BleepingComputer.com: Formidable Google Redirect Virus

This virus redirects my searches to a goingonearth.com based site. Every time I try to run Microsoft Security Essentials it blips on the Task Manager and then disappears. My computer has slowed down significantly and it freezes randomly for short periods of time. I am running Kaspersky and it has yet to find a virus. rkill found 2 malicious processes running: searchHost.exe and searchIndex.exe, or something of the sort, in the system32 folder and I naturally deleted them. And an annoying process: Tsmyea.exe will not die, no matter how many times I kill it. Any help would be appreciated. Here are my logs:

DDS.txt:

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by David Forrest at 21:23:58.07 on Sat 05/07/2011
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3197.2251 [GMT -7:00]
.
AV: Malware Defense *Enabled/Outdated* {28e00e3b-806e-4533-925c-f4c3d79514b9}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
svchost.exe
C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\WINDOWS\system32\svchost.exe -k HPService
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\StkASv2K.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Virus Removal Arsenal\Kaspersky Rootkit Removal Tool\kaspersky_setup\kaspersky_setup.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\David Forrest\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://start.facemoods.com/?a=audio
uSearch Page = hxxp://search.autocompletepro.com/?si=10197&bi=400
uDefault_Search_URL = hxxp://search.autocompletepro.com/?si=10197&bi=400
uSearch Bar = hxxp://search.autocompletepro.com/?si=10197&bi=400
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = localhost:80
mSearchAssistant = hxxp://start.facemoods.com/?a=audio&s={searchTerms}&f=4
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - c:\program files\bitcomet\tools\BitCometBHO_1.4.12.6.dll
BHO: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - c:\program files\search toolbar\SearchToolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - c:\program files\search toolbar\SearchToolbar.dll
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [Weather] c:\program files\aws\weatherbug\Weather.exe 1
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [R8388QA8U8] c:\docume~1\davidf~1\locals~1\temp\Trh.exe
uRunOnce: [jH28601IpOiO28601] c:\documents and settings\all users\application data\jh28601ipoio28601\jH28601IpOiO28601.exe
mRun: [HDAudDeck] c:\program files\via\viaudioi\hdadeck\HDeck.exe 1
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [InstaLAN] "c:\program files\belkin\router setup and monitor\BelkinRouterMonitor.exe" startup
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
IE: &D&ownload &with BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm
IE: &D&ownload all with BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://c:\program files\bitcomet\tools\BitCometBHO_1.4.12.6.dll/206
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1263871860703
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1263871854484
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
mASetup: {D58F39FF-953E-4F45-898F-59F243B9A523} - "c:\program files\windows sidebar\sidebar.exe" /RegServer
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\docume~1\davidf~1\applic~1\mozilla\firefox\profiles\8udanxiv.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2117678&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://us.mg.mail.yahoo.com/neo/launch
FF - component: c:\documents and settings\david forrest\application

data\mozilla\firefox\profiles\8udanxiv.default\extensions\{b042753d-f57e-4e8e-a01b-7379a6d4cefb}\components\IBitCometExtension.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpClipBook.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpClipBookDB.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpNeoLogger.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSaturn.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSeymour.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSmartSelect.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSmartWebPrinting.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSWPOperation.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXPLogging.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXPMTC.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXPMTL.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXREStub.dll
FF - plugin: c:\documents and settings\david forrest\my documents\real player\netscape6\nppl3260.dll
FF - plugin: c:\documents and settings\david forrest\my documents\real player\netscape6\nprjplug.dll
FF - plugin: c:\documents and settings\david forrest\my documents\real player\netscape6\nprpjplug.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\google updater\2.4.1601.7122\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npcosmop211.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npsharedview.dll
FF - plugin: c:\program files\opera\program\plugins\np_gp.dll
FF - plugin: c:\program files\opera\program\plugins\npcosmop211.dll
FF - plugin: c:\program files\opera\program\plugins\npdivx32.dll
.
============= SERVICES / DRIVERS ===============
.
R0 93425302;93425302 Boot Guard Driver;c:\windows\system32\drivers\93425302.sys [2010-12-13 37392]
R1 93425301;93425301;c:\windows\system32\drivers\93425301.sys [2010-12-13 128016]
R1 kaspersky_setupdrv;kaspersky_setupdrv;c:\windows\system32\drivers\9342530.sys [2010-12-13 315408]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-3-25 165264]
R1 VBoxDrv;VirtualBox Service;c:\windows\system32\drivers\VBoxDrv.sys [2010-9-27 162544]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\drivers\VBoxUSBMon.sys [2010-9-27 44784]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [2010-8-5 111280]
R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\drivers\VBoxNetFlt.sys [2011-4-26 122224]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2008-10-22 238080]
S1 MpKsl1706cee7;MpKsl1706cee7;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{7b3ee020-c7c3-4ad5-ab70-9a7c772e2ca4}\mpksl1706cee7.sys --> c:\documents and settings\all users\application data\microsoft\microsoft

antimalware\definition updates\{7b3ee020-c7c3-4ad5-ab70-9a7c772e2ca4}\MpKsl1706cee7.sys [?]
S1 MpKsl29e66122;MpKsl29e66122;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{bf05652e-7745-41da-9077-f9c1f633374a}\mpksl29e66122.sys --> c:\documents and settings\all users\application data\microsoft\microsoft

antimalware\definition updates\{bf05652e-7745-41da-9077-f9c1f633374a}\MpKsl29e66122.sys [?]
S1 MpKsl80d38c41;MpKsl80d38c41;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{75ead202-95c7-4e74-9af4-f973f4d22cf6}\mpksl80d38c41.sys --> c:\documents and settings\all users\application data\microsoft\microsoft

antimalware\definition updates\{75ead202-95c7-4e74-9af4-f973f4d22cf6}\MpKsl80d38c41.sys [?]
S1 MpKslec1f82f6;MpKslec1f82f6;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{a8537721-ba21-4926-8a00-c5b7b79a8a6b}\mpkslec1f82f6.sys --> c:\documents and settings\all users\application data\microsoft\microsoft

antimalware\definition updates\{a8537721-ba21-4926-8a00-c5b7b79a8a6b}\MpKslec1f82f6.sys [?]
S1 MpKslf7e8760a;MpKslf7e8760a;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{b8978fa6-8c0c-4aee-b919-5a925334087a}\mpkslf7e8760a.sys --> c:\documents and settings\all users\application data\microsoft\microsoft

antimalware\definition updates\{b8978fa6-8c0c-4aee-b919-5a925334087a}\MpKslf7e8760a.sys [?]
S1 MpKslf8eca916;MpKslf8eca916;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{7b3ee020-c7c3-4ad5-ab70-9a7c772e2ca4}\mpkslf8eca916.sys --> c:\documents and settings\all users\application data\microsoft\microsoft

antimalware\definition updates\{7b3ee020-c7c3-4ad5-ab70-9a7c772e2ca4}\MpKslf8eca916.sys [?]
S2 gupdate1c9eaeb137993de;Google Update Service (gupdate1c9eaeb137993de);c:\program files\google\update\GoogleUpdate.exe [2009-6-11 133104]
S2 StudioPro;StudioPro webcam;c:\windows\system32\drivers\StudioPro.sys [2009-2-28 124416]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-6-11 133104]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys --> c:\windows\system32\drivers\motccgp.sys [?]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys --> c:\windows\system32\drivers\motccgpfl.sys [?]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys --> c:\windows\system32\drivers\motport.sys [?]
S3 ssrangdr;ssrangdr;c:\windows\system32\drivers\ssrangdr.sys [2009-12-13 2560]
S3 VBoxUSB;VirtualBox USB;c:\windows\system32\drivers\VBoxUSB.sys [2010-10-4 31824]
S4 misalign;Data Misalignment Exception Kernel Driver;c:\windows\system32\drivers\misalign.sys [2009-3-10 8832]
.
=============== File Associations ===============
.
.txt=speakingtxtfile
.
=============== Created Last 30 ================
.
2011-05-08 03:18:33 -------- d-----w- c:\docume~1\alluse~1\applic~1\jH28601IpOiO28601
2011-05-08 02:54:43 137728 ----a-w- c:\windows\Tsymea.exe
2011-05-08 02:54:38 135168 --sha-r- c:\windows\system32\avicap32Z.dll
2011-05-07 18:44:27 7071056 ----a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition

updates\{e43e12c2-48cd-4b98-aa86-cb0ffb78ee4a}\mpengine.dll
2011-05-07 06:33:36 -------- d-----w- c:\program files\Sony
2011-05-07 00:01:20 -------- d-----w- c:\docume~1\davidf~1\applic~1\SecurityHeroes
2011-05-06 03:47:41 -------- d-----w- c:\docume~1\davidf~1\locals~1\applic~1\Miro
2011-05-06 03:46:15 -------- d-----w- c:\program files\Participatory Culture Foundation
2011-05-06 03:33:56 781272 ----a-w- c:\program files\mozilla firefox\mozsqlite3.dll
2011-05-06 03:33:56 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2011-05-06 03:33:55 89048 ----a-w- c:\program files\mozilla firefox\libEGL.dll
2011-05-06 03:33:55 465880 ----a-w- c:\program files\mozilla firefox\libGLESv2.dll
2011-05-06 03:33:55 1974616 ----a-w- c:\program files\mozilla firefox\D3DCompiler_42.dll
2011-05-06 03:33:55 1892184 ----a-w- c:\program files\mozilla firefox\d3dx9_42.dll
2011-05-06 03:33:55 1874904 ----a-w- c:\program files\mozilla firefox\mozjs.dll
2011-05-06 03:33:55 15832 ----a-w- c:\program files\mozilla firefox\mozalloc.dll
2011-05-05 06:12:22 -------- d-----w- c:\program files\rComplex
2011-05-05 06:11:53 -------- d-----w- c:\program files\Search Toolbar
2011-05-01 22:44:25 -------- d-----w- c:\documents and settings\david forrest\VirtualBox VMs
2011-05-01 21:56:10 31232 --sha-r- c:\windows\system32\msfDX.dll
2011-05-01 21:56:10 216064 --sha-r- c:\windows\system32\nbDX.dll
2011-05-01 21:56:05 92672 --sha-r- c:\windows\system32\RLVorbisDec.ax
2011-05-01 21:56:05 90112 --sha-r- c:\windows\system32\TTADSSplitter.ax
2011-05-01 21:56:05 90112 --sha-r- c:\windows\system32\TTADSDecoder.ax
2011-05-01 21:56:05 70656 --sha-r- c:\windows\system32\RLAPEDec.ax
2011-05-01 21:56:05 67584 --sha-r- c:\windows\system32\RLTheoraDec.ax
2011-05-01 21:56:05 51712 --sha-r- c:\windows\system32\RLSpeexDec.ax
2011-05-01 21:56:05 186880 --sha-r- c:\windows\system32\RLOgg.ax
2011-05-01 21:56:05 107520 --sha-r- c:\windows\system32\RLMPCDec.ax
2011-05-01 21:56:00 120832 --sha-r- c:\windows\system32\MPCDx.ax
2011-05-01 21:55:49 97280 --sha-r- c:\windows\system32\FLACDX.ax
2011-05-01 21:55:28 175104 --sha-r- c:\windows\system32\CoreAAC.ax
2011-05-01 21:55:28 123904 --sha-r- c:\windows\system32\AVCDX.ax
2011-05-01 21:55:27 81920 --sha-r- c:\windows\system32\aac_parser.ax
2011-05-01 21:55:27 227328 --sha-r- c:\windows\system32\ac3DX.ax
2011-04-29 06:50:03 -------- d-----w- c:\program files\DVDStyler
2011-04-29 06:49:16 -------- d-----w- c:\program files\Celtx
2011-04-26 22:56:38 -------- d-----w- c:\program files\Speaking Notepad
2011-04-26 22:10:34 122224 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys
2011-04-26 22:10:32 135472 ----a-w- c:\windows\system32\VBoxNetFltNotify.dll
2011-04-20 08:39:03 -------- d-----w- c:\program files\EarthSculptor
.
==================== Find3M ====================
.
2011-05-05 00:34:40 233832 ----a-w- c:\windows\system32\nvdrsdb1.bin
2011-05-05 00:34:40 233832 ----a-w- c:\windows\system32\nvdrsdb0.bin
2011-05-05 00:34:40 1 ----a-w- c:\windows\system32\nvdrssel.bin
2011-05-02 04:14:04 737280 ----a-w- c:\windows\iun6002.exe
2011-03-15 04:31:53 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2011-03-07 05:33:50 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:37:06 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21:11 1857920 ----a-w- c:\windows\system32\win32k.sys
2011-02-22 23:06:29 916480 ----a-w- c:\windows\system32\wininet.dll
2011-02-22 23:06:29 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-02-22 23:06:29 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-02-22 11:41:59 385024 ----a-w- c:\windows\system32\html.iec
2011-02-17 12:32:12 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2011-02-15 12:56:39 290432 ----a-w- c:\windows\system32\atmfd.dll
2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-08 13:33:55 978944 ----a-w- c:\windows\system32\mfc42.dll
2011-02-08 13:33:55 974848 ----a-w- c:\windows\system32\mfc42u.dll
2008-03-09 14:25:10 236 ---ha-w- c:\program files\common files\dx.reg
2007-02-21 20:47:16 31232 --sha-r- c:\windows\system32\msfDX.dll
2008-03-16 22:30:52 216064 --sha-r- c:\windows\system32\nbDX.dll
.
============= FINISH: 21:27:18.70 ===============

Thank You!

Hi RobotiX, and welcome to Bleeping Computer.

Firstly,
Download RogueKiller to your Desktop.

• Quit all running programs.
  
• Simply run RogueKiller.exe.
  
• When prompted, type 1 and validate.
  
• The RKreport.txt shall be generated next to the executable.
  
• If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe.

Please post the contents of the RKreport.txt in your next Reply.

Immediately after running RogueKiller, try downloading and running Malwarebytes (instructions below). Be sure to get updates, if you have internet access. If not, run it without updates and save that log, then once you are able to get online, try running MBAM again, and this time get updates first. Post both logs on here.

Secondly,
Please download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Hi,
I ran Malwarebytes a few days ago after I posted my first post. It found 4 viruses and deleted them, my computer seems to be running faster and all symptoms are gone except that google is still redirecting (only on my profile thankfully) and Microsoft Security Essentials is still unable to run (on all profiles). Here is the log from that run:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6529

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

5/7/2011 11:34:39 PM
mbam-log-2011-05-07 (23-34-39).txt

Scan type: Full scan (C:\|)
Objects scanned: 364023
Time elapsed: 1 hour(s), 12 minute(s), 57 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
c:\WINDOWS\Tsymea.exe (Trojan.Downloader) -> 4180 -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\Software\R8388QA8U8 (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\Tsymea.exe (Trojan.Downloader) -> Delete on reboot.
c:\documents and settings\all users\application data\jh28601ipoio28601\jh28601ipoio28601.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\david forrest\local settings\Temp\Trg.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Tasks\{810401e2-dde0-454e-b0e2-aa89c9e5967c}.job (Trojan.FraudPack) -> Quarantined and deleted successfully.


Here is the RogueKiller log:

RogueKiller V5.1.1 [05/05/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion-193725-1-BRogueKillerD-Remontees.html

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: David Forrest [Admin rights]
Mode: Scan -- Date : 05/12/2011 15:10:51

Bad processes: 0

Registry Entries: 3
[BLACKLIST Value] HKUS\S-1-5-21-420793594-3175798489-343474573-1005[...]\Run : twunk_32x.exe (C:\DOCUME~1\Juliet\LOCALS~1\Temp\twunk_32x.exe) -> FOUND
[APPDT/TMP/DESKTOP] setup_9.0.0.722_08.05.2011_07-40.lnk : C:\Documents and Settings\David Forrest\Desktop\Virus Removal Tool\setup_9.0.0.722_08.05.2011_07-40\startup.exe -> FOUND
[PROXY IE] HKCU\[...]\Internet Settings : ProxyServer (localhost:80) -> FOUND

HOSTS File:
127.0.0.1 localhost


Finished : << RKreport[1].txt >>
RKreport[1].txt



Here is the new MBAM log (found one virus):

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6563

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

5/12/2011 9:01:44 PM
mbam-log-2011-05-12 (21-01-44).txt

Scan type: Full scan (C:\|)
Objects scanned: 361475
Time elapsed: 54 minute(s), 16 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\5GUTNY6MFK (Trojan.FakeAlert.SA) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Thank you for helping.

Hi again RobotiX!!..

RobotiX, on 12 May 2011 - 11:05 PM, said:

Let's check if an updated version of MBAM gets the file responsible for the redirects:

So, firstly,

• Please launch Malwarebytes' Anti-Malware, click the Update tab, and then Check for Updates.
  
• Then choose the Scanner tab and select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.

Secondly,
Download OTL.exe by OldTimer to your Desktop.

• Close all windows and double click OTL.exe.
  
• In the "Custom Scans/Fixes" window (under the light green bar) paste the following in bold:
  
  netsvcs
  drivers32
  %SYSTEMDRIVE%\*.*
  %systemroot%\*. /mp /s
  CREATERESTOREPOINT
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  
  
  
• Click Run Scan and let the program run uninterrupted.
  
• When the scan completes, it will open two Notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL. Post both logs in this thread.
  
• You may need to use two posts to get it all.

Ok... The third MBAM run found nothing.
Log:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6571

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

5/13/2011 6:20:36 PM
mbam-log-2011-05-13 (18-20-36).txt

Scan type: Quick scan
Objects scanned: 196612
Time elapsed: 4 minute(s), 35 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

-And here's the OTL.txt log:

OTL logfile created on: 5/13/2011 6:23:52 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\David Forrest\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 73.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 696.05 Gb Total Space | 440.37 Gb Free Space | 63.27% Space Free | Partition Type: NTFS

Computer Name: BUFF_PC | User Name: David Forrest | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/05/13 18:18:28 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\David Forrest\Desktop\OTL.exe
PRC - [2011/04/14 09:25:41 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/07/28 18:34:02 | 000,569,752 | ---- | M] (Affinegy, Inc.) -- C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe
PRC - [2010/07/28 18:33:58 | 006,995,864 | ---- | M] (Affinegy, Inc.) -- C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe
PRC - [2010/07/28 18:33:58 | 001,485,208 | ---- | M] (Affinegy, Inc.) -- C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe
PRC - [2009/06/09 16:12:08 | 000,096,088 | ---- | M] (Microsoft Corp.) -- C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
PRC - [2009/03/03 03:19:28 | 000,691,200 | ---- | M] (FileZilla Project) -- C:\Program Files\FileZilla Server\FileZilla server.exe
PRC - [2009/02/20 12:22:34 | 004,363,504 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
PRC - [2009/01/30 10:34:44 | 001,347,584 | ---- | M] (AWS Convergence Technologies, Inc.) -- C:\Program Files\AWS\WeatherBug\Weather.exe
PRC - [2008/04/14 09:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/09/28 02:20:00 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
PRC - [2006/05/23 23:49:14 | 000,024,576 | ---- | M] (Syntek America Inc.) -- C:\WINDOWS\system32\StkASv2K.exe


========== Modules (SafeList) ==========

MOD - [2011/05/13 18:18:28 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\David Forrest\Desktop\OTL.exe
MOD - [2010/08/23 09:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- -- (getPlusHelper) getPlus®
SRV - [2010/11/11 13:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2010/07/28 18:34:02 | 000,569,752 | ---- | M] (Affinegy, Inc.) [Auto | Running] -- C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe -- (AffinegyService)
SRV - [2009/03/27 23:55:42 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009/03/03 03:19:28 | 000,691,200 | ---- | M] (FileZilla Project) [Auto | Running] -- C:\Program Files\FileZilla Server\FileZilla Server.exe -- (FileZilla Server)
SRV - [2009/01/07 19:21:00 | 000,026,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\system32\spupdsvc.exe -- (spupdsvc)
SRV - [2006/09/28 02:20:00 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)
SRV - [2006/05/23 23:49:14 | 000,024,576 | ---- | M] (Syntek America Inc.) [Auto | Running] -- C:\WINDOWS\system32\StkASv2K.exe -- (StkASSrv)


========== Driver Services (SafeList) ==========

DRV - [2011/04/26 15:10:34 | 000,122,224 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VBoxNetFlt.sys -- (VBoxNetFlt)
DRV - [2011/04/26 15:10:34 | 000,111,280 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV - [2011/04/26 15:10:34 | 000,044,784 | ---- | M] (Oracle Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\VBoxUSBMon.sys -- (VBoxUSBMon)
DRV - [2011/04/26 15:10:32 | 000,162,544 | ---- | M] (Oracle Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\VBoxDrv.sys -- (VBoxDrv)
DRV - [2010/08/05 14:08:02 | 000,031,824 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VBoxUSB.sys -- (VBoxUSB)
DRV - [2010/06/23 19:12:50 | 000,027,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AFGSp50.sys -- (AFGSp50)
DRV - [2009/12/13 04:21:40 | 000,002,560 | ---- | M] (SupportSoft Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ssrangdr.sys -- (ssrangdr)
DRV - [2009/10/22 13:54:18 | 000,037,392 | ---- | M] (Kaspersky Lab) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\93425302.sys -- (93425302)
DRV - [2009/10/22 13:54:18 | 000,037,392 | ---- | M] (Kaspersky Lab) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\02141412.sys -- (02141412)
DRV - [2009/10/09 23:31:10 | 000,315,408 | ---- | M] (Kaspersky Lab) [File_System | System | Stopped] -- C:\WINDOWS\system32\drivers\0214141.sys -- (setup_9.0.0.722_08.05.2011_07-40drv)
DRV - [2009/10/09 23:31:10 | 000,315,408 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\9342530.sys -- (kaspersky_setupdrv)
DRV - [2009/09/25 17:59:42 | 000,128,016 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\93425301.sys -- (93425301)
DRV - [2009/09/25 17:59:42 | 000,128,016 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\02141411.sys -- (02141411)
DRV - [2009/04/04 13:43:16 | 000,025,280 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hamachi.sys -- (hamachi)
DRV - [2008/08/21 16:23:44 | 000,008,832 | ---- | M] (QUALCOMM Incorporated.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\misalign.sys -- (misalign)
DRV - [2008/08/01 15:36:00 | 000,054,784 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2008/08/01 15:36:00 | 000,022,016 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2008/05/08 21:23:22 | 000,238,080 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV - [2008/05/01 08:11:45 | 000,049,536 | R--- | M] (Texas Instruments Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tiehdusb.sys -- (TIEHDUSB)
DRV - [2008/02/14 14:12:00 | 001,389,056 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\monfilt.sys -- (monfilt)
DRV - [2007/06/27 06:05:52 | 000,053,184 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ftdibus.sys -- (FTDIBUS)
DRV - [2007/06/27 06:04:14 | 000,071,488 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ftser2k.sys -- (FTSER2K)
DRV - [2006/12/03 23:09:32 | 000,124,416 | ---- | M] (e2eSoft) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\StudioPro.sys -- (StudioPro)
DRV - [2006/09/26 20:01:36 | 000,241,628 | R--- | M] (Syntek America Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\StkAMini.sys -- (StkAMini)
DRV - [2006/08/01 23:44:04 | 000,004,772 | R--- | M] (Syntek America Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\StkScan.sys -- (StkScan)
DRV - [2005/06/23 13:56:26 | 000,048,384 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2004/08/12 08:00:00 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=audio&s={searchTerms}&f=4

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.autocompletepro.com/?si=10197&bi=400
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.autocompletepro.com/?si=10197&bi=400
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = http://search.autocompletepro.com/?si=10197&bi=400
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.facemoods.com/?a=audio
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://search.autocompletepro.com/?si=10197&bi=400
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = http://search.autocompletepro.com/?si=10197&bi=400
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = localhost:80

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: messagestyle-blackened@addons.instantbird.org:0.9
FF - prefs.js..extensions.enabledItems: default-palette@celtx.com:1.0
FF - prefs.js..extensions.enabledItems: messagestyle-depth@addons.instantbird.org:1.1
FF - prefs.js..extensions.enabledItems: inspector@mozilla.org:2.0.0
FF - prefs.js..extensions.enabledItems: messagestyle-minimal20@addons.instantbird.org:1.5
FF - prefs.js..extensions.enabledItems: emoticons-msn-smileys@m513901.de:0.1
FF - prefs.js..extensions.enabledItems: calendar-timezones@mozilla.org:0.1.2008d

FF - HKLM\software\mozilla\Firefox\extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/08/19 23:02:17 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/05 20:33:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/05 20:33:55 | 000,000,000 | ---D | M]

[2010/09/12 21:41:35 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Extensions
[2010/09/12 21:41:35 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Extensions\celtx@celtx.com
[2011/05/11 12:49:01 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions
[2010/04/27 21:46:35 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/01 19:21:42 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\{43c35458-c907-439b-bcfd-07d373834689}
[2010/02/10 18:33:53 | 000,000,000 | ---D | M] (Ad blocker) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3612C}
[2011/05/06 17:01:19 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/03/25 00:10:46 | 000,000,000 | ---D | M] (BitComet Video Downloader) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}
[2011/03/25 00:10:47 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}-trash
[2009/03/06 21:49:38 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus®)) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}
[2009/08/19 21:59:13 | 000,000,000 | ---D | M] (Ask Chrome Search Engine) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\askopensearch-VTS@ask.com
[2011/05/11 12:49:01 | 000,000,000 | ---D | M] (Diccionario de Español/España) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\es-es@dictionaries.addons.mozilla.org
[2011/05/05 20:35:14 | 000,000,000 | ---D | M] (FDislike) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\fbdislike@doweb.fr
[2011/05/05 20:34:32 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\nostmp
[2011/05/06 17:01:17 | 000,000,000 | ---D | M] (Maximum AdBlock) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\ozymandias@securityheroes.com
[2011/03/14 19:26:36 | 000,000,000 | ---D | M] (Personas) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\personas@christopher.beard
[2010/01/27 02:07:53 | 000,000,000 | ---D | M] (Game Maker Community Extension) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\Revel@gmcextension.gmhut.com
[2010/09/03 17:48:12 | 000,000,000 | ---D | M] ("YoYo Games InstantPlay") -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\yyginstantplay@yoyogames.com
[2010/01/27 02:07:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\Revel@gmcextension.gmhut.com\chrome
[2010/01/27 02:07:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\Revel@gmcextension.gmhut.com\defaults
[2010/01/27 02:07:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\Revel@gmcextension.gmhut.com\locale
[2010/01/27 02:07:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\Revel@gmcextension.gmhut.com\skin
[2011/05/05 20:33:56 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/08/19 15:08:11 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\browserhighlighter@ebay.com
[2011/04/28 23:49:17 | 000,000,000 | ---D | M] (Timezone Definitions for Mozilla Calendar) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\CALENDAR-TIMEZONES@MOZILLA.ORG
[2011/04/28 23:49:17 | 000,000,000 | ---D | M] (Default Shot Palette) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\DEFAULT-PALETTE@CELTX.COM
[2011/04/28 23:49:17 | 000,000,000 | ---D | M] (MSN-Smileys) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\EMOTICONS-MSN-SMILEYS@M513901.DE
[2011/04/28 23:49:17 | 000,000,000 | ---D | M] (DOM Inspector) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\INSPECTOR@MOZILLA.ORG
[2011/04/28 23:49:17 | 000,000,000 | ---D | M] (Blackened) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\MESSAGESTYLE-BLACKENED@ADDONS.INSTANTBIRD.ORG
[2011/04/28 23:49:17 | 000,000,000 | ---D | M] (Depth) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\MESSAGESTYLE-DEPTH@ADDONS.INSTANTBIRD.ORG
[2011/04/28 23:49:17 | 000,000,000 | ---D | M] (Minimal) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\MESSAGESTYLE-MINIMAL20@ADDONS.INSTANTBIRD.ORG
[2011/04/14 09:26:02 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/08/24 02:31:30 | 000,773,120 | ---- | M] (BitComet) -- C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2007/09/23 15:41:20 | 000,404,992 | ---- | M] (PLATINUM technology, inc.) -- C:\Program Files\Mozilla Firefox\plugins\npcosmop211.dll
[2008/01/30 12:48:38 | 000,074,280 | ---- | M] ( ) -- C:\Program Files\Mozilla Firefox\plugins\npsharedview.dll
[2010/12/22 14:18:27 | 000,003,189 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\acpro.xml
[2010/01/01 01:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010/11/22 09:33:08 | 000,002,037 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrchaudio.xml

O1 HOSTS File: ([2006/02/28 05:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.4.12.6.dll (BitComet)
O2 - BHO: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O3 - HKLM\..\Toolbar: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [InstaLAN] C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe (Affinegy, Inc.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe (AWS Convergence Technologies, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowLegacyWebView = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowUnhashedWebView = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &D&ownload &with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D&ownload all with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.4.12.6.dll (BitComet)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1263871860703 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1263871854484 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_17-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\HmelyoffLabs\VHToolkit\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/10/22 17:55:27 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{fe77adaf-1e4c-11e0-81bb-00248c00f37d}\Shell - "" = AutoRun
O33 - MountPoints2\{fe77adaf-1e4c-11e0-81bb-00248c00f37d}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fe77adaf-1e4c-11e0-81bb-00248c00f37d}\Shell\AutoRun\command - "" = I:\setup.exe -a
O33 - MountPoints2\I\Shell - "" = AutoRun
O33 - MountPoints2\I\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\LaunchU3.exe -a
O33 - MountPoints2\Z\Shell - "" = AutoRun
O33 - MountPoints2\Z\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\Z\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.dvacm - C:\Program Files\Common Files\Ulead Systems\VIO\DVACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\WINDOWS\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.MPEGacm - C:\Program Files\Common Files\Ulead Systems\MPEG\MPEGACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.ulmp3acm - C:\Program Files\Common Files\Ulead Systems\MPEG\ulmp3acm.acm (Ulead systems)
Drivers32: msacm.vorbis - C:\WINDOWS\System32\vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.444p - C:\Program Files\t@b\0.958\686\tabdec.dll File not found
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.MP42 - MPG4C32.dll File not found
Drivers32: vidc.mpng - C:\Program Files\t@b\0.958\686\tabdec.dll File not found
Drivers32: vidc.mvjp - C:\Program Files\t@b\0.958\686\tabdec.dll File not found
Drivers32: vidc.yv12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2011/05/13 18:18:27 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\David Forrest\Desktop\OTL.exe
[2011/05/13 01:30:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\Shared Documents
[2011/05/11 21:02:05 | 000,000,000 | ---D | C] -- C:\f48b585ca38a974920db91a250
[2011/05/11 20:38:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows PowerShell 1.0
[2011/05/11 20:38:02 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\windowspowershell
[2011/05/08 00:30:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2011/05/08 00:15:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Hmelyoff Labs
[2011/05/08 00:05:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SplitMediaLabs
[2011/05/08 00:05:07 | 000,000,000 | ---D | C] -- C:\Program Files\SplitMediaLabs
[2011/05/07 22:48:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\DAVID-Laserscanner
[2011/05/07 22:48:19 | 000,000,000 | ---D | C] -- C:\Program Files\DAVID-Laserscanner
[2011/05/07 22:21:17 | 000,315,408 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\0214141.sys
[2011/05/07 22:21:17 | 000,128,016 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\02141411.sys
[2011/05/07 22:21:17 | 000,037,392 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\02141412.sys
[2011/05/07 22:21:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Desktop\Virus Removal Tool
[2011/05/07 21:52:55 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\David Forrest\Recent
[2011/05/07 21:38:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Desktop\gmer
[2011/05/07 20:18:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\jH28601IpOiO28601
[2011/05/07 20:11:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Desktop\David_Laserscanner_2_4_3
[2011/05/07 12:56:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Desktop\grapnel_v1.4
[2011/05/06 23:33:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Sony
[2011/05/06 23:33:36 | 000,000,000 | ---D | C] -- C:\Program Files\Sony
[2011/05/06 23:33:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sony
[2011/05/06 17:01:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Application Data\SecurityHeroes
[2011/05/05 20:47:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Local Settings\Application Data\Miro
[2011/05/05 20:46:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Start Menu\Programs\Miro
[2011/05/05 20:46:15 | 000,000,000 | ---D | C] -- C:\Program Files\Participatory Culture Foundation
[2011/05/04 23:13:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Start Menu\Programs\rComplex
[2011/05/04 23:12:22 | 000,000,000 | ---D | C] -- C:\Program Files\rComplex
[2011/05/04 23:11:53 | 000,000,000 | ---D | C] -- C:\Program Files\Search Toolbar
[2011/05/01 21:14:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\BlueVoda Website Builder
[2011/05/01 15:44:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\VirtualBox VMs
[2011/05/01 15:30:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Oracle VM VirtualBox
[2011/05/01 14:56:10 | 000,216,064 | RHS- | C] (MONOGRAM Multimedia, s.r.o.) -- C:\WINDOWS\System32\nbDX.dll
[2011/05/01 14:56:10 | 000,031,232 | RHS- | C] (Hans Mayerl) -- C:\WINDOWS\System32\msfDX.dll
[2011/05/01 14:56:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SUPER © - by eRightSoft
[2011/05/01 14:56:05 | 000,186,880 | RHS- | C] (RadLight) -- C:\WINDOWS\System32\RLOgg.ax
[2011/05/01 14:56:05 | 000,092,672 | RHS- | C] (RadLight) -- C:\WINDOWS\System32\RLVorbisDec.ax
[2011/05/01 14:56:05 | 000,090,112 | RHS- | C] (-) -- C:\WINDOWS\System32\TTADSSplitter.ax
[2011/05/01 14:56:05 | 000,090,112 | RHS- | C] (-) -- C:\WINDOWS\System32\TTADSDecoder.ax
[2011/05/01 14:56:05 | 000,067,584 | RHS- | C] (RadLight, LLC) -- C:\WINDOWS\System32\RLTheoraDec.ax
[2011/05/01 14:55:28 | 000,123,904 | RHS- | C] (CoreCodec) -- C:\WINDOWS\System32\AVCDX.ax
[2011/04/30 22:24:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Blender Foundation
[2011/04/29 13:06:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Desktop\Spring Break
[2011/04/28 23:50:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\DVDStyler
[2011/04/28 23:50:03 | 000,000,000 | ---D | C] -- C:\Program Files\DVDStyler
[2011/04/28 23:49:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Celtx
[2011/04/28 23:49:16 | 000,000,000 | ---D | C] -- C:\Program Files\Celtx
[2011/04/26 15:56:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Speaking Notepad
[2011/04/26 15:56:38 | 000,000,000 | ---D | C] -- C:\Program Files\Speaking Notepad
[2011/04/26 15:10:34 | 000,122,224 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\drivers\VBoxNetFlt.sys
[2011/04/26 15:10:32 | 000,135,472 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\VBoxNetFltNotify.dll
[2011/04/20 01:39:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\EarthSculptor
[2011/04/20 01:39:03 | 000,000,000 | ---D | C] -- C:\Program Files\EarthSculptor
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\David Forrest\My Documents\*.tmp files -> C:\Documents and Settings\David Forrest\My Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/13 18:22:00 | 000,000,434 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{2AAE5D93-28BF-47D6-AA76-E938912D7580}.job
[2011/05/13 18:18:28 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\David Forrest\Desktop\OTL.exe
[2011/05/13 18:12:47 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/05/13 17:52:00 | 000,000,982 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-420793594-3175798489-343474573-1005UA.job
[2011/05/13 17:41:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/05/13 15:16:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/05/13 14:43:20 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2011/05/13 12:41:00 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/05/13 00:52:00 | 000,000,930 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-420793594-3175798489-343474573-1005Core.job
[2011/05/12 23:01:03 | 000,000,294 | ---- | M] () -- C:\WINDOWS\tasks\switchDowngrade.job
[2011/05/12 23:01:01 | 000,000,296 | ---- | M] () -- C:\WINDOWS\tasks\videopadDowngrade.job
[2011/05/12 15:20:59 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/12 15:09:31 | 000,471,610 | ---- | M] () -- C:\Documents and Settings\David Forrest\Desktop\RogueKiller.exe
[2011/05/11 21:03:09 | 000,001,787 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
[2011/05/11 20:28:05 | 004,346,086 | ---- | M] () -- C:\Documents and Settings\David Forrest\Desktop\ComboFix.exe
[2011/05/10 15:40:12 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\David Forrest\.1
[2011/05/09 18:58:34 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011/05/08 19:55:55 | 000,098,816 | ---- | M] () -- C:\Documents and Settings\David Forrest\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/07 23:36:56 | 000,000,332 | -HS- | M] () -- C:\WINDOWS\tasks\Eyipwdgkh.job
[2011/05/07 23:36:48 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/05/07 21:23:39 | 000,625,664 | ---- | M] () -- C:\Documents and Settings\David Forrest\Desktop\dds.scr
[2011/05/07 19:54:38 | 000,135,168 | RHS- | M] () -- C:\WINDOWS\System32\avicap32Z.dll
[2011/05/06 23:33:58 | 000,000,805 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Vegas Pro 10.0.lnk
[2011/05/06 17:43:39 | 000,221,973 | ---- | M] () -- C:\Documents and Settings\David Forrest\My Documents\PDR.dmp
[2011/05/06 00:13:17 | 000,005,141 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\Global.sw2
[2011/05/05 20:33:59 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\David Forrest\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/05/05 15:22:49 | 000,000,074 | ---- | M] () -- C:\Documents and Settings\David Forrest\default.pls
[2011/05/04 22:59:00 | 000,000,294 | ---- | M] () -- C:\WINDOWS\tasks\switchShakeIcon.job
[2011/05/04 17:34:40 | 000,233,832 | ---- | M] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2011/05/04 17:34:40 | 000,233,832 | ---- | M] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2011/05/04 17:34:40 | 000,000,001 | ---- | M] () -- C:\WINDOWS\System32\nvdrssel.bin
[2011/05/01 21:14:57 | 000,001,692 | ---- | M] () -- C:\Documents and Settings\David Forrest\Desktop\BlueVoda Website Builder.lnk
[2011/05/01 21:14:04 | 000,737,280 | ---- | M] (Indigo Rose Corporation) -- C:\WINDOWS\iun6002.exe
[2011/05/01 19:34:24 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/05/01 15:30:47 | 000,000,801 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Oracle VM VirtualBox.lnk
[2011/05/01 14:56:12 | 000,000,761 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SUPER ©.lnk
[2011/05/01 14:52:17 | 000,000,298 | ---- | M] () -- C:\WINDOWS\tasks\wavepadShakeIcon.job
[2011/05/01 14:49:47 | 000,002,043 | ---- | M] () -- C:\Documents and Settings\David Forrest\.lmmsrc.xml
[2011/04/30 22:24:36 | 000,001,745 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Blender.lnk
[2011/04/29 13:14:37 | 000,000,210 | RHS- | M] () -- C:\boot.ini
[2011/04/28 23:50:08 | 000,000,762 | ---- | M] () -- C:\Documents and Settings\David Forrest\Desktop\DVDStyler.lnk
[2011/04/28 23:49:19 | 000,001,510 | ---- | M] () -- C:\Documents and Settings\David Forrest\Application Data\Microsoft\Internet Explorer\Quick Launch\Celtx.lnk
[2011/04/28 23:49:19 | 000,001,492 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Celtx.lnk
[2011/04/28 22:59:43 | 000,000,296 | ---- | M] () -- C:\WINDOWS\tasks\videopadShakeIcon.job
[2011/04/26 15:10:34 | 000,122,224 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\drivers\VBoxNetFlt.sys
[2011/04/26 15:10:34 | 000,111,280 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\drivers\VBoxNetAdp.sys
[2011/04/26 15:10:34 | 000,044,784 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\drivers\VBoxUSBMon.sys
[2011/04/26 15:10:32 | 000,162,544 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\drivers\VBoxDrv.sys
[2011/04/26 15:10:32 | 000,135,472 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\VBoxNetFltNotify.dll
[2011/04/14 16:52:16 | 000,021,807 | ---- | M] () -- C:\Documents and Settings\David Forrest\.recently-used.xbel
[2011/04/14 03:33:25 | 001,504,256 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/04/14 03:13:20 | 000,414,084 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/04/14 03:13:20 | 000,064,666 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\David Forrest\My Documents\*.tmp files -> C:\Documents and Settings\David Forrest\My Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/12 15:20:59 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/12 15:09:30 | 000,471,610 | ---- | C] () -- C:\Documents and Settings\David Forrest\Desktop\RogueKiller.exe
[2011/05/11 20:27:53 | 004,346,086 | ---- | C] () -- C:\Documents and Settings\David Forrest\Desktop\ComboFix.exe
[2011/05/10 15:40:12 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\David Forrest\.1
[2011/05/07 21:23:36 | 000,625,664 | ---- | C] () -- C:\Documents and Settings\David Forrest\Desktop\dds.scr
[2011/05/07 19:54:38 | 000,135,168 | RHS- | C] () -- C:\WINDOWS\System32\avicap32Z.dll
[2011/05/07 19:54:38 | 000,000,332 | -HS- | C] () -- C:\WINDOWS\tasks\Eyipwdgkh.job
[2011/05/06 23:33:58 | 000,000,805 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Vegas Pro 10.0.lnk
[2011/05/05 20:33:59 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/05/01 21:14:57 | 000,001,692 | ---- | C] () -- C:\Documents and Settings\David Forrest\Desktop\BlueVoda Website Builder.lnk
[2011/05/01 19:34:24 | 000,001,804 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2011/05/01 19:34:24 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/05/01 15:30:47 | 000,000,801 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Oracle VM VirtualBox.lnk
[2011/05/01 14:56:12 | 000,000,761 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SUPER ©.lnk
[2011/05/01 14:56:05 | 000,107,520 | RHS- | C] () -- C:\WINDOWS\System32\RLMPCDec.ax
[2011/05/01 14:56:05 | 000,070,656 | RHS- | C] () -- C:\WINDOWS\System32\RLAPEDec.ax
[2011/05/01 14:56:05 | 000,051,712 | RHS- | C] () -- C:\WINDOWS\System32\RLSpeexDec.ax
[2011/05/01 14:56:00 | 000,120,832 | RHS- | C] () -- C:\WINDOWS\System32\MPCDx.ax
[2011/05/01 14:55:49 | 000,097,280 | RHS- | C] () -- C:\WINDOWS\System32\FLACDX.ax
[2011/05/01 14:55:28 | 000,175,104 | RHS- | C] () -- C:\WINDOWS\System32\CoreAAC.ax
[2011/05/01 14:55:27 | 000,227,328 | RHS- | C] () -- C:\WINDOWS\System32\ac3DX.ax
[2011/05/01 14:55:27 | 000,081,920 | RHS- | C] () -- C:\WINDOWS\System32\aac_parser.ax
[2011/05/01 14:52:16 | 000,000,298 | ---- | C] () -- C:\WINDOWS\tasks\wavepadShakeIcon.job
[2011/04/30 22:24:36 | 000,001,745 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Blender.lnk
[2011/04/28 23:50:08 | 000,000,762 | ---- | C] () -- C:\Documents and Settings\David Forrest\Desktop\DVDStyler.lnk
[2011/04/28 23:49:19 | 000,001,510 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\Microsoft\Internet Explorer\Quick Launch\Celtx.lnk
[2011/04/28 23:49:19 | 000,001,492 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Celtx.lnk
[2011/04/28 22:59:21 | 000,000,294 | ---- | C] () -- C:\WINDOWS\tasks\switchDowngrade.job
[2011/04/14 20:41:57 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/04/14 16:52:16 | 000,021,807 | ---- | C] () -- C:\Documents and Settings\David Forrest\.recently-used.xbel
[2011/03/18 01:44:22 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\d6f2e38b
[2011/03/18 01:44:21 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\660cc00d
[2011/03/18 01:44:11 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\a8710bec
[2011/03/18 01:44:08 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\c5709935
[2011/03/18 01:44:03 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\bbec604a
[2011/03/18 01:44:03 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\bbaf9130
[2011/03/18 01:44:00 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\4d656f75
[2011/03/18 01:44:00 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\4d127ea3
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\86d40099
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\8698f2d2
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\860c9948
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\85d21749
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\859db37f
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\852af8cb
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\84ed778a
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\8041c91d
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\7e1527b9
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\7de414ee
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\7da22d81
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\7d3f1e0a
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\7c7a5b84
[2011/03/18 01:43:27 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\ceda8b7e
[2011/03/18 01:43:27 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\ce94dc19
[2011/03/18 01:43:25 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\79c615aa
[2011/03/18 01:43:25 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\79781fc9
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\c157bd28
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\c1157cba
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\c09a8b4c
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\be183617
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\bde96f9c
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\bd553205
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\bd19ac03
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\b744724c
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\b3f02c08
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\b3c0ac6c
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\b378b056
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\b33cf5fa
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\b21ef689
[2011/02/11 20:38:51 | 000,962,560 | ---- | C] () -- C:\WINDOWS\tesseract.exe
[2011/01/19 16:35:54 | 000,000,038 | -HS- | C] () -- C:\WINDOWS\camcodec100.ini
[2011/01/19 16:35:54 | 000,000,028 | -HS- | C] () -- C:\WINDOWS\lagarith.ini
[2010/09/09 13:08:46 | 000,233,832 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2010/09/09 13:08:44 | 000,233,832 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2010/09/09 13:08:44 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2010/09/09 13:08:05 | 002,195,030 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin
[2010/08/23 14:09:27 | 000,207,282 | ---- | C] () -- C:\WINDOWS\hpwins28.dat
[2010/08/23 14:09:27 | 000,000,418 | ---- | C] () -- C:\WINDOWS\hpwmdl28.dat
[2010/08/19 22:53:42 | 000,207,226 | ---- | C] () -- C:\WINDOWS\hpwins28.dat.temp
[2010/08/19 22:53:42 | 000,000,418 | ---- | C] () -- C:\WINDOWS\hpwmdl28.dat.temp
[2010/05/28 23:14:09 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/04/06 13:31:32 | 000,001,019 | ---- | C] () -- C:\Program Files\Nero PhotoSnap Viewer.lnk
[2010/03/15 18:34:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\UVMapper.INI
[2010/02/12 23:54:58 | 000,018,944 | ---- | C] () -- C:\WINDOWS\System32\xrxscnui.dll
[2010/02/12 23:52:29 | 000,000,872 | ---- | C] () -- C:\WINDOWS\wnsetup.ini
[2010/02/12 23:51:39 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\MSVCRT10.DLL
[2010/02/12 23:51:15 | 000,000,032 | ---- | C] () -- C:\WINDOWS\KPCMS.INI
[2009/09/23 18:58:33 | 000,001,492 | ---- | C] () -- C:\WINDOWS\netdet.ini
[2009/09/03 20:13:31 | 000,000,008 | ---- | C] () -- C:\Documents and Settings\David Forrest\Local Settings\Application Data\.mpid
[2009/08/30 14:07:54 | 000,000,854 | ---- | C] () -- C:\WINDOWS\blocks.dat
[2009/08/22 20:20:41 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2009/08/12 00:57:59 | 000,502,784 | ---- | C] () -- C:\WINDOWS\x2.64.exe
[2009/08/12 00:57:59 | 000,240,128 | ---- | C] () -- C:\WINDOWS\System32\x.264.exe
[2009/08/12 00:57:59 | 000,217,073 | ---- | C] () -- C:\WINDOWS\meta4.exe
[2009/08/12 00:57:59 | 000,066,560 | ---- | C] () -- C:\WINDOWS\MOTA113.exe
[2009/08/11 22:06:11 | 000,005,045 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ypkpiykb.yyr
[2009/08/10 10:50:59 | 000,000,110 | ---- | C] () -- C:\WINDOWS\GSdx9.INI
[2009/08/10 10:45:41 | 001,584,149 | ---- | C] () -- C:\WINDOWS\System32\setupapinew.dll
[2009/08/10 10:45:41 | 000,874,502 | ---- | C] () -- C:\WINDOWS\System32\kernel32new.dll
[2009/08/10 10:45:41 | 000,789,525 | ---- | C] () -- C:\WINDOWS\System32\rpcrt4new.dll
[2009/08/10 10:45:41 | 000,681,478 | ---- | C] () -- C:\WINDOWS\System32\msvcrtnew.dll
[2009/08/10 10:45:41 | 000,633,871 | ---- | C] () -- C:\WINDOWS\System32\user32new.dll
[2009/08/10 10:45:41 | 000,376,832 | ---- | C] () -- C:\WINDOWS\System32\M2000Twn.dll
[2009/08/10 10:45:41 | 000,167,948 | ---- | C] () -- C:\WINDOWS\System32\dxgi.dll
[2009/08/10 10:45:41 | 000,134,671 | ---- | C] () -- C:\WINDOWS\System32\winstanew.dll
[2009/08/10 10:45:41 | 000,096,783 | ---- | C] () -- C:\WINDOWS\System32\powrprofnew.dll
[2009/08/10 10:45:41 | 000,087,558 | ---- | C] () -- C:\WINDOWS\System32\ntdsapinew.dll
[2009/08/10 10:45:41 | 000,072,707 | ---- | C] () -- C:\WINDOWS\System32\secur32new.dll
[2009/08/10 10:45:41 | 000,039,948 | ---- | C] () -- C:\WINDOWS\System32\dwmapi.dll
[2009/08/10 10:45:41 | 000,025,037 | ---- | C] () -- C:\WINDOWS\System32\Nucleus.dll
[2009/08/10 10:45:41 | 000,000,236 | -H-- | C] () -- C:\Program Files\Common Files\dx.reg
[2009/08/10 10:45:40 | 001,029,126 | ---- | C] () -- C:\WINDOWS\System32\d3d10.dll
[2009/08/10 10:45:40 | 000,974,354 | ---- | C] () -- C:\WINDOWS\System32\crypt32new.dll
[2009/08/10 10:45:40 | 000,770,069 | ---- | C] () -- C:\WINDOWS\System32\advapi32new.dll
[2009/08/10 10:45:40 | 000,187,398 | ---- | C] () -- C:\WINDOWS\System32\d3d10core.dll
[2009/08/10 10:45:40 | 000,171,023 | ---- | C] () -- C:\WINDOWS\System32\apphelpnew.dll
[2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 16:07:42 | 000,230,768 | ---- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe
[2009/07/18 16:46:48 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/06/09 16:22:41 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\David Forrest\Local Settings\Application Data\PUTTY.RND
[2009/05/18 20:10:31 | 000,007,937 | ---- | C] () -- C:\WINDOWS\PmLite3.ini
[2009/05/18 20:10:31 | 000,001,862 | ---- | C] () -- C:\WINDOWS\PMStockCams.Ini
[2009/05/08 16:06:13 | 000,000,275 | ---- | C] () -- C:\WINDOWS\Caligari.ini
[2009/04/06 20:25:21 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Brownie.ini
[2009/04/05 21:40:30 | 000,000,236 | ---- | C] () -- C:\WINDOWS\Brpfx04a.ini
[2009/04/05 21:40:30 | 000,000,092 | ---- | C] () -- C:\WINDOWS\brpcfx.ini
[2009/04/05 21:40:30 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\BRIDF04A.dat
[2009/04/05 21:34:59 | 000,000,419 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2009/04/05 21:34:59 | 000,000,079 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2009/04/05 21:34:58 | 000,000,030 | ---- | C] () -- C:\WINDOWS\System32\brss01a.ini
[2009/04/05 15:25:10 | 000,002,070 | ---- | C] () -- C:\WINDOWS\kaillera.ini
[2009/03/12 23:32:21 | 000,001,106 | ---- | C] () -- C:\WINDOWS\videoimp.ini
[2009/03/12 23:32:11 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2009/03/12 23:31:58 | 000,000,021 | ---- | C] () -- C:\WINDOWS\VI_setup.ini
[2009/03/12 23:30:57 | 000,000,021 | ---- | C] () -- C:\WINDOWS\PI_setup.ini
[2009/03/07 16:41:03 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2009/03/04 01:51:29 | 000,000,031 | ---- | C] () -- C:\WINDOWS\e2eSoft.ini
[2009/02/28 17:24:33 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2009/02/28 10:35:03 | 000,000,031 | ---- | C] () -- C:\WINDOWS\bluevoda.ini
[2009/02/26 04:33:10 | 000,000,060 | ---- | C] () -- C:\WINDOWS\System32\SYSDRV.DAT
[2009/02/25 21:24:49 | 000,000,158 | ---- | C] () -- C:\WINDOWS\settings.ini
[2009/02/25 16:49:16 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/02/25 14:43:41 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009/02/25 14:36:18 | 000,098,816 | ---- | C] () -- C:\Documents and Settings\David Forrest\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/10/23 11:37:20 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008/10/23 11:37:07 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008/10/23 11:37:07 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008/10/23 11:36:52 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2008/10/23 11:36:26 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008/10/23 11:36:25 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2008/10/23 11:35:22 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008/10/22 19:50:27 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2008/10/22 19:07:47 | 000,000,470 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2008/10/22 18:41:32 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2008/10/22 18:41:25 | 000,024,892 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2008/10/22 18:41:25 | 000,010,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2008/10/22 18:37:09 | 000,004,984 | R--- | C] () -- C:\WINDOWS\System32\drivers\nvphy.bin
[2008/10/22 17:56:54 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2008/10/22 17:53:25 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2008/10/22 13:49:56 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2008/10/22 13:49:04 | 001,504,256 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2008/08/01 18:48:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2008/05/27 01:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/27 01:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2007/09/27 14:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 14:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 14:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2007/09/23 15:41:20 | 000,779,776 | ---- | C] () -- C:\WINDOWS\System32\cp211_main.dll
[2007/09/23 15:41:20 | 000,285,184 | ---- | C] () -- C:\WINDOWS\System32\cp211_graphicslarge16.dll
[2007/09/23 15:41:20 | 000,252,416 | ---- | C] () -- C:\WINDOWS\System32\cp211_javascript.dll
[2007/09/23 15:41:20 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\cp211_basic.dll
[2006/02/28 12:00:00 | 000,414,084 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006/02/28 12:00:00 | 000,064,666 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006/02/28 12:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2002/06/06 01:01:58 | 000,029,696 | ---- | C] () -- C:\WINDOWS\System32\asutl8.dll
[2002/04/19 18:03:52 | 000,004,514 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2002/04/19 18:03:48 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2008/10/22 17:55:27 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2011/04/29 13:14:37 | 000,000,210 | RHS- | M] () -- C:\boot.ini
[2008/10/22 17:55:27 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2008/10/22 17:55:27 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2008/10/22 17:55:27 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2006/02/28 12:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/10/22 18:06:15 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2011/05/07 23:36:42 | 2145,386,496 | -HS- | M] () -- C:\pagefile.sys
[2011/05/07 20:31:13 | 000,000,359 | ---- | M] () -- C:\rkill.log

< %systemroot%\*. /mp /s >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-12 03:52:23

========== Alternate Data Streams ==========

@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8

< End of report >

-And the Extras.txt log:

OTL Extras logfile created on: 5/13/2011 6:23:52 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\David Forrest\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 73.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 696.05 Gb Total Space | 440.37 Gb Free Space | 63.27% Space Free | Partition Type: NTFS

Computer Name: BUFF_PC | User Name: David Forrest | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"427:TCP" = 427:TCP:LocalSubNet:Enabled:SLP_Port(427)_TCP
"427:UDP" = 427:UDP:LocalSubNet:Enabled:SLP_Port(427)_UDP
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5353:TCP" = 5353:TCP:*:Enabled:Adobe CSI CS4
"4457:TCP" = 4457:TCP:*:Enabled:Application Sharing
"4458:TCP" = 4458:TCP:*:Enabled:Application Sharing
"86:TCP" = 86:TCP:*:Enabled:BroadCam Video Streaming Server TCP/IP Port
"1935:TCP" = 1935:TCP:*:Enabled:BroadCam Video Streaming Server Flash Video Server
"22681:TCP" = 22681:TCP:*:Enabled:BitComet 22681 TCP
"22681:UDP" = 22681:UDP:*:Enabled:BitComet 22681 UDP
"427:TCP" = 427:TCP:LocalSubNet:Enabled:SLP_Port(427)_TCP
"427:UDP" = 427:UDP:LocalSubNet:Enabled:SLP_Port(427)_UDP
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"8246:TCP" = 8246:TCP:*:Enabled:BitComet 8246 TCP
"8246:UDP" = 8246:UDP:*:Enabled:BitComet 8246 UDP
"1090:TCP" = 1090:TCP:*:Enabled:Akamai NetSession Interface
"5000:UDP" = 5000:UDP:*:Enabled:Akamai NetSession Interface

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 6.2
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpofxs08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxs08.exe:*:Enabled:hpofxs08.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqfxt08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqfxt08.exe:*:Enabled:hpqfxt08.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\HP Software Update\HPWUCli.exe" = C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe -- (Hewlett-Packard Co.)
"C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe" = C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe:LocalSubNet:Enabled:Belkin Setup -- (Affinegy, Inc.)
"C:\Program Files\HP\Digital Imaging\{7E0E61CC-1C99-429D-BEA7-C4DD5B898D2A}\setup\hpznui01.exe" = C:\Program Files\HP\Digital Imaging\{7E0E61CC-1C99-429D-BEA7-C4DD5B898D2A}\setup\hpznui01.exe:*:Enabled:hpznui01.exe -- (Hewlett-Packard)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
"C:\WINDOWS\system32\dplaysvr.exe" = C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper -- (Microsoft Corporation)
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\Documents and Settings\David Forrest\My Documents\YoYoGames\74631\Battles And Battalions.exe" = C:\Documents and Settings\David Forrest\My Documents\YoYoGames\74631\Battles And Battalions.exe:*:Enabled:The Online Adventure Game -- (Bellum Games)
"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" = C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4 -- (Adobe Systems Incorporated)
"C:\Program Files\Hamachi\hamachi.exe" = C:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi Client
"C:\Documents and Settings\All Users\Application Data\YoYoGames\yoyo61.exe" = C:\Documents and Settings\All Users\Application Data\YoYoGames\yoyo61.exe:*:Enabled:YoYo Games Player -- (YoYo Games Ltd)
"C:\Program Files\Garena\Garena.exe" = C:\Program Files\Garena\Garena.exe:*:Enabled:Garena
"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
"C:\WINDOWS\system32\java.exe" = C:\WINDOWS\system32\java.exe:*:Enabled:Java™ Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Program Files\Java\jre6\bin\javaw.exe" = C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java™ Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
"C:\WINDOWS\system32\dxdiag.exe" = C:\WINDOWS\system32\dxdiag.exe:*:Enabled:Microsoft DirectX Diagnostic Tool -- (Microsoft Corporation)
"C:\WINDOWS\system32\dpnsvr.exe" = C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server -- (Microsoft Corporation)
"C:\Documents and Settings\David Forrest\Desktop\Games Galore\Emulator Stuff\Kaillera Server\kaillerasrv.exe" = C:\Documents and Settings\David Forrest\Desktop\Games Galore\Emulator Stuff\Kaillera Server\kaillerasrv.exe:*:Enabled:kaillerasrv -- ()
"C:\Program Files\Google\Google Talk\googletalk.exe" = C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk
"C:\Documents and Settings\Juliet\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll" = C:\Documents and Settings\Juliet\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll:*:Enabled:Google Talk Plugin -- (Google)
"C:\Documents and Settings\Juliet\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe" = C:\Documents and Settings\Juliet\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin -- (Google)
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_30044\mypong.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_30044\mypong.exe:*:Enabled:mypong
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_32486\mypong.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_32486\mypong.exe:*:Enabled:mypong
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_97144\pong3.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_97144\pong3.exe:*:Enabled:pong3
"C:\Documents and Settings\David Forrest\My Documents\Real Player\realplay.exe" = C:\Documents and Settings\David Forrest\My Documents\Real Player\realplay.exe:*:Enabled:RealPlayer -- (RealNetworks, Inc.)
"C:\WINDOWS\system32\javaw.exe" = C:\WINDOWS\system32\javaw.exe:*:Enabled:Java™ Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Program Files\Messenger\msmsgr.exe" = C:\Program Files\Messenger\msmsgr.exe:*:Enabled:Windows Messenger
"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 6.2
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_94454\gmFTP.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_94454\gmFTP.exe:*:Enabled:gmFTP
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_6764\FileTran.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_6764\FileTran.exe:*:Enabled:FileTran
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_40570\FileTran.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_40570\FileTran.exe:*:Enabled:FileTran
"C:\Documents and Settings\David Forrest\Desktop\Games Galore\Emulator Stuff\Fusion36\Fusion.exe" = C:\Documents and Settings\David Forrest\Desktop\Games Galore\Emulator Stuff\Fusion36\Fusion.exe:*:Enabled:Fusion -- ()
"C:\Documents and Settings\David Forrest\Desktop\bgb_1.2\bgb.exe" = C:\Documents and Settings\David Forrest\Desktop\bgb_1.2\bgb.exe:*:Enabled:bgb
"C:\Documents and Settings\David Forrest\Desktop\zsnesw142\zsnesw.exe" = C:\Documents and Settings\David Forrest\Desktop\zsnesw142\zsnesw.exe:*:Enabled:zsnesw
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_41241\File_Transfer.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_41241\File_Transfer.exe:*:Enabled:File_Transfer
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_1986\File_Transfer.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_1986\File_Transfer.exe:*:Enabled:File_Transfer
"C:\Documents and Settings\David Forrest\Desktop\Adrenaline\Server\AdrenalineServer.exe" = C:\Documents and Settings\David Forrest\Desktop\Adrenaline\Server\AdrenalineServer.exe:*:Enabled:AdrenalineServer
"C:\Documents and Settings\David Forrest\Desktop\Adrenaline\Adrenaline.exe" = C:\Documents and Settings\David Forrest\Desktop\Adrenaline\Adrenaline.exe:*:Enabled:Adrenaline
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_87601\FileTran.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_87601\FileTran.exe:*:Enabled:FileTran
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpofxs08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxs08.exe:*:Enabled:hpofxs08.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqfxt08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqfxt08.exe:*:Enabled:hpqfxt08.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\HP Software Update\HPWUCli.exe" = C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe -- (Hewlett-Packard Co.)
"C:\Program Files\Steam\Steam.exe" = C:\Program Files\Steam\Steam.exe:*:Enabled:Steam -- (Valve Corporation)
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_77330\Mplay_Server.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_77330\Mplay_Server.exe:*:Enabled:Mplay_Server
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_85694\Mplay_Client.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_85694\Mplay_Client.exe:*:Enabled:Mplay_Client
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_98922\myMplay_Client.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_98922\myMplay_Client.exe:*:Enabled:myMplay_Client
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_77912\MSL v2 - Master Server List.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_77912\MSL v2 - Master Server List.exe:*:Enabled:MSL v2 - Master Server List
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_85490\MSL v2 - Server.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_85490\MSL v2 - Server.exe:*:Enabled:MSL v2 - Server
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_34947\master.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_34947\master.exe:*:Enabled:master
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_95119\master_list.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_95119\master_list.exe:*:Enabled:master_list
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_16886\best_client.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_16886\best_client.exe:*:Enabled:best_client
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_6308\best_client.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_6308\best_client.exe:*:Enabled:best_client
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_14992\mypong.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_14992\mypong.exe:*:Enabled:mypong
"C:\Program Files\BitComet\BitComet.exe" = C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet.exe -- (www.BitComet.com)
"C:\Program Files\Google\Google Earth\client\googleearth.exe" = C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_49786\File_Transfer.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_49786\File_Transfer.exe:*:Enabled:File_Transfer
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_92895\File_Transfer.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_92895\File_Transfer.exe:*:Enabled:File_Transfer
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_92895\File_Transfer_bin.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_92895\File_Transfer_bin.exe:*:Enabled:File_Transfer_bin
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_79675\File_Transfer_bin.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_79675\File_Transfer_bin.exe:*:Enabled:File_Transfer_bin
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_74016\File_Transfer_bin.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_74016\File_Transfer_bin.exe:*:Enabled:File_Transfer_bin
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_29173\File_Transfer.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_29173\File_Transfer.exe:*:Enabled:File_Transfer
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_34746\File_Transfer.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_34746\File_Transfer.exe:*:Enabled:File_Transfer
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_7204\File_Transfer.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_7204\File_Transfer.exe:*:Enabled:File_Transfer
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_54171\File_Transfer.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_54171\File_Transfer.exe:*:Enabled:File_Transfer
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_54171\File_Transfer_data.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_54171\File_Transfer_data.exe:*:Enabled:File_Transfer_data
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_18699\File_Transfer_data.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_18699\File_Transfer_data.exe:*:Enabled:File_Transfer_data
"C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" = C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe:*:Enabled:Veoh Web Player
"C:\Documents and Settings\David Forrest\Desktop\Games Galore\Tutorials\Tut - Mplay\GM Tutorial - Multiplayer\Examples\pong.exe" = C:\Documents and Settings\David Forrest\Desktop\Games Galore\Tutorials\Tut - Mplay\GM Tutorial - Multiplayer\Examples\pong.exe:*:Enabled:pong -- ()
"C:\Documents and Settings\David Forrest\Desktop\Adrenaline_YYG_2\Adrenaline.exe" = C:\Documents and Settings\David Forrest\Desktop\Adrenaline_YYG_2\Adrenaline.exe:*:Enabled:Adrenaline
"C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe" = C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe:LocalSubNet:Enabled:Belkin Setup -- (Affinegy, Inc.)
"C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_35850\server.exe" = C:\Documents and Settings\David Forrest\Local Settings\Temp\gm_ttt_35850\server.exe:*:Enabled:server
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Program Files\Steam\steamapps\common\left 4 dead\left4dead.exe" = C:\Program Files\Steam\steamapps\common\left 4 dead\left4dead.exe:*:Enabled:Left 4 Dead -- ()
"C:\Program Files\HP\Digital Imaging\{7E0E61CC-1C99-429D-BEA7-C4DD5B898D2A}\setup\hpznui01.exe" = C:\Program Files\HP\Digital Imaging\{7E0E61CC-1C99-429D-BEA7-C4DD5B898D2A}\setup\hpznui01.exe:*:Enabled:hpznui01.exe -- (Hewlett-Packard)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{005F78AF-110D-398A-8430-BE98950A1E22}" = Google Talk Plugin
"{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}" = Adobe Color NA Recommended Settings CS4
"{044F9133-B8D7-4d11-BF39-803FA20F5C8B}" = Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Win32
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{108A39BF-4ED1-4293-B11A-06BD521FB8F7}" = FreeOCR 3.0
"{136A7381-D9A0-453C-B999-B012E09253F1}" = Oracle VM VirtualBox 4.0.6
"{14291118-0C19-45EA-A4FA-5C1C0F5FDE09}" = Primo
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{1B7DCF2E-774A-11E0-9986-0013D3D69929}" = Vegas Pro 10.0
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{2168245A-B5AD-40D8-A641-48E3E070B5B6}" = Adobe Flash CS4 STI-en
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{229B6751-774A-11E0-BCAE-0013D3D69929}" = MSVCRT Redists
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java™ 6 Update 15
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{3248F0A8-6813-11D6-A77B-00B0D0150170}" = J2SE Runtime Environment 5.0 Update 17
"{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}" = CyberLink WaveEditor
"{32A3A4F4-B792-11D6-A78A-00B0D0150170}" = J2SE Development Kit 5.0 Update 17
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{37491A3D-B2A6-402D-898E-5C4EF3984C29}" = Adobe Flash Media Live Encoder 3.1
"{37C39957-B0B3-40DC-8BA4-2363241159ED}" = LightScribe 1.4.44.1
"{3898934B-05AE-41CD-96BE-70DA9BFBCE1F}" = Microsoft XNA Framework Redistributable 3.0
"{3A4D5E2D-988D-4ee9-8E7F-3AC200A2B8F5}" = 4500G510nz_Software_Min
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3A6829EF-0791-4FDD-9382-C690DD0821B9}" = Adobe Flash Player 10 ActiveX
"{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{3F8EB641-6AD2-45DE-A8DD-91D7BDD39CDE}" = Microsoft USB Flash Drive Manager
"{422ACD84-E340-457F-AB4F-F2769B3E2F4D}" = easyC Pro
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{43509E18-076E-40FE-AF38-CA5ED400A5A9}" = Pixel Bender Toolkit
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{440B915A-0C85-45DB-92AE-75AE14704A64}" = Fax
"{459C13B0-DD46-11DF-BFE1-005056C00008}" = MSVCRT Redists
"{48530DE6-19F9-489D-809E-AFAA8AACC6DF}" = SplitMediaLabs VH Screen Capture Driver (x86)
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{548F12A2-BD2E-4B5A-9B62-BBC0AA8EB3DD}" = Everio MediaBrowser HD Edition
"{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}" = Adobe Color EU Extra Settings CS4
"{586D9A3C-FF54-46BD-A4C6-5C70608AFD39}" = ArcSoft VideoImpression 1.6
"{5AE3D9F1-9E9E-4015-8787-E22705AA32C5}" = msxml4
"{5B05FF91-F20C-4832-A8DE-E1912639C17C}" = 4500G510nz
"{5BE1E709-30E4-3D6D-A708-96CE8D5E5E8D}" = Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for .NET Framework - enu
"{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}" = Adobe Dynamiclink Support
"{6151F634-A05E-4E5B-B975-007784703AD2}" = easyC V2 for Vex
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{659B48CD-0608-4ED5-94C0-0B6C87114F10}" = Apple Mobile Device Support
"{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}" = SmartWebPrinting
"{690879A5-18EF-447B-98D6-B699D51008AB}" = 4500_G510nz_Help
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{6F3D2F66-F050-45E3-BEB1-6523FE6D6690}" = MotoHelper MergeModules
"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update
"{70DECFBF-9119-4434-B2D3-A3C283D15E45}" = WeatherBug
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{774088D4-0777-4D78-904D-E435B318F5D2}" = Microsoft Antimalware
"{77A776C4-D10F-416D-88F0-53F2D9DCD9B3}" = Microsoft Security Client
"{793D1D88-6141-43DE-BE58-59BCE31B4090}" = Adobe Flash CS4 Extension - Flash Lite STI en
"{7E0E61CC-1C99-429D-BEA7-C4DD5B898D2A}" = HP Officejet 4500 G510n-z
"{7ff90460-89b7-435b-b583-b37b2815ccc7}" = Python 3.1.1
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{8186E1B9-DDC6-45B6-B9EB-C28947CBC4CF}" = Adobe Flash Player 9 ActiveX
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8F8D9297-FDD2-405A-97E7-E52C7B2F97B3}" = Ulead VideoStudio SE DVD
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90170409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office FrontPage 2003
"{90ED84D5-BF1B-48B3-81CD-A41278E7C5EF}" = easyC Pro
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D0E65B9-B525-43C0-A2C9-5D73D24ADB80}" = Miro Video Converter
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2A60894-E3ED-46FE-9A6A-7CF7A87572A0}" = Opera 9.64
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A3096853-5F1C-464A-B7AE-5FB5137EAEC5}" = ArcSoft PhotoImpression
"{A403D88E-ED7D-48E3-91FD-B8C8A720EDA1}" = Microsoft Speech SDK 5.1
"{A8B94669-8654-4126-BD28-D0D2412CDED6}" = TI Connect 1.6
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB4FDE97-B105-48FE-9F68-03C34430D1AC}" = easyC V2 for Vex
"{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X (10.0.1)
"{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}" = Microsoft Office Live Add-in 1.4
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{B2455727-ED8F-4643-8A6E-F4AB8DE3633D}" = Network
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1" = SUPER © v2011.build.48 (April 23, 2011) version v2011.build.48
"{BB05D173-9681-4812-A7FA-BD4042A3DA00}" = Alky for Applications (Windows XP)
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{C8838D06-D7DB-4CB0-BF13-7191D2D84C42}" = Gadget Extractor
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC5702D7-86E2-45A8-99D7-E8B976ADCC56}" = iTunes
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF77710A-4915-4FC7-AD3F-9F40BDE0E13E}" = RepairSolutions
"{D03A3400-20C0-4B58-AA9C-1B22C3D2850D}" = easyC
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D5B8BDC3-3D44-429C-9AA5-8BA289F45741}_is1" = DAVID-Laserscanner 2.6.3
"{DABF43D9-1104-4764-927B-5BED1274A3B0}" = Runtime
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{DD622B1D-A78E-3FE8-9C8C-246F5764B0D0}" = Microsoft Visual Basic 2008 Express Edition with SP1 - ENU
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}" = Microsoft SQL Server Compact 3.5 SP1 English
"{E5D52570-5EF1-4576-A434-6CCD92268F0F}" = Google SketchUp 7
"{E5FCED12-3E77-4C0E-A305-5AEB38A52A70}" = AdobeColorCommonSetCMYK
"{E6DE9A54-8514-446E-9D11-530DC599C355}" = Microsoft SharedView
"{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = VEX USB-to-Serial
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EED50C97-C79E-4149-BD82-7C5A22437708}" = Adobe Setup
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F5E87B12-3C27-452F-8E78-21D42164FD83}" = Microsoft SQL Server 2008 Management Objects
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F6E99614-F042-4459-82B7-8B38B2601356}" = Adobe Flash CS4
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FC7BACF0-1FFA-4605-B3B4-A66AB382752D}" = XML Notepad 2007
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_a68eec966ce913ddaa63251dc82ed31" = Adobe Flash CS4 Professional
"Audacity_is1" = Audacity 1.2.6
"AVS4YOU Video Converter 7_is1" = AVS Video Converter 7
"Belkin Setup and Router Monitor_is1" = Belkin Setup and Router Monitor
"BitComet" = BitComet 1.25
"Blender" = Blender
"BlueVoda_Website_Builder_1.0" = BlueVoda Website Builder 11 V4
"CamStudio" = CamStudio
"CCleaner" = CCleaner
"Celtx (2.9.1)" = Celtx (2.9.1)
"Dorgem_is1" = Dorgem 2.1.0
"DVDStyler_is1" = DVDStyler v1.8.3
"EarthSculptor_is1" = EarthSculptor 1.05
"FileZilla Server" = FileZilla Server (remove only)
"Game Maker 5.3A" = Game Maker 5.3A
"Game Maker 6.1A" = Game Maker 6.1A
"Game Maker 7.0" = Game Maker 7.0
"Game Maker 8.0" = Game Maker 8.0
"Google Updater" = Google Updater
"HandBrake" = HandBrake 0.9.5
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Smart Web Printing" = HP Smart Web Printing 4.5
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"ImgBurn" = ImgBurn
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"InstallShield_{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}" = CyberLink WaveEditor
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"KaraFun_is1" = KaraFun 1.18
"LHTTSSPE" = L&H TTS3000 Español
"Light Artist_is1" = Light Artist 1.5
"lmms" = LMMS 0.4.10
"LMMS 0.4.6" = Linux MultiMedia Studio (LMMS)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MeshLab" = MeshLab 1.2.0
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Client" = Microsoft Security Essentials
"Microsoft Visual Basic 2008 Express Edition with SP1 - ENU" = Microsoft Visual Basic 2008 Express Edition with SP1 - ENU
"Mozilla Firefox 4.0.1 (x86 en-US)" = Mozilla Firefox 4.0.1 (x86 en-US)
"MSNINST" = MSN
"MSTTS" = Microsoft Text-to-Speech Engine 4.0 (English)
"NeroMultiInstaller!UninstallKey" = Nero Suite
"Neverball" = Neverball 1.5.1
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"OpenLibraries" = OpenLibraries
"PhotoModeler Lite" = PhotoModeler Lite
"Prism" = Prism Video Converter
"rComplex" = rComplex
"RealPlayer 12.0" = RealPlayer
"Search Toolbar" = Search Toolbar
"Speaking Notepad_is1" = Speaking Notepad 3.4
"Steam App 500" = Left 4 Dead
"Switch" = Switch Sound File Converter
"ToolBox" = NCH Toolbox
"tv_enua" = Lernout & Hauspie TruVoice American English TTS Engine
"VH Toolkit_is1" = VH Toolkit 1.0.44.0
"VideoPad" = VideoPad Video Editor
"WavePad" = WavePad Sound Editor
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows Sidebar" = Windows Sidebar
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.6
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"Yahoo! Messenger" = Yahoo! Messenger

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"CodeBlocks" = CodeBlocks
"FileZilla Client" = FileZilla Client 3.3.2.1

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/21/2010 4:03:07 AM | Computer Name = BUFF_PC | Source = Windows Search Service | ID = 3013
Description = The entry <C:\DOCUMENTS AND SETTINGS\DAVID FORREST\RECENT\APPLETPAGE.HTML.LNK>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 12/21/2010 4:03:07 AM | Computer Name = BUFF_PC | Source = Windows Search Service | ID = 3013
Description = The entry <C:\DOCUMENTS AND SETTINGS\DAVID FORREST\RECENT\UPLOAD.LNK>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 12/21/2010 4:03:30 AM | Computer Name = BUFF_PC | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P2 2.1.6805.0, P3 timeout, P4 1.1.6402.0, P5 local, P6 unspecified, P7 unspecified,
P8 NIL, P9 NIL, P10 NIL.

Error - 12/21/2010 4:03:54 AM | Computer Name = BUFF_PC | Source = Windows Search Service | ID = 3013
Description = The entry <C:\DOCUMENTS AND SETTINGS\DAVID FORREST\DESKTOP\GAMES GALORE\PLAYNOW
0021\UPLOAD\PLAYNOWAPP2.JAR> in the hash map cannot be updated. Context: Application,
SystemIndex Catalog Details: A device attached to the system is not functioning.
(0x8007001f)

Error - 12/21/2010 4:04:02 AM | Computer Name = BUFF_PC | Source = Windows Search Service | ID = 3013
Description = The entry <C:\DOCUMENTS AND SETTINGS\DAVID FORREST\MY DOCUMENTS\MY
VIDEOS\VEOH\VEOHE20F72A861154A5887A045E2827EC9DD.VIDEOS-JOURNAL> in the hash map
cannot be updated. Context: Application, SystemIndex Catalog Details: A device attached
to the system is not functioning. (0x8007001f)

Error - 12/22/2010 6:04:48 PM | Computer Name = BUFF_PC | Source = Application Hang | ID = 1002
Description = Hanging application wmplayer.exe, version 11.0.5721.5262, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 12/23/2010 5:18:22 PM | Computer Name = BUFF_PC | Source = Application Hang | ID = 1002
Description = Hanging application wmplayer.exe, version 11.0.5721.5262, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 12/23/2010 5:19:22 PM | Computer Name = BUFF_PC | Source = Application Error | ID = 1000
Description = Faulting application dvdstyler.exe, version 0.0.0.0, faulting module
dvdstyler.exe, version 0.0.0.0, fault address 0x0007a903.

Error - 12/26/2010 3:26:44 AM | Computer Name = BUFF_PC | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P2 2.1.6805.0, P3 timeout, P4 1.1.6402.0, P5 local, P6 unspecified, P7 unspecified,
P8 NIL, P9 NIL, P10 NIL.

Error - 12/27/2010 12:18:58 AM | Computer Name = BUFF_PC | Source = Application Hang | ID = 1002
Description = Hanging application yoyo80.exe, version 8.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

[ OSession Events ]
Error - 4/7/2009 10:46:11 PM | Computer Name = BUFF_PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6331.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 83857
seconds with 8340 seconds of active time. This session ended with a crash.

Error - 5/8/2009 9:47:09 AM | Computer Name = BUFF_PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6331.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 28820
seconds with 360 seconds of active time. This session ended with a crash.

Error - 6/10/2009 6:38:43 PM | Computer Name = BUFF_PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6331.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 29677
seconds with 120 seconds of active time. This session ended with a crash.

Error - 1/2/2010 12:52:48 AM | Computer Name = BUFF_PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 100747
seconds with 180 seconds of active time. This session ended with a crash.

Error - 1/22/2010 7:16:30 AM | Computer Name = BUFF_PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 22535
seconds with 7140 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 5/11/2011 6:00:43 AM | Computer Name = BUFF_PC | Source = Service Control Manager | ID = 7000
Description = The Windows Search service failed to start due to the following error:
%%2

Error - 5/11/2011 11:39:45 PM | Computer Name = BUFF_PC | Source = Service Control Manager | ID = 7000
Description = The Windows Search service failed to start due to the following error:
%%2

Error - 5/11/2011 11:54:38 PM | Computer Name = BUFF_PC | Source = DCOM | ID = 10005
Description = DCOM got error "%2" attempting to start the service WSearch with arguments
"" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error - 5/11/2011 11:54:38 PM | Computer Name = BUFF_PC | Source = DCOM | ID = 10005
Description = DCOM got error "%2" attempting to start the service WSearch with arguments
"" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error - 5/11/2011 11:54:38 PM | Computer Name = BUFF_PC | Source = Service Control Manager | ID = 7000
Description = The Windows Search service failed to start due to the following error:
%%2

Error - 5/11/2011 11:54:38 PM | Computer Name = BUFF_PC | Source = Service Control Manager | ID = 7000
Description = The Windows Search service failed to start due to the following error:
%%2

Error - 5/11/2011 11:54:38 PM | Computer Name = BUFF_PC | Source = DCOM | ID = 10005
Description = DCOM got error "%2" attempting to start the service WSearch with arguments
"" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error - 5/11/2011 11:54:38 PM | Computer Name = BUFF_PC | Source = Service Control Manager | ID = 7000
Description = The Windows Search service failed to start due to the following error:
%%2

Error - 5/11/2011 11:59:38 PM | Computer Name = BUFF_PC | Source = DCOM | ID = 10005
Description = DCOM got error "%2" attempting to start the service WSearch with arguments
"" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error - 5/11/2011 11:59:38 PM | Computer Name = BUFF_PC | Source = Service Control Manager | ID = 7000
Description = The Windows Search service failed to start due to the following error:
%%2


< End of report >

Thanx again for helping.

Hi again RobotiX!!..

Read the entire post before proceeding, because it will make following the instructions easier.

Ok, please do the following:

Firstly,
Go to Start > Control Panel double-click on Add or Remove Programs and uninstall the following:
Search Toolbar - a toolbar hailing from zugo.com, bundled with various third party applications - detected as Adware.Zugo...

Secondly,
Run a script with OTL - please note that I included in the script entries that belong to Toolbar.Facemood and Autocomplete pro, as it looks as these programs/toolbars are no longer installed... If that's not a case, let me know and I'll amend the script...

Please run OTL.exe.

• Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :OTL
  IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=audio&s={searchTerms}&f=4
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.autocompletepro.com/?si=10197&bi=400
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.autocompletepro.com/?si=10197&bi=400
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = http://search.autocompletepro.com/?si=10197&bi=400
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.facemoods.com/?a=audio
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://search.autocompletepro.com/?si=10197&bi=400
  IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = http://search.autocompletepro.com/?si=10197&bi=400
  [2009/08/19 21:59:13 | 000,000,000 | ---D | M] (Ask Chrome Search Engine) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\askopensearch-VTS@ask.com
  O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
  O2 - BHO: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
  O3 - HKLM\..\Toolbar: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
  O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
  O3 - HKCU\..\Toolbar\WebBrowser: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
  O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  Drivers32: vidc.444p - C:\Program Files\t@b\0.958\686\tabdec.dll File not found
  Drivers32: vidc.MP42 - MPG4C32.dll File not found
  Drivers32: vidc.mpng - C:\Program Files\t@b\0.958\686\tabdec.dll File not found
  Drivers32: vidc.mvjp - C:\Program Files\t@b\0.958\686\tabdec.dll File not found
  [2011/05/07 20:18:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\jH28601IpOiO28601
  [2011/05/07 19:54:38 | 000,135,168 | RHS- | C] () -- C:\WINDOWS\System32\avicap32Z.dll
  [2011/05/07 19:54:38 | 000,000,332 | -HS- | C] () -- C:\WINDOWS\tasks\Eyipwdgkh.job
  [2009/08/11 22:06:11 | 000,005,045 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ypkpiykb.yyr
  :Commands
  [EmptyTemp]
  [EMPTYFLASH]
  
  
  
• Return to OTL.exe, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.
  
  
• Click the red Run Fix button.
  
• A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTL.exe

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Thirdly,
After a reboot (fix with OTL), right click this folder: C:\_OTL (it's an OTL backup folder) and choose: "Send to" --> "Compressed (zipped) Folder". Upload that zipped folder to this site --> click on Browse, choose the file, then click Upload. Allow the file to be uploaded - wait till: The file has been uploaded! appears.
Please let me know once you do this. Note: This step has to be done before the scan with ESET.


Finally,
I'd like us to scan your machine with ESET OnlineScan

• Hold down Control and click on this link to open ESET OnlineScan in a new window.
  
• Click the button.
  
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
    
  • Double click on the
    icon on your desktop.
  
  
• Check "YES, I accept the Terms of Use."
  
• Click the Start button.
  
• Accept any security warnings from your browser.
  
• Under scan settings, check "Scan Archives" and "Remove found threats"
  
• Click Advanced settings and select the following:
  • Scan potentially unwanted applications
    
  • Scan for potentially unsafe applications
    
  • Enable Anti-Stealth technology
  
  
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  
• When the scan completes, click List Threats
  
• Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  
• Click the Back button.
  
• Click the Finish button.

Ok,
So I uninstalled the search toolbar by zugo, and ran the otl code (I uploaded the zip but it said that the file was too large so idk if it worked) and it totally worked! No more redirecting, and MSE opened and I immediately ran a scan with it, which was good because it found a destroyed the newest annoyance on my computer: a fake Microsoft antivirus that blocked all web pages, under the name of ohm.exe. Then I ran the eset scanner and all it found was the otl stuff.

Here is the Eset log:

C:\_OTL.zip multiple threats deleted - quarantined
C:\_OTL\MovedFiles\05152011_164041\C_Program Files\Search Toolbar\SearchToolbar.dll Win32/Toolbar.Zugo application cleaned by deleting - quarantined
C:\_OTL\MovedFiles\05152011_164041\C_WINDOWS\system32\avicap32Z.dll a variant of Win32/Kryptik.LXF trojan cleaned by deleting - quarantined

There is just one problem still. MSE is having a hard time updating the virus definitions... I think. It starts downloading then a notification pops up and it says that it was unable to update but on the MSE screen it says that the update worked... so I don't know, I might want to try reinstalling it.

Thank you so much for all the great help!

This post has been edited by RobotiX: 16 May 2011 - 12:31 AM

Hi again RobotiX!!..

Thanks for the upload!.. A detection for this variant will be added to MBAM...

RobotiX, on 16 May 2011 - 12:27 AM, said:

Does it simply say it could not update or gives a specific error code??.. And yes, if after a reboot the situation persists, try reinstalling the software...

Firstly,
Run a scan with OTL.exe, only OTL.txt logfile will be generated - post it in your next reply...

Secondly,
We need to update outdated programs (with security vulnerabilities) on your machine:

- Java

Go to Start > Control Panel double-click on Add or Remove Programs and remove:
Java™ 6 Update 15
J2SE Runtime Environment 5.0 Update 17
J2SE Development Kit 5.0 Update 17

Then,

• Download the latest version of Java Runtime Environment (JRE) 6.
  
• Scroll down to where it says Java Platform, Standard Edition / "Java SE 6 Update 25".
  
• Click the "Download JRE" button to the right.
  
• In the Window that opens, check the box that says: "Accept License Agreement".
• Click on the link: jre-6u25-windows-i586.exe to download an offline installer for Windows x86. Save the file to your Desktop.
  
• Close any programs you may have running - especially your web browser.
  
• Then from your Desktop double-click on the file that you've downloaded to install the newest version.

- Adobe Flash Player:

To make sure you have the latest version of Adobe Flash Player installed:
1. To uninstall an older version, download this file to your Desktop: uninstall_flash_player.exe
2. Quit ALL running applications, including all Internet Explorer or other browser windows, and messenger applications (like AOL Instant Messenger, Yahoo Messenger, MSN Messenger.
3. Double-click on the file you've downloaded to uninstall Flash.
4. If uninstalled successfully, go to this site: Install Adobe Flash Player, and choose Agree and install now. This will install the newest version of Flash for your browser (note: Flash plugins for IE and Firefox must be installed separately).
Note: I recommend you uncheck an optional install (Free McAfee Security Scan or Free Google Toolbar).

- Opera - you do have an old version installed (9.64), I recommend you either uninstall this browser (if you do not use it) or upgrade to the newest version (11.10): Opera browser

- Skype - I recommend you upgrade to the newest version of skype: Skype 5.3


Let me know if all updates went well...

Ok I did all that. And I uninstalled MSE and then reinstalled it (after like 3 tries, it kept saying that a file was corrupt, but after i redownloaded it and tried it twice, it installed) Then I got the error again when it tried to update, but I pressed update again and it downloaded the new definitions. But if i try to hit update again it will give me the error. Weird. Below are two scrrenshots of the error. The first one is the pop up and the second one is what it says afterwards (that it had indeed updated, note the time in the bottom right corner.)

Pop up:


Verification screen (note the time):


OTL log:
OTL logfile created on: 5/17/2011 8:33:54 PM - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\David Forrest\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 64.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 696.05 Gb Total Space | 437.81 Gb Free Space | 62.90% Space Free | Partition Type: NTFS

Computer Name: BUFF_PC | User Name: David Forrest | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/05/13 18:18:28 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\David Forrest\Desktop\OTL.exe
PRC - [2011/04/14 09:25:41 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/11/30 13:20:36 | 000,997,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2010/11/11 12:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2010/07/28 18:34:02 | 000,569,752 | ---- | M] (Affinegy, Inc.) -- C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe
PRC - [2010/07/28 18:33:58 | 006,995,864 | ---- | M] (Affinegy, Inc.) -- C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe
PRC - [2010/07/28 18:33:58 | 001,485,208 | ---- | M] (Affinegy, Inc.) -- C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe
PRC - [2009/03/03 03:19:28 | 000,691,200 | ---- | M] (FileZilla Project) -- C:\Program Files\FileZilla Server\FileZilla server.exe
PRC - [2009/02/20 12:22:34 | 004,363,504 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
PRC - [2009/01/30 10:34:44 | 001,347,584 | ---- | M] (AWS Convergence Technologies, Inc.) -- C:\Program Files\AWS\WeatherBug\Weather.exe
PRC - [2008/04/14 09:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/09/28 02:20:00 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
PRC - [2006/05/23 23:49:14 | 000,024,576 | ---- | M] (Syntek America Inc.) -- C:\WINDOWS\system32\StkASv2K.exe


========== Modules (SafeList) ==========

MOD - [2011/05/13 18:18:28 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\David Forrest\Desktop\OTL.exe
MOD - [2010/08/23 09:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- -- (getPlusHelper) getPlus®
SRV - [2010/11/11 12:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2010/07/28 18:34:02 | 000,569,752 | ---- | M] (Affinegy, Inc.) [Auto | Running] -- C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe -- (AffinegyService)
SRV - [2009/03/27 23:55:42 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009/03/03 03:19:28 | 000,691,200 | ---- | M] (FileZilla Project) [Auto | Running] -- C:\Program Files\FileZilla Server\FileZilla Server.exe -- (FileZilla Server)
SRV - [2006/09/28 02:20:00 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)
SRV - [2006/05/23 23:49:14 | 000,024,576 | ---- | M] (Syntek America Inc.) [Auto | Running] -- C:\WINDOWS\system32\StkASv2K.exe -- (StkASSrv)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | System | Running] -- -- (MpKsle3eace94)
DRV - [2011/05/17 20:27:52 | 000,028,752 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A074D545-FA7E-4688-A087-6453F60D141F}\MpKslf8ba0abd.sys -- (MpKslf8ba0abd)
DRV - [2011/04/26 15:10:34 | 000,122,224 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VBoxNetFlt.sys -- (VBoxNetFlt)
DRV - [2011/04/26 15:10:34 | 000,111,280 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV - [2011/04/26 15:10:34 | 000,044,784 | ---- | M] (Oracle Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\VBoxUSBMon.sys -- (VBoxUSBMon)
DRV - [2011/04/26 15:10:32 | 000,162,544 | ---- | M] (Oracle Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\VBoxDrv.sys -- (VBoxDrv)
DRV - [2010/08/05 14:08:02 | 000,031,824 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VBoxUSB.sys -- (VBoxUSB)
DRV - [2010/06/23 19:12:50 | 000,027,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AFGSp50.sys -- (AFGSp50)
DRV - [2009/12/13 04:21:40 | 000,002,560 | ---- | M] (SupportSoft Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ssrangdr.sys -- (ssrangdr)
DRV - [2009/10/22 13:54:18 | 000,037,392 | ---- | M] (Kaspersky Lab) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\93425302.sys -- (93425302)
DRV - [2009/10/22 13:54:18 | 000,037,392 | ---- | M] (Kaspersky Lab) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\02141412.sys -- (02141412)
DRV - [2009/10/09 23:31:10 | 000,315,408 | ---- | M] (Kaspersky Lab) [File_System | System | Stopped] -- C:\WINDOWS\system32\drivers\0214141.sys -- (setup_9.0.0.722_08.05.2011_07-40drv)
DRV - [2009/10/09 23:31:10 | 000,315,408 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\9342530.sys -- (kaspersky_setupdrv)
DRV - [2009/09/25 17:59:42 | 000,128,016 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\93425301.sys -- (93425301)
DRV - [2009/09/25 17:59:42 | 000,128,016 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\02141411.sys -- (02141411)
DRV - [2009/04/04 13:43:16 | 000,025,280 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hamachi.sys -- (hamachi)
DRV - [2008/08/21 16:23:44 | 000,008,832 | ---- | M] (QUALCOMM Incorporated.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\misalign.sys -- (misalign)
DRV - [2008/08/01 15:36:00 | 000,054,784 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2008/08/01 15:36:00 | 000,022,016 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2008/05/08 21:23:22 | 000,238,080 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV - [2008/05/01 08:11:45 | 000,049,536 | R--- | M] (Texas Instruments Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tiehdusb.sys -- (TIEHDUSB)
DRV - [2008/02/14 14:12:00 | 001,389,056 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\monfilt.sys -- (monfilt)
DRV - [2007/06/27 06:05:52 | 000,053,184 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ftdibus.sys -- (FTDIBUS)
DRV - [2007/06/27 06:04:14 | 000,071,488 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ftser2k.sys -- (FTSER2K)
DRV - [2006/12/03 23:09:32 | 000,124,416 | ---- | M] (e2eSoft) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\StudioPro.sys -- (StudioPro)
DRV - [2006/09/26 20:01:36 | 000,241,628 | R--- | M] (Syntek America Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\StkAMini.sys -- (StkAMini)
DRV - [2006/08/01 23:44:04 | 000,004,772 | R--- | M] (Syntek America Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\StkScan.sys -- (StkScan)
DRV - [2005/06/23 13:56:26 | 000,048,384 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2004/08/12 08:00:00 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = localhost:80

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: messagestyle-blackened@addons.instantbird.org:0.9
FF - prefs.js..extensions.enabledItems: default-palette@celtx.com:1.0
FF - prefs.js..extensions.enabledItems: messagestyle-depth@addons.instantbird.org:1.1
FF - prefs.js..extensions.enabledItems: inspector@mozilla.org:2.0.0
FF - prefs.js..extensions.enabledItems: messagestyle-minimal20@addons.instantbird.org:1.5
FF - prefs.js..extensions.enabledItems: emoticons-msn-smileys@m513901.de:0.1
FF - prefs.js..extensions.enabledItems: calendar-timezones@mozilla.org:0.1.2008d

FF - HKLM\software\mozilla\Firefox\extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/08/19 23:02:17 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/05 20:33:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/17 20:18:00 | 000,000,000 | ---D | M]

[2010/09/12 21:41:35 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Extensions
[2010/09/12 21:41:35 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Extensions\celtx@celtx.com
[2011/05/15 16:40:44 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions
[2010/04/27 21:46:35 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/01 19:21:42 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\{43c35458-c907-439b-bcfd-07d373834689}
[2010/02/10 18:33:53 | 000,000,000 | ---D | M] (Ad blocker) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3612C}
[2011/05/06 17:01:19 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/03/25 00:10:46 | 000,000,000 | ---D | M] (BitComet Video Downloader) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}
[2011/03/25 00:10:47 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}-trash
[2009/03/06 21:49:38 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus®)) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}
[2011/05/11 12:49:01 | 000,000,000 | ---D | M] (Diccionario de Español/España) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\es-es@dictionaries.addons.mozilla.org
[2011/05/05 20:35:14 | 000,000,000 | ---D | M] (FDislike) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\fbdislike@doweb.fr
[2011/05/05 20:34:32 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\nostmp
[2011/05/06 17:01:17 | 000,000,000 | ---D | M] (Maximum AdBlock) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\ozymandias@securityheroes.com
[2011/03/14 19:26:36 | 000,000,000 | ---D | M] (Personas) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\personas@christopher.beard
[2010/01/27 02:07:53 | 000,000,000 | ---D | M] (Game Maker Community Extension) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\Revel@gmcextension.gmhut.com
[2010/09/03 17:48:12 | 000,000,000 | ---D | M] ("YoYo Games InstantPlay") -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\yyginstantplay@yoyogames.com
[2010/01/27 02:07:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\Revel@gmcextension.gmhut.com\chrome
[2010/01/27 02:07:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\Revel@gmcextension.gmhut.com\defaults
[2010/01/27 02:07:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\Revel@gmcextension.gmhut.com\locale
[2010/01/27 02:07:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David Forrest\Application Data\Mozilla\Firefox\Profiles\8udanxiv.default\extensions\Revel@gmcextension.gmhut.com\skin
[2011/05/17 20:18:01 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/05/17 20:18:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
[2010/08/19 15:08:11 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\browserhighlighter@ebay.com
[2011/04/28 23:49:17 | 000,000,000 | ---D | M] (Timezone Definitions for Mozilla Calendar) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\CALENDAR-TIMEZONES@MOZILLA.ORG
[2011/04/28 23:49:17 | 000,000,000 | ---D | M] (Default Shot Palette) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\DEFAULT-PALETTE@CELTX.COM
[2011/04/28 23:49:17 | 000,000,000 | ---D | M] (MSN-Smileys) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\EMOTICONS-MSN-SMILEYS@M513901.DE
[2011/04/28 23:49:17 | 000,000,000 | ---D | M] (DOM Inspector) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\INSPECTOR@MOZILLA.ORG
[2011/04/28 23:49:17 | 000,000,000 | ---D | M] (Blackened) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\MESSAGESTYLE-BLACKENED@ADDONS.INSTANTBIRD.ORG
[2011/04/28 23:49:17 | 000,000,000 | ---D | M] (Depth) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\MESSAGESTYLE-DEPTH@ADDONS.INSTANTBIRD.ORG
[2011/04/28 23:49:17 | 000,000,000 | ---D | M] (Minimal) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\MESSAGESTYLE-MINIMAL20@ADDONS.INSTANTBIRD.ORG
[2011/04/14 09:26:02 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/08/24 02:31:30 | 000,773,120 | ---- | M] (BitComet) -- C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2007/09/23 15:41:20 | 000,404,992 | ---- | M] (PLATINUM technology, inc.) -- C:\Program Files\Mozilla Firefox\plugins\npcosmop211.dll
[2011/05/17 20:17:50 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2008/01/30 12:48:38 | 000,074,280 | ---- | M] ( ) -- C:\Program Files\Mozilla Firefox\plugins\npsharedview.dll
[2010/12/22 14:18:27 | 000,003,189 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\acpro.xml
[2010/01/01 01:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010/11/22 09:33:08 | 000,002,037 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrchaudio.xml

O1 HOSTS File: ([2006/02/28 05:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.4.12.6.dll (BitComet)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [InstaLAN] C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe (Affinegy, Inc.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe (AWS Convergence Technologies, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowLegacyWebView = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowUnhashedWebView = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &D&ownload &with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D&ownload all with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.4.12.6.dll (BitComet)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1263871860703 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1263871854484 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\HmelyoffLabs\VHToolkit\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/10/22 17:55:27 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{fe77adaf-1e4c-11e0-81bb-00248c00f37d}\Shell - "" = AutoRun
O33 - MountPoints2\{fe77adaf-1e4c-11e0-81bb-00248c00f37d}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fe77adaf-1e4c-11e0-81bb-00248c00f37d}\Shell\AutoRun\command - "" = I:\setup.exe -a
O33 - MountPoints2\I\Shell - "" = AutoRun
O33 - MountPoints2\I\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\LaunchU3.exe -a
O33 - MountPoints2\Z\Shell - "" = AutoRun
O33 - MountPoints2\Z\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\Z\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKCU\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/05/17 20:35:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Local Settings\Application Data\AskToolbar
[2011/05/17 20:35:14 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
[2011/05/17 20:34:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\WebcamMax
[2011/05/17 20:34:44 | 000,000,000 | ---D | C] -- C:\Program Files\WebcamMax
[2011/05/17 20:27:43 | 000,000,000 | ---D | C] -- C:\f2c2821ea6d5ea6c14888a
[2011/05/17 20:25:43 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2011/05/17 20:18:40 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/05/17 20:18:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2011/05/17 20:18:08 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2011/05/17 20:18:00 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2011/05/17 20:18:00 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2011/05/17 20:18:00 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2011/05/17 20:18:00 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2011/05/17 20:18:00 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2011/05/17 19:12:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Desktop\Shooting_Tutorial GM 7
[2011/05/16 23:14:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Desktop\Prom
[2011/05/16 21:17:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Desktop\Comp Scied
[2011/05/15 19:21:50 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2011/05/15 19:18:41 | 002,322,184 | ---- | C] (ESET) -- C:\Documents and Settings\David Forrest\Desktop\esetsmartinstaller_enu.exe
[2011/05/15 16:40:41 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/05/13 18:18:27 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\David Forrest\Desktop\OTL.exe
[2011/05/13 01:30:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\Shared Documents
[2011/05/11 20:38:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows PowerShell 1.0
[2011/05/11 20:38:02 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\windowspowershell
[2011/05/08 00:15:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Hmelyoff Labs
[2011/05/08 00:05:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SplitMediaLabs
[2011/05/08 00:05:07 | 000,000,000 | ---D | C] -- C:\Program Files\SplitMediaLabs
[2011/05/07 22:48:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\DAVID-Laserscanner
[2011/05/07 22:48:19 | 000,000,000 | ---D | C] -- C:\Program Files\DAVID-Laserscanner
[2011/05/07 22:21:17 | 000,315,408 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\0214141.sys
[2011/05/07 22:21:17 | 000,128,016 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\02141411.sys
[2011/05/07 22:21:17 | 000,037,392 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\02141412.sys
[2011/05/07 22:21:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Desktop\Virus Removal Tool
[2011/05/07 21:52:55 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\David Forrest\Recent
[2011/05/07 21:38:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Desktop\gmer
[2011/05/07 20:18:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\jH28601IpOiO28601
[2011/05/07 20:11:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Desktop\David_Laserscanner_2_4_3
[2011/05/07 12:56:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Desktop\grapnel_v1.4
[2011/05/06 23:33:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Sony
[2011/05/06 23:33:36 | 000,000,000 | ---D | C] -- C:\Program Files\Sony
[2011/05/06 23:33:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sony
[2011/05/06 17:01:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Application Data\SecurityHeroes
[2011/05/05 20:47:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Local Settings\Application Data\Miro
[2011/05/05 20:46:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Start Menu\Programs\Miro
[2011/05/05 20:46:15 | 000,000,000 | ---D | C] -- C:\Program Files\Participatory Culture Foundation
[2011/05/04 23:13:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Start Menu\Programs\rComplex
[2011/05/04 23:12:22 | 000,000,000 | ---D | C] -- C:\Program Files\rComplex
[2011/05/01 21:14:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\BlueVoda Website Builder
[2011/05/01 15:44:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\VirtualBox VMs
[2011/05/01 15:30:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Oracle VM VirtualBox
[2011/05/01 14:56:10 | 000,216,064 | RHS- | C] (MONOGRAM Multimedia, s.r.o.) -- C:\WINDOWS\System32\nbDX.dll
[2011/05/01 14:56:10 | 000,031,232 | RHS- | C] (Hans Mayerl) -- C:\WINDOWS\System32\msfDX.dll
[2011/05/01 14:56:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SUPER © - by eRightSoft
[2011/05/01 14:56:05 | 000,186,880 | RHS- | C] (RadLight) -- C:\WINDOWS\System32\RLOgg.ax
[2011/05/01 14:56:05 | 000,092,672 | RHS- | C] (RadLight) -- C:\WINDOWS\System32\RLVorbisDec.ax
[2011/05/01 14:56:05 | 000,090,112 | RHS- | C] (-) -- C:\WINDOWS\System32\TTADSSplitter.ax
[2011/05/01 14:56:05 | 000,090,112 | RHS- | C] (-) -- C:\WINDOWS\System32\TTADSDecoder.ax
[2011/05/01 14:56:05 | 000,067,584 | RHS- | C] (RadLight, LLC) -- C:\WINDOWS\System32\RLTheoraDec.ax
[2011/05/01 14:55:28 | 000,123,904 | RHS- | C] (CoreCodec) -- C:\WINDOWS\System32\AVCDX.ax
[2011/04/30 22:24:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Blender Foundation
[2011/04/29 13:06:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David Forrest\Desktop\Spring Break
[2011/04/28 23:50:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\DVDStyler
[2011/04/28 23:50:03 | 000,000,000 | ---D | C] -- C:\Program Files\DVDStyler
[2011/04/28 23:49:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Celtx
[2011/04/28 23:49:16 | 000,000,000 | ---D | C] -- C:\Program Files\Celtx
[2011/04/26 15:56:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Speaking Notepad
[2011/04/26 15:56:38 | 000,000,000 | ---D | C] -- C:\Program Files\Speaking Notepad
[2011/04/26 15:10:34 | 000,122,224 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\drivers\VBoxNetFlt.sys
[2011/04/26 15:10:32 | 000,135,472 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\VBoxNetFltNotify.dll
[2011/04/20 01:39:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\EarthSculptor
[2011/04/20 01:39:03 | 000,000,000 | ---D | C] -- C:\Program Files\EarthSculptor
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\David Forrest\My Documents\*.tmp files -> C:\Documents and Settings\David Forrest\My Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/17 20:37:00 | 000,000,434 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{2AAE5D93-28BF-47D6-AA76-E938912D7580}.job
[2011/05/17 20:35:25 | 000,000,250 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/05/17 20:34:55 | 000,000,694 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\WebcamMax.lnk
[2011/05/17 20:31:01 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/05/17 20:31:00 | 000,000,390 | -H-- | M] () -- C:\WINDOWS\tasks\MpIdleTask.job
[2011/05/17 20:26:07 | 000,001,945 | ---- | M] () -- C:\WINDOWS\epplauncher.mif
[2011/05/17 20:25:39 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/05/17 20:20:54 | 003,072,054 | ---- | M] () -- C:\Documents and Settings\David Forrest\Desktop\error2.bmp
[2011/05/17 20:20:45 | 003,072,054 | ---- | M] () -- C:\Documents and Settings\David Forrest\Desktop\error.bmp
[2011/05/17 20:18:40 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/05/17 20:17:49 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2011/05/17 20:17:49 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2011/05/17 20:17:48 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2011/05/17 20:17:48 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2011/05/17 20:17:48 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2011/05/17 20:12:56 | 000,005,141 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\Global.sw2
[2011/05/17 19:52:00 | 000,000,982 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-420793594-3175798489-343474573-1005UA.job
[2011/05/17 19:41:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/05/17 19:02:18 | 000,071,609 | ---- | M] () -- C:\Documents and Settings\David Forrest\Desktop\Line_shape_example.gm6
[2011/05/17 18:46:20 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2011/05/17 12:41:00 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/05/17 00:52:00 | 000,000,930 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-420793594-3175798489-343474573-1005Core.job
[2011/05/16 23:18:45 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011/05/16 22:45:14 | 000,098,816 | ---- | M] () -- C:\Documents and Settings\David Forrest\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/16 21:31:54 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/05/15 19:18:48 | 002,322,184 | ---- | M] (ESET) -- C:\Documents and Settings\David Forrest\Desktop\esetsmartinstaller_enu.exe
[2011/05/15 16:45:38 | 000,016,198 | -HS- | M] () -- C:\Documents and Settings\David Forrest\Local Settings\Application Data\2i873h68bh1v04b31ta2hhc25
[2011/05/15 16:45:38 | 000,016,198 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\2i873h68bh1v04b31ta2hhc25
[2011/05/13 18:18:28 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\David Forrest\Desktop\OTL.exe
[2011/05/13 15:16:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/05/12 23:01:03 | 000,000,294 | ---- | M] () -- C:\WINDOWS\tasks\switchDowngrade.job
[2011/05/12 23:01:01 | 000,000,296 | ---- | M] () -- C:\WINDOWS\tasks\videopadDowngrade.job
[2011/05/12 15:20:59 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/12 15:09:31 | 000,471,610 | ---- | M] () -- C:\Documents and Settings\David Forrest\Desktop\RogueKiller.exe
[2011/05/11 21:03:09 | 000,001,787 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
[2011/05/11 20:28:05 | 004,346,086 | ---- | M] () -- C:\Documents and Settings\David Forrest\Desktop\ComboFix.exe
[2011/05/10 15:40:12 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\David Forrest\.1
[2011/05/07 21:23:39 | 000,625,664 | ---- | M] () -- C:\Documents and Settings\David Forrest\Desktop\dds.scr
[2011/05/06 23:33:58 | 000,000,805 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Vegas Pro 10.0.lnk
[2011/05/06 17:43:39 | 000,221,973 | ---- | M] () -- C:\Documents and Settings\David Forrest\My Documents\PDR.dmp
[2011/05/05 20:33:59 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\David Forrest\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/05/05 15:22:49 | 000,000,074 | ---- | M] () -- C:\Documents and Settings\David Forrest\default.pls
[2011/05/04 22:59:00 | 000,000,294 | ---- | M] () -- C:\WINDOWS\tasks\switchShakeIcon.job
[2011/05/04 17:34:40 | 000,233,832 | ---- | M] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2011/05/04 17:34:40 | 000,233,832 | ---- | M] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2011/05/04 17:34:40 | 000,000,001 | ---- | M] () -- C:\WINDOWS\System32\nvdrssel.bin
[2011/05/01 21:14:57 | 000,001,692 | ---- | M] () -- C:\Documents and Settings\David Forrest\Desktop\BlueVoda Website Builder.lnk
[2011/05/01 21:14:04 | 000,737,280 | ---- | M] (Indigo Rose Corporation) -- C:\WINDOWS\iun6002.exe
[2011/05/01 19:34:24 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/05/01 15:30:47 | 000,000,801 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Oracle VM VirtualBox.lnk
[2011/05/01 14:56:12 | 000,000,761 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SUPER ©.lnk
[2011/05/01 14:52:17 | 000,000,298 | ---- | M] () -- C:\WINDOWS\tasks\wavepadShakeIcon.job
[2011/05/01 14:49:47 | 000,002,043 | ---- | M] () -- C:\Documents and Settings\David Forrest\.lmmsrc.xml
[2011/04/30 22:24:36 | 000,001,745 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Blender.lnk
[2011/04/29 13:14:37 | 000,000,210 | RHS- | M] () -- C:\boot.ini
[2011/04/28 23:50:08 | 000,000,762 | ---- | M] () -- C:\Documents and Settings\David Forrest\Desktop\DVDStyler.lnk
[2011/04/28 23:49:19 | 000,001,510 | ---- | M] () -- C:\Documents and Settings\David Forrest\Application Data\Microsoft\Internet Explorer\Quick Launch\Celtx.lnk
[2011/04/28 23:49:19 | 000,001,492 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Celtx.lnk
[2011/04/28 22:59:43 | 000,000,296 | ---- | M] () -- C:\WINDOWS\tasks\videopadShakeIcon.job
[2011/04/26 15:10:34 | 000,122,224 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\drivers\VBoxNetFlt.sys
[2011/04/26 15:10:34 | 000,111,280 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\drivers\VBoxNetAdp.sys
[2011/04/26 15:10:34 | 000,044,784 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\drivers\VBoxUSBMon.sys
[2011/04/26 15:10:32 | 000,162,544 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\drivers\VBoxDrv.sys
[2011/04/26 15:10:32 | 000,135,472 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\VBoxNetFltNotify.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\David Forrest\My Documents\*.tmp files -> C:\Documents and Settings\David Forrest\My Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/17 20:35:25 | 000,000,250 | ---- | C] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/05/17 20:34:55 | 000,000,694 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\WebcamMax.lnk
[2011/05/17 20:31:01 | 000,000,424 | -H-- | C] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/05/17 20:30:59 | 000,000,390 | -H-- | C] () -- C:\WINDOWS\tasks\MpIdleTask.job
[2011/05/17 20:25:48 | 000,001,680 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Security Essentials.lnk
[2011/05/17 20:20:53 | 003,072,054 | ---- | C] () -- C:\Documents and Settings\David Forrest\Desktop\error2.bmp
[2011/05/17 20:20:44 | 003,072,054 | ---- | C] () -- C:\Documents and Settings\David Forrest\Desktop\error.bmp
[2011/05/17 19:02:18 | 000,071,609 | ---- | C] () -- C:\Documents and Settings\David Forrest\Desktop\Line_shape_example.gm6
[2011/05/14 10:35:38 | 000,016,198 | -HS- | C] () -- C:\Documents and Settings\David Forrest\Local Settings\Application Data\2i873h68bh1v04b31ta2hhc25
[2011/05/14 10:35:38 | 000,016,198 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\2i873h68bh1v04b31ta2hhc25
[2011/05/12 15:20:59 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/12 15:09:30 | 000,471,610 | ---- | C] () -- C:\Documents and Settings\David Forrest\Desktop\RogueKiller.exe
[2011/05/11 20:27:53 | 004,346,086 | ---- | C] () -- C:\Documents and Settings\David Forrest\Desktop\ComboFix.exe
[2011/05/10 15:40:12 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\David Forrest\.1
[2011/05/07 21:23:36 | 000,625,664 | ---- | C] () -- C:\Documents and Settings\David Forrest\Desktop\dds.scr
[2011/05/06 23:33:58 | 000,000,805 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Vegas Pro 10.0.lnk
[2011/05/05 20:33:59 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/05/01 21:14:57 | 000,001,692 | ---- | C] () -- C:\Documents and Settings\David Forrest\Desktop\BlueVoda Website Builder.lnk
[2011/05/01 19:34:24 | 000,001,804 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2011/05/01 19:34:24 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/05/01 15:30:47 | 000,000,801 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Oracle VM VirtualBox.lnk
[2011/05/01 14:56:12 | 000,000,761 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SUPER ©.lnk
[2011/05/01 14:56:05 | 000,107,520 | RHS- | C] () -- C:\WINDOWS\System32\RLMPCDec.ax
[2011/05/01 14:56:05 | 000,070,656 | RHS- | C] () -- C:\WINDOWS\System32\RLAPEDec.ax
[2011/05/01 14:56:05 | 000,051,712 | RHS- | C] () -- C:\WINDOWS\System32\RLSpeexDec.ax
[2011/05/01 14:56:00 | 000,120,832 | RHS- | C] () -- C:\WINDOWS\System32\MPCDx.ax
[2011/05/01 14:55:49 | 000,097,280 | RHS- | C] () -- C:\WINDOWS\System32\FLACDX.ax
[2011/05/01 14:55:28 | 000,175,104 | RHS- | C] () -- C:\WINDOWS\System32\CoreAAC.ax
[2011/05/01 14:55:27 | 000,227,328 | RHS- | C] () -- C:\WINDOWS\System32\ac3DX.ax
[2011/05/01 14:55:27 | 000,081,920 | RHS- | C] () -- C:\WINDOWS\System32\aac_parser.ax
[2011/05/01 14:52:16 | 000,000,298 | ---- | C] () -- C:\WINDOWS\tasks\wavepadShakeIcon.job
[2011/04/30 22:24:36 | 000,001,745 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Blender.lnk
[2011/04/28 23:50:08 | 000,000,762 | ---- | C] () -- C:\Documents and Settings\David Forrest\Desktop\DVDStyler.lnk
[2011/04/28 23:49:19 | 000,001,510 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\Microsoft\Internet Explorer\Quick Launch\Celtx.lnk
[2011/04/28 23:49:19 | 000,001,492 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Celtx.lnk
[2011/04/28 22:59:21 | 000,000,294 | ---- | C] () -- C:\WINDOWS\tasks\switchDowngrade.job
[2011/03/18 01:44:22 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\d6f2e38b
[2011/03/18 01:44:21 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\660cc00d
[2011/03/18 01:44:11 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\a8710bec
[2011/03/18 01:44:08 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\c5709935
[2011/03/18 01:44:03 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\bbec604a
[2011/03/18 01:44:03 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\bbaf9130
[2011/03/18 01:44:00 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\4d656f75
[2011/03/18 01:44:00 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\4d127ea3
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\86d40099
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\8698f2d2
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\860c9948
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\85d21749
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\859db37f
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\852af8cb
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\84ed778a
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\8041c91d
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\7e1527b9
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\7de414ee
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\7da22d81
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\7d3f1e0a
[2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\7c7a5b84
[2011/03/18 01:43:27 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\ceda8b7e
[2011/03/18 01:43:27 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\ce94dc19
[2011/03/18 01:43:25 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\79c615aa
[2011/03/18 01:43:25 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\79781fc9
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\c157bd28
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\c1157cba
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\c09a8b4c
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\be183617
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\bde96f9c
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\bd553205
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\bd19ac03
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\b744724c
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\b3f02c08
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\b3c0ac6c
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\b378b056
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\b33cf5fa
[2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\b21ef689
[2011/02/11 20:38:51 | 000,962,560 | ---- | C] () -- C:\WINDOWS\tesseract.exe
[2011/01/19 16:35:54 | 000,000,038 | -HS- | C] () -- C:\WINDOWS\camcodec100.ini
[2011/01/19 16:35:54 | 000,000,028 | -HS- | C] () -- C:\WINDOWS\lagarith.ini
[2010/09/09 13:08:46 | 000,233,832 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2010/09/09 13:08:44 | 000,233,832 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2010/09/09 13:08:44 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2010/09/09 13:08:05 | 002,195,030 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin
[2010/08/23 14:09:27 | 000,207,282 | ---- | C] () -- C:\WINDOWS\hpwins28.dat
[2010/08/23 14:09:27 | 000,000,418 | ---- | C] () -- C:\WINDOWS\hpwmdl28.dat
[2010/08/19 22:53:42 | 000,207,226 | ---- | C] () -- C:\WINDOWS\hpwins28.dat.temp
[2010/08/19 22:53:42 | 000,000,418 | ---- | C] () -- C:\WINDOWS\hpwmdl28.dat.temp
[2010/05/28 23:14:09 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/04/06 13:31:32 | 000,001,019 | ---- | C] () -- C:\Program Files\Nero PhotoSnap Viewer.lnk
[2010/03/15 18:34:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\UVMapper.INI
[2010/02/12 23:54:58 | 000,018,944 | ---- | C] () -- C:\WINDOWS\System32\xrxscnui.dll
[2010/02/12 23:52:29 | 000,000,872 | ---- | C] () -- C:\WINDOWS\wnsetup.ini
[2010/02/12 23:51:39 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\MSVCRT10.DLL
[2010/02/12 23:51:15 | 000,000,032 | ---- | C] () -- C:\WINDOWS\KPCMS.INI
[2009/09/23 18:58:33 | 000,001,492 | ---- | C] () -- C:\WINDOWS\netdet.ini
[2009/09/03 20:13:31 | 000,000,008 | ---- | C] () -- C:\Documents and Settings\David Forrest\Local Settings\Application Data\.mpid
[2009/08/30 14:07:54 | 000,000,854 | ---- | C] () -- C:\WINDOWS\blocks.dat
[2009/08/22 20:20:41 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2009/08/12 00:57:59 | 000,502,784 | ---- | C] () -- C:\WINDOWS\x2.64.exe
[2009/08/12 00:57:59 | 000,240,128 | ---- | C] () -- C:\WINDOWS\System32\x.264.exe
[2009/08/12 00:57:59 | 000,217,073 | ---- | C] () -- C:\WINDOWS\meta4.exe
[2009/08/12 00:57:59 | 000,066,560 | ---- | C] () -- C:\WINDOWS\MOTA113.exe
[2009/08/10 10:50:59 | 000,000,110 | ---- | C] () -- C:\WINDOWS\GSdx9.INI
[2009/08/10 10:45:41 | 001,584,149 | ---- | C] () -- C:\WINDOWS\System32\setupapinew.dll
[2009/08/10 10:45:41 | 000,874,502 | ---- | C] () -- C:\WINDOWS\System32\kernel32new.dll
[2009/08/10 10:45:41 | 000,789,525 | ---- | C] () -- C:\WINDOWS\System32\rpcrt4new.dll
[2009/08/10 10:45:41 | 000,681,478 | ---- | C] () -- C:\WINDOWS\System32\msvcrtnew.dll
[2009/08/10 10:45:41 | 000,633,871 | ---- | C] () -- C:\WINDOWS\System32\user32new.dll
[2009/08/10 10:45:41 | 000,376,832 | ---- | C] () -- C:\WINDOWS\System32\M2000Twn.dll
[2009/08/10 10:45:41 | 000,167,948 | ---- | C] () -- C:\WINDOWS\System32\dxgi.dll
[2009/08/10 10:45:41 | 000,134,671 | ---- | C] () -- C:\WINDOWS\System32\winstanew.dll
[2009/08/10 10:45:41 | 000,096,783 | ---- | C] () -- C:\WINDOWS\System32\powrprofnew.dll
[2009/08/10 10:45:41 | 000,087,558 | ---- | C] () -- C:\WINDOWS\System32\ntdsapinew.dll
[2009/08/10 10:45:41 | 000,072,707 | ---- | C] () -- C:\WINDOWS\System32\secur32new.dll
[2009/08/10 10:45:41 | 000,039,948 | ---- | C] () -- C:\WINDOWS\System32\dwmapi.dll
[2009/08/10 10:45:41 | 000,025,037 | ---- | C] () -- C:\WINDOWS\System32\Nucleus.dll
[2009/08/10 10:45:41 | 000,000,236 | -H-- | C] () -- C:\Program Files\Common Files\dx.reg
[2009/08/10 10:45:40 | 001,029,126 | ---- | C] () -- C:\WINDOWS\System32\d3d10.dll
[2009/08/10 10:45:40 | 000,974,354 | ---- | C] () -- C:\WINDOWS\System32\crypt32new.dll
[2009/08/10 10:45:40 | 000,770,069 | ---- | C] () -- C:\WINDOWS\System32\advapi32new.dll
[2009/08/10 10:45:40 | 000,187,398 | ---- | C] () -- C:\WINDOWS\System32\d3d10core.dll
[2009/08/10 10:45:40 | 000,171,023 | ---- | C] () -- C:\WINDOWS\System32\apphelpnew.dll
[2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 16:07:42 | 000,230,768 | ---- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe
[2009/07/18 16:46:48 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/06/09 16:22:41 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\David Forrest\Local Settings\Application Data\PUTTY.RND
[2009/05/18 20:10:31 | 000,007,937 | ---- | C] () -- C:\WINDOWS\PmLite3.ini
[2009/05/18 20:10:31 | 000,001,862 | ---- | C] () -- C:\WINDOWS\PMStockCams.Ini
[2009/05/08 16:06:13 | 000,000,275 | ---- | C] () -- C:\WINDOWS\Caligari.ini
[2009/04/06 20:25:21 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Brownie.ini
[2009/04/05 21:40:30 | 000,000,236 | ---- | C] () -- C:\WINDOWS\Brpfx04a.ini
[2009/04/05 21:40:30 | 000,000,092 | ---- | C] () -- C:\WINDOWS\brpcfx.ini
[2009/04/05 21:40:30 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\BRIDF04A.dat
[2009/04/05 21:34:59 | 000,000,419 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2009/04/05 21:34:59 | 000,000,079 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2009/04/05 21:34:58 | 000,000,030 | ---- | C] () -- C:\WINDOWS\System32\brss01a.ini
[2009/04/05 15:25:10 | 000,002,070 | ---- | C] () -- C:\WINDOWS\kaillera.ini
[2009/03/12 23:32:21 | 000,001,106 | ---- | C] () -- C:\WINDOWS\videoimp.ini
[2009/03/12 23:32:11 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2009/03/12 23:31:58 | 000,000,021 | ---- | C] () -- C:\WINDOWS\VI_setup.ini
[2009/03/12 23:30:57 | 000,000,021 | ---- | C] () -- C:\WINDOWS\PI_setup.ini
[2009/03/07 16:41:03 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2009/03/04 01:51:29 | 000,000,031 | ---- | C] () -- C:\WINDOWS\e2eSoft.ini
[2009/02/28 17:24:33 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2009/02/28 10:35:03 | 000,000,031 | ---- | C] () -- C:\WINDOWS\bluevoda.ini
[2009/02/26 04:33:10 | 000,000,060 | ---- | C] () -- C:\WINDOWS\System32\SYSDRV.DAT
[2009/02/25 21:24:49 | 000,000,158 | ---- | C] () -- C:\WINDOWS\settings.ini
[2009/02/25 16:49:16 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/02/25 14:43:41 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009/02/25 14:36:18 | 000,098,816 | ---- | C] () -- C:\Documents and Settings\David Forrest\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/10/23 11:37:20 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008/10/23 11:37:07 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008/10/23 11:37:07 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008/10/23 11:36:52 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2008/10/23 11:36:26 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008/10/23 11:36:25 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2008/10/23 11:35:22 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008/10/22 19:50:27 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2008/10/22 19:07:47 | 000,000,470 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2008/10/22 18:41:32 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2008/10/22 18:41:25 | 000,024,892 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2008/10/22 18:41:25 | 000,010,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2008/10/22 18:37:09 | 000,004,984 | R--- | C] () -- C:\WINDOWS\System32\drivers\nvphy.bin
[2008/10/22 17:56:54 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2008/10/22 17:53:25 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2008/10/22 13:49:56 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2008/10/22 13:49:04 | 001,504,256 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2008/08/01 18:48:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2008/05/27 01:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/27 01:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2007/09/27 14:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 14:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 14:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2007/09/23 15:41:20 | 000,779,776 | ---- | C] () -- C:\WINDOWS\System32\cp211_main.dll
[2007/09/23 15:41:20 | 000,285,184 | ---- | C] () -- C:\WINDOWS\System32\cp211_graphicslarge16.dll
[2007/09/23 15:41:20 | 000,252,416 | ---- | C] () -- C:\WINDOWS\System32\cp211_javascript.dll
[2007/09/23 15:41:20 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\cp211_basic.dll
[2006/02/28 12:00:00 | 000,414,084 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006/02/28 12:00:00 | 000,064,666 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006/02/28 12:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2002/06/06 01:01:58 | 000,029,696 | ---- | C] () -- C:\WINDOWS\System32\asutl8.dll
[2002/04/19 18:03:52 | 000,004,514 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2002/04/19 18:03:48 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

========== Alternate Data Streams ==========

@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8

< End of report >


Thanks for all the great help you have been, I truly appreciate it.
RobotiX

This post has been edited by RobotiX: 17 May 2011 - 10:46 PM

Hi again RobotiX!!..

RobotiX, on 17 May 2011 - 10:33 PM, said:

An error code is of much help, Microsoft has an article about it: Windows Update error 80070424, though, the advice here: Error code 0x80070424 seems to be more suited for your system (Windows XP)...
Are you able to start these Services??.. If yes, does MS Security Essentials update correctly now (check after a reboot)??..

Ok, the script below will remove some leftovers only (not sure why I did not include them in a script earlier ):

Please run OTL.exe.

• Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :OTL
  [2010/12/22 14:18:27 | 000,003,189 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\acpro.xml
  [2010/11/22 09:33:08 | 000,002,037 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrchaudio.xml
  [2011/05/15 16:45:38 | 000,016,198 | -HS- | M] () -- C:\Documents and Settings\David Forrest\Local Settings\Application Data\2i873h68bh1v04b31ta2hhc25
  [2011/05/15 16:45:38 | 000,016,198 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\2i873h68bh1v04b31ta2hhc25
  [2011/03/18 01:44:22 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\d6f2e38b
  [2011/03/18 01:44:21 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\660cc00d
  [2011/03/18 01:44:11 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\a8710bec
  [2011/03/18 01:44:08 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\c5709935
  [2011/03/18 01:44:03 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\bbec604a
  [2011/03/18 01:44:03 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\bbaf9130
  [2011/03/18 01:44:00 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\4d656f75
  [2011/03/18 01:44:00 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\4d127ea3
  [2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\86d40099
  [2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\8698f2d2
  [2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\860c9948
  [2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\85d21749
  [2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\859db37f
  [2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\852af8cb
  [2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\84ed778a
  [2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\8041c91d
  [2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\7e1527b9
  [2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\7de414ee
  [2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\7da22d81
  [2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\7d3f1e0a
  [2011/03/18 01:43:57 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\7c7a5b84
  [2011/03/18 01:43:27 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\ceda8b7e
  [2011/03/18 01:43:27 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\ce94dc19
  [2011/03/18 01:43:25 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\79c615aa
  [2011/03/18 01:43:25 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\79781fc9
  [2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\c157bd28
  [2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\c1157cba
  [2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\c09a8b4c
  [2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\be183617
  [2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\bde96f9c
  [2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\bd553205
  [2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\bd19ac03
  [2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\b744724c
  [2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\b3f02c08
  [2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\b3c0ac6c
  [2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\b378b056
  [2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\b33cf5fa
  [2011/03/18 01:43:15 | 000,004,636 | ---- | C] () -- C:\Documents and Settings\David Forrest\Application Data\b21ef689
  
  
  
• Return to OTL.exe, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.
  
  
• Click the red Run Fix button.
  
• A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTL.exe

Hey,
This is very strange, I followed the instructions on that other website and I set everything that it said to, to start and automatic but then I noticed that Windows Update is absent from the services list (No doubt the cause of the error). So I further follow the instructions and follow the link to automatically install Windows Update from the Microsoft website. I click a few buttons and start the install, but the page refreshes and says that the page I'm looking for is unavailable, and on the website in the upper right hand corner it says "Error Code: 0x80070424" The same error I get with the updating for MSE. So I proceed to install the Windows Update Agent manually, I download the installer and run it, it extracts some files and then a window opens up and it says "No need to install, Windows Install Agent is already installed." so I click finish and proceed t type all this up and tell you and here we are! MSE runs fine, scans, finds, and destroys viruses but I guess it doesn't update? I'm still not really sure. Anyway... Here's the OTL Log:

========== OTL ==========
C:\Program Files\Mozilla Firefox\searchplugins\acpro.xml moved successfully.
C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrchaudio.xml moved successfully.
C:\Documents and Settings\David Forrest\Local Settings\Application Data\2i873h68bh1v04b31ta2hhc25 moved successfully.
C:\Documents and Settings\All Users\Application Data\2i873h68bh1v04b31ta2hhc25 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\d6f2e38b moved successfully.
C:\Documents and Settings\David Forrest\Application Data\660cc00d moved successfully.
C:\Documents and Settings\David Forrest\Application Data\a8710bec moved successfully.
C:\Documents and Settings\David Forrest\Application Data\c5709935 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\bbec604a moved successfully.
C:\Documents and Settings\David Forrest\Application Data\bbaf9130 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\4d656f75 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\4d127ea3 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\86d40099 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\8698f2d2 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\860c9948 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\85d21749 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\859db37f moved successfully.
C:\Documents and Settings\David Forrest\Application Data\852af8cb moved successfully.
C:\Documents and Settings\David Forrest\Application Data\84ed778a moved successfully.
C:\Documents and Settings\David Forrest\Application Data\8041c91d moved successfully.
C:\Documents and Settings\David Forrest\Application Data\7e1527b9 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\7de414ee moved successfully.
C:\Documents and Settings\David Forrest\Application Data\7da22d81 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\7d3f1e0a moved successfully.
C:\Documents and Settings\David Forrest\Application Data\7c7a5b84 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\ceda8b7e moved successfully.
C:\Documents and Settings\David Forrest\Application Data\ce94dc19 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\79c615aa moved successfully.
C:\Documents and Settings\David Forrest\Application Data\79781fc9 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\c157bd28 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\c1157cba moved successfully.
C:\Documents and Settings\David Forrest\Application Data\c09a8b4c moved successfully.
C:\Documents and Settings\David Forrest\Application Data\be183617 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\bde96f9c moved successfully.
C:\Documents and Settings\David Forrest\Application Data\bd553205 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\bd19ac03 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\b744724c moved successfully.
C:\Documents and Settings\David Forrest\Application Data\b3f02c08 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\b3c0ac6c moved successfully.
C:\Documents and Settings\David Forrest\Application Data\b378b056 moved successfully.
C:\Documents and Settings\David Forrest\Application Data\b33cf5fa moved successfully.
C:\Documents and Settings\David Forrest\Application Data\b21ef689 moved successfully.

OTL by OldTimer - Version 3.2.22.3 log created on 05182011_155713

Hopefully we can find a solution, thanks for the constant help.

RobotiX

Hi again RobotiX!!..

Follow the instructions provided in this article: How do I reset Windows Update components? - basically, download and run Microsoft's FixIt! ... Let me know if it solves the problem...

Wooo!
Did it, MSE updates just fine, although "Windows Update" is still absent from my serviced list I don't think it does a difference.

Thank You,
David Buff

Hi again David!!..

RobotiX, on 19 May 2011 - 05:38 PM, said:

Hmm, let's check something, maybe we'll be able to figure out why it is that way...

Firstly,
Check if your system can search for updates: windowsupdate.microsoft.com without any errors...

Secondly,
Open Notepad and copy and paste next present in the quotebox:

Quote

Save this as look.bat , choose to save as *all files and place it on your Desktop.
It should look like this:
Doubleclick on it and Notepad should open.
Copy and paste the contents of it in your next reply.

Thirdly,

• Download TDSSKiller.zip and extract TDSSKiller.exe to your Desktop.
  
• Execute TDSSKiller.exe by doubleclicking on it.
  
• Press Start Scan

• If Malicious objects are found, ensure Cure is selected (it should be by default).
  
• Click Continue then click Reboot now.
  
  
• Once complete, a log will be produced at the root drive which is typically C:\
  
  For example, C:\TDSSKiller.2.4.0.0_24.07.2010_13.10.52_log.txt
  
  
• Please post that log here.

Hey snemelk,
Ok, the Windows update worked fine, it didn't give me the error this time it actually searched for updates, it didn't find any, I'm not surprised though because my computer is set to auto update at 3am everyday. Here is the look.bat, logsc.txt log:


SERVICE_NAME: wuauserv
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE,NOT_PAUSABLE,ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv]
"Type"=dword:00000020
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
"DisplayName"="Automatic Updates"
"ObjectName"="LocalSystem"
"Description"="Enables the download and installation of Windows updates. If this service is disabled, this computer will not be able to use the Automatic Updates feature or the Windows Update Web site."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Parameters]
"ServiceDll"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,77,00,75,00,\
61,00,75,00,73,00,65,00,72,00,76,00,2e,00,64,00,6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Security]
"Security"=hex:01,00,14,80,78,00,00,00,84,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,00,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,48,00,03,00,00,00,00,00,14,00,9d,00,02,00,01,01,00,00,00,00,00,\
05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,ff,01,0f,00,01,01,00,00,00,00,00,05,12,00,00,00,01,\
01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Enum]
"0"="Root\\LEGACY_WUAUSERV\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

And the tdsskiller found nothing. No log to post. But it did scan 228 objects in 6 seconds, not bad.

Thanks Always,
David Buff