Inactive AVG finds generic18 trojan

[Inactive] AVG finds generic18 trojan

AVG has found for the last few scan the following:
"C:\Windows\System32\svchost.exe (1428) "; "Trojan horse Generic18.BNYJ ";" "
"C:\Windows\System32\svchost.exe (1428):\memory_07830000 "; "Trojan horse Generic18.BNYJ "; "Object is inaccessible. "

I have run Malwarebyte and Panda scan quick scan both find nothing. Is this virus really here? Thank you. DDS logs below:

DDS (Ver_10-10-10.03) - NTFSx86
Run by David at 7:34:50.59 on Mon 10/18/2010
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_22

============== Running Processes ===============


============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=74&bd=Pavilion&pf=desktop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=74&bd=Pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
uRun: [Google Update] "c:\users\david\appdata\local\google\update\GoogleUpdate.exe" /c
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe
mRun: [OsdMaestro] "c:\program files\hewlett-packard\on-screen osd indicator\OSD.exe "
mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe "
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe
mRun: [SunJavaUpdateReg] "c:\windows\system32\jureg.exe "
mRun: [<NO NAME>]
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\autost~1.lnk - c:\program files\wintv\Ir.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\wintvr~1.lnk - c:\program files\wintv\wintv7\WinTVTray.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} - hxxp://www.thelistingwidget.com/includes/uploader/ImageUploader5.cab
DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
DPF: {80AEEC0E-A2BE-4B8D-985F-350FE869DC40} - hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsVista.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} - hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsVista.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
AppInit_DLLs: avgrsstx.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\users\david\appdata\roaming\mozilla\firefox\profiles\mlcxnuno.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - component: c:\users\david\appdata\roaming\mozilla\firefox\profiles\mlcxnuno.default\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}\platform\winnt_x86-msvc\components\pagespeed.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll
FF - plugin: c:\program files\virtools\3d life player\npvirtools.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\david\appdata\local\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\users\david\appdata\locallow\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\users\david\appdata\roaming\move networks\plugins\npqmp071505000011.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbaam7a8h ", true);
c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);

============= SERVICES / DRIVERS ===============


=============== Created Last 30 ================

2010-10-15 18:57:34 6084944 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{418a7b0d-9116-46ee-9bb6-7b59f5654fe6}\mpengine.dll
2010-10-14 11:48:25 231936 ----a-w- c:\windows\system32\msshsq.dll
2010-10-13 13:30:16 866816 ----a-w- c:\windows\system32\wmpmde.dll
2010-10-13 13:30:05 168960 ----a-w- c:\program files\windows media player\wmplayer.exe
2010-10-13 13:30:04 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2010-10-13 13:29:28 303616 ----a-w- c:\windows\system32\drivers\srv.sys
2010-10-13 13:29:28 125952 ----a-w- c:\windows\system32\srvsvc.dll
2010-10-13 13:29:28 101888 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-10-13 13:29:27 17920 ----a-w- c:\windows\system32\netevent.dll
2010-10-13 13:29:27 145408 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-10-13 13:29:02 274432 ----a-w- c:\windows\system32\schannel.dll
2010-10-13 13:28:59 1315840 ----a-w- c:\windows\system32\ole32.dll
2010-10-13 13:28:58 339968 ----a-w- c:\program files\windows nt\accessories\wordpad.exe
2010-10-13 13:28:56 157184 ----a-w- c:\windows\system32\t2embed.dll
2010-10-13 13:28:54 954752 ----a-w- c:\windows\system32\mfc40.dll
2010-10-13 13:28:54 954288 ----a-w- c:\windows\system32\mfc40u.dll
2010-10-13 13:21:33 2037248 ----a-w- c:\windows\system32\win32k.sys
2010-10-13 13:21:30 531968 ----a-w- c:\windows\system32\comctl32.dll
2010-09-29 17:35:03 -------- d-----w- c:\users\david\appdata\local\PokerStars.NET
2010-09-29 17:34:33 -------- d-----w- c:\program files\PokerStars.NET
2010-09-28 21:47:11 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-22 23:10:52 103864 ----a-w- c:\program files\mozilla firefox\plugins\nppdf32.dll
2010-09-22 23:10:52 103864 ----a-w- c:\program files\internet explorer\plugins\nppdf32.dll

==================== Find3M ====================

2010-10-14 13:12:08 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-10-01 15:55:07 285480 ----a-w- c:\windows\system32\guard32.dll
2010-09-08 17:26:59 833024 ----a-w- c:\windows\system32\wininet.dll
2010-09-08 17:23:42 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-09-08 16:17:46 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-09-08 16:17:46 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-09-08 15:53:07 389632 ----a-w- c:\windows\system32\html.iec
2010-09-08 15:28:29 1383424 ----a-w- c:\windows\system32\mshtml.tlb
2010-08-17 13:32:33 126464 ----a-w- c:\windows\system32\spoolsv.exe
2010-07-27 23:44:10 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-07-27 23:44:10 107808 ----a-w- c:\windows\system32\dns-sd.exe

============= FINISH: 7:36:02.01 ===============


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-10-10.03)


==== Disk Partitions =========================


==== Disabled Device Manager Items =============

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

32 Bit HP CIO Components Installer
3DVIA player 5.0
6300
6300_Help
6300Trb
Ad-Aware
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.4.0
Adobe Shockwave Player 11.5
AIO_CDB_ProductContext
AIO_CDB_Software
AIO_Scan
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AutoUpdate
AVG Free 9.0
Bonjour
BufferChm
CCleaner
COMODO Internet Security
COMODO livePCsupport
Compatibility Pack for the 2007 Office system
Copy
Coupon Printer for Windows
CustomerResearchQFolder
Destination Component
DeviceDiscovery
DeviceManagementQFolder
DivX Version Checker
DocProc
DocProcQFolder
DScaler 5 Mpeg Decoders
eSupportQFolder
Fax
ffdshow [rev 1723] [2007-12-24]
FileZilla Client 3.3.3
FLV Player 2.0 (build 25)
Google Chrome
Google Earth Plug-in
Google Update Helper
Hardware Diagnostic Tools
Hauppauge MCE XP/Vista Software Encoder (2.0.27022)
Hauppauge WinTV 7
Hauppauge WinTV Infrared Remote
Hewlett-Packard Active Check for Health Check
Hewlett-Packard Asset Agent for Health Check
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Active Support Library 32 bit components
HP Customer Experience Enhancements
HP Customer Feedback
HP Customer Participation Program 8.0
HP Easy Setup - Frontend
HP Imaging Device Functions 8.0
HP OCR Software 8.0
HP On-Screen Cap/Num/Scroll Lock Indicator
HP Photosmart Essential
HP Photosmart Essential 2.01
HP Photosmart Essential2.01
HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
HP Product Assistant
HP Solution Center 8.0
HP Total Care Advisor
HP Update
HPProductAssistant
HPSSupply
IBP 11.7.4
Intel(R) Matrix Storage Manager
iPhone Configuration Utility
iTunes
Java Auto Updater
Java(TM) 6 Update 16
Java(TM) 6 Update 22
Junk Mail filter update
Kaspersky Online Scanner
LightScribe 1.8.15.1
Malwarebytes' Anti-Malware
MarketResearch
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Works
Move Media Player
Mozilla Firefox (3.6.10)
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
muvee autoProducer 6.0
My HP Games
NVIDIA Drivers
OGA Notifier 2.0.0048.0
OpenOffice.org 3.2
Orb
Orb Runtime libraries
Panda ActiveScan 2.0
PokerStars
PSSWCORE
Python 2.5
QuickTime
RealPlayer
Realtek High Definition Audio Driver
Recuva
Rhapsody
Rhapsody Player Engine
Roxio Creator Audio
Roxio Creator Basic v9
Roxio Creator Copy
Roxio Creator Data
Roxio Creator EasyArchive
Roxio Creator Tools
Roxio Express Labeler 3
Scan
Secunia PSI
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Shop for HP Supplies
Snapfish Picture Mover
SolutionCenter
Spelling Dictionaries Support For Adobe Reader 8
Spybot - Search & Destroy
SpywareBlaster 4.4
Status
SUPERAntiSpyware Free Edition
Toolbox
TrayApp
Unity Web Player
UnloadSupport
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
VideoToolkit01
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WeatherBug Gadget
WebReg
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live Mail
Windows Live Movie Maker
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Live Writer
Windows Media Player Firefox Plugin
WinMerge 2.12.4
WinPatrol 2009
WinRAR archiver
Xvid 1.1.3 final uninstall

==== End Of File ===========================

 

broni,

Thank you again for your help, the other computer was not mine I try to help my family and friends who are having trouble(for free) this is my computer logs:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4871

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

10/18/2010 10:27:32 AM
mbam-log-2010-10-18 (10-27-32).txt

Scan type: Full scan (C:\|)
Objects scanned: 277840
Time elapsed: 1 hour(s), 14 minute(s), 14 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
*******

GMER 1.0.15.15472 - http://www.gmer.net
Rootkit scan 2010-10-18 18:54:50
Windows 6.0.6001 Service Pack 1
Running: gmer.exe


---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Classes\CLSID\{87D91890-C280-268C-576E-0A7E35ACFC9
Reg HKLM\SOFTWARE\Classes\CLSID\{87D91890-C280-268C-576E-0A7E35ACFC9 0x61 0x61 0x00 0x00
Reg HKLM\SOFTWARE\Classes\CLSID\{87D91890-C280-268C-576E-0A7E35ACFC9 0x61 0x61 0x00 0x00

---- Files - GMER 1.0.15 ----

File C:\System Volume Information\MountPointManagerRemoteDatabase 0 bytes
File C:\System Volume Information\SPP 0 bytes
File C:\System Volume Information\SystemRestore 0 bytes
File C:\System Volume Information\tracking.log 20480 bytes
File C:\System Volume Information\Windows Backup 0 bytes
File C:\System Volume Information\Windows Backup\Catalogs 0 bytes
File C:\System Volume Information\Windows Backup\Catalogs\GlobalCatal 136 bytes
File C:\System Volume Information\{8b4a24c2-d5f5-11df-ab3c-001e8c052a 1717223424 bytes
File C:\System Volume Information\{8f101229-d787-11df-b2a5-001e8c052a 1145454592 bytes
File C:\System Volume Information\{9420692a-d9ee-11df-ae5e-001e8c052a 1429487616 bytes
File C:\System Volume Information\{b37ecb3d-daae-11df-ac4f-001e8c052a 1572864000 bytes
File C:\System Volume Information\{c64b92c8-d857-11df-a961-001e8c052a 942227456 bytes
File C:\System Volume Information\{c64b9346-d857-11df-a961-001e8c052a 973307904 bytes
File C:\System Volume Information\{d3860d3d-d464-11df-aa32-001e8c052a 1089044480 bytes
File C:\System Volume Information\{570df5aa-d2cf-11df-b5d6-001e8c052a 1079263232 bytes
File C:\System Volume Information\{570df5e6-d2cf-11df-b5d6-001e8c052a 1016725504 bytes
File C:\System Volume Information\{6a8692c8-d39b-11df-ae5f-001e8c052a -1721516032 bytes
File C:\System Volume Information\{e8f6adc8-d922-11df-aff0-001e8c052a -1958313984 bytes
File C:\System Volume Information\{ea24a248-d6b8-11df-a63a-001e8c052a 215449600 bytes
File C:\System Volume Information\{ea24a2dd-d6b8-11df-a63a-001e8c052a -885727232 bytes
File C:\System Volume Information\{f2024660-d78d-11df-ace8-001e8c052a 1117814784 bytes
File C:\System Volume Information\{f3671f31-d591-11df-a516-001e8c052a 951517184 bytes
File C:\System Volume Information\{05af71c8-d52e-11df-aca2-001e8c052a 746389504 bytes
File C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc7 65536 bytes
File C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl 64 bytes
File C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Applicat 0 bytes
File C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Forwarde 0 bytes
File C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security 64 bytes
File C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.e 64 bytes
File C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTMsMpPsSession.etl 0 bytes

---- EOF - GMER 1.0.15 ----


MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 1 (build 6001), 32-bit
Base Board Manufacturer: ASUSTek Computer INC.
BIOS Manufacturer: Phoenix Technologies, LTD
System Manufacturer: HP-Pavilion
System Product Name: GS220AAR-ABA s3200t
Logical Drives Mask: 0x0000003c

Kernel Drivers (total 151):
0x82648000 \SystemRoot\system32\ntkrnlpa.exe
0x82615000 \SystemRoot\system32\hal.dll
0x8040E000 \SystemRoot\system32\kdcom.dll
0x80416000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x80476000 \SystemRoot\system32\PSHED.dll
0x80487000 \SystemRoot\system32\BOOTVID.dll
0x8048F000 \SystemRoot\system32\CLFS.SYS
0x804D0000 \SystemRoot\system32\CI.dll
0x80603000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8067F000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8068C000 \SystemRoot\system32\drivers\acpi.sys
0x806D2000 \SystemRoot\system32\drivers\WMILIB.SYS
0x806DB000 \SystemRoot\system32\drivers\msisadrv.sys
0x806E3000 \SystemRoot\system32\drivers\pci.sys
0x8070A000 \SystemRoot\System32\drivers\partmgr.sys
0x80719000 \SystemRoot\system32\drivers\volmgr.sys
0x80728000 \SystemRoot\System32\drivers\volmgrx.sys
0x80772000 \SystemRoot\System32\drivers\mountmgr.sys
0x80782000 \SystemRoot\system32\drivers\pavboot.sys
0x88201000 \SystemRoot\system32\drivers\iastor.sys
0x882C8000 \SystemRoot\system32\drivers\fltmgr.sys
0x882FA000 \SystemRoot\system32\drivers\fileinfo.sys
0x8830A000 \SystemRoot\system32\DRIVERS\Lbd.sys
0x88319000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x88323000 \SystemRoot\System32\Drivers\ksecdd.sys
0x88403000 \SystemRoot\system32\drivers\ndis.sys
0x8850E000 \SystemRoot\system32\drivers\msrpc.sys
0x88539000 \SystemRoot\system32\drivers\NETIO.SYS
0x8860C000 \SystemRoot\System32\drivers\tcpip.sys
0x886F5000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8880D000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8891C000 \SystemRoot\system32\drivers\volsnap.sys
0x88955000 \SystemRoot\System32\Drivers\spldr.sys
0x8895D000 \SystemRoot\System32\Drivers\mup.sys
0x8896C000 \SystemRoot\System32\drivers\ecache.sys
0x88993000 \SystemRoot\system32\drivers\disk.sys
0x889A4000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x889C5000 \SystemRoot\system32\drivers\crcdisk.sys
0x889DB000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x889E6000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x889EF000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8CC0B000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x8D55F000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
0x8D561000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x88800000 \SystemRoot\System32\drivers\watchdog.sys
0x887D7000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8CC00000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x88573000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x887E9000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x885B1000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x885C1000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x885CF000 \SystemRoot\system32\DRIVERS\e100b325.sys
0x88394000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x88600000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x883A7000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x883B2000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x887F8000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x883CA000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x80788000 \SystemRoot\system32\DRIVERS\storport.sys
0x807C9000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x807D4000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x807EB000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x805B0000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x805D3000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x805E2000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8D607000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8D61C000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8D62C000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8D62E000 \SystemRoot\system32\DRIVERS\ks.sys
0x8D658000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8D662000 \SystemRoot\system32\DRIVERS\TMPassthru.sys
0x8D693000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8D6A0000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8D6D4000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8DA0E000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x8DCAB000 \SystemRoot\system32\drivers\portcls.sys
0x8DCD8000 \SystemRoot\system32\drivers\drmk.sys
0x8DCFD000 \SystemRoot\System32\DRIVERS\cmdguard.sys
0x8DD3A000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8DD43000 \SystemRoot\System32\Drivers\Null.SYS
0x8DD4A000 \SystemRoot\System32\Drivers\Beep.SYS
0x8DD51000 \SystemRoot\System32\drivers\vga.sys
0x8DD5D000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8DD7E000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8DD86000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8DD8E000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8DD99000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8DDA7000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8DDB0000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8DDC6000 \SystemRoot\System32\DRIVERS\cmdhlp.sys
0x8D6E5000 \SystemRoot\System32\Drivers\avgtdix.sys
0x8D71F000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8DDD0000 \SystemRoot\system32\DRIVERS\smb.sys
0x8D751000 \SystemRoot\system32\drivers\afd.sys
0x8DDE4000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8D799000 \SystemRoot\system32\DRIVERS\inspect.sys
0x8DA00000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8D7AE000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8D7C1000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
0x8DDFA000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0x8E409000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8E445000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8E44F000 \SystemRoot\System32\Drivers\dfsc.sys
0x8E466000 \SystemRoot\System32\Drivers\avgmfx86.sys
0x8E46C000 \SystemRoot\System32\Drivers\avgldx86.sys
0x8E4A0000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x8E4B7000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8E4B9000 \SystemRoot\system32\DRIVERS\hcw72ATV.sys
0x8E5E3000 \SystemRoot\system32\DRIVERS\BdaSup.SYS
0x8E5E6000 \SystemRoot\system32\DRIVERS\hcw72ADFilter.sys
0x8E5EE000 \SystemRoot\system32\drivers\usbaudio.sys
0x8EC00000 \SystemRoot\system32\DRIVERS\hcw72DTV.sys
0x8ED2A000 \SystemRoot\system32\DRIVERS\usbscan.sys
0x8ED37000 \SystemRoot\system32\DRIVERS\usbprint.sys
0x8ED41000 \SystemRoot\system32\DRIVERS\dot4usb.sys
0x8ED4E000 \SystemRoot\system32\DRIVERS\Dot4.sys
0x8ED73000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x8ED85000 \SystemRoot\system32\DRIVERS\Dot4Prt.sys
0x8ED8E000 \SystemRoot\system32\drivers\RTSTOR.SYS
0x8EDA2000 \SystemRoot\System32\Drivers\crashdmp.sys
0x88710000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x95EA0000 \SystemRoot\System32\win32k.sys
0x8EDAF000 \SystemRoot\System32\drivers\Dxapi.sys
0x8EDB9000 \SystemRoot\system32\DRIVERS\monitor.sys
0x960C0000 \SystemRoot\System32\TSDDD.dll
0x960E0000 \SystemRoot\System32\cdd.dll
0x8EDC8000 \SystemRoot\system32\drivers\luafv.sys
0x9BC0B000 \SystemRoot\system32\drivers\spsys.sys
0x9BCBA000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x9BCCA000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x9BCDD000 \SystemRoot\system32\drivers\HTTP.sys
0x9BD4A000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9BD67000 \SystemRoot\system32\DRIVERS\bowser.sys
0x9BD80000 \SystemRoot\System32\drivers\mpsdrv.sys
0x9BD95000 \SystemRoot\system32\drivers\mrxdav.sys
0x9BDB5000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x9EE00000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9EE39000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9EE51000 \SystemRoot\System32\DRIVERS\srv2.sys
0x9EE79000 \SystemRoot\System32\DRIVERS\srv.sys
0x9EEDF000 \SystemRoot\system32\drivers\peauth.sys
0x9EFBD000 \SystemRoot\System32\Drivers\secdrv.SYS
0x9EFC7000 \SystemRoot\System32\drivers\tcpipreg.sys
0x9EFD3000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0x9EFE8000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
0x9EFFA000 \SystemRoot\system32\drivers\MSPQM.sys
0x9EEC7000 \SystemRoot\system32\drivers\tdtcp.sys
0x9EED2000 \SystemRoot\System32\DRIVERS\tssecsrv.sys
0xA820C000 \SystemRoot\System32\Drivers\RDPWD.SYS
0xA823F000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x779D0000 \Windows\System32\ntdll.dll

Processes (total 82):
0 System Idle Process
4 System
512 C:\Windows\System32\smss.exe
588 csrss.exe
640 C:\Windows\System32\wininit.exe
652 csrss.exe
660 C:\Program Files\AVG\AVG9\avgchsvx.exe
668 C:\Program Files\AVG\AVG9\avgrsx.exe
724 C:\Program Files\AVG\AVG9\avgcsrvx.exe
740 C:\Windows\System32\services.exe
752 C:\Windows\System32\lsass.exe
760 C:\Windows\System32\lsm.exe
896 C:\Windows\System32\winlogon.exe
1112 C:\Windows\System32\svchost.exe
1168 C:\Program Files\COMODO\COMODO livePCsupport\CLPSLS.exe
1180 C:\Windows\System32\nvvsvc.exe
1208 C:\Windows\System32\svchost.exe
1280 C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
1340 C:\Windows\System32\svchost.exe
1356 C:\Windows\System32\svchost.exe
1472 C:\Windows\System32\svchost.exe
1512 C:\Windows\System32\svchost.exe
1536 C:\Windows\System32\svchost.exe
1640 C:\Windows\System32\audiodg.exe
1660 C:\Windows\System32\svchost.exe
1680 C:\Windows\System32\SLsvc.exe
1708 C:\Windows\System32\svchost.exe
1860 C:\Windows\System32\nvvsvc.exe
348 C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
1844 C:\Windows\System32\spoolsv.exe
2044 C:\Windows\System32\svchost.exe
2284 C:\Windows\System32\dwm.exe
2312 C:\Windows\System32\taskeng.exe
2352 C:\Windows\explorer.exe
2384 C:\Windows\System32\taskeng.exe
2704 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
2736 C:\Program Files\AVG\AVG9\avgwdsvc.exe
2756 C:\Program Files\Bonjour\mDNSResponder.exe
2848 C:\PROGRA~1\WinTV\TVServer\HAUPPA~1.EXE
2896 C:\Windows\System32\svchost.exe
2948 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
3040 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
3060 C:\Windows\System32\svchost.exe
3104 C:\Windows\System32\svchost.exe
3116 C:\Windows\System32\svchost.exe
3148 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
3196 C:\Windows\System32\svchost.exe
3292 C:\Windows\System32\svchost.exe
3340 C:\Windows\System32\SearchIndexer.exe
3464 C:\Program Files\AVG\AVG9\avgemc.exe
3516 C:\Program Files\AVG\AVG9\avgnsx.exe
3668 WUDFHost.exe
3768 C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
3932 C:\Program Files\AVG\AVG9\avgcsrvx.exe
1204 CAPTUR~4.EXE
2412 C:\Program Files\Windows Defender\MSASCui.exe
2668 C:\hp\support\hpsysdrv.exe
2972 C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
2504 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
2440 C:\Windows\RtHDVCpl.exe
1388 C:\Windows\System32\jureg.exe
1504 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
2104 C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
2516 C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
2968 C:\Program Files\AVG\AVG9\avgtray.exe
3156 C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
2856 C:\Program Files\iTunes\iTunesHelper.exe
3436 C:\Program Files\Common Files\Java\Java Update\jusched.exe
3976 C:\Program Files\WinTV\Ir.exe
3192 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
3256 C:\Program Files\WinTV\WinTV7\WinTVTray.exe
3220 C:\Windows\System32\schtasks.exe
4296 C:\Users\David\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe
5016 C:\Program Files\iPod\bin\iPodService.exe
5296 C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
5568 C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
636 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
4244 C:\Windows\System32\wuauclt.exe
5620 C:\Program Files\Orb Networks\Orb\bin\OrbLauncher.exe
5008 dllhost.exe
5880 dllhost.exe
2040 C:\Users\David\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000023`31991200 (NTFS)

PhysicalDrive0 Model Number: SAMSUNGHD161HJ, Rev: JF100-19

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Hewlett-Packard MBR code detected
SHA1: 161E5DF10EB9B6EAC4AA8DF99305EF77B11BEBD8


Done!

 

here is combo fix:

ComboFix 10-10-18.01 - David 10/18/2010 20:28:40.1.2 - x86
Running from: c:\users\David\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\install.exe
c:\users\David\AppData\Roaming\EurekaLog
c:\users\David\AppData\Roaming\Microsoft\Windows\Recent\smokinhumidors.com-Mar-2010.pif
c:\windows\system32\jusched.exe

.
((((((((((((((((((((((((( Files Created from 2010-09-19 to 2010-10-19 )))))))))))))))))))))))))))))))
.

2010-10-19 01:35 . 2010-10-19 01:35 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-15 18:57 . 2010-09-09 22:52 6084944 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{418A7B0D-9116-46EE-9BB6-7B59F5654FE6}\mpengine.dll
2010-10-14 11:48 . 2010-09-20 09:25 231936 ----a-w- c:\windows\system32\msshsq.dll
2010-10-13 13:30 . 2010-08-20 15:21 866816 ----a-w- c:\windows\system32\wmpmde.dll
2010-10-13 13:30 . 2010-09-10 16:35 168960 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2010-10-13 13:30 . 2010-09-10 16:37 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2010-10-13 13:29 . 2010-09-06 16:24 125952 ----a-w- c:\windows\system32\srvsvc.dll
2010-10-13 13:29 . 2010-09-06 14:13 303616 ----a-w- c:\windows\system32\drivers\srv.sys
2010-10-13 13:29 . 2010-09-06 14:12 101888 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-10-13 13:29 . 2010-09-06 16:23 17920 ----a-w- c:\windows\system32\netevent.dll
2010-10-13 13:29 . 2010-09-06 14:12 145408 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-10-13 13:29 . 2010-08-10 15:02 274432 ----a-w- c:\windows\system32\schannel.dll
2010-10-13 13:28 . 2010-06-28 16:15 1315840 ----a-w- c:\windows\system32\ole32.dll
2010-10-13 13:28 . 2010-06-28 14:31 339968 ----a-w- c:\program files\Windows NT\Accessories\wordpad.exe
2010-10-13 13:28 . 2010-08-26 16:07 157184 ----a-w- c:\windows\system32\t2embed.dll
2010-10-13 13:28 . 2010-08-31 15:41 954752 ----a-w- c:\windows\system32\mfc40.dll
2010-10-13 13:28 . 2010-08-31 15:41 954288 ----a-w- c:\windows\system32\mfc40u.dll
2010-10-13 13:21 . 2010-08-31 13:39 2037248 ----a-w- c:\windows\system32\win32k.sys
2010-10-13 13:21 . 2010-08-31 15:40 531968 ----a-w- c:\windows\system32\comctl32.dll
2010-10-08 13:36 . 2010-10-08 13:36 -------- d-----w- c:\program files\Common Files\Adobe
2010-09-29 17:35 . 2010-09-29 17:44 -------- d-----w- c:\users\David\AppData\Local\PokerStars.NET
2010-09-29 17:34 . 2010-09-29 18:12 -------- d-----w- c:\program files\PokerStars.NET
2010-09-28 21:47 . 2010-06-22 12:57 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-22 23:10 . 2010-09-22 23:10 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2010-09-22 23:10 . 2010-09-22 23:10 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update "= "c:\users\David\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-03-13 135664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender "= "c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"hpsysdrv "= "c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"OsdMaestro "= "c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
"IAAnotif "= "c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-07-13 178712]
"RtHDVCpl "= "RtHDVCpl.exe" [2008-01-15 4874240]
"HP Health Check Scheduler "= "c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-05-24 71176]
"SunJavaUpdateReg "= "c:\windows\system32\jureg.exe" [2009-10-11 55072]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152]
"Ad-Watch "= "c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-04-22 788880]
"WinPatrol "= "c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2009-10-10 320832]
"AVG9_TRAY "= "c:\progra~1\AVG\AVG9\avgtray.exe" [2010-10-06 2067808]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2009-06-26 13789728]
"Malwarebytes Anti-Malware (reboot) "= "c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
"COMODO Internet Security "= "c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-10-01 2500552]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher "= "c:\windows\SMINST\launcher.exe" [2007-04-03 44168]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AutoStart IR.lnk - c:\program files\WinTV\Ir.exe [2009-11-1 117344]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
WinTV Recording Status..lnk - c:\program files\WinTV\WinTV7\WinTVTray.exe [2009-11-1 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-06 14:16 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CLPSLS]
@= "Service "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@= "Service "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Privoxy.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Privoxy.lnk
backup=c:\windows\pss\Privoxy.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snapfish Media Detector.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish Media Detector.lnk
backup=c:\windows\pss\Snapfish Media Detector.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-09-01 13:32 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-09-08 16:17 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2008-01-19 07:33 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-06-18 14:46 185896 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"IBP "=

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride "=dword:00000001

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-15 136176]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-04-22 1181328]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [x]
R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-07-07 14904]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2010-03-04 12872]
R3 TMPassthru;Trend Micro Passthru Ndis Service;c:\windows\system32\DRIVERS\TMPassthru.sys [2008-03-02 206608]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-09-23 64288]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-06-30 28552]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2010-07-15 216400]
S1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2010-07-15 243024]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2010-10-01 236088]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2010-10-01 30112]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-03-04 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2010-07-28 67656]
S2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [2010-07-21 921952]
S2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-07-15 308136]
S2 CLPSLS;COMODO livePCsupport Service;c:\program files\COMODO\COMODO livePCsupport\CLPSLS.exe [2010-02-13 148744]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 hcw72ADFilter;WinTV HVR-950 USB Audio Filter Driver;c:\windows\system32\DRIVERS\hcw72ADFilter.sys [2010-04-23 28928]
S3 hcw72ATV;WinTV HVR-950 NTSC;c:\windows\system32\DRIVERS\hcw72ATV.sys [2010-04-23 1217920]
S3 hcw72DTV;WinTV HVR-950 ATSC/QAM;c:\windows\system32\DRIVERS\hcw72DTV.sys [2010-04-23 1220224]
S3 TMPassthruMP;TMPassthruMP;c:\windows\system32\DRIVERS\TMPassthru.sys [2008-03-02 206608]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2010-10-18 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 16:14]

2010-10-18 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 16:14]

2010-10-18 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 16:14]

2010-10-18 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 16:14]

2010-10-18 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 16:14]

2010-10-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-25 00:37]

2010-10-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-25 00:37]

2010-10-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-942920361-1515226988-2560670545-1000Core.job
- c:\users\David\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-13 04:27]

2010-10-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-942920361-1515226988-2560670545-1000UA.job
- c:\users\David\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-13 04:27]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=74&bd=Pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\users\David\AppData\Roaming\Mozilla\Firefox\Profiles\mlcxnuno.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\users\David\AppData\Roaming\Mozilla\Firefox\Profiles\mlcxnuno.default\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}\platform\WINNT_x86-msvc\components\pagespeed.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\David\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\users\David\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\users\David\AppData\Roaming\Move Networks\plugins\npqmp071505000011.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbaam7a8h ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled ", false);
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-Orb - c:\program files\Orb Networks\Orb\bin\OrbTray.exe
MSConfigStartUp-Vidalia - c:\program files\Vidalia Bundle\Vidalia\vidalia.exe


.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(752)
c:\windows\system32\guard32.dll
.
Completion time: 2010-10-18 20:37:59
ComboFix-quarantined-files.txt 2010-10-19 01:37

Pre-Run: 94,232,449,024 bytes free
Post-Run: 93,840,113,664 bytes free

- - End Of File - - 0B3182B8B49DB53490EC90310E1CE885

 

WinPatrol popped up a couple times during scan here are logs:

OTL Extras logfile created on: 10/18/2010 8:58:56 PM - Run 1
OTL by OldTimer - Version 3.2.15.2 Folder = C:\Users\David\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 45.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 140.77 Gb Total Space | 87.45 Gb Free Space | 62.12% Space Free | Partition Type: NTFS
Drive D: | 8.27 Gb Total Space | 0.81 Gb Free Space | 9.76% Space Free | Partition Type: NTFS

Computer Name: BAR1 | User Name: David | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink -- (EarthLink, Inc.)


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{056BC492-A94A-4DBE-87BE-02B79A8C9BC4}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{07C846A8-BB54-4E9D-BE77-A1C3E6C6BDFF}" = lport=445 | protocol=6 | dir=in | app=system |
"{2DD56FA8-5CF0-495E-B2A0-D32CF4744D8F}" = rport=139 | protocol=6 | dir=out | app=system |
"{574CE121-7A0A-45A3-9898-ABCCD7ADAFE1}" = lport=138 | protocol=17 | dir=in | app=system |
"{6BB9F9EC-E5B0-4744-BDF2-A78DEB1C5ACE}" = lport=139 | protocol=6 | dir=in | app=system |
"{A0E21FB5-7377-4C22-862B-7243083BB1D7}" = rport=137 | protocol=17 | dir=out | app=system |
"{A14A2E7B-F4A3-4AAE-AA43-488C0B1F2E26}" = rport=138 | protocol=17 | dir=out | app=system |
"{B016628B-F462-498D-97C2-B42A1F08CD57}" = rport=445 | protocol=6 | dir=out | app=system |
"{CE711109-CD7A-480E-8992-CE9EF450B128}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{F53758F3-6185-4E3F-AC99-AC3191393679}" = lport=137 | protocol=17 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00074F51-10A3-40D7-9636-A9D257FAE654}" = protocol=6 | dir=in | app=c:\program files\orb networks\orb\bin\orbcontrolpanel.exe |
"{0A6B221E-BF22-4A80-BA0E-B9F031E38BE2}" = protocol=6 | dir=in | app=c:\program files\orb networks\orb\bin\orbjetmanager.exe |
"{0D04405A-3876-4BD8-95D9-78B6D18F4177}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{0D09755B-BA55-45CF-B8B1-B5955A2C19BA}" = protocol=6 | dir=in | app=c:\program files\orb networks\orb\bin\orbsetupwizard.exe |
"{129BB456-305C-42B5-BD0B-29D5A3F8EFFB}" = protocol=17 | dir=in | app=c:\program files\orb networks\orb\bin\orbir.exe |
"{159C0F87-FA83-4CF6-9CEC-7979FD6BB4EA}" = protocol=17 | dir=in | app=c:\program files\orb networks\orb\bin\orbstreamerclient.exe |
"{164954AB-14FF-493E-9DF7-19D7B3EE5320}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{210F2224-C719-40D4-8110-6B66FFDB0BB7}" = protocol=6 | dir=in | app=c:\users\david\appdata\local\tversity\media server\mediaserver.exe |
"{2FEF326A-7AB1-4084-B0A0-F8784A4A09C5}" = protocol=6 | dir=in | app=c:\program files\orb networks\orb\bin\orbir.exe |
"{30B39D0C-0FDF-4F48-9277-93F6591B6F07}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{3151150A-96A8-410F-B1DB-9B0EFDD038F0}" = protocol=6 | dir=in | app=c:\program files\orb networks\orb\bin\orb.exe |
"{385BD3D7-924B-49F6-BF69-C6E8BEE036CC}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{3EBEF80A-0766-4D4C-B4AC-F462623BD810}" = protocol=17 | dir=in | app=c:\program files\orb networks\orb\bin\orblauncher.exe |
"{40F96D82-182F-4BB8-9AC8-86E68C548FD7}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{449952C7-F32D-4EFE-AAE4-CE64F95A1CD2}" = protocol=17 | dir=in | app=c:\program files\orb networks\orb\bin\orbir.exe |
"{4D616283-5D94-4B8B-8D86-F964F94FE735}" = protocol=6 | dir=in | app=c:\program files\orb networks\orb\bin\orbsetupwizard.exe |
"{59C06907-74B6-4038-A278-CA4782C992B6}" = protocol=6 | dir=in | app=c:\program files\orb networks\orb\bin\xmltv.exe |
"{5BEBF491-BCAE-42CC-B6A1-6499B98B8AD3}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{5EEFC2AA-F728-420C-A9B9-1F5C4423F21B}" = dir=in | app=c:\program files\avg\avg9\avgnsx.exe |
"{6298F139-E1C7-46FF-BF48-2F193F2EFF62}" = protocol=6 | dir=in | app=c:\program files\orb networks\orb\bin\orblauncher.exe |
"{6828C238-0573-4511-86BB-EA8D1250B43A}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{6DB93657-804D-4D0A-8B94-DD49630C1FA1}" = dir=in | app=c:\program files\avg\avg8\avgupd.exe |
"{74FB0636-6355-42FA-861B-E7FB015ED517}" = dir=in | app=c:\program files\avg\avg8\avgemc.exe |
"{7A1BC16D-3D78-4B1E-8572-D7CF1ABE19FC}" = protocol=17 | dir=in | app=c:\program files\orb networks\orb\bin\orbsetupwizard.exe |
"{7DA5325F-9709-4B2C-83E8-F29764730FDF}" = protocol=6 | dir=in | app=c:\program files\orb networks\orb\bin\orb.exe |
"{83C9DD4D-235D-4D73-88AF-4160F3118C1D}" = protocol=17 | dir=in | app=c:\program files\orb networks\orb\bin\orb.exe |
"{86014E7B-5664-41FA-8470-DFEBFD7AF4DD}" = protocol=6 | dir=in | app=c:\program files\orb networks\orb\bin\orbir.exe |
"{8FECB406-1E0B-4DE4-BF00-D6F6CCAEAAE0}" = protocol=17 | dir=in | app=c:\program files\orb networks\orb\bin\xmltv.exe |
"{92C79DE5-A361-4E22-8CE1-2847364F76EC}" = protocol=6 | dir=in | app=c:\program files\orb networks\orb\bin\orbtray.exe |
"{931603FA-F4F7-4332-BFFE-AFBF8EB3EB3C}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{9372ACAE-4BCB-4D0A-A4EE-F25CE34F28B4}" = protocol=17 | dir=in | app=c:\program files\orb networks\orb\bin\orbstreamerclient.exe |
"{980DEA9D-1EB6-4DCE-8DFF-460531DF8CD3}" = protocol=6 | dir=in | app=c:\program files\orb networks\orb\bin\orbcontrolpanel.exe |
"{B83E1A49-CC78-4DF8-BA10-9A68E4ECBB46}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{B996DD66-571F-4AE2-B3F7-C869198D7F30}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{BA770E79-EF74-4D06-AF37-426EE93744CA}" = protocol=6 | dir=in | app=c:\program files\orb networks\orb\bin\orbstreamerclient.exe |
"{BE0F44E3-C08F-40F3-A39A-259AA346DB68}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{C72BD36F-828E-4890-80A0-222783C22817}" = protocol=17 | dir=in | app=c:\program files\orb networks\orb\bin\orbjetmanager.exe |
"{CBCBF724-E942-4088-86C2-72D67F95ED3A}" = protocol=17 | dir=in | app=c:\program files\orb networks\orb\bin\orbtray.exe |
"{D29F502C-4CAC-4E39-91EB-AC6945B9EA81}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{D3282EED-8576-4674-9F7A-65EEDA373664}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{D711AB20-C9CC-4BB5-8F52-6ACB9E0CD618}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{D76C493B-0D5A-42C4-9B67-BD5FC5168AF1}" = protocol=17 | dir=in | app=c:\program files\orb networks\orb\bin\orbsetupwizard.exe |
"{D8973C36-3668-4BA4-83C7-B76301B1C2C9}" = protocol=6 | dir=in | app=c:\program files\orb networks\orb\bin\orblauncher.exe |
"{DCE8A4FF-23E4-41D6-AAE9-12DFC63DCDE9}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{E1C4405D-0564-4CE9-BFF1-B9517C8C2B1A}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{E3AC7CB7-63E5-4062-8028-3AC82143CE3D}" = protocol=17 | dir=in | app=c:\program files\orb networks\orb\bin\orbcontrolpanel.exe |
"{E4E3CAA4-4D30-4CD3-9A5B-2D1C64F2A2B5}" = protocol=17 | dir=in | app=c:\users\david\appdata\local\tversity\media server\mediaserver.exe |
"{E5367B6E-837C-43B6-86BD-DE40FE3A6794}" = protocol=17 | dir=in | app=c:\program files\orb networks\orb\bin\orbcontrolpanel.exe |
"{F36A0994-4611-4213-8C05-12C54794E6AB}" = protocol=17 | dir=in | app=c:\program files\orb networks\orb\bin\orb.exe |
"{F7957A44-2203-4944-AF4E-D0BB220D8BA9}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{F908F2E2-761C-4159-9BEA-78EC5F46686A}" = protocol=6 | dir=in | app=c:\program files\orb networks\orb\bin\orbstreamerclient.exe |
"{FAF4E1D1-EDDA-4B76-A9EA-7DBAA33978CF}" = protocol=17 | dir=in | app=c:\program files\orb networks\orb\bin\orblauncher.exe |
"TCP Query User{1BFAA071-94CD-477D-9C0F-ED853CC8722B}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{24BA98FF-D59B-4B36-9FB5-EB9D78AB97D0}C:\program files\filezilla ftp client\filezilla.exe" = protocol=6 | dir=in | app=c:\program files\filezilla ftp client\filezilla.exe |
"TCP Query User{2774AA77-4733-4287-92D3-56F8773FE129}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"TCP Query User{2F703D59-08E6-41DA-95B6-EA12EBC72DD0}C:\program files\orb networks\orb\bin\orbtray.exe" = protocol=6 | dir=in | app=c:\program files\orb networks\orb\bin\orbtray.exe |
"TCP Query User{423A4773-6F54-4072-8D12-26E36FDE60F8}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"TCP Query User{77091600-3940-443F-B4BC-26D5EEA1A781}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{7DE9B771-9111-4641-B52C-0C95F95A6EDE}C:\program files\mirc\mirc.exe" = protocol=6 | dir=in | app=c:\program files\mirc\mirc.exe |
"TCP Query User{8247AD25-BA56-4B12-B75F-C824078807FB}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{904C03A1-5452-4E53-82B7-C6FCEE4FFFCF}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{98ABDF7C-9F5A-4361-93E1-60E38E1962B1}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"TCP Query User{BA6181D0-43CF-4F33-925F-B2259AE8768F}C:\program files\mirc\mirc.exe" = protocol=6 | dir=in | app=c:\program files\mirc\mirc.exe |
"TCP Query User{CAE731B9-F80F-4012-9A9D-85D82E0F1FAE}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe |
"UDP Query User{1F7E4570-486A-46EF-A5EE-06A460EE0B93}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"UDP Query User{2AB8D6E1-7079-4E52-9FF3-CC0C8D2BF295}C:\program files\orb networks\orb\bin\orbtray.exe" = protocol=17 | dir=in | app=c:\program files\orb networks\orb\bin\orbtray.exe |
"UDP Query User{3B46C26F-BB7D-4A7C-9D81-0F71A8AC6698}C:\program files\filezilla ftp client\filezilla.exe" = protocol=17 | dir=in | app=c:\program files\filezilla ftp client\filezilla.exe |
"UDP Query User{431B3BF6-D17A-40CD-A049-365AC86FBDAE}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{55029768-7F75-46D7-91BF-6E7C8517A179}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{5FE54CC0-E5D4-4F3D-B9B9-4619C4662891}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe |
"UDP Query User{850E6278-7C09-40C1-9B9F-1C7E051350CA}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"UDP Query User{8C1ADDD2-CAD7-4F07-A3FF-94AE69C90DA8}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"UDP Query User{AD86A140-5C37-4554-B89F-091649FDD29F}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{BBF158E0-98C1-41AF-B42A-1F2B91354C58}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{CD666AD2-6D65-4997-AC4F-591EABE5438A}C:\program files\mirc\mirc.exe" = protocol=17 | dir=in | app=c:\program files\mirc\mirc.exe |
"UDP Query User{F1F80925-B1A7-4F04-B1C8-88DBE60BB325}C:\program files\mirc\mirc.exe" = protocol=17 | dir=in | app=c:\program files\mirc\mirc.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
"{029B5901-1F27-4347-9923-E8ACC8F54E15}" = Snapfish Picture Mover
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack
"{0A2C5854-557E-48C8-835A-3B9F074BDCAA}" = Python 2.5
"{0A47BAFF-D4FF-4BD3-96CA-02A22EA62722}" = HP Active Support Library
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{0DDA7620-4F8B-43B3-8828-CA5EE292FA3B}" = HP Total Care Advisor
"{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}" = Roxio Creator EasyArchive
"{139E303E-1050-497F-98B1-9AE87B15C463}" = Windows Live Family Safety
"{14AF024E-2E3B-49D0-A175-D1C1A06B155A}" = muvee autoProducer 6.0
"{171E6C1E-B5FC-11DF-B115-005056C00008}" = Google Earth Plug-in
"{17271AB7-D7EC-4a95-9861-FAFE5A4664AD}" = 6300Trb
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{209CDA54-D390-46A2-A97C-7BF61734418D}" = WeatherBug Gadget
"{2133CB3F-F891-4081-8681-FEE2B2419FF4}" = Orb Runtime libraries
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check for Health Check
"{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer
"{26A24AE4-039D-4CA4-87B4-2F83216016F0}" = Java(TM) 6 Update 16
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{350FB27C-CF62-4EF3-AF9D-70FF313FE221}" = iTunes
"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
"{377B2121-65F6-4C5F-998F-5284DEF41F3E}" = COMODO livePCsupport
"{39CB30DB-27F8-4dd4-A294-CB4AE3B584FD}" = Copy
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D5044A5-97B8-45C0-B956-BB2376569188}" = Windows Live Movie Maker
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{40F7AED3-0C7D-4582-99F6-484A515C73F2}" = HP Easy Setup - Frontend
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E868D3D-6EEB-4273-926C-2287236B5B79}" = 3DVIA player 5.0
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6D3DB611-D5E8-4E4B-8952-0D3F549F9CC6}" = HP Active Support Library 32 bit components
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{824D3839-DAA1-4315-A822-7AE3E620E528}" = VideoToolkit01
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8389382B-53BA-4A87-8854-91E3D80A5AC7}" = HP Photosmart Essential2.01
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
"{9DBA770F-BF73-4D39-B1DF-6035D95268FC}" = HP Customer Feedback
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AB5E289E-76BF-4251-9F3F-9B763F681AE0}" = HP Customer Experience Enhancements
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.0
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B395BC1D-CC06-425E-9049-4CD985EFF004}" = LightScribe 1.8.15.1
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply
"{BDEDBDD9-C97B-4333-B7BE-6979A34F6F74}" = 6300_Help
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{BEFBEDDF-1417-4C8A-92FB-F003C0D41199}" = OpenOffice.org 3.2
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Basic v9
"{C8FD5BC1-92EF-4C15-92A9-F9AC7F61985F}" = HP Update
"{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}" = HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
"{CC6B1BB4-4E06-4A5B-A166-B371B551324B}" = COMODO Internet Security
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E09575B2-498D-4C8B-A9D2-623F78574F29}" = AIO_CDB_Software
"{E2CB21A2-FD45-4353-888B-FFD071270F35}" = 6300
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EEEB604C-C1A7-4f8c-B03F-56F9C1C9C45F}" = Fax
"{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F72E2DDC-3DB8-4190-A21D-63883D955FE7}" = PSSWCORE
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone Configuration Utility
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"ActiveScan 2.0" = Panda ActiveScan 2.0
"Ad-Aware" = Ad-Aware
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AVG9Uninstall" = AVG Free 9.0
"CCleaner" = CCleaner
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"DScaler 5 Mpeg Decoders_is1" = DScaler 5 Mpeg Decoders
"ffdshow_is1" = ffdshow [rev 1723] [2007-12-24]
"FileZilla Client" = FileZilla Client 3.3.3
"FLV Player" = FLV Player 2.0 (build 25)
"Hauppauge MCE2005 Software Encoder" = Hauppauge MCE XP/Vista Software Encoder (2.0.27022)
"Hauppauge WinTV 7" = Hauppauge WinTV 7
"Hauppauge WinTV Infrared Remote" = Hauppauge WinTV Infrared Remote
"HijackThis" = HijackThis 2.0.2
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Photosmart Essential" = HP Photosmart Essential 2.01
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"HPOCR" = HP OCR Software 8.0
"IBP11_is1" = IBP 11.7.4
"Kaspersky Online Scanner" = Kaspersky Online Scanner
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)
"NVIDIA Drivers" = NVIDIA Drivers
"Orb" = Orb
"OsdMaestro" = HP On-Screen Cap/Num/Scroll Lock Indicator
"PC-Doctor 5 for Windows" = Hardware Diagnostic Tools
"PokerStars" = PokerStars
"RealPlayer 6.0" = RealPlayer
"Recuva" = Recuva
"Rhapsody" = Rhapsody
"Secunia PSI" = Secunia PSI
"Shop for HP Supplies" = Shop for HP Supplies
"SpywareBlaster_is1" = SpywareBlaster 4.4
"WildTangent hp Master Uninstall" = My HP Games
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinMerge_is1" = WinMerge 2.12.4
"WinPatrol" = WinPatrol 2009
"WinRAR archiver" = WinRAR archiver
"Xvid_is1" = Xvid 1.1.3 final uninstall

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"Move Media Player" = Move Media Player
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 10/18/2010 9:57:12 PM | Computer Name = bar1 | Source = SDWinSec.exe | ID = 0
Description =

Error - 10/18/2010 9:58:12 PM | Computer Name = bar1 | Source = SDWinSec.exe | ID = 0
Description =

Error - 10/18/2010 9:59:12 PM | Computer Name = bar1 | Source = SDWinSec.exe | ID = 0
Description =

Error - 10/18/2010 10:00:12 PM | Computer Name = bar1 | Source = SDWinSec.exe | ID = 0
Description =

Error - 10/18/2010 10:01:12 PM | Computer Name = bar1 | Source = SDWinSec.exe | ID = 0
Description =

Error - 10/18/2010 10:02:12 PM | Computer Name = bar1 | Source = SDWinSec.exe | ID = 0
Description =

Error - 10/18/2010 10:03:12 PM | Computer Name = bar1 | Source = SDWinSec.exe | ID = 0
Description =

Error - 10/18/2010 10:04:12 PM | Computer Name = bar1 | Source = SDWinSec.exe | ID = 0
Description =

Error - 10/18/2010 10:05:12 PM | Computer Name = bar1 | Source = SDWinSec.exe | ID = 0
Description =

Error - 10/18/2010 10:06:12 PM | Computer Name = bar1 | Source = SDWinSec.exe | ID = 0
Description =

[ Media Center Events ]
Error - 6/9/2009 1:27:05 PM | Computer Name = bar1 | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ System Events ]
Error - 10/18/2010 8:04:49 AM | Computer Name = bar1 | Source = Microsoft-Windows-Servicing | ID = 4385
Description =

Error - 10/18/2010 8:04:49 AM | Computer Name = bar1 | Source = Microsoft-Windows-Servicing | ID = 4385
Description =

Error - 10/18/2010 8:04:49 AM | Computer Name = bar1 | Source = Microsoft-Windows-Servicing | ID = 4385
Description =

Error - 10/18/2010 8:04:49 AM | Computer Name = bar1 | Source = Microsoft-Windows-Servicing | ID = 4385
Description =

Error - 10/18/2010 8:04:49 AM | Computer Name = bar1 | Source = Microsoft-Windows-Servicing | ID = 4385
Description =

Error - 10/18/2010 8:08:13 AM | Computer Name = bar1 | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description =

Error - 10/18/2010 8:27:47 AM | Computer Name = bar1 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.100.2 for the Network Card with network
address 001E8C052AE0 has been denied by the DHCP server 192.168.100.1 (The DHCP
Server sent a DHCPNACK message).

Error - 10/18/2010 9:43:57 PM | Computer Name = bar1 | Source = Dhcp | ID = 1002
Description = The IP address lease 98.168.137.181 for the Network Card with network
address 001E8C052AE0 has been denied by the DHCP server 192.168.100.1 (The DHCP
Server sent a DHCPNACK message).

Error - 10/18/2010 9:43:57 PM | Computer Name = bar1 | Source = HTTP | ID = 15016
Description =

Error - 10/18/2010 9:53:39 PM | Computer Name = bar1 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.100.2 for the Network Card with network
address 001E8C052AE0 has been denied by the DHCP server 192.168.100.1 (The DHCP
Server sent a DHCPNACK message).


< End of report >

 

Too big broken into 2 parts:
Part 1

OTL logfile created on: 10/18/2010 8:58:56 PM - Run 1
OTL by OldTimer - Version 3.2.15.2 Folder = C:\Users\David\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 45.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 140.77 Gb Total Space | 87.45 Gb Free Space | 62.12% Space Free | Partition Type: NTFS
Drive D: | 8.27 Gb Total Space | 0.81 Gb Free Space | 9.76% Space Free | Partition Type: NTFS

Computer Name: BAR1 | User Name: David | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days

========== Processes (SafeList) ==========

PRC - [2010/10/18 20:55:43 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\David\Desktop\OTL.exe
PRC - [2010/10/06 09:39:13 | 002,067,808 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe
PRC - [2010/10/06 09:38:43 | 000,723,296 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2010/10/01 10:54:51 | 002,500,552 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
PRC - [2010/10/01 10:54:44 | 001,901,056 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
PRC - [2010/09/23 12:47:05 | 000,621,920 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2010/08/13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/07/21 14:50:25 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgemc.exe
PRC - [2010/07/15 13:59:33 | 000,515,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2010/07/15 13:59:31 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2010/07/15 13:58:50 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2010/06/14 19:37:47 | 000,134,808 | ---- | M] (Google Inc.) -- C:\Users\David\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe
PRC - [2010/05/14 11:00:26 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2010/04/22 11:14:54 | 000,788,880 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2010/04/22 11:14:53 | 001,181,328 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2010/02/12 19:23:32 | 000,148,744 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO livePCsupport\CLPSLS.exe
PRC - [2009/10/11 05:17:36 | 000,055,072 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\jureg.exe
PRC - [2009/10/10 16:07:08 | 000,320,832 | ---- | M] (BillP Studios) -- C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
PRC - [2009/09/22 17:02:26 | 000,098,304 | ---- | M] (Hauppauge Computer Works, Inc.) -- C:\Program Files\WinTV\WinTV7\WinTVTray.exe
PRC - [2009/09/22 17:02:16 | 000,315,392 | ---- | M] (Hauppauge Computer Works) -- C:\Program Files\WinTV\TVServer\CaptureGenUSB.exe
PRC - [2009/09/22 17:01:46 | 000,434,176 | ---- | M] (Hauppauge Computer Works) -- C:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe
PRC - [2009/09/01 23:46:00 | 000,117,344 | ---- | M] (Hauppauge Computer Works) -- C:\Program Files\WinTV\Ir.exe
PRC - [2009/01/26 16:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008/10/29 01:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/01/19 02:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2008/01/19 02:33:27 | 000,151,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\schtasks.exe
PRC - [2008/01/15 13:26:18 | 004,874,240 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007/07/12 19:36:12 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2007/07/12 19:36:10 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2007/04/18 10:01:34 | 000,065,536 | ---- | M] (Hewlett-Packard Company) -- C:\hp\support\hpsysdrv.exe
PRC - [2007/02/15 06:59:00 | 000,118,784 | ---- | M] (OsdMaestro) -- C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe


========== Modules (SafeList) ==========

MOD - [2010/10/18 20:55:43 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\David\Desktop\OTL.exe
MOD - [2010/10/01 10:55:07 | 000,285,480 | ---- | M] (COMODO) -- C:\Windows\System32\guard32.dll
MOD - [2010/08/31 10:39:57 | 001,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll
MOD - [2008/01/19 02:33:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2010/10/01 10:54:44 | 001,901,056 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent)
SRV - [2010/08/13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/07/21 14:50:25 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)
SRV - [2010/07/15 13:59:31 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2010/05/14 11:00:26 | 000,249,136 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2010/04/22 11:14:53 | 001,181,328 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2010/03/18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/12 19:23:32 | 000,148,744 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO livePCsupport\CLPSLS.exe -- (CLPSLS)
SRV - [2009/09/22 17:01:46 | 000,434,176 | ---- | M] (Hauppauge Computer Works) [Auto | Running] -- C:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe -- (HauppaugeTVServer)
SRV - [2009/08/05 22:48:42 | 000,704,864 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2009/01/26 16:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2008/01/19 02:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/07/12 19:36:12 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\David\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2010/10/01 10:55:07 | 000,078,504 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\Windows\System32\drivers\inspect.sys -- (inspect)
DRV - [2010/10/01 10:55:06 | 000,236,088 | ---- | M] (COMODO) [File_System | System | Running] -- C:\Windows\System32\drivers\cmdGuard.sys -- (cmdGuard)
DRV - [2010/10/01 10:55:06 | 000,030,112 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\Windows\System32\drivers\cmdhlp.sys -- (cmdHlp)
DRV - [2010/07/28 09:25:55 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/07/15 13:59:35 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\Drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2010/07/15 13:58:52 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\Drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2010/07/07 09:05:32 | 000,014,904 | ---- | M] (Secunia) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\psi_mf.sys -- (PSI)
DRV - [2010/06/02 09:00:37 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2010/04/23 15:52:38 | 001,220,224 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hcw72DTV.sys -- (hcw72DTV)
DRV - [2010/04/23 15:48:44 | 001,217,920 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hcw72ATV.sys -- (hcw72ATV)
DRV - [2010/04/23 15:47:40 | 000,028,928 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hcw72ADFilter.sys -- (hcw72ADFilter)
DRV - [2010/03/04 14:27:42 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV)
DRV - [2010/03/04 14:27:42 | 000,012,872 | ---- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)
DRV - [2009/09/23 07:55:23 | 000,064,288 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\Lbd.sys -- (Lbd)
DRV - [2009/08/05 22:48:42 | 000,054,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fssfltr.sys -- (fssfltr)
DRV - [2009/08/04 09:48:20 | 002,744,800 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2009/06/30 10:37:16 | 000,028,552 | ---- | M] (Panda Security, S.L.) [File_System | Boot | Running] -- C:\Windows\system32\drivers\pavboot.sys -- (pavboot)
DRV - [2009/06/26 22:01:00 | 009,777,376 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009/04/08 03:53:12 | 000,064,000 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTSTOR.sys -- (RTSTOR)
DRV - [2008/03/02 03:28:00 | 000,206,608 | ---- | M] (Trend Micro Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\TMPassthru.sys -- (TMPassthruMP)
DRV - [2008/03/02 03:28:00 | 000,206,608 | ---- | M] (Trend Micro Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TMPassthru.sys -- (TMPassthru)
DRV - [2008/01/19 00:53:23 | 000,073,088 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2007/07/12 11:35:02 | 000,305,176 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\iastor.sys -- (iaStor)
DRV - [2006/11/02 04:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 04:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 04:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 04:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 04:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 04:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2006/11/02 04:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 04:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 04:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 04:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 04:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 04:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 04:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2006/11/02 04:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 04:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 04:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 04:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2006/11/02 04:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 04:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 04:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 04:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 04:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2006/11/02 04:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 04:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 04:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 04:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 04:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 04:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 04:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 04:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 04:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 04:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 04:49:30 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2006/11/02 04:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2006/11/02 04:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2006/11/02 03:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 03:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 03:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 03:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 03:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 03:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 02:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 02:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=74&bd=Pavilion&pf=desktop

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/ "
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.855
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.5.4
FF - prefs.js..extensions.enabledItems: foxyseotool@foxyseotool.com:0.8.4
FF - prefs.js..extensions.enabledItems: foxyproxy@eric.h.jung:2.22.1
FF - prefs.js..extensions.enabledItems: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.5
FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.8
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.%(version)s
FF - prefs.js..extensions.enabledItems: {e3f6c2cc-d8db-498c-af6c-499fb211db97}:1.9.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {9815d32d-08c2-42ca-a8c6-43e501a4512f}:0.3.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..network.proxy.backup.ftp: "122.225.56.18 "
FF - prefs.js..network.proxy.backup.ftp_port: 8080
FF - prefs.js..network.proxy.backup.gopher: "122.225.56.18 "
FF - prefs.js..network.proxy.backup.gopher_port: 8080
FF - prefs.js..network.proxy.backup.socks: "122.225.56.18 "
FF - prefs.js..network.proxy.backup.socks_port: 8080
FF - prefs.js..network.proxy.backup.ssl: "122.225.56.18 "
FF - prefs.js..network.proxy.backup.ssl_port: 8080
FF - prefs.js..network.proxy.ftp: "122.225.56.18 "
FF - prefs.js..network.proxy.ftp_port: 8085
FF - prefs.js..network.proxy.gopher: "122.225.56.18 "
FF - prefs.js..network.proxy.gopher_port: 8085
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "122.225.56.18 "
FF - prefs.js..network.proxy.socks_port: 8085
FF - prefs.js..network.proxy.ssl: "122.225.56.18 "
FF - prefs.js..network.proxy.ssl_port: 8085


FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/09/23 13:00:25 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/16 14:01:27 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/10/08 08:37:00 | 000,000,000 | ---D | M]

[2008/12/16 22:38:26 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\mozilla\Extensions
[2010/10/18 13:26:39 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\mlcxnuno.default\extensions
[2010/04/26 21:44:40 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\mlcxnuno.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/08/21 07:23:21 | 000,000,000 | ---D | M] (Tor-Proxy.NET Toolbar) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\mlcxnuno.default\extensions\{9815d32d-08c2-42ca-a8c6-43e501a4512f}
[2010/01/15 19:59:36 | 000,000,000 | ---D | M] (Web Developer) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\mlcxnuno.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
[2010/04/20 15:02:06 | 000,000,000 | ---D | M] (Torbutton) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\mlcxnuno.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
[2010/10/13 14:40:28 | 000,000,000 | ---D | M] (Page Speed) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\mlcxnuno.default\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}
[2010/05/07 08:46:31 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\mlcxnuno.default\extensions\firebug@software.joehewitt.com
[2010/08/30 20:11:36 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\mlcxnuno.default\extensions\foxyproxy@eric.h.jung
[2010/07/18 09:53:51 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\mlcxnuno.default\extensions\foxyseotool@foxyseotool.com
[2010/10/14 08:19:19 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/04/29 08:55:31 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/10/14 08:12:36 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2009/11/19 17:16:28 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2010/10/14 08:12:08 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2009/11/19 17:16:29 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll

O1 HOSTS File: ([2010/10/18 20:35:52 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SunJavaUpdateReg] C:\Windows\System32\jureg.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O4 - HKLM..\RunOnce: [Launcher] C:\Windows\SMINST\Launcher.exe (soft thinks)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} http://www.thelistingwidget.com/includes/uploader/ImageUploader5.cab (Image Uploader Control)
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {80AEEC0E-A2BE-4B8D-985F-350FE869DC40} http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsVista.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsVista.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\Windows\System32\avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img22.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img22.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/02/18 18:01:26 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: vidc.XVID - C:\Windows\System32\xvidvfw.dll ()

CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 90 Days ==========

[2010/10/18 20:55:39 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Users\David\Desktop\OTL.exe
[2010/10/18 20:38:04 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2010/10/18 20:38:01 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010/10/18 20:25:36 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2010/10/18 20:25:36 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2010/10/18 20:25:36 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2010/10/18 20:25:19 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010/10/18 20:25:14 | 000,000,000 | ---D | C] -- C:\ComboFix
[2010/10/18 20:25:04 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/10/18 20:24:36 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010/10/08 08:36:56 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2010/10/01 16:51:06 | 000,000,000 | ---D | C] -- C:\Users\David\Desktop\public_html
[2010/10/01 16:36:56 | 000,000,000 | ---D | C] -- C:\Users\David\Desktop\zen-cart-v1.3.9g-full-fileset-09292010
[2010/09/29 12:35:03 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Local\PokerStars.NET
[2010/09/29 12:34:33 | 000,000,000 | ---D | C] -- C:\Program Files\PokerStars.NET
[2010/09/25 08:28:24 | 000,000,000 | ---D | C] -- C:\Windows\System32\WindowsPowerShell
[2010/09/16 11:27:16 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010/09/13 21:58:45 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2010/09/13 21:58:40 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2010/09/13 21:51:13 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2010/09/13 21:38:35 | 000,000,000 | ---D | C] -- C:\Program Files\Secunia
[2010/09/13 12:48:37 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Users\David\Documents\TFC(3).exe
[2010/09/03 22:11:31 | 000,000,000 | ---D | C] -- C:\f48f8f5c404f5b9f07efee9fea
[2010/08/08 08:10:33 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Local\Apple Computer
[2010/08/06 22:03:21 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Local\Apple
[2010/07/29 15:57:44 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/07/28 14:36:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe AIR
[2010/07/28 14:36:14 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Local\Adobe

========== Files - Modified Within 90 Days ==========

[2010/10/18 21:33:22 | 000,294,912 | ---- | M] () -- C:\Users\David\Desktop\gmer.exe
[2010/10/18 20:55:43 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\David\Desktop\OTL.exe
[2010/10/18 20:55:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/10/18 20:46:37 | 000,000,370 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2010/10/18 20:46:37 | 000,000,370 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Daily 4).job
[2010/10/18 20:46:37 | 000,000,370 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Daily 3).job
[2010/10/18 20:46:37 | 000,000,370 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Daily 2).job
[2010/10/18 20:46:36 | 000,000,370 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Daily 1).job
[2010/10/18 20:45:52 | 000,000,258 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2010/10/18 20:44:04 | 000,064,479 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010/10/18 20:44:02 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/10/18 20:44:02 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/10/18 20:44:01 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/10/18 20:43:57 | 000,064,479 | ---- | M] () -- C:\ProgramData\nvModes.001
[2010/10/18 20:43:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/10/18 20:43:35 | 2145,898,496 | -HS- | M] () -- C:\hiberfil.sys
[2010/10/18 20:42:00 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-942920361-1515226988-2560670545-1000UA.job
[2010/10/18 20:35:52 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010/10/18 20:24:34 | 000,000,000 | ---- | M] () -- C:\Users\David\AppData\Local\prvlcl.dat
[2010/10/18 20:17:03 | 003,880,095 | R--- | M] () -- C:\Users\David\Desktop\ComboFix.exe
[2010/10/18 19:42:00 | 000,000,856 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-942920361-1515226988-2560670545-1000Core.job
[2010/10/18 18:37:40 | 000,080,384 | ---- | M] () -- C:\Users\David\Desktop\MBRCheck.exe
[2010/10/18 08:22:43 | 066,526,646 | ---- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm
[2010/10/18 07:33:50 | 000,544,768 | ---- | M] () -- C:\Users\David\Desktop\dds.scr
[2010/10/14 07:25:31 | 000,311,288 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/10/08 08:37:00 | 000,001,889 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/10/03 16:22:10 | 000,000,806 | ---- | M] () -- C:\Users\David\Desktop\CCleaner.lnk
[2010/10/01 12:03:22 | 000,082,321 | ---- | M] () -- C:\Users\David\Documents\Hydra-SM_Instructions.pdf
[2010/10/01 10:55:07 | 000,285,480 | ---- | M] (COMODO) -- C:\Windows\System32\guard32.dll
[2010/10/01 10:55:07 | 000,078,504 | ---- | M] (COMODO) -- C:\Windows\System32\drivers\inspect.sys
[2010/10/01 10:55:06 | 000,236,088 | ---- | M] (COMODO) -- C:\Windows\System32\drivers\cmdGuard.sys
[2010/10/01 10:55:06 | 000,030,112 | ---- | M] (COMODO) -- C:\Windows\System32\drivers\cmdhlp.sys
[2010/10/01 10:55:06 | 000,017,256 | ---- | M] (COMODO) -- C:\Windows\System32\drivers\cmderd.sys
[2010/09/29 13:09:54 | 000,000,884 | ---- | M] () -- C:\Users\David\Application Data\Microsoft\Internet Explorer\Quick Launch\PokerStars.lnk
[2010/09/29 13:09:54 | 000,000,860 | ---- | M] () -- C:\Users\Public\Desktop\PokerStars.lnk
[2010/09/24 10:04:37 | 000,420,225 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20101013-063828.backup
[2010/09/23 12:42:42 | 000,002,044 | ---- | M] () -- C:\Users\David\Desktop\Google Chrome.lnk
[2010/09/23 12:42:42 | 000,002,006 | ---- | M] () -- C:\Users\David\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/09/21 12:36:44 | 000,245,256 | ---- | M] () -- C:\Users\David\Desktop\QI 2010 Wholesale Pricelist.pdf
[2010/09/18 14:48:53 | 000,001,021 | ---- | M] () -- C:\Users\Public\Desktop\Orb.lnk
[2010/09/16 11:27:41 | 000,001,728 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/09/13 22:18:13 | 000,000,985 | ---- | M] () -- C:\Users\Public\Desktop\OpenOffice.org 3.2.lnk
[2010/09/13 21:59:25 | 000,001,804 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010/09/13 12:24:51 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\David\Documents\TFC(3).exe
[2010/09/12 11:08:36 | 000,000,814 | ---- | M] () -- C:\Users\David\Desktop\SpywareBlaster.lnk
[2010/08/25 18:00:28 | 000,417,708 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100924-100437.backup
[2010/08/19 16:05:15 | 000,015,872 | ---- | M] () -- C:\Users\David\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/08/18 17:41:25 | 000,417,644 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100825-180028.backup
[2010/08/16 13:26:27 | 000,001,356 | ---- | M] () -- C:\Users\David\AppData\Local\d3d9caps.dat
[2010/08/13 10:27:11 | 000,016,703 | ---- | M] () -- C:\Users\David\Documents\humidorsales2010.ods
[2010/07/29 16:19:31 | 000,026,096 | ---- | M] () -- C:\Users\David\Documents\cc_20100729_161928.reg
[2010/07/29 16:00:19 | 000,416,395 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100818-174125.backup
[2010/07/22 07:27:40 | 000,415,510 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100729-160019.backup

========== Files Created - No Company Name ==========

[2010/10/18 20:25:36 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010/10/18 20:25:36 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010/10/18 20:25:36 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010/10/18 20:25:36 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010/10/18 20:25:36 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010/10/18 20:16:50 | 003,880,095 | R--- | C] () -- C:\Users\David\Desktop\ComboFix.exe
[2010/10/18 18:41:06 | 000,294,912 | ---- | C] () -- C:\Users\David\Desktop\gmer.exe
[2010/10/18 18:37:38 | 000,080,384 | ---- | C] () -- C:\Users\David\Desktop\MBRCheck.exe
[2010/10/18 07:33:43 | 000,544,768 | ---- | C] () -- C:\Users\David\Desktop\dds.scr
[2010/10/17 08:03:50 | 000,000,370 | ---- | C] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2010/10/17 08:03:50 | 000,000,370 | ---- | C] () -- C:\Windows\tasks\Ad-Aware Update (Daily 4).job
[2010/10/17 08:03:50 | 000,000,370 | ---- | C] () -- C:\Windows\tasks\Ad-Aware Update (Daily 3).job
[2010/10/17 08:03:50 | 000,000,370 | ---- | C] () -- C:\Windows\tasks\Ad-Aware Update (Daily 2).job
[2010/10/17 08:03:49 | 000,000,370 | ---- | C] () -- C:\Windows\tasks\Ad-Aware Update (Daily 1).job
[2010/10/08 08:37:00 | 000,001,889 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/10/01 12:03:22 | 000,082,321 | ---- | C] () -- C:\Users\David\Documents\Hydra-SM_Instructions.pdf
[2010/09/29 13:09:54 | 000,000,884 | ---- | C] () -- C:\Users\David\Application Data\Microsoft\Internet Explorer\Quick Launch\PokerStars.lnk
[2010/09/29 13:09:54 | 000,000,860 | ---- | C] () -- C:\Users\Public\Desktop\PokerStars.lnk
[2010/09/25 08:26:06 | 000,201,184 | ---- | C] () -- C:\Windows\System32\winrm.vbs
[2010/09/25 08:26:06 | 000,004,675 | ---- | C] () -- C:\Windows\System32\wsmanconfig_schema.xml
[2010/09/25 08:26:06 | 000,002,426 | ---- | C] () -- C:\Windows\System32\WsmTxt.xsl
[2010/09/21 12:36:44 | 000,245,256 | ---- | C] () -- C:\Users\David\Desktop\QI 2010 Wholesale Pricelist.pdf
[2010/09/16 11:27:41 | 000,001,728 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/09/13 22:18:13 | 000,000,985 | ---- | C] () -- C:\Users\Public\Desktop\OpenOffice.org 3.2.lnk
[2010/09/13 21:59:25 | 000,001,804 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010/07/29 16:19:30 | 000,026,096 | ---- | C] () -- C:\Users\David\Documents\cc_20100729_161928.reg
[2010/03/28 10:36:47 | 000,000,000 | ---- | C] () -- C:\Users\David\AppData\Local\prvlcl.dat
[2009/11/16 10:39:12 | 000,000,036 | ---- | C] () -- C:\Users\David\AppData\Local\housecall.guid.cache
[2009/11/11 14:52:06 | 000,064,479 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009/11/11 14:46:16 | 000,064,479 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009/11/01 10:18:42 | 000,003,509 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2009/09/11 09:54:16 | 000,007,680 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/03/17 09:46:54 | 000,000,824 | ---- | C] () -- C:\Windows\System32\PCProxy.ini
[2009/03/17 09:46:35 | 000,172,032 | ---- | C] () -- C:\Windows\System32\AVLibrary.dll
[2008/10/02 17:37:52 | 001,228,854 | ---- | C] () -- C:\ProgramData\OrbError.bmp
[2008/10/02 17:24:52 | 000,033,877 | ---- | C] () -- C:\Windows\Irremote.ini
[2008/10/02 17:24:42 | 000,065,536 | ---- | C] () -- C:\Windows\System32\dmcrypto.dll
[2008/10/02 17:24:10 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2008/10/02 17:24:10 | 000,000,135 | ---- | C] () -- C:\Windows\ODBC.INI
[2008/07/29 22:35:08 | 000,000,168 | ---- | C] () -- C:\Windows\wininit.ini
[2008/04/20 17:34:50 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2008/04/19 10:57:11 | 000,765,952 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2008/04/19 10:56:33 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2008/04/13 21:38:05 | 000,024,206 | ---- | C] () -- C:\Users\David\AppData\Roaming\UserTile.png
[2008/04/13 21:36:11 | 000,015,872 | ---- | C] () -- C:\Users\David\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/04/11 19:54:22 | 000,001,390 | ---- | C] () -- C:\Users\David\AppData\Roaming\wklnhst.dat
[2008/04/11 14:29:56 | 000,001,356 | ---- | C] () -- C:\Users\David\AppData\Local\d3d9caps.dat
[2008/02/18 17:59:13 | 000,055,646 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2008/02/18 17:42:51 | 000,327,680 | ---- | C] () -- C:\Windows\System32\pythoncom25.dll
[2008/02/18 17:42:51 | 000,102,400 | ---- | C] () -- C:\Windows\System32\pywintypes25.dll
[2007/07/19 10:07:52 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2006/12/14 02:01:36 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006/12/14 02:01:36 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
[2006/11/02 07:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

========== LOP Check ==========

[2010/05/30 15:34:54 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\CheeseSoft
[2010/07/16 07:44:28 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\FileZilla
[2010/06/15 07:24:32 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\IBP
[2010/03/12 20:34:24 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Image Zone Express
[2008/08/15 17:38:58 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Microgaming
[2008/11/19 23:18:18 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\OpenOffice.org
[2008/04/13 21:38:05 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\PeerNetworking
[2010/01/19 17:22:21 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Printer Info Cache
[2008/04/11 14:33:36 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Snapfish
[2008/04/11 19:54:23 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Template
[2010/01/31 19:02:43 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Unity
[2008/04/14 14:20:05 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\WildTangent
[2008/04/11 14:39:28 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\WinBatch
[2009/07/30 14:15:23 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\WinPatrol
[2010/10/18 20:46:36 | 000,000,370 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Daily 1).job
[2010/10/18 20:46:37 | 000,000,370 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Daily 2).job
[2010/10/18 20:46:37 | 000,000,370 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Daily 3).job
[2010/10/18 20:46:37 | 000,000,370 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Daily 4).job
[2010/10/18 20:46:37 | 000,000,370 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Weekly).job
[2010/10/18 20:42:22 | 000,032,554 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

 

Part 2 of 2

========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/10/18 20:43:34 | 000,215,840 | ---- | M] () -- C:\aaw7boot.log
[2008/02/18 18:01:26 | 000,000,074 | ---- | M] () -- C:\autoexec.bat
[2008/01/19 02:45:45 | 000,333,203 | RHS- | M] () -- C:\bootmgr
[2008/02/18 17:22:42 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2010/10/18 20:38:00 | 000,015,012 | ---- | M] () -- C:\ComboFix.txt
[2006/09/18 16:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2007/11/07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1028.txt
[2007/11/07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1031.txt
[2007/11/07 09:00:40 | 000,010,134 | ---- | M] () -- C:\eula.1033.txt
[2007/11/07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1036.txt
[2007/11/07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1040.txt
[2007/11/07 09:00:40 | 000,000,118 | ---- | M] () -- C:\eula.1041.txt
[2007/11/07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1042.txt
[2007/11/07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.2052.txt
[2007/11/07 09:00:40 | 000,017,734 | ---- | M] () -- C:\eula.3082.txt
[2007/11/07 09:00:40 | 000,001,110 | ---- | M] () -- C:\globdata.ini
[2009/11/01 10:04:52 | 000,000,068 | ---- | M] () -- C:\hcwclear.txt
[2010/10/18 20:43:35 | 2145,898,496 | -HS- | M] () -- C:\hiberfil.sys
[2007/11/07 09:00:40 | 000,000,843 | ---- | M] () -- C:\install.ini
[2007/11/07 09:03:18 | 000,076,304 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll
[2007/11/07 09:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll
[2007/11/07 09:03:18 | 000,091,152 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll
[2007/11/07 09:03:18 | 000,097,296 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll
[2007/11/07 09:03:18 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll
[2007/11/07 09:03:18 | 000,081,424 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll
[2007/11/07 09:03:18 | 000,079,888 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll
[2007/11/07 09:03:18 | 000,075,792 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll
[2007/11/07 09:03:18 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll
[2008/02/20 13:54:19 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/09/13 22:24:21 | 000,016,398 | ---- | M] () -- C:\JavaRa.log
[2010/05/18 08:59:20 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt
[2008/02/20 13:54:19 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2009/03/27 08:27:30 | 000,000,000 | ---- | M] () -- C:\OrbPVR.db
[2010/10/18 20:43:34 | 2459,709,440 | -HS- | M] () -- C:\pagefile.sys
[2008/04/11 14:40:54 | 000,000,477 | ---- | M] () -- C:\RHDSetup.log
[2007/11/07 09:00:40 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp
[2007/11/07 09:09:22 | 001,442,522 | ---- | M] () -- C:\VC_RED.cab
[2007/11/07 09:12:28 | 000,232,960 | ---- | M] () -- C:\VC_RED.MSI

< %systemroot%\Fonts\*.com >
[2006/11/02 07:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 07:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 07:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006/11/02 07:37:12 | 000,030,808 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 16:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/01/19 02:34:28 | 000,089,600 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006/11/02 07:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2009/07/10 12:15:46 | 000,306,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/04/18 18:22:32 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 05:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 05:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 05:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 05:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 05:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/03/27 08:14:12 | 000,000,286 | -HS- | M] () -- C:\Users\David\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/10/18 20:17:03 | 003,880,095 | R--- | M] () -- C:\Users\David\Desktop\ComboFix.exe
[2010/10/18 21:33:22 | 000,294,912 | ---- | M] () -- C:\Users\David\Desktop\gmer.exe
[2010/10/18 18:37:40 | 000,080,384 | ---- | M] () -- C:\Users\David\Desktop\MBRCheck.exe
[2010/10/18 20:55:43 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\David\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2008/04/11 14:33:24 | 000,000,402 | -HS- | M] () -- C:\Users\David\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2009/10/22 08:06:26 | 000,055,646 | ---- | M] () -- C:\ProgramData\hpzinstall.log
[2010/10/18 20:45:52 | 000,000,258 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2010/10/18 20:43:57 | 000,064,479 | ---- | M] () -- C:\ProgramData\nvModes.001
[2009/03/06 15:47:39 | 001,228,854 | ---- | M] () -- C:\ProgramData\OrbError.bmp

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:5C321E34

< End of report >

 

OLT fixes and Security check done logs: will run temp cleaner and eset scan

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{A057A204-BACC-4D26-9990-79A187E2698E} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}\ not found.
Starting removal of ActiveX control {80AEEC0E-A2BE-4B8D-985F-350FE869DC40}
C:\Windows\Downloaded Program Files\setup.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{80AEEC0E-A2BE-4B8D-985F-350FE869DC40}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80AEEC0E-A2BE-4B8D-985F-350FE869DC40}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{80AEEC0E-A2BE-4B8D-985F-350FE869DC40}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{80AEEC0E-A2BE-4B8D-985F-350FE869DC40}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\Windows\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D}
C:\Windows\Downloaded Program Files\setup.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
ADS C:\ProgramData\TEMP:5C321E34 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: David
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 199685 bytes
->Java cache emptied: 128094 bytes
->FireFox cache emptied: 42825309 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 969 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 9963 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 41.00 mb


[EMPTYFLASH]

User: All Users

User: David
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.15.2 log created on 10182010_212950

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
*********************
Results of screen317's Security Check version 0.99.5
Windows Vista Service Pack 1 (UAC is enabled)
Out of date service pack!!
Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
AVG Free 9.0
WMI entry may not exist for antivirus; attempting automatic update.
AVG9 successfully updated!
```````````````````````````````
Anti-malware/Other Utilities Check:
Ad-Aware
WinPatrol 2009
Malwarebytes' Anti-Malware
HijackThis 2.0.2
CCleaner
Java(TM) 6 Update 16
Java(TM) 6 Update 22
Out of date Java installed!
Adobe Flash Player 10.1.85.3
Adobe Reader 9.4.0
````````````````````````````````
Process Check:
objlist.exe by Laurent
Ad-Aware AAWService.exe is disabled!
Ad-Aware AAWTray.exe is disabled!
WinPatrol winpatrol.exe is disabled!
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

 

broni,

ESETscan was clean, ran Javara.

 

OTL Log now going to run clean up.

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: David
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32969 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 42230453 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 686 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 40.00 mb


[EMPTYFLASH]

User: All Users

User: David
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb



OTL by OldTimer - Version 3.2.15.2 log created on 10192010_173645

Files\Folders moved on Reboot...
C:\Windows\temp\JET5DA9.tmp moved successfully.

Registry entries deleted on Reboot...

 

Ran clean up tried windows update can not get
Microsoft .NET Framework 3.5 SP1 Update for Windows Vista SP1 and Windows Server 2008 x86 (KB982535)
too run fails ever time, I have tried several times before today.

 

Go on? update failed error code 80070643 history show 23 times and 80041001 once going back to 9/27

 

yes, the only other update is IE 8 I didn't like it so I stayed with IE 7, but everything else has been updated