Need help removing viruses

**Dev** · 07-02-2011

Last Sunday morning I turned on my laptop and a Win Scan started up and gave all types of hard drive errors, etc. My Avira anti-virus program quarantined it as far as I know and I have been trying to figure out how to get the icon off my desktop, it keeps reappearing at each start up. While working online today I got another virus notice from Avira that three viruses/trojans were found (TR/Dldr.Murlo.kzs) and these were quarantined but I do not know how to remove these from my laptop. I am not sure they are disabled and would like to know if it is safe to use my laptop to continue work on, using passwords, etc. I would appreciate it if someone could take a look at the logs and help me remove these from my computer. I also noticed that win scan is also still listed in my start up programs.

Thanks in advance for any help.

===========================

Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes

Database version: 5698

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18999

2/6/2011 7:25:16 PM
mbam-log-2011-02-06 (19-25-16).txt

Scan type: Quick scan
Objects scanned: 168221
Time elapsed: 6 minute(s), 16 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\Devorah\Desktop\Explorer.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

===========================

GMER (said there were no modifications and the log was empty)

===========================

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 64-bit
Base Board Manufacturer: TOSHIBA
BIOS Manufacturer: TOSHIBA
System Manufacturer: TOSHIBA
System Product Name: Satellite P305
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 172):
0x01E59000 \SystemRoot\system32\ntoskrnl.exe
0x01E13000 \SystemRoot\system32\hal.dll
0x00608000 \SystemRoot\system32\kdcom.dll
0x00612000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x0064D000 \SystemRoot\system32\PSHED.dll
0x00661000 \SystemRoot\system32\CLFS.SYS
0x006BE000 \SystemRoot\system32\CI.dll
0x00806000 \SystemRoot\system32\drivers\Wdf01000.sys
0x008E0000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x008EE000 \SystemRoot\system32\drivers\fltmgr.sys
0x00935000 \SystemRoot\system32\drivers\acpi.sys
0x0098B000 \SystemRoot\system32\drivers\WMILIB.SYS
0x00994000 \SystemRoot\system32\drivers\msisadrv.sys
0x0099E000 \SystemRoot\system32\drivers\pci.sys
0x009CE000 \SystemRoot\System32\drivers\partmgr.sys
0x009E3000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x009E7000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x00770000 \SystemRoot\system32\drivers\volmgr.sys
0x00784000 \SystemRoot\System32\drivers\volmgrx.sys
0x009F3000 \SystemRoot\system32\drivers\intelide.sys
0x007EA000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x00A0B000 \SystemRoot\System32\drivers\mountmgr.sys
0x00A1E000 \SystemRoot\system32\drivers\pavboot64.sys
0x00A29000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x00B2D000 \SystemRoot\system32\drivers\atapi.sys
0x00B35000 \SystemRoot\system32\drivers\ataport.SYS
0x00B59000 \SystemRoot\system32\drivers\msahci.sys
0x00B63000 \SystemRoot\system32\drivers\fileinfo.sys
0x00B77000 \SystemRoot\system32\drivers\PCTCore64.sys
0x00C02000 \SystemRoot\system32\drivers\pctDS64.sys
0x00C73000 \SystemRoot\system32\drivers\pctEFA64.sys
0x00D3F000 \SystemRoot\System32\Drivers\ksecdd.sys
0x00E02000 \SystemRoot\system32\drivers\ndis.sys
0x0100D000 \SystemRoot\system32\drivers\msrpc.sys
0x0105D000 \SystemRoot\system32\drivers\NETIO.SYS
0x01203000 \SystemRoot\System32\drivers\tcpip.sys
0x01379000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x01409000 \SystemRoot\System32\Drivers\Ntfs.sys
0x01589000 \SystemRoot\system32\drivers\volsnap.sys
0x015CD000 \SystemRoot\system32\DRIVERS\TVALZ_O.SYS
0x010B6000 \SystemRoot\system32\DRIVERS\tos_sps64.sys
0x015D2000 \SystemRoot\System32\Drivers\spldr.sys
0x015DA000 \SystemRoot\System32\Drivers\mup.sys
0x013A5000 \SystemRoot\System32\drivers\ecache.sys
0x015EC000 \SystemRoot\system32\drivers\disk.sys
0x013D1000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x0113D000 \SystemRoot\system32\drivers\crcdisk.sys
0x01155000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x01400000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x01162000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x01175000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x0117A000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x02607000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x0240D000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x024F0000 \SystemRoot\System32\drivers\watchdog.sys
0x02500000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x025ED000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x02B53000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x02B99000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x02C05000 \SystemRoot\system32\DRIVERS\NETw4v64.sys
0x02F1C000 \SystemRoot\system32\DRIVERS\yk60x64.sys
0x02F81000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x02F93000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x02FA3000 \SystemRoot\system32\DRIVERS\o2sdx64.sys
0x02FAF000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
0x02FDD000 \SystemRoot\system32\DRIVERS\o2mdx64.sys
0x02FEA000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x02BAA000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x01183000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x02C00000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x02400000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x02BB8000 \SystemRoot\system32\DRIVERS\tdcmdpst.sys
0x02BC2000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x02BDE000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x00FC5000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x03006000 \SystemRoot\system32\DRIVERS\storport.sys
0x03063000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x03070000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x03093000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x0309F000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x030D0000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x030E0000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x030FE000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x03116000 \SystemRoot\system32\DRIVERS\termdd.sys
0x03129000 \SystemRoot\system32\DRIVERS\swenum.sys
0x0312B000 \SystemRoot\system32\DRIVERS\ks.sys
0x0315F000 \SystemRoot\system32\DRIVERS\QIOMem.sys
0x03169000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x03174000 \SystemRoot\system32\DRIVERS\umbus.sys
0x03184000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x031CC000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x06406000 \SystemRoot\system32\drivers\HdAudio.sys
0x0644F000 \SystemRoot\system32\drivers\portcls.sys
0x0648A000 \SystemRoot\system32\drivers\drmk.sys
0x064AD000 \SystemRoot\system32\drivers\ksthunk.sys
0x064B3000 \SystemRoot\system32\drivers\CHDART64.sys
0x064EF000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x064F9000 \SystemRoot\System32\Drivers\Null.SYS
0x06502000 \SystemRoot\System32\drivers\vga.sys
0x06510000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x06535000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x06551000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x0655A000 \SystemRoot\system32\DRIVERS\usbscan.sys
0x0656A000 \SystemRoot\system32\drivers\rdpencdd.sys
0x06573000 \SystemRoot\System32\Drivers\Msfs.SYS
0x0657E000 \SystemRoot\system32\DRIVERS\usbprint.sys
0x06589000 \SystemRoot\System32\Drivers\Npfs.SYS
0x0659A000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x065A3000 \SystemRoot\system32\DRIVERS\tdx.sys
0x065C0000 \SystemRoot\system32\DRIVERS\smb.sys
0x065DB000 \SystemRoot\system32\DRIVERS\dot4usb.sys
0x06603000 \SystemRoot\System32\Drivers\avgtdia.sys
0x06654000 \SystemRoot\system32\DRIVERS\Dot4.sys
0x0667C000 \SystemRoot\System32\DRIVERS\netbt.sys
0x066C0000 \SystemRoot\System32\Drivers\aswTdi.SYS
0x066D0000 \SystemRoot\system32\drivers\afd.sys
0x0673B000 \SystemRoot\System32\Drivers\aswRdr.SYS
0x06744000 \SystemRoot\system32\drivers\ws2ifsl.sys
0x0674F000 \SystemRoot\system32\DRIVERS\Dot4Prt.sys
0x06759000 \SystemRoot\system32\DRIVERS\pacer.sys
0x06777000 \SystemRoot\system32\DRIVERS\netbios.sys
0x06786000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x067A1000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x067AA000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x067BC000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x067C4000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x0680B000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x06858000 \SystemRoot\system32\drivers\nsiproxy.sys
0x06864000 \SystemRoot\System32\Drivers\dfsc.sys
0x06881000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x068A3000 \SystemRoot\system32\DRIVERS\PTDUBus.sys
0x068B3000 \SystemRoot\system32\DRIVERS\PTDUMdm.sys
0x068DC000 \SystemRoot\system32\drivers\modem.sys
0x068EB000 \SystemRoot\system32\DRIVERS\PTDUVsp.sys
0x06914000 \SystemRoot\system32\DRIVERS\PTDUWWAN.sys
0x06949000 \SystemRoot\system32\DRIVERS\PTDUWFLT.sys
0x0694B000 \SystemRoot\System32\Drivers\avgldx64.sys
0x06979000 \SystemRoot\System32\Drivers\aswSP.SYS
0x06995000 \SystemRoot\System32\Drivers\UVCFTR_S.SYS
0x069A0000 \SystemRoot\System32\Drivers\usbvideo.sys
0x00090000 \SystemRoot\System32\win32k.sys
0x069D8000 \SystemRoot\System32\drivers\Dxapi.sys
0x069E4000 \SystemRoot\system32\DRIVERS\monitor.sys
0x004A0000 \SystemRoot\System32\TSDDD.dll
0x00640000 \SystemRoot\System32\cdd.dll
0x00830000 \SystemRoot\System32\ATMFD.DLL
0x067CF000 \SystemRoot\system32\drivers\luafv.sys
0x031E0000 \SystemRoot\system32\DRIVERS\aswMonFlt.sys
0x011D8000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x069F7000 \SystemRoot\system32\DRIVERS\aswFsBlk.sys
0x08002000 \SystemRoot\system32\drivers\spsys.sys
0x0809C000 \SystemRoot\system32\DRIVERS\AegisP.sys
0x080A7000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x080BB000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x080EF000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x080FA000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x08112000 \SystemRoot\system32\drivers\HTTP.sys
0x081B5000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x081DE000 \SystemRoot\system32\DRIVERS\bowser.sys
0x00DC6000 \SystemRoot\System32\drivers\mpsdrv.sys
0x00BBA000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x0880A000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x08853000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x08872000 \SystemRoot\System32\DRIVERS\srv2.sys
0x088A4000 \SystemRoot\System32\DRIVERS\srv.sys
0x08938000 \SystemRoot\system32\drivers\peauth.sys
0x089EE000 \SystemRoot\System32\Drivers\secdrv.SYS
0x065EB000 \SystemRoot\System32\drivers\tcpipreg.sys
0x00DE0000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x06800000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x069CA000 \??\C:\PROGRA~2\VERIZO~1\VZACCE~1\SMSIVZAM5X64.SYS
0x772E0000 \Windows\System32\ntdll.dll

Processes (total 101):
0 System Idle Process
4 System
472 C:\Windows\System32\smss.exe
604 csrss.exe
656 C:\Windows\System32\wininit.exe
676 csrss.exe
712 C:\Windows\System32\services.exe
732 C:\Windows\System32\lsass.exe
740 C:\Windows\System32\lsm.exe
840 C:\Windows\System32\winlogon.exe
916 C:\Windows\System32\svchost.exe
996 C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\Pres entationFontCache.exe
244 C:\Windows\System32\svchost.exe
680 C:\Windows\System32\Ati2evxx.exe
1032 C:\Windows\System32\svchost.exe
1068 C:\Windows\System32\svchost.exe
1080 C:\Windows\System32\svchost.exe
1160 C:\Windows\System32\audiodg.exe
1184 C:\Windows\System32\svchost.exe
1204 C:\Windows\System32\SLsvc.exe
1232 C:\Windows\System32\svchost.exe
1408 C:\Windows\System32\svchost.exe
1432 C:\Windows\System32\Ati2evxx.exe
1572 C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
1584 C:\Program Files\Alwil Software\Avast4\ashServ.exe
1592 C:\Windows\System32\wlanext.exe
2000 C:\Windows\System32\spoolsv.exe
2024 C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
2036 C:\Windows\System32\svchost.exe
2144 C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
2176 C:\Windows\System32\svchost.exe
2188 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
2280 C:\Windows\SysWOW64\atashost.exe
2288 C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
2336 C:\Program Files (x86)\AVG\AVGLS9\avgwdsvc.exe
2348 C:\Program Files (x86)\Bonjour\mDNSResponder.exe
2452 C:\Windows\System32\taskeng.exe
2472 C:\Windows\System32\dwm.exe
2484 C:\Program Files (x86)\Toshiba\ConfigFree\CFSvcs.exe
2552 C:\Program Files (x86)\AVG\AVGLS9\avgnsa.exe
2564 C:\Windows\explorer.exe
2640 C:\Program Files\Process Lasso\ProcessLasso.exe
2648 C:\Windows\System32\taskeng.exe
2856 C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
2892 C:\Windows\System32\taskeng.exe
2900 C:\Program Files\Process Lasso\ProcessGovernor.exe
2996 C:\Windows\SysWOW64\svchost.exe
3012 C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
2064 C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
1564 C:\Windows\System32\svchost.exe
2360 C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
3232 C:\Program Files (x86)\O2Micro Flash Memory Card Driver\o2flash.exe
3316 C:\TOSHIBA\IVP\ISM\pinger.exe
3336 C:\Windows\System32\svchost.exe
3348 C:\Windows\System32\svchost.exe
3360 C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
3428 C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
3456 C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
3784 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
3820 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
3852 C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
3920 C:\Program Files\Toshiba\SmoothView\SmoothView.exe
3964 C:\Windows\System32\svchost.exe
4044 C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
4056 C:\TOSHIBA\IVP\swupdate\swupdtmr.exe
3136 C:\Windows\ehome\ehtray.exe
3276 C:\Windows\ehome\ehmsas.exe
3488 C:\Program Files (x86)\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
1028 C:\Windows\System32\TODDSrv.exe
812 C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
3216 C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
3508 C:\Program Files\Toshiba\SMARTLogService\TosIPCSrv.exe
3140 C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
3608 C:\Windows\System32\svchost.exe
1444 C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
1424 C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
3892 C:\Program Files (x86)\iTunes\iTunesHelper.exe
4120 C:\Windows\System32\svchost.exe
4208 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
4300 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
4328 C:\Windows\System32\SearchIndexer.exe
4540 C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
4784 C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
2420 C:\Program Files\iPod\bin\iPodService.exe
4536 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
5452 C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe
5280 C:\Program Files (x86)\IObit\Advanced SystemCare 3\AWC.exe
2124 C:\Program Files (x86)\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe
1888 WmiPrvSE.exe
2396 C:\Users\Devorah\AppData\Local\Google\Chrome\Appli cation\chrome.exe
500 C:\Users\Devorah\AppData\Local\Google\Chrome\Appli cation\chrome.exe
3024 C:\Users\Devorah\AppData\Local\Google\Chrome\Appli cation\chrome.exe
5404 C:\Users\Devorah\AppData\Local\Google\Chrome\Appli cation\chrome.exe
2100 C:\Users\Devorah\AppData\Local\Google\Chrome\Appli cation\chrome.exe
4320 C:\Users\Devorah\AppData\Local\Google\Chrome\Appli cation\chrome.exe
3436 C:\Users\Devorah\AppData\Local\Google\Chrome\Appli cation\chrome.exe
5792 C:\Windows\System32\SearchProtocolHost.exe
3004 C:\Windows\System32\SearchFilterHost.exe
4560 dllhost.exe
4068 dllhost.exe
5692 C:\Users\Devorah\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`5dd00000 (NTFS)
\\.\D: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: TOSHIBAMK2046GSX, Rev: LB013M
PhysicalDrive1 Model Number: HitachiHTS542520K9SA00, Rev: BBDOC33P

Size Device Name MBR Status
--------------------------------------------
186 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
SHA1: BBAD517F7EAC529451E4B9586C847AE190574F61
186 GB \\.\PhysicalDrive1 Unknown MBR code
SHA1: B8E2175818464D3FFEB1C1B647995AD0F49BFDB5

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

=========================

DDS (Ver_10-12-12.02) - NTFS_AMD64
Run by Devorah at 20:29:54.75 on Sun 02/06/2011
Internet Explorer: 8.0.6001.18999 BrowserJavaVersion: 1.6.0_17
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.4093.2368 [GMT -6:00]

AV: avast! antivirus *Enabled/Outdated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: avast! antivirus *Enabled/Outdated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Spyware Doctor *Disabled/Updated* {94076BB2-F3DA-227F-9A1E-F060FF73600F}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\Pres entationFontCache.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
C:\Windows\system32\svchost.exe -k apphost
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\SysWOW64\atashost.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files (x86)\AVG\AVGLS9\avgwdsvc.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files (x86)\AVG\AVGLS9\avgnsa.exe
C:\Windows\Explorer.EXE
C:\Program Files\Process Lasso\processlasso.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Process Lasso\processgovernor.exe
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
C:\Program Files (x86)\O2Micro Flash Memory Card Driver\o2flash.exe
C:\TOSHIBA\IVP\ISM\pinger.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files (x86)\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Windows\system32\svchost.exe -k iissvcs
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files (x86)\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe
C:\Users\Devorah\AppData\Local\Google\Chrome\Appli cation\chrome.exe
C:\Users\Devorah\AppData\Local\Google\Chrome\Appli cation\chrome.exe
C:\Users\Devorah\AppData\Local\Google\Chrome\Appli cation\chrome.exe
C:\Users\Devorah\AppData\Local\Google\Chrome\Appli cation\chrome.exe
C:\Users\Devorah\AppData\Local\Google\Chrome\Appli cation\chrome.exe
C:\Users\Devorah\AppData\Local\Google\Chrome\Appli cation\chrome.exe
C:\Users\Devorah\AppData\Local\Google\Chrome\Appli cation\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Devorah\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.toshibadirect.com/dpdstart
uDefault_Page_URL = hxxp://www.toshibadirect.com/dpdstart
mDefault_Page_URL = hxxp://www.toshibadirect.com/dpdstart
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - C:\Program Files (x86)\AVG\AVGLS9\Toolbar\IEToolbar.dll
uURLSearchHooks: IObitCom Toolbar: {31c7d459-9cc3-44f2-9dca-fc11795309b4} - C:\Program Files (x86)\IObitCom\tbIObi.dll
uURLSearchHooks: H - No File
mURLSearchHooks: IObitCom Toolbar: {31c7d459-9cc3-44f2-9dca-fc11795309b4} - C:\Program Files (x86)\IObitCom\tbIObi.dll
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - C:\Program Files (x86)\AVG\AVGLS9\Toolbar\IEToolbar.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
BHO: IObitCom Toolbar: {31c7d459-9cc3-44f2-9dca-fc11795309b4} - C:\Program Files (x86)\IObitCom\tbIObi.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVGLS9\avgssie.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - C:\Program Files (x86)\AVG\AVGLS9\Toolbar\IEToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - C:\Program Files (x86)\AVG\AVGLS9\Toolbar\IEToolbar.dll
TB: IObitCom Toolbar: {31c7d459-9cc3-44f2-9dca-fc11795309b4} - C:\Program Files (x86)\IObitCom\tbIObi.dll
uRun: [ehTray.exe] C:\Windows\ehome\ehTray.exe
mRun: [Conime] %windir%\system32\conime.exe
mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Sta rtup\WHITES~1.LNK - C:\Users\Devorah\Desktop\WhiteSmokeWriterGeo5002_e n.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Download with mediAvatar YouTube Video Converter - C:\Program Files (x86)\mediAvatar\YouTube Video Converter\upod_link.HTM
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
LSP: C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll
Trusted Zone: intuit.com\ttlc
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: {A1E7CB3C-06AF-4444-BE7F-45A807BD0CB1} = 69.78.96.14 66.174.92.14
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files (x86)\AVG\AVGLS9\Toolbar\IEToolbar.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVGLS9\avgpp.dll
Notify: !SASWinLogon - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - C:\Program Files (x86)\SUPERAntiSpyware\SASSEH.DLL
BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVGLS9\avgssiea.dll
BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
TB-X64: {31C7D459-9CC3-44F2-9DCA-FC11795309B4} - No File
TB-X64: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
mRun-x64: [IAAnotif] "C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe"
mRun-x64: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
mRun-x64: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
mRun-x64: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
mRun-x64: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
mRun-x64: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe

================= FIREFOX ===================

FF - ProfilePath - C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - component: C:\Program Files (x86)\AVG\AVGLS9\Firefox\components\avgssff.dll
FF - component: C:\Program Files (x86)\AVG\AVGLS9\Toolbar\Firefox\avg@igeared\compo nents\IGeared_tavgp_xputils2.dll
FF - component: C:\Program Files (x86)\AVG\AVGLS9\Toolbar\Firefox\avg@igeared\compo nents\IGeared_tavgp_xputils3.dll
FF - component: C:\Program Files (x86)\AVG\AVGLS9\Toolbar\Firefox\avg@igeared\compo nents\IGeared_tavgp_xputils35.dll
FF - component: C:\Program Files (x86)\AVG\AVGLS9\Toolbar\Firefox\avg@igeared\compo nents\xpavgtbapi.dll
FF - component: C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{29956a1f-dda2-4319-a8cc-30966adea17a}\components\FFExternalAlert.dll
FF - component: C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{29956a1f-dda2-4319-a8cc-30966adea17a}\components\RadioWMPCore.dll
FF - component: C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll
FF - component: C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}\components\nstidy.dll
FF - component: C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll
FF - component: C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}\platform\WINNT_x86-msvc\components\pagespeed.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll
FF - plugin: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
FF - plugin: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
FF - plugin: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
FF - plugin: C:\Users\Devorah\AppData\Local\Google\Update\1.2.1 83.39\npGoogleOneClick8.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Web Developer: {c45c406e-ab73-11d8-be73-000a95be3b12} - %profile%\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: FireFTP: {a7c6cf7f-112c-4500-a7ea-39801a327e5f} - %profile%\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
FF - Ext: Hebrew Calendar: {C4A22BA1-6D61-45F1-82A9-140FD33F1110} - %profile%\extensions\{C4A22BA1-6D61-45F1-82A9-140FD33F1110}
FF - Ext: SearchStatus: {d57c9ff1-6389-48fc-b770-f78bd89b6e8a} - %profile%\extensions\{d57c9ff1-6389-48fc-b770-f78bd89b6e8a}
FF - Ext: Expression Web Toolbar: {29956a1f-dda2-4319-a8cc-30966adea17a} - %profile%\extensions\{29956a1f-dda2-4319-a8cc-30966adea17a}
FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.co m
FF - Ext: Omnibar: omnibar@ajitk.com - %profile%\extensions\omnibar@ajitk.com
FF - Ext: SEO Doctor: seodoctor@prelovac.com - %profile%\extensions\seodoctor@prelovac.com
FF - Ext: Page Speed: {e3f6c2cc-d8db-498c-af6c-499fb211db97} - %profile%\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}
FF - Ext: Html Validator: {3b56bcc7-54e5-44a2-9b44-66c3ef58c13e} - %profile%\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}
FF - Ext: YSlow: yslow@yahoo-inc.com - %profile%\extensions\yslow@yahoo-inc.com
FF - Ext: WCAG Contrast checker: colorchecker@colorcheckerniquelao.net - %profile%\extensions\colorchecker@colorcheckerniqu elao.net
FF - Ext: View Source Chart: {68836a21-fc7d-4ea1-a065-7efabd99d414} - %profile%\extensions\{68836a21-fc7d-4ea1-a065-7efabd99d414}
FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - C:\Program Files (x86)\AVG\AVGLS9\Firefox
FF - Ext: AVG Security Toolbar em:version=6.010.006.004 em:displayname=AVG Security Toolbar em:iconURL=chrome://tavgp/skin/logo.ico em:creator=AVG Technologies em:description=AVG Security Toolbar em:homepageURL=http://www.avg.com >: avg@igeared - C:\Program Files (x86)\AVG\AVGLS9\Toolbar\Firefox\avg@igeared

============= SERVICES / DRIVERS ===============

R0 pavboot;pavboot;C:\Windows\System32\drivers\pavboo t64.sys [2009-6-20 33792]
R0 PCTCore;PCTools KDS;C:\Windows\System32\drivers\PCTCore64.sys [2011-1-30 257232]
R0 pctDS;PC Tools Data Store;C:\Windows\System32\drivers\pctDS64.sys [2011-1-30 452872]
R0 pctEFA;PC Tools Extended File Attributes;C:\Windows\System32\drivers\pctEFA64.sy s [2011-1-30 816016]
R0 tos_sps64;TOSHIBA tos_sps64 Service;C:\Windows\System32\drivers\tos_sps64.sys [2008-6-27 531968]
R1 aswSP;avast! Self Protection;C:\Windows\System32\drivers\aswSP.sys [2008-12-3 89680]
R1 AvgLdx64;AVG LinkScanner® AVI Loader Driver x64;C:\Windows\System32\drivers\avgldx64.sys [2010-5-29 174160]
R1 AvgTdiA;AVG LinkScanner® Network Redirector x64;C:\Windows\System32\drivers\avgtdia.sys [2010-5-29 317520]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2010-5-7 135336]
R2 AntiVirService;Avira AntiVir Guard;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2010-5-7 267944]
R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswF sBlk.sys [2008-12-3 22096]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\as wMonFlt.sys [2008-12-3 65616]
R2 atashost;WebEx Service Host for Support Center;C:\Windows\SysWOW64\atashost.exe [2009-2-16 20376]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\Alwil Software\Avast4\ashServ.exe [2008-12-3 138680]
R2 avg9wd;AVG LinkScanner®9 WatchDog;C:\Program Files (x86)\AVG\AVGLS9\avgwdsvc.exe [2010-6-29 308136]
R2 avgntflt;avgntflt;C:\Windows\System32\drivers\avgn tflt.sys [2010-5-7 83120]
R2 ConfigFree Service;ConfigFree Service;C:\Program Files (x86)\Toshiba\ConfigFree\CFSvcs.exe [2007-12-25 40960]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;C:\Program Files\Toshiba\SMARTLogService\TosIPCSrv.exe [2007-12-3 175104]
R3 avast! Mail Scanner;avast! Mail Scanner;C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2008-12-3 254040]
R3 avast! Web Scanner;avast! Web Scanner;C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2008-12-3 352920]
R3 CnxtHdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service;C:\Windows\System32\drivers\CHDART64.sys [2008-2-1 222720]
R3 NETw4v64;Intel(R) Wireless WiFi Link Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\NETw4v64.sys [2007-9-26 3196416]
R3 O2MDRDR;O2MDRDR;C:\Windows\System32\drivers\o2mdx6 4.sys [2008-1-15 58328]
R3 O2SDRDR;O2SDRDR;C:\Windows\System32\drivers\o2sdx6 4.sys [2008-1-8 51544]
R3 PTDUBus;PANTECH UM175 Composite Device Driver ;C:\Windows\System32\drivers\PTDUBus.sys [2010-3-10 70672]
R3 PTDUMdm;PANTECH UM175 Drivers;C:\Windows\System32\drivers\PTDUMdm.sys [2010-3-10 173456]
R3 PTDUVsp;PANTECH UM175 Diagnostic Port;C:\Windows\System32\drivers\PTDUVsp.sys [2010-3-10 173456]
R3 PTDUWFLT;PTDUWWAN Filter Driver;C:\Windows\System32\drivers\PTDUWFLT.sys [2010-3-10 12688]
R3 PTDUWWAN;PANTECH UM175 WWAN Driver;C:\Windows\System32\drivers\PTDUWWAN.sys [2010-3-10 141840]
R3 QIOMem;Generic IO & Memory Access;C:\Windows\System32\drivers\QIOMem.sys [2007-4-9 9728]
R3 SMSIVZAM5X64;SMSIVZAM5X64 NDIS Protocol Driver;C:\PROGRA~2\VERIZO~1\VZACCE~1\SMSIVZAM5X64. SYS [2009-5-25 43032]
R3 yukonx64;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk60x64.sys [2007-12-28 391680]
S1 SASDIFSV;SASDIFSV;C:\Program Files (x86)\SUPERAntiSpyware\sasdifsv.sys [2010-1-5 9968]
S1 SASKUTIL;SASKUTIL;C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.SYS [2010-1-5 74480]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\ v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework6 4\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;C:\Program Files (x86)\AVG\AVGLS9\Toolbar\ToolbarBroker.exe [2010-10-19 517448]
S3 FontCache;Windows Font Cache Service;C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 27648]
S3 HpGmb001;USB Mobile Packet Filter Driver;C:\Windows\System32\drivers\HpGmb001.sys [2010-4-11 14336]
S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968]
S3 PSSDK42;PSSDK42;C:\Windows\System32\drivers\pssdk4 2.sys [2010-2-7 53312]
S3 SASENUM;SASENUM;C:\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS [2010-1-5 7408]
S3 sdAuxService;PC Tools Auxiliary Service;C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe [2011-1-30 366840]
S3 sdCoreService;PC Tools Security Service;C:\Program Files (x86)\PC Tools Security\pctsSvc.exe [2011-1-30 1150936]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2010-9-28 51712]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0. 30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768]
S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework6 4\v2.0.50727\mscorsvw.exe [2009-7-23 89920]
S4 KR10I64;KR10I64;C:\Windows\System32\drivers\KR10I6 4.sys [2008-2-20 248320]
S4 KR10N64;KR10N64;C:\Windows\System32\drivers\KR10N6 4.sys [2008-2-20 237568]

=============== File Associations ===============

JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %*
scrfile="%1" /S

=============== Created Last 30 ================

2011-01-30 20:50:54 -------- d-----w- C:\PROGRA~3\SafeReturner
2011-01-30 12:49:16 816016 ----a-w- C:\Windows\System32\drivers\pctEFA64.sys
2011-01-30 12:49:16 452872 ----a-w- C:\Windows\System32\drivers\pctDS64.sys
2011-01-30 12:49:15 331368 ----a-w- C:\Windows\System32\drivers\pctgntdi64.sys
2011-01-30 12:49:15 136168 ----a-w- C:\Windows\System32\drivers\pctwfpfilter64.sys
2011-01-30 12:49:12 257232 ----a-w- C:\Windows\System32\drivers\PCTCore64.sys
2011-01-30 12:49:01 92896 ----a-w- C:\Windows\System32\drivers\pctplsg64.sys
2011-01-30 12:48:45 -------- d-----w- C:\Program Files (x86)\Common Files\PC Tools
2011-01-30 12:48:44 -------- d-----w- C:\Users\Devorah\AppData\Roaming\PC Tools
2011-01-30 12:48:44 -------- d-----w- C:\Program Files (x86)\PC Tools Security
2011-01-30 12:38:34 -------- d-----w- C:\PROGRA~3\PC Tools
2011-01-27 11:37:59 -------- d-----w- C:\Program Files (x86)\DVDFab 8
2011-01-24 01:57:50 -------- d-----w- C:\Users\Devorah\AppData\Roaming\Engelmann Media
2011-01-24 01:57:48 -------- d-----w- C:\Program Files (x86)\Engelmann Media
2011-01-24 01:57:48 -------- d-----w- C:\Program Files (x86)\Common Files\HDX4
2011-01-21 18:30:06 311296 ----a-w- C:\Windows\SysWow64\EMRegSys.dll
2011-01-21 12:08:29 -------- d-----w- C:\Users\Devorah\AppData\Roaming\ArcticLine
2011-01-21 12:08:23 -------- d-----w- C:\Program Files (x86)\Folder Marker
2011-01-14 00:05:39 -------- d-----w- C:\PROGRA~3\ProcessLasso
2011-01-14 00:05:11 -------- d-----w- C:\Users\Devorah\AppData\Roaming\ProcessLasso
2011-01-14 00:05:11 -------- d-----w- C:\Program Files\Process Lasso
2011-01-11 13:48:08 -------- d-----w- C:\Program Files (x86)\Inpaint
2011-01-09 14:25:14 -------- d-----w- C:\Program Files (x86)\Vectorian Inc

==================== Find3M ====================

2010-12-28 16:08:18 466944 ----a-w- C:\Windows\System32\odbc32.dll
2010-12-28 15:55:03 413696 ----a-w- C:\Windows\SysWow64\odbc32.dll
2010-12-21 00:08:40 24152 ----a-w- C:\Windows\System32\drivers\mbam.sys
2010-12-14 16:15:49 1251840 ----a-w- C:\Windows\System32\sdclt.exe
2010-11-24 11:45:31 83120 ----a-w- C:\Windows\System32\drivers\avgntflt.sys

============= FINISH: 20:30:34.34 ===============

=====================

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 6/27/2008 11

29 PM
System Uptime: 2/6/2011 7:26:58 PM (1 hours ago)

Motherboard: TOSHIBA | | Satellite P305
Processor: Intel(R) Core(TM)2 Duo CPU T5750 @ 2.00GHz | U2E1 | 1667/166mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 185 GiB total, 98.486 GiB free.
D: is FIXED (NTFS) - 186 GiB total, 186.272 GiB free.
E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

==== Installed Programs ======================

Acrobat.com
Activation Assistant for the 2007 Microsoft Office suites
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.4.1
Advanced SystemCare 3
Ahnenblatt 2.61
AIO_CDB_ProductContext
AIO_CDB_Software
AIO_Scan
Amazon MP3 Downloader 1.0.10
Aneesoft 3D Flash Gallery GOTD
Apple Application Support
Apple Software Update
Artensoft Photo Mosaic Wizard
Ashampoo Burning Studio 2010 Advanced
Ashampoo Photo Commander 7.60
AVG LinkScanner® 9.0
Avira AntiVir Personal - Free Antivirus
AWicons Pro
bookTome
BufferChm
BurnPro Version 5.1.1
Calme 2010.0
Camera Assistant Software for Toshiba
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center Localization Chinese Standard
Catalyst Control Center Localization Chinese Traditional
Catalyst Control Center Localization Dutch
Catalyst Control Center Localization French
Catalyst Control Center Localization German
Catalyst Control Center Localization Italian
Catalyst Control Center Localization Japanese
Catalyst Control Center Localization Korean
Catalyst Control Center Localization Portuguese
Catalyst Control Center Localization Spanish
Catalyst Control Center Localization Swedish
ccc-core-static
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Dutch
CCC Help English
CCC Help French
CCC Help German
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Portuguese
CCC Help Spanish
CCC Help Swedish
CCleaner
CD/DVD Drive Acoustic Silencer
Chromagic 1.0
CodedColor PhotoStudio 2010, 6.1.2
CollageIt 1.1.5
ColorPic
Compatibility Pack for the 2007 Office system
Copy
Corner-A ArtStudio
Cover Commander 3.1.3 by Insofta Development
CustomerResearchQFolder
CyberLink PowerCinema for TOSHIBA
D3DX10
Destinations
Device Doctor 1.0.0.1
DeviceManagementQFolder
DigitImg
DocProc
DocProcQFolder
DVD MovieFactory for TOSHIBA
DVDFab 8.0.7.2 (26/01/2011)
EarthSoft Audio Jukebox 1.0.0
Easy Flyer Creator 2.0
Easy Photo Sorter version 2.6
Easy Thumbnails (Remove only)
Efficient Diary 1.75
eSupportQFolder
ExeIcon.com 3D Box Maker (remove only)
Express Burn
Express Rip
Expression Extras SEO Tools for Expression Web 3
Expression Extras SEO Tools for xWeb 2
Fax
FileZilla Client 3.3.2.1
Flash Slideshow Maker Pro 5.00
Flexible Album Studio v0.96 beta 1
FM Tuner Utility
GDR 4053 for SQL Server Database Services 2005 ENU (KB970892)
GDR 4053 for SQL Server Tools and Workstation Components 2005 ENU (KB970892)
GIMP 2.6.8
Good Keywords v3 042209
Google Chrome
GPL Ghostscript 8.70
Greeting Card Builder Full
HijackThis 1.99.1
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Memories Disc
HP Photosmart Essential
HP Software Update
HP Update
HP Wireless Comfort Mobile Mouse
HPProductAssistant
HPSSupply
Inpaint 3.0
InstantMask 1.4
IObitCom Toolbar
iSEEK AnswerWorks English Runtime
iVocalize Web Conference 4
Java(TM) 6 Update 17
Java(TM) 6 Update 3
jlGui 3.0
Junk Mail filter update
Karen's Directory Printer
Malwarebytes' Anti-Malware
MarketResearch
McGill English Dictionary of Rhyme & Verse Perfect 2.0
mediAvatar YouTube Video Converter
Microsoft Application Error Reporting
Microsoft Expression Web 2
Microsoft Expression Web 2 MUI (English)
Microsoft Expression Web 3
Microsoft Expression Web 3 SP1
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access 2003 Runtime
Microsoft Office Accounting 2009
Microsoft Office Accounting 2009 Equifax Addin
Microsoft Office Accounting 2009 Fixed Asset Manager
Microsoft Office Accounting 2009 PayPal Addin
Microsoft Office Accounting 2009 Tax Integration Add-in
Microsoft Office Accounting ADP Payroll Addin
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office Live Add-in 1.5
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Small Business Connectivity Components
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
Microsoft SQL Server 2005 Tools Express Edition
Microsoft SQL Server Setup Support Files (English)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
Microsoft XML Parser
Mobile Broadband Manager
Mozilla Firefox (3.0.8)
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MyHeritage Family Tree Builder
Napster
Napster Burn Engine
Ncesoft Flip Book Maker 2.3.1
NCH Toolbox
NetWaiting
Norton 360
Notepad++
Nuclear Coffee - DiscRipper
One-click CD/DVD Copy
OpenOffice.org 3.1
Panda ActiveScan 2.0
Photosmart 140,240,7200,7600,7700,7900 Series
PhotoWipe 1.0
Picture Collage Maker Pro 2.2.8
Picture Collage Maker Pro Full
PictureFrame Wizard v1.0
PitchPerfect Musical Instrument Tuner
Pixpedia Publisher 3.0.8
Prism Video Converter
Process Lasso
PSShortcuts
PSUsage
QuickBooks Financial Center
QuickTime
Qumana
RAD Video Tools
RealPlayer
Revo Uninstaller 1.88
RocketDock 1.3.5
Safari
Scan
Scribus 1.3.6svn
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2289158)
Security Update for 2007 Microsoft Office System (KB2344875)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft Office Excel 2007 (KB2345035)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office PowerPoint Viewer (KB2413381)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Security Update for Windows Media Encoder (KB2447961)
Security Update for Windows Media Encoder (KB954156)
Security Update for Windows Media Encoder (KB979332)
Segoe UI
Serif PagePlus SE 1.0
SimplyGoodPictures
Site Content Analyzer 3.2
SiteSpinner Pro V2
Skins
SolutionCenter
Sothink DHTML Menu 9
Spawn for Expression Web 3
Spelling Dictionaries Support For Adobe Reader 8
Spybot - Search & Destroy
Spyware Doctor 8.0
SpywareBlaster 4.3
SRWare Iron 2.0.178.0
Status
SUPERAntiSpyware Free Edition
Synovel Spicebird (0.7.1)
taskTome
Toolbox
Toshiba Assist
TOSHIBA ConfigFree
TOSHIBA DVD PLAYER
TOSHIBA Extended Tiles for Windows Mobility Center
TOSHIBA Face Recognition
TOSHIBA Games
TOSHIBA Hardware Setup
Toshiba Registration
TOSHIBA Software Upgrades
TOSHIBA Speech System Applications
TOSHIBA Speech System SR Engine(U.S.) Version1.0
TOSHIBA Speech System TTS Engine(U.S.) Version1.0
TOSHIBA Supervisor Password
TOSHIBA Value Added Package
TrayApp
TurboTax 2009
TurboTax 2009 WinPerFedFormset
TurboTax 2009 WinPerReleaseEngine
TurboTax 2009 WinPerTaxSupport
TurboTax 2009 wmoiper
TurboTax 2009 wrapper
UnloadSupport
Update for 2007 Microsoft Office System (KB2284654)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Expression Web 2 (KB957827)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VC80CRTRedist - 8.0.50727.4053
Vectorian Giotto 2.3.1
VideoPad Video Editor
Visual C++ 8.0 Runtime Setup Package (x64)
VZAccess Manager
WavePad Sound Editor
Web Album Generator 1.8.2
Web Site Publisher 2.1.1
WebDwarf V2
WebReg
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Photo Common
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Media Encoder 9 Series
Windows Media Player Firefox Plugin
Wondershare DemoCreator (Build 3.0.6)
Wondershare Flash Gallery Factory Standard 4.8.0.1

==== End Of File ===========================

**broni** · 07-02-2011

Welcome aboard

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
If you're stuck, or you're not sure about certain step, always ask before doing anything else.
Please refrain from running tools or applying updates other than those I suggest.
Never run more than one scan at a time.
Keep updating me regarding your computer behavior, good, or bad.
The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

================================================== =============================

You're running two AV programs, Avast and Avira.
One of them has to go.
Your choice.

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: Uninstall & Remove McAfee, Symantec, Norton, AVG, Avast & More Antivirus and Security Applications and Programs
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

Double-click on the Rkill desktop icon to run the tool.
If using Vista or Windows 7 right-click on it and choose Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
Do not reboot until instructed.
If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

**Dev** · 07-02-2011

Hi and thank you so much for your help. I just wanted to quickly reply to your instruction to only run one anti-virus program. As far as I knew I thought I was running just Avira. I assumed that when I uninstalled Avast over a year ago it was gone. Maybe it is running in the background and I do not know it? I have checked in the start up programs and it is not there and when I look in my Revo Uninstaller program to uninstall it is not there. Where can I find it to uninstall?

I will go now and follow the rest of your instructions.

**Dev** · 07-02-2011

I couldn't find where to disable Avast so I used the AppRemover to disable the Avast anti-virus. Below is the ComboFix log:

ComboFix 11-02-06.02 - Devorah 02/07/2011 8:39.1.2 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.4093.2711 [GMT -6:00]
Running from: c:\users\Devorah\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Spyware Doctor *Disabled/Updated* {94076BB2-F3DA-227F-9A1E-F060FF73600F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Devorah\AppData\Roaming\inst.exe

.
((((((((((((((((((((((((( Files Created from 2011-01-07 to 2011-02-07 )))))))))))))))))))))))))))))))
.

2011-02-07 14:51 . 2011-02-07 14:51 -------- d-----w- c:\users\Devorah\AppData\Local\temp
2011-02-07 14:51 . 2011-02-07 14:51 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-01-30 20:50 . 2011-01-30 20:54 -------- d-----w- c:\programdata\SafeReturner
2011-01-30 12:49 . 2010-07-16 20:53 816016 ----a-w- c:\windows\system32\drivers\pctEFA64.sys
2011-01-30 12:49 . 2010-06-29 16:35 452872 ----a-w- c:\windows\system32\drivers\pctDS64.sys
2011-01-30 12:49 . 2010-11-17 16:20 331368 ----a-w- c:\windows\system32\drivers\pctgntdi64.sys
2011-01-30 12:49 . 2010-11-17 16:20 136168 ----a-w- c:\windows\system32\drivers\pctwfpfilter64.sys
2011-01-30 12:49 . 2010-11-25 16:43 257232 ----a-w- c:\windows\system32\drivers\PCTCore64.sys
2011-01-30 12:49 . 2010-11-25 16:42 92896 ----a-w- c:\windows\system32\drivers\pctplsg64.sys
2011-01-30 12:48 . 2011-01-30 12:52 -------- d-----w- c:\program files (x86)\Common Files\PC Tools
2011-01-30 12:48 . 2011-02-07 13:54 -------- d-----w- c:\program files (x86)\PC Tools Security
2011-01-30 12:48 . 2011-01-30 12:48 -------- d-----w- c:\users\Devorah\AppData\Roaming\PC Tools
2011-01-30 12:38 . 2011-01-30 12:49 -------- d-----w- c:\programdata\PC Tools
2011-01-27 11:37 . 2011-01-27 11:38 -------- d-----w- c:\program files (x86)\DVDFab 8
2011-01-24 01:57 . 2011-01-24 01:57 -------- d-----w- c:\users\Devorah\AppData\Roaming\Engelmann Media
2011-01-24 01:57 . 2011-01-24 01:57 -------- d-----w- c:\program files (x86)\Engelmann Media
2011-01-24 01:57 . 2011-01-24 01:57 -------- d-----w- c:\program files (x86)\Common Files\HDX4
2011-01-21 18:30 . 2011-01-21 18:30 311296 ----a-w- c:\windows\SysWow64\EMRegSys.dll
2011-01-21 12:08 . 2011-01-21 12:08 -------- d-----w- c:\users\Devorah\AppData\Roaming\ArcticLine
2011-01-21 12:08 . 2011-01-21 12:08 -------- d-----w- c:\program files (x86)\Folder Marker
2011-01-14 00:05 . 2011-01-14 00:05 -------- d-----w- c:\programdata\ProcessLasso
2011-01-14 00:05 . 2011-01-14 00:06 -------- d-----w- c:\users\Devorah\AppData\Roaming\ProcessLasso
2011-01-14 00:05 . 2011-01-14 00:06 -------- d-----w- c:\program files\Process Lasso
2011-01-11 13:48 . 2011-01-11 13:48 -------- d-----w- c:\program files (x86)\Inpaint
2011-01-09 14:25 . 2011-01-09 14:25 -------- d-----w- c:\program files (x86)\Vectorian Inc

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2010-12-22 22:18 . 2010-12-22 22:18 749832 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlig ht\MCESpotlight\SpotlightResources.dll
2010-12-21 00:09 . 2010-01-13 11:20 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2010-12-21 00:08 . 2010-01-13 11:20 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-24 11:45 . 2010-05-07 20:07 83120 ----a-w- c:\windows\system32\drivers\avgntflt.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{31c7d459-9cc3-44f2-9dca-fc11795309b4}"= "c:\program files (x86)\IObitCom\tbIObi.dll" [2009-10-01 2166296]

[HKEY_CLASSES_ROOT\clsid\{31c7d459-9cc3-44f2-9dca-fc11795309b4}]

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{31c7d459-9cc3-44f2-9dca-fc11795309b4}]
2009-10-01 23:29 2166296 ----a-w- c:\program files (x86)\IObitCom\tbIObi.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\ Windows\CurrentVersion\Run]
"Conime"="c:\windows\system32\conime.exe" [2009-04-11 69120]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2010-11-06 281768]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-10-08 47904]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-11-18 421160]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
WhiteSmoke Translator.lnk - c:\users\Devorah\Desktop\WhiteSmokeWriterGeo5002_e n.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\Wow6432Node\microsoft\ windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files (x86)\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 ----a-w- c:\program files (x86)\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\ windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

R0 AFS;AFS; [x]
R1 SASDIFSV;SASDIFSV;c:\program files (x86)\SUPERAntiSpyware\SASDIFSV.SYS [2010-01-05 9968]
R1 SASKUTIL;SASKUTIL;c:\program files (x86)\SUPERAntiSpyware\SASKUTIL.sys [2010-01-05 74480]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\ v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework6 4\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 HpGmb001;USB Mobile Packet Filter Driver;c:\windows\system32\DRIVERS\HpGmb001.SYS [2009-05-26 14336]
R3 PSSDK42;PSSDK42;c:\windows\system32\Drivers\pssdk4 2.sys [2010-02-07 53312]
R3 SASENUM;SASENUM;c:\program files (x86)\SUPERAntiSpyware\SASENUM.SYS [2010-01-05 7408]
R3 sdAuxService;PC Tools Auxiliary Service;c:\program files (x86)\PC Tools Security\pctsAuxs.exe [2010-03-15 366840]
R3 SMSIVZAM5X64;SMSIVZAM5X64 NDIS Protocol Driver;c:\progra~2\VERIZO~1\VZACCE~1\SMSIVZAM5X64. SYS [2009-05-25 43032]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2010-09-28 51712]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework64\v4.0. 30319\WPF\WPFFontCache_v0400.exe [2010-03-18 1020768]
R4 KR10I64;KR10I64;c:\windows\system32\drivers\kr10i6 4.sys [2006-11-09 248320]
R4 KR10N64;KR10N64;c:\windows\system32\drivers\kr10n6 4.sys [2006-11-09 237568]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboo t64.sys [2008-06-19 33792]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore64.sys [2010-11-25 257232]
S0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS64.sys [2010-06-29 452872]
S0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA64.sy s [2010-07-16 816016]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [2008-01-21 531968]
S1 aswSP;avast! Self Protection; [x]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2010-11-06 135336]
S2 atashost;WebEx Service Host for Support Center;c:\windows\SysWOW64\atashost.exe [2009-02-17 20376]
S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2007-12-25 40960]
S2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [2007-12-04 175104]
S3 CnxtHdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service;c:\windows\system32\drivers\CHDART64.sys [2008-02-01 222720]
S3 NETw4v64;Intel(R) Wireless WiFi Link Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\NETw4v64.sys [2007-09-26 3196416]
S3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2mdx6 4.sys [2008-01-15 58328]
S3 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sdx6 4.sys [2008-01-09 51544]
S3 PTDUBus;PANTECH UM175 Composite Device Driver ;c:\windows\system32\DRIVERS\PTDUBus.sys [2009-08-12 70672]
S3 PTDUMdm;PANTECH UM175 Drivers;c:\windows\system32\DRIVERS\PTDUMdm.sys [2009-08-12 173456]
S3 PTDUVsp;PANTECH UM175 Diagnostic Port;c:\windows\system32\DRIVERS\PTDUVsp.sys [2009-08-12 173456]
S3 PTDUWFLT;PTDUWWAN Filter Driver;c:\windows\system32\DRIVERS\PTDUWFLT.sys [2009-08-12 12688]
S3 PTDUWWAN;PANTECH UM175 WWAN Driver;c:\windows\system32\DRIVERS\PTDUWWAN.sys [2009-08-12 141840]
S3 QIOMem;Generic IO & Memory Access;c:\windows\system32\DRIVERS\QIOMem.sys [2007-04-10 9728]
S3 yukonx64;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk60x64.sys [2007-12-28 391680]

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\ windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2011-02-07 c:\windows\Tasks\AWC Startup.job
- c:\program files (x86)\IObit\Advanced SystemCare 3\AWC.exe [2009-07-04 22:19]

2011-02-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4275440598-3698797053-1848500140-1000Core.job
- c:\users\Devorah\AppData\Local\Google\Update\Googl eUpdate.exe [2008-12-04 01:51]

2011-02-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4275440598-3698797053-1848500140-1000UA.job
- c:\users\Devorah\AppData\Local\Google\Update\Googl eUpdate.exe [2008-12-04 01:51]
.

--------- x86-64 -----------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-10-24 178712]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-11-30 1216808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.toshibadirect.com/dpdstart
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Download with mediAvatar YouTube Video Converter - c:\program files (x86)\mediAvatar\YouTube Video Converter\upod_link.HTM
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll
Trusted Zone: intuit.com\ttlc
FF - ProfilePath - c:\users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Web Developer: {c45c406e-ab73-11d8-be73-000a95be3b12} - %profile%\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: FireFTP: {a7c6cf7f-112c-4500-a7ea-39801a327e5f} - %profile%\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
FF - Ext: Hebrew Calendar: {C4A22BA1-6D61-45F1-82A9-140FD33F1110} - %profile%\extensions\{C4A22BA1-6D61-45F1-82A9-140FD33F1110}
FF - Ext: SearchStatus: {d57c9ff1-6389-48fc-b770-f78bd89b6e8a} - %profile%\extensions\{d57c9ff1-6389-48fc-b770-f78bd89b6e8a}
FF - Ext: Expression Web Toolbar: {29956a1f-dda2-4319-a8cc-30966adea17a} - %profile%\extensions\{29956a1f-dda2-4319-a8cc-30966adea17a}
FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.co m
FF - Ext: Omnibar: omnibar@ajitk.com - %profile%\extensions\omnibar@ajitk.com
FF - Ext: SEO Doctor: seodoctor@prelovac.com - %profile%\extensions\seodoctor@prelovac.com
FF - Ext: Page Speed: {e3f6c2cc-d8db-498c-af6c-499fb211db97} - %profile%\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}
FF - Ext: Html Validator: {3b56bcc7-54e5-44a2-9b44-66c3ef58c13e} - %profile%\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}
FF - Ext: YSlow: yslow@yahoo-inc.com - %profile%\extensions\yslow@yahoo-inc.com
FF - Ext: WCAG Contrast checker: colorchecker@colorcheckerniquelao.net - %profile%\extensions\colorchecker@colorcheckerniqu elao.net
FF - Ext: View Source Chart: {68836a21-fc7d-4ea1-a065-7efabd99d414} - %profile%\extensions\{68836a21-fc7d-4ea1-a065-7efabd99d414}
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{31C7D459-9CC3-44F2-9DCA-FC11795309B4} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKLM-Run-TPwrMain - %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
HKLM-Run-HSON - %ProgramFiles%\TOSHIBA\TBS\HSON.exe
HKLM-Run-SmoothView - %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
HKLM-Run-00TCrdMain - %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
AddRemove-jlGui 3.0 - c:\windows\system32\javaws.exe

.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Cl ass\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-02-07 08:52:51
ComboFix-quarantined-files.txt 2011-02-07 14:52

Pre-Run: 104,306,057,216 bytes free
Post-Run: 104,237,830,144 bytes free

- - End Of File - - 11D9AD660039904ABA84239CE261F516

**broni** · 07-02-2011

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

File::
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WhiteSmoke Translator.lnk
c:\users\Devorah\Desktop\WhiteSmokeWriterGeo5002_en.exe


Driver::
AFS
aswSP

3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

**Dev** · 07-02-2011

New ComboFix log:

ComboFix 11-02-06.02 - Devorah 02/07/2011 10:59:00.2.2 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.4093.2402 [GMT -6:00]
Running from: c:\users\Devorah\Desktop\ComboFix.exe
Command switches used :: c:\users\Devorah\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Spyware Doctor *Disabled/Updated* {94076BB2-F3DA-227F-9A1E-F060FF73600F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FILE ::
"c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WhiteSmoke Translator.lnk"
"c:\users\Devorah\Desktop\WhiteSmokeWriterGeo5002_ en.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WhiteSmoke Translator.lnk

Infected copy of c:\windows\SysWow64\drivers\ntfs.sys was found and disinfected
Restored copy from - c:\windows\ERDNT\cache64\ntfs.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ASWSP
-------\Service_AFS
-------\Service_aswSP

((((((((((((((((((((((((( Files Created from 2011-01-07 to 2011-02-07 )))))))))))))))))))))))))))))))
.

2011-02-07 17:09 . 2011-02-07 17:12 -------- d-----w- c:\users\Devorah\AppData\Local\temp
2011-02-07 17:09 . 2011-02-07 17:09 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-02-07 17:08 . 2009-04-11 07:15 1515496 ----a-w- c:\windows\SysWow64\drivers\ntfs.sys
2011-01-30 20:50 . 2011-01-30 20:54 -------- d-----w- c:\programdata\SafeReturner
2011-01-30 12:49 . 2010-07-16 20:53 816016 ----a-w- c:\windows\system32\drivers\pctEFA64.sys
2011-01-30 12:49 . 2010-06-29 16:35 452872 ----a-w- c:\windows\system32\drivers\pctDS64.sys
2011-01-30 12:49 . 2010-11-17 16:20 331368 ----a-w- c:\windows\system32\drivers\pctgntdi64.sys
2011-01-30 12:49 . 2010-11-17 16:20 136168 ----a-w- c:\windows\system32\drivers\pctwfpfilter64.sys
2011-01-30 12:49 . 2010-11-25 16:43 257232 ----a-w- c:\windows\system32\drivers\PCTCore64.sys
2011-01-30 12:49 . 2010-11-25 16:42 92896 ----a-w- c:\windows\system32\drivers\pctplsg64.sys
2011-01-30 12:48 . 2011-01-30 12:52 -------- d-----w- c:\program files (x86)\Common Files\PC Tools
2011-01-30 12:48 . 2011-02-07 13:54 -------- d-----w- c:\program files (x86)\PC Tools Security
2011-01-30 12:48 . 2011-01-30 12:48 -------- d-----w- c:\users\Devorah\AppData\Roaming\PC Tools
2011-01-30 12:38 . 2011-01-30 12:49 -------- d-----w- c:\programdata\PC Tools
2011-01-27 11:37 . 2011-01-27 11:38 -------- d-----w- c:\program files (x86)\DVDFab 8
2011-01-24 01:57 . 2011-01-24 01:57 -------- d-----w- c:\users\Devorah\AppData\Roaming\Engelmann Media
2011-01-24 01:57 . 2011-01-24 01:57 -------- d-----w- c:\program files (x86)\Engelmann Media
2011-01-24 01:57 . 2011-01-24 01:57 -------- d-----w- c:\program files (x86)\Common Files\HDX4
2011-01-21 18:30 . 2011-01-21 18:30 311296 ----a-w- c:\windows\SysWow64\EMRegSys.dll
2011-01-21 12:08 . 2011-01-21 12:08 -------- d-----w- c:\users\Devorah\AppData\Roaming\ArcticLine
2011-01-21 12:08 . 2011-01-21 12:08 -------- d-----w- c:\program files (x86)\Folder Marker
2011-01-14 00:05 . 2011-01-14 00:05 -------- d-----w- c:\programdata\ProcessLasso
2011-01-14 00:05 . 2011-01-14 00:06 -------- d-----w- c:\users\Devorah\AppData\Roaming\ProcessLasso
2011-01-14 00:05 . 2011-01-14 00:06 -------- d-----w- c:\program files\Process Lasso
2011-01-11 13:48 . 2011-01-11 13:48 -------- d-----w- c:\program files (x86)\Inpaint
2011-01-09 14:25 . 2011-01-09 14:25 -------- d-----w- c:\program files (x86)\Vectorian Inc

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2010-12-22 22:18 . 2010-12-22 22:18 749832 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlig ht\MCESpotlight\SpotlightResources.dll
2010-12-21 00:09 . 2010-01-13 11:20 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2010-12-21 00:08 . 2010-01-13 11:20 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-24 11:45 . 2010-05-07 20:07 83120 ----a-w- c:\windows\system32\drivers\avgntflt.sys
.

((((((((((((((((((((((((((((( SnapShot@2011-02-07_14.51.10 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-11-02 15:45 . 2011-02-07 17:13 98768 c:\windows\system32\WDI\BootPerformanceDiagnostics _SystemData.bin
+ 2008-12-03 17:59 . 2011-02-07 17:13 19208 c:\windows\system32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4275440598-3698797053-1848500140-1000_UserData.bin
- 2011-02-07 14:32 . 2011-02-07 14:32 2048 c:\windows\ServiceProfiles\LocalService\AppData\Lo cal\lastalive1.dat
+ 2011-02-07 17:11 . 2011-02-07 17:11 2048 c:\windows\ServiceProfiles\LocalService\AppData\Lo cal\lastalive1.dat
+ 2011-02-07 17:11 . 2011-02-07 17:11 2048 c:\windows\ServiceProfiles\LocalService\AppData\Lo cal\lastalive0.dat
- 2011-02-07 14:32 . 2011-02-07 14:32 2048 c:\windows\ServiceProfiles\LocalService\AppData\Lo cal\lastalive0.dat
+ 2010-03-08 13:47 . 2011-02-07 17:10 2737496 c:\windows\ServiceProfiles\LocalService\AppData\Lo cal\FontCache3.0.0.0.dat
- 2010-03-08 13:47 . 2011-02-07 14:31 2737496 c:\windows\ServiceProfiles\LocalService\AppData\Lo cal\FontCache3.0.0.0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{31c7d459-9cc3-44f2-9dca-fc11795309b4}"= "c:\program files (x86)\IObitCom\tbIObi.dll" [2009-10-01 2166296]

[HKEY_CLASSES_ROOT\clsid\{31c7d459-9cc3-44f2-9dca-fc11795309b4}]

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{31c7d459-9cc3-44f2-9dca-fc11795309b4}]
2009-10-01 23:29 2166296 ----a-w- c:\program files (x86)\IObitCom\tbIObi.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\ Windows\CurrentVersion\Run]
"Conime"="c:\windows\system32\conime.exe" [2009-04-11 69120]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2010-11-06 281768]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-10-08 47904]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-11-18 421160]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\Wow6432Node\microsoft\ windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files (x86)\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 ----a-w- c:\program files (x86)\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\ windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

R1 SASDIFSV;SASDIFSV;c:\program files (x86)\SUPERAntiSpyware\SASDIFSV.SYS [2010-01-05 9968]
R1 SASKUTIL;SASKUTIL;c:\program files (x86)\SUPERAntiSpyware\SASKUTIL.sys [2010-01-05 74480]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\ v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework6 4\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 HpGmb001;USB Mobile Packet Filter Driver;c:\windows\system32\DRIVERS\HpGmb001.SYS [2009-05-26 14336]
R3 PSSDK42;PSSDK42;c:\windows\system32\Drivers\pssdk4 2.sys [2010-02-07 53312]
R3 SASENUM;SASENUM;c:\program files (x86)\SUPERAntiSpyware\SASENUM.SYS [2010-01-05 7408]
R3 sdAuxService;PC Tools Auxiliary Service;c:\program files (x86)\PC Tools Security\pctsAuxs.exe [2010-03-15 366840]
R3 SMSIVZAM5X64;SMSIVZAM5X64 NDIS Protocol Driver;c:\progra~2\VERIZO~1\VZACCE~1\SMSIVZAM5X64. SYS [2009-05-25 43032]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2010-09-28 51712]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework64\v4.0. 30319\WPF\WPFFontCache_v0400.exe [2010-03-18 1020768]
R4 KR10I64;KR10I64;c:\windows\system32\drivers\kr10i6 4.sys [2006-11-09 248320]
R4 KR10N64;KR10N64;c:\windows\system32\drivers\kr10n6 4.sys [2006-11-09 237568]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboo t64.sys [2008-06-19 33792]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore64.sys [2010-11-25 257232]
S0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS64.sys [2010-06-29 452872]
S0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA64.sy s [2010-07-16 816016]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [2008-01-21 531968]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2010-11-06 135336]
S2 atashost;WebEx Service Host for Support Center;c:\windows\SysWOW64\atashost.exe [2009-02-17 20376]
S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2007-12-25 40960]
S2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [2007-12-04 175104]
S3 CnxtHdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service;c:\windows\system32\drivers\CHDART64.sys [2008-02-01 222720]
S3 NETw4v64;Intel(R) Wireless WiFi Link Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\NETw4v64.sys [2007-09-26 3196416]
S3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2mdx6 4.sys [2008-01-15 58328]
S3 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sdx6 4.sys [2008-01-09 51544]
S3 PTDUBus;PANTECH UM175 Composite Device Driver ;c:\windows\system32\DRIVERS\PTDUBus.sys [2009-08-12 70672]
S3 PTDUMdm;PANTECH UM175 Drivers;c:\windows\system32\DRIVERS\PTDUMdm.sys [2009-08-12 173456]
S3 PTDUVsp;PANTECH UM175 Diagnostic Port;c:\windows\system32\DRIVERS\PTDUVsp.sys [2009-08-12 173456]
S3 PTDUWFLT;PTDUWWAN Filter Driver;c:\windows\system32\DRIVERS\PTDUWFLT.sys [2009-08-12 12688]
S3 PTDUWWAN;PANTECH UM175 WWAN Driver;c:\windows\system32\DRIVERS\PTDUWWAN.sys [2009-08-12 141840]
S3 QIOMem;Generic IO & Memory Access;c:\windows\system32\DRIVERS\QIOMem.sys [2007-04-10 9728]
S3 yukonx64;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk60x64.sys [2007-12-28 391680]

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\ windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2011-02-07 c:\windows\Tasks\AWC Startup.job
- c:\program files (x86)\IObit\Advanced SystemCare 3\AWC.exe [2009-07-04 22:19]

2011-02-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4275440598-3698797053-1848500140-1000Core.job
- c:\users\Devorah\AppData\Local\Google\Update\Googl eUpdate.exe [2008-12-04 01:51]

2011-02-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4275440598-3698797053-1848500140-1000UA.job
- c:\users\Devorah\AppData\Local\Google\Update\Googl eUpdate.exe [2008-12-04 01:51]
.

--------- x86-64 -----------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"combofix"="c:\combofix\CF20168.cfxxe" [X]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-10-24 178712]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-11-30 1216808]
"TPwrMain"="%ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE" [BU]
"HSON"="%ProgramFiles%\TOSHIBA\TBS\HSON.exe" [BU]
"SmoothView"="%ProgramFiles%\Toshiba\SmoothView\Sm oothView.exe" [BU]
"00TCrdMain"="%ProgramFiles%\TOSHIBA\FlashCards\TC rdMain.exe" [BU]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.toshibadirect.com/dpdstart
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Download with mediAvatar YouTube Video Converter - c:\program files (x86)\mediAvatar\YouTube Video Converter\upod_link.HTM
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll
Trusted Zone: intuit.com\ttlc
FF - ProfilePath - c:\users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Web Developer: {c45c406e-ab73-11d8-be73-000a95be3b12} - %profile%\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: FireFTP: {a7c6cf7f-112c-4500-a7ea-39801a327e5f} - %profile%\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
FF - Ext: Hebrew Calendar: {C4A22BA1-6D61-45F1-82A9-140FD33F1110} - %profile%\extensions\{C4A22BA1-6D61-45F1-82A9-140FD33F1110}
FF - Ext: SearchStatus: {d57c9ff1-6389-48fc-b770-f78bd89b6e8a} - %profile%\extensions\{d57c9ff1-6389-48fc-b770-f78bd89b6e8a}
FF - Ext: Expression Web Toolbar: {29956a1f-dda2-4319-a8cc-30966adea17a} - %profile%\extensions\{29956a1f-dda2-4319-a8cc-30966adea17a}
FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.co m
FF - Ext: Omnibar: omnibar@ajitk.com - %profile%\extensions\omnibar@ajitk.com
FF - Ext: SEO Doctor: seodoctor@prelovac.com - %profile%\extensions\seodoctor@prelovac.com
FF - Ext: Page Speed: {e3f6c2cc-d8db-498c-af6c-499fb211db97} - %profile%\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}
FF - Ext: Html Validator: {3b56bcc7-54e5-44a2-9b44-66c3ef58c13e} - %profile%\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}
FF - Ext: YSlow: yslow@yahoo-inc.com - %profile%\extensions\yslow@yahoo-inc.com
FF - Ext: WCAG Contrast checker: colorchecker@colorcheckerniquelao.net - %profile%\extensions\colorchecker@colorcheckerniqu elao.net
FF - Ext: View Source Chart: {68836a21-fc7d-4ea1-a065-7efabd99d414} - %profile%\extensions\{68836a21-fc7d-4ea1-a065-7efabd99d414}
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{31C7D459-9CC3-44F2-9DCA-FC11795309B4} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Cl ass\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files (x86)\O2Micro Flash Memory Card Driver\o2flash.exe
c:\toshiba\IVP\ISM\pinger.exe
c:\program files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\toshiba\IVP\swupdate\swupdtmr.exe
c:\program files (x86)\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
c:\program files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe
.
************************************************** ************************
.
Completion time: 2011-02-07 11

03 - machine was rebooted
ComboFix-quarantined-files.txt 2011-02-07 17:21
ComboFix2.txt 2011-02-07 14:52

Pre-Run: 104,317,730,816 bytes free
Post-Run: 103,735,328,768 bytes free

- - End Of File - - 357CA75C4960CE83C549C1AA590ECEBB

**broni** · 07-02-2011

Good

How is computer doing?

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click the Scan All Users checkbox.
Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

**Dev** · 07-02-2011

Computer seems to be doing ok, new logs below. I noticed that the win scan icon is still on my desktop and in my start--->all programs section. Previously, when I would delete it from my desktop it would come back at boot up. Should I try deleting it again?

PS: I have tried to post the two logs together here but I keep getting an error. Will try posting in different windows and see if that works.

======================

OTL logfile created on: 2/7/2011 11:54:14 AM - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\Devorah\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18999)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 62.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 184.84 Gb Total Space | 96.65 Gb Free Space | 52.29% Space Free | Partition Type: NTFS
Drive D: | 186.31 Gb Total Space | 186.27 Gb Free Space | 99.98% Space Free | Partition Type: NTFS

Computer Name: DEVORAH-PC | User Name: Devorah | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/02/07 11:50:24 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Devorah\Desktop\OTL.exe
PRC - [2010/12/16 16:19:34 | 002,402,512 | ---- | M] (IObit) -- C:\Program Files (x86)\IObit\Advanced SystemCare 3\AWC.exe
PRC - [2010/12/08 06:51:27 | 000,267,944 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2010/11/05 18:29:52 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010/11/05 18:29:52 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2010/10/16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/06/02 18:50:58 | 001,144,104 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
PRC - [2009/11/19 19:17:50 | 003,925,272 | ---- | M] (Smith Micro Software, Inc.) -- C:\Program Files (x86)\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe
PRC - [2009/09/29 08:17:50 | 000,013,088 | ---- | M] (Intuit Inc.) -- C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe
PRC - [2009/02/16 18:08:44 | 000,020,376 | ---- | M] (WebEx Communications, Inc.) -- C:\Windows\SysWOW64\atashost.exe
PRC - [2008/01/21 17:54:46 | 000,083,312 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files (x86)\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
PRC - [2007/12/25 15:07:14 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files (x86)\Toshiba\ConfigFree\CFSvcs.exe
PRC - [2007/10/24 11:02:16 | 000,358,936 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2007/10/24 11:02:14 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2007/10/23 18:27:16 | 000,066,928 | ---- | M] () -- c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
PRC - [2007/02/12 18:43:44 | 000,065,536 | ---- | M] (O2Micro International) -- C:\Program Files (x86)\O2Micro Flash Memory Card Driver\o2flash.exe
PRC - [2007/01/25 20:47:50 | 000,136,816 | ---- | M] () -- C:\TOSHIBA\IVP\ISM\pinger.exe
PRC - [2006/08/23 18:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

========== Modules (SafeList) ==========

MOD - [2011/02/07 11:50:24 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Devorah\Desktop\OTL.exe
MOD - [2010/08/31 09:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb7 2f2a088b0ed3\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2008/01/20 20:47:32 | 000,383,544 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2008/01/17 18:29:48 | 000,434,016 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV:64bit: - [2008/01/09 22:58:26 | 000,830,464 | ---- | M] (ATI Technologies Inc.) [Auto | Running] -- C:\Windows\SysNative\Ati2evxx.exe -- (Ati External Event Utility)
SRV:64bit: - [2007/12/03 19:04:48 | 000,175,104 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe -- (TOSHIBA SMART Log Service)
SRV:64bit: - [2007/11/21 18:53:16 | 000,135,168 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)
SRV:64bit: - [2007/10/08 15:59:06 | 001,334,784 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe -- (EvtEng)
SRV:64bit: - [2007/10/08 15:28:44 | 000,856,576 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe -- (RegSrvc)
SRV - [2010/12/08 06:51:27 | 000,267,944 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010/11/19 06:57:14 | 001,150,936 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Tools Security\pctsSvc.exe -- (sdCoreService)
SRV - [2010/11/05 18:29:52 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/10/16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/04/21 11:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010/04/21 11:46:17 | 000,373,760 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msco rsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/15 14:02:36 | 000,366,840 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Tools Security\pctsAuxs.exe -- (sdAuxService)
SRV - [2009/09/29 08:17:50 | 000,013,088 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)
SRV - [2009/04/11 00:28:17 | 000,052,224 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2009/03/29 22:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\msco rsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/02/16 18:08:44 | 000,020,376 | ---- | M] (WebEx Communications, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\atashost.exe -- (atashost)
SRV - [2008/01/21 17:54:46 | 000,083,312 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files (x86)\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe -- (TNaviSrv)
SRV - [2007/12/25 15:07:14 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)
SRV - [2007/10/24 11:02:16 | 000,358,936 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2007/10/23 18:27:16 | 000,066,928 | ---- | M] () [Auto | Running] -- c:\TOSHIBA\IVP\swupdate\swupdtmr.exe -- (Swupdtmr)
SRV - [2007/09/28 18:06:42 | 000,168,296 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
SRV - [2007/09/24 19:38:00 | 000,181,784 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2007/03/13 02:23:18 | 000,225,280 | ---- | M] (Hewlett-Packard Co.) [On_Demand | Running] -- C:\Program Files (x86)\Hewlett-Packard\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08)
SRV - [2007/03/13 02:23:18 | 000,131,072 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\Digital Imaging\bin\hpqddsvc.dll -- (hpqddsvc)
SRV - [2007/02/12 18:43:44 | 000,065,536 | ---- | M] (O2Micro International) [Auto | Running] -- C:\Program Files (x86)\O2Micro Flash Memory Card Driver\o2flash.exe -- (o2flash)
SRV - [2007/01/25 20:47:50 | 000,136,816 | ---- | M] () [Auto | Running] -- C:\TOSHIBA\IVP\ISM\pinger.exe -- (pinger)
SRV - [2006/08/23 18:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2010/11/25 10:43:26 | 000,257,232 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PCTCore64.sys -- (PCTCore)
DRV:64bit: - [2010/11/24 05:45:31 | 000,083,120 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\DRIVERS\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2010/09/28 15:44:52 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2010/07/16 14:53:32 | 000,816,016 | ---- | M] (PC Tools) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\pctEFA64.sys -- (pctEFA)
DRV:64bit: - [2010/06/29 10:35:34 | 000,452,872 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\pctDS64.sys -- (pctDS)
DRV:64bit: - [2010/03/02 12:35:01 | 000,116,568 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\avipbb.sys -- (avipbb)
DRV:64bit: - [2010/02/07 07:37:16 | 000,053,312 | ---- | M] (microOLAP Technologies LTD) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\pssdk42.sys -- (PSSDK42)
DRV:64bit: - [2009/09/30 18:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:64bit: - [2009/08/12 05:14:16 | 000,173,456 | ---- | M] (DEVGURU Co., LTD.(DEVGURU¸¦ Ã£¾ÆÁÖ¼Å¼* °¨»çÇÕ´Ï´Ù.)) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\PTDUMdm.sys -- (PTDUMdm)
DRV:64bit: - [2009/08/12 05:14:16 | 000,141,840 | ---- | M] (DEVGURU Co., LTD.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\PTDUWWAN.sys -- (PTDUWWAN)
DRV:64bit: - [2009/08/12 05:14:16 | 000,070,672 | ---- | M] (DEVGURU Co., LTD.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\PTDUBus.sys -- (PTDUBus)
DRV:64bit: - [2009/08/12 05:14:16 | 000,012,688 | ---- | M] (DEVGURU Co., LTD.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\PTDUWFLT.sys -- (PTDUWFLT)
DRV:64bit: - [2009/08/12 05:14:12 | 000,173,456 | ---- | M] (DEVGURU Co., LTD.(DEVGURU¸¦ Ã£¾ÆÁÖ¼Å¼* °¨»çÇÕ´Ï´Ù.)) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\PTDUVsp.sys -- (PTDUVsp)
DRV:64bit: - [2009/05/26 15:55:54 | 000,014,336 | ---- | M] (Primax Electronics Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\HpGmb001.SYS -- (HpGmb001)
DRV:64bit: - [2009/05/18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2008/12/04 18:18:50 | 000,082,816 | ---- | M] (VSO Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\pcouffin.sys -- (pcouffin)
DRV:64bit: - [2008/06/27 23:38:05 | 000,030,208 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\AegisP.sys -- (AegisP) AEGIS Protocol (IEEE 802.1x)
DRV:64bit: - [2008/06/19 16:24:32 | 000,033,792 | ---- | M] (Panda Security, S.L.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\pavboot64.sys -- (pavboot)
DRV:64bit: - [2008/02/01 12:46:54 | 000,222,720 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDART64.sys -- (CnxtHdAudAddService)
DRV:64bit: - [2008/01/21 16:42:26 | 000,531,968 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\tos_sps64.sys -- (tos_sps64)
DRV:64bit: - [2008/01/20 20:46:55 | 000,111,104 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\DRIVERS\sdbus.sys -- (sdbus)
DRV:64bit: - [2008/01/15 12:35:34 | 000,058,328 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\o2mdx64.sys -- (O2MDRDR)
DRV:64bit: - [2008/01/10 01:44:54 | 004,168,192 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2008/01/08 19:40:52 | 000,051,544 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\o2sdx64.sys -- (O2SDRDR)
DRV:64bit: - [2007/12/28 12:51:00 | 000,391,680 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\yk60x64.sys -- (yukonx64)
DRV:64bit: - [2007/12/20 17:10:50 | 000,028,200 | ---- | M] (Chicony Electronics Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\UVCFTR_S.SYS -- (UVCFTR)
DRV:64bit: - [2007/11/29 18:58:58 | 000,320,048 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\SynTP.sys -- (SynTP)
DRV:64bit: - [2007/11/09 16:00:30 | 000,026,968 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\TVALZ_O.SYS -- (TVALZ)
DRV:64bit: - [2007/09/30 00:03:32 | 000,384,024 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\iaStor.sys -- (iaStor)
DRV:64bit: - [2007/09/26 07:19:08 | 003,196,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\NETw4v64.sys -- (NETw4v64) Intel(R)
DRV:64bit: - [2007/04/09 18:15:44 | 000,009,728 | ---- | M] (TOSHIBA) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\QIOMem.sys -- (QIOMem)
DRV:64bit: - [2006/11/09 15:34:42 | 000,237,568 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\kr10n64.sys -- (KR10N64)
DRV:64bit: - [2006/11/09 15:33:44 | 000,248,320 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\kr10i64.sys -- (KR10I64)
DRV:64bit: - [2006/10/23 18:33:08 | 000,018,944 | ---- | M] (TOSHIBA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\DRIVERS\tosrfec.sys -- (tosrfec)
DRV:64bit: - [2006/10/19 14:10:40 | 000,027,456 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\tdcmdpst.sys -- (tdcmdpst)
DRV:64bit: - [2006/10/04 20:13:38 | 000,585,216 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\athrx.sys -- (athr)
DRV:64bit: - [2006/09/18 15:36:24 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV - [2010/01/05 07

06 | 000,007,408 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)
DRV - [2010/01/05 07

04 | 000,009,968 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] -- C:\Program Files (x86)\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2010/01/05 07

02 | 000,074,480 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] -- C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2009/05/25 15:43:58 | 000,043,032 | ---- | M] (Smith Micro Inc.) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Verizon Wireless\VZAccess Manager\SMSIVZAM5X64.sys -- (SMSIVZAM5X64)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {31c7d459-9cc3-44f2-9dca-fc11795309b4} - C:\Program Files (x86)\IObitCom\tbIObi.dll (Conduit Ltd.)

IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVer sion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Inter net Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-4275440598-3698797053-1848500140-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Home - Welcome to Toshiba
IE - HKU\S-1-5-21-4275440598-3698797053-1848500140-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-4275440598-3698797053-1848500140-1000\..\URLSearchHook: {31c7d459-9cc3-44f2-9dca-fc11795309b4} - C:\Program Files (x86)\IObitCom\tbIObi.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-4275440598-3698797053-1848500140-1000\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-4275440598-3698797053-1848500140-1000\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892 B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009/05/29 17:36:44 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5 b-e555-4543-90e2-c3908898db71}: C:\Program Files (x86)\AVG\AVGLS9\Firefox
FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igea red: C:\Program Files (x86)\AVG\AVGLS9\Toolbar\Firefox\avg@igeared
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.8\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/12/11 20:20:35 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.8\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/12/11 20:20:35 | 000,000,000 | ---D | M]

[2010/02/07 09:16:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Extension s
[2010/02/07 09:16:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Extension s\{ee53ece0-255c-4cc6-8a7e-81a8b6e5ba2c}
[2011/02/06 08:14:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions
[2010/04/06 05:55:35 | 000,000,000 | ---D | M] (Screengrab) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2010/05/01 11:34:35 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/11/20 08:45:31 | 000,000,000 | ---D | M] (Expression Web Toolbar) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{29956a1f-dda2-4319-a8cc-30966adea17a}
[2011/01/12 18:19:16 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/11/20 08:46:01 | 000,000,000 | ---D | M] (SeoQuake) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74}
[2010/05/29 07:41:23 | 000,000,000 | ---D | M] (Html Validator) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}
[2010/04/06 05:55:34 | 000,000,000 | ---D | M] (ScrapBook) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{53A03D43-5363-4669-8190-99061B2DEBA5}
[2011/01/24 16:46:37 | 000,000,000 | ---D | M] (View Source Chart) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{68836a21-fc7d-4ea1-a065-7efabd99d414}
[2009/10/10 19:43:51 | 000,000,000 | ---D | M] (OperaView) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{87f54a61-c9b3-4138-a38a-33c31770bb9e}
[2008/12/06 20:45:32 | 000,000,000 | ---D | M] ("TinyUrl Creator") -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{89736E8E-4B14-4042-8C75-AD00B6BD3900}
[2009/11/04 18:32:39 | 000,000,000 | ---D | M] (BugMeNot) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{987311C6-B504-4aa2-90BF-60CC49808D42}
[2011/01/07 08:13:14 | 000,000,000 | ---D | M] (FireFTP) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
[2010/11/20 08:45:30 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/01/07 08:13:16 | 000,000,000 | ---D | M] (Web Developer) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
[2010/11/20 08:45:36 | 000,000,000 | ---D | M] (Hebrew Calendar) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{C4A22BA1-6D61-45F1-82A9-140FD33F1110}
[2010/11/20 08:45:55 | 000,000,000 | ---D | M] ("SearchStatus") -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{d57c9ff1-6389-48fc-b770-f78bd89b6e8a}
[2010/11/20 08:45:24 | 000,000,000 | ---D | M] ("BitDefender QuickScan") -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2011/01/07 08:13:05 | 000,000,000 | ---D | M] (Page Speed) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}
[2009/12/19 17:38:45 | 000,000,000 | ---D | M] ("KeywordSpyâ„¢ SEO/PPC") -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\{fae5bcbc-dd73-439a-a15e-5b9ff39c0e9b}
[2010/04/06 05:55:12 | 000,000,000 | ---D | M] (Aardvark) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\aardvark@rob.b rown
[2011/01/08 13:43:40 | 000,000,000 | ---D | M] (WCAG Contrast checker) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\colorchecker@c olorcheckerniquelao.net
[2011/01/07 08:12:54 | 000,000,000 | ---D | M] (Firebug) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\firebug@softwa re.joehewitt.com
[2011/01/07 08:13:15 | 000,000,000 | ---D | M] (Zemanta) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\firefox@zemant a.com
[2011/01/07 08:13:06 | 000,000,000 | ---D | M] (Foxy SEO Tool) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\foxyseotool@fo xyseotool.com
[2008/12/06 20:45:32 | 000,000,000 | ---D | M] (How-To Video Sidebar) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\howtovideoside bar@wonderhowto.com
[2011/01/07 08:13:06 | 000,000,000 | ---D | M] ("KGen") -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\kgen@elitwork. com
[2010/11/20 08:45:43 | 000,000,000 | ---D | M] ("NetVideoHunter") -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\netvideohunter @netvideohunter.com
[2010/11/20 08:45:45 | 000,000,000 | ---D | M] (Omnibar) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\omnibar@ajitk. com
[2010/11/20 08:45:28 | 000,000,000 | ---D | M] (Cooliris) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\piclens@coolir is.com
[2010/11/20 08:45:55 | 000,000,000 | ---D | M] (SEO Doctor) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\seodoctor@prel ovac.com
[2011/01/07 08:13:13 | 000,000,000 | ---D | M] (KwiClick) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\vinceturk@gmai l.com
[2010/12/09 13:25:09 | 000,000,000 | ---D | M] (YSlow) -- C:\Users\Devorah\AppData\Roaming\Mozilla\Firefox\P rofiles\1nrbjd4v.default\extensions\yslow@yahoo-inc.com
[2010/01/04 20:45:35 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

O1 HOSTS File: ([2006/09/18 15:37:24 | 000,000,736 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: ::1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (IObitCom Toolbar) - {31c7d459-9cc3-44f2-9dca-fc11795309b4} - C:\Program Files (x86)\IObitCom\tbIObi.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-4275440598-3698797053-1848500140-1000\..\Toolbar\Explorer: (no name) - {D8168918-45A1-4514-A2DB-2263A6C58D44} - No CLSID value found.
O3 - HKU\S-1-5-21-4275440598-3698797053-1848500140-1000\..\Toolbar\ShellBrowser: (no name) - {D8168918-45A1-4514-A2DB-2263A6C58D44} - No CLSID value found.
O3 - HKU\S-1-5-21-4275440598-3698797053-1848500140-1000\..\Toolbar\WebBrowser: (IObitCom Toolbar) - {31C7D459-9CC3-44F2-9DCA-FC11795309B4} - C:\Program Files (x86)\IObitCom\tbIObi.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [00TCrdMain] C:\Program Files\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [HSON] C:\Program Files\Toshiba\TBS\HSON.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [SmoothView] C:\Program Files\Toshiba\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Conime] C:\Windows\SysWOW64\conime.exe (Microsoft Corporation)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-4275440598-3698797053-1848500140-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-4275440598-3698797053-1848500140-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Download with mediAvatar YouTube Video Converter - C:\Program Files (x86)\mediAvatar\YouTube Video Converter\upod_link.HTM ()
O8 - Extra context menu item: Download with mediAvatar YouTube Video Converter - C:\Program Files (x86)\mediAvatar\YouTube Video Converter\upod_link.HTM ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O15 - HKU\S-1-5-21-4275440598-3698797053-1848500140-1000\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/downlo...OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Value error.)
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\toshiba_1920x1200-1.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\toshiba_1920x1200-1.jpg
O28:64bit: - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files (x86)\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.dvacm - C:\Program Files (x86)\Common Files\Ulead Systems\vio\DVACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/02/07 11:50:23 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\Devorah\Desktop\OTL.exe
[2011/02/07 11

05 | 000,000,000 | ---D | C] -- C:\Users\Devorah\AppData\Local\temp
[2011/02/07 11:12:21 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2011/02/07 10

32 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2011/02/07 08:35:50 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/02/07 08:35:50 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/02/07 08:35:50 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/02/07 08:35:45 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/02/07 07:59:58 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/02/07 07:00:48 | 006,022,408 | ---- | C] (OPSWAT, Inc.) -- C:\Users\Devorah\Desktop\AppRemover.exe
[2011/02/06 18:58:05 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Users\Devorah\Desktop\TFC.exe
[2011/02/06 17:19:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011/02/06 14:08:52 | 000,156,672 | ---- | C] (Bflix) -- C:\Users\Devorah\Desktop\VLCInstaller.exe
[2011/02/04 18

07 | 000,000,000 | ---D | C] -- C:\Users\Devorah\Desktop\2-4-2011
[2011/02/01 17:33:38 | 000,000,000 | ---D | C] -- C:\Users\Devorah\Desktop\To fix Problems
[2011/01/30 14:50:54 | 000,000,000 | ---D | C] -- C:\ProgramData\SafeReturner
[2011/01/30 06:49:16 | 000,816,016 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\pctEFA64.sys
[2011/01/30 06:49:16 | 000,452,872 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\pctDS64.sys
[2011/01/30 06:49:15 | 000,331,368 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\pctgntdi64.sys
[2011/01/30 06:49:15 | 000,136,168 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\pctwfpfilter64.sys
[2011/01/30 06:49:12 | 000,257,232 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\PCTCore64.sys
[2011/01/30 06:49:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Tools Security
[2011/01/30 06:49:01 | 000,092,896 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\pctplsg64.sys
[2011/01/30 06:48:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PC Tools
[2011/01/30 06:48:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PC Tools Security
[2011/01/30 06:48:44 | 000,000,000 | ---D | C] -- C:\Users\Devorah\AppData\Roaming\PC Tools
[2011/01/30 06:38:34 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2011/01/30 06:22:37 | 000,000,000 | ---D | C] -- C:\Users\Devorah\AppData\Roaming\Microsoft\Windows \Start Menu\Programs\Win Scan
[2011/01/27 05:38:11 | 000,000,000 | ---D | C] -- C:\Users\Devorah\Documents\DVDFab
[2011/01/27 05:38:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDFab 8
[2011/01/27 05:37:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDFab 8
[2011/01/23 19:57:50 | 000,000,000 | ---D | C] -- C:\Users\Devorah\AppData\Roaming\Engelmann Media
[2011/01/23 19:57:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\HDX4
[2011/01/23 19:57:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Engelmann Media
[2011/01/23 19:57:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Engelmann Media
[2011/01/21 06:08:29 | 000,000,000 | ---D | C] -- C:\Users\Devorah\AppData\Roaming\ArcticLine
[2011/01/21 06:08:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Folder Marker
[2011/01/21 06:08:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Folder Marker
[2011/01/13 18:05:39 | 000,000,000 | ---D | C] -- C:\ProgramData\ProcessLasso
[2011/01/13 18:05:16 | 000,000,000 | ---D | C] -- C:\Users\Devorah\AppData\Roaming\Microsoft\Windows \Start Menu\Programs\Process Lasso
[2011/01/13 18:05:11 | 000,000,000 | ---D | C] -- C:\Users\Devorah\AppData\Roaming\ProcessLasso
[2011/01/13 18:05:11 | 000,000,000 | ---D | C] -- C:\Program Files\Process Lasso
[2011/01/11 07:48:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inpaint
[2011/01/11 07:48:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Inpaint
[2011/01/09 08:25:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vectorian Giotto
[2011/01/09 08:25:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Vectorian Inc
[2008/12/04 18:18:50 | 000,082,816 | ---- | C] (VSO Software) -- C:\Users\Devorah\AppData\Roaming\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2011/02/07 11:57:04 | 000,000,916 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4275440598-3698797053-1848500140-1000UA.job
[2011/02/07 11:50:24 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Devorah\Desktop\OTL.exe
[2011/02/07 11:11:52 | 000,000,398 | ---- | M] () -- C:\Windows\tasks\AWC Startup.job
[2011/02/07 11:11:41 | 000,003,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/02/07 11:11:41 | 000,003,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/02/07 11:11:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/02/07 07:38:59 | 004,264,433 | R--- | M] () -- C:\Users\Devorah\Desktop\ComboFix.exe
[2011/02/07 07:01:32 | 006,022,408 | ---- | M] (OPSWAT, Inc.) -- C:\Users\Devorah\Desktop\AppRemover.exe
[2011/02/07 06:57:00 | 000,000,864 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4275440598-3698797053-1848500140-1000Core.job
[2011/02/06 20:29:07 | 000,624,128 | ---- | M] () -- C:\Users\Devorah\Desktop\dds.scr
[2011/02/06 20:26:36 | 000,080,384 | ---- | M] () -- C:\Users\Devorah\Desktop\MBRCheck.exe
[2011/02/06 19:30:53 | 000,296,448 | ---- | M] () -- C:\Users\Devorah\Desktop\qvywtozv.exe
[2011/02/06 18:57:57 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Devorah\Desktop\TFC.exe
[2011/02/06 17:19:19 | 000,001,108 | ---- | M] () -- C:\Users\Devorah\Desktop\Spybot - Search & Destroy.lnk
[2011/02/06 15:10:18 | 000,000,838 | ---- | M] () -- C:\Users\Public\Desktop\Safe Returner.lnk
[2011/02/06 15:10:18 | 000,000,818 | ---- | M] () -- C:\Users\Public\Desktop\Kill Rogue Process.lnk
[2011/02/06 14:08:42 | 000,156,672 | ---- | M] (Bflix) -- C:\Users\Devorah\Desktop\VLCInstaller.exe
[2011/02/05 17:50:26 | 000,033,034 | ---- | M] () -- C:\Users\Devorah\Desktop\nanasgrandmother18.jpg
[2011/02/05 13

45 | 000,892,622 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011/02/05 13

45 | 000,739,900 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011/02/05 13

45 | 000,153,644 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011/02/03 18:31:11 | 000,103,506 | ---- | M] () -- C:\Users\Devorah\Desktop\simcha_large.jpg
[2011/02/02 05:37:49 | 000,002,838 | ---- | M] () -- C:\Windows\machine.ver
[2011/01/30 14:26:19 | 000,000,272 | ---- | M] () -- C:\ProgramData\~oWDItIqY
[2011/01/30 14:26:19 | 000,000,160 | ---- | M] () -- C:\ProgramData\~oWDItIqYr
[2011/01/30 06:49:34 | 002,604,634 | ---- | M] () -- C:\Windows\SysNative\drivers\Cat.DB
[2011/01/30 06:49:11 | 000,001,851 | ---- | M] () -- C:\Users\Public\Desktop\Spyware Doctor.lnk
[2011/01/30 06:28:51 | 000,000,384 | ---- | M] () -- C:\ProgramData\oWDItIqY
[2011/01/30 06:22:41 | 000,000,578 | ---- | M] () -- C:\Users\Devorah\Desktop\Win Scan.lnk
[2011/01/26 09:16:48 | 000,002,620 | ---- | M] () -- C:\Users\Devorah\AppData\Roaming\wklnhst.dat
[2011/01/25 20:58:06 | 000,012,896 | ---- | M] () -- C:\Users\Devorah\Desktop\safe_image.php
[2011/01/25 17:51:21 | 000,002,460 | ---- | M] () -- C:\Users\Devorah\Desktop\silver-magen.jpg
[2011/01/23 19:57:50 | 000,001,125 | ---- | M] () -- C:\Users\Public\Desktop\SimplyGoodPictures.lnk
[2011/01/21 12:30:06 | 000,311,296 | ---- | M] () -- C:\Windows\SysWow64\EMRegSys.dll
[2011/01/18 11

18 | 000,010,752 | ---- | M] () -- C:\Users\Devorah\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/16 06:35:26 | 000,591,192 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2011/02/07 08:35:50 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011/02/07 08:35:50 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/02/07 08:35:50 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
[2011/02/07 08:35:50 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/02/07 08:35:50 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/02/07 07:38:30 | 004,264,433 | R--- | C] () -- C:\Users\Devorah\Desktop\ComboFix.exe
[2011/02/06 20:29:01 | 000,624,128 | ---- | C] () -- C:\Users\Devorah\Desktop\dds.scr
[2011/02/06 20:26:41 | 000,080,384 | ---- | C] () -- C:\Users\Devorah\Desktop\MBRCheck.exe
[2011/02/06 19:31:02 | 000,296,448 | ---- | C] () -- C:\Users\Devorah\Desktop\qvywtozv.exe
[2011/02/06 17:19:19 | 000,001,108 | ---- | C] () -- C:\Users\Devorah\Desktop\Spybot - Search & Destroy.lnk
[2011/02/06 14:59:11 | 000,000,838 | ---- | C] () -- C:\Users\Public\Desktop\Safe Returner.lnk
[2011/02/06 14:59:11 | 000,000,818 | ---- | C] () -- C:\Users\Public\Desktop\Kill Rogue Process.lnk
[2011/02/05 17:50:26 | 000,033,034 | ---- | C] () -- C:\Users\Devorah\Desktop\nanasgrandmother18.jpg
[2011/02/03 18:31:11 | 000,103,506 | ---- | C] () -- C:\Users\Devorah\Desktop\simcha_large.jpg
[2011/01/30 06:49:16 | 002,604,634 | ---- | C] () -- C:\Windows\SysNative\drivers\Cat.DB
[2011/01/30 06:49:11 | 000,001,851 | ---- | C] () -- C:\Users\Public\Desktop\Spyware Doctor.lnk
[2011/01/30 06:48:46 | 000,427,238 | ---- | C] () -- C:\Users\Devorah\AppData\Local\dd_vcredistMSI1FE4. txt
[2011/01/30 06:48:46 | 000,011,486 | ---- | C] () -- C:\Users\Devorah\AppData\Local\dd_vcredistUI1FE4.t xt
[2011/01/30 06:48:46 | 000,010,642 | ---- | C] () -- C:\Users\Devorah\AppData\Local\dd_vcredistUI1FE5.t xt
[2011/01/30 06:26:40 | 000,000,160 | ---- | C] () -- C:\ProgramData\~oWDItIqYr
[2011/01/30 06:26:39 | 000,000,272 | ---- | C] () -- C:\ProgramData\~oWDItIqY
[2011/01/30 06:22:41 | 000,000,578 | ---- | C] () -- C:\Users\Devorah\Desktop\Win Scan.lnk
[2011/01/30 06:22:33 | 000,000,384 | ---- | C] () -- C:\ProgramData\oWDItIqY
[2011/01/25 20:58:19 | 000,012,896 | ---- | C] () -- C:\Users\Devorah\Desktop\safe_image.php
[2011/01/25 17:51:33 | 000,002,460 | ---- | C] () -- C:\Users\Devorah\Desktop\silver-magen.jpg
[2011/01/23 19:57:50 | 000,001,125 | ---- | C] () -- C:\Users\Public\Desktop\SimplyGoodPictures.lnk
[2011/01/21 12:30:06 | 000,311,296 | ---- | C] () -- C:\Windows\SysWow64\EMRegSys.dll
[2010/09/25 04:34:19 | 000,419,052 | ---- | C] () -- C:\Users\Devorah\AppData\Local\dd_vcredistMSI7619. txt
[2010/09/25 04:34:19 | 000,011,896 | ---- | C] () -- C:\Users\Devorah\AppData\Local\dd_vcredistUI7619.t xt
[2010/09/22 03:55:40 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\ZLIB.DLL
[2010/08/08 06:47:04 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\lame_enc.dll
[2010/05/07 14:03:47 | 000,417,634 | ---- | C] () -- C:\Users\Devorah\AppData\Local\dd_vcredistMSI2133. txt
[2010/05/07 14:03:47 | 000,011,686 | ---- | C] () -- C:\Users\Devorah\AppData\Local\dd_vcredistUI2133.t xt
[2010/03/16 16:59:12 | 000,000,183 | ---- | C] () -- C:\Users\Devorah\AppData\Local\LaunchHomeCenter.lo g
[2010/03/16 16:04:34 | 000,129,432 | ---- | C] () -- C:\Users\Devorah\AppData\Local\installer.log
[2010/03/16 11:52:26 | 000,025,384 | ---- | C] () -- C:\Windows\maxlink.ini
[2010/03/16 11:52:26 | 000,000,020 | ---- | C] () -- C:\Windows\calera.ini
[2010/03/16 11:52:19 | 000,269,312 | ---- | C] () -- C:\Windows\SysWow64\FPXIG.DLL
[2010/03/16 11:52:19 | 000,068,096 | ---- | C] () -- C:\Windows\SysWow64\IGFPX32P.DLL
[2010/03/16 11:52:19 | 000,065,024 | ---- | C] () -- C:\Windows\SysWow64\JPEGACC.DLL
[2010/03/16 11:51:53 | 000,101,376 | ---- | C] () -- C:\Windows\SysWow64\WELSOF32.DLL
[2010/02/16 13:32:36 | 000,404,972 | ---- | C] () -- C:\Users\Devorah\AppData\Local\dd_vcredistMSI1EB2. txt
[2010/02/16 13:32:36 | 000,011,372 | ---- | C] () -- C:\Users\Devorah\AppData\Local\dd_vcredistUI1EB2.t xt
[2010/02/05 19:01:01 | 000,024,226 | ---- | C] () -- C:\Users\Devorah\AppData\Roaming\UserTile.png
[2010/01/14 16:57:12 | 000,000,036 | ---- | C] () -- C:\Users\Devorah\AppData\Local\housecall.guid.cach e
[2009/12/22 06:17:24 | 000,000,040 | ---- | C] () -- C:\Users\Devorah\AppData\Roaming\cdr.ini
[2009/11/17 07:58:26 | 000,000,170 | ---- | C] () -- C:\Windows\MyHeritage.INI
[2009/11/17 07:57:21 | 000,454,656 | ---- | C] () -- C:\Windows\SysWow64\PaintX.dll
[2009/11/01 17:43:13 | 000,000,646 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2009/07/23 18:02:28 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2009/07/23 18:01:13 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/02/05 17:49:34 | 000,000,680 | ---- | C] () -- C:\Users\Devorah\AppData\Local\d3d9caps.dat
[2009/02/03 20:16:55 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2009/01/05 16:27:57 | 000,000,012 | ---- | C] () -- C:\Users\Devorah\AppData\Roaming\settings.xml
[2009/01/05 16:27:56 | 000,000,235 | ---- | C] () -- C:\Users\Devorah\AppData\Roaming\devices.xml
[2008/12/19 16:18:58 | 000,002,620 | ---- | C] () -- C:\Users\Devorah\AppData\Roaming\wklnhst.dat
[2008/12/04 19:41:17 | 000,000,067 | ---- | C] () -- C:\Windows\swupdate.INI
[2008/12/04 18:18:50 | 000,007,859 | ---- | C] () -- C:\Users\Devorah\AppData\Roaming\pcouffin.cat
[2008/12/04 18:18:50 | 000,001,167 | ---- | C] () -- C:\Users\Devorah\AppData\Roaming\pcouffin.inf
[2008/12/03 20:37:13 | 001,881,814 | ---- | C] () -- C:\Users\Devorah\AppData\Local\dd_NET_Framework35_ x64_MSI192B.txt
[2008/12/03 20:36:28 | 000,199,883 | ---- | C] () -- C:\Users\Devorah\AppData\Local\dd_depcheck_NETFX_E XP_35.txt
[2008/12/03 20:36:26 | 000,280,694 | ---- | C] () -- C:\Users\Devorah\AppData\Local\dd_dotnetfx35instal l.txt
[2008/12/03 20:36:26 | 000,076,150 | ---- | C] () -- C:\Users\Devorah\AppData\Local\uxeventlog.txt
[2008/12/03 20:36:26 | 000,000,002 | ---- | C] () -- C:\Users\Devorah\AppData\Local\dd_dotnetfx35error. txt
[2008/12/03 19:43:04 | 000,832,402 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2008/12/02 17:57:13 | 000,010,752 | ---- | C] () -- C:\Users\Devorah\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/12/02 16:14:11 | 000,000,013 | RHS- | C] () -- C:\Windows\SysWow64\drivers\fbd.sys
[2008/02/21 15

52 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI
[2008/02/20 18:30:24 | 000,204,800 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeW7.dll
[2008/02/20 18:30:24 | 000,200,704 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeA6.dll
[2008/02/20 18:30:24 | 000,192,512 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeP6.dll
[2008/02/20 18:30:24 | 000,192,512 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeM6.dll
[2008/02/20 18:30:24 | 000,188,416 | ---- | C] () -- C:\Windows\SysWow64\IVIresizePX.dll
[2008/02/20 18:30:24 | 000,020,480 | ---- | C] () -- C:\Windows\SysWow64\IVIresize.dll
[2008/02/04 18:23:10 | 000,693,792 | ---- | C] () -- C:\Windows\SysWow64\OGACheckControl.DLL
[2008/01/20 20:50:05 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2007/12/21 18:46:32 | 000,118,784 | ---- | C] () -- C:\Windows\SysWow64\TosBtAcc.dll
[2005/07/22 23:30:18 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\TosCommAPI.dll

========== LOP Check ==========

[2009/06/09 19:02:10 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\1&1
[2009/07/04 09:44:26 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Ahnenblatt
[2010/09/17 19:10:37 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Amazon
[2011/01/21 06:08:29 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\ArcticLine
[2010/11/26 20:22:44 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Ashampoo
[2010/07/23 13:18:11 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Burn Pro
[2010/12/25 05:47:06 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Burn4U
[2010/12/25 06:02:26 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Byngo
[2010/12/25 05:52:25 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\CodedColor
[2010/06/29 06:08:16 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\DemoCreator
[2009/11/30 16:01:04 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\DeviceDoctorSoftw are
[2008/12/04 16:02:59 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Easy Thumbnails
[2009/09/19 16:22:30 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Efficient Diary
[2011/01/23 19:57:50 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Engelmann Media
[2010/05/25 20:10:09 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\FileZilla
[2010/11/26 20:19:05 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\FlexibleSoft
[2010/12/27 18:47:38 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\gtk-2.0
[2011/01/04 07:12:58 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Image Zone Express
[2009/11/21 08

47 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\IObit
[2010/05/16 11:53:27 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\IrfanView
[2009/11/28 11:00:24 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\KompoZer
[2010/09/22 03

57 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Likno Software
[2010/09/25 04:35:15 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\mediAvatar
[2009/11/17 07:57:27 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\MyHeritage
[2010/02/25 17:28:29 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\NCH Swift Sound
[2009/10/30 16:25:18 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Notepad++
[2008/12/13 15:33:18 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\OLYMPUS
[2009/08/03 13:47:08 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\OpenOffice.org
[2010/06/21 08

42 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\PearlMountainSoft
[2010/12/25 06:00:26 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Pixpedia Publisher
[2009/11/19 15:06:40 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Printer Info Cache
[2011/01/13 18:06:05 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\ProcessLasso
[2010/01/15 08:13:34 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\QuickScan
[2009/07/29 18:57:50 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Qumana
[2010/08/13 05:10:11 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Registry Mechanic
[2009/08/02 08:18:30 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Resort Labs
[2009/07/03 07:33:49 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\saSoftware
[2009/10/17 08:36:31 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Scribus
[2009/10/17 05:31:55 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Serif
[2010/02/04 13:34:54 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Smith Micro
[2010/02/07 09:16:36 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Spicebird
[2010/03/16 17:14:34 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Temp
[2008/12/19 16:19:59 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Template
[2009/11/17 07:57:21 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\The Complete Genealogy Reporter - FTB
[2010/03/16 13:03:41 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\TOSHIBA
[2008/12/04 17:13:57 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Ulead Systems
[2010/11/29 21:02:46 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Virtual Mechanics
[2008/12/04 19:30:38 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Vso
[2008/12/02 17:54:30 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\WildTangent
[2008/12/02 17:53:41 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\WinBatch
[2010/02/03 20:23:57 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Windows Live Writer
[2011/01/07 06

34 | 000,000,000 | ---D | M] -- C:\Users\Devorah\AppData\Roaming\Zoner
[2011/02/07 11:11:52 | 000,000,398 | ---- | M] () -- C:\Windows\Tasks\AWC Startup.job
[2011/02/07 11:10:10 | 000,032,582 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/04/11 00:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2008/02/20 16:41:22 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2011/02/07 11

03 | 000,017,012 | ---- | M] () -- C:\ComboFix.txt
[2010/05/07 17:14:32 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt
[2011/02/07 11:11:24 | 311,934,975 | -HS- | M] () -- C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2006/11/02 09:06:41 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 09:06:41 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 09:06:41 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/09/17 04:40:05 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 15:35:48 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/01/20 21

59 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/05/19 17:37:53 | 000,000,286 | -HS- | M] () -- C:\Users\Devorah\AppData\Roaming\Microsoft\Interne t Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/02/07 07:01:32 | 006,022,408 | ---- | M] (OPSWAT, Inc.) -- C:\Users\Devorah\Desktop\AppRemover.exe
[2011/02/07 07:38:59 | 004,264,433 | R--- | M] () -- C:\Users\Devorah\Desktop\ComboFix.exe
[2011/02/06 20:26:36 | 000,080,384 | ---- | M] () -- C:\Users\Devorah\Desktop\MBRCheck.exe
[2011/02/07 11:50:24 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Devorah\Desktop\OTL.exe
[2011/02/06 19:30:53 | 000,296,448 | ---- | M] () -- C:\Users\Devorah\Desktop\qvywtozv.exe
[2010/10/29 05:48:35 | 000,469,696 | ---- | M] (SpeedyFox) -- C:\Users\Devorah\Desktop\speedyfox.exe
[2010/01/13 12:54:19 | 000,204,496 | ---- | M] (Malwarebytes) -- C:\Users\Devorah\Desktop\StartUpLite.exe
[2011/02/06 18:57:57 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Devorah\Desktop\TFC.exe
[2009/05/15 16:46:34 | 000,393,216 | ---- | M] () -- C:\Users\Devorah\Desktop\Ultimate Windows Tweaker.exe
[2011/02/06 14:08:42 | 000,156,672 | ---- | M] (Bflix) -- C:\Users\Devorah\Desktop\VLCInstaller.exe
[2010/03/10 11:39:46 | 029,253,144 | ---- | M] (Smith Micro Software, Inc.) -- C:\Users\Devorah\Desktop\VZAM_7.2.1_2420b_Pantech_ UM175.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >
[2009/09/17 05:13:26 | 000,008,192 | ---- | M] () -- C:\Windows\security\database\edb.chk
[2009/09/17 05:12:56 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edb.log
[2009/09/17 05:12:56 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edbres00001.jrs
[2009/09/17 05:12:56 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edbres00002.jrs
[2009/09/17 05:12:56 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edbtmp.log
[2009/09/17 05:12:56 | 001,056,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\security\database\tmp.edb

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2008/12/02 16:14:28 | 000,000,402 | -HS- | M] () -- C:\Users\Devorah\Favorites\desktop.ini
[2010/12/18 10:38:28 | 000,000,270 | ---- | M] () -- C:\Users\Devorah\Favorites\NCH Audio and Telephony Software.lnk
[2010/12/18 10:38:28 | 000,000,228 | ---- | M] () -- C:\Users\Devorah\Favorites\NCH Software Download.lnk

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2010/01/02 05:31:16 | 000,000,646 | ---- | M] () -- C:\ProgramData\hpzinstall.log
[2011/01/30 06:28:51 | 000,000,384 | ---- | M] () -- C:\ProgramData\oWDItIqY
[2011/01/30 14:26:19 | 000,000,272 | ---- | M] () -- C:\ProgramData\~oWDItIqY
[2011/01/30 14:26:19 | 000,000,160 | ---- | M] () -- C:\ProgramData\~oWDItIqYr

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >
ColorPic Uninstaller.exe

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >
[2007/09/11 16:54:36 | 000,753,416 | ---- | M] (Intel Corporation) -- C:\Windows\Installer\iProInst.exe

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 171 bytes -> C:\ProgramData\TEMP

FC5A2B2
@Alternate Data Stream - 166 bytes -> C:\ProgramData\TEMP:4F0FFA06
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:8045FBC5
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:5C321E34
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:0A8E2C33
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP

1B5B4F1

< End of report >

**Dev** · 07-02-2011

OTL Extras logfile created on: 2/7/2011 11:54:14 AM - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\Devorah\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18999)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 62.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 184.84 Gb Total Space | 96.65 Gb Free Space | 52.29% Space Free | Partition Type: NTFS
Drive D: | 186.31 Gb Total Space | 186.27 Gb Free Space | 99.98% Space Free | Partition Type: NTFS

Computer Name: DEVORAH-PC | User Name: Devorah | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_USERS\S-1-5-21-4275440598-3698797053-1848500140-1000\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- C:\Users\Devorah\AppData\Local\Google\Chrome\Appli cation\chrome.exe (Google Inc.)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 1
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01 [binary data]
"VistaSp2" = 1E 59 8B EE 87 37 CA 01 [binary data]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\DomainPr ofile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\Standard Profile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\Standard Profile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\PublicPr ofile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\DomainPr ofile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\Standard Profile\AuthorizedApplications\List]
"C:\TOSHIBA\ivp\NetInt\Netint.exe" = C:\TOSHIBA\ivp\NetInt\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrades Engine -- (TOSHIBA Corporation)
"C:\TOSHIBA\Ivp\ISM\pinger.exe" = C:\TOSHIBA\Ivp\ISM\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger -- ()
"C:\TOSHIBA\ivp\NetInt\Netint.exe" = C:\TOSHIBA\ivp\NetInt\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrades Engine -- (TOSHIBA Corporation)
"C:\TOSHIBA\Ivp\ISM\pinger.exe" = C:\TOSHIBA\Ivp\ISM\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger -- ()

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\Firewall Rules]
"{0C46EE76-F835-4E4B-869A-E0EE01AB4E69}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{1B22F775-4336-4B40-84D6-4D0EB6631D9F}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{6730E139-D4A7-4C3A-BCFB-20CABF8FD677}" = lport=80 | protocol=6 | dir=in | app=system |
"{7F4B890A-2BF7-46CA-9D6C-0AECB3C03EDB}" = rport=80 | protocol=6 | dir=out | app=c:\program files (x86)\common files\intuit\update service\intuitupdater.exe |
"{E3D89FAF-CF62-4659-96A6-05498A4A412D}" = rport=80 | protocol=6 | dir=out | app=c:\program files (x86)\common files\intuit\update service\intuitupdateservice.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\Firewall Rules]
"{10C9D463-75C9-4F48-9D7B-658A6E484460}" = protocol=17 | dir=in | app=c:\program files\smartftp client\smartftp.exe |
"{12DFEE7F-5DDA-414F-8A7B-5DFFD48C1848}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{183E1645-D1CD-4927-8BED-56BA85D85654}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{23898462-0253-47E7-B614-952250030F47}" = dir=in | app=c:\program files (x86)\cyberlink\powercinema for toshiba\pcmservice.exe |
"{265DD9D6-90A0-4157-B965-F867D4665C1F}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{39131CCA-FA40-4D25-B491-B2CA5E1D77A4}" = dir=in | app=c:\program files (x86)\avg\avgls9\avgupd.exe |
"{477DBC33-450E-42D5-B715-E9ECA93C0E39}" = dir=in | app=c:\program files (x86)\cyberlink\powercinema for toshiba\kernel\dms\clmsservice.exe |
"{490C4041-A85C-4FAE-8DEA-1F379430F211}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{72404A2D-BDA7-471C-9FD7-C10724765E3C}" = dir=in | app=c:\program files (x86)\cyberlink\powercinema for toshiba\powercinema.exe |
"{7AD58963-1D9E-4B59-A726-EBA63535D74F}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{92B7222B-FB9B-4CFD-ADDE-EF16D3B8AECE}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{AEA7BAB8-E2A2-4338-A1FD-F71968C0742B}" = protocol=6 | dir=in | app=c:\program files\smartftp client\smartftp.exe |
"{F2F6C35F-F777-4DFC-BA7C-0729743D7111}" = dir=in | app=c:\program files (x86)\avg\avgls9\avgnsa.exe |
"{FD2B4700-562C-4E69-9138-5470FA38404F}" = dir=in | app=c:\program files (x86)\cyberlink\powercinema for toshiba\kernel\dmp\clbrowserengine.exe |
"TCP Query User{18D18BF7-AB08-42AB-9AEC-1760F0EEC7F8}C:\users\devorah\appdata\local\google \chrome\application\chrome.exe" = protocol=6 | dir=in | app=c:\users\devorah\appdata\local\google\chrome\a pplication\chrome.exe |
"TCP Query User{9973DBA6-C13F-4950-97A2-F28AD9849355}C:\users\devorah\appdata\local\google \chrome\application\chrome.exe" = protocol=6 | dir=in | app=c:\users\devorah\appdata\local\google\chrome\a pplication\chrome.exe |
"UDP Query User{06020575-9C61-4628-BCBC-922E3C17BE26}C:\users\devorah\appdata\local\google \chrome\application\chrome.exe" = protocol=17 | dir=in | app=c:\users\devorah\appdata\local\google\chrome\a pplication\chrome.exe |
"UDP Query User{91E6D3B7-95A6-422C-9516-0A4F89E510DE}C:\users\devorah\appdata\local\google \chrome\application\chrome.exe" = protocol=17 | dir=in | app=c:\users\devorah\appdata\local\google\chrome\a pplication\chrome.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall]
"{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"{17E02F38-FF2D-4c3d-83DF-ECE2A1D20A5E}" = AIO_CDB_ToolboxIni64
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{1E3CA1C4-1E90-401B-8CC0-911DF018D8D8}" = AllWebMenus PRO 5.3.840
"{25297C31-EBA4-A1AA-0593-547468395DE8}" = ccc-utility64
"{3F2B4DAD-88CB-4F5B-86B2-DF3384063EFA}" = O2Micro Flash Memory Card Reader Driver (x64)
"{41BF0DE4-5BAE-4B88-AFD3-86A30B222186}" = Bonjour
"{5254156F-AA77-499A-B7C1-D5581D44E788}" = Marvell Miniport Driver
"{5ADC0761-2120-4E9A-860E-1D3F139F7FF2}" = One-click CD/DVD Copy 64-bit module
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
"{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"{639673E9-D53F-44F4-A046-485C8A6ADA16}" = Paint.NET v3.5.6
"{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{79BF7CB8-1E09-489F-9547-DB3EE8EA3F16}" = Microsoft SQL Server Native Client
"{7FB35ED7-D375-482C-B1F0-317B902A0230}" = SmartFTP Client
"{86177DAE-38B1-49DD-912E-35CB703AB779}" = Microsoft SQL Server VSS Writer
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8C6BB412-D3A8-4AAE-A01B-35B681789D68}" = mHelp
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{963BFE7E-C350-4346-B43C-B02358306A45}" = Apple Mobile Device Support
"{9C7AB2D0-7768-4708-B9DA-6C1F44C9833A}" = mCPlug
"{9F560BEB-021F-43AC-825F-AA60442D8DE4}" = 64 Bit HP CIO Components Installer
"{A2EBEBDB-E39F-4AF0-A04A-FDF2813C6133}" = NXPowerLite
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{B6EFD9A5-2ECE-4C22-BAEC-D16E73EA2013}" = iTunes
"{C13AF9C7-8E06-4354-B629-DF6192CE4A66}" = PANTECH UM175 Driver
"{C3BC9ECF-563E-33AF-FF45-1688C1800F18}" = ATI Catalyst Install Manager
"{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}" = HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF0853CA-A1D0-4169-8472-F2822C8FA1EB}" = TOSHIBA Supervisor Password
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{E8B39B08-7FAB-48CC-89E9-37C5589E130C}" = TOSHIBA Hardware Setup
"{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities
"{EF5948BA-589D-4BE7-B993-C45DC1A77E24}" = MobileMe Control Panel
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F2EF0002-9141-439B-B6F3-237DD2A18938}" = FM Tuner Utility
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F67FA545-D8E5-4209-86B1-AEE045D1003F}" = TOSHIBA Face Recognition
"CNXT_AUDIO_HDA" = Conexant HD Audio
"Folder Marker_is1" = Folder Marker Home v 3.1 GAOTD Edition
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"HPOCR" = HP OCR Software 8.0
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"ProInst" = Intel(R) PROSet/Wireless Software
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"ZonerPhotoStudio13_EN_is1" = Zoner Photo Studio 13

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{008D69EB-70FF-46AB-9C75-924620DF191A}" = TOSHIBA Speech System SR Engine(U.S.) Version1.0
"{0235B9FB-3225-4A55-BD77-1B1C43D3865F}" = SiteSpinner Pro V2
"{02CD3644-6640-B07A-E8DF-2149DA65F85C}" = Catalyst Control Center Localization Italian
"{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"{077425F6-507C-0257-7891-FDCC8D6CA84D}" = Skins
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0CCA76C3-AA59-8D77-8D87-F8F3B32FB7EF}" = Catalyst Control Center Localization Swedish
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{0D92D5D0-624F-4ED3-98C2-CEE6A3285544}" = WebDwarf V2
"{0F49EBA7-A06A-9F3F-28B6-BD815267918D}" = CCC Help Japanese
"{12B662BB-93D8-4EEC-AFD2-94CD9A9EB1B9}}_is1" = Aneesoft 3D Flash Gallery GOTD
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{17849E30-6D35-40FC-BF1B-7E1AEA86BB75}" = Picture Collage Maker Pro Full
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{1B87C40B-A60B-4EF3-9A68-706CF4B69978}" = Toshiba Assist
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{205CAD2A-8ED7-EF66-4AC7-E6ECDFA56E6B}" = CCC Help Dutch
"{25BB07FA-D9A0-478E-8A4B-38466A4E8BF2}" = Serif PagePlus SE 1.0
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = CyberLink PowerCinema for TOSHIBA
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 17
"{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}" = Microsoft SQL Server 2005 Tools Express Edition
"{29205904-A7A8-4545-0001-697935602C90}" = SimplyGoodPictures
"{2AEDC172-479F-47AE-8A48-A0524D4AED5B}_is1" = Inpaint 3.0
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{2EA497D6-38C3-9CF7-CBD8-1AA1B0A1E75E}" = Catalyst Control Center Core Implementation
"{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}" = Visual C++ 8.0 Runtime Setup Package (x64)
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{37C866E4-AA67-4725-9E95-A39968DD7960}" = Camera Assistant Software for Toshiba
"{3881DB80-EAA2-012B-ADAE-000000000000}" = TurboTax 2009 WinPerFedFormset
"{38975F50-EAA2-012B-ADB4-000000000000}" = TurboTax 2009 WinPerReleaseEngine
"{38A34630-EAA2-012B-ADB6-000000000000}" = TurboTax 2009 WinPerTaxSupport
"{3A2EEF40-EAA2-012B-AE15-000000000000}" = TurboTax 2009 wmoiper
"{3C5A81D0-EAA2-012B-AE9F-000000000000}" = TurboTax 2009 wrapper
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{3FBF6F99-8EC6-41B4-8527-0A32241B5496}" = TOSHIBA Speech System TTS Engine(U.S.) Version1.0
"{425A2BC2-AA64-4107-9C29-484245BBEA05}" = TOSHIBA Software Upgrades
"{45B6180B-DCAB-4093-8EE8-6164457517F0}" = Photosmart 140,240,7200,7600,7700,7900 Series
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{4C3F3228-13BE-41D0-A782-3DDE7CB2479A}" = CD/DVD Drive Acoustic Silencer
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{4CC04CB8-422A-4940-A5C9-90F233690509}_is1" = SRWare Iron 2.0.178.0
"{4E41C7CC-C7AA-C56F-747B-C897A611C78D}" = Catalyst Control Center Localization Chinese Traditional
"{5007E629-8769-44BB-BD51-A20B6DCC5CC9}" = Microsoft Office Accounting 2009
"{5137F222-54CF-0754-7082-78E657C468F4}" = ccc-core-static
"{517B8FB2-26EE-43B0-AE1B-07408860AA69}" = DigitImg
"{53276F5A-85AB-4BEF-BAA2-2490975DC006}" = Microsoft Office Accounting 2009 Fixed Asset Manager
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{56F15A5F-DAF8-6F07-0F1E-7722D5DE7FF8}" = Catalyst Control Center Localization Korean
"{5A937F04-F71A-47A3-A98A-F576BA9A39DF}_is1" = Easy Photo Sorter version 2.6
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{5EACB46D-5DA4-44F8-9178-9ED373DBD655}_is1" = InstantMask 1.4
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FA793A6-0071-42C1-9355-8F69A428C44F}" = Microsoft Office Accounting ADP Payroll Addin
"{60758250-C8CF-47EB-8CB6-E0C3B84D8207}" = PSShortcuts
"{62DB5CD4-E3E1-BE42-B3B3-DA4DCB8D9FAE}" = CCC Help Chinese Traditional
"{63A6E9A9-A190-46D4-9430-2DB28654AFD8}" = Norton 360
"{65BCF909-6AF7-4B01-8EB3-713CE2873DC8}" = Microsoft Expression Web 3
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6B9B0C6F-E5FA-4633-A640-AB98A272ECCA}" = Safari
"{6C32ACBF-B9CA-4d53-BB71-C4FA97582286}_is1" = Sothink DHTML Menu 9
"{6C5F3BDC-0A1B-4436-A696-5939629D5C31}" = TOSHIBA DVD PLAYER
"{6D308A90-6C14-4A02-9B04-CB0EF17894A9}_is1" = Picture Collage Maker Pro 2.2.8
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{752E90AC-3F11-4EA3-88EA-96441047EC31}" = Microsoft Expression Web 3 SP1
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7709A640-B3C6-183D-4409-B834DBC89431}" = Catalyst Control Center Graphics Full New
"{78C6A78A-8B03-48C8-A47C-78BA1FCA2307}" = TOSHIBA ConfigFree
"{7A7DC702-DEDE-42A8-8722-B3BA724D546F}" = Fax
"{7D813247-3D62-2795-FB19-6A8D07A5F79B}" = CCC Help Spanish
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{88AA4636-2FB2-DFE1-1C61-43B6EF2CD8E1}" = CCC Help French
"{890EF3F8-742F-46BD-9E8E-084B3A1F4364}" = QuickBooks Financial Center
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update
"{8DCE550C-CA43-4E82-92DF-FFC4A48F5BE1}" = Napster Burn Engine
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}_XWeb_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}_XWeb_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}_XWeb_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_XWeb_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0409-1000-0000000FF1CE}_XWeb_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0045-0000-0000-0000000FF1CE}" = Microsoft Expression Web 2
"{90120000-0045-0000-0000-0000000FF1CE}_XWeb_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0045-0409-0000-0000000FF1CE}" = Microsoft Expression Web 2 MUI (English)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}_XWeb_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}_XWeb_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0116-0409-1000-0000000FF1CE}_XWeb_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{901C0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Access 2003 Runtime
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{978C25EE-5777-46e4-8988-732C297CBDBD}" = Status
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B1FD9CE-0776-4f0b-A6F5-C6AB7B650CDF}" = Destinations
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9E5A03E3-6246-4920-9630-0527D5DA9B07}" = iSEEK AnswerWorks English Runtime
"{A0659B5E-4B1B-490C-89BF-941B9A98A99C}_is1" = Chromagic 1.0
"{A19CD270-67D3-F68F-9DC1-C85460A7BA46}" = CCC Help German
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A3B7C670-4A1E-4EE2-950E-C875BC1965D0}" = Copy
"{A5AD3FDA-6A02-408F-874E-52B0CA0AC3ED}" = Expression Extras SEO Tools for Expression Web 3
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{A9510C09-D2CE-9BCC-1E98-05E7C4AEFDAA}" = Catalyst Control Center Localization Japanese
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA41F48A-DA7A-F60F-D7A7-22F7EACF54A1}" = Catalyst Control Center Graphics Previews Vista
"{AA8B2587-7198-44E6-858D-20EA0E833C9D}" = HP Wireless Comfort Mobile Mouse
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.1
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{B376402D-58EA-45EA-BD50-DD924EB67A70}" = HP Memories Disc
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B65FA8F4-D555-4599-BBDB-4B36A4239202}_is1" = Calme 2010.0
"{B951C695-82CE-E8A9-B409-4C1BF65F90C9}" = Catalyst Control Center Localization German
"{B99B452B-1FE9-050C-F33A-5D0D11F52780}" = CCC Help Portuguese
"{BBBCAE4B-B416-4182-A6F2-438180894A81}" = Napster
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{C0A42EB7-498E-62FD-4368-2957C85C3C00}" = CCC Help Chinese Standard
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C53D16CC-E56F-47B8-906E-70AAF8EABB4F}" = Toshiba Registration
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C6C148EC-55FB-4FDF-AD4F-ECEA579D040D}" = Microsoft Office Accounting 2009 Equifax Addin
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{CACC1AB3-33EF-7F78-8877-960934FDD63A}" = CCC Help Korean
"{CB15E3F1-84F4-E8FB-D21C-815616B2B9A4}" = CCC Help English
"{CDC85536-A0EF-4401-82A6-25D8EFC7EFAC}" = VZAccess Manager
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D43BB532-3537-4CE9-9CBB-92533BD29F0C}" = HP Software Update
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D575FBAA-D6D6-4221-A2C4-67541DB7AB5E}_is1" = Device Doctor 1.0.0.1
"{D58A1E94-9EEA-4C6E-B9FB-D7C63DC6C941}" = Catalyst Control Center - Branding
"{D7CCE9E8-2BFB-7AB9-8A8E-A19C4C5658B8}" = CCC Help Swedish
"{D9757258-30B2-496E-86F2-84920C5858E1}_is1" = CollageIt 1.1.5
"{D9AE6BE1-5847-4962-86B0-2A290B7E6C43}" = Microsoft Office Accounting 2009 Tax Integration Add-in
"{DC0C35E4-CD3D-4F12-95BB-7C74D9467BD7}" = Microsoft Office Accounting 2009 PayPal Addin
"{DC4C472D-5AD7-947C-02F5-72D6C95A416B}" = CCC Help Italian
"{DC7816CD-49C1-1735-F3B8-DFFEA045E3B3}" = Catalyst Control Center Localization Spanish
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE4997B5-55AD-4878-97A7-C9FA84FE23C7}" = PSUsage
"{E0328433-2A59-49A7-BE3D-1B7506165177}" = Spawn for Expression Web 3
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E09575B2-498D-4C8B-A9D2-623F78574F29}" = AIO_CDB_Software
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext
"{E74D62FF-F041-4E67-A9B4-F23A8C643FDF}" = Catalyst Control Center Localization Dutch
"{E7C0D6C0-9BE3-486E-8F66-C5788CD704B9}" = One-click CD/DVD Copy
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{EE033C1F-443E-41EC-A0E2-559B539A4E4D}" = TOSHIBA Speech System Applications
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F008A697-D7D2-6FA5-BB13-86212B5EF1F6}" = Catalyst Control Center Graphics Light
"{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}" = DVD MovieFactory for TOSHIBA
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F6591A9D-A7EF-4FDF-8440-F42C725E37F4}" = Easy Flyer Creator 2.0
"{F6F725C9-3E65-4450-8E87-43EA8139F07E}" = Greeting Card Builder Full
"{F7E2446B-9529-958E-AB34-7BF47F0AB1C6}" = Catalyst Control Center Localization Portuguese
"{F8D923C1-F53B-4CBA-CBDF-AAF8EAF7564C}" = Catalyst Control Center Localization French
"{F92B8C16-4089-A2D6-C006-D66F3AF00EEB}" = Catalyst Control Center Graphics Full Existing
"{FA26FB54-B5F2-5F12-C22D-67EB1423D8A8}" = Catalyst Control Center Localization Chinese Standard
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"ActiveScan 2.0" = Panda ActiveScan 2.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Advanced SystemCare 3_is1" = Advanced SystemCare 3
"Ahnenblatt_is1" = Ahnenblatt 2.61
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.10
"Artensoft Photo Mosaic Wizard_is1" = Artensoft Photo Mosaic Wizard
"Ashampoo Burning Studio 2010 Advanced_is1" = Ashampoo Burning Studio 2010 Advanced
"Ashampoo Photo Commander 7_is1" = Ashampoo Photo Commander 7.60
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AWicons Pro" = AWicons Pro
"bookTome" = bookTome
"BurnPro_is1" = BurnPro Version 5.1.1
"CCleaner" = CCleaner
"CodedColor_is1" = CodedColor PhotoStudio 2010, 6.1.2
"ColorPic" = ColorPic
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B3204 85DF8CE.1" = Acrobat.com
"Corner-A ArtStudio" = Corner-A ArtStudio
"Cover Commander" = Cover Commander 3.1.3 by Insofta Development
"DiscRipper_is1" = Nuclear Coffee - DiscRipper
"DVDFab 8_is1" = DVDFab 8.0.7.2 (26/01/2011)
"EarthSoft Audio Jukebox_is1" = EarthSoft Audio Jukebox 1.0.0
"Easy Thumbnails_is1" = Easy Thumbnails (Remove only)
"Efficient Diary_is1" = Efficient Diary 1.75
"ExpressBurn" = Express Burn
"Expression Extras SEO Tools for xWeb 2" = Expression Extras SEO Tools for xWeb 2
"ExpressRip" = Express Rip
"Family Tree Builder" = MyHeritage Family Tree Builder
"FileZilla Client" = FileZilla Client 3.3.2.1
"Flash Slideshow Maker Pro" = Flash Slideshow Maker Pro 5.00
"Flexible Album Studio_is1" = Flexible Album Studio v0.96 beta 1
"Good Keywords v3_is1" = Good Keywords v3 042209
"GPL Ghostscript 8.70" = GPL Ghostscript 8.70
"HijackThis" = HijackThis 1.99.1
"Hijackthis_is1" = Hijackthis 1.99.1
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = CyberLink PowerCinema for TOSHIBA
"InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
"InstallShield_{DF0853CA-A1D0-4169-8472-F2822C8FA1EB}" = TOSHIBA Supervisor Password
"InstallShield_{E8B39B08-7FAB-48CC-89E9-37C5589E130C}" = TOSHIBA Hardware Setup
"InstallShield_{F2EF0002-9141-439B-B6F3-237DD2A18938}" = FM Tuner Utility
"InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}" = TOSHIBA Face Recognition
"IObitCom Toolbar" = IObitCom Toolbar
"iVocalize Web Conference 4" = iVocalize Web Conference 4
"Karen's Directory Printer" = Karen's Directory Printer
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"McGill English Dictionary of Rhyme with VersePer~286A7AE6_is1" = McGill English Dictionary of Rhyme & Verse Perfect 2.0
"mediAvatar YouTube Video Converter" = mediAvatar YouTube Video Converter
"Microsoft Office Accounting 2009" = Microsoft Office Accounting 2009
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox (3.0.8)" = Mozilla Firefox (3.0.8)
"Ncesoft Flip Book Maker_is1" = Ncesoft Flip Book Maker 2.3.1
"Notepad++" = Notepad++
"PhotoWipe_is1" = PhotoWipe 1.0
"PictureFrame Wizard_is1" = PictureFrame Wizard v1.0
"PitchPerfect" = PitchPerfect Musical Instrument Tuner
"pixpedia-en_is1" = Pixpedia Publisher 3.0.8
"Prism" = Prism Video Converter
"ProcessLasso" = Process Lasso
"Qumana" = Qumana
"RADVideo" = RAD Video Tools
"RealPlayer 6.0" = RealPlayer
"Revo Uninstaller" = Revo Uninstaller 1.88
"RocketDock_is1" = RocketDock 1.3.5
"Scribus 1.3.6" = Scribus 1.3.6svn
"Site Content Analyzer_is1" = Site Content Analyzer 3.2
"Spyware Doctor" = Spyware Doctor 8.0
"SpywareBlaster_is1" = SpywareBlaster 4.3
"Synovel Spicebird (0.7.1)" = Synovel Spicebird (0.7.1)
"taskTome" = taskTome
"ToolBox" = NCH Toolbox
"TurboTax 2009" = TurboTax 2009
"Vectorian Giotto_is1" = Vectorian Giotto 2.3.1
"VideoPad" = VideoPad Video Editor
"WavePad" = WavePad Sound Editor
"Web Album Generator_is1" = Web Album Generator 1.8.2
"Web Site Publisher_is1" = Web Site Publisher 2.1.1
"Web_3.0.3813.0" = Microsoft Expression Web 3
"WildTangent toshiba Master Uninstall" = TOSHIBA Games
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinLiveSuite" = Windows Live Essentials
"Wondershare DemoCreator (Build 3.0.6)_is1" = Wondershare DemoCreator (Build 3.0.6)
"Wondershare Flash Gallery Factory Standard_is1" = Wondershare Flash Gallery Factory Standard 4.8.0.1
"XWeb" = Microsoft Expression Web 2

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-4275440598-3698797053-1848500140-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall]
"ExeIcon3DBox" = ExeIcon.com 3D Box Maker (remove only)
"Google Chrome" = Google Chrome
"Mobile Broadband Manager" = Mobile Broadband Manager

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 5/27/2009 7:42:00 AM | Computer Name = Devorah-pc | Source = avast! | ID = 33554522
Description =

Error - 9/1/2009 1:17:23 PM | Computer Name = Devorah-pc | Source = avast! | ID = 33554522
Description =

Error - 9/5/2009 10:23:33 PM | Computer Name = Devorah-pc | Source = avast! | ID = 33554522
Description =

Error - 10/25/2009 11:55:20 AM | Computer Name = Devorah-pc | Source = avast! | ID = 33554522
Description =

Error - 11/21/2009 10:47:39 AM | Computer Name = Devorah-pc | Source = avast! | ID = 33554522
Description =

Error - 1/19/2010 10:49:02 PM | Computer Name = Devorah-pc | Source = avast! | ID = 33554522
Description =

Error - 2/13/2010 8:54:02 PM | Computer Name = Devorah-pc | Source = avast! | ID = 33554522
Description =

Error - 2/13/2010 8:58:35 PM | Computer Name = Devorah-pc | Source = avast! | ID = 33554522
Description =

Error - 3/16/2010 7:14:23 PM | Computer Name = Devorah-pc | Source = avast! | ID = 33554522
Description =

Error - 3/27/2010 10:18:03 PM | Computer Name = Devorah-pc | Source = avast! | ID = 33554522
Description =

[ Application Events ]
Error - 2/6/2011 7:17:30 PM | Computer Name = Devorah-pc | Source = SideBySide | ID = 16842830
Description = Activation context generation failed for "C:\Users\Devorah\Downloads\SoftonicDownloader_for _verseperfect.exe".Error
in manifest or policy file "" on line . A component version required by the application
conflicts with another component version already active. Conflicting components
are:. Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows. common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb7 2f2a088b0ed3.manifest.
Component
2: C:\Windows\WinSxS\manifests\amd64_microsoft.window s.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509 f852f40ee5cd.manifest.

Error - 2/6/2011 9:07:08 PM | Computer Name = Devorah-pc | Source = WinMgmt | ID = 10
Description =

Error - 2/6/2011 9:28:59 PM | Computer Name = Devorah-pc | Source = WinMgmt | ID = 10
Description =

Error - 2/7/2011 6:49:01 AM | Computer Name = Devorah-pc | Source = WinMgmt | ID = 10
Description =

Error - 2/7/2011 9:47:22 AM | Computer Name = Devorah-pc | Source = EventSystem | ID = 4621
Description =

Error - 2/7/2011 9:50:18 AM | Computer Name = Devorah-pc | Source = WinMgmt | ID = 10
Description =

Error - 2/7/2011 10:30:56 AM | Computer Name = Devorah-pc | Source = EventSystem | ID = 4621
Description =

Error - 2/7/2011 10:33:50 AM | Computer Name = Devorah-pc | Source = WinMgmt | ID = 10
Description =

Error - 2/7/2011 1:10:06 PM | Computer Name = Devorah-pc | Source = EventSystem | ID = 4621
Description =

Error - 2/7/2011 1:13:00 PM | Computer Name = Devorah-pc | Source = WinMgmt | ID = 10
Description =

[ Media Center Events ]
Error - 6/9/2009 4:52:42 PM | Computer Name = Devorah-pc | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 8/4/2009 3:26:38 PM | Computer Name = Devorah-pc | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 10/26/2009 3:31:24 PM | Computer Name = Devorah-pc | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 11/1/2009 7:00:40 AM | Computer Name = Devorah-pc | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ OSession Events ]
Error - 1/3/2009 8:39:31 PM | Computer Name = Devorah-pc | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 22, Application Name: Microsoft Expression Web, Application Version:
2008.1200.6329.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted
3160 seconds with 1740 seconds of active time. This session ended with a crash.

Error - 2/6/2009 8:24:20 PM | Computer Name = Devorah-pc | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 22, Application Name: Microsoft Expression Web, Application Version:
2008.1200.6329.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted
3798 seconds with 1620 seconds of active time. This session ended with a crash.

Error - 7/20/2009 8:30:08 PM | Computer Name = Devorah-pc | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 22, Application Name: Microsoft Expression Web, Application Version:
2008.1200.6329.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted
8495 seconds with 6600 seconds of active time. This session ended with a crash.

Error - 11/9/2009 8:40:43 AM | Computer Name = Devorah-pc | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 22, Application Name: Microsoft Expression Web, Application Version:
2008.1200.6329.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted
101 seconds with 60 seconds of active time. This session ended with a crash.

Error - 6/14/2010 2:23:58 PM | Computer Name = Devorah-pc | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 22, Application Name: Microsoft Expression Web, Application Version:
2008.1200.6329.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted
803 seconds with 600 seconds of active time. This session ended with a crash.

Error - 10/23/2010 9:50:41 AM | Computer Name = Devorah-pc | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 22, Application Name: Microsoft Expression Web, Application Version:
2008.1200.6329.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted
10958 seconds with 3780 seconds of active time. This session ended with a crash.

Error - 11/27/2010 10:06:32 PM | Computer Name = Devorah-pc | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4
seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 2/7/2011 1:08:56 PM | Computer Name = Devorah-pc | Source = Application Popup | ID = 1060
Description = \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility
with this system. Please contact your software vendor for a compatible version
of the driver.

Error - 2/7/2011 1:08:56 PM | Computer Name = Devorah-pc | Source = Application Popup | ID = 1060
Description = \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility
with this system. Please contact your software vendor for a compatible version
of the driver.

Error - 2/7/2011 1:09:30 PM | Computer Name = Devorah-pc | Source = Service Control Manager | ID = 7030
Description =

Error - 2/7/2011 1:09:44 PM | Computer Name = Devorah-pc | Source = Service Control Manager | ID = 7030
Description =

Error - 2/7/2011 1:10:06 PM | Computer Name = Devorah-pc | Source = DCOM | ID = 10010
Description =

Error - 2/7/2011 1:11:06 PM | Computer Name = Devorah-pc | Source = volmgr | ID = 262190
Description = Crash dump initialization failed!

Error - 2/7/2011 1:11:22 PM | Computer Name = Devorah-pc | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.sys has been
blocked from loading due to incompatibility with this system. Please contact your
software vendor for a compatible version of the driver.

Error - 2/7/2011 1:11:22 PM | Computer Name = Devorah-pc | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\SUPERAntiSpyware\SASDIFSV.SYS has been
blocked from loading due to incompatibility with this system. Please contact your
software vendor for a compatible version of the driver.

Error - 2/7/2011 1:11:24 PM | Computer Name = Devorah-pc | Source = volmgr | ID = 262190
Description = Crash dump initialization failed!

Error - 2/7/2011 1:13:00 PM | Computer Name = Devorah-pc | Source = Service Control Manager | ID = 7026
Description =

< End of report >

**Dev** · 07-02-2011

deleted - posted the Extras.Txt twice.

Need help removing viruses

Need help removing viruses

Similar Threads

Help! Got three viruses (new ones)!

viruses..need help

Help, How to I get rid of these viruses???

removing viruses

Need help removing "Winka/Winupdt viruses