Solved Unable to install Updates: Error Message 646

Equipper · 2010/07/26

[Resolved] Unable to install Updates: Error Message 646

Hi, I have been unable to install updates for the past two months now. Just havenot been able to find any solution to the problem. Windows update does find the updates but after hitting the "install" button. I always get the error message 646 saying that the updates "failed" to be installed. what can I do to resolve this problem. Thanks. Below is the DDS.txt and Attach.txt.

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
***********************************************************

DDS (Ver_10-03-17.01) - NTFSx86
Run by John N. W. Horace at 10:17:38.86 on Mon 07/26/2010
Internet Explorer: 8.0.6001.18928 BrowserJavaVersion: 1.6.0_20
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6002.2.1252.1.1033.18.2037.856 [GMT -4:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
C:\Acer\Empowering Technology\eNet\eNet Service.exe
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Acer\Mobility Center\MobilityService.exe
C:\Program Files\Norton 360\Engine\4.2.0.12\ccSvcHst.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Norton 360\Engine\4.2.0.12\ccSvcHst.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\SafeConnect\scManager.sys
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\ehome\ehtray.exe
D:\WORDsearch 9\WORDsearch 9\ZipScript.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\SafeConnect\scClient.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\John N. W. Horace\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com
uSEARCH PAGE =
uSearch Bar = Preserve
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://en.us.acer.yahoo.com
mDefault_Page_URL = hxxp://en.us.acer.yahoo.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn2\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton 360\engine\4.2.0.12\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton 360\engine\4.2.0.12\IPSBHO.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn2\YTSingleInstance.dll
TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\windows\system32\eDStoolbar.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn2\yt.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton 360\engine\4.2.0.12\coIEPlg.dll
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
TB: {EEE6C35B-6118-11DC-9C72-001320C79847} - No File
uRun: [????r]
uRun: [?????????] ??????????????e
uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [MSConfig] c:\users\john n. w. horace\egw.exe \u
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [levasugofi] Rundll32.exe "c:\programdata\zilafaba\zilafaba.dll ",s
uRun: [AdobeBridge]
uRun: [msnmsgr] ~ "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [ZipScript] d:\wordsearch 9\wordsearch 9\ZipScript.exe
uRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -startup
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [Google Update] "c:\users\john n. w. horace\appdata\local\google\update\GoogleUpdate.exe" /c
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
StartupFolder: c:\users\john n. w. horace\appdata\roaming\microsoft\windows\start menu\programs\startup\wmitpsk.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\empowe~1.lnk - c:\acer\empowering technology\eAPLauncher.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\safeco~1.lnk - c:\program files\safeconnect\scClient.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-explorer: UserId = L7AKH?>
mPolicies-explorer: UserIdNo = 694 (0x2b6)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
Trusted Zone: wordsearchbible.com\www
Trusted Zone: yahoo.com\www.en.us.acer
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: lbxfile - {56831180-F115-11d2-B6AA-00104B2B9943} - c:\program files\libronix dls\system\FileProt.dll
Handler: lbxres - {24508F1B-9E94-40EE-9759-9AF5795ADF52} - c:\program files\libronix dls\system\ResProt.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: eNetHook.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\johnnw~1.hor\appdata\roaming\mozilla\firefox\profiles\1vgekn52.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - eBay
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-USfficial
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\coffplgn\components\coFFPlgn.dll
FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\ipsffplgn\components\IPSFFPl.dll
FF - component: c:\programdata\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\users\john n. w. horace\appdata\local\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\users\john n. w. horace\appdata\local\yahoo!\browserplus\2.9.2\plugins\npybrowserplus_2.9.2.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_popup_windows ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.enable_click_image_resizing ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "accessibility.browsewithcaret_shortcut.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.high_water_mark ", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.gc_frequency ", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.lu ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.nu ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.nz ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbaam7a8h ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--p1ai ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbayh7gpa ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.tel ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.proxy.type ", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.buffer.cache.count ", 24);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.buffer.cache.size ", 4096);
c:\program files\mozilla firefox\greprefs\all.js - pref( "dom.ipc.plugins.timeoutSecs ", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.trackpoint_hack.enabled ", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.debug ", false);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.agedWeight ", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.bucketSize ", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.maxTimeGroupings ", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.timeGroupingSize ", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.boundaryWeight ", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.prefixWeight ", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref( "accelerometer.enabled ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "html5.enable ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.download.backgroundInterval ", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.url.manual ", "http://www.firefox.com ");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-ja ", "mozff ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add ", "addons.mozilla.org ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add.36 ", "getpersonas.com ");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "lightweightThemes.update.enabled ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.allTabs.previews ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.hide_infobar_for_outdated_plugin ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "toolbar.customization.usesheet ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.nptest.dll ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npswf32.dll ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npctrl.dll ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npqtplugin.dll ", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.enable ", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.max ", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.cachetime ", 20);

============= SERVICES / DRIVERS ===============

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\n360\0402000.00c\symds.sys [2010-5-25 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0402000.00c\symefa.sys [2010-5-25 173104]
R1 BHDrvx86;BHDrvx86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\bashdefs\20100709.001\BHDrvx86.sys [2010-7-12 691248]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360\0402000.00c\cchpx86.sys [2010-5-25 501888]
R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\ipsdefs\20100723.001\IDSvix86.sys [2010-7-23 344112]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\n360\0402000.00c\ironx86.sys [2010-5-25 116784]
R1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\system32\drivers\n360\0402000.00c\symtdiv.sys [2010-5-25 339504]
R2 N360;Norton 360;c:\program files\norton 360\engine\4.2.0.12\ccsvchst.exe [2010-5-25 126392]
R2 SCManager;SafeConnect Manager;c:\program files\safeconnect\scmanager.sys servicestart --> c:\program files\safeconnect\scManager.sys servicestart [?]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-5-28 102448]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2010-1-15 21504]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 .1263280449;1263280449;c:\program files\1263280449\john n. w. horace1263280449l.exe --> c:\program files\1263280449\John N. W. Horace1263280449L.exe [?]

=============== Created Last 30 ================

2010-07-24 18:50:51 0 d-----w- c:\program files\iPod
2010-07-24 07:01:43 0 d-----w- c:\programdata\Last.fm
2010-07-24 06:59:59 0 d-----w- c:\program files\Last.fm
2010-07-21 21:19:36 0 d-----w- c:\program files\common files\xing shared
2010-07-04 17:30:35 0 d-----w- c:\program files\iTunes
2010-07-04 17:22:08 0 d-----w- c:\program files\Bonjour

==================== Find3M ====================

2010-07-26 13:24:54 51200 ----a-w- c:\windows\inf\infpub.dat
2010-07-26 13:24:53 143360 ----a-w- c:\windows\inf\infstrng.dat
2010-07-24 02:51:01 45200 ------w- c:\windows\system32\drivers\pxhelp20.sys
2010-07-13 15:40:57 143360 ----a-w- c:\windows\inf\infstor.dat
2010-07-05 07:27:10 286720 ------w- c:\windows\Setup1.exe
2010-07-05 07:27:09 73216 ----a-w- c:\windows\ST6UNST.EXE
2010-06-04 13:33:00 130955 ----a-w- c:\windows\hpoins12.dat
2010-06-02 00:18:35 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-05-26 17:06:41 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-26 16:54:40 103994 ----a-w- c:\windows\hpqins01.dat
2010-05-26 14:47:41 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-05-18 20:35:16 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-05-18 20:35:16 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-05-04 05:59:21 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 05:55:42 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-05-04 05:55:42 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-05-04 04:31:05 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-05-01 14:13:48 2037248 ----a-w- c:\windows\system32\win32k.sys
2010-01-16 09:05:38 665600 ----a-w- c:\windows\inf\drvindex.dat
2010-01-15 07:30:12 174 --sha-w- c:\program files\desktop.ini
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2010-01-28 11:29:53 16384 --sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\cookies\index.dat
2010-01-28 11:29:53 16384 --sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\history\history.ie5\index.dat
2010-01-28 11:29:53 32768 --sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\temporary internet files\content.ie5\index.dat
2010-01-17 01:38:55 16384 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\history\history.ie5\index.dat
2010-01-17 01:38:55 32768 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat
2010-01-17 01:38:55 16384 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\cookies\index.dat
2010-01-17 01:38:55 245760 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2010-04-27 06:46:37 245760 --sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat

============= FINISH: 10:18:00.88 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft® Windows Vistaâ„¢ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 1/12/2010 2:14:09 AM
System Uptime: 7/26/2010 3:58:00 AM (7 hours ago)

Motherboard: Acer | | Grapevine
Processor: Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz | U1 | 1667/166mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 83 GiB total, 12.053 GiB free.
D: is FIXED (NTFS) - 58 GiB total, 6.115 GiB free.
E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP372: 7/24/2010 3:00:37 AM - Windows Update
RP373: 7/24/2010 12:38:52 PM - Installed Skylook
RP374: 7/24/2010 6:29:20 PM - Windows Update
RP375: 7/25/2010 3:01:18 AM - Windows Update
RP376: 7/25/2010 8:21:39 PM - Removed Skylook
RP377: 7/25/2010 9:17:51 PM - Windows Update
RP378: 7/26/2010 4:06:02 AM - Windows Update

==== Installed Programs ======================

32 Bit HP CIO Components Installer
Acer Arcade Deluxe
Acer Assist
Acer eDataSecurity Management
Acer eLock Management
Acer Empowering Technology
Acer eNet Management
Acer ePower Management
Acer ePresentation Management
Acer eSettings Management
Acer GridVista
Acer Mobility Center Plug-In
Acer OrbiCam
Acer OrbiCam
Acer Registration
Acer ScreenSaver
Acer Tour
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Media Player
Adobe Reader 9.3.3
AIO_Scan
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Batch Update
Bible Data Type System Files
BibleWorks 8
BlackBerry Desktop Software 5.0.1
BlackBerry Device Software Updater
BlackBerry Device Software v5.0.0 for the BlackBerry 9630 smartphone
BlackBerry® Media Sync
Bonjour
BufferChm
Common System Files
Copy
Destinations
DeviceManagementQFolder
DJ_AIO_ProductContext
DJ_AIO_Software
DJ_AIO_Software_min
eSupportQFolder
F4100
F4100_Help
FileZilla Client 3.3.2.1
Google Chrome
Gre Bible
Gre Bible (d:\)
HDAUDIO Soft Data Fax Modem with SmartCP
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Deskjet All-In-One Software 8.0
HP Imaging Device Functions 8.0
HP Product Assistant
HP Solution Center 8.0
HP Update
HPProductAssistant
HPSSupply
Intel(R) Graphics Media Accelerator Driver
iTunes
Java Auto Updater
Java(TM) 6 Update 20
JFTP 4.1
K-Lite Mega Codec Pack 2.1.5
Last.fm 1.5.4.24567
Launch Manager
Libronix Digital Library System
Libronix DLS Application
Libronix DLS Shortcuts
LibronixUpdate
LightScribe 1.4.136.1
LLS Resource Driver
Logos 4 Prerequisites
Logos Bible Software 4
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Plus 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Mozilla Firefox (3.6.8)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Norton 360
Norton Internet Security
NTI Backup NOW! 4.7
OEB Resource Driver
OGA Notifier 2.0.0048.0
PDF Resource Driver
PowerISO
QuickTime
RealNetworks - Microsoft Visual C++ 2005 Runtime
RealPlayer
Realtek High Definition Audio Driver
RealUpgrade 1.0
Roxio Media Manager
SafeConnect
Scan
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for 2007 Microsoft Office System (KB978380)
Security Update for Microsoft Office Excel 2007 (KB978382)
Security Update for Microsoft Office Outlook 2007 (KB972363)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office Publisher 2007 (KB980470)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Skypeâ„¢ 4.2
SMSC Fast Infrared Driver
SolutionCenter
Status
SweetIM for Messenger 2.9
Synaptics Pointing Device Driver
Toolbox
TrayApp
UnloadSupport
Update for 2007 Microsoft Office System (KB967642)
Update for 2007 Microsoft Office System (KB981715)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office InfoPath 2007 (KB976416)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 (KB974561)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Outlook 2007 Junk Email Filter (kb981726)
WebReg
WIDCOMM Bluetooth Software 6.0.1.3100
Windows Media Player Firefox Plugin
WinMerge 2.12.4
WinRAR archiver
WORDsearch
Yahoo! BrowserPlus 2.9.2
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Mail Advisor
Yahoo! Messenger
Yahoo! Search Protection
Yahoo! Software Update
Yahoo! Toolbar

==== Event Viewer Messages From Past Week ========

7/26/2010 4:12:53 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for the 2007 Microsoft Office System (KB982312).
7/26/2010 4:11:29 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft Office Excel 2007 (KB982308).
7/26/2010 4:10:58 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft Office InfoPath 2007 (KB979441).
7/26/2010 4:10:25 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft Office PowerPoint 2007 (KB982158).
7/26/2010 4:09:54 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft Office Access 2007 (KB979440).
7/26/2010 4:09:19 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft Office Publisher 2007 (KB982124).
7/26/2010 4:08:46 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft Office Word 2007 (KB982135).
7/26/2010 4:08:15 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for the 2007 Microsoft Office System (KB982331).
7/26/2010 4:07:45 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2202131).
7/26/2010 4:07:13 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft Office Outlook 2007 (KB980376).
7/26/2010 4:00:57 AM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.5.75 for the Network Card with network address 0019D2C724C2 has been denied by the DHCP server 192.168.4.14 (The DHCP Server sent a DHCPNACK message).
7/26/2010 3:59:35 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Roxio Hard Drive Watcher 9 service to connect.
7/26/2010 3:59:20 AM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.17.8 for the Network Card with network address 0019D2C724C2 has been denied by the DHCP server 192.168.4.14 (The DHCP Server sent a DHCPNACK message).
7/25/2010 9:47:37 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SysMain service.
7/25/2010 9:47:07 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TrkWks service.
7/25/2010 6:49:50 AM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.17.4 for the Network Card with network address 0019D2C724C2 has been denied by the DHCP server 192.168.4.14 (The DHCP Server sent a DHCPNACK message).
7/24/2010 6:13:10 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.17.14 for the Network Card with network address 0019D2C724C2 has been denied by the DHCP server 192.168.4.14 (The DHCP Server sent a DHCPNACK message).
7/24/2010 6:11:55 PM, Error: ACPI [13] - : The embedded controller (EC) did not respond within the specified timeout period. This may indicate that there is an error in the EC hardware or firmware or that the BIOS is accessing the EC incorrectly. You should check with your computer manufacturer for an upgraded BIOS. In some situations, this error may cause the computer to function incorrectly.
7/24/2010 3:13:35 PM, Error: Service Control Manager [7043] - The Group Policy Client service did not shut down properly after receiving a preshutdown control.
7/24/2010 3:13:35 PM, Error: Service Control Manager [7001] - The Application Information service depends on the User Profile Service service which failed to start because of the following error: The service has not been started.
7/24/2010 3:13:35 PM, Error: Service Control Manager [7000] - The hpqcxs08 service failed to start due to the following error: A system shutdown is in progress.
7/24/2010 3:13:35 PM, Error: Service Control Manager [7000] - The Diagnostic System Host service failed to start due to the following error: A system shutdown is in progress.
7/24/2010 3:13:35 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1115" attempting to start the service hpqcxs08 with arguments " " in order to run the server: {1DAEDD8A-30ED-4585-9CF1-13BDF7791DDE}
7/24/2010 2:47:56 PM, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
7/23/2010 7:12:39 AM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
7/23/2010 7:09:15 AM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.17.30 for the Network Card with network address 0019D2C724C2 has been denied by the DHCP server 192.168.4.14 (The DHCP Server sent a DHCPNACK message).
7/23/2010 3:20:18 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.7 for the Network Card with network address 0019D2C724C2 has been denied by the DHCP server 192.168.4.14 (The DHCP Server sent a DHCPNACK message).
7/23/2010 11:42:40 AM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.5.75 for the Network Card with network address 0019D2C724C2 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
7/23/2010 11:26:18 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.17.10 for the Network Card with network address 0019D2C724C2 has been denied by the DHCP server 192.168.4.14 (The DHCP Server sent a DHCPNACK message).
7/23/2010 10:30:29 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service.
7/21/2010 2:26:27 PM, Error: EventLog [6008] - The previous system shutdown at 1:49:44 PM on 7/21/2010 was unexpected.
7/21/2010 2:24:56 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the wscsvc service.
7/21/2010 2:24:20 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Eventlog service.
7/21/2010 2:23:52 PM, Error: Service Control Manager [7043] - The Windows Update service did not shut down properly after receiving a preshutdown control.
7/21/2010 2:23:49 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Audiosrv service.

==== End Of File ===========================

broni · 2010/07/26

Your computer is definitely infected.

STEP 1. Download Malwarebytes' Anti-Malware (aka MBAM): http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform Quick Scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

STEP 2. Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
Alternative downloads:
- http://majorgeeks.com/GMER_d5198.html
- http://www.softpedia.com/get/Interne...ers/GMER.shtml
Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
Do NOT use the computer while GMER is running!
When scan is completed, click Save button, and save the results as gmer.log
Warning ! Please, do not select the "Show all" checkbox during the scan.
Post the log to your next reply.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Equipper · 2010/07/27

Thanks broni for your prompt response to my request; appreciate it . I have followed your instructions to the letter. I have posted the logs below:

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^****************************************************************
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4356

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18928

7/27/2010 1:54:50 AM
mbam-log-2010-07-27 (01-54-50).txt

Scan type: Quick scan
Objects scanned: 139554
Time elapsed: 9 minute(s), 1 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 24
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\Environment\evapp (Rogue.Antivir2010) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Environment\evuninst (Rogue.Antivir2010) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\levasugofi (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

************************************************************************************************************************************

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-07-27 11:58:56
Windows 6.0.6002 Service Pack 2
Running: mrbdiq72.exe; Driver: C:\Users\JOHNNW~1.HOR\AppData\Local\Temp\fxkyikod.sys

---- System - GMER 1.0.15 ----

SSDT 86D48048 ZwAlertResumeThread
SSDT 86CE7048 ZwAlertThread
SSDT 86DAC470 ZwAllocateVirtualMemory
SSDT 86434130 ZwAlpcConnectPort
SSDT 86DAB048 ZwAssignProcessToJobObject
SSDT 86D8A740 ZwCreateMutant
SSDT 86DB0DF8 ZwCreateSymbolicLinkObject
SSDT 86DABDA8 ZwCreateThread
SSDT 86DA5048 ZwDebugActiveProcess
SSDT 86DAC688 ZwDuplicateObject
SSDT 86DADE78 ZwFreeVirtualMemory
SSDT 86D397D0 ZwImpersonateAnonymousToken
SSDT 86D4B048 ZwImpersonateThread
SSDT 863A1D28 ZwLoadDriver
SSDT 86DADD58 ZwMapViewOfSection
SSDT 86D2F048 ZwOpenEvent
SSDT 86DAC8A8 ZwOpenProcess
SSDT 86C78110 ZwOpenProcessToken
SSDT 86D53048 ZwOpenSection
SSDT 86DAC798 ZwOpenThread
SSDT 86DAFAB8 ZwProtectVirtualMemory
SSDT 86D13048 ZwResumeThread
SSDT 86C97108 ZwSetContextThread
SSDT 86DADB40 ZwSetInformationProcess
SSDT 86D85048 ZwSetSystemInformation
SSDT 86D4F048 ZwSuspendProcess
SSDT 86CDD048 ZwSuspendThread
SSDT 86C4C110 ZwTerminateProcess
SSDT 86CC8048 ZwTerminateThread
SSDT 86C8F118 ZwUnmapViewOfSection
SSDT 86DAC1E0 ZwWriteVirtualMemory
SSDT 86DAF2D8 ZwCreateThreadEx

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!KeSetEvent + 11D 81EBF880 8 Bytes [48, 80, D4, 86, 48, 70, CE, ...]
.text ntkrnlpa.exe!KeSetEvent + 131 81EBF894 4 Bytes [70, C4, DA, 86]
.text ntkrnlpa.exe!KeSetEvent + 13D 81EBF8A0 4 Bytes [30, 41, 43, 86]
.text ntkrnlpa.exe!KeSetEvent + 191 81EBF8F4 4 Bytes [48, B0, DA, 86]
.text ntkrnlpa.exe!KeSetEvent + 1F5 81EBF958 4 Bytes [40, A7, D8, 86]
.text ...

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Mozilla Firefox\firefox.exe[3600] ntdll.dll!LdrLoadDll 77B49390 5 Bytes JMP 01C2003A
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[5148] USER32.dll!TrackPopupMenu 778714F3 4 Bytes JMP 6404721D C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\Explorer.EXE[3160] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [74B37817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3160] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [74B8A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3160] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [74B3BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3160] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [74B2F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3160] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [74B375E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3160] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [74B2E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3160] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [74B68395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3160] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [74B3DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3160] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [74B2FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3160] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [74B2FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3160] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [74B271CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3160] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [74BBCAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3160] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [74B5C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3160] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [74B2D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3160] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [74B26853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3160] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [74B2687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3160] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [74B32AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [614AAE77] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [614AADA9] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [614AA7A3] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [614AADE9] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [614AAE77] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [614AADA9] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [614AADE9] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [614AA7A3] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\USER32.dll [GDI32.dll!GetStockObject] [614A9CEC] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [614AADE9] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [614AAE77] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [614AADA9] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [614AA7A3] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\SHLWAPI.dll [GDI32.dll!GetStockObject] [614A9CEC] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!GetSysColor] [614A9C27] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!DefWindowProcW] [614AA3BA] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!DefWindowProcA] [614AA3BA] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [614AAE77] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [614AA7A3] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [614AADE9] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [614AADA9] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\SHELL32.dll [GDI32.dll!GetStockObject] [614A9CEC] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\SHELL32.dll [USER32.dll!TrackPopupMenuEx] [614A9B94] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\SHELL32.dll [USER32.dll!TrackPopupMenu] [614A9B56] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\SHELL32.dll [USER32.dll!GetSysColorBrush] [614A9CF2] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\SHELL32.dll [USER32.dll!GetSysColor] [614A9C27] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\SHELL32.dll [USER32.dll!DefWindowProcW] [614AA3BA] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[3972] @ C:\Windows\system32\SHELL32.dll [USER32.dll!AnimateWindow] [614A9D87] C:\Program Files\Yahoo!\Messenger\yui.dll

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\877570FF05E6de7499D1B370DFE42305\Usage@TrayApp 1023083144
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\EE52C87977754e64988837C292C7DBDB\Usage@statusexe 1023083974
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Capture\{3d0db8d4-2156-4264-80fc-6821c847f391}@DeviceState 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Render\{caa181a8-d1ed-4b6e-ab50-9cb8a2709a20}@DeviceState 1

---- EOF - GMER 1.0.15 ----

broni · 2010/07/27

Good

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

[color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

Close any open browsers.

[color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Equipper · 2010/07/27

Once again I want to continue to thank you for your prompt response; and I have followed your instructions to the letter. I have posted the ComboFix log below.

******************************************************************************************************************
&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&

ComboFix 10-07-26.04 - John N. W. Horace 07/27/2010 15:19:27.1.2 - x86
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6002.2.1252.1.1033.18.2037.825 [GMT -4:00]
Running from: c:\users\John N. W. Horace\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Common Files\Uninstall
c:\windows\system32\%appdata%

.
((((((((((((((((((((((((( Files Created from 2010-06-27 to 2010-07-27 )))))))))))))))))))))))))))))))
.

2010-07-27 19:30 . 2010-07-27 19:30 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-07-27 05:43 . 2010-07-27 05:43 -------- d-----w- c:\users\John N. W. Horace\AppData\Roaming\Malwarebytes
2010-07-27 05:43 . 2010-07-27 19:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-27 05:43 . 2010-07-27 05:43 -------- d-----w- c:\programdata\Malwarebytes
2010-07-25 06:11 . 2010-07-25 06:14 -------- d-----w- c:\users\John N. W. Horace\AppData\Local\Deployment
2010-07-25 06:11 . 2010-07-25 06:11 -------- d-----w- c:\users\John N. W. Horace\AppData\Local\Apps
2010-07-24 18:50 . 2010-07-24 18:50 -------- d-----w- c:\program files\iPod
2010-07-24 07:01 . 2010-07-24 07:01 -------- d-----w- c:\programdata\Last.fm
2010-07-24 07:00 . 2010-07-24 17:56 -------- d-----w- c:\users\John N. W. Horace\AppData\Local\Last.fm
2010-07-24 06:59 . 2010-07-24 07:00 -------- d-----w- c:\program files\Last.fm
2010-07-23 19:44 . 2010-07-23 19:44 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-07-21 21:19 . 2010-07-21 21:19 -------- d-----w- c:\program files\Common Files\xing shared
2010-07-04 17:30 . 2010-07-24 18:51 -------- d-----w- c:\program files\iTunes
2010-07-04 17:27 . 2010-07-04 17:29 -------- d-----w- c:\program files\QuickTime
2010-07-04 17:26 . 2010-07-04 17:26 -------- d-----w- c:\program files\Apple Software Update
2010-07-04 17:22 . 2010-07-04 17:22 -------- d-----w- c:\program files\Bonjour

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-27 19:39 . 2010-04-09 13:11 -------- d-----w- c:\users\John N. W. Horace\AppData\Roaming\Skype
2010-07-27 17:15 . 2010-01-12 10:27 -------- d-----w- c:\program files\SafeConnect
2010-07-27 17:00 . 2010-04-09 13:16 -------- d-----w- c:\users\John N. W. Horace\AppData\Roaming\skypePM
2010-07-24 18:50 . 2010-01-16 01:21 -------- d-----w- c:\program files\Common Files\Apple
2010-07-24 18:47 . 2010-07-24 18:47 73000 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe
2010-07-24 18:35 . 2010-07-24 07:01 683801 ----a-w- c:\programdata\Last.fm\Client\UninstWMP\unins000.exe
2010-07-24 18:35 . 2010-07-24 07:01 683801 ----a-w- c:\programdata\Last.fm\Client\UninstITW\unins000.exe
2010-07-24 14:50 . 2010-02-18 02:41 -------- d-----w- c:\programdata\NOS
2010-07-24 07:01 . 2010-07-24 07:01 108 ----a-w- c:\programdata\Last.fm\Client\uninst2.bat
2010-07-24 02:51 . 2010-04-04 05:13 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-07-24 02:51 . 2007-05-01 07:00 45200 ------w- c:\windows\system32\drivers\pxhelp20.sys
2010-07-23 19:44 . 2010-07-23 20:12 53632 ----a-w- c:\users\John N. W. Horace\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-07-21 21:20 . 2010-03-25 20:15 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll
2010-07-21 21:20 . 2010-03-25 20:15 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll
2010-07-21 21:20 . 2010-03-25 20:15 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll
2010-07-21 21:20 . 2010-03-25 20:15 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll
2010-07-21 21:20 . 2010-03-25 20:15 49152 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll
2010-07-21 21:20 . 2010-03-25 20:15 308808 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll
2010-07-21 21:20 . 2010-03-25 20:15 14848 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
2010-07-21 21:20 . 2010-03-14 08:21 341600 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
2010-07-21 21:20 . 2010-01-15 00:47 -------- d-----w- c:\program files\Common Files\Real
2010-07-21 21:19 . 2010-01-15 00:47 -------- d-----w- c:\program files\Real
2010-07-21 21:16 . 2010-07-21 21:16 493064 ----a-w- c:\users\John N. W. Horace\AppData\Roaming\Real\RealPlayer\setup\AU_setup16.exe
2010-07-15 07:15 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-07-13 15:40 . 2010-07-13 15:40 53248 ----a-r- c:\users\John N. W. Horace\AppData\Roaming\Microsoft\Installer\{3360D505-B0AA-4284-92DF-F872AF90A448}\ARPPRODUCTICON.exe
2010-07-05 07:27 . 2010-03-04 00:10 286720 ------w- c:\windows\Setup1.exe
2010-07-05 07:27 . 2010-03-04 00:10 73216 ----a-w- c:\windows\ST6UNST.EXE
2010-07-04 17:34 . 2010-02-23 19:40 -------- d-----w- c:\users\John N. W. Horace\AppData\Roaming\Apple Computer
2010-07-04 17:27 . 2010-01-16 01:23 -------- d-----w- c:\programdata\Apple Computer
2010-06-26 07:12 . 2010-01-14 04:33 -------- d-----w- c:\program files\Microsoft.NET
2010-06-19 05:46 . 2010-01-21 11:58 -------- d-----w- c:\users\John N. W. Horace\AppData\Roaming\U3
2010-06-16 19:15 . 2010-06-23 14:11 6536704 ----a-w- c:\programdata\WORDsearch\WORDsearch 9\Updates\NewFiles\ProgramFiles\WORDsearch.exe
2010-06-16 15:05 . 2010-06-16 15:05 -------- d-----w- c:\users\John N. W. Horace\AppData\Roaming\Tific
2010-06-14 16:00 . 2010-02-22 15:23 -------- d-----w- c:\users\John N. W. Horace\AppData\Roaming\FileZilla
2010-06-04 13:33 . 2010-02-11 06:52 130955 ----a-w- c:\windows\hpoins12.dat
2010-06-03 17:38 . 2010-06-23 14:12 6536192 ----a-w- c:\programdata\WORDsearch\WORDsearch 9\Updates\BackupFiles\ProgramFiles\WORDsearch.exe
2010-06-02 00:19 . 2010-06-02 00:19 -------- d-----w- c:\program files\Common Files\Java
2010-06-02 00:18 . 2010-06-02 00:19 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-06-02 00:18 . 2010-06-02 00:18 -------- d-----w- c:\program files\Java
2010-05-29 17:52 . 2010-04-10 15:18 1356 ----a-w- c:\users\John N. W. Horace\AppData\Local\d3d9caps.dat
2010-05-26 17:06 . 2010-06-09 03:37 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-26 16:54 . 2007-01-17 04:07 103994 ----a-w- c:\windows\hpqins01.dat
2010-05-26 14:47 . 2010-06-09 03:37 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-05-18 20:35 . 2010-05-18 20:35 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-05-18 20:35 . 2010-05-18 20:35 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-05-14 18:11 . 2010-01-12 04:37 141688 ----a-w- c:\users\John N. W. Horace\AppData\Local\GDIPFONTCACHEV1.DAT
2010-05-04 19:44 . 2010-05-04 19:44 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-05-04 05:59 . 2010-06-09 03:37 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 05:55 . 2010-06-09 03:37 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-05-04 05:55 . 2010-06-09 03:37 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-05-04 04:31 . 2010-06-09 03:37 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-05-01 14:13 . 2010-06-09 03:37 2037248 ----a-w- c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"????r "=" " [?]
"????????? "= "??????????????e" [?]
"Messenger (Yahoo!) "= "c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2010-03-19 5248312]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"ZipScript "= "d:\wordsearch 9\WORDsearch 9\ZipScript.exe" [2009-02-06 1390592]
"ISUSPM Startup "= "c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]
"ISUSPM "= "c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]
"Skype "= "c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]
"Google Update "= "c:\users\John N. W. Horace\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-07-25 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-03-19 421888]
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-07-21 202256]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]

c:\users\John N. W. Horace\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
wmitpsk.exe [2010-1-11 208896]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-1-13 528384]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
SafeConnect.lnk - c:\program files\SafeConnect\scClient.exe [2009-3-31 297240]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"UserId "= L7AKH?>
"UserIdNo "= 694 (0x2b6)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=c:\windows\System32\eNetHook.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2 "=hex(b):42,5f,28,d7,34,96,ca,01

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 .1263280449;1263280449;c:\program files\1263280449\John N. W. Horace1263280449L.exe [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0402000.00C\SYMDS.SYS [2009-10-15 328752]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0402000.00C\SYMEFA.SYS [2010-04-22 173104]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20100709.001\BHDrvx86.sys [2010-05-22 691248]
S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0402000.00C\ccHPx86.sys [2010-02-26 501888]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100723.001\IDSvix86.sys [2010-05-28 344112]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0402000.00C\Ironx86.SYS [2010-04-29 116784]
S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\N360\0402000.00C\SYMTDIV.SYS [2010-05-06 339504]
S2 N360;Norton 360;c:\program files\Norton 360\Engine\4.2.0.12\ccSvcHst.exe [2010-02-26 126392]
S2 SCManager;SafeConnect Manager;c:\program files\SafeConnect\scManager.sys servicestart [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-05-27 102448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2010-07-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-409448064-391623352-931058572-1000Core.job
- c:\users\John N. W. Horace\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-25 06:14]

2010-07-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-409448064-391623352-931058572-1000UA.job
- c:\users\John N. W. Horace\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-25 06:14]

2010-07-27 c:\windows\Tasks\User_Feed_Synchronization-{BAF87866-2DCD-4E99-82D4-588C90CCA522}.job
- c:\windows\system32\msfeedssync.exe [2010-06-09 04:30]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://en.us.acer.yahoo.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
Trusted Zone: wordsearchbible.com\www
Trusted Zone: yahoo.com\www.en.us.acer
FF - ProfilePath - c:\users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - eBay
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-USfficial
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\IPSFFPlgn\components\IPSFFPl.dll
FF - component: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: c:\users\John N. W. Horace\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\users\John N. W. Horace\AppData\Local\Yahoo!\BrowserPlus\2.9.2\Plugins\npybrowserplus_2.9.2.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.lu ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.nu ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.nz ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbaam7a8h ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--p1ai ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbayh7gpa ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.tel ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.proxy.type ", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.buffer.cache.count ", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.buffer.cache.size ", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "dom.ipc.plugins.timeoutSecs ", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "accelerometer.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.nptest.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npswf32.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npctrl.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npqtplugin.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled ", false);
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
HKCU-Run-AdobeBridge - (no file)
HKCU-Run-msnmsgr - ~c:\program files\Windows Live\Messenger\msnmsgr.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-27 15:38
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
msnmsgr = ~ "c:\program files\Windows Live\Messenger\msnmsgr.exe" /background?

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\N360]
"ImagePath "= "\ "c:\program files\Norton 360\Engine\4.2.0.12\ccSvcHst.exe\" /s \ "N360\" /m \ "c:\program files\Norton 360\Engine\4.2.0.12\diMaster.dll\" /prefetch:1 "
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(5616)
c:\windows\System32\NLSData0009.dll
c:\windows\System32\NLSLexicons0009.dll
c:\windows\system32\btncopy.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\acer\Empowering Technology\eDataSecurity\eDSService.exe
c:\acer\Empowering Technology\eLock\Service\eLockServ.exe
c:\acer\Empowering Technology\eNet\eNet Service.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\acer\Mobility Center\MobilityService.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\SafeConnect\scManager.sys
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\acer\Empowering Technology\eSettings\Service\capuserv.exe
c:\acer\Empowering Technology\ePower\ePowerSvc.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\DllHost.exe
c:\windows\ehome\ehmsas.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2010-07-27 15:46:47 - machine was rebooted
ComboFix-quarantined-files.txt 2010-07-27 19:46

Pre-Run: 11,689,168,896 bytes free
Post-Run: 11,667,546,112 bytes free

- - End Of File - - 9B69537AE73CA55477C26EDD79B7506F

broni · 2010/07/27

You're very welcome

1. Please open Notepad

Click Start , then Run

Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:
Code:
Driver::
.1263280449


Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 "????r "=-
 "????????? "=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
 "DisableMonitoring "=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
 "DisableMonitoring "=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
 "DisableMonitoring "=-
3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

Equipper · 2010/07/27

Here you go and thanks...
&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&

ComboFix 10-07-26.04 - John N. W. Horace 07/27/2010 23:51:13.2.2 - x86
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6002.2.1252.1.1033.18.2037.829 [GMT -4:00]
Running from: c:\users\John N. W. Horace\Desktop\ComboFix.exe
Command switches used :: c:\users\John N. W. Horace\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_.1263280449

((((((((((((((((((((((((( Files Created from 2010-06-28 to 2010-07-28 )))))))))))))))))))))))))))))))
.

2010-07-28 04:01 . 2010-07-28 04:01 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-07-28 04:01 . 2010-07-28 04:01 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-07-28 04:01 . 2010-07-28 04:01 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-07-28 04:01 . 2010-07-28 04:01 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2010-07-28 00:06 . 2010-07-28 00:06 -------- d-----w- c:\program files\Xvid
2010-07-27 19:46 . 2010-07-28 04:08 -------- d-----w- c:\users\John N. W. Horace\AppData\Local\temp
2010-07-27 05:43 . 2010-07-27 05:43 -------- d-----w- c:\users\John N. W. Horace\AppData\Roaming\Malwarebytes
2010-07-27 05:43 . 2010-07-27 19:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-27 05:43 . 2010-07-27 05:43 -------- d-----w- c:\programdata\Malwarebytes
2010-07-25 06:11 . 2010-07-25 06:14 -------- d-----w- c:\users\John N. W. Horace\AppData\Local\Deployment
2010-07-25 06:11 . 2010-07-25 06:11 -------- d-----w- c:\users\John N. W. Horace\AppData\Local\Apps
2010-07-24 18:50 . 2010-07-24 18:50 -------- d-----w- c:\program files\iPod
2010-07-24 07:01 . 2010-07-24 07:01 -------- d-----w- c:\programdata\Last.fm
2010-07-24 07:00 . 2010-07-24 17:56 -------- d-----w- c:\users\John N. W. Horace\AppData\Local\Last.fm
2010-07-24 06:59 . 2010-07-24 07:00 -------- d-----w- c:\program files\Last.fm
2010-07-23 19:44 . 2010-07-23 19:44 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-07-21 21:19 . 2010-07-21 21:19 -------- d-----w- c:\program files\Common Files\xing shared
2010-07-04 17:30 . 2010-07-24 18:51 -------- d-----w- c:\program files\iTunes
2010-07-04 17:27 . 2010-07-04 17:29 -------- d-----w- c:\program files\QuickTime
2010-07-04 17:26 . 2010-07-04 17:26 -------- d-----w- c:\program files\Apple Software Update
2010-07-04 17:22 . 2010-07-04 17:22 -------- d-----w- c:\program files\Bonjour

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-28 04:11 . 2010-04-09 13:11 -------- d-----w- c:\users\John N. W. Horace\AppData\Roaming\Skype
2010-07-28 04:09 . 2010-04-09 13:16 -------- d-----w- c:\users\John N. W. Horace\AppData\Roaming\skypePM
2010-07-28 03:03 . 2010-01-12 10:27 -------- d-----w- c:\program files\SafeConnect
2010-07-24 18:50 . 2010-01-16 01:21 -------- d-----w- c:\program files\Common Files\Apple
2010-07-24 18:47 . 2010-07-24 18:47 73000 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe
2010-07-24 18:35 . 2010-07-24 07:01 683801 ----a-w- c:\programdata\Last.fm\Client\UninstWMP\unins000.exe
2010-07-24 18:35 . 2010-07-24 07:01 683801 ----a-w- c:\programdata\Last.fm\Client\UninstITW\unins000.exe
2010-07-24 14:50 . 2010-02-18 02:41 -------- d-----w- c:\programdata\NOS
2010-07-24 07:01 . 2010-07-24 07:01 108 ----a-w- c:\programdata\Last.fm\Client\uninst2.bat
2010-07-24 02:51 . 2010-04-04 05:13 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-07-24 02:51 . 2007-05-01 07:00 45200 ------w- c:\windows\system32\drivers\pxhelp20.sys
2010-07-23 19:44 . 2010-07-23 20:12 53632 ----a-w- c:\users\John N. W. Horace\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-07-21 21:20 . 2010-03-25 20:15 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll
2010-07-21 21:20 . 2010-03-25 20:15 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll
2010-07-21 21:20 . 2010-03-25 20:15 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll
2010-07-21 21:20 . 2010-03-25 20:15 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll
2010-07-21 21:20 . 2010-03-25 20:15 49152 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll
2010-07-21 21:20 . 2010-03-25 20:15 308808 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll
2010-07-21 21:20 . 2010-03-25 20:15 14848 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
2010-07-21 21:20 . 2010-03-14 08:21 341600 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
2010-07-21 21:20 . 2010-01-15 00:47 -------- d-----w- c:\program files\Common Files\Real
2010-07-21 21:19 . 2010-01-15 00:47 -------- d-----w- c:\program files\Real
2010-07-21 21:16 . 2010-07-21 21:16 493064 ----a-w- c:\users\John N. W. Horace\AppData\Roaming\Real\RealPlayer\setup\AU_setup16.exe
2010-07-15 07:15 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-07-13 15:40 . 2010-07-13 15:40 53248 ----a-r- c:\users\John N. W. Horace\AppData\Roaming\Microsoft\Installer\{3360D505-B0AA-4284-92DF-F872AF90A448}\ARPPRODUCTICON.exe
2010-07-05 07:27 . 2010-03-04 00:10 286720 ------w- c:\windows\Setup1.exe
2010-07-05 07:27 . 2010-03-04 00:10 73216 ----a-w- c:\windows\ST6UNST.EXE
2010-07-04 17:34 . 2010-02-23 19:40 -------- d-----w- c:\users\John N. W. Horace\AppData\Roaming\Apple Computer
2010-07-04 17:27 . 2010-01-16 01:23 -------- d-----w- c:\programdata\Apple Computer
2010-06-26 07:12 . 2010-01-14 04:33 -------- d-----w- c:\program files\Microsoft.NET
2010-06-19 05:46 . 2010-01-21 11:58 -------- d-----w- c:\users\John N. W. Horace\AppData\Roaming\U3
2010-06-16 19:15 . 2010-06-23 14:11 6536704 ----a-w- c:\programdata\WORDsearch\WORDsearch 9\Updates\NewFiles\ProgramFiles\WORDsearch.exe
2010-06-16 15:05 . 2010-06-16 15:05 -------- d-----w- c:\users\John N. W. Horace\AppData\Roaming\Tific
2010-06-14 16:00 . 2010-02-22 15:23 -------- d-----w- c:\users\John N. W. Horace\AppData\Roaming\FileZilla
2010-06-04 13:33 . 2010-02-11 06:52 130955 ----a-w- c:\windows\hpoins12.dat
2010-06-03 17:38 . 2010-06-23 14:12 6536192 ----a-w- c:\programdata\WORDsearch\WORDsearch 9\Updates\BackupFiles\ProgramFiles\WORDsearch.exe
2010-06-02 00:19 . 2010-06-02 00:19 -------- d-----w- c:\program files\Common Files\Java
2010-06-02 00:18 . 2010-06-02 00:19 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-06-02 00:18 . 2010-06-02 00:18 -------- d-----w- c:\program files\Java
2010-05-29 17:52 . 2010-04-10 15:18 1356 ----a-w- c:\users\John N. W. Horace\AppData\Local\d3d9caps.dat
2010-05-26 17:06 . 2010-06-09 03:37 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-26 16:54 . 2007-01-17 04:07 103994 ----a-w- c:\windows\hpqins01.dat
2010-05-26 14:47 . 2010-06-09 03:37 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-05-18 20:35 . 2010-05-18 20:35 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-05-18 20:35 . 2010-05-18 20:35 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-05-14 18:11 . 2010-01-12 04:37 141688 ----a-w- c:\users\John N. W. Horace\AppData\Local\GDIPFONTCACHEV1.DAT
2010-05-04 19:44 . 2010-05-04 19:44 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-05-04 05:59 . 2010-06-09 03:37 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 05:55 . 2010-06-09 03:37 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-05-04 05:55 . 2010-06-09 03:37 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-05-04 04:31 . 2010-06-09 03:37 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-05-01 14:13 . 2010-06-09 03:37 2037248 ----a-w- c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"????r "=" " [?]
"????????? "= "??????????????e" [?]
"Messenger (Yahoo!) "= "c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2010-03-19 5248312]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"ZipScript "= "d:\wordsearch 9\WORDsearch 9\ZipScript.exe" [2009-02-06 1390592]
"ISUSPM Startup "= "c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]
"ISUSPM "= "c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]
"Skype "= "c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]
"Google Update "= "c:\users\John N. W. Horace\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-07-25 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-03-19 421888]
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-07-21 202256]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]

c:\users\John N. W. Horace\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
wmitpsk.exe [2010-1-11 208896]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-1-13 528384]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
SafeConnect.lnk - c:\program files\SafeConnect\scClient.exe [2009-3-31 297240]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"UserId "= L7AKH?>
"UserIdNo "= 694 (0x2b6)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=c:\windows\System32\eNetHook.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2 "=hex(b):42,5f,28,d7,34,96,ca,01

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0402000.00C\SYMDS.SYS [2009-10-15 328752]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0402000.00C\SYMEFA.SYS [2010-04-22 173104]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20100709.001\BHDrvx86.sys [2010-05-22 691248]
S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0402000.00C\ccHPx86.sys [2010-02-26 501888]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100723.001\IDSvix86.sys [2010-05-28 344112]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0402000.00C\Ironx86.SYS [2010-04-29 116784]
S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\N360\0402000.00C\SYMTDIV.SYS [2010-05-06 339504]
S2 N360;Norton 360;c:\program files\Norton 360\Engine\4.2.0.12\ccSvcHst.exe [2010-02-26 126392]
S2 SCManager;SafeConnect Manager;c:\program files\SafeConnect\scManager.sys servicestart [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-05-27 102448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2010-07-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-409448064-391623352-931058572-1000Core.job
- c:\users\John N. W. Horace\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-25 06:14]

2010-07-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-409448064-391623352-931058572-1000UA.job
- c:\users\John N. W. Horace\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-25 06:14]

2010-07-28 c:\windows\Tasks\User_Feed_Synchronization-{BAF87866-2DCD-4E99-82D4-588C90CCA522}.job
- c:\windows\system32\msfeedssync.exe [2010-06-09 04:30]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://en.us.acer.yahoo.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
Trusted Zone: wordsearchbible.com\www
Trusted Zone: yahoo.com\www.en.us.acer
FF - ProfilePath - c:\users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - eBay
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-USfficial
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\IPSFFPlgn\components\IPSFFPl.dll
FF - component: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: c:\users\John N. W. Horace\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\users\John N. W. Horace\AppData\Local\Yahoo!\BrowserPlus\2.9.2\Plugins\npybrowserplus_2.9.2.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.lu ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.nu ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.nz ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbaam7a8h ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--p1ai ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbayh7gpa ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.tel ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.proxy.type ", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.buffer.cache.count ", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.buffer.cache.size ", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "dom.ipc.plugins.timeoutSecs ", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "accelerometer.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.nptest.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npswf32.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npctrl.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npqtplugin.dll ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled ", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-28 00:09
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\N360]
"ImagePath "= "\ "c:\program files\Norton 360\Engine\4.2.0.12\ccSvcHst.exe\" /s \ "N360\" /m \ "c:\program files\Norton 360\Engine\4.2.0.12\diMaster.dll\" /prefetch:1 "
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(5080)
c:\windows\System32\NLSLexicons0009.dll
c:\program files\Norton 360\Engine\4.2.0.12\ccVrTrst.dll
c:\program files\Norton 360\Engine\4.2.0.12\ccSet.dll
c:\windows\system32\btncopy.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\acer\Empowering Technology\eDataSecurity\eDSService.exe
c:\acer\Empowering Technology\eLock\Service\eLockServ.exe
c:\acer\Empowering Technology\eNet\eNet Service.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\acer\Mobility Center\MobilityService.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\SafeConnect\scManager.sys
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\acer\Empowering Technology\eSettings\Service\capuserv.exe
c:\acer\Empowering Technology\ePower\ePowerSvc.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\DllHost.exe
c:\windows\ehome\ehmsas.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\program files\Yahoo!\Messenger\ymsgr_tray.exe
c:\program files\Internet Explorer\IELowutil.exe
.
**************************************************************************
.
Completion time: 2010-07-28 00:14:48 - machine was rebooted
ComboFix-quarantined-files.txt 2010-07-28 04:14
ComboFix2.txt 2010-07-27 19:46

Pre-Run: 11,708,903,424 bytes free
Post-Run: 12,682,129,408 bytes free

- - End Of File - - FE3EDA867D8319F0425AA6B96869212C

broni · 2010/07/28

Good

Uninstall Combofix:
Go Start > Run [Vista users, go Start> "Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall "
Click OK (Vista users - press Enter).
Restart computer.

=============================================================

Download OTL to your Desktop.

* Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
* Under the Custom Scan box paste this in:

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\system32\spool\prtprocs\w32x86\*.tmp
%systemroot%\*. /mp /s
/md5start
/md5stop
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

* Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

Equipper · 2010/07/28

Once again I continue to thank you for your sustained efforts in helping me resolved this issue. Below are the logs and I have followed your instructions.

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^************************************************************
OTL logfile created on: 7/28/2010 4:23:48 PM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\John N. W. Horace\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 45.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 70.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 83.18 Gb Total Space | 11.61 Gb Free Space | 13.96% Space Free | Partition Type: NTFS
Drive D: | 58.06 Gb Total Space | 6.13 Gb Free Space | 10.55% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 298.09 Gb Total Space | 87.89 Gb Free Space | 29.48% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded

Computer Name: JOHNNWHORACE-PC
Current User Name: John N. W. Horace
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/07/28 16:20:08 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\John N. W. Horace\Desktop\OTL.exe
PRC - [2010/07/24 01:14:57 | 000,014,808 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\plugin-container.exe
PRC - [2010/07/24 01:14:56 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/07/21 17:18:37 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2010/06/10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/02/25 20:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton 360\Engine\4.2.0.12\ccsvchst.exe
PRC - [2010/01/12 06:27:07 | 000,297,240 | ---- | M] (Impulse Point, LLC) -- C:\Program Files\SafeConnect\SCClient.exe
PRC - [2010/01/12 06:27:06 | 000,128,280 | ---- | M] (Impulse Point, LLC) -- C:\Program Files\SafeConnect\scManager.sys
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/02/06 16:22:26 | 001,390,592 | ---- | M] (WORDsearch Corp.) -- D:\WORDsearch 9\WORDsearch 9\ZipScript.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/10/24 09:14:36 | 000,206,112 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
PRC - [2007/01/10 20:20:34 | 000,462,848 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
PRC - [2007/01/02 22:58:58 | 000,457,512 | ---- | M] (HiTRSUT) -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
PRC - [2007/01/02 20:46:52 | 000,024,576 | ---- | M] () -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
PRC - [2007/01/02 13:33:24 | 000,135,168 | ---- | M] (acer) -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
PRC - [2006/12/29 00:07:22 | 000,724,992 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eNet\eNMTray.exe
PRC - [2006/12/29 00:07:22 | 000,126,976 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eNet\eNet Service.exe
PRC - [2006/12/28 19:24:14 | 000,049,152 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
PRC - [2006/12/25 20:45:26 | 000,319,488 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
PRC - [2006/12/22 18:43:18 | 000,024,576 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
PRC - [2006/12/14 16:34:16 | 000,393,216 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
PRC - [2006/11/24 16:57:54 | 000,107,008 | ---- | M] () -- C:\Acer\Mobility Center\MobilityService.exe

========== Modules (SafeList) ==========

MOD - [2010/07/28 16:20:08 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\John N. W. Horace\Desktop\OTL.exe
MOD - [2010/05/14 01:35:01 | 000,415,088 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton 360\Engine\4.2.0.12\asoehook.dll
MOD - [2010/05/04 15:40:55 | 000,653,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_5090ab56bcba71c2\msvcr90.dll
MOD - [2010/05/04 15:40:55 | 000,569,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_5090ab56bcba71c2\msvcp90.dll
MOD - [2009/04/11 02:21:38 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll
MOD - [2008/01/19 03:33:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - [2010/06/10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/03/18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/25 20:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files\Norton 360\Engine\4.2.0.12\ccSvcHst.exe -- (N360)
SRV - [2010/01/12 06:27:06 | 000,128,280 | ---- | M] (Impulse Point, LLC) [Auto | Running] -- C:\Program Files\SafeConnect\scManager.sys -- (SCManager)
SRV - [2009/09/24 21:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/01/19 03:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/01/02 22:58:58 | 000,457,512 | ---- | M] (HiTRSUT) [Auto | Running] -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe -- (eDataSecurity Service)
SRV - [2007/01/02 20:46:52 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe -- (eSettingsService)
SRV - [2007/01/02 13:33:24 | 000,135,168 | ---- | M] (acer) [Auto | Running] -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe -- (WMIService)
SRV - [2006/12/29 00:07:22 | 000,126,976 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eNet\eNet Service.exe -- (eNet Service)
SRV - [2006/12/28 19:24:14 | 000,049,152 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe -- (eRecoveryService)
SRV - [2006/12/22 18:43:18 | 000,024,576 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe -- (eLockService)
SRV - [2006/11/24 16:57:54 | 000,107,008 | ---- | M] () [Auto | Running] -- C:\Acer\Mobility Center\MobilityService.exe -- (MobilityService)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\UIUSYS.SYS -- (UIUSys)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2010/07/13 20:32:46 | 001,362,608 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100728.002\NAVEX15.SYS -- (NAVEX15)
DRV - [2010/07/13 20:32:46 | 000,085,424 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100728.002\NAVENG.SYS -- (NAVENG)
DRV - [2010/06/16 15:25:57 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010/05/28 15:33:19 | 000,344,112 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100726.001\IDSvix86.sys -- (IDSVix86)
DRV - [2010/05/27 07:09:27 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2010/05/22 18:19:20 | 000,691,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20100709.001\BHDrvx86.sys -- (BHDrvx86)
DRV - [2010/05/06 00:01:59 | 000,339,504 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\Drivers\N360\0402000.00C\SYMTDIV.SYS -- (SYMTDIv)
DRV - [2010/05/04 15:44:05 | 000,124,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2010/04/29 01:03:51 | 000,116,784 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\N360\0402000.00C\Ironx86.SYS -- (SymIRON)
DRV - [2010/04/21 23:02:20 | 000,173,104 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\system32\drivers\N360\0402000.00C\SYMEFA.SYS -- (SymEFA)
DRV - [2010/04/21 22:29:50 | 000,325,680 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\System32\Drivers\N360\0402000.00C\SRTSP.SYS -- (SRTSP)
DRV - [2010/04/21 22:29:50 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\N360\0402000.00C\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2010/02/25 20:22:57 | 000,501,888 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\N360\0402000.00C\ccHPx86.sys -- (ccHP)
DRV - [2009/10/14 23:50:05 | 000,328,752 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\N360\0402000.00C\SYMDS.SYS -- (SymDS)
DRV - [2009/04/11 00:42:54 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/11/02 04:44:10 | 000,056,572 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2007/12/04 17:10:30 | 000,016,640 | ---- | M] (PalmSource, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PalmUSBD.sys -- (PalmUSBD)
DRV - [2007/01/13 04:30:08 | 000,006,144 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV - [2007/01/02 22:59:24 | 000,016,680 | ---- | M] (HiTRUST) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\PSDNServ.sys -- (PSDNServ)
DRV - [2007/01/02 22:59:20 | 000,060,712 | ---- | M] (HiTRUST) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\psdvdisk.sys -- (psdvdisk)
DRV - [2007/01/02 22:59:18 | 000,020,264 | ---- | M] (HiTRUST) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\psdfilter.sys -- (PSDFilter)
DRV - [2006/12/26 21:57:12 | 000,817,968 | ---- | M] (Bison Electronics. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\BisonC07.sys -- (Cam5607)
DRV - [2006/12/07 19:12:02 | 000,076,584 | ---- | M] () [Kernel | Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\int15.sys -- (int15)
DRV - [2006/12/01 01:38:00 | 001,655,464 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006/11/05 22:29:14 | 001,473,024 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx)
DRV - [2006/11/05 22:29:14 | 001,473,024 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\igdkmd32.sys -- (ialm)
DRV - [2006/11/02 09:29:38 | 000,021,264 | ---- | M] (Dritek System Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\DKbFltr.sys -- (DKbFltr)
DRV - [2006/11/02 09:27:36 | 000,020,112 | ---- | M] (Dritek System Inc.) [Kernel | System | Running] -- C:\Program Files\Launch Manager\DPortIO.sys -- (DritekPortIO)
DRV - [2006/11/02 05:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 05:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 05:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 05:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 05:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 05:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2006/11/02 05:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 05:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 05:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 05:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 05:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 05:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 05:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2006/11/02 05:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 05:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 05:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 05:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2006/11/02 05:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 05:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 05:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 05:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 05:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2006/11/02 05:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 05:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 05:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 05:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 05:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 05:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 05:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 05:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 05:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 05:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 05:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2006/11/02 05:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2006/11/02 05:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2006/11/02 04:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 04:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 04:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 04:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 04:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 04:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 03:41:49 | 000,200,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VSTAZL3.SYS -- (HSFHWAZL)
DRV - [2006/11/02 03:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 03:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2006/11/02 03:30:53 | 000,045,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2006/10/29 21:42:28 | 001,786,880 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2006/10/25 02:36:48 | 000,042,240 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ESD7SK.sys -- (ESDCR)
DRV - [2006/10/25 02:36:44 | 000,076,928 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ESM7SK.sys -- (ESMCR)
DRV - [2006/10/25 02:36:36 | 000,062,208 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\EMS7SK.sys -- (EMSCR)
DRV - [2006/10/22 23:17:32 | 000,179,896 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP)
DRV - [2006/10/17 23:09:26 | 000,986,624 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DPV.sys -- (HSF_DPV)
DRV - [2006/10/17 23:08:14 | 000,206,848 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWAZL.sys -- (HSXHWAZL)
DRV - [2006/10/17 23:08:04 | 000,659,968 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_CNXT.sys -- (winachsf)
DRV - [2006/08/04 05:39:10 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Bing "
FF - prefs.js..browser.search.defaulturl: "http://www.bing.com/search?FORM=IEFM1&q= "
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm "
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm "
FF - prefs.js..browser.search.param.yahoo-type: "${8} "
FF - prefs.js..browser.search.selectedEngine: "eBay "
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-USfficial "
FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.0.7
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.5
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:4.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {3ee8d0be-f450-4ef2-97b9-ac2222d14db3}:2.7.1.3
FF - prefs.js..extensions.enabledItems: {6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}:1.4.8
FF - prefs.js..keyword.URL: "http://www.bing.com/search?FORM=IEFM1&q= "

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/07/21 17:20:21 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\IPSFFPlgn\ [2010/05/27 11:37:19 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\coFFPlgn\ [2010/05/04 15:44:47 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/26 10:45:08 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/26 10:45:08 | 000,000,000 | ---D | M]

[2010/01/15 19:39:59 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Extensions
[2010/07/28 00:37:45 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\extensions
[2010/07/22 18:53:05 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2010/04/27 03:07:08 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/13 14:54:02 | 000,000,000 | ---D | M] (Free TV Bar c3 Toolbar) -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\extensions\{3ee8d0be-f450-4ef2-97b9-ac2222d14db3}
[2010/04/09 14:08:09 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/07/24 02:39:37 | 000,000,000 | ---D | M] (Fire.fm) -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\extensions\{6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}
[2010/02/19 22:43:43 | 000,002,163 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\searchplugins\bing.xml
[2010/06/08 11:30:18 | 000,000,931 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\searchplugins\conduit.xml
[2010/02/12 15:49:41 | 000,009,977 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\searchplugins\mywebsearch.xml
[2010/02/19 16:48:37 | 000,003,915 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\searchplugins\sweetim.xml
[2010/07/28 00:37:45 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/06/01 20:19:14 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/06/01 20:18:40 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/07/28 00:07:40 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\4.2.0.12\ipsbho.dll (Symantec Corporation)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [ISUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKCU..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [ZipScript] D:\WORDsearch 9\WORDsearch 9\ZipScript.exe (WORDsearch Corp.)
O4 - HKCU..\Run: [捁牥吠畯r] File not found
O4 - HKCU..\Run: [捁牥吠畯⁲敒業摮牥] File not found
O4 - Startup: C:\Users\John N. W. Horace\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wmitpsk.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: UserId = L7AKH?>
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: UserIdNo = 694
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: wordsearchbible.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: yahoo.com ([www.en.us.acer] https in Trusted sites)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.4.14 192.168.4.31
O18 - Protocol\Handler\lbxfile {56831180-F115-11d2-B6AA-00104B2B9943} - C:\Program Files\Libronix DLS\System\FileProt.dll (Libronix Corporation)
O18 - Protocol\Handler\lbxres {24508F1B-9E94-40EE-9759-9AF5795ADF52} - C:\Program Files\Libronix DLS\System\ResProt.dll (Libronix Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\Windows\System32\eNetHook.dll) - C:\Windows\System32\eNetHook.dll (acer)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\Acer01.JPG
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\Acer01.JPG
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: aux - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\Windows\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.ac3acm - C:\Windows\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.imaadpcm - C:\Windows\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.msadpcm - C:\Windows\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\Windows\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\Windows\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.DIVX - C:\Windows\System32\divx.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: vidc.i420 - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: VIDC.IYUV - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\Windows\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\Windows\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)
Drivers32: VIDC.UYVY - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: VIDC.YUY2 - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yv12 - C:\Windows\System32\yv12vfw.dll (www.helixcommunity.org)
Drivers32: VIDC.YVU9 - C:\Windows\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\Windows\System32\msacm32.drv (Microsoft Corporation)

Equipper · 2010/07/28

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 90 Days ==========

[2010/07/28 16:20:06 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\John N. W. Horace\Desktop\OTL.exe
[2010/07/28 00:14:51 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010/07/28 00:14:51 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\temp
[2010/07/28 00:13:51 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2010/07/27 20:06:18 | 000,000,000 | ---D | C] -- C:\Program Files\Xvid
[2010/07/27 15:15:54 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010/07/27 01:43:53 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Roaming\Malwarebytes
[2010/07/27 01:43:33 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/27 01:43:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010/07/26 10:47:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Windows Genuine Advantage
[2010/07/25 02:11:41 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\Deployment
[2010/07/25 02:11:41 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\Apps
[2010/07/24 14:50:51 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2010/07/24 12:41:49 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\Documents\Skylook
[2010/07/24 03:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Last.fm
[2010/07/24 03:00:07 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\Last.fm
[2010/07/24 02:59:59 | 000,000,000 | ---D | C] -- C:\Program Files\Last.fm
[2010/07/23 15:44:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe AIR
[2010/07/21 17:19:36 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\xing shared
[2010/07/20 20:51:28 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\Documents\Beckah Shae - Life (2010)
[2010/07/04 13:30:35 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2010/07/04 13:27:10 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010/07/04 13:26:29 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2010/07/04 13:22:08 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2010/06/16 11:05:58 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Roaming\Tific
[2010/06/10 10:41:12 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\Super Internet TV
[2010/06/01 20:19:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/06/01 20:18:24 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2010/05/27 18:58:27 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\Documents\Kennedy Emetulu
[2010/05/27 18:23:06 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\Documents\Moses Ebe Ochonu
[2010/05/27 07:24:48 | 000,000,000 | ---D | C] -- C:\ProgramData\WEBREG
[2010/05/16 14:03:16 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\ElevatedDiagnostics
[2010/05/16 13:58:54 | 000,000,000 | ---D | C] -- C:\Windows\System32\WindowsPowerShell
[2010/05/16 13:55:42 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft ATS
[2010/05/14 20:13:22 | 000,000,000 | ---D | C] -- C:\HiTRUSTDrive
[2010/05/10 15:59:36 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\CrashDumps
[2010/05/10 08:55:59 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2010/05/04 15:44:22 | 000,124,976 | ---- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\SYMEVENT.SYS
[2010/05/04 15:44:05 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec
[2010/05/04 15:42:42 | 000,000,000 | ---D | C] -- C:\Program Files\Norton 360
[2010/05/04 15:38:31 | 000,000,000 | ---D | C] -- C:\Program Files\NortonInstaller
[2010/05/04 03:05:46 | 000,000,000 | R--D | C] -- C:\Program Files\Norton Support
[2010/05/04 03:02:36 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\Symantec
[2010/04/30 13:29:25 | 000,000,000 | ---D | C] -- C:\ProgramData\HP Product Assistant
[2007/01/13 04:36:13 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\Interop.Shell32.dll

========== Files - Modified Within 90 Days ==========

[2010/07/28 16:24:45 | 001,844,444 | ---- | M] () -- C:\Windows\System32\drivers\N360\0402000.00C\Cat.DB
[2010/07/28 16:22:58 | 006,029,312 | -HS- | M] () -- C:\Users\John N. W. Horace\ntuser.dat
[2010/07/28 16:20:08 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\John N. W. Horace\Desktop\OTL.exe
[2010/07/28 16:19:00 | 000,000,956 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-409448064-391623352-931058572-1000UA.job
[2010/07/28 16:15:21 | 000,707,392 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/07/28 16:15:21 | 000,607,406 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/07/28 16:15:21 | 000,105,014 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/07/28 16:14:36 | 000,000,446 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{BAF87866-2DCD-4E99-82D4-588C90CCA522}.job
[2010/07/28 16:08:38 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/07/28 16:08:37 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/07/28 16:08:31 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/07/28 16:08:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/07/28 16:08:19 | 2137,120,768 | -HS- | M] () -- C:\hiberfil.sys
[2010/07/28 16:06:31 | 000,524,288 | -HS- | M] () -- C:\Users\John N. W. Horace\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/07/28 16:06:31 | 000,065,536 | -HS- | M] () -- C:\Users\John N. W. Horace\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/07/28 16:05:57 | 002,719,937 | -H-- | M] () -- C:\Users\John N. W. Horace\AppData\Local\IconCache.db
[2010/07/28 14:38:31 | 000,002,627 | ---- | M] () -- C:\Users\John N. W. Horace\Desktop\Microsoft Office Word 2007.lnk
[2010/07/28 02:19:00 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-409448064-391623352-931058572-1000Core.job
[2010/07/28 00:07:52 | 000,000,215 | ---- | M] () -- C:\Windows\system.ini
[2010/07/28 00:07:40 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010/07/27 20:11:03 | 000,019,968 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/27 02:36:02 | 303,483,214 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010/07/25 02:15:55 | 000,002,106 | ---- | M] () -- C:\Users\John N. W. Horace\Desktop\Google Chrome.lnk
[2010/07/25 02:15:55 | 000,002,068 | ---- | M] () -- C:\Users\John N. W. Horace\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/07/24 23:23:11 | 001,546,752 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\relevance_of_gender_statistics_in_policy_making_in_liberia.doc
[2010/07/24 23:21:37 | 003,687,936 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Population Censuses in Post-Conflict Countries-The Liberian Experience-150210.ppt
[2010/07/24 14:51:59 | 000,001,804 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010/07/24 03:00:03 | 000,000,737 | ---- | M] () -- C:\Users\Public\Desktop\Last.fm.lnk
[2010/07/21 17:20:22 | 000,000,847 | ---- | M] () -- C:\Users\Public\Desktop\RealPlayer SP.lnk
[2010/07/21 17:18:42 | 000,278,528 | ---- | M] (Real Networks, Inc) -- C:\Windows\System32\pncrt.dll
[2010/07/21 00:17:52 | 000,001,853 | ---- | M] () -- C:\Users\John N. W. Horace\Desktop\Logos Bible Software 4.lnk
[2010/07/20 21:52:02 | 000,011,878 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\My New Passwords.docx
[2010/07/20 21:44:49 | 000,002,627 | ---- | M] () -- C:\Users\John N. W. Horace\Desktop\Microsoft Office Word 2007 (2).lnk
[2010/07/08 22:34:19 | 000,026,073 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Re.docx
[2010/07/07 23:23:57 | 002,503,210 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\blackberry_bold_9650_smartphone_ug.pdf
[2010/07/05 03:29:41 | 000,002,609 | ---- | M] () -- C:\Users\John N. W. Horace\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Excel 2007.lnk
[2010/07/04 23:33:49 | 000,065,348 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Local\rx_audio.Cache
[2010/07/04 23:33:49 | 000,002,232 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Local\rx_image.Cache
[2010/07/04 13:27:40 | 000,001,730 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/07/02 19:21:33 | 000,948,556 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\LoaderBackup-(2010-07-02).ipd
[2010/07/01 11:06:40 | 000,010,256 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\My NVS profile signature.docx
[2010/06/30 01:18:04 | 005,375,603 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\The Importance of Proper Fit.docx
[2010/06/30 01:15:53 | 000,001,891 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/06/25 08:11:10 | 000,001,752 | ---- | M] () -- C:\Users\John N. W. Horace\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/06/25 08:11:10 | 000,001,728 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010/06/18 12:23:40 | 000,400,896 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\TIPS FOR BUYING REAL ESTATE IN LAGOS.doc
[2010/06/18 11:07:43 | 000,129,536 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Why Does God Not Intervene.doc
[2010/06/09 03:33:39 | 002,393,576 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/06/09 00:35:34 | 001,286,232 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\TIPS FOR BUYING REAL ESTATE IN LAGOS.docx
[2010/06/04 09:33:00 | 000,130,955 | ---- | M] () -- C:\Windows\hpoins12.dat
[2010/06/04 09:19:26 | 000,000,278 | ---- | M] () -- C:\Windows\win.ini
[2010/06/01 14:53:50 | 000,015,151 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Praise.docx
[2010/06/01 14:53:24 | 000,018,310 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Worship.docx
[2010/06/01 12:51:53 | 000,121,713 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Doc1.docx
[2010/06/01 12:49:59 | 000,121,709 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\pastor's accountable reimbursement form.docx
[2010/05/29 13:52:18 | 000,001,356 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Local\d3d9caps.dat
[2010/05/28 13:20:18 | 000,017,816 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Charles Hodge.docx
[2010/05/28 13:18:34 | 000,011,141 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\A Creedal Statement.docx
[2010/05/28 12:59:00 | 000,013,601 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Charles Hodg1.docx
[2010/05/27 06:55:39 | 000,002,100 | ---- | M] () -- C:\Users\Public\Desktop\Norton 360.lnk
[2010/05/26 12:54:40 | 000,103,994 | ---- | M] () -- C:\Windows\hpqins01.dat
[2010/05/26 12:51:34 | 000,001,976 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2010/05/24 00:04:35 | 000,012,711 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\The three biblical pilgrimage festivals are Pesach.docx
[2010/05/24 00:04:02 | 000,316,504 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\L4 Bibliography AA.docx
[2010/05/19 18:51:02 | 000,035,096 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\English Bibles.docx
[2010/05/19 13:06:20 | 000,022,742 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\PRINCETON is a pleasant little town of fully six thousand inhabitants.docx
[2010/05/17 14:53:57 | 000,035,501 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\From.docxCharles Hodge.docx
[2010/05/16 13:56:18 | 002,818,048 | ---- | M] () -- C:\Windows\ocsetup_install_MicrosoftWindowsPowerShell.etl
[2010/05/16 13:56:18 | 000,196,608 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.perf
[2010/05/16 13:56:18 | 000,065,536 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.dpx
[2010/05/15 23:40:38 | 000,020,485 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Hodge1.docx22.docx
[2010/05/14 14:11:21 | 000,141,688 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Local\GDIPFONTCACHEV1.DAT
[2010/05/14 13:02:55 | 000,020,608 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Princeton Theology.docx
[2010/05/14 02:40:03 | 000,000,172 | ---- | M] () -- C:\Windows\System32\drivers\N360\0402000.00C\isolate.ini
[2010/05/13 12:07:59 | 000,013,090 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\In America.docx
[2010/05/12 09:15:29 | 000,013,733 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Charles Hodge Revisited.docx
[2010/05/12 09:15:20 | 000,013,188 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\HODGE.docx
[2010/05/11 09:57:57 | 000,011,511 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Bibliograph3.docx
[2010/05/11 09:57:18 | 000,011,289 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Introduction.docx
[2010/05/11 08:54:43 | 000,011,391 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Introduction.docxClass proj systematic theol 11.docx
[2010/05/10 12:48:54 | 000,011,840 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Annotated Bibliograph1.docx
[2010/05/10 12:48:43 | 000,012,448 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Annotated Bibliography.docx
[2010/05/10 12:48:34 | 000,010,801 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Erickson.docx
[2010/05/10 09:14:24 | 000,026,498 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Christology.docxjnwh.docx
[2010/05/10 08:37:15 | 000,383,086 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Christology.tif
[2010/05/10 07:40:25 | 000,017,253 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Theological Anthropology.docx
[2010/05/10 00:58:47 | 000,000,162 | -H-- | M] () -- C:\Users\John N. W. Horace\Documents\~$eological Anthropology Revised.docx
[2010/05/09 18:06:29 | 000,001,495 | ---- | M] () -- C:\Users\John N. W. Horace\Desktop\My.Master.Bibliography.File - Shortcut.lnk
[2010/05/08 15:12:13 | 000,983,965 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\LoaderBackup-(2010-05-08).ipd
[2010/05/07 16:06:10 | 000,030,368 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Theological Anthropology Revised.docx
[2010/05/06 15:22:41 | 000,012,213 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\My Learning and Action Plan.docx
[2010/05/06 00:01:59 | 000,339,504 | ---- | M] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0402000.00C\symtdiv.sys
[2010/05/06 00:01:43 | 000,001,473 | ---- | M] () -- C:\Windows\System32\drivers\N360\0402000.00C\symnetv.inf
[2010/05/06 00:01:43 | 000,001,445 | ---- | M] () -- C:\Windows\System32\drivers\N360\0402000.00C\symnet.inf
[2010/05/05 07:45:40 | 000,043,100 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Functions & Roles car dev.tif
[2010/05/04 15:44:05 | 000,124,976 | ---- | M] (Symantec Corporation) -- C:\Windows\System32\drivers\SYMEVENT.SYS
[2010/05/04 15:44:05 | 000,007,443 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.CAT
[2010/05/04 15:44:05 | 000,000,805 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.INF
[2010/05/04 10:45:37 | 000,033,814 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Theological Anthropolog1.docxClassproject.docx
[2010/05/04 02:39:36 | 000,015,520 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Christology.docx
[2010/05/02 16:16:01 | 000,013,278 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Matthew contains well over sixty explicit quotations from the OT.docx

========== Files Created - No Company Name ==========

[2099/01/01 12:00:00 | 000,001,744 | -H-- | C] () -- C:\ProgramData\luvilogu
[2010/07/27 20:06:18 | 000,077,824 | ---- | C] () -- C:\Windows\System32\xvid.ax
[2010/07/27 02:28:34 | 2137,120,768 | -HS- | C] () -- C:\hiberfil.sys
[2010/07/25 02:15:55 | 000,002,106 | ---- | C] () -- C:\Users\John N. W. Horace\Desktop\Google Chrome.lnk
[2010/07/25 02:15:55 | 000,002,068 | ---- | C] () -- C:\Users\John N. W. Horace\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/07/25 02:14:51 | 000,000,956 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-409448064-391623352-931058572-1000UA.job
[2010/07/25 02:14:48 | 000,000,904 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-409448064-391623352-931058572-1000Core.job
[2010/07/24 23:23:10 | 001,546,752 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\relevance_of_gender_statistics_in_policy_making_in_liberia.doc
[2010/07/24 23:21:31 | 003,687,936 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Population Censuses in Post-Conflict Countries-The Liberian Experience-150210.ppt
[2010/07/24 14:51:59 | 000,001,804 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010/07/24 03:00:03 | 000,000,737 | ---- | C] () -- C:\Users\Public\Desktop\Last.fm.lnk
[2010/07/21 17:20:22 | 000,000,847 | ---- | C] () -- C:\Users\Public\Desktop\RealPlayer SP.lnk
[2010/07/20 21:44:49 | 000,002,627 | ---- | C] () -- C:\Users\John N. W. Horace\Desktop\Microsoft Office Word 2007 (2).lnk
[2010/07/18 11:15:59 | 000,011,878 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\My New Passwords.docx
[2010/07/08 22:34:15 | 000,026,073 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Re.docx
[2010/07/07 23:23:56 | 002,503,210 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\blackberry_bold_9650_smartphone_ug.pdf
[2010/07/04 22:29:46 | 000,065,348 | ---- | C] () -- C:\Users\John N. W. Horace\AppData\Local\rx_audio.Cache
[2010/07/04 13:27:39 | 000,001,730 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/07/02 19:21:33 | 000,948,556 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\LoaderBackup-(2010-07-02).ipd
[2010/07/01 11:06:38 | 000,010,256 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\My NVS profile signature.docx
[2010/06/30 01:17:25 | 005,375,603 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\The Importance of Proper Fit.docx
[2010/06/18 12:23:38 | 000,400,896 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\TIPS FOR BUYING REAL ESTATE IN LAGOS.doc
[2010/06/18 11:07:41 | 000,129,536 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Why Does God Not Intervene.doc
[2010/06/09 00:35:30 | 001,286,232 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\TIPS FOR BUYING REAL ESTATE IN LAGOS.docx
[2010/06/01 14:53:49 | 000,015,151 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Praise.docx
[2010/06/01 14:53:24 | 000,018,310 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Worship.docx
[2010/06/01 12:51:52 | 000,121,713 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Doc1.docx
[2010/06/01 12:49:57 | 000,121,709 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\pastor's accountable reimbursement form.docx
[2010/05/28 12:58:58 | 000,013,601 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Charles Hodg1.docx
[2010/05/26 12:51:33 | 000,001,976 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2010/05/25 00:19:12 | 000,017,816 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Charles Hodge.docx
[2010/05/24 00:04:34 | 000,012,711 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\The three biblical pilgrimage festivals are Pesach.docx
[2010/05/24 00:04:00 | 000,316,504 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\L4 Bibliography AA.docx
[2010/05/19 18:51:01 | 000,035,096 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\English Bibles.docx
[2010/05/19 13:06:20 | 000,022,742 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\PRINCETON is a pleasant little town of fully six thousand inhabitants.docx
[2010/05/17 14:53:56 | 000,035,501 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\From.docxCharles Hodge.docx
[2010/05/16 13:55:45 | 002,818,048 | ---- | C] () -- C:\Windows\ocsetup_install_MicrosoftWindowsPowerShell.etl
[2010/05/16 13:55:45 | 000,196,608 | ---- | C] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.perf
[2010/05/16 13:55:45 | 000,065,536 | ---- | C] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.dpx
[2010/05/15 23:40:27 | 000,020,485 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Hodge1.docx22.docx
[2010/05/14 13:02:54 | 000,020,608 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Princeton Theology.docx
[2010/05/13 12:07:20 | 000,013,090 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\In America.docx
[2010/05/12 09:15:28 | 000,013,733 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Charles Hodge Revisited.docx
[2010/05/12 09:15:19 | 000,013,188 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\HODGE.docx
[2010/05/11 09:57:56 | 000,011,511 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Bibliograph3.docx
[2010/05/11 09:57:17 | 000,011,289 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Introduction.docx
[2010/05/10 12:48:53 | 000,011,840 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Annotated Bibliograph1.docx
[2010/05/10 12:48:43 | 000,012,448 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Annotated Bibliography.docx
[2010/05/10 12:48:34 | 000,010,801 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Erickson.docx
[2010/05/10 08:51:55 | 000,026,498 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Christology.docxjnwh.docx
[2010/05/10 08:37:14 | 000,383,086 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Christology.tif
[2010/05/10 00:58:47 | 000,000,162 | -H-- | C] () -- C:\Users\John N. W. Horace\Documents\~$eological Anthropology Revised.docx
[2010/05/08 15:12:13 | 000,983,965 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\LoaderBackup-(2010-05-08).ipd
[2010/05/07 16:40:41 | 000,030,368 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Theological Anthropology Revised.docx
[2010/05/06 15:22:34 | 000,012,213 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\My Learning and Action Plan.docx
[2010/05/05 07:45:39 | 000,043,100 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Functions & Roles car dev.tif
[2010/05/04 15:44:22 | 000,007,443 | ---- | C] () -- C:\Windows\System32\drivers\SYMEVENT.CAT
[2010/05/04 15:44:22 | 000,000,805 | ---- | C] () -- C:\Windows\System32\drivers\SYMEVENT.INF
[2010/05/04 15:43:39 | 000,002,100 | ---- | C] () -- C:\Users\Public\Desktop\Norton 360.lnk
[2010/05/04 11:08:42 | 000,011,141 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\A Creedal Statement.docx
[2010/05/04 10:45:31 | 000,011,391 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Introduction.docxClass proj systematic theol 11.docx
[2010/05/04 02:39:26 | 000,033,814 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Theological Anthropolog1.docxClassproject.docx
[2010/05/02 16:15:58 | 000,013,278 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Matthew contains well over sixty explicit quotations from the OT.docx
[2010/04/09 14:14:19 | 000,000,094 | ---- | C] () -- C:\Windows\family.ini
[2010/01/26 23:32:24 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2010/01/26 23:32:24 | 000,819,200 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2010/01/26 23:32:24 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2010/01/26 23:32:22 | 000,010,752 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2010/01/26 23:32:22 | 000,000,547 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll.manifest
[2010/01/22 19:20:33 | 000,181,760 | ---- | C] () -- C:\Windows\System32\patchw32.dll
[2010/01/22 19:20:33 | 000,116,736 | ---- | C] () -- C:\Windows\System32\patchw.dll
[2010/01/22 19:20:33 | 000,058,280 | ---- | C] () -- C:\Windows\System32\bwntsend.dll
[2010/01/22 19:20:33 | 000,058,280 | ---- | C] () -- C:\Windows\System32\bwnthook.dll
[2010/01/22 19:20:33 | 000,055,808 | ---- | C] () -- C:\Windows\System32\zlib1.dll
[2010/01/22 19:20:32 | 007,533,568 | ---- | C] () -- C:\Windows\System32\bwbits80.dll
[2010/01/15 10:03:57 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010/01/12 01:54:38 | 000,000,092 | ---- | C] () -- C:\Windows\CLEANUP.INI
[2010/01/12 00:36:45 | 000,000,037 | ---- | C] () -- C:\Windows\Acer.ini
[2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2007/01/13 15:40:25 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN4.dll
[2007/01/13 04:55:30 | 000,198,144 | ---- | C] () -- C:\Windows\System32\_psisdecd.dll
[2007/01/13 04:45:52 | 000,076,584 | ---- | C] () -- C:\Windows\System32\drivers\int15.sys
[2007/01/13 04:45:52 | 000,015,656 | ---- | C] () -- C:\Windows\System32\drivers\int15_64.sys
[2007/01/13 04:44:55 | 000,065,536 | ---- | C] () -- C:\Windows\System32\NATTraversal.dll
[2007/01/13 04:36:14 | 000,331,776 | ---- | C] () -- C:\Windows\System32\ScrollBarLib.dll
[2007/01/13 04:23:47 | 000,356,352 | ---- | C] () -- C:\Windows\EMCRI.dll
[2007/01/13 01:42:32 | 000,000,099 | ---- | C] () -- C:\Windows\Alaunch.ini
[2007/01/13 01:42:27 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1114.dll
[2007/01/13 01:42:27 | 000,053,248 | ---- | C] () -- C:\Windows\System32\oemdspif.dll
[2007/01/13 01:42:24 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2007/01/13 01:42:24 | 000,077,824 | ---- | C] () -- C:\Windows\System32\hccutils.dll
[2007/01/13 01:41:21 | 000,015,190 | ---- | C] () -- C:\Windows\M2000T07.ini
[2007/01/02 22:54:14 | 000,266,240 | ---- | C] () -- C:\Windows\System32\NotesExtmngr.dll
[2007/01/02 22:53:54 | 000,204,800 | ---- | C] () -- C:\Windows\System32\NotesActnMenu.dll
[2007/01/02 22:53:20 | 000,086,016 | ---- | C] () -- C:\Windows\System32\MSNSpook.dll
[2007/01/02 22:52:40 | 000,037,376 | ---- | C] () -- C:\Windows\System32\MSNChatHook.dll
[2007/01/02 22:52:28 | 000,028,672 | ---- | C] () -- C:\Windows\System32\BatchCrypto.dll
[2007/01/02 22:52:26 | 000,073,728 | ---- | C] () -- C:\Windows\System32\APISlice.dll
[2007/01/02 22:52:18 | 000,063,488 | ---- | C] () -- C:\Windows\System32\ShowErrMsg.dll
[2006/12/25 19:44:48 | 000,022,016 | ---- | C] () -- C:\Windows\System32\MailFormat_U.dll
[2006/11/03 17:25:56 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:25:21 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2001/12/26 19:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll
[2001/11/14 12:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
[2001/09/04 02:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll
[2001/07/30 19:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll
[2001/07/24 01:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll

========== LOP Check ==========

[2010/01/12 02:35:58 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\Acer
[2010/02/17 23:09:41 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/06/14 12:00:51 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\FileZilla
[2010/04/09 14:14:19 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\HotSync
[2010/01/12 02:35:56 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\Leadertech
[2010/01/12 21:14:28 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\Libronix DLS
[2010/04/04 01:51:22 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\Research In Motion
[2010/06/16 11:05:58 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\Tific
[2010/04/27 02:45:52 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\Titanium Gears
[2010/07/28 16:06:54 | 000,032,560 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010/07/28 16:14:36 | 000,000,446 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{BAF87866-2DCD-4E99-82D4-588C90CCA522}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2007/01/13 04:40:10 | 000,003,269 | ---- | M] () -- C:\-20070113.log
[2010/04/01 00:57:06 | 000,002,853 | ---- | M] () -- C:\additdiag.txt
[2006/09/18 17:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2009/04/11 02:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2007/01/13 01:43:23 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2010/07/28 00:14:49 | 000,021,577 | ---- | M] () -- C:\ComboFix.txt
[2006/09/18 17:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2010/07/28 16:08:19 | 2137,120,768 | -HS- | M] () -- C:\hiberfil.sys
[2010/03/19 15:39:20 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/03/19 15:39:20 | 000,000,007 | ---- | M] () -- C:\ISACER.id
[2010/03/19 15:39:20 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2010/07/28 16:08:18 | 2450,919,424 | -HS- | M] () -- C:\pagefile.sys
[2007/01/13 04:16:05 | 000,000,284 | ---- | M] () -- C:\RHDSetup.log
[2007/01/13 04:32:01 | 000,000,178 | ---- | M] () -- C:\setup.log
[2007/01/13 04:49:47 | 000,000,000 | ---- | M] () -- C:\Trace.log

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2006/12/29 10:57:18 | 000,273,920 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\hpzpp4v2.dll
[2006/11/02 08:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 20:58:12 | 000,030,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/11/02 08:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 08:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 08:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2010/01/15 12:53:12 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/04/11 02:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2009/04/11 02:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2006/11/02 06:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 06:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 06:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 06:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 06:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %systemroot%\system32\user32.dll /md5 >
[2009/04/11 02:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/01/19 03:37:09 | 000,179,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\ws2_32.dll

< %systemroot%\system32\ws2help.dll /md5 >
[2006/11/02 05:44:30 | 000,004,608 | ---- | M] (Microsoft Corporation) MD5=17C0671BF57057108A6D949510EE42C8 -- C:\Windows\System32\ws2help.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Yoruba Tradition.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\voo.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\URL.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\uncatalogued resources for Libronix.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\uncatalogued resources for Libronix.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Theological Anthropology.doc2.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\The Yoruba family.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\thd_handbook_08[1].pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\thd_doctoral_language_requirements[1].pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Stress Management_ How to Reduce, Prevent, and Cope with Stress.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Skills and Satisfactions List cardev2.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Sentence Completion cardev2.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\salarystudy.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\saints in exile 6.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\saints in exile 5.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\saints in exile 4.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Resume.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Resume of JNWHorace.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\resources abc 10413.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Resources 081209(1).xls:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Recommended Books for Leadership.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Real Estate Topic Library (Before You Buy Any Land Or Property) - Nairaland.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\readme.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Preventing Burnout_ Signs, Symptoms, Causes, and Coping Strategies.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Personal Book Builder Tutorial.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\pandacodedoc.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Oyedepo.Dr David !Satan Get Lost[1].pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Obsessive-Compulsive Disorder (OCD)_ Symptoms, Behavior, and Treatment.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Norton Product Key.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\nigeria.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\My Resume.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\My Libronix Library 12-15-2009.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Motivating Values List cardev4.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\mo.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\ME travel seminar Itinerary and registration form.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\logos3quickstart.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Limits of Confidentiality cardev.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Liberia[1].pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Letter from a Birmingham Jail [King, Jr.].pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\How to Stop Worrying_ Self-Help for Anxiety Relief.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\How To Calculate The Price of a C of O and Governor's Consent In Lagos Yours.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Health History cardev5.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\hands_on_guide_to_streaming_media_second_edition_an_introduction_to_delivering_on_demand_media.9780240808635.34861.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Guide.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\God's Purpose and Agenda for my Life.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\God's Purpose and Agenda for my Life.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Glossary_of_Theological_Terms.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Generalized Anxiety Disorder (GAD)_ Symptoms, Treatment, and Self-Help.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Functions & Roles car dev.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Flash.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Facebook _ Tonia Horace Thanks to all who responded and much appreciation fo.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Facebook _ Facebook Site Governance_ Facebook's Privacy Policy - Full Versio.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Ethical Disclosure car dev 7.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Ejiro2.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Ejiro1.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\DOCUMENTING VERBATIMS FOR FIELD EDUCATION.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Details_of_Theologians.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\cover.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Churchlink - STRESS AND BURNOUT IN MINISTRY.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Christian Counseling.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\chathistory.doc lateesha.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Chapter_1.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\BlackBerry_Tour_9630_Smartphone-User_Guide-T643442-643442-0203014428-001-5.0-US.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\BlackBerry_Tour_9630_Smartphone-Learn_More--646527-1127024523-001-5.0-US.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\BlackBerry_Messenger-User_Guide--903196-1111023712-001-5.0-US.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Biographical_Ministry_Sketch.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Bibliograph2.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Biblical Hebrew.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Barr_Reading the book of Revelation - a resource for students.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\BandEquipmentFinal(1).xls:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\A-Z Of The Do’s And Don’ts Of Buying A Land Or Property In Lagos - Nairaland.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Autobiographical Statement.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Apologetics (Theology).txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Anxiety Attacks and Disorders_ Signs, Symptoms, and Treatment.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\716516.pdfIgala1.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\714903.pdfIgara.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\537544.pdfigala1212.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\2009-2010 GUIDELINES+FOR+WRITING+VERBATIMS[1].doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\180294.pdfIGALA123.pdf:Roxio EMC Stream
@Alternate Data Stream - 351398 bytes -> C:\Users\John N. W. Horace\AppData\Roaming\desktop.ini:init
< End of report >

Equipper · 2010/07/28

OTL Extras logfile created on: 7/28/2010 4:23:48 PM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\John N. W. Horace\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 45.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 70.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 83.18 Gb Total Space | 11.61 Gb Free Space | 13.96% Space Free | Partition Type: NTFS
Drive D: | 58.06 Gb Total Space | 6.13 Gb Free Space | 10.55% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 298.09 Gb Total Space | 87.89 Gb Free Space | 29.48% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded

Computer Name: JOHNNWHORACE-PC
Current User Name: John N. W. Horace
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.exe [@ = exefile] -- Reg Error: Key error. File not found
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"FirstRunDisabled" = 0
"UacDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe" = C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu -- (Acer Inc.)
"C:\Acer\Empowering Technology\eDataSecurity\encryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption -- (HiTRUST)
"C:\Acer\Empowering Technology\eDataSecurity\decryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled:decryption -- (HiTRUST)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{729A3026-3290-4B3A-94FB-4C52C3900600}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{039EC7C7-F79C-4771-993B-A007EECE053F}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{14CF3EA4-B086-492F-9488-8C564D234FB0}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{16AE7F90-71DF-45AD-8572-3401CC0F5E19}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{3958BCB1-778A-4AD6-AE22-77B2E58344FA}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{9DD875FE-78F0-4301-A80C-729BFF3F3125}" = protocol=6 | dir=in | app=c:\program files\acer arcade deluxe\acer arcade deluxe\mce deluxe suite.exe |
"{A8457775-0BA5-4B04-99F4-1CAEC6B8E5BC}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{CAB0C2F9-5BD9-45D8-8459-9CF716217837}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D889881C-2F8A-46CD-89FF-820D08F25743}" = protocol=17 | dir=in | app=c:\program files\acer arcade deluxe\acer arcade deluxe\mce deluxe suite.exe |
"{D9BD54E2-04C7-4B2F-A88E-3A7D4B9B82E9}" = protocol=6 | dir=in | app=c:\users\john n. w. horace\appdata\local\temp\rarsfx0\symnrt.exe |
"{E1E04B23-EA73-4773-B135-E05D90DFECA6}" = protocol=17 | dir=in | app=c:\users\john n. w. horace\appdata\local\temp\rarsfx0\symnrt.exe |
"{F95219BC-4234-4E34-9D31-EEB0D3D729C6}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"TCP Query User{BD2E0240-B0E5-48E1-98EC-60FCFD986573}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{D75CC5BB-05DD-4F5C-BD5F-CB2CFEA06AC9}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"TCP Query User{DE808AA4-F08E-4312-960E-9FCEE2D65137}C:\program files\quicktime\quicktimeplayer.exe" = protocol=6 | dir=in | app=c:\program files\quicktime\quicktimeplayer.exe |
"TCP Query User{EA39489A-8D39-475E-860D-F6459EA5E9A1}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{142330D2-22E7-49F5-879D-6AED200FE7B6}C:\program files\quicktime\quicktimeplayer.exe" = protocol=17 | dir=in | app=c:\program files\quicktime\quicktimeplayer.exe |
"UDP Query User{49AAC0FD-EBE1-49EC-808A-7EF01A716F41}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{7E24E115-1FE5-4460-AC25-5EA00B866EE1}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{DA863C67-1D7E-43D9-B36C-1692CECF7384}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{026C3D27-9BE1-46BE-BEAE-6DE38A0F4FBE}" = RealNetworks - Microsoft Visual C++ 2005 Runtime
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{10FD7666-5D97-4677-8181-AFCD08260043}" = BlackBerry Device Software v5.0.0 for the BlackBerry 9630 smartphone
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}" = Acer eLock Management
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{19991EAD-C273-47EB-87E8-0D274925230B}" = OEB Resource Driver
"{1AEC7728-1640-4E98-AABC-5EBE3FB57FE4}" = SMSC Fast Infrared Driver
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{24557DC0-0839-496f-82F9-C4EB72EFE4FA}" = HP Deskjet All-In-One Software 8.0
"{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{2B163CC2-65A9-4C83-AF5A-DEBF1C3B1705}" = Logos 4 Prerequisites
"{3360D505-B0AA-4284-92DF-F872AF90A448}" = BlackBerry Device Software Updater
"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D9892BB-A751-4E48-ADC8-E4289956CE1D}" = QuickTime
"{40A594D0-1490-4979-9382-D2B764F949C6}" = BlackBerry® Media Sync
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BB1DCED-84D3-47F9-B718-5947E904593E}" = Acer OrbiCam
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{5F81DD84-6A2F-11D4-903E-00E0293397B7}" = Bible Data Type System Files
"{5F81DD89-6A2F-11D4-903E-00E0293397B7}" = Common System Files
"{5F81DD92-6A2F-11D4-903E-00E0293397B7}" = Libronix Digital Library System
"{5F81DD97-6A2F-11D4-903E-00E0293397B7}" = Libronix DLS Application
"{5F81DD9B-6A2F-11D4-903E-00E0293397B7}" = LibronixUpdate
"{5F81DD9F-6A2F-11D4-903E-00E0293397B7}" = LLS Resource Driver
"{5F81DDA3-6A2F-11D4-903E-00E0293397B7}" = PDF Resource Driver
"{657F8B33-CBBB-45F4-9087-274F22C89400}" = DJ_AIO_ProductContext
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67ADE9AF-5CD9-4089-8825-55DE4B366799}" = NTI Backup NOW! 4.7
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{72CB5335-6D2A-4207-B811-6CB6C6925039}" = Batch Update
"{787D1A33-A97B-4245-87C0-7174609A540C}" = HP Update
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7B15D70E-9449-4CFB-B9BC-798465B2BD5C}" = Norton Internet Security
"{7DDEABFB-0621-4321-B385-CB86D3A6F90F}" = F4100
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROPLUS_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROPLUS_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROPLUS_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91F7F3F3-CE80-48C3-8327-7D24A0A5716A}" = iTunes
"{94389919-B0AA-4882-9BE8-9F0B004ECA35}" = Acer Tour
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{978C25EE-5777-46e4-8988-732C297CBDBD}" = Status
"{9B1FD9CE-0776-4f0b-A6F5-C6AB7B650CDF}" = Destinations
"{9E4444A9-EC85-4433-8C69-A07504E4E501}" = SweetIM for Messenger 2.9
"{9ECB4705-B9CB-405A-B6D4-33BDF707308E}" = DJ_AIO_Software
"{A13E07E1-A423-44FB-9DEE-B24C75C1BAF2}" = WIDCOMM Bluetooth Software 6.0.1.3100
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A3B7C670-4A1E-4EE2-950E-C875BC1965D0}" = Copy
"{A87B11AC-4344-4E5D-8B12-8F471A87DAD9}" = LightScribe 1.4.136.1
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.3
"{ACE22C48-49D7-4531-BE20-5C3D03393AB6}" = F4100_Help
"{AEEAE013-92F1-4515-B278-139F1A692A35}" = Acer eDataSecurity Management
"{B038A58E-EAF0-44CB-ADCA-3895ECD0812D}" = BibleWorks 8
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{B930930C-5651-40E0-95C8-990CA731891C}" = Logos Bible Software 4
"{B98BE95C-E76F-4246-B8E6-BEB8EE791D06}" = Roxio Media Manager
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{BF839132-BD43-4056-ACBF-4377F4A88E2A}" = Acer ePresentation Management
"{C06554A1-2C1E-4D20-B613-EE62C79927CC}" = Acer eNet Management
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{CA0AF735-4583-413E-897F-E91A237EE2E1}" = Libronix DLS Shortcuts
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE65A9A0-9686-45C6-9098-3C9543A412F0}" = Acer eSettings Management
"{CE86E2F5-850C-4207-94A3-A58D647B1733}" = BlackBerry Desktop Software 5.0.1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{DC83F417-8068-4074-BA2F-C4F8AB872556}" = DJ_AIO_Software_min
"{DD1DED37-2486-4F56-8F89-56AA814003F5}" = Acer OrbiCam
"{DF86841B-D4C4-41D9-A455-F47C0EF97D9D}" = WORDsearch
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}" = Acer Arcade Deluxe
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp
"Acer Assist" = Acer Assist
"Acer Registration" = Acer Registration
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"BlackBerry_{CE86E2F5-850C-4207-94A3-A58D647B1733}" = BlackBerry Desktop Software 5.0.1
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118" = HDAUDIO Soft Data Fax Modem with SmartCP
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"GridVista" = Acer GridVista
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"JFTP 4.1" = JFTP 4.1
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 2.1.5
"LastFM_is1" = Last.fm 1.5.4.24567
"Libronix DLS" = Libronix Digital Library System
"LManager" = Launch Manager
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"N360" = Norton 360
"PowerISO" = PowerISO
"PROPLUS" = Microsoft Office Professional Plus 2007
"RealPlayer 12.0" = RealPlayer
"SafeConnect" = SafeConnect
"ST6UNST #1" = Gre Bible
"ST6UNST #2" = Gre Bible (d:\)
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinMerge_is1" = WinMerge 2.12.4
"WinRAR archiver" = WinRAR archiver
"WORDsearch" = WORDsearch
"Xvid_is1" = Xvid 1.2.2 final uninstall
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Mail" = Yahoo! Internet Mail
"Yahoo! Mail Advisor" = Yahoo! Mail Advisor
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Search Defender" = Yahoo! Search Protection
"Yahoo! Software Update" = Yahoo! Software Update
"YInstHelper" = Yahoo! Install Manager

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"FileZilla Client" = FileZilla Client 3.3.2.1
"Google Chrome" = Google Chrome
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.2

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/16/2010 3:08:00 AM | Computer Name = JohnNWHorace-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 7/16/2010 3:08:00 AM | Computer Name = JohnNWHorace-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9839873

Error - 7/16/2010 3:08:00 AM | Computer Name = JohnNWHorace-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9839873

Error - 7/16/2010 3:08:01 AM | Computer Name = JohnNWHorace-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 7/16/2010 3:08:01 AM | Computer Name = JohnNWHorace-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9840871

Error - 7/16/2010 3:08:01 AM | Computer Name = JohnNWHorace-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9840871

Error - 7/16/2010 3:08:02 AM | Computer Name = JohnNWHorace-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 7/16/2010 3:08:02 AM | Computer Name = JohnNWHorace-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9841885

Error - 7/16/2010 3:08:02 AM | Computer Name = JohnNWHorace-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9841885

Error - 7/16/2010 3:08:03 AM | Computer Name = JohnNWHorace-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

[ Media Center Events ]
Error - 3/30/2010 9:33:15 PM | Computer Name = JohnNWHorace-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ System Events ]
Error - 7/28/2010 10:35:42 AM | Computer Name = JohnNWHorace-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description =

Error - 7/28/2010 10:36:17 AM | Computer Name = JohnNWHorace-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description =

Error - 7/28/2010 10:36:57 AM | Computer Name = JohnNWHorace-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description =

Error - 7/28/2010 10:37:40 AM | Computer Name = JohnNWHorace-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description =

Error - 7/28/2010 10:38:54 AM | Computer Name = JohnNWHorace-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description =

Error - 7/28/2010 10:47:20 AM | Computer Name = JohnNWHorace-PC | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.17.68 for the Network Card with network
address 0019D2C724C2 has been denied by the DHCP server 192.168.4.14 (The DHCP
Server sent a DHCPNACK message).

Error - 7/28/2010 10:48:39 AM | Computer Name = JohnNWHorace-PC | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.5.75 for the Network Card with network
address 0019D2C724C2 has been denied by the DHCP server 192.168.4.14 (The DHCP
Server sent a DHCPNACK message).

Error - 7/28/2010 4:08:00 PM | Computer Name = JohnNWHorace-PC | Source = ACPI | ID = 327693
Description = : The embedded controller (EC) did not respond within the specified
timeout period. This may indicate that there is an error in the EC hardware or
firmware or that the BIOS is accessing the EC incorrectly. You should check with
your computer manufacturer for an upgraded BIOS. In some situations, this error
may cause the computer to function incorrectly.

Error - 7/28/2010 4:08:58 PM | Computer Name = JohnNWHorace-PC | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.17.68 for the Network Card with network
address 0019D2C724C2 has been denied by the DHCP server 192.168.4.14 (The DHCP
Server sent a DHCPNACK message).

Error - 7/28/2010 4:09:21 PM | Computer Name = JohnNWHorace-PC | Source = Service Control Manager | ID = 7009
Description =

< End of report >

broni · 2010/07/28

Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.

==============================================================

Run OTL

Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following

Code:

:OTL
O4 - HKCU..\Run: [捁牥吠畯r] File not found
O4 - HKCU..\Run: [捁牥吠畯⁲敒業摮牥] File not found
O4 - Startup: C:\Users\John N. W. Horace\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wmitpsk.exe ()
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Yoruba Tradition.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\voo.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\URL.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\uncatalogued resources for Libronix.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\uncatalogued resources for Libronix.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Theological Anthropology.doc2.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\The Yoruba family.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\thd_handbook_08[1].pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\thd_doctoral_language_requirements[1].pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Stress Management_ How to Reduce, Prevent, and Cope with Stress.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Skills and Satisfactions List cardev2.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Sentence Completion cardev2.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\salarystudy.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\saints in exile 6.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\saints in exile 5.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\saints in exile 4.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Resume.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Resume of JNWHorace.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\resources abc 10413.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Resources 081209(1).xls:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Recommended Books for Leadership.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Real Estate Topic Library (Before You Buy Any Land Or Property) - Nairaland.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\readme.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Preventing Burnout_ Signs, Symptoms, Causes, and Coping Strategies.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Personal Book Builder Tutorial.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\pandacodedoc.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Oyedepo.Dr David !Satan Get Lost[1].pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Obsessive-Compulsive Disorder (OCD)_ Symptoms, Behavior, and Treatment.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Norton Product Key.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\nigeria.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\My Resume.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\My Libronix Library 12-15-2009.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Motivating Values List cardev4.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\mo.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\ME travel seminar Itinerary and registration form.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\logos3quickstart.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Limits of Confidentiality cardev.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Liberia[1].pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Letter from a Birmingham Jail [King, Jr.].pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\How to Stop Worrying_ Self-Help for Anxiety Relief.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\How To Calculate The Price of a C of O and Governor's Consent In Lagos Yours.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Health History cardev5.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\hands_on_guide_to_streaming_media_second_edition_an_introd uction_to_delivering_on_demand_media.9780240808635.34861.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Guide.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\God's Purpose and Agenda for my Life.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\God's Purpose and Agenda for my Life.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Glossary_of_Theological_Terms.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Generalized Anxiety Disorder (GAD)_ Symptoms, Treatment, and Self-Help.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Functions & Roles car dev.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Flash.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Facebook _ Tonia Horace Thanks to all who responded and much appreciation fo.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Facebook _ Facebook Site Governance_ Facebook's Privacy Policy - Full Versio.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Ethical Disclosure car dev 7.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Ejiro2.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Ejiro1.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\DOCUMENTING VERBATIMS FOR FIELD EDUCATION.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Details_of_Theologians.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\cover.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Churchlink - STRESS AND BURNOUT IN MINISTRY.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Christian Counseling.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\chathistory.doc lateesha.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Chapter_1.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\BlackBerry_Tour_9630_Smartphone-User_Guide-T643442-643442-0203014428-001-5.0-US.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\BlackBerry_Tour_9630_Smartphone-Learn_More--646527-1127024523-001-5.0-US.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\BlackBerry_Messenger-User_Guide--903196-1111023712-001-5.0-US.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Biographical_Ministry_Sketch.doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Bibliograph2.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Biblical Hebrew.txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Barr_Reading the book of Revelation - a resource for students.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\BandEquipmentFinal(1).xls:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\A-Z Of The Do’s And Don’ts Of Buying A Land Or Property In Lagos - Nairaland.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Autobiographical Statement.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Apologetics (Theology).txt:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\Anxiety Attacks and Disorders_ Signs, Symptoms, and Treatment.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\716516.pdfIgala1.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\714903.pdfIgara.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\537544.pdfigala1212.pdf:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\2009-2010 GUIDELINES+FOR+WRITING+VERBATIMS[1].doc:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\180294.pdfIGALA123.pdf:Roxio EMC Stream
@Alternate Data Stream - 351398 bytes -> C:\Users\John N. W. Horace\AppData\Roaming\desktop.ini:init


:Services

:Reg

:Files
C:\Users\John N. W. Horace\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wmitpsk.exe 

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]

Then click the [color= "#FF0000"]Run Fix[/color] button at the top
Let the program run unhindered, reboot the PC when it is done
You will get a log that shows the results of the fix. Please post it.
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

Equipper · 2010/07/28

Yes here we are again. Thanks man, I am most APPRECIATIVE.

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\捁牥吠畯r not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\捁牥吠畯⁲敒業摮牥 not found.
File C:\Users\John N. W. Horace\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wmitpsk.exe not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Yoruba Tradition.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\voo.jpg:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\URL.txt:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\uncatalogued resources for Libronix.txt:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\uncatalogued resources for Libronix.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Theological Anthropology.doc2.doc:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\The Yoruba family.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\thd_handbook_08[1].pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\thd_doctoral_language_requirements[1].pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Stress Management_ How to Reduce, Prevent, and Cope with Stress.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Skills and Satisfactions List cardev2.doc:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Sentence Completion cardev2.doc:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\salarystudy.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\saints in exile 6.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\saints in exile 5.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\saints in exile 4.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Resume.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Resume of JNWHorace.doc:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\resources abc 10413.txt:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Resources 081209(1).xls:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Recommended Books for Leadership.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Real Estate Topic Library (Before You Buy Any Land Or Property) - Nairaland.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\readme.txt:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Preventing Burnout_ Signs, Symptoms, Causes, and Coping Strategies.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Personal Book Builder Tutorial.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\pandacodedoc.txt:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Oyedepo.Dr David !Satan Get Lost[1].pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Obsessive-Compulsive Disorder (OCD)_ Symptoms, Behavior, and Treatment.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Norton Product Key.txt:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\nigeria.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\My Resume.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\My Libronix Library 12-15-2009.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Motivating Values List cardev4.doc:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\mo.jpg:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\ME travel seminar Itinerary and registration form.doc:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\logos3quickstart.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Limits of Confidentiality cardev.doc:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Liberia[1].pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Letter from a Birmingham Jail [King, Jr.].pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\How to Stop Worrying_ Self-Help for Anxiety Relief.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\How To Calculate The Price of a C of O and Governor's Consent In Lagos Yours.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Health History cardev5.doc:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\hands_on_guide_to_streaming_media_second_edition_an_introd uction_to_delivering_on_demand_media.9780240808635.34861.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Guide.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\God's Purpose and Agenda for my Life.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\God's Purpose and Agenda for my Life.doc:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Glossary_of_Theological_Terms.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Generalized Anxiety Disorder (GAD)_ Symptoms, Treatment, and Self-Help.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Functions & Roles car dev.doc:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Flash.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Facebook _ Tonia Horace Thanks to all who responded and much appreciation fo.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Facebook _ Facebook Site Governance_ Facebook's Privacy Policy - Full Versio.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Ethical Disclosure car dev 7.doc:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Ejiro2.txt:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Ejiro1.txt:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\DOCUMENTING VERBATIMS FOR FIELD EDUCATION.doc:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Details_of_Theologians.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\cover.jpg:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Churchlink - STRESS AND BURNOUT IN MINISTRY.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Christian Counseling.txt:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\chathistory.doc lateesha.doc:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Chapter_1.doc:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\BlackBerry_Tour_9630_Smartphone-User_Guide-T643442-643442-0203014428-001-5.0-US.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\BlackBerry_Tour_9630_Smartphone-Learn_More--646527-1127024523-001-5.0-US.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\BlackBerry_Messenger-User_Guide--903196-1111023712-001-5.0-US.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Biographical_Ministry_Sketch.doc:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Bibliograph2.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Biblical Hebrew.txt:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Barr_Reading the book of Revelation - a resource for students.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\BandEquipmentFinal(1).xls:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\A-Z Of The Do’s And Don’ts Of Buying A Land Or Property In Lagos - Nairaland.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Autobiographical Statement.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Apologetics (Theology).txt:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\Anxiety Attacks and Disorders_ Signs, Symptoms, and Treatment.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\716516.pdfIgala1.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\714903.pdfIgara.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\537544.pdfigala1212.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\2009-2010 GUIDELINES+FOR+WRITING+VERBATIMS[1].doc:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\Documents\180294.pdfIGALA123.pdf:Roxio EMC Stream .
Unable to delete ADS C:\Users\John N. W. Horace\AppData\Roaming\desktop.ini:init .
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File\Folder C:\Users\John N. W. Horace\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wmitpsk.exe not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: John N. W. Horace
->Temp folder emptied: 71458 bytes
->Temporary Internet Files folder emptied: 57277216 bytes
->Java cache emptied: 2830792 bytes
->FireFox cache emptied: 38945485 bytes
->Google Chrome cache emptied: 53480871 bytes
->Flash cache emptied: 173230 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 23476 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 492584 bytes

Total Files Cleaned = 146.00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: John N. W. Horace
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.9.1 log created on 07282010_195529

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

broni · 2010/07/28

You're welcome

...and...

Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
Click to expand...

Equipper · 2010/07/28

Thanks man.

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

OTL logfile created on: 7/28/2010 10:08:45 PM - Run 2
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\John N. W. Horace\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 48.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 67.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 83.18 Gb Total Space | 11.64 Gb Free Space | 14.00% Space Free | Partition Type: NTFS
Drive D: | 58.06 Gb Total Space | 6.13 Gb Free Space | 10.55% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 298.09 Gb Total Space | 87.48 Gb Free Space | 29.35% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded

Computer Name: JOHNNWHORACE-PC
Current User Name: John N. W. Horace
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/07/28 16:20:08 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\John N. W. Horace\Desktop\OTL.exe
PRC - [2010/07/24 01:14:57 | 000,014,808 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\plugin-container.exe
PRC - [2010/07/24 01:14:56 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/07/21 17:18:37 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2010/06/10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/02/25 20:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton 360\Engine\4.2.0.12\ccsvchst.exe
PRC - [2010/01/12 06:27:07 | 000,297,240 | ---- | M] (Impulse Point, LLC) -- C:\Program Files\SafeConnect\SCClient.exe
PRC - [2010/01/12 06:27:06 | 000,128,280 | ---- | M] (Impulse Point, LLC) -- C:\Program Files\SafeConnect\scManager.sys
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/02/06 16:22:26 | 001,390,592 | ---- | M] (WORDsearch Corp.) -- D:\WORDsearch 9\WORDsearch 9\ZipScript.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/10/24 09:14:36 | 000,206,112 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
PRC - [2007/01/10 20:20:34 | 000,462,848 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
PRC - [2007/01/02 22:58:58 | 000,457,512 | ---- | M] (HiTRSUT) -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
PRC - [2007/01/02 20:46:52 | 000,024,576 | ---- | M] () -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
PRC - [2007/01/02 13:33:24 | 000,135,168 | ---- | M] (acer) -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
PRC - [2006/12/29 00:07:22 | 000,724,992 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eNet\eNMTray.exe
PRC - [2006/12/29 00:07:22 | 000,126,976 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eNet\eNet Service.exe
PRC - [2006/12/28 19:24:14 | 000,049,152 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
PRC - [2006/12/25 20:45:26 | 000,319,488 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
PRC - [2006/12/22 18:43:18 | 000,024,576 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
PRC - [2006/12/14 16:34:16 | 000,393,216 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
PRC - [2006/11/24 16:57:54 | 000,107,008 | ---- | M] () -- C:\Acer\Mobility Center\MobilityService.exe

========== Modules (SafeList) ==========

MOD - [2010/07/28 16:20:08 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\John N. W. Horace\Desktop\OTL.exe
MOD - [2010/05/14 01:35:01 | 000,415,088 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton 360\Engine\4.2.0.12\asoehook.dll
MOD - [2010/05/04 15:40:55 | 000,653,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_5090ab56bcba71c2\msvcr90.dll
MOD - [2010/05/04 15:40:55 | 000,569,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_5090ab56bcba71c2\msvcp90.dll
MOD - [2009/04/11 02:21:38 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll
MOD - [2008/01/19 03:33:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - [2010/06/10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/03/18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/25 20:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files\Norton 360\Engine\4.2.0.12\ccSvcHst.exe -- (N360)
SRV - [2010/01/12 06:27:06 | 000,128,280 | ---- | M] (Impulse Point, LLC) [Auto | Running] -- C:\Program Files\SafeConnect\scManager.sys -- (SCManager)
SRV - [2009/09/24 21:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/01/19 03:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/01/02 22:58:58 | 000,457,512 | ---- | M] (HiTRSUT) [Auto | Running] -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe -- (eDataSecurity Service)
SRV - [2007/01/02 20:46:52 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe -- (eSettingsService)
SRV - [2007/01/02 13:33:24 | 000,135,168 | ---- | M] (acer) [Auto | Running] -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe -- (WMIService)
SRV - [2006/12/29 00:07:22 | 000,126,976 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eNet\eNet Service.exe -- (eNet Service)
SRV - [2006/12/28 19:24:14 | 000,049,152 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe -- (eRecoveryService)
SRV - [2006/12/22 18:43:18 | 000,024,576 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe -- (eLockService)
SRV - [2006/11/24 16:57:54 | 000,107,008 | ---- | M] () [Auto | Running] -- C:\Acer\Mobility Center\MobilityService.exe -- (MobilityService)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\UIUSYS.SYS -- (UIUSys)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2010/07/13 20:32:46 | 001,362,608 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100728.021\NAVEX15.SYS -- (NAVEX15)
DRV - [2010/07/13 20:32:46 | 000,085,424 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100728.021\NAVENG.SYS -- (NAVENG)
DRV - [2010/06/16 15:25:57 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010/05/28 15:33:19 | 000,344,112 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100726.001\IDSvix86.sys -- (IDSVix86)
DRV - [2010/05/27 07:09:27 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2010/05/22 18:19:20 | 000,691,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20100709.001\BHDrvx86.sys -- (BHDrvx86)
DRV - [2010/05/06 00:01:59 | 000,339,504 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\Drivers\N360\0402000.00C\SYMTDIV.SYS -- (SYMTDIv)
DRV - [2010/05/04 15:44:05 | 000,124,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2010/04/29 01:03:51 | 000,116,784 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\N360\0402000.00C\Ironx86.SYS -- (SymIRON)
DRV - [2010/04/21 23:02:20 | 000,173,104 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\system32\drivers\N360\0402000.00C\SYMEFA.SYS -- (SymEFA)
DRV - [2010/04/21 22:29:50 | 000,325,680 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\System32\Drivers\N360\0402000.00C\SRTSP.SYS -- (SRTSP)
DRV - [2010/04/21 22:29:50 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\N360\0402000.00C\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2010/02/25 20:22:57 | 000,501,888 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\N360\0402000.00C\ccHPx86.sys -- (ccHP)
DRV - [2009/10/14 23:50:05 | 000,328,752 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\N360\0402000.00C\SYMDS.SYS -- (SymDS)
DRV - [2009/04/11 00:42:54 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/11/02 04:44:10 | 000,056,572 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2007/12/04 17:10:30 | 000,016,640 | ---- | M] (PalmSource, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PalmUSBD.sys -- (PalmUSBD)
DRV - [2007/01/13 04:30:08 | 000,006,144 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV - [2007/01/02 22:59:24 | 000,016,680 | ---- | M] (HiTRUST) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\PSDNServ.sys -- (PSDNServ)
DRV - [2007/01/02 22:59:20 | 000,060,712 | ---- | M] (HiTRUST) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\psdvdisk.sys -- (psdvdisk)
DRV - [2007/01/02 22:59:18 | 000,020,264 | ---- | M] (HiTRUST) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\psdfilter.sys -- (PSDFilter)
DRV - [2006/12/26 21:57:12 | 000,817,968 | ---- | M] (Bison Electronics. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\BisonC07.sys -- (Cam5607)
DRV - [2006/12/07 19:12:02 | 000,076,584 | ---- | M] () [Kernel | Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\int15.sys -- (int15)
DRV - [2006/12/01 01:38:00 | 001,655,464 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006/11/05 22:29:14 | 001,473,024 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx)
DRV - [2006/11/05 22:29:14 | 001,473,024 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\igdkmd32.sys -- (ialm)
DRV - [2006/11/02 09:29:38 | 000,021,264 | ---- | M] (Dritek System Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\DKbFltr.sys -- (DKbFltr)
DRV - [2006/11/02 09:27:36 | 000,020,112 | ---- | M] (Dritek System Inc.) [Kernel | System | Running] -- C:\Program Files\Launch Manager\DPortIO.sys -- (DritekPortIO)
DRV - [2006/11/02 05:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 05:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 05:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 05:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 05:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 05:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2006/11/02 05:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 05:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 05:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 05:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 05:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 05:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 05:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2006/11/02 05:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 05:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 05:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 05:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2006/11/02 05:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 05:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 05:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 05:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 05:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2006/11/02 05:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 05:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 05:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 05:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 05:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 05:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 05:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 05:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 05:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 05:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 05:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2006/11/02 05:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2006/11/02 05:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2006/11/02 04:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 04:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 04:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 04:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 04:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 04:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 03:41:49 | 000,200,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VSTAZL3.SYS -- (HSFHWAZL)
DRV - [2006/11/02 03:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 03:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2006/11/02 03:30:53 | 000,045,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2006/10/29 21:42:28 | 001,786,880 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2006/10/25 02:36:48 | 000,042,240 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ESD7SK.sys -- (ESDCR)
DRV - [2006/10/25 02:36:44 | 000,076,928 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ESM7SK.sys -- (ESMCR)
DRV - [2006/10/25 02:36:36 | 000,062,208 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\EMS7SK.sys -- (EMSCR)
DRV - [2006/10/22 23:17:32 | 000,179,896 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP)
DRV - [2006/10/17 23:09:26 | 000,986,624 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DPV.sys -- (HSF_DPV)
DRV - [2006/10/17 23:08:14 | 000,206,848 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWAZL.sys -- (HSXHWAZL)
DRV - [2006/10/17 23:08:04 | 000,659,968 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_CNXT.sys -- (winachsf)
DRV - [2006/08/04 05:39:10 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Bing "
FF - prefs.js..browser.search.defaulturl: "http://www.bing.com/search?FORM=IEFM1&q= "
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm "
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm "
FF - prefs.js..browser.search.param.yahoo-type: "${8} "
FF - prefs.js..browser.search.selectedEngine: "eBay "
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-USfficial "
FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.0.7
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.5
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:4.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {3ee8d0be-f450-4ef2-97b9-ac2222d14db3}:2.7.1.3
FF - prefs.js..extensions.enabledItems: {6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}:1.4.8
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..keyword.URL: "http://www.bing.com/search?FORM=IEFM1&q= "

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/07/21 17:20:21 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\IPSFFPlgn\ [2010/05/27 11:37:19 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\coFFPlgn\ [2010/05/04 15:44:47 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/26 10:45:08 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/26 10:45:08 | 000,000,000 | ---D | M]

[2010/01/15 19:39:59 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Extensions
[2010/07/28 20:16:05 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\extensions
[2010/07/22 18:53:05 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2010/04/27 03:07:08 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/13 14:54:02 | 000,000,000 | ---D | M] (Free TV Bar c3 Toolbar) -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\extensions\{3ee8d0be-f450-4ef2-97b9-ac2222d14db3}
[2010/04/09 14:08:09 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/07/24 02:39:37 | 000,000,000 | ---D | M] (Fire.fm) -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\extensions\{6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}
[2010/02/19 22:43:43 | 000,002,163 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\searchplugins\bing.xml
[2010/06/08 11:30:18 | 000,000,931 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\searchplugins\conduit.xml
[2010/02/12 15:49:41 | 000,009,977 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\searchplugins\mywebsearch.xml
[2010/02/19 16:48:37 | 000,003,915 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\searchplugins\sweetim.xml
[2010/07/28 19:24:37 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/06/01 20:19:14 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/07/28 19:24:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/07/17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/07/28 00:07:40 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\4.2.0.12\ipsbho.dll (Symantec Corporation)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [ISUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKCU..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [ZipScript] D:\WORDsearch 9\WORDsearch 9\ZipScript.exe (WORDsearch Corp.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: UserId = L7AKH?>
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: UserIdNo = 694
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: wordsearchbible.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: yahoo.com ([www.en.us.acer] https in Trusted sites)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.4.14 192.168.4.31
O18 - Protocol\Handler\lbxfile {56831180-F115-11d2-B6AA-00104B2B9943} - C:\Program Files\Libronix DLS\System\FileProt.dll (Libronix Corporation)
O18 - Protocol\Handler\lbxres {24508F1B-9E94-40EE-9759-9AF5795ADF52} - C:\Program Files\Libronix DLS\System\ResProt.dll (Libronix Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\Windows\System32\eNetHook.dll) - C:\Windows\System32\eNetHook.dll (acer)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\Acer01.JPG
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\Acer01.JPG
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found

========== Files/Folders - Created Within 90 Days ==========

[2010/07/28 19:41:48 | 000,000,000 | ---D | C] -- C:\_OTL
[2010/07/28 19:25:00 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/07/28 16:20:06 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\John N. W. Horace\Desktop\OTL.exe
[2010/07/28 00:14:51 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010/07/28 00:14:51 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\temp
[2010/07/28 00:13:51 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2010/07/27 20:06:18 | 000,000,000 | ---D | C] -- C:\Program Files\Xvid
[2010/07/27 15:15:54 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010/07/27 01:43:53 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Roaming\Malwarebytes
[2010/07/27 01:43:33 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/27 01:43:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010/07/26 10:47:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Windows Genuine Advantage
[2010/07/25 02:11:41 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\Deployment
[2010/07/25 02:11:41 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\Apps
[2010/07/24 14:50:51 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2010/07/24 12:41:49 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\Documents\Skylook
[2010/07/24 03:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Last.fm
[2010/07/24 03:00:07 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\Last.fm
[2010/07/24 02:59:59 | 000,000,000 | ---D | C] -- C:\Program Files\Last.fm
[2010/07/23 15:44:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe AIR
[2010/07/21 17:19:36 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\xing shared
[2010/07/20 20:51:28 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\Documents\Beckah Shae - Life (2010)
[2010/07/04 13:30:35 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2010/07/04 13:27:10 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010/07/04 13:26:29 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2010/07/04 13:22:08 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2010/06/16 11:05:58 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Roaming\Tific
[2010/06/10 10:41:12 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\Super Internet TV
[2010/06/01 20:18:24 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2010/05/27 18:58:27 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\Documents\Kennedy Emetulu
[2010/05/27 18:23:06 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\Documents\Moses Ebe Ochonu
[2010/05/27 07:24:48 | 000,000,000 | ---D | C] -- C:\ProgramData\WEBREG
[2010/05/16 14:03:16 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\ElevatedDiagnostics
[2010/05/16 13:58:54 | 000,000,000 | ---D | C] -- C:\Windows\System32\WindowsPowerShell
[2010/05/16 13:55:42 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft ATS
[2010/05/14 20:13:22 | 000,000,000 | ---D | C] -- C:\HiTRUSTDrive
[2010/05/10 15:59:36 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\CrashDumps
[2010/05/10 08:55:59 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2010/05/04 15:44:22 | 000,124,976 | ---- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\SYMEVENT.SYS
[2010/05/04 15:44:05 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec
[2010/05/04 15:42:42 | 000,000,000 | ---D | C] -- C:\Program Files\Norton 360
[2010/05/04 15:38:31 | 000,000,000 | ---D | C] -- C:\Program Files\NortonInstaller
[2010/05/04 03:05:46 | 000,000,000 | R--D | C] -- C:\Program Files\Norton Support
[2010/05/04 03:02:36 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\Symantec
[2010/04/30 13:29:25 | 000,000,000 | ---D | C] -- C:\ProgramData\HP Product Assistant
[2007/01/13 04:36:13 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\Interop.Shell32.dll

========== Files - Modified Within 90 Days ==========

[2010/07/28 22:10:04 | 006,029,312 | -HS- | M] () -- C:\Users\John N. W. Horace\ntuser.dat
[2010/07/28 22:06:17 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/07/28 22:06:17 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/07/28 21:19:00 | 000,000,956 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-409448064-391623352-931058572-1000UA.job
[2010/07/28 21:11:42 | 001,844,444 | ---- | M] () -- C:\Windows\System32\drivers\N360\0402000.00C\Cat.DB
[2010/07/28 20:13:52 | 000,707,392 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/07/28 20:13:52 | 000,607,406 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/07/28 20:13:52 | 000,105,014 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/07/28 20:06:18 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/07/28 20:06:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/07/28 20:06:12 | 2135,044,096 | -HS- | M] () -- C:\hiberfil.sys
[2010/07/28 20:04:57 | 000,524,288 | -HS- | M] () -- C:\Users\John N. W. Horace\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/07/28 20:04:57 | 000,065,536 | -HS- | M] () -- C:\Users\John N. W. Horace\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/07/28 19:26:44 | 002,725,951 | -H-- | M] () -- C:\Users\John N. W. Horace\AppData\Local\IconCache.db
[2010/07/28 19:17:53 | 000,000,446 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{BAF87866-2DCD-4E99-82D4-588C90CCA522}.job
[2010/07/28 16:20:08 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\John N. W. Horace\Desktop\OTL.exe
[2010/07/28 14:38:31 | 000,002,627 | ---- | M] () -- C:\Users\John N. W. Horace\Desktop\Microsoft Office Word 2007.lnk
[2010/07/28 02:19:00 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-409448064-391623352-931058572-1000Core.job
[2010/07/28 00:07:52 | 000,000,215 | ---- | M] () -- C:\Windows\system.ini
[2010/07/28 00:07:40 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010/07/27 20:11:03 | 000,019,968 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/27 02:36:02 | 303,483,214 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010/07/25 02:15:55 | 000,002,106 | ---- | M] () -- C:\Users\John N. W. Horace\Desktop\Google Chrome.lnk
[2010/07/25 02:15:55 | 000,002,068 | ---- | M] () -- C:\Users\John N. W. Horace\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/07/24 23:23:11 | 001,546,752 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\relevance_of_gender_statistics_in_policy_making_in_liberia.doc
[2010/07/24 23:21:37 | 003,687,936 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Population Censuses in Post-Conflict Countries-The Liberian Experience-150210.ppt
[2010/07/24 14:51:59 | 000,001,804 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010/07/24 03:00:03 | 000,000,737 | ---- | M] () -- C:\Users\Public\Desktop\Last.fm.lnk
[2010/07/21 17:20:22 | 000,000,847 | ---- | M] () -- C:\Users\Public\Desktop\RealPlayer SP.lnk
[2010/07/21 17:18:42 | 000,278,528 | ---- | M] (Real Networks, Inc) -- C:\Windows\System32\pncrt.dll
[2010/07/21 00:17:52 | 000,001,853 | ---- | M] () -- C:\Users\John N. W. Horace\Desktop\Logos Bible Software 4.lnk
[2010/07/20 21:52:02 | 000,011,878 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\My New Passwords.docx
[2010/07/20 21:44:49 | 000,002,627 | ---- | M] () -- C:\Users\John N. W. Horace\Desktop\Microsoft Office Word 2007 (2).lnk
[2010/07/08 22:34:19 | 000,026,073 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Re.docx
[2010/07/07 23:23:57 | 002,503,210 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\blackberry_bold_9650_smartphone_ug.pdf
[2010/07/05 03:29:41 | 000,002,609 | ---- | M] () -- C:\Users\John N. W. Horace\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Excel 2007.lnk
[2010/07/04 23:33:49 | 000,065,348 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Local\rx_audio.Cache
[2010/07/04 23:33:49 | 000,002,232 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Local\rx_image.Cache
[2010/07/04 13:27:40 | 000,001,730 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/07/02 19:21:33 | 000,948,556 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\LoaderBackup-(2010-07-02).ipd
[2010/07/01 11:06:40 | 000,010,256 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\My NVS profile signature.docx
[2010/06/30 01:18:04 | 005,375,603 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\The Importance of Proper Fit.docx
[2010/06/30 01:15:53 | 000,001,891 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/06/25 08:11:10 | 000,001,752 | ---- | M] () -- C:\Users\John N. W. Horace\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/06/25 08:11:10 | 000,001,728 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010/06/18 12:23:40 | 000,400,896 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\TIPS FOR BUYING REAL ESTATE IN LAGOS.doc
[2010/06/18 11:07:43 | 000,129,536 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Why Does God Not Intervene.doc
[2010/06/09 03:33:39 | 002,393,576 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/06/09 00:35:34 | 001,286,232 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\TIPS FOR BUYING REAL ESTATE IN LAGOS.docx
[2010/06/04 09:33:00 | 000,130,955 | ---- | M] () -- C:\Windows\hpoins12.dat
[2010/06/04 09:19:26 | 000,000,278 | ---- | M] () -- C:\Windows\win.ini
[2010/06/01 14:53:50 | 000,015,151 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Praise.docx
[2010/06/01 14:53:24 | 000,018,310 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Worship.docx
[2010/06/01 12:51:53 | 000,121,713 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Doc1.docx
[2010/06/01 12:49:59 | 000,121,709 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\pastor's accountable reimbursement form.docx
[2010/05/29 13:52:18 | 000,001,356 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Local\d3d9caps.dat
[2010/05/28 13:20:18 | 000,017,816 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Charles Hodge.docx
[2010/05/28 13:18:34 | 000,011,141 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\A Creedal Statement.docx
[2010/05/28 12:59:00 | 000,013,601 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Charles Hodg1.docx
[2010/05/27 06:55:39 | 000,002,100 | ---- | M] () -- C:\Users\Public\Desktop\Norton 360.lnk
[2010/05/26 12:54:40 | 000,103,994 | ---- | M] () -- C:\Windows\hpqins01.dat
[2010/05/26 12:51:34 | 000,001,976 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2010/05/24 00:04:35 | 000,012,711 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\The three biblical pilgrimage festivals are Pesach.docx
[2010/05/24 00:04:02 | 000,316,504 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\L4 Bibliography AA.docx
[2010/05/19 18:51:02 | 000,035,096 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\English Bibles.docx
[2010/05/19 13:06:20 | 000,022,742 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\PRINCETON is a pleasant little town of fully six thousand inhabitants.docx
[2010/05/17 14:53:57 | 000,035,501 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\From.docxCharles Hodge.docx
[2010/05/16 13:56:18 | 002,818,048 | ---- | M] () -- C:\Windows\ocsetup_install_MicrosoftWindowsPowerShell.etl
[2010/05/16 13:56:18 | 000,196,608 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.perf
[2010/05/16 13:56:18 | 000,065,536 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.dpx
[2010/05/15 23:40:38 | 000,020,485 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Hodge1.docx22.docx
[2010/05/14 14:11:21 | 000,141,688 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Local\GDIPFONTCACHEV1.DAT
[2010/05/14 13:02:55 | 000,020,608 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Princeton Theology.docx
[2010/05/14 02:40:03 | 000,000,172 | ---- | M] () -- C:\Windows\System32\drivers\N360\0402000.00C\isolate.ini
[2010/05/13 12:07:59 | 000,013,090 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\In America.docx
[2010/05/12 09:15:29 | 000,013,733 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Charles Hodge Revisited.docx
[2010/05/12 09:15:20 | 000,013,188 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\HODGE.docx
[2010/05/11 09:57:57 | 000,011,511 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Bibliograph3.docx
[2010/05/11 09:57:18 | 000,011,289 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Introduction.docx
[2010/05/11 08:54:43 | 000,011,391 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Introduction.docxClass proj systematic theol 11.docx
[2010/05/10 12:48:54 | 000,011,840 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Annotated Bibliograph1.docx
[2010/05/10 12:48:43 | 000,012,448 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Annotated Bibliography.docx
[2010/05/10 12:48:34 | 000,010,801 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Erickson.docx
[2010/05/10 09:14:24 | 000,026,498 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Christology.docxjnwh.docx
[2010/05/10 08:37:15 | 000,383,086 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Christology.tif
[2010/05/10 07:40:25 | 000,017,253 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Theological Anthropology.docx
[2010/05/10 00:58:47 | 000,000,162 | -H-- | M] () -- C:\Users\John N. W. Horace\Documents\~$eological Anthropology Revised.docx
[2010/05/09 18:06:29 | 000,001,495 | ---- | M] () -- C:\Users\John N. W. Horace\Desktop\My.Master.Bibliography.File - Shortcut.lnk
[2010/05/08 15:12:13 | 000,983,965 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\LoaderBackup-(2010-05-08).ipd
[2010/05/07 16:06:10 | 000,030,368 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Theological Anthropology Revised.docx
[2010/05/06 15:22:41 | 000,012,213 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\My Learning and Action Plan.docx
[2010/05/06 00:01:59 | 000,339,504 | ---- | M] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0402000.00C\symtdiv.sys
[2010/05/06 00:01:43 | 000,001,473 | ---- | M] () -- C:\Windows\System32\drivers\N360\0402000.00C\symnetv.inf
[2010/05/06 00:01:43 | 000,001,445 | ---- | M] () -- C:\Windows\System32\drivers\N360\0402000.00C\symnet.inf
[2010/05/05 07:45:40 | 000,043,100 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Functions & Roles car dev.tif
[2010/05/04 15:44:05 | 000,124,976 | ---- | M] (Symantec Corporation) -- C:\Windows\System32\drivers\SYMEVENT.SYS
[2010/05/04 15:44:05 | 000,007,443 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.CAT
[2010/05/04 15:44:05 | 000,000,805 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.INF
[2010/05/04 10:45:37 | 000,033,814 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Theological Anthropolog1.docxClassproject.docx
[2010/05/04 02:39:36 | 000,015,520 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Christology.docx
[2010/05/02 16:16:01 | 000,013,278 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Matthew contains well over sixty explicit quotations from the OT.docx

Equipper · 2010/07/28

Thanks man.

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

OTL logfile created on: 7/28/2010 10:08:45 PM - Run 2
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\John N. W. Horace\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 48.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 67.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 83.18 Gb Total Space | 11.64 Gb Free Space | 14.00% Space Free | Partition Type: NTFS
Drive D: | 58.06 Gb Total Space | 6.13 Gb Free Space | 10.55% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 298.09 Gb Total Space | 87.48 Gb Free Space | 29.35% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded

Computer Name: JOHNNWHORACE-PC
Current User Name: John N. W. Horace
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/07/28 16:20:08 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\John N. W. Horace\Desktop\OTL.exe
PRC - [2010/07/24 01:14:57 | 000,014,808 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\plugin-container.exe
PRC - [2010/07/24 01:14:56 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/07/21 17:18:37 | 000,202,256 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2010/06/10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/02/25 20:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton 360\Engine\4.2.0.12\ccsvchst.exe
PRC - [2010/01/12 06:27:07 | 000,297,240 | ---- | M] (Impulse Point, LLC) -- C:\Program Files\SafeConnect\SCClient.exe
PRC - [2010/01/12 06:27:06 | 000,128,280 | ---- | M] (Impulse Point, LLC) -- C:\Program Files\SafeConnect\scManager.sys
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/02/06 16:22:26 | 001,390,592 | ---- | M] (WORDsearch Corp.) -- D:\WORDsearch 9\WORDsearch 9\ZipScript.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/10/24 09:14:36 | 000,206,112 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
PRC - [2007/01/10 20:20:34 | 000,462,848 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
PRC - [2007/01/02 22:58:58 | 000,457,512 | ---- | M] (HiTRSUT) -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
PRC - [2007/01/02 20:46:52 | 000,024,576 | ---- | M] () -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
PRC - [2007/01/02 13:33:24 | 000,135,168 | ---- | M] (acer) -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
PRC - [2006/12/29 00:07:22 | 000,724,992 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eNet\eNMTray.exe
PRC - [2006/12/29 00:07:22 | 000,126,976 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eNet\eNet Service.exe
PRC - [2006/12/28 19:24:14 | 000,049,152 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
PRC - [2006/12/25 20:45:26 | 000,319,488 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
PRC - [2006/12/22 18:43:18 | 000,024,576 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
PRC - [2006/12/14 16:34:16 | 000,393,216 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
PRC - [2006/11/24 16:57:54 | 000,107,008 | ---- | M] () -- C:\Acer\Mobility Center\MobilityService.exe

========== Modules (SafeList) ==========

MOD - [2010/07/28 16:20:08 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\John N. W. Horace\Desktop\OTL.exe
MOD - [2010/05/14 01:35:01 | 000,415,088 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton 360\Engine\4.2.0.12\asoehook.dll
MOD - [2010/05/04 15:40:55 | 000,653,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_5090ab56bcba71c2\msvcr90.dll
MOD - [2010/05/04 15:40:55 | 000,569,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_5090ab56bcba71c2\msvcp90.dll
MOD - [2009/04/11 02:21:38 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll
MOD - [2008/01/19 03:33:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - [2010/06/10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/03/18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/25 20:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files\Norton 360\Engine\4.2.0.12\ccSvcHst.exe -- (N360)
SRV - [2010/01/12 06:27:06 | 000,128,280 | ---- | M] (Impulse Point, LLC) [Auto | Running] -- C:\Program Files\SafeConnect\scManager.sys -- (SCManager)
SRV - [2009/09/24 21:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/01/19 03:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/01/02 22:58:58 | 000,457,512 | ---- | M] (HiTRSUT) [Auto | Running] -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe -- (eDataSecurity Service)
SRV - [2007/01/02 20:46:52 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe -- (eSettingsService)
SRV - [2007/01/02 13:33:24 | 000,135,168 | ---- | M] (acer) [Auto | Running] -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe -- (WMIService)
SRV - [2006/12/29 00:07:22 | 000,126,976 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eNet\eNet Service.exe -- (eNet Service)
SRV - [2006/12/28 19:24:14 | 000,049,152 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe -- (eRecoveryService)
SRV - [2006/12/22 18:43:18 | 000,024,576 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe -- (eLockService)
SRV - [2006/11/24 16:57:54 | 000,107,008 | ---- | M] () [Auto | Running] -- C:\Acer\Mobility Center\MobilityService.exe -- (MobilityService)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\UIUSYS.SYS -- (UIUSys)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2010/07/13 20:32:46 | 001,362,608 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100728.021\NAVEX15.SYS -- (NAVEX15)
DRV - [2010/07/13 20:32:46 | 000,085,424 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100728.021\NAVENG.SYS -- (NAVENG)
DRV - [2010/06/16 15:25:57 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010/05/28 15:33:19 | 000,344,112 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100726.001\IDSvix86.sys -- (IDSVix86)
DRV - [2010/05/27 07:09:27 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2010/05/22 18:19:20 | 000,691,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20100709.001\BHDrvx86.sys -- (BHDrvx86)
DRV - [2010/05/06 00:01:59 | 000,339,504 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\Drivers\N360\0402000.00C\SYMTDIV.SYS -- (SYMTDIv)
DRV - [2010/05/04 15:44:05 | 000,124,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2010/04/29 01:03:51 | 000,116,784 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\N360\0402000.00C\Ironx86.SYS -- (SymIRON)
DRV - [2010/04/21 23:02:20 | 000,173,104 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\system32\drivers\N360\0402000.00C\SYMEFA.SYS -- (SymEFA)
DRV - [2010/04/21 22:29:50 | 000,325,680 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\System32\Drivers\N360\0402000.00C\SRTSP.SYS -- (SRTSP)
DRV - [2010/04/21 22:29:50 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\N360\0402000.00C\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2010/02/25 20:22:57 | 000,501,888 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\N360\0402000.00C\ccHPx86.sys -- (ccHP)
DRV - [2009/10/14 23:50:05 | 000,328,752 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\N360\0402000.00C\SYMDS.SYS -- (SymDS)
DRV - [2009/04/11 00:42:54 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/11/02 04:44:10 | 000,056,572 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2007/12/04 17:10:30 | 000,016,640 | ---- | M] (PalmSource, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PalmUSBD.sys -- (PalmUSBD)
DRV - [2007/01/13 04:30:08 | 000,006,144 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV - [2007/01/02 22:59:24 | 000,016,680 | ---- | M] (HiTRUST) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\PSDNServ.sys -- (PSDNServ)
DRV - [2007/01/02 22:59:20 | 000,060,712 | ---- | M] (HiTRUST) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\psdvdisk.sys -- (psdvdisk)
DRV - [2007/01/02 22:59:18 | 000,020,264 | ---- | M] (HiTRUST) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\psdfilter.sys -- (PSDFilter)
DRV - [2006/12/26 21:57:12 | 000,817,968 | ---- | M] (Bison Electronics. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\BisonC07.sys -- (Cam5607)
DRV - [2006/12/07 19:12:02 | 000,076,584 | ---- | M] () [Kernel | Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\int15.sys -- (int15)
DRV - [2006/12/01 01:38:00 | 001,655,464 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006/11/05 22:29:14 | 001,473,024 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx)
DRV - [2006/11/05 22:29:14 | 001,473,024 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\igdkmd32.sys -- (ialm)
DRV - [2006/11/02 09:29:38 | 000,021,264 | ---- | M] (Dritek System Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\DKbFltr.sys -- (DKbFltr)
DRV - [2006/11/02 09:27:36 | 000,020,112 | ---- | M] (Dritek System Inc.) [Kernel | System | Running] -- C:\Program Files\Launch Manager\DPortIO.sys -- (DritekPortIO)
DRV - [2006/11/02 05:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 05:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 05:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 05:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 05:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 05:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2006/11/02 05:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 05:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 05:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 05:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 05:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 05:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 05:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2006/11/02 05:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 05:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 05:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 05:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2006/11/02 05:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 05:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 05:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 05:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 05:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2006/11/02 05:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 05:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 05:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 05:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 05:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 05:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 05:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 05:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 05:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 05:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 05:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2006/11/02 05:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2006/11/02 05:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2006/11/02 04:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 04:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 04:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 04:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 04:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 04:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 03:41:49 | 000,200,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VSTAZL3.SYS -- (HSFHWAZL)
DRV - [2006/11/02 03:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 03:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2006/11/02 03:30:53 | 000,045,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2006/10/29 21:42:28 | 001,786,880 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2006/10/25 02:36:48 | 000,042,240 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ESD7SK.sys -- (ESDCR)
DRV - [2006/10/25 02:36:44 | 000,076,928 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ESM7SK.sys -- (ESMCR)
DRV - [2006/10/25 02:36:36 | 000,062,208 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\EMS7SK.sys -- (EMSCR)
DRV - [2006/10/22 23:17:32 | 000,179,896 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP)
DRV - [2006/10/17 23:09:26 | 000,986,624 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DPV.sys -- (HSF_DPV)
DRV - [2006/10/17 23:08:14 | 000,206,848 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWAZL.sys -- (HSXHWAZL)
DRV - [2006/10/17 23:08:04 | 000,659,968 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_CNXT.sys -- (winachsf)
DRV - [2006/08/04 05:39:10 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Bing "
FF - prefs.js..browser.search.defaulturl: "http://www.bing.com/search?FORM=IEFM1&q= "
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm "
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm "
FF - prefs.js..browser.search.param.yahoo-type: "${8} "
FF - prefs.js..browser.search.selectedEngine: "eBay "
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-USfficial "
FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.0.7
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.5
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:4.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {3ee8d0be-f450-4ef2-97b9-ac2222d14db3}:2.7.1.3
FF - prefs.js..extensions.enabledItems: {6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}:1.4.8
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..keyword.URL: "http://www.bing.com/search?FORM=IEFM1&q= "

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/07/21 17:20:21 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\IPSFFPlgn\ [2010/05/27 11:37:19 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\coFFPlgn\ [2010/05/04 15:44:47 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/26 10:45:08 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/26 10:45:08 | 000,000,000 | ---D | M]

[2010/01/15 19:39:59 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Extensions
[2010/07/28 20:16:05 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\extensions
[2010/07/22 18:53:05 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2010/04/27 03:07:08 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/13 14:54:02 | 000,000,000 | ---D | M] (Free TV Bar c3 Toolbar) -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\extensions\{3ee8d0be-f450-4ef2-97b9-ac2222d14db3}
[2010/04/09 14:08:09 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/07/24 02:39:37 | 000,000,000 | ---D | M] (Fire.fm) -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\extensions\{6F0976E6-26F3-4AFE-BBEC-9E99E27E4DF3}
[2010/02/19 22:43:43 | 000,002,163 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\searchplugins\bing.xml
[2010/06/08 11:30:18 | 000,000,931 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\searchplugins\conduit.xml
[2010/02/12 15:49:41 | 000,009,977 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\searchplugins\mywebsearch.xml
[2010/02/19 16:48:37 | 000,003,915 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Roaming\Mozilla\Firefox\Profiles\1vgekn52.default\searchplugins\sweetim.xml
[2010/07/28 19:24:37 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/06/01 20:19:14 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/07/28 19:24:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/07/17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/07/28 00:07:40 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\4.2.0.12\ipsbho.dll (Symantec Corporation)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [ISUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKCU..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [ZipScript] D:\WORDsearch 9\WORDsearch 9\ZipScript.exe (WORDsearch Corp.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: UserId = L7AKH?>
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: UserIdNo = 694
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: wordsearchbible.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: yahoo.com ([www.en.us.acer] https in Trusted sites)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.4.14 192.168.4.31
O18 - Protocol\Handler\lbxfile {56831180-F115-11d2-B6AA-00104B2B9943} - C:\Program Files\Libronix DLS\System\FileProt.dll (Libronix Corporation)
O18 - Protocol\Handler\lbxres {24508F1B-9E94-40EE-9759-9AF5795ADF52} - C:\Program Files\Libronix DLS\System\ResProt.dll (Libronix Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\Windows\System32\eNetHook.dll) - C:\Windows\System32\eNetHook.dll (acer)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\Acer01.JPG
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\Acer01.JPG
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found

========== Files/Folders - Created Within 90 Days ==========

[2010/07/28 19:41:48 | 000,000,000 | ---D | C] -- C:\_OTL
[2010/07/28 19:25:00 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/07/28 16:20:06 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\John N. W. Horace\Desktop\OTL.exe
[2010/07/28 00:14:51 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010/07/28 00:14:51 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\temp
[2010/07/28 00:13:51 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2010/07/27 20:06:18 | 000,000,000 | ---D | C] -- C:\Program Files\Xvid
[2010/07/27 15:15:54 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010/07/27 01:43:53 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Roaming\Malwarebytes
[2010/07/27 01:43:33 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/27 01:43:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010/07/26 10:47:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Windows Genuine Advantage
[2010/07/25 02:11:41 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\Deployment
[2010/07/25 02:11:41 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\Apps
[2010/07/24 14:50:51 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2010/07/24 12:41:49 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\Documents\Skylook
[2010/07/24 03:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Last.fm
[2010/07/24 03:00:07 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\Last.fm
[2010/07/24 02:59:59 | 000,000,000 | ---D | C] -- C:\Program Files\Last.fm
[2010/07/23 15:44:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe AIR
[2010/07/21 17:19:36 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\xing shared
[2010/07/20 20:51:28 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\Documents\Beckah Shae - Life (2010)
[2010/07/04 13:30:35 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2010/07/04 13:27:10 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010/07/04 13:26:29 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2010/07/04 13:22:08 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2010/06/16 11:05:58 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Roaming\Tific
[2010/06/10 10:41:12 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\Super Internet TV
[2010/06/01 20:18:24 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2010/05/27 18:58:27 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\Documents\Kennedy Emetulu
[2010/05/27 18:23:06 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\Documents\Moses Ebe Ochonu
[2010/05/27 07:24:48 | 000,000,000 | ---D | C] -- C:\ProgramData\WEBREG
[2010/05/16 14:03:16 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\ElevatedDiagnostics
[2010/05/16 13:58:54 | 000,000,000 | ---D | C] -- C:\Windows\System32\WindowsPowerShell
[2010/05/16 13:55:42 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft ATS
[2010/05/14 20:13:22 | 000,000,000 | ---D | C] -- C:\HiTRUSTDrive
[2010/05/10 15:59:36 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\CrashDumps
[2010/05/10 08:55:59 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2010/05/04 15:44:22 | 000,124,976 | ---- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\SYMEVENT.SYS
[2010/05/04 15:44:05 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec
[2010/05/04 15:42:42 | 000,000,000 | ---D | C] -- C:\Program Files\Norton 360
[2010/05/04 15:38:31 | 000,000,000 | ---D | C] -- C:\Program Files\NortonInstaller
[2010/05/04 03:05:46 | 000,000,000 | R--D | C] -- C:\Program Files\Norton Support
[2010/05/04 03:02:36 | 000,000,000 | ---D | C] -- C:\Users\John N. W. Horace\AppData\Local\Symantec
[2010/04/30 13:29:25 | 000,000,000 | ---D | C] -- C:\ProgramData\HP Product Assistant
[2007/01/13 04:36:13 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\Interop.Shell32.dll

========== Files - Modified Within 90 Days ==========

[2010/07/28 22:10:04 | 006,029,312 | -HS- | M] () -- C:\Users\John N. W. Horace\ntuser.dat
[2010/07/28 22:06:17 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/07/28 22:06:17 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/07/28 21:19:00 | 000,000,956 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-409448064-391623352-931058572-1000UA.job
[2010/07/28 21:11:42 | 001,844,444 | ---- | M] () -- C:\Windows\System32\drivers\N360\0402000.00C\Cat.DB
[2010/07/28 20:13:52 | 000,707,392 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/07/28 20:13:52 | 000,607,406 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/07/28 20:13:52 | 000,105,014 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/07/28 20:06:18 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/07/28 20:06:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/07/28 20:06:12 | 2135,044,096 | -HS- | M] () -- C:\hiberfil.sys
[2010/07/28 20:04:57 | 000,524,288 | -HS- | M] () -- C:\Users\John N. W. Horace\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/07/28 20:04:57 | 000,065,536 | -HS- | M] () -- C:\Users\John N. W. Horace\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/07/28 19:26:44 | 002,725,951 | -H-- | M] () -- C:\Users\John N. W. Horace\AppData\Local\IconCache.db
[2010/07/28 19:17:53 | 000,000,446 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{BAF87866-2DCD-4E99-82D4-588C90CCA522}.job
[2010/07/28 16:20:08 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\John N. W. Horace\Desktop\OTL.exe
[2010/07/28 14:38:31 | 000,002,627 | ---- | M] () -- C:\Users\John N. W. Horace\Desktop\Microsoft Office Word 2007.lnk
[2010/07/28 02:19:00 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-409448064-391623352-931058572-1000Core.job
[2010/07/28 00:07:52 | 000,000,215 | ---- | M] () -- C:\Windows\system.ini
[2010/07/28 00:07:40 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010/07/27 20:11:03 | 000,019,968 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/27 02:36:02 | 303,483,214 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010/07/25 02:15:55 | 000,002,106 | ---- | M] () -- C:\Users\John N. W. Horace\Desktop\Google Chrome.lnk
[2010/07/25 02:15:55 | 000,002,068 | ---- | M] () -- C:\Users\John N. W. Horace\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/07/24 23:23:11 | 001,546,752 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\relevance_of_gender_statistics_in_policy_making_in_liberia.doc
[2010/07/24 23:21:37 | 003,687,936 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Population Censuses in Post-Conflict Countries-The Liberian Experience-150210.ppt
[2010/07/24 14:51:59 | 000,001,804 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010/07/24 03:00:03 | 000,000,737 | ---- | M] () -- C:\Users\Public\Desktop\Last.fm.lnk
[2010/07/21 17:20:22 | 000,000,847 | ---- | M] () -- C:\Users\Public\Desktop\RealPlayer SP.lnk
[2010/07/21 17:18:42 | 000,278,528 | ---- | M] (Real Networks, Inc) -- C:\Windows\System32\pncrt.dll
[2010/07/21 00:17:52 | 000,001,853 | ---- | M] () -- C:\Users\John N. W. Horace\Desktop\Logos Bible Software 4.lnk
[2010/07/20 21:52:02 | 000,011,878 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\My New Passwords.docx
[2010/07/20 21:44:49 | 000,002,627 | ---- | M] () -- C:\Users\John N. W. Horace\Desktop\Microsoft Office Word 2007 (2).lnk
[2010/07/08 22:34:19 | 000,026,073 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Re.docx
[2010/07/07 23:23:57 | 002,503,210 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\blackberry_bold_9650_smartphone_ug.pdf
[2010/07/05 03:29:41 | 000,002,609 | ---- | M] () -- C:\Users\John N. W. Horace\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Excel 2007.lnk
[2010/07/04 23:33:49 | 000,065,348 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Local\rx_audio.Cache
[2010/07/04 23:33:49 | 000,002,232 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Local\rx_image.Cache
[2010/07/04 13:27:40 | 000,001,730 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/07/02 19:21:33 | 000,948,556 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\LoaderBackup-(2010-07-02).ipd
[2010/07/01 11:06:40 | 000,010,256 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\My NVS profile signature.docx
[2010/06/30 01:18:04 | 005,375,603 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\The Importance of Proper Fit.docx
[2010/06/30 01:15:53 | 000,001,891 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/06/25 08:11:10 | 000,001,752 | ---- | M] () -- C:\Users\John N. W. Horace\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/06/25 08:11:10 | 000,001,728 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010/06/18 12:23:40 | 000,400,896 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\TIPS FOR BUYING REAL ESTATE IN LAGOS.doc
[2010/06/18 11:07:43 | 000,129,536 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Why Does God Not Intervene.doc
[2010/06/09 03:33:39 | 002,393,576 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/06/09 00:35:34 | 001,286,232 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\TIPS FOR BUYING REAL ESTATE IN LAGOS.docx
[2010/06/04 09:33:00 | 000,130,955 | ---- | M] () -- C:\Windows\hpoins12.dat
[2010/06/04 09:19:26 | 000,000,278 | ---- | M] () -- C:\Windows\win.ini
[2010/06/01 14:53:50 | 000,015,151 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Praise.docx
[2010/06/01 14:53:24 | 000,018,310 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Worship.docx
[2010/06/01 12:51:53 | 000,121,713 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Doc1.docx
[2010/06/01 12:49:59 | 000,121,709 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\pastor's accountable reimbursement form.docx
[2010/05/29 13:52:18 | 000,001,356 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Local\d3d9caps.dat
[2010/05/28 13:20:18 | 000,017,816 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Charles Hodge.docx
[2010/05/28 13:18:34 | 000,011,141 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\A Creedal Statement.docx
[2010/05/28 12:59:00 | 000,013,601 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Charles Hodg1.docx
[2010/05/27 06:55:39 | 000,002,100 | ---- | M] () -- C:\Users\Public\Desktop\Norton 360.lnk
[2010/05/26 12:54:40 | 000,103,994 | ---- | M] () -- C:\Windows\hpqins01.dat
[2010/05/26 12:51:34 | 000,001,976 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2010/05/24 00:04:35 | 000,012,711 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\The three biblical pilgrimage festivals are Pesach.docx
[2010/05/24 00:04:02 | 000,316,504 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\L4 Bibliography AA.docx
[2010/05/19 18:51:02 | 000,035,096 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\English Bibles.docx
[2010/05/19 13:06:20 | 000,022,742 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\PRINCETON is a pleasant little town of fully six thousand inhabitants.docx
[2010/05/17 14:53:57 | 000,035,501 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\From.docxCharles Hodge.docx
[2010/05/16 13:56:18 | 002,818,048 | ---- | M] () -- C:\Windows\ocsetup_install_MicrosoftWindowsPowerShell.etl
[2010/05/16 13:56:18 | 000,196,608 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.perf
[2010/05/16 13:56:18 | 000,065,536 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.dpx
[2010/05/15 23:40:38 | 000,020,485 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Hodge1.docx22.docx
[2010/05/14 14:11:21 | 000,141,688 | ---- | M] () -- C:\Users\John N. W. Horace\AppData\Local\GDIPFONTCACHEV1.DAT
[2010/05/14 13:02:55 | 000,020,608 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Princeton Theology.docx
[2010/05/14 02:40:03 | 000,000,172 | ---- | M] () -- C:\Windows\System32\drivers\N360\0402000.00C\isolate.ini
[2010/05/13 12:07:59 | 000,013,090 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\In America.docx
[2010/05/12 09:15:29 | 000,013,733 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Charles Hodge Revisited.docx
[2010/05/12 09:15:20 | 000,013,188 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\HODGE.docx
[2010/05/11 09:57:57 | 000,011,511 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Bibliograph3.docx
[2010/05/11 09:57:18 | 000,011,289 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Introduction.docx
[2010/05/11 08:54:43 | 000,011,391 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Introduction.docxClass proj systematic theol 11.docx
[2010/05/10 12:48:54 | 000,011,840 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Annotated Bibliograph1.docx
[2010/05/10 12:48:43 | 000,012,448 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Annotated Bibliography.docx
[2010/05/10 12:48:34 | 000,010,801 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Erickson.docx
[2010/05/10 09:14:24 | 000,026,498 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Christology.docxjnwh.docx
[2010/05/10 08:37:15 | 000,383,086 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Christology.tif
[2010/05/10 07:40:25 | 000,017,253 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Theological Anthropology.docx
[2010/05/10 00:58:47 | 000,000,162 | -H-- | M] () -- C:\Users\John N. W. Horace\Documents\~$eological Anthropology Revised.docx
[2010/05/09 18:06:29 | 000,001,495 | ---- | M] () -- C:\Users\John N. W. Horace\Desktop\My.Master.Bibliography.File - Shortcut.lnk
[2010/05/08 15:12:13 | 000,983,965 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\LoaderBackup-(2010-05-08).ipd
[2010/05/07 16:06:10 | 000,030,368 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Theological Anthropology Revised.docx
[2010/05/06 15:22:41 | 000,012,213 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\My Learning and Action Plan.docx
[2010/05/06 00:01:59 | 000,339,504 | ---- | M] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\0402000.00C\symtdiv.sys
[2010/05/06 00:01:43 | 000,001,473 | ---- | M] () -- C:\Windows\System32\drivers\N360\0402000.00C\symnetv.inf
[2010/05/06 00:01:43 | 000,001,445 | ---- | M] () -- C:\Windows\System32\drivers\N360\0402000.00C\symnet.inf
[2010/05/05 07:45:40 | 000,043,100 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Functions & Roles car dev.tif
[2010/05/04 15:44:05 | 000,124,976 | ---- | M] (Symantec Corporation) -- C:\Windows\System32\drivers\SYMEVENT.SYS
[2010/05/04 15:44:05 | 000,007,443 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.CAT
[2010/05/04 15:44:05 | 000,000,805 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.INF
[2010/05/04 10:45:37 | 000,033,814 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Theological Anthropolog1.docxClassproject.docx
[2010/05/04 02:39:36 | 000,015,520 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Christology.docx
[2010/05/02 16:16:01 | 000,013,278 | ---- | M] () -- C:\Users\John N. W. Horace\Documents\Matthew contains well over sixty explicit quotations from the OT.docx

Equipper · 2010/07/28

========== Files Created - No Company Name ==========

[2099/01/01 12:00:00 | 000,001,744 | -H-- | C] () -- C:\ProgramData\luvilogu
[2010/07/27 20:06:18 | 000,077,824 | ---- | C] () -- C:\Windows\System32\xvid.ax
[2010/07/27 02:28:34 | 2135,044,096 | -HS- | C] () -- C:\hiberfil.sys
[2010/07/25 02:15:55 | 000,002,106 | ---- | C] () -- C:\Users\John N. W. Horace\Desktop\Google Chrome.lnk
[2010/07/25 02:15:55 | 000,002,068 | ---- | C] () -- C:\Users\John N. W. Horace\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/07/25 02:14:51 | 000,000,956 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-409448064-391623352-931058572-1000UA.job
[2010/07/25 02:14:48 | 000,000,904 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-409448064-391623352-931058572-1000Core.job
[2010/07/24 23:23:10 | 001,546,752 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\relevance_of_gender_statistics_in_policy_making_in_liberia.doc
[2010/07/24 23:21:31 | 003,687,936 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Population Censuses in Post-Conflict Countries-The Liberian Experience-150210.ppt
[2010/07/24 14:51:59 | 000,001,804 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010/07/24 03:00:03 | 000,000,737 | ---- | C] () -- C:\Users\Public\Desktop\Last.fm.lnk
[2010/07/21 17:20:22 | 000,000,847 | ---- | C] () -- C:\Users\Public\Desktop\RealPlayer SP.lnk
[2010/07/20 21:44:49 | 000,002,627 | ---- | C] () -- C:\Users\John N. W. Horace\Desktop\Microsoft Office Word 2007 (2).lnk
[2010/07/18 11:15:59 | 000,011,878 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\My New Passwords.docx
[2010/07/08 22:34:15 | 000,026,073 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Re.docx
[2010/07/07 23:23:56 | 002,503,210 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\blackberry_bold_9650_smartphone_ug.pdf
[2010/07/04 22:29:46 | 000,065,348 | ---- | C] () -- C:\Users\John N. W. Horace\AppData\Local\rx_audio.Cache
[2010/07/04 13:27:39 | 000,001,730 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/07/02 19:21:33 | 000,948,556 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\LoaderBackup-(2010-07-02).ipd
[2010/07/01 11:06:38 | 000,010,256 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\My NVS profile signature.docx
[2010/06/30 01:17:25 | 005,375,603 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\The Importance of Proper Fit.docx
[2010/06/18 12:23:38 | 000,400,896 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\TIPS FOR BUYING REAL ESTATE IN LAGOS.doc
[2010/06/18 11:07:41 | 000,129,536 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Why Does God Not Intervene.doc
[2010/06/09 00:35:30 | 001,286,232 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\TIPS FOR BUYING REAL ESTATE IN LAGOS.docx
[2010/06/01 14:53:49 | 000,015,151 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Praise.docx
[2010/06/01 14:53:24 | 000,018,310 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Worship.docx
[2010/06/01 12:51:52 | 000,121,713 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Doc1.docx
[2010/06/01 12:49:57 | 000,121,709 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\pastor's accountable reimbursement form.docx
[2010/05/28 12:58:58 | 000,013,601 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Charles Hodg1.docx
[2010/05/26 12:51:33 | 000,001,976 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2010/05/25 00:19:12 | 000,017,816 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Charles Hodge.docx
[2010/05/24 00:04:34 | 000,012,711 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\The three biblical pilgrimage festivals are Pesach.docx
[2010/05/24 00:04:00 | 000,316,504 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\L4 Bibliography AA.docx
[2010/05/19 18:51:01 | 000,035,096 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\English Bibles.docx
[2010/05/19 13:06:20 | 000,022,742 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\PRINCETON is a pleasant little town of fully six thousand inhabitants.docx
[2010/05/17 14:53:56 | 000,035,501 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\From.docxCharles Hodge.docx
[2010/05/16 13:55:45 | 002,818,048 | ---- | C] () -- C:\Windows\ocsetup_install_MicrosoftWindowsPowerShell.etl
[2010/05/16 13:55:45 | 000,196,608 | ---- | C] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.perf
[2010/05/16 13:55:45 | 000,065,536 | ---- | C] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.dpx
[2010/05/15 23:40:27 | 000,020,485 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Hodge1.docx22.docx
[2010/05/14 13:02:54 | 000,020,608 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Princeton Theology.docx
[2010/05/13 12:07:20 | 000,013,090 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\In America.docx
[2010/05/12 09:15:28 | 000,013,733 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Charles Hodge Revisited.docx
[2010/05/12 09:15:19 | 000,013,188 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\HODGE.docx
[2010/05/11 09:57:56 | 000,011,511 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Bibliograph3.docx
[2010/05/11 09:57:17 | 000,011,289 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Introduction.docx
[2010/05/10 12:48:53 | 000,011,840 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Annotated Bibliograph1.docx
[2010/05/10 12:48:43 | 000,012,448 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Annotated Bibliography.docx
[2010/05/10 12:48:34 | 000,010,801 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Erickson.docx
[2010/05/10 08:51:55 | 000,026,498 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Christology.docxjnwh.docx
[2010/05/10 08:37:14 | 000,383,086 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Christology.tif
[2010/05/10 00:58:47 | 000,000,162 | -H-- | C] () -- C:\Users\John N. W. Horace\Documents\~$eological Anthropology Revised.docx
[2010/05/08 15:12:13 | 000,983,965 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\LoaderBackup-(2010-05-08).ipd
[2010/05/07 16:40:41 | 000,030,368 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Theological Anthropology Revised.docx
[2010/05/06 15:22:34 | 000,012,213 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\My Learning and Action Plan.docx
[2010/05/05 07:45:39 | 000,043,100 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Functions & Roles car dev.tif
[2010/05/04 15:44:22 | 000,007,443 | ---- | C] () -- C:\Windows\System32\drivers\SYMEVENT.CAT
[2010/05/04 15:44:22 | 000,000,805 | ---- | C] () -- C:\Windows\System32\drivers\SYMEVENT.INF
[2010/05/04 15:43:39 | 000,002,100 | ---- | C] () -- C:\Users\Public\Desktop\Norton 360.lnk
[2010/05/04 11:08:42 | 000,011,141 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\A Creedal Statement.docx
[2010/05/04 10:45:31 | 000,011,391 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Introduction.docxClass proj systematic theol 11.docx
[2010/05/04 02:39:26 | 000,033,814 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Theological Anthropolog1.docxClassproject.docx
[2010/05/02 16:15:58 | 000,013,278 | ---- | C] () -- C:\Users\John N. W. Horace\Documents\Matthew contains well over sixty explicit quotations from the OT.docx
[2010/04/09 14:14:19 | 000,000,094 | ---- | C] () -- C:\Windows\family.ini
[2010/01/26 23:32:24 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2010/01/26 23:32:24 | 000,819,200 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2010/01/26 23:32:24 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2010/01/26 23:32:22 | 000,010,752 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2010/01/26 23:32:22 | 000,000,547 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll.manifest
[2010/01/22 19:20:33 | 000,181,760 | ---- | C] () -- C:\Windows\System32\patchw32.dll
[2010/01/22 19:20:33 | 000,116,736 | ---- | C] () -- C:\Windows\System32\patchw.dll
[2010/01/22 19:20:33 | 000,058,280 | ---- | C] () -- C:\Windows\System32\bwntsend.dll
[2010/01/22 19:20:33 | 000,058,280 | ---- | C] () -- C:\Windows\System32\bwnthook.dll
[2010/01/22 19:20:33 | 000,055,808 | ---- | C] () -- C:\Windows\System32\zlib1.dll
[2010/01/22 19:20:32 | 007,533,568 | ---- | C] () -- C:\Windows\System32\bwbits80.dll
[2010/01/15 10:03:57 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010/01/12 01:54:38 | 000,000,092 | ---- | C] () -- C:\Windows\CLEANUP.INI
[2010/01/12 00:36:45 | 000,000,037 | ---- | C] () -- C:\Windows\Acer.ini
[2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2007/01/13 15:40:25 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN4.dll
[2007/01/13 04:55:30 | 000,198,144 | ---- | C] () -- C:\Windows\System32\_psisdecd.dll
[2007/01/13 04:45:52 | 000,076,584 | ---- | C] () -- C:\Windows\System32\drivers\int15.sys
[2007/01/13 04:45:52 | 000,015,656 | ---- | C] () -- C:\Windows\System32\drivers\int15_64.sys
[2007/01/13 04:44:55 | 000,065,536 | ---- | C] () -- C:\Windows\System32\NATTraversal.dll
[2007/01/13 04:36:14 | 000,331,776 | ---- | C] () -- C:\Windows\System32\ScrollBarLib.dll
[2007/01/13 04:23:47 | 000,356,352 | ---- | C] () -- C:\Windows\EMCRI.dll
[2007/01/13 01:42:32 | 000,000,099 | ---- | C] () -- C:\Windows\Alaunch.ini
[2007/01/13 01:42:27 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1114.dll
[2007/01/13 01:42:27 | 000,053,248 | ---- | C] () -- C:\Windows\System32\oemdspif.dll
[2007/01/13 01:42:24 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2007/01/13 01:42:24 | 000,077,824 | ---- | C] () -- C:\Windows\System32\hccutils.dll
[2007/01/13 01:41:21 | 000,015,190 | ---- | C] () -- C:\Windows\M2000T07.ini
[2007/01/02 22:54:14 | 000,266,240 | ---- | C] () -- C:\Windows\System32\NotesExtmngr.dll
[2007/01/02 22:53:54 | 000,204,800 | ---- | C] () -- C:\Windows\System32\NotesActnMenu.dll
[2007/01/02 22:53:20 | 000,086,016 | ---- | C] () -- C:\Windows\System32\MSNSpook.dll
[2007/01/02 22:52:40 | 000,037,376 | ---- | C] () -- C:\Windows\System32\MSNChatHook.dll
[2007/01/02 22:52:28 | 000,028,672 | ---- | C] () -- C:\Windows\System32\BatchCrypto.dll
[2007/01/02 22:52:26 | 000,073,728 | ---- | C] () -- C:\Windows\System32\APISlice.dll
[2007/01/02 22:52:18 | 000,063,488 | ---- | C] () -- C:\Windows\System32\ShowErrMsg.dll
[2006/12/25 19:44:48 | 000,022,016 | ---- | C] () -- C:\Windows\System32\MailFormat_U.dll
[2006/11/03 17:25:56 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:25:21 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2001/12/26 19:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll
[2001/11/14 12:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
[2001/09/04 02:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll
[2001/07/30 19:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll
[2001/07/24 01:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll

========== LOP Check ==========

[2010/01/12 02:35:58 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\Acer
[2010/02/17 23:09:41 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/06/14 12:00:51 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\FileZilla
[2010/04/09 14:14:19 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\HotSync
[2010/01/12 02:35:56 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\Leadertech
[2010/01/12 21:14:28 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\Libronix DLS
[2010/04/04 01:51:22 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\Research In Motion
[2010/06/16 11:05:58 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\Tific
[2010/04/27 02:45:52 | 000,000,000 | ---D | M] -- C:\Users\John N. W. Horace\AppData\Roaming\Titanium Gears
[2010/07/28 20:04:59 | 000,032,560 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010/07/28 19:17:53 | 000,000,446 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{BAF87866-2DCD-4E99-82D4-588C90CCA522}.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Users\John N. W. Horace\Documents\hands_on_guide_to_streaming_media_second_edition_an_introduction_to_delivering_on_demand_media.9780240808635.34861.pdf:Roxio EMC Stream
< End of report >

broni · 2010/07/28

Good

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

2. Download Temp File Cleaner (TFC)
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

3. Go to Kaspersky website and perform an online antivirus scan.

1. Disable your active antivirus program.
2. Read through the requirements and privacy statement and click on Accept button.
3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
4. When the downloads have finished, click on Settings.
5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

Spyware, Adware, Dialers, and other potentially dangerous programs
[*] Archives
[*] Mail databases

6. Click on My Computer under Scan.
7. Once the scan is complete, it will display the results. Click on View Scan Report.
8. You will see a list of infected items there. Click on Save Report As....
9. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

Equipper · 2010/07/29

Results of screen317's Security Check version 0.99.4
Windows Vista Service Pack 2 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Norton Internet Security
Norton 360
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Java(TM) 6 Update 21
Out of date Java installed!
Adobe Flash Player 10.1.53.64
Adobe Reader 9.3.3
````````````````````````````````
Process Check:
objlist.exe by Laurent
Norton ccSvcHst.exe
Empowering Technology eSettings Service capuserv.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

Equipper · 2010/07/29

I had a very tough time with the online scanning. After running for hours when I clicked on report, I saw a blank report. Not even a suspected item. I don't know if I did something wrong or I missed something. I want to do it all over again. Please understand. Thanks again for everything

Log in or Sign up

Solved Unable to install Updates: Error Message 646

Equipper Inactive Thread Starter

broni Moderator Malware Analyst

Equipper Inactive Thread Starter

broni Moderator Malware Analyst

Equipper Inactive Thread Starter

broni Moderator Malware Analyst

Equipper Inactive Thread Starter

broni Moderator Malware Analyst

Equipper Inactive Thread Starter

Equipper Inactive Thread Starter

Equipper Inactive Thread Starter

broni Moderator Malware Analyst

Equipper Inactive Thread Starter

broni Moderator Malware Analyst

Equipper Inactive Thread Starter

Equipper Inactive Thread Starter

Equipper Inactive Thread Starter

broni Moderator Malware Analyst

Equipper Inactive Thread Starter

Equipper Inactive Thread Starter

Share This Page

Log in or Sign up

Solved Unable to install Updates: Error Message 646

Equipper Inactive Thread Starter

broni Moderator Malware Analyst

Equipper Inactive Thread Starter

broni Moderator Malware Analyst

Equipper Inactive Thread Starter

broni Moderator Malware Analyst

Equipper Inactive Thread Starter

broni Moderator Malware Analyst

Equipper Inactive Thread Starter

Equipper Inactive Thread Starter

Equipper Inactive Thread Starter

broni Moderator Malware Analyst

Equipper Inactive Thread Starter

broni Moderator Malware Analyst

Equipper Inactive Thread Starter

Equipper Inactive Thread Starter

Equipper Inactive Thread Starter

broni Moderator Malware Analyst

Equipper Inactive Thread Starter

Equipper Inactive Thread Starter

Share This Page

Useful Searches