltelWifi.exe [C:\Program Files\Alltel\GoBoingo\AlltelWifi.exe] -> [2007/10/02 17:51:54 | 000,324,912 | ---- | M] (Boingo Wireless, Inc.) "HotKeysCmds" -> C:\Windows\System32\hkcmd.exe [C:\Windows\system32\hkcmd.exe] -> [2007/03/13 13:34:02 | 000,154,392 | ---- | M] (Intel Corporation) "hpqSRMon" -> C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe [C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe] -> [2008/08/20 11:54:08 | 000,150,016 | ---- | M] (Hewlett-Packard) "HSON" -> C:\Program Files\Toshiba\TBS\HSON.exe [%ProgramFiles%\TOSHIBA\TBS\HSON.exe] -> [2006/12/07 19:49:20 | 000,055,416 | ---- | M] (TOSHIBA Corporation) "IgfxTray" -> C:\Windows\System32\igfxtray.exe [C:\Windows\system32\igfxtray.exe] -> [2007/03/13 13:34:24 | 000,138,008 | ---- | M] (Intel Corporation) "LogitechVideoRepair" -> C:\Program Files\Logitech\Video\ISStart.exe [C:\Program Files\Logitech\Video\ISStart.exe ] -> [2005/06/08 15:24:32 | 000,458,752 | ---- | M] (Logitech Inc.) "LogitechVideoTray" -> C:\Program Files\Logitech\Video\LogiTray.exe [C:\Program Files\Logitech\Video\LogiTray.exe] -> [2005/06/08 15:14:44 | 000,217,088 | ---- | M] (Logitech Inc.) "LVCOMSX" -> C:\Windows\System32\LVCOMSX.EXE [C:\Windows\system32\LVCOMSX.EXE] -> [2005/07/19 17:32:18 | 000,221,184 | ---- | M] (Logitech Inc.) "Malwarebytes Anti-Malware (reboot)" -> C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe ["C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript] -> [2010/01/07 17:07:10 | 001,394,000 | ---- | M] (Malwarebytes Corporation) "NDSTray.exe" -> [NDSTray.exe] -> File not found "Persistence" -> C:\Windows\System32\igfxpers.exe [C:\Windows\system32\igfxpers.exe] -> [2007/03/13 13:34:16 | 000,133,912 | ---- | M] (Intel Corporation) "QuickTime Task" -> C:\Program Files\QuickTime\QTTask.exe ["C:\Program Files\QuickTime\QTTask.exe" -atboottime] -> [2008/01/31 23:13:08 | 000,385,024 | ---- | M] (Apple Inc.) "RtHDVCpl" -> C:\Windows\RtHDVCpl.exe [RtHDVCpl.exe] -> [2007/02/06 20:50:08 | 004,374,528 | ---- | M] (Realtek Semiconductor) "sealmon.exe" -> C:\Program Files\Oracle\Information Rights Management\Desktop\sealmon.exe [C:\Program Files\Oracle\Information Rights Management\Desktop\sealmon.exe] -> [2010/01/13 20:19:12 | 000,370,992 | ---- | M] (Oracle Corporation) "SmoothView" -> C:\Program Files\Toshiba\SmoothView\SmoothView.exe [%ProgramFiles%\Toshiba\SmoothView\SmoothView.exe] -> [2007/01/19 01:24:20 | 000,448,632 | ---- | M] (TOSHIBA Corporation) "SunJavaUpdateSched" -> C:\Program Files\Java\jre6\bin\jusched.exe ["C:\Program Files\Java\jre6\bin\jusched.exe"] -> [2009/10/11 05:17:36 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) "SynTPEnh" -> C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [C:\Program Files\Synaptics\SynTP\SynTPEnh.exe] -> [2007/02/02 16:36:50 | 000,835,584 | ---- | M] (Synaptics, Inc.) "TPwrMain" -> C:\Program Files\Toshiba\Power Saver\TPwrMain.exe [%ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE] -> [2006/12/20 02:16:44 | 000,411,768 | ---- | M] (TOSHIBA Corporation) "Windows Defender" -> C:\Program Files\Windows Defender\MSASCui.exe [%ProgramFiles%\Windows Defender\MSASCui.exe -hide] -> [2008/01/19 02:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) "Windows Mobile-based device management" -> C:\Windows\WindowsMobile\wmdSync.exe [%windir%\WindowsMobile\wmdSync.exe] -> [2006/11/02 04:45:59 | 000,215,552 | ---- | M] (Microsoft Corporation) < Run [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> "Picasa Media Detector" -> C:\Program Files\Picasa2\PicasaMediaDetector.exe [C:\Program Files\Picasa2\PicasaMediaDetector.exe] -> File not found < Run [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> "Picasa Media Detector" -> C:\Program Files\Picasa2\PicasaMediaDetector.exe [C:\Program Files\Picasa2\PicasaMediaDetector.exe] -> File not found < Run [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> "WindowsWelcomeCenter" -> C:\Windows\System32\oobefldr.dll [rundll32.exe oobefldr.dll,ShowWelcomeCenter] -> [2009/04/11 01:28:23 | 002,153,472 | ---- | M] (Microsoft Corporation) < Run [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> "WindowsWelcomeCenter" -> C:\Windows\System32\oobefldr.dll [rundll32.exe oobefldr.dll,ShowWelcomeCenter] -> [2009/04/11 01:28:23 | 002,153,472 | ---- | M] (Microsoft Corporation) < Run [HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\] > -> HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> "ggldadpe" -> C:\Users\Smashley\AppData\Local\bdibbjahd\ohupgcrtssd.exe [C:\Users\Smashley\AppData\Local\bdibbjahd\ohupgcrtssd.exe] -> [2010/06/29 23:20:38 | 000,286,464 | ---- | M] () "LogitechSoftwareUpdate" -> C:\Program Files\Logitech\Video\ManifestEngine.exe ["C:\Program Files\Logitech\Video\ManifestEngine.exe" boot] -> [2005/06/08 14:44:14 | 000,196,608 | ---- | M] (Logitech Inc.) "TOSCDSPD" -> [TOSCDSPD.EXE] -> File not found "WMPNSCFG" -> C:\Program Files\Windows Media Player\wmpnscfg.exe [C:\Program Files\Windows Media Player\WMPNSCFG.exe] -> [2008/01/19 02:33:39 | 000,202,240 | ---- | M] (Microsoft Corporation) < CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer < CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats < CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000] > -> HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> < CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000] > -> HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> < Internet Explorer Menu Extensions [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\MenuExt\ -> Add to Google Photos Screensa&ver -> C:\Windows\System32\GPhotos.scr [res://C:\Windows\system32\GPhotos.scr/200] -> [2010/02/19 18:47:50 | 003,604,480 | ---- | M] (Google Inc.) < Internet Explorer Menu Extensions [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\MenuExt\ -> Add to Google Photos Screensa&ver -> C:\Windows\System32\GPhotos.scr [res://C:\Windows\system32\GPhotos.scr/200] -> [2010/02/19 18:47:50 | 003,604,480 | ---- | M] (Google Inc.) < Internet Explorer Menu Extensions [HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\] > -> HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\Software\Microsoft\Internet Explorer\MenuExt\ -> Add to Google Photos Screensa&ver -> C:\Windows\System32\GPhotos.scr [res://C:\Windows\system32\GPhotos.scr/200] -> [2010/02/19 18:47:50 | 003,604,480 | ---- | M] (Google Inc.) < Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> {2670000A-7350-4f3c-8081-5663EE0C6C49}:{48E73304-E1D6-4330-914C-F5F514E3486C} [HKLM] -> C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll [Button: Send to OneNote] -> [2009/02/26 19:45:52 | 000,603,040 | ---- | M] (Microsoft Corporation) {2670000A-7350-4f3c-8081-5663EE0C6C49}:{48E73304-E1D6-4330-914C-F5F514E3486C} [HKLM] -> C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll [Menu: S&end to OneNote] -> [2009/02/26 19:45:52 | 000,603,040 | ---- | M] (Microsoft Corporation) < Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix "" -> http:// < Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> < Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> < Trusted Sites Ranges [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> < Trusted Sites Ranges [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> < Trusted Sites Ranges [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> < Trusted Sites Ranges [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Trusted Sites Domains [HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\] > -> HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 4810 domain(s) found. -> < Trusted Sites Ranges [HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\] > -> HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> HKEY_USERS\S-1-5-21-1679214456-368351518-2209028700-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> < Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> {8AD9C840-044E-11D1-B3E9-00805F499D93} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab [Java Plug-in 1.6.0_17] -> {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab [Java Plug-in 1.6.0_17] -> {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab [Java Plug-in 1.6.0_17] -> {D27CDB6E-AE6D-11CF-96B8-444553540000} [HKLM] -> http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab [Shockwave Flash Object] -> < Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ -> DhcpNameServer -> 68.87.68.166 68.87.74.166 -> < Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ -> {D0DEFBEB-88E5-49BD-8F31-6B3C88E30F28}\\DhcpNameServer -> 68.87.68.166 68.87.74.166 (Intel(R) PRO/Wireless 3945ABG Network Connection) -> < AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs -> *AppInit_DLLs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls -> avgrsstx.dll -> C:\Windows\System32\avgrsstx.dll -> [2010/06/30 12:26:19 | 000,012,464 | ---- | M] (AVG Technologies CZ, s.r.o.) *MultiFile Done* -> -> < Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> *Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> explorer.exe -> C:\Windows\explorer.exe -> [2009/04/11 01:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) *MultiFile Done* -> -> < Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ -> !SASWinLogon -> C:\Program Files\SUPERAntiSpyware\SASWINLO.dll -> [2009/09/03 15:21:42 | 000,548,352 | ---- | M] (SUPERAntiSpyware.com) igfxcui -> C:\Windows\System32\igfxdev.dll -> [2007/03/06 13:33:04 | 000,204,800 | ---- | M] (Intel Corporation) < ShellExecuteHooks [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks -> "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}" [HKLM] -> C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [] -> [2008/05/13 10:13:36 | 000,077,824 | ---- | M] (SuperAdBlocker.com) < Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List -> "C:\TOSHIBA\Ivp\ISM\pinger.exe" -> C:\TOSHIBA\Ivp\ISM\pinger.exe [C:\TOSHIBA\Ivp\ISM\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger] -> [2007/01/25 20:47:50 | 000,136,816 | ---- | M] () "C:\TOSHIBA\ivp\NetInt\Netint.exe" -> C:\TOSHIBA\ivp\NetInt\Netint.exe [C:\TOSHIBA\ivp\NetInt\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrades Engine] -> [2007/01/25 20:49:34 | 000,472,688 | ---- | M] (TOSHIBA Corporation) < SafeBoot AlternateShell [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot -> < CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom -> "AutoRun" -> 1 -> "DisplayName" -> CD-ROM Driver -> "ImagePath" -> [system32\DRIVERS\cdrom.sys] -> File not found < MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 -> \F HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell \F\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\AutoRun\command \F\shell\AutoRun\command\\"" -> F:\LaunchU3.exe [F:\LaunchU3.exe -a] -> File not found \{0aea8497-2f57-11dd-82ed-00a0d17cf124} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0aea8497-2f57-11dd-82ed-00a0d17cf124}\shell\AutoRun\command \{0aea8497-2f57-11dd-82ed-00a0d17cf124}\shell\AutoRun\command\\"" -> E:\Player\DVR_Player.exe ..\20 [E:\Player\DVR_Player.exe ..\20080311\151346\NORMAL\[000001].drv -DT000 -M33] -> File not found \{16e78b7b-4f5a-11df-a01c-00a0d17cf124} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{16e78b7b-4f5a-11df-a01c-00a0d17cf124}\shell \{16e78b7b-4f5a-11df-a01c-00a0d17cf124}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{16e78b7b-4f5a-11df-a01c-00a0d17cf124}\shell\AutoRun\command \{16e78b7b-4f5a-11df-a01c-00a0d17cf124}\shell\AutoRun\command\\"" -> F:\EMP_UDSe.exe [F:\EMP_UDSe.exe /autorun] -> File not found \{4b0432f2-2436-11df-b00a-00a0d17cf124} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4b0432f2-2436-11df-b00a-00a0d17cf124}\shell \{4b0432f2-2436-11df-b00a-00a0d17cf124}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4b0432f2-2436-11df-b00a-00a0d17cf124}\shell\AutoRun\command \{4b0432f2-2436-11df-b00a-00a0d17cf124}\shell\AutoRun\command\\"" -> F:\AutoRun.exe [F:\AutoRun.exe] -> File not found \{4b0432fd-2436-11df-b00a-7a8020000200} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4b0432fd-2436-11df-b00a-7a8020000200}\shell \{4b0432fd-2436-11df-b00a-7a8020000200}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4b0432fd-2436-11df-b00a-7a8020000200}\shell\AutoRun\command \{4b0432fd-2436-11df-b00a-7a8020000200}\shell\AutoRun\command\\"" -> F:\AutoRun.exe [F:\AutoRun.exe] -> File not found \{4db79140-72ee-11de-8041-7a8020000200} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4db79140-72ee-11de-8041-7a8020000200}\shell \{4db79140-72ee-11de-8041-7a8020000200}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4db79140-72ee-11de-8041-7a8020000200}\shell\AutoRun\command \{4db79140-72ee-11de-8041-7a8020000200}\shell\AutoRun\command\\"" -> F:\AutoRun.exe [F:\AutoRun.exe] -> File not found \{5df7010f-dc25-11dd-b09c-00a0d17cf124} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5df7010f-dc25-11dd-b09c-00a0d17cf124}\shell \{5df7010f-dc25-11dd-b09c-00a0d17cf124}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5df7010f-dc25-11dd-b09c-00a0d17cf124}\shell\AutoRun\command \{5df7010f-dc25-11dd-b09c-00a0d17cf124}\shell\AutoRun\command\\"" -> F:\LaunchU3.exe [F:\LaunchU3.exe -a] -> File not found \{8ba3e4b2-b470-11de-8642-00a0d17cf124} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8ba3e4b2-b470-11de-8642-00a0d17cf124}\shell\AutoRun\command \{8ba3e4b2-b470-11de-8642-00a0d17cf124}\shell\AutoRun\command\\"" -> E:\setupSNK.exe [E:\setupSNK.exe] -> File not found \{8ba3e4b5-b470-11de-8642-00a0d17cf124} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8ba3e4b5-b470-11de-8642-00a0d17cf124}\shell \{8ba3e4b5-b470-11de-8642-00a0d17cf124}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8ba3e4b5-b470-11de-8642-00a0d17cf124}\shell\AutoRun\command \{8ba3e4b5-b470-11de-8642-00a0d17cf124}\shell\AutoRun\command\\"" -> F:\LaunchU3.exe [F:\LaunchU3.exe -a] -> File not found \{d9f2e680-af89-11de-ace1-00a0d17cf124} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9f2e680-af89-11de-ace1-00a0d17cf124}\shell \{d9f2e680-af89-11de-ace1-00a0d17cf124}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d9f2e680-af89-11de-ace1-00a0d17cf124}\shell\AutoRun\command \{d9f2e680-af89-11de-ace1-00a0d17cf124}\shell\AutoRun\command\\"" -> F:\LaunchU3.exe [F:\LaunchU3.exe -a] -> File not found \{f27f8b42-47e1-11de-a951-00a0d17cf124} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f27f8b42-47e1-11de-a951-00a0d17cf124}\shell \{f27f8b42-47e1-11de-a951-00a0d17cf124}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f27f8b42-47e1-11de-a951-00a0d17cf124}\shell\AutoRun\command \{f27f8b42-47e1-11de-a951-00a0d17cf124}\shell\AutoRun\command\\"" -> E:\AutoRun.exe [E:\AutoRun.exe] -> File not found \{f27f8bba-47e1-11de-a951-7a8020000200} HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f27f8bba-47e1-11de-a951-7a8020000200}\shell \{f27f8bba-47e1-11de-a951-7a8020000200}\shell\\"" -> [AutoRun] -> File not found HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f27f8bba-47e1-11de-a951-7a8020000200}\shell\AutoRun\command \{f27f8bba-47e1-11de-a951-7a8020000200}\shell\AutoRun\command\\"" -> F:\AutoRun.exe [F:\AutoRun.exe] -> File not found < Registry Shell Spawning - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command -> comfile [open] -> "%1" %* -> exefile [open] -> "%1" %* -> [Registry - Additional Scans - Safe List] < Drivers32 [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 -> "msacm.dvacm" -> C:\Program Files\Common Files\Ulead Systems\vio\DVACM.acm [C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm] -> [2006/08/23 19:39:40 | 000,032,768 | ---- | M] (Ulead Systems, Inc.) "msacm.l3acm" -> C:\Windows\System32\l3codeca.acm [L3CODECA.ACM] -> [2010/01/21 10:05:44 | 000,062,464 | ---- | M] (Fraunhofer Institut Integrierte Schaltungen IIS) "MSVideo" -> C:\Windows\System32\vfwwdm32.dll [vfwwdm32.dll] -> [2008/01/19 02:36:47 | 000,056,832 | ---- | M] (Microsoft Corporation) "MSVideo8" -> C:\Windows\System32\vfwwdm32.dll [VfWWDM32.dll] -> [2008/01/19 02:36:47 | 000,056,832 | ---- | M] (Microsoft Corporation) "vidc.cvid" -> C:\Windows\System32\iccvid.dll [iccvid.dll] -> [2006/11/02 07:34:41 | 000,081,920 | ---- | M] (Radius Inc.) "vidc.DIVX" -> C:\Windows\System32\DivX.dll [DivX.dll] -> [2008/01/04 16:57:10 | 000,682,496 | ---- | M] (DivX, Inc.) "VIDC.I420" -> C:\Windows\System32\lvcodec2.dll [lvcodec2.dll] -> [2005/05/27 09:26:36 | 000,204,800 | ---- | M] (Logitech Inc.) "vidc.tscc" -> C:\Windows\System32\tsccvid.dll [tsccvid.dll] -> [2005/06/15 10:00:00 | 000,102,400 | ---- | M] (TechSmith Corporation) "vidc.VP60" -> C:\Windows\System32\vp6vfw.dll [C:\Windows\system32\vp6vfw.dll] -> [2004/08/17 22:14:36 | 000,442,368 | R--- | M] (On2.com) "vidc.VP61" -> C:\Windows\System32\vp6vfw.dll [C:\Windows\system32\vp6vfw.dll] -> [2004/08/17 22:14:36 | 000,442,368 | R--- | M] (On2.com) "VIDC.WMV3" -> C:\Windows\System32\wmv9vcm.dll [wmv9vcm.dll] -> [2003/06/23 02:44:36 | 001,415,680 | ---- | M] (Microsoft Corporation) "vidc.yv12" -> C:\Windows\System32\DivX.dll [DivX.dll] -> [2008/01/04 16:57:10 | 000,682,496 | ---- | M] (DivX, Inc.) < Registry Shell Spawning - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command -> batfile [open] -> "%1" %* -> cmdfile [open] -> "%1" %* -> comfile [open] -> "%1" %* -> cplfile [cplopen] -> %SystemRoot%\System32\control.exe "%1",%* -> [2006/11/02 04:44:59 | 000,211,968 | ---- | M] (Microsoft Corporation) exefile [open] -> "%1" %* -> helpfile [open] -> Reg Error: Key error. hlpfile [open] -> %SystemRoot%\winhlp32.exe %1 -> [2006/11/02 04:45:57 | 000,009,216 | ---- | M] (Microsoft Corporation) htmlfile [edit] -> "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 -> [2007/04/19 15:07:38 | 000,061,280 | ---- | M] (Microsoft Corporation) htmlfile [open] -> "C:\Program Files\Internet Explorer\iexplore.exe" -nohome -> [2010/05/04 01:00:35 | 000,638,232 | ---- | M] (Microsoft Corporation) htmlfile [opennew] -> "C:\Program Files\Internet Explorer\iexplore.exe" %1 -> [2010/05/04 01:00:35 | 000,638,232 | ---- | M] (Microsoft Corporation) htmlfile [print] -> "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 -> [2007/04/19 15:07:38 | 000,061,280 | ---- | M] (Microsoft Corporation) http [open] -> "C:\Program Files\Internet Explorer\iexplore.exe" -nohome -> [2010/05/04 01:00:35 | 000,638,232 | ---- | M] (Microsoft Corporation) https [open] -> "C:\Program Files\Internet Explorer\iexplore.exe" -nohome -> [2010/05/04 01:00:35 | 000,638,232 | ---- | M] (Microsoft Corporation) inffile [install] -> %SystemRoot%\System32\InfDefaultInstall.exe "%1" -> [2008/01/19 02:33:12 | 000,011,776 | ---- | M] (Microsoft Corporation) piffile [open] -> "%1" %* -> regfile [merge] -> Reg Error: Key error. scrfile [config] -> "%1" -> scrfile [install] -> rundll32.exe desk.cpl,InstallScreenSaver %l -> [2008/01/19 02:32:56 | 000,368,640 | ---- | M] (Microsoft Corporation) scrfile [open] -> "%1" /S -> txtfile [edit] -> Reg Error: Key error. Unknown [openas] -> %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 -> Directory [cmd] -> cmd.exe /s /k pushd "%V" -> [2008/01/19 02:33:04 | 000,318,976 | ---- | M] (Microsoft Corporation) Directory [find] -> %SystemRoot%\Explorer.exe -> [2009/04/11 01:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) Directory [OneNote.Open] -> C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" -> [2009/02/26 15:24:50 | 001,001,840 | ---- | M] (Microsoft Corporation) Folder [open] -> %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L -> [2009/04/11 01:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) Folder [explore] -> %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L -> [2009/04/11 01:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) Drive [find] -> %SystemRoot%\Explorer.exe -> [2009/04/11 01:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) Applications\iexplore.exe [open] -> "C:\Program Files\Internet Explorer\iexplore.exe" %1 -> [2010/05/04 01:00:35 | 000,638,232 | ---- | M] (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -> "C:\Program Files\Internet Explorer\iexplore.exe" -> [2010/05/04 01:00:35 | 000,638,232 | ---- | M] (Microsoft Corporation) < EventViewer Logs - Last 10 Errors > -> Event Information -> Description Application [ Error ] 5/17/2010 05:18:04 PM Computer Name = Smash2theLey | Source = Application Hang | ID = 1002 -> Description = The program Explorer.EXE version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 1400 Start Time: 01caf600a132bbd0 Termination Time: 0 Application [ Error ] 5/17/2010 05:19:20 PM Computer Name = Smash2theLey | Source = Application Hang | ID = 1002 -> Description = The program Explorer.EXE version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: a30 Start Time: 01caf606704c5d90 Termination Time: 0 Application [ Error ] 5/17/2010 05:21:17 PM Computer Name = Smash2theLey | Source = Application Hang | ID = 1002 -> Description = The program Explorer.EXE version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 11b8 Start Time: 01caf6069d626b30 Termination Time: 0 Application [ Error ] 5/17/2010 05:22:41 PM Computer Name = Smash2theLey | Source = Application Hang | ID = 1002 -> Description = The program Explorer.EXE version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 155c Start Time: 01caf606e313e910 Termination Time: 0 Application [ Error ] 5/17/2010 05:36:52 PM Computer Name = Smash2theLey | Source = Application Hang | ID = 1002 -> Description = The program Explorer.EXE version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 1078 Start Time: 01caf60714f9a730 Termination Time: 0 Application [ Error ] 5/18/2010 04:57:01 PM Computer Name = Smash2theLey | Source = Application Hang | ID = 1002 -> Description = The program Explorer.EXE version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 7f4 Start Time: 01caf6ca6a0fb3c7 Termination Time: 0 Application [ Error ] 5/18/2010 04:58:49 PM Computer Name = Smash2theLey | Source = Application Hang | ID = 1002 -> Description = The program Explorer.EXE version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 308 Start Time: 01caf6cca972ed57 Termination Time: 0 Application [ Error ] 5/18/2010 04:59:06 PM Computer Name = Smash2theLey | Source = Application Hang | ID = 1002 -> Description = The program Explorer.EXE version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 1c4 Start Time: 01caf6ccea0d5177 Termination Time: 76 Application [ Error ] 5/18/2010 05:12:24 PM Computer Name = Smash2theLey | Source = Application Hang | ID = 1002 -> Description = The program explorer.exe version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 154c Start Time: 01caf6ccf48ab667 Termination Time: 0 Application [ Error ] 5/20/2010 05:46:51 PM Computer Name = Smash2theLey | Source = Application Hang | ID = 1002 -> Description = The program explorer.exe version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 161c Start Time: 01caf6cecfd0a267 Termination Time: 2609 Media Center [ Error ] 11/27/2007 02:47:52 AM Computer Name = Smash2theLey | Source = MCUpdate | ID = 0 -> Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule. Media Center [ Error ] 12/3/2007 08:55:25 PM Computer Name = Smash2theLey | Source = MCUpdate | ID = 0 -> Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule. Media Center [ Error ] 12/13/2007 12:45:31 AM Computer Name = Smash2theLey | Source = MCUpdate | ID = 0 -> Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule. Media Center [ Error ] 12/15/2007 06:50:00 PM Computer Name = Smash2theLey | Source = MCUpdate | ID = 0 -> Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule. Media Center [ Error ] 12/21/2007 12:36:25 AM Computer Name = Smash2theLey | Source = MCUpdate | ID = 0 -> Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule. Media Center [ Error ] 4/2/2008 12:18:27 AM Computer Name = Smash2theLey | Source = MCUpdate | ID = 0 -> Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule. Media Center [ Error ] 4/15/2008 10:16:39 PM Computer Name = Smash2theLey | Source = MCUpdate | ID = 0 -> Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight. Media Center [ Error ] 5/26/2008 12:51:14 AM Computer Name = Smash2theLey | Source = MCUpdate | ID = 0 -> Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight. Media Center [ Error ] 6/1/2008 12:13:37 AM Computer Name = Smash2theLey | Source = MCUpdate | ID = 0 -> Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight. Media Center [ Error ] 8/9/2008 01:48:52 AM Computer Name = Smash2theLey | Source = MCUpdate | ID = 0 -> Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule. System [ Error ] 12/4/2008 09:26:01 PM Computer Name = Smash2theLey | Source = Dhcp | ID = 1002 -> Description = The IP address lease 192.168.1.125 for the Network Card with network address 001B778291FF has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message). System [ Error ] 12/4/2008 10:48:22 PM Computer Name = Smash2theLey | Source = EventLog | ID = 6008 -> Description = The previous system shutdown at 8:40:17 PM on 12/4/2008 was unexpected. System [ Error ] 12/4/2008 10:48:26 PM Computer Name = Smash2theLey | Source = HTTP | ID = 15016 -> Description = System [ Error ] 12/4/2008 10:50:04 PM Computer Name = Smash2theLey | Source = Service Control Manager | ID = 7000 -> Description = System [ Error ] 12/5/2008 11:54:39 PM Computer Name = Smash2theLey | Source = Service Control Manager | ID = 7011 -> Description = System [ Error ] 12/6/2008 08:28:37 PM Computer Name = Smash2theLey | Source = yukonwlh | ID = 458853 -> Description = Driver has encountered an internal error System [ Error ] 12/6/2008 08:28:37 PM Computer Name = Smash2theLey | Source = yukonwlh | ID = 458853 -> Description = Driver has encountered an internal error System [ Error ] 12/6/2008 08:28:58 PM Computer Name = Smash2theLey | Source = Dhcp | ID = 1002 -> Description = The IP address lease 192.168.2.102 for the Network Card with network address 001B778291FF has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message). System [ Error ] 12/6/2008 11:24:18 PM Computer Name = Smash2theLey | Source = Service Control Manager | ID = 7011 -> Description = System [ Error ] 12/7/2008 02:06:54 AM Computer Name = Smash2theLey | Source = EventLog | ID = 6008 -> Description = The previous system shutdown at 10:50:00 PM on 12/6/2008 was unexpected. [Files/Folders - Created Within 30 Days] $AVG -> C:\$AVG -> [2010/06/30 12:30:31 | 000,000,000 | -H-D | C] avgrsstx.dll -> C:\Windows\System32\avgrsstx.dll -> [2010/06/30 12:26:19 | 000,012,464 | ---- | C] (AVG Technologies CZ, s.r.o.) avgtdix.sys -> C:\Windows\System32\drivers\avgtdix.sys -> [2010/06/30 12:26:17 | 000,360,584 | ---- | C] (AVG Technologies CZ, s.r.o.) avgldx86.sys -> C:\Windows\System32\drivers\avgldx86.sys -> [2010/06/30 12:26:15 | 000,333,192 | ---- | C] (AVG Technologies CZ, s.r.o.) avgmfx86.sys -> C:\Windows\System32\drivers\avgmfx86.sys -> [2010/06/30 12:26:14 | 000,028,424 | ---- | C] (AVG Technologies CZ, s.r.o.) Avg -> C:\Windows\System32\drivers\Avg -> [2010/06/30 12:26:13 | 000,000,000 | ---D | C] AVG Security Toolbar -> C:\ProgramData\AVG Security Toolbar -> [2010/06/30 12:26:11 | 000,000,000 | ---D | C] bdibbjahd -> C:\Users\Smashley\AppData\Local\bdibbjahd -> [2010/06/29 23:21:03 | 000,000,000 | ---D | C] PresentationHostProxy.dll -> C:\Windows\System32\PresentationHostProxy.dll -> [2010/06/24 03:00:48 | 000,099,176 | ---- | C] (Microsoft Corporation) PresentationHost.exe -> C:\Windows\System32\PresentationHost.exe -> [2010/06/24 03:00:47 | 000,295,264 | ---- | C] (Microsoft Corporation) netfxperf.dll -> C:\Windows\System32\netfxperf.dll -> [2010/06/24 03:00:47 | 000,049,472 | ---- | C] (Microsoft Corporation) Apphlpdm.dll -> C:\Windows\System32\Apphlpdm.dll -> [2010/06/23 00:23:25 | 000,028,672 | ---- | C] (Microsoft Corporation) GameUXLegacyGDFs.dll -> C:\Windows\System32\GameUXLegacyGDFs.dll -> [2010/06/23 00:23:24 | 004,240,384 | ---- | C] (Microsoft) Gimp Brushes -> C:\Users\Smashley\Desktop\Gimp Brushes -> [2010/06/18 01:55:36 | 000,000,000 | ---D | C] heart -> C:\Users\Smashley\heart -> [2010/06/17 19:30:50 | 000,000,000 | ---D | C] asycfilt.dll -> C:\Windows\System32\asycfilt.dll -> [2010/06/08 21:40:23 | 000,067,072 | ---- | C] (Microsoft Corporation) atmfd.dll -> C:\Windows\System32\atmfd.dll -> [2010/06/08 21:40:17 | 000,289,792 | ---- | C] (Adobe Systems Incorporated) atmlib.dll -> C:\Windows\System32\atmlib.dll -> [2010/06/08 21:40:16 | 000,034,304 | ---- | C] (Adobe Systems) msfeeds.dll -> C:\Windows\System32\msfeeds.dll -> [2010/06/08 21:39:55 | 000,599,040 | ---- | C] (Microsoft Corporation) mstime.dll -> C:\Windows\System32\mstime.dll -> [2010/06/08 21:39:54 | 000,611,840 | ---- | C] (Microsoft Corporation) iedkcs32.dll -> C:\Windows\System32\iedkcs32.dll -> [2010/06/08 21:39:54 | 000,387,584 | ---- | C] (Microsoft Corporation) inetcpl.cpl -> C:\Windows\System32\inetcpl.cpl -> [2010/06/08 21:39:53 | 001,469,440 | ---- | C] (Microsoft Corporation) ieui.dll -> C:\Windows\System32\ieui.dll -> [2010/06/08 21:39:53 | 000,164,352 | ---- | C] (Microsoft Corporation) iepeers.dll -> C:\Windows\System32\iepeers.dll -> [2010/06/08 21:39:52 | 000,184,320 | ---- | C] (Microsoft Corporation) ieUnatt.exe -> C:\Windows\System32\ieUnatt.exe -> [2010/06/08 21:39:52 | 000,133,632 | ---- | C] (Microsoft Corporation) iesysprep.dll -> C:\Windows\System32\iesysprep.dll -> [2010/06/08 21:39:52 | 000,109,056 | ---- | C] (Microsoft Corporation) msfeedsbs.dll -> C:\Windows\System32\msfeedsbs.dll -> [2010/06/08 21:39:52 | 000,055,296 | ---- | C] (Microsoft Corporation) jsproxy.dll -> C:\Windows\System32\jsproxy.dll -> [2010/06/08 21:39:52 | 000,025,600 | ---- | C] (Microsoft Corporation) mshtml.tlb -> C:\Windows\System32\mshtml.tlb -> [2010/06/08 21:39:44 | 001,638,912 | ---- | C] (Microsoft Corporation) ie4uinit.exe -> C:\Windows\System32\ie4uinit.exe -> [2010/06/08 21:39:44 | 000,173,056 | ---- | C] (Microsoft Corporation) iesetup.dll -> C:\Windows\System32\iesetup.dll -> [2010/06/08 21:39:44 | 000,071,680 | ---- | C] (Microsoft Corporation) iernonce.dll -> C:\Windows\System32\iernonce.dll -> [2010/06/08 21:39:44 | 000,055,808 | ---- | C] (Microsoft Corporation) msfeedssync.exe -> C:\Windows\System32\msfeedssync.exe -> [2010/06/08 21:39:44 | 000,013,312 | ---- | C] (Microsoft Corporation) win32k.sys -> C:\Windows\System32\win32k.sys -> [2010/06/08 21:39:30 | 002,037,248 | ---- | C] (Microsoft Corporation) [Files/Folders - Modified Within 30 Days] ntuser.dat -> C:\Users\Smashley\ntuser.dat -> [2010/06/30 12:40:14 | 004,718,592 | -HS- | M] () avgrsstx.dll -> C:\Windows\System32\avgrsstx.dll -> [2010/06/30 12:26:19 | 000,012,464 | ---- | M] (AVG Technologies CZ, s.r.o.) AVG Free 9.0.lnk -> C:\Users\Public\Desktop\AVG Free 9.0.lnk -> [2010/06/30 12:26:19 | 000,001,658 | ---- | M] () avgtdix.sys -> C:\Windows\System32\drivers\avgtdix.sys -> [2010/06/30 12:26:17 | 000,360,584 | ---- | M] (AVG Technologies CZ, s.r.o.) avgldx86.sys -> C:\Windows\System32\drivers\avgldx86.sys -> [2010/06/30 12:26:15 | 000,333,192 | ---- | M] (AVG Technologies CZ, s.r.o.) incavi.avm -> C:\Windows\System32\drivers\Avg\incavi.avm -> [2010/06/30 12:26:14 | 061,534,963 | ---- | M] () iavichjw.avm -> C:\Windows\System32\drivers\Avg\iavichjw.avm -> [2010/06/30 12:26:14 | 000,113,461 | ---- | M] () avgmfx86.sys -> C:\Windows\System32\drivers\avgmfx86.sys -> [2010/06/30 12:26:14 | 000,028,424 | ---- | M] (AVG Technologies CZ, s.r.o.) avi7.avg -> C:\Windows\System32\drivers\Avg\avi7.avg -> [2010/06/30 12:26:13 | 006,061,540 | ---- | M] () miniavi.avg -> C:\Windows\System32\drivers\Avg\miniavi.avg -> [2010/06/30 12:26:13 | 000,492,629 | ---- | M] () microavi.avg -> C:\Windows\System32\drivers\Avg\microavi.avg -> [2010/06/30 12:26:13 | 000,142,495 | ---- | M] () Ikeext.etl -> C:\Windows\System32\Ikeext.etl -> [2010/06/30 12:09:42 | 000,016,384 | ---- | M] () bootstat.dat -> C:\Windows\bootstat.dat -> [2010/06/30 12:09:33 | 000,067,584 | --S- | M] () ntuser.dat{b1f1f7da-549f-11dd-88bd-001b778291ff}.TMContainer00000000000000000001.regtrans-ms -> C:\Users\Smashley\ntuser.dat{b1f1f7da-549f-11dd-88bd-001b778291ff}.TMContainer00000000000000000001.regtrans-ms -> [2010/06/30 02:19:03 | 000,524,288 | -HS- | M] () ntuser.dat{b1f1f7da-549f-11dd-88bd-001b778291ff}.TM.blf -> C:\Users\Smashley\ntuser.dat{b1f1f7da-549f-11dd-88bd-001b778291ff}.TM.blf -> [2010/06/30 02:19:03 | 000,065,536 | -HS- | M] () 7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 -> C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 -> [2010/06/30 02:16:58 | 000,003,568 | -H-- | M] () 7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 -> C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 -> [2010/06/30 02:16:58 | 000,003,568 | -H-- | M] () SA.DAT -> C:\Windows\tasks\SA.DAT -> [2010/06/30 02:16:37 | 000,000,006 | -H-- | M] () {8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job -> C:\Windows\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job -> [2010/06/30 02:16:27 | 000,000,298 | -H-- | M] () AWC Startup.job -> C:\Windows\tasks\AWC Startup.job -> [2010/06/30 02:16:24 | 000,000,376 | ---- | M] () d3d9caps.dat -> C:\Users\Smashley\AppData\Local\d3d9caps.dat -> [2010/06/30 02:16:22 | 000,000,680 | ---- | M] () oqalarejuc.dll -> C:\Users\Smashley\AppData\Local\oqalarejuc.dll -> [2010/06/29 23:23:33 | 000,002,744 | ---- | M] () PerfStringBackup.INI -> C:\Windows\System32\PerfStringBackup.INI -> [2010/06/29 19:36:01 | 000,759,570 | ---- | M] () perfh009.dat -> C:\Windows\System32\perfh009.dat -> [2010/06/29 19:36:01 | 000,642,906 | ---- | M] () perfc009.dat -> C:\Windows\System32\perfc009.dat -> [2010/06/29 19:36:01 | 000,120,064 | ---- | M] () Norton Security Scan for Smashley.job -> C:\Windows\tasks\Norton Security Scan for Smashley.job -> [2010/06/29 03:05:13 | 000,000,564 | -H-- | M] () Newest_Resume.doc -> C:\Users\Smashley\Documents\Newest_Resume.doc -> [2010/06/21 11:40:01 | 000,032,256 | ---- | M] () Resume for ULM-1.doc -> C:\Users\Smashley\Documents\Resume for ULM-1.doc -> [2010/06/21 11:02:01 | 000,035,840 | ---- | M] () .recently-used.xbel -> C:\Users\Smashley\.recently-used.xbel -> [2010/06/17 14:13:35 | 000,005,885 | ---- | M] () HCG Recipes2.doc -> C:\Users\Smashley\Documents\HCG Recipes2.doc -> [2010/06/16 14:49:56 | 000,027,648 | ---- | M] () Microsoft Office Word 2003.lnk -> C:\Users\Smashley\Desktop\Microsoft Office Word 2003.lnk -> [2010/06/16 14:10:30 | 000,002,609 | ---- | M] () HCG Recipes.doc -> C:\Users\Smashley\Documents\HCG Recipes.doc -> [2010/06/14 17:12:47 | 000,024,064 | ---- | M] () Hcg Phase2 Recipes.pdf -> C:\Users\Smashley\Desktop\Hcg Phase2 Recipes.pdf -> [2010/06/14 14:15:29 | 000,669,167 | ---- | M] () GDIPFONTCACHEV1.DAT -> C:\Users\Smashley\AppData\Local\GDIPFONTCACHEV1.DAT -> [2010/06/12 01:28:27 | 000,501,584 | ---- | M] () FNTCACHE.DAT -> C:\Windows\System32\FNTCACHE.DAT -> [2010/06/12 01:24:24 | 001,182,888 | ---- | M] () GIMP 2.lnk -> C:\Users\Public\Desktop\GIMP 2.lnk -> [2010/06/10 01:54:24 | 000,000,909 | ---- | M] () LimeWire 5.5.9.lnk -> C:\Users\Smashley\Desktop\LimeWire 5.5.9.lnk -> [2010/06/08 22:49:05 | 000,001,711 | ---- | M] () win.ini -> C:\Windows\win.ini -> [2010/06/08 22:46:26 | 000,000,275 | ---- | M] () vbaddin.ini -> C:\Windows\vbaddin.ini -> [2010/06/08 22:34:59 | 000,000,039 | ---- | M] () 13 C:\Users\Smashley\AppData\Local\Temp\*.tmp files -> C:\Users\Smashley\AppData\Local\Temp\*.tmp -> 13 C:\Users\Smashley\AppData\Local\Temp\*.tmp files -> C:\Users\Smashley\AppData\Local\Temp\*.tmp -> [Files - No Company Name] AVG Free 9.0.lnk -> C:\Users\Public\Desktop\AVG Free 9.0.lnk -> [2010/06/30 12:26:19 | 000,001,658 | ---- | C] () iavichjw.avm -> C:\Windows\System32\drivers\Avg\iavichjw.avm -> [2010/06/30 12:26:14 | 000,113,461 | ---- | C] () incavi.avm -> C:\Windows\System32\drivers\Avg\incavi.avm -> [2010/06/30 12:26:13 | 061,534,963 | ---- | C] () avi7.avg -> C:\Windows\System32\drivers\Avg\avi7.avg -> [2010/06/30 12:26:13 | 006,061,540 | ---- | C] () miniavi.avg -> C:\Windows\System32\drivers\Avg\miniavi.avg -> [2010/06/30 12:26:13 | 000,492,629 | ---- | C] () microavi.avg -> C:\Windows\System32\drivers\Avg\microavi.avg -> [2010/06/30 12:26:13 | 000,142,495 | ---- | C] () {8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job -> C:\Windows\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job -> [2010/06/30 02:13:36 | 000,000,298 | -H-- | C] () d3d9caps.dat -> C:\Users\Smashley\AppData\Local\d3d9caps.dat -> [2010/06/29 23:38:34 | 000,000,680 | ---- | C] () oqalarejuc.dll -> C:\Users\Smashley\AppData\Local\oqalarejuc.dll -> [2010/06/29 23:23:33 | 000,002,744 | ---- | C] () Newest_Resume.doc -> C:\Users\Smashley\Documents\Newest_Resume.doc -> [2010/06/21 11:40:01 | 000,032,256 | ---- | C] () .recently-used.xbel -> C:\Users\Smashley\.recently-used.xbel -> [2010/06/17 14:13:35 | 000,005,885 | ---- | C] () HCG Recipes2.doc -> C:\Users\Smashley\Documents\HCG Recipes2.doc -> [2010/06/16 14:49:55 | 000,027,648 | ---- | C] () HCG Recipes.doc -> C:\Users\Smashley\Documents\HCG Recipes.doc -> [2010/06/14 17:12:44 | 000,024,064 | ---- | C] () Hcg Phase2 Recipes.pdf -> C:\Users\Smashley\Desktop\Hcg Phase2 Recipes.pdf -> [2010/06/14 14:15:28 | 000,669,167 | ---- | C] () LimeWire 5.5.9.lnk -> C:\Users\Smashley\Desktop\LimeWire 5.5.9.lnk -> [2010/06/08 22:49:05 | 000,001,711 | ---- | C] () Resume for ULM-1.doc -> C:\Users\Smashley\Documents\Resume for ULM-1.doc -> [2010/06/02 09:35:08 | 000,035,840 | ---- | C] () unrar.dll -> C:\Windows\System32\unrar.dll -> [2010/04/29 17:12:02 | 000,165,376 | ---- | C] () lvcoinst.ini -> C:\Windows\System32\lvcoinst.ini -> [2010/04/05 15:01:51 | 000,009,255 | ---- | C] () Bti.ini -> C:\Windows\Bti.ini -> [2009/11/30 12:55:39 | 000,000,751 | ---- | C] () libactivboardex.dll -> C:\Windows\libactivboardex.dll -> [2009/10/22 16:44:36 | 000,223,016 | ---- | C] () ActivDRV.dll -> C:\Windows\ActivDRV.dll -> [2009/10/22 16:44:16 | 000,252,696 | ---- | C] () EhStorAuthn.dll -> C:\Windows\System32\EhStorAuthn.dll -> [2009/09/17 19:20:25 | 000,117,248 | ---- | C] () OGACheckControl.dll -> C:\Windows\System32\OGACheckControl.dll -> [2009/08/03 15:07:42 | 000,403,816 | ---- | C] () pythoncom21.dll -> C:\Windows\System32\pythoncom21.dll -> [2009/02/08 19:15:08 | 000,290,919 | ---- | C] () PyWinTypes21.dll -> C:\Windows\System32\PyWinTypes21.dll -> [2009/02/08 19:15:08 | 000,057,344 | ---- | C] () SlantAdj.dll -> C:\Windows\SlantAdj.dll -> [2009/02/08 19:13:38 | 000,096,768 | ---- | C] () epDPE.ini -> C:\Windows\System32\epDPE.ini -> [2009/02/08 19:13:38 | 000,000,072 | R--- | C] () EPSON CX3200 Installer.ini -> C:\Windows\EPSON CX3200 Installer.ini -> [2009/02/08 18:45:15 | 000,000,171 | ---- | C] () swupdate.INI -> C:\Windows\swupdate.INI -> [2008/04/30 21:16:30 | 000,000,067 | ---- | C] () jpn_lang_plusviewer.ini -> C:\Windows\System32\jpn_lang_plusviewer.ini -> [2008/01/24 10:58:36 | 000,028,124 | ---- | C] () kor_lang_plusviewer.ini -> C:\Windows\System32\kor_lang_plusviewer.ini -> [2008/01/24 10:58:20 | 000,028,973 | ---- | C] () eng_lang_plusviewer.ini -> C:\Windows\System32\eng_lang_plusviewer.ini -> [2008/01/24 10:58:06 | 000,029,742 | ---- | C] () ODBC.INI -> C:\Windows\ODBC.INI -> [2008/01/16 22:11:46 | 000,000,376 | ---- | C] () qt-dx331.dll -> C:\Windows\System32\qt-dx331.dll -> [2008/01/04 16:58:50 | 003,596,288 | ---- | C] () dtu100.dll.manifest -> C:\Windows\System32\dtu100.dll.manifest -> [2008/01/04 16:57:22 | 000,000,416 | ---- | C] () dpl100.dll.manifest -> C:\Windows\System32\dpl100.dll.manifest -> [2008/01/04 16:57:22 | 000,000,416 | ---- | C] () DivXWMPExtType.dll -> C:\Windows\System32\DivXWMPExtType.dll -> [2008/01/04 16:56:24 | 000,012,288 | ---- | C] () tosmreg.ini -> C:\Windows\System32\tosmreg.ini -> [2007/07/18 00:42:16 | 000,010,150 | ---- | C] () csellang.ini -> C:\Windows\System32\csellang.ini -> [2007/07/18 00:42:15 | 000,128,113 | ---- | C] () csellang.dll -> C:\Windows\System32\csellang.dll -> [2007/07/18 00:42:15 | 000,045,056 | ---- | C] () cseltbl.ini -> C:\Windows\System32\cseltbl.ini -> [2007/07/18 00:42:15 | 000,007,671 | ---- | C] () mp4dec2avi.dll -> C:\Windows\System32\mp4dec2avi.dll -> [2007/03/21 17:30:52 | 000,069,632 | ---- | C] () igfxCoIn_v1227.dll -> C:\Windows\System32\igfxCoIn_v1227.dll -> [2007/03/06 14:49:42 | 000,204,800 | ---- | C] () IVIresizeW7.dll -> C:\Windows\System32\IVIresizeW7.dll -> [2007/03/02 14:01:09 | 000,204,800 | ---- | C] () IVIresizePX.dll -> C:\Windows\System32\IVIresizePX.dll -> [2007/03/02 14:01:09 | 000,188,416 | ---- | C] () IVIresizeA6.dll -> C:\Windows\System32\IVIresizeA6.dll -> [2007/03/02 14:01:08 | 000,200,704 | ---- | C] () IVIresizeP6.dll -> C:\Windows\System32\IVIresizeP6.dll -> [2007/03/02 14:01:08 | 000,192,512 | ---- | C] () IVIresizeM6.dll -> C:\Windows\System32\IVIresizeM6.dll -> [2007/03/02 14:01:08 | 000,192,512 | ---- | C] () IVIresize.dll -> C:\Windows\System32\IVIresize.dll -> [2007/03/02 14:01:08 | 000,020,480 | ---- | C] () NDSTray.INI -> C:\Windows\NDSTray.INI -> [2007/02/28 15:47:07 | 000,000,000 | ---- | C] () TosBtAcc.dll -> C:\Windows\System32\TosBtAcc.dll -> [2006/12/05 16:05:06 | 000,114,688 | ---- | C] () GlobalUserInterface.CompositeFont -> C:\Windows\Fonts\GlobalUserInterface.CompositeFont -> [2006/11/02 07:37:35 | 000,037,665 | ---- | C] () GlobalSerif.CompositeFont -> C:\Windows\Fonts\GlobalSerif.CompositeFont -> [2006/11/02 07:37:35 | 000,029,779 | ---- | C] () GlobalSansSerif.CompositeFont -> C:\Windows\Fonts\GlobalSansSerif.CompositeFont -> [2006/11/02 07:37:35 | 000,026,489 | ---- | C] () GlobalMonospace.CompositeFont -> C:\Windows\Fonts\GlobalMonospace.CompositeFont -> [2006/11/02 07:37:35 | 000,026,040 | ---- | C] () sysprepMCE.dll -> C:\Windows\System32\sysprepMCE.dll -> [2006/11/02 07:35:32 | 000,005,632 | ---- | C] () igfxTMM.dll -> C:\Windows\System32\igfxTMM.dll -> [2006/11/02 05:25:21 | 000,249,856 | ---- | C] () pacerprf.ini -> C:\Windows\System32\pacerprf.ini -> [2006/11/02 02:40:29 | 000,013,750 | ---- | C] () WdfCoInstaller01000.dll -> C:\Windows\System32\WdfCoInstaller01000.dll -> [2006/03/09 13:58:00 | 001,060,424 | ---- | C] () TosCommAPI.dll -> C:\Windows\System32\TosCommAPI.dll -> [2005/07/23 00:30:20 | 000,065,536 | ---- | C] () rfg726.dll -> C:\Windows\System32\rfg726.dll -> [2004/05/31 15:39:46 | 000,045,056 | ---- | C] () mwmp4dec.dll -> C:\Windows\System32\mwmp4dec.dll -> [2004/01/19 18:17:58 | 000,356,352 | ---- | C] () FGWVB32.DLL -> C:\Windows\System32\FGWVB32.DLL -> [2003/03/24 05:03:00 | 000,279,552 | ---- | C] () OUTLPERF.INI -> C:\Windows\System32\OUTLPERF.INI -> [2003/01/07 16:05:08 | 000,002,695 | ---- | C] () ltcry13n.dll -> C:\Windows\System32\ltcry13n.dll -> [2002/12/11 19:19:34 | 000,708,608 | ---- | C] () lttls13n.dll -> C:\Windows\System32\lttls13n.dll -> [2002/12/11 19:19:34 | 000,147,456 | ---- | C] () lfkodak.dll -> C:\Windows\System32\lfkodak.dll -> [2000/04/12 17:28:12 | 000,118,784 | ---- | C] () lffpx7.dll -> C:\Windows\System32\lffpx7.dll -> [2000/04/12 17:24:10 | 000,338,944 | ---- | C] () Declw.dll -> C:\Windows\System32\Declw.dll -> [1996/02/23 16:34:48 | 000,014,629 | ---- | C] () Decln.dll -> C:\Windows\System32\Decln.dll -> [1996/02/22 14:09:20 | 000,032,256 | ---- | C] () [File - Lop Check] Skinux -> C:\Users\Guest\AppData\Roaming\Skinux -> [2008/11/16 09:32:16 | 000,000,000 | ---D | M] Template -> C:\Users\Guest\AppData\Roaming\Template -> [2008/12/12 14:54:05 | 000,000,000 | ---D | M] ACTIV Software -> C:\Users\Smashley\AppData\Roaming\ACTIV Software -> [2010/04/07 12:27:49 | 000,000,000 | ---D | M] Azureus -> C:\Users\Smashley\AppData\Roaming\Azureus -> [2008/10/19 02:50:22 | 000,000,000 | ---D | M] EPSON -> C:\Users\Smashley\AppData\Roaming\EPSON -> [2009/04/17 23:56:44 | 000,000,000 | ---D | M] GameHouse -> C:\Users\Smashley\AppData\Roaming\GameHouse -> [2008/05/14 21:23:15 | 000,000,000 | ---D | M] GetRightToGo -> C:\Users\Smashley\AppData\Roaming\GetRightToGo -> [2010/04/05 15:40:47 | 000,000,000 | ---D | M] gtk-2.0 -> C:\Users\Smashley\AppData\Roaming\gtk-2.0 -> [2010/06/17 14:13:35 | 000,000,000 | ---D | M] Image Zone Express -> C:\Users\Smashley\AppData\Roaming\Image Zone Express -> [2010/05/06 07:21:18 | 000,000,000 | ---D | M] IObit -> C:\Users\Smashley\AppData\Roaming\IObit -> [2010/03/30 06:42:35 | 000,000,000 | ---D | M] IrfanView -> C:\Users\Smashley\AppData\Roaming\IrfanView -> [2009/02/17 10:54:40 | 000,000,000 | ---D | M] iWinArcade -> C:\Users\Smashley\AppData\Roaming\iWinArcade -> [2008/03/12 02:20:13 | 000,000,000 | ---D | M] Leadertech -> C:\Users\Smashley\AppData\Roaming\Leadertech -> [2010/04/05 14:02:46 | 000,000,000 | ---D | M] LimeWire -> C:\Users\Smashley\AppData\Roaming\LimeWire -> [2010/06/10 23:10:11 | 000,000,000 | ---D | M] My Games -> C:\Users\Smashley\AppData\Roaming\My Games -> [2008/05/14 21:25:12 | 000,000,000 | ---D | M] PlayFirst -> C:\Users\Smashley\AppData\Roaming\PlayFirst -> [2008/02/24 20:11:42 | 000,000,000 | ---D | M] Printer Info Cache -> C:\Users\Smashley\AppData\Roaming\Printer Info Cache -> [2008/12/01 01:29:56 | 000,000,000 | ---D | M] Promethean -> C:\Users\Smashley\AppData\Roaming\Promethean -> [2010/04/08 10:07:48 | 000,000,000 | ---D | M] River Past G5 -> C:\Users\Smashley\AppData\Roaming\River Past G5 -> [2008/11/04 23:53:00 | 000,000,000 | ---D | M] Skinux -> C:\Users\Smashley\AppData\Roaming\Skinux -> [2008/10/27 23:34:39 | 000,000,000 | ---D | M] SMART Technologies Inc -> C:\Users\Smashley\AppData\Roaming\SMART Technologies Inc -> [2010/01/21 16:05:30 | 000,000,000 | ---D | M] Smith Micro -> C:\Users\Smashley\AppData\Roaming\Smith Micro -> [2009/05/30 15:20:41 | 000,000,000 | ---D | M] Template -> C:\Users\Smashley\AppData\Roaming\Template -> [2007/12/04 08:21:43 | 000,000,000 | ---D | M] TOSHIBA -> C:\Users\Smashley\AppData\Roaming\TOSHIBA -> [2009/01/21 02:23:08 | 000,000,000 | ---D | M] WinBatch -> C:\Users\Smashley\AppData\Roaming\WinBatch -> [2009/01/22 10:59:14 | 000,000,000 | ---D | M] AWC Startup.job -> C:\Windows\Tasks\AWC Startup.job -> [2010/06/30 02:16:24 | 000,000,376 | ---- | M] () SCHEDLGU.TXT -> C:\Windows\Tasks\SCHEDLGU.TXT -> [2010/06/30 02:16:39 | 000,032,522 | ---- | M] () {8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job -> C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job -> [2010/06/30 02:16:27 | 000,000,298 | -H-- | M] () [File - Purity Scan] [Custom Scans] < netsvcs > < %SYSTEMDRIVE%\*.exe > < %SYSTEMDRIVE%\*.* > bootmgr -> C:\bootmgr -> [2009/04/11 01:36:36 | 000,333,257 | RHS- | M] () BOOTSECT.BAK -> C:\BOOTSECT.BAK -> [2007/02/28 14:08:50 | 000,008,192 | R-S- | M] () config.sys -> C:\config.sys -> [2006/09/18 16:43:37 | 000,000,010 | ---- | M] () error.log -> C:\error.log -> [2010/05/10 20:25:30 | 000,000,045 | ---- | M] () IO.SYS -> C:\IO.SYS -> [2007/12/28 04:15:53 | 000,000,000 | RHS- | M] () MSDOS.SYS -> C:\MSDOS.SYS -> [2007/12/28 04:15:53 | 000,000,000 | RHS- | M] () pagefile.sys -> C:\pagefile.sys -> [2010/06/30 12:09:08 | 1377,116,160 | -HS- | M] () rapport.txt -> C:\rapport.txt -> [2010/02/07 14:03:50 | 000,002,472 | ---- | M] () YServer.txt -> C:\YServer.txt -> [2008/05/04 16:12:59 | 000,000,162 | ---- | M] () < MD5 Scans Start> < %systemdrive%\AGP440.SYS /md5 /s > AGP440.sys : MD5=13F9E33747E6B41A3FF305C37DB0D360 -> C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys -> [2008/01/19 02:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) AGP440.sys : MD5=13F9E33747E6B41A3FF305C37DB0D360 -> C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys -> [2008/01/19 02:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) AGP440.sys : MD5=13F9E33747E6B41A3FF305C37DB0D360 -> C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys -> [2008/01/19 02:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) AGP440.sys : MD5=13F9E33747E6B41A3FF305C37DB0D360 -> C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys -> [2008/01/19 02:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) agp440.sys : MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -> C:\Windows\System32\drivers\agp440.sys -> [2006/11/02 04:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) AGP440.sys : MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -> C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys -> [2006/11/02 04:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) < %systemdrive%\ATAPI.SYS /md5 /s > atapi.sys : MD5=1F05B78AB91C9075565A9D8A4B880BC4 -> C:\Windows\System32\drivers\atapi.sys -> [2009/04/11 01:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) atapi.sys : MD5=1F05B78AB91C9075565A9D8A4B880BC4 -> C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys -> [2009/04/11 01:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) atapi.sys : MD5=1F05B78AB91C9075565A9D8A4B880BC4 -> C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys -> [2009/04/11 01:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) atapi.sys : MD5=2D9C903DC76A66813D350A562DE40ED9 -> C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys -> [2008/01/19 02:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) atapi.sys : MD5=2D9C903DC76A66813D350A562DE40ED9 -> C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys -> [2008/01/19 02:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) atapi.sys : MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -> C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys -> [2006/11/02 04:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) atapi.sys : MD5=B35CFCEF838382AB6490B321C87EDF17 -> C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys -> [2008/02/15 16:04:30 | 000,021,560 | ---- | M] (Microsoft Corporation) atapi.sys : MD5=B35CFCEF838382AB6490B321C87EDF17 -> C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys -> [2008/02/15 16:04:30 | 000,021,560 | ---- | M] (Microsoft Corporation) atapi.sys : MD5=E03E8C99D15D0381E02743C36AFC7C6F -> C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys -> [2008/02/15 16:04:27 | 000,021,560 | ---- | M] (Microsoft Corporation) < %systemdrive%\CNGAUDIT.DLL /md5 /s > cngaudit.dll : MD5=7F15B4953378C8B5161D65C26D5FED4D -> C:\Windows\System32\cngaudit.dll -> [2006/11/02 04:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) cngaudit.dll : MD5=7F15B4953378C8B5161D65C26D5FED4D -> C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll -> [2006/11/02 04:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) < %systemdrive%\IASTORV.SYS /md5 /s > iaStorV.sys : MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -> C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys -> [2008/01/19 02:42:51 | 000,235,064 | ---- | M] (Intel Corporation) iaStorV.sys : MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -> C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys -> [2008/01/19 02:42:51 | 000,235,064 | ---- | M] (Intel Corporation) iaStorV.sys : MD5=C957BF4B5D80B46C5017BF0101E6C906 -> C:\Windows\System32\drivers\iaStorV.sys -> [2006/11/02 04:51:25 | 000,232,040 | ---- | M] (Intel Corporation) iaStorV.sys : MD5=C957BF4B5D80B46C5017BF0101E6C906 -> C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys -> [2006/11/02 04:51:25 | 000,232,040 | ---- | M] (Intel Corporation) < %systemdrive%\KR10N.SYS /md5 /s > KR10N.sys : MD5=A1963360E74931222A67356C8AD48378 -> C:\Windows\System32\drivers\KR10N.sys -> [2007/01/03 03:43:19 | 000,207,104 | ---- | M] (TOSHIBA CORPORATION) KR10N.sys : MD5=A1963360E74931222A67356C8AD48378 -> C:\Windows\System32\DriverStore\FileRepository\kr10n.inf_f8c77270\KR10N.sys -> [2007/01/03 03:43:19 | 000,207,104 | ---- | M] (TOSHIBA CORPORATION) < %systemdrive%\NETLOGON.DLL /md5 /s > netlogon.dll : MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -> C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll -> [2006/11/02 04:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) netlogon.dll : MD5=95DAECF0FB120A7B5DA679CC54E37DDE -> C:\Windows\System32\netlogon.dll -> [2009/04/11 01:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) netlogon.dll : MD5=95DAECF0FB120A7B5DA679CC54E37DDE -> C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll -> [2009/04/11 01:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) netlogon.dll : MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -> C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll -> [2008/01/19 02:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) < %systemdrive%\NVSTOR.SYS /md5 /s > nvstor.sys : MD5=9E0BA19A28C498A6D323D065DB76DFFC -> C:\Windows\System32\drivers\nvstor.sys -> [2006/11/02 04:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) nvstor.sys : MD5=9E0BA19A28C498A6D323D065DB76DFFC -> C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys -> [2006/11/02 04:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) nvstor.sys : MD5=ABED0C09758D1D97DB0042DBB2688177 -> C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys -> [2008/01/19 02:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) nvstor.sys : MD5=ABED0C09758D1D97DB0042DBB2688177 -> C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys -> [2008/01/19 02:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) < %systemdrive%\SCECLI.DLL /md5 /s > scecli.dll : MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -> C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll -> [2008/01/19 02:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) scecli.dll : MD5=80E2839D05CA5970A86D7BE2A08BFF61 -> C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll -> [2006/11/02 04:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) scecli.dll : MD5=8FC182167381E9915651267044105EE1 -> C:\Windows\System32\scecli.dll -> [2009/04/11 01:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) scecli.dll : MD5=8FC182167381E9915651267044105EE1 -> C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll -> [2009/04/11 01:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) < MD5 Scans End> < %systemroot%\*. /mp /s > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options /s > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions \DllNXOptions\\"mscoree.dll" -> [1] -> File not found \DllNXOptions\\"mscorwks.dll" -> [1] -> File not found \DllNXOptions\\"mso.dll" -> [1] -> File not found \DllNXOptions\\"msjava.dll" -> [1] -> File not found \DllNXOptions\\"msci_uno.dll" -> [1] -> File not found \DllNXOptions\\"jvm.dll" -> [1] -> File not found \DllNXOptions\\"jvm_g.dll" -> [1] -> File not found \DllNXOptions\\"javai.dll" -> [1] -> File not found \DllNXOptions\\"vb40032.dll" -> [1] -> File not found \DllNXOptions\\"vbe6.dll" -> [1] -> File not found \DllNXOptions\\"ums.dll" -> [1] -> File not found \DllNXOptions\\"main123w.dll" -> [1] -> File not found \DllNXOptions\\"udtapi.dll" -> [1] -> File not found \DllNXOptions\\"mscorsvr.dll" -> [1] -> File not found \DllNXOptions\\"eMigrationmmc.dll" -> [1] -> File not found \DllNXOptions\\"eProcedureMMC.dll" -> [1] -> File not found \DllNXOptions\\"eQueryMMC.dll" -> [1] -> File not found \DllNXOptions\\"EncryptPatchVer.dll" -> [1] -> File not found \DllNXOptions\\"Cleanup.dll" -> [1] -> File not found \DllNXOptions\\"divx.dll" -> [1] -> File not found \DllNXOptions\\"divxdec.ax" -> [1] -> File not found \DllNXOptions\\"fullsoft.dll" -> [1] -> File not found \DllNXOptions\\"NSWSTE.dll" -> [1] -> File not found \DllNXOptions\\"ASSTE.dll" -> [1] -> File not found \DllNXOptions\\"NPMLIC.dll" -> [1] -> File not found \DllNXOptions\\"PMSTE.dll" -> [1] -> File not found \DllNXOptions\\"AVSTE.dll" -> [1] -> File not found \DllNXOptions\\"NAVOPTRF.dll" -> [1] -> File not found \DllNXOptions\\"DRMINST.dll" -> [1] -> File not found \DllNXOptions\\"TFDTCTT8.dll" -> [1] -> File not found \DllNXOptions\\"DJSMAR00.dll" -> [1] -> File not found \DllNXOptions\\"xlmlEN.dll" -> [1] -> File not found \DllNXOptions\\"ISSTE.dll" -> [1] -> File not found \DllNXOptions\\"symlcnet.dll" -> [1] -> File not found \DllNXOptions\\"ppw32hlp.dll" -> [1] -> File not found \DllNXOptions\\"Apitrap.dll" -> [1] -> File not found \DllNXOptions\\"Vegas60k.dll" -> [1] -> File not found HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEInstal.exe \IEInstal.exe\\"ExecuteOptions" -> [0] -> File not found OTS cannot create restorepoints on Vista OSs! < %systemroot%\system32\*.dll /lockedfiles > < %systemroot%\Tasks\*.job /lockedfiles > [Alternate Data Streams] @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:B9252F22 @Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:94A19129 @Alternate Data Stream - 64 bytes -> C:\Users\Smashley\Ashley.bak.avi:TOC.WMV @Alternate Data Stream - 64 bytes -> C:\Users\Smashley\Desktop\Ashley Video_AVI.avi:TOC.WMV @Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:9AEE100C < End of report >
Attached Files
Edited by Smashley76, 01 July 2010 - 02:47 PM.
expanded OTS scan.