Strange Infection

boston · December 7, 2011

Hi

I have what I suspect to be multiple unrelated malware infections. I have lots of scans to run and logs to post, and I will be posting them as my time allows. My issues are my NIC getting shut off for no reason, settings being changed periodically on whether or not Windows will be sued to configure my wireless settings.

I'm running XP 32.

For this post, I will post my Super Anti-Spyware log and my MBAM log. I'm running OTL and dl'ing RK Unhookers as I type this. Please bear with me as I cannot get all of the required logs and such posted at once.

The SAS log:

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 12/07/2011 at 01:43 PM

Application Version : 5.0.1136

Core Rules Database Version : 8024

Trace Rules Database Version: 5836

Scan type : Complete Scan

Total Scan Time : 01:43:55

Operating System Information

Windows XP Home Edition 32-bit, Service Pack 3 (Build 5.01.2600)

Administrator

Memory items scanned : 554

Memory threats detected : 0

Registry items scanned : 36191

Registry threats detected : 0

File items scanned : 49354

File threats detected : 46

Adware.Tracking Cookie

www.linuxquestions.org [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\U0ODWF1P.DEFAULT\COOKIES.SQLITE ]

account.thequestionsnetwork.org [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\U0ODWF1P.DEFAULT\COOKIES.SQLITE ]

.www.linuxquestions.org [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\U0ODWF1P.DEFAULT\COOKIES.SQLITE ]

.invitemedia.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\U0ODWF1P.DEFAULT\COOKIES.SQLITE ]

.liveperson.net [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\U0ODWF1P.DEFAULT\COOKIES.SQLITE ]

sales.liveperson.net [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\U0ODWF1P.DEFAULT\COOKIES.SQLITE ]

.liveperson.net [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\U0ODWF1P.DEFAULT\COOKIES.SQLITE ]

affiliates.commissionaccount.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\U0ODWF1P.DEFAULT\COOKIES.SQLITE ]

.affiliates.commissionaccount.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\U0ODWF1P.DEFAULT\COOKIES.SQLITE ]

accounts.youtube.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\U0ODWF1P.DEFAULT\COOKIES.SQLITE ]

accounts.google.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\U0ODWF1P.DEFAULT\COOKIES.SQLITE ]

www.advertban.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\U0ODWF1P.DEFAULT\COOKIES.SQLITE ]

.ru4.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

.invitemedia.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

.media6degrees.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

.interclick.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

.a1.interclick.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

.interclick.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

.adxpose.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

.invitemedia.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

.akamai.interclickproxy.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

.interclick.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

.burstbeacon.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

.invitemedia.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

.lucidmedia.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

.lfstmedia.com [ C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

The MBAM log:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 8329

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

12/7/2011 2:24:24 PM

mbam-log-2011-12-07 (14-24-24).txt

Scan type: Full scan (C:\|)

Objects scanned: 231817

Time elapsed: 2 hour(s), 14 minute(s), 17 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

boston · December 7, 2011

My OTL.txt:

OTL logfile created on: 12/7/2011 2:36:17 PM - Run 1

OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Christopher\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1013.35 Mb Total Physical Memory | 340.50 Mb Available Physical Memory | 33.60% Memory free

2.89 Gb Paging File | 2.40 Gb Available in Paging File | 82.97% Paging File free

Paging file location(s): C:\pagefile.sys 2048 2048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 137.67 Gb Total Space | 108.22 Gb Free Space | 78.61% Space Free | Partition Type: NTFS

Computer Name: BOSTON | User Name: Christopher | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/12/07 14:35:10 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Christopher\Desktop\OTL.exe

PRC - [2011/11/09 08:51:47 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe

PRC - [2011/06/29 08:29:44 | 000,217,256 | ---- | M] (Panda Security) -- C:\Documents and Settings\All Users\Application Data\Panda Security URL Filtering\Panda_URL_Filtering.exe

PRC - [2011/04/28 13:01:20 | 000,439,616 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe

PRC - [2011/04/28 12:58:54 | 000,140,608 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe

PRC - [2009/11/13 17:00:46 | 000,873,840 | ---- | M] (COMPAL ELECTRONIC INC.) -- C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe

PRC - [2009/10/07 23:10:36 | 000,471,129 | ---- | M] (Atheros Communications, Inc.) -- C:\Program Files\Atheros\ACU.exe

PRC - [2009/10/07 23:10:02 | 000,499,797 | ---- | M] (Atheros) -- C:\WINDOWS\system32\acs.exe

PRC - [2009/09/30 12:08:04 | 000,268,864 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSMain.exe

PRC - [2009/09/17 14:37:18 | 000,111,960 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe

PRC - [2009/09/17 14:36:58 | 001,021,272 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe

PRC - [2009/08/24 18:25:56 | 000,575,552 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\ThpSrv.exe

PRC - [2008/07/01 14:03:06 | 000,038,200 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSBattM.exe

PRC - [2008/04/14 04:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007/11/21 17:23:32 | 000,129,632 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TODDSrv.exe

PRC - [2005/06/06 09:58:44 | 000,024,576 | ---- | M] (TOSHIBA) -- C:\WINDOWS\system32\ZoomingHook.exe

========== Modules (No Company Name) ==========

MOD - [2011/11/16 22:38:20 | 008,527,008 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

MOD - [2011/11/09 08:51:41 | 001,989,592 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll

MOD - [2009/09/17 14:36:34 | 000,079,192 | ---- | M] () -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll

MOD - [2009/06/06 00:42:40 | 000,028,672 | ---- | M] () -- C:\WINDOWS\system32\TPeculiarity.dll

MOD - [2009/04/15 16:46:50 | 000,040,960 | ---- | M] () -- C:\WINDOWS\system32\EBLib.DLL

MOD - [2009/04/02 08:35:18 | 000,024,576 | ---- | M] () -- C:\WINDOWS\system32\EKECioCtl.dll

MOD - [2007/02/14 12:55:11 | 000,165,424 | ---- | M] () -- C:\Program Files\Panda Security\Panda Cloud Antivirus\MiniCrypto.dll

MOD - [2007/02/14 12:55:10 | 000,099,888 | ---- | M] () -- C:\Program Files\Panda Security\Panda Cloud Antivirus\APIcr.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (LUVM)

SRV - File not found [Disabled | Stopped] -- -- (HidServ)

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)

SRV - [2011/08/11 15:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [On_Demand | Stopped] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)

SRV - [2011/04/28 12:58:54 | 000,140,608 | ---- | M] (Panda Security, S.L.) [Auto | Running] -- C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe -- (NanoServiceMain)

SRV - [2009/10/07 23:10:02 | 000,499,797 | ---- | M] (Atheros) [Auto | Running] -- C:\WINDOWS\system32\acs.exe -- (ACS)

SRV - [2009/10/06 08:21:50 | 000,051,512 | ---- | M] (TOSHIBA Corporation) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)

SRV - [2009/09/29 09:17:50 | 000,013,088 | ---- | M] (Intuit Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)

SRV - [2009/09/17 14:37:18 | 000,111,960 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)

SRV - [2009/08/24 18:25:56 | 000,575,552 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\WINDOWS\system32\ThpSrv.exe -- (Thpsrv)

SRV - [2008/11/09 12:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Disabled | Stopped] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)

SRV - [2007/11/21 17:23:32 | 000,129,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\WINDOWS\system32\TODDSrv.exe -- (TODDSrv)

========== Driver Services (SafeList) ==========

DRV - [2011/08/01 03:23:20 | 000,143,752 | ---- | M] (Panda Security, S.L.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\PSINAflt.sys -- (PSINAflt)

DRV - [2011/07/22 08:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)

DRV - [2011/07/12 13:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

DRV - [2011/04/28 12:57:57 | 000,112,456 | ---- | M] (Panda Security, S.L.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\PSINProt.sys -- (PSINProt)

DRV - [2011/04/28 12:57:38 | 000,129,992 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\PSINKNC.sys -- (PSINKNC)

DRV - [2011/04/28 12:57:38 | 000,111,688 | ---- | M] (Panda Security, S.L.) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\PSINProc.sys -- (PSINProc)

DRV - [2011/04/28 12:57:38 | 000,097,096 | ---- | M] (Panda Security, S.L.) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\PSINFile.sys -- (PSINFile)

DRV - [2010/06/04 02:29:04 | 001,606,368 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)

DRV - [2009/11/16 17:34:26 | 005,955,072 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)

DRV - [2009/11/06 17:55:56 | 000,177,024 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)

DRV - [2009/09/22 16:40:48 | 000,174,592 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RtsUStor.sys -- (RSUSBSTOR)

DRV - [2009/09/21 10:05:42 | 000,018,816 | ---- | M] (Toshiba) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pgsuspend.SYS -- (PGSUSFLT)

DRV - [2009/06/29 09:25:30 | 000,029,760 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\thpdrv.sys -- (Thpdrv)

DRV - [2009/06/22 16:04:58 | 000,024,064 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PGEffect.sys -- (PGEffect)

DRV - [2009/05/11 18:11:44 | 000,006,528 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Thpevm.SYS -- (Thpevm)

DRV - [2009/03/16 22:19:44 | 000,058,208 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wsimd.sys -- (WSIMD)

DRV - [2009/03/12 14:09:54 | 000,023,512 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\TVALZ_O.SYS -- (TVALZ)

DRV - [2008/08/05 19:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)

DRV - [2008/07/24 13:40:58 | 000,017,192 | ---- | M] (TOSHIBA ) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\TPwSav.sys -- (TPwSav)

DRV - [2007/02/22 15:10:30 | 000,016,128 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tdcmdpst.sys -- (tdcmdpst)

DRV - [2006/01/04 14:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=TSNB&bmod=TSNB

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3298523943-3000498379-3009045840-1006\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKU\S-1-5-21-3298523943-3000498379-3009045840-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://blackboard.sdccd.edu/

IE - HKU\S-1-5-21-3298523943-3000498379-3009045840-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3298523943-3000498379-3009045840-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

========== FireFox ==========

FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"

FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"

FF - prefs.js..browser.search.param.yahoo-type: "${8}"

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..extensions.enabledItems: {dd3d7613-0246-469d-bc65-2a3cc1668adc}:0.7.1.1

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/11/09 08:51:49 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/10/14 13:22:43 | 000,000,000 | ---D | M]

[2010/06/10 19:24:30 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Christopher\Application Data\Mozilla\Extensions

[2011/12/06 21:44:24 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Christopher\Application Data\Mozilla\Firefox\Profiles\u0odwf1p.default\extensions

[2011/12/06 21:44:24 | 000,000,000 | ---D | M] (ColorZilla) -- C:\Documents and Settings\Christopher\Application Data\Mozilla\Firefox\Profiles\u0odwf1p.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}

[2010/10/27 15:51:32 | 000,000,000 | ---D | M] (BlockSite) -- C:\Documents and Settings\Christopher\Application Data\Mozilla\Firefox\Profiles\u0odwf1p.default\extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc}

[2011/11/16 10:49:43 | 000,000,000 | ---D | M] (HTTPS-Everywhere) -- C:\Documents and Settings\Christopher\Application Data\Mozilla\Firefox\Profiles\u0odwf1p.default\extensions\https-everywhere@eff.org

[2011/11/09 08:52:03 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2011/10/24 04:52:15 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}

() (No name found) -- C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\U0ODWF1P.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

() (No name found) -- C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\U0ODWF1P.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI

() (No name found) -- C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\U0ODWF1P.DEFAULT\EXTENSIONS\ADBAN@AD-BAN.APPSPOT.COM.XPI

() (No name found) -- C:\DOCUMENTS AND SETTINGS\CHRISTOPHER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\U0ODWF1P.DEFAULT\EXTENSIONS\ADBLOCKPOPUPS@JESSEHAKANEN.NET.XPI

[2010/07/04 14:55:14 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF

[2011/11/09 08:51:47 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011/10/03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2011/07/11 13:48:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll

[2010/01/01 00:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2011/11/09 08:51:48 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2011/07/27 06:30:31 | 000,436,064 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: 127.0.0.1 www.007guard.com

O1 - Hosts: 127.0.0.1 007guard.com

O1 - Hosts: 127.0.0.1 008i.com

O1 - Hosts: 127.0.0.1 www.008k.com

O1 - Hosts: 127.0.0.1 008k.com

O1 - Hosts: 127.0.0.1 www.00hq.com

O1 - Hosts: 127.0.0.1 00hq.com

O1 - Hosts: 127.0.0.1 010402.com

O1 - Hosts: 127.0.0.1 www.032439.com

O1 - Hosts: 127.0.0.1 032439.com

O1 - Hosts: 127.0.0.1 www.0scan.com

O1 - Hosts: 127.0.0.1 0scan.com

O1 - Hosts: 127.0.0.1 1000gratisproben.com

O1 - Hosts: 127.0.0.1 www.1000gratisproben.com

O1 - Hosts: 127.0.0.1 1001namen.com

O1 - Hosts: 127.0.0.1 www.1001namen.com

O1 - Hosts: 127.0.0.1 100888290cs.com

O1 - Hosts: 127.0.0.1 www.100888290cs.com

O1 - Hosts: 127.0.0.1 www.100sexlinks.com

O1 - Hosts: 127.0.0.1 100sexlinks.com

O1 - Hosts: 127.0.0.1 10sek.com

O1 - Hosts: 127.0.0.1 www.10sek.com

O1 - Hosts: 127.0.0.1 www.1-2005-search.com

O1 - Hosts: 127.0.0.1 1-2005-search.com

O1 - Hosts: 15010 more lines...

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O4 - HKLM..\Run: [ACU] C:\Program Files\Atheros\ACU.exe (Atheros Communications, Inc.)

O4 - HKLM..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe (COMPAL ELECTRONIC INC.)

O4 - HKLM..\Run: [Panda Security URL Filtering] C:\Documents and Settings\All Users\Application Data\Panda Security URL Filtering\Panda_URL_Filtering.exe (Panda Security)

O4 - HKLM..\Run: [PSUNMain] C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe (Panda Security, S.L.)

O4 - HKLM..\Run: [ThpSrv] C:\WINDOWS\System32\thpsrv.exe (TOSHIBA Corporation)

O4 - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)

O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation)

O4 - HKLM..\Run: [Zooming] C:\WINDOWS\System32\ZoomingHook.exe (TOSHIBA)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-3298523943-3000498379-3009045840-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-3298523943-3000498379-3009045840-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-21-3298523943-3000498379-3009045840-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-21-3298523943-3000498379-3009045840-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O15 - HKU\S-1-5-21-3298523943-3000498379-3009045840-1006\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B56B07C8-B922-4E3B-BB6F-F61CF6D51AC8}: DhcpNameServer = 192.168.2.1

O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (c:\windows\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)

O24 - Desktop WallPaper: C:\Documents and Settings\Christopher\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\Christopher\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2010/01/20 17:13:16 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/12/07 14:49:45 | 000,719,574 | ---- | C] (UG North ) -- C:\Documents and Settings\Christopher\Desktop\RkU3.8.388.590.exe

[2011/12/07 14:35:07 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Christopher\Desktop\OTL.exe

[2011/11/13 22:32:07 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Christopher\Recent

[2011/11/10 20:25:42 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2011/11/09 08:40:17 | 000,000,000 | RHSD | C] -- C:\cmdcons

[2011/11/09 08:38:00 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2011/11/09 08:38:00 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2011/11/09 08:38:00 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2011/11/09 08:38:00 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2011/11/08 08:40:14 | 000,000,000 | ---D | C] -- C:\MGtools

[2011/11/08 08:31:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SUPERAntiSpyware

[2011/11/08 08:31:53 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/12/07 14:35:10 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Christopher\Desktop\OTL.exe

[2011/12/07 06:25:28 | 000,504,702 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2011/12/07 06:25:28 | 000,089,390 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2011/12/06 11:01:55 | 000,004,669 | ---- | M] () -- C:\Documents and Settings\Christopher\Local Settings\Application Data\devcpp.ini

[2011/12/06 11:01:55 | 000,000,018 | ---- | M] () -- C:\Documents and Settings\Christopher\Local Settings\Application Data\devcpp.cfg

[2011/12/05 21:30:02 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011/12/05 17:40:49 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011/12/05 17:40:44 | 1062,645,760 | -HS- | M] () -- C:\hiberfil.sys

[2011/12/05 09:28:38 | 000,115,721 | ---- | M] () -- C:\Documents and Settings\Christopher\Desktop\Essay4F11.pdf

[2011/12/05 08:17:46 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\Update Spybot-S&D.job

[2011/12/05 08:14:27 | 000,000,378 | ---- | M] () -- C:\WINDOWS\tasks\jucheck.job

[2011/12/02 23:08:00 | 000,000,486 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

[2011/12/01 16:52:36 | 004,696,228 | ---- | M] () -- C:\Documents and Settings\Christopher\Desktop\Paradise.zip

[2011/11/15 22:33:51 | 033,148,224 | ---- | M] () -- C:\Documents and Settings\Christopher\Desktop\Mushi.zip

[2011/11/15 09:10:20 | 000,219,248 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2011/11/11 23:11:52 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\rp_stats.dat

[2011/11/11 23:11:52 | 000,000,044 | ---- | M] () -- C:\WINDOWS\System32\rp_rules.dat

[2011/11/09 08:40:26 | 000,000,327 | RHS- | M] () -- C:\boot.ini

[2011/11/08 08:43:21 | 000,118,113 | ---- | M] () -- C:\MGlogs.zip

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/05 09:29:08 | 000,115,721 | ---- | C] () -- C:\Documents and Settings\Christopher\Desktop\Essay4F11.pdf

[2011/12/01 16:52:32 | 004,696,228 | ---- | C] () -- C:\Documents and Settings\Christopher\Desktop\Paradise.zip

[2011/11/15 22:33:44 | 033,148,224 | ---- | C] () -- C:\Documents and Settings\Christopher\Desktop\Mushi.zip

[2011/11/09 08:40:25 | 000,000,210 | ---- | C] () -- C:\Boot.bak

[2011/11/09 08:40:21 | 000,260,272 | RHS- | C] () -- C:\cmldr

[2011/11/09 08:38:00 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2011/11/09 08:38:00 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2011/11/09 08:38:00 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2011/11/09 08:38:00 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2011/11/09 08:38:00 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2011/11/08 08:40:20 | 000,118,113 | ---- | C] () -- C:\MGlogs.zip

[2011/10/04 15:04:38 | 000,000,018 | ---- | C] () -- C:\Documents and Settings\Christopher\Local Settings\Application Data\devcpp.cfg

[2011/10/04 14:27:57 | 011,895,205 | ---- | C] () -- C:\Documents and Settings\Christopher\Local Settings\Application Data\cache.ccc

[2011/10/04 14:25:21 | 000,004,669 | ---- | C] () -- C:\Documents and Settings\Christopher\Local Settings\Application Data\devcpp.ini

[2011/09/07 19:05:06 | 000,000,264 | ---- | C] () -- C:\WINDOWS\System32\PSUNCpl.dat

[2011/09/03 08:32:28 | 000,243,714 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat

[2011/08/15 22:11:09 | 000,000,064 | ---- | C] () -- C:\WINDOWS\System32\rp_stats.dat

[2011/08/15 22:11:09 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\rp_rules.dat

[2011/03/11 14:14:02 | 000,000,105 | ---- | C] () -- C:\WINDOWS\crackpdf.INI

[2011/03/06 20:05:36 | 000,631,808 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll

[2011/03/06 20:05:35 | 000,243,200 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll

[2010/11/24 12:54:50 | 000,000,000 | ---- | C] () -- C:\WINDOWS\TPTray.INI

[2010/11/10 02:14:26 | 000,288,440 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

[2010/11/01 19:05:36 | 000,046,592 | ---- | C] () -- C:\Documents and Settings\Christopher\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010/07/04 13:36:10 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2010/06/10 19:24:22 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2010/06/10 19:12:33 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll

[2010/06/10 19:11:40 | 000,000,013 | RHS- | C] () -- C:\WINDOWS\System32\drivers\fbd.sys

[2010/04/22 13:26:54 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2010/04/22 13:20:25 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\TDispVol.dll

[2010/04/22 13:15:27 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\EBLib.DLL

[2010/04/22 13:13:54 | 000,262,217 | ---- | C] () -- C:\WINDOWS\System32\IPTests.dll

[2010/04/22 13:07:36 | 000,000,520 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTEQEX0.dat

[2010/01/20 17:45:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NDSTray.INI

[2010/01/20 17:15:03 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2010/01/20 17:11:27 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2010/01/20 17:10:42 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini

[2010/01/20 16:39:19 | 000,000,353 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI

[2010/01/20 16:32:09 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2010/01/20 16:31:56 | 000,504,702 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2010/01/20 16:31:56 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2010/01/20 16:31:56 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2010/01/20 16:31:55 | 000,089,390 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2010/01/20 16:31:52 | 000,004,631 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2010/01/20 16:31:51 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2010/01/20 16:31:44 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

[2010/01/20 16:31:23 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2010/01/20 16:31:22 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2010/01/20 16:30:42 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2010/01/20 16:30:30 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin

[2010/01/20 09:08:40 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2010/01/20 09:07:57 | 000,219,248 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2009/06/06 00:42:40 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\TPeculiarity.dll

[2009/05/01 08:27:48 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\HWS_Ctrl.dll

[2009/04/28 03:37:00 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\SPCtl.dll

[2009/04/02 08:35:18 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\EKECioCtl.dll

[2005/03/25 21:00:00 | 000,101,376 | ---- | C] () -- C:\WINDOWS\System32\FORMATUFD.EXE

========== LOP Check ==========

[2010/01/20 17:42:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\toshiba

[2010/01/20 17:17:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\WinBatch

[2010/08/19 18:50:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AIM

[2010/11/28 09:24:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG10

[2010/11/28 08:30:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9

[2010/11/28 08:37:57 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files

[2010/11/28 08:26:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData

[2011/09/07 19:04:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Panda Security

[2011/12/05 21:30:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Panda Security URL Filtering

[2010/06/11 14:43:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Partner

[2010/06/16 19:47:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SpinTop Games

[2010/01/20 18:19:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Toshiba

[2010/04/22 13:19:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Vista32

[2010/04/22 13:19:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Vista64

[2010/11/28 00:21:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WildTangent

[2010/10/26 18:24:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

[2010/08/19 18:51:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christopher\Application Data\acccore

[2010/11/28 08:40:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christopher\Application Data\AVG10

[2011/09/28 17:39:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christopher\Application Data\Dev-Cpp

[2010/06/27 00:25:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christopher\Application Data\ElevatedDiagnostics

[2011/10/04 08:12:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christopher\Application Data\Foxit Software

[2011/08/31 09:15:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christopher\Application Data\geany

[2011/08/31 09:23:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christopher\Application Data\gtk-2.0

[2010/08/01 11:31:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christopher\Application Data\OpenOffice.org

[2011/09/07 19:09:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christopher\Application Data\Panda Security

[2010/07/07 10:22:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christopher\Application Data\SecondLife

[2011/06/07 16:36:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christopher\Application Data\toshiba

[2010/01/20 17:17:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Christopher\Application Data\WinBatch

[2010/01/20 17:42:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\toshiba

[2010/01/20 17:17:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\WinBatch

[2011/12/02 23:08:00 | 000,000,486 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job

[2011/12/05 08:14:27 | 000,000,378 | ---- | M] () -- C:\WINDOWS\Tasks\jucheck.job

[2011/12/05 08:17:46 | 000,000,276 | ---- | M] () -- C:\WINDOWS\Tasks\Update Spybot-S&D.job

========== Purity Check ==========

< End of report >

My Extras.txt:

OTL Extras logfile created on: 12/7/2011 2:36:17 PM - Run 1

OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Christopher\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1013.35 Mb Total Physical Memory | 340.50 Mb Available Physical Memory | 33.60% Memory free

2.89 Gb Paging File | 2.40 Gb Available in Paging File | 82.97% Paging File free

Paging file location(s): C:\pagefile.sys 2048 2048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 137.67 Gb Total Space | 108.22 Gb Free Space | 78.61% Space Free | Partition Type: NTFS

Computer Name: BOSTON | User Name: Christopher | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-3298523943-3000498379-3009045840-1006\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

exefile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)

Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)

Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"5985:TCP" = 5985:TCP:*:Disabled:Windows Remote Management

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"3724:TCP" = 3724:TCP:*:Disabled:Blizzard Downloader: 3724

"6881:TCP" = 6881:TCP:*:Disabled:Blizzard Downloader: 6881

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)

"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AIM -- (AOL Inc.)

"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)

"C:\Program Files\HP\HP Deskjet 1000 J110 series\Bin\USBSetup.exe" = C:\Program Files\HP\HP Deskjet 1000 J110 series\Bin\USBSetup.exe:LocalSubNet:Enabled:HP Device Setup -- (Hewlett-Packard Co.)

"C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe" = C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe:LocalSubNet:Disabled:Intuit Update Shared Downloads Server -- (Intuit Inc.)

"C:\Program Files\Google\Google Earth\plugin\geplugin.exe" = C:\Program Files\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{02EED746-8C5A-43C8-BB3D-D29C8B363A4D}" = TOSHIBA Zooming Utility

"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended

"{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver

"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist

"{16E8BF9A-B419-4A44-A020-30F8CFB84B9D}" = Atheros Client Utility

"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool

"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT

"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java 6 Update 29

"{2C38F661-26B7-445D-B87D-B53FE2D3BD42}" = TOSHIBA PC Diagnostic Tool

"{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4}" = iTunes

"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{3881DB80-EAA2-012B-ADAE-000000000000}" = TurboTax 2009 WinPerFedFormset

"{38975F50-EAA2-012B-ADB4-000000000000}" = TurboTax 2009 WinPerReleaseEngine

"{38A34630-EAA2-012B-ADB6-000000000000}" = TurboTax 2009 WinPerTaxSupport

"{392A74D0-4DFE-49F7-87C3-8A61708F8856}" = Eraser 6.0.8.2273

"{3A57482F-BEBC-47E4-ADA1-6302403C7E50}" = TOSHIBA Accessibility

"{3A9FC03D-C685-4831-94CF-4EDFD3749497}" = Microsoft SQL Server Compact 3.5 SP2 ENU

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3C5A81D0-EAA2-012B-AE9F-000000000000}" = TurboTax 2009 wrapper

"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3

"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant

"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials

"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4F44B5AE-82A6-4A8A-A3E3-E24D489728E3}" = Microsoft SQL Server 2008 Native Client

"{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password

"{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup

"{59FDFDFB-52FE-45B1-8A2A-A00079B07FF0}" = TOSHIBA Power Saver Driver

"{5AF550B4-BB67-4E7E-82F1-2C4300279050}" = ToshibaRegistration

"{5E6F6CF3-BACC-4144-868C-E14622C658F3}" = TOSHIBA Web Camera Application

"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail

"{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}" = Power Tab Editor 1.7

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{7833B48D-8CCD-4588-A7A0-AE01C96ACAA4}" = SelectiveSuspend

"{7900D3A6-A9E8-4954-ACCB-AB15867978BF}" = TOSHIBA Hotkey Utility

"{80977342-27E8-4FF7-8B6A-D8D89461DA7F}" = TouchPad On/Off Utility

"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update

"{8F7AC250-4D7D-431D-AC4E-94FB78EA3F8B}" = TOSHIBA Power Saver

"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system

"{94A90C69-71C1-470A-88F5-AA47ECC96B40}" = TOSHIBA HDD Protection

"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader

"{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}" = TOSHIBA Application and Driver Installer

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175

"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AC6569FA-6919-442A-8552-073BE69E247A}" = TOSHIBA Service Station

"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync

"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy

"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger

"{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Media Creator

"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2

"{C3A32068-8AB1-4327-BB16-BED9C6219DC7}" = Atheros Driver Installation Program

"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update

"{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}" = Toshiba Online Backup

"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack

"{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert

"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support

"{DDDFCC77-7F9C-45E9-B38E-721BA599BA0C}" = HP Deskjet 1000 J110 series Help

"{E487EE7D-EAAA-4E2A-9116-E3B477D8A74F}" = TOSHIBA USB Sleep and Charge Utility

"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call

"{E69992ED-A7F6-406C-9280-1C156417BC49}" = TOSHIBA Quality Application

"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime

"{EE39FFBD-544E-49E4-A999-6819828EAE91}" = Windows Live Photo Gallery

"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)

"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01

"{F4B1B985-F308-4DBA-BFD7-CCCB8839234B}" = HP Deskjet 1000 J110 series Basic Device Software

"{FCE19796-1ADF-42DF-81D8-3563867FC2C2}" = TOSHIBA Zooming Hook

"{FEB2D0CA-9912-4AA1-8FBE-CFD852F9F1FC}" = Panda Cloud Antivirus

"7-Zip" = 7-Zip 9.20

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"AIM_7" = AIM 7

"CCleaner" = CCleaner

"Dev-C++" = Dev-C++ 5 beta 9 release (4.9.9.1)

"Fn-esse" = TOSHIBA Fn-esse

"Foxit PDF Editor" = Foxit PDF Editor

"Foxit Reader_is1" = Foxit Reader 5.1

"HDMI" = Intel® Graphics Media Accelerator Driver

"HijackThis" = HijackThis 1.99.1

"ie8" = Windows Internet Explorer 8

"InstallShield_{02EED746-8C5A-43C8-BB3D-D29C8B363A4D}" = TOSHIBA Zooming Utility

"InstallShield_{2C38F661-26B7-445D-B87D-B53FE2D3BD42}" = TOSHIBA PC Diagnostic Tool

"InstallShield_{3A57482F-BEBC-47E4-ADA1-6302403C7E50}" = TOSHIBA Accessibility

"InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password

"InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup

"InstallShield_{7833B48D-8CCD-4588-A7A0-AE01C96ACAA4}" = SelectiveSuspend

"InstallShield_{7900D3A6-A9E8-4954-ACCB-AB15867978BF}" = TOSHIBA Hotkey Utility

"InstallShield_{80977342-27E8-4FF7-8B6A-D8D89461DA7F}" = TouchPad On/Off Utility

"InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300

"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended

"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0

"Mozilla Firefox 8.0 (x86 en-US)" = Mozilla Firefox 8.0 (x86 en-US)

"Panda Cloud Antivirus" = Panda Cloud Antivirus

"Panda Security URL Filtering" = Panda Security URL Filtering

"Revo Uninstaller" = Revo Uninstaller 1.93

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"TurboTax 2009" = TurboTax 2009

"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9

"Winamp" = Winamp

"Windows Media Format Runtime" = Windows Media Format Runtime

"Windows Media Player" = Windows Media Player 10

"WinLiveSuite_Wave3" = Windows Live Essentials

"Xvid_is1" = Xvid MPEG-4 Video Codec

"Yahoo! Messenger" = Yahoo! Messenger

"Yahoo! Software Update" = Yahoo! Software Update

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3298523943-3000498379-3009045840-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Winamp Detect" = Winamp Detector Plug-in

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 11/10/2011 3:26:54 AM | Computer Name = BOSTON | Source = Application Error | ID = 1000

Description = Faulting application snes9x.exe, version 1.5.2.0, faulting module

snes9x.exe, version 1.5.2.0, fault address 0x001ea365.

Error - 11/10/2011 3:27:03 AM | Computer Name = BOSTON | Source = Application Error | ID = 1000

Description = Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module

dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.

Error - 11/12/2011 3:12:04 AM | Computer Name = BOSTON | Source = Lavasoft Ad-Aware Service | ID = 0

Description =

Error - 11/12/2011 12:31:59 PM | Computer Name = BOSTON | Source = crypt32 | ID = 131083

Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>

with error: The data is invalid.

Error - 11/12/2011 12:31:59 PM | Computer Name = BOSTON | Source = crypt32 | ID = 131083

Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>

with error: The data is invalid.

Error - 11/15/2011 1:48:21 PM | Computer Name = BOSTON | Source = Application Hang | ID = 1002

Description = Hanging application firefox.exe, version 8.0.0.4325, hang module hungapp,

version 0.0.0.0, hang address 0x00000000.

Error - 11/16/2011 2:05:29 PM | Computer Name = BOSTON | Source = Application Hang | ID = 1002

Description = Hanging application firefox.exe, version 8.0.0.4325, hang module hungapp,

version 0.0.0.0, hang address 0x00000000.

Error - 11/16/2011 2:05:40 PM | Computer Name = BOSTON | Source = Application Hang | ID = 1001

Description = Fault bucket -1612583200.

Error - 12/3/2011 12:59:03 AM | Computer Name = BOSTON | Source = Application Error | ID = 1000

Description = Faulting application snes9x.exe, version 1.5.2.0, faulting module

snes9x.exe, version 1.5.2.0, fault address 0x001e9f39.

Error - 12/3/2011 12:59:13 AM | Computer Name = BOSTON | Source = Application Error | ID = 1000

Description = Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module

dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.

[ System Events ]

Error - 12/7/2011 5:08:46 PM | Computer Name = BOSTON | Source = Service Control Manager | ID = 7023