Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

« previous next »
Pages: 1 2 [All]   Go Down

Author Topic: Malware removal - can't perform any suggested steps with .exe file  (Read 20330 times)

0 Members and 1 Guest are viewing this topic.

lcarco

    Topic Starter


    Rookie

    Malware removal - can't perform any suggested steps with .exe file
    « on: August 14, 2010, 01:20:16 PM »
    Hi, I've been trying to complete the steps for malware removal.   I cannot do a THING with my laptop, can't connect to the internet or run any programs (I was trying to do the steps listed on the HOPE forum and was only able to get through the first few steps (rrkill and Super Antispyware) AND run the scan. but from there I've been unable to do anything further. What do I do now???

    Thanks!
    Lisa
    Logged

    lcarco

      Topic Starter


      Rookie

      Re: Malware removal - can't perform any suggested steps with .exe file
      « Reply #1 on: August 14, 2010, 01:20:49 PM »
      Oh, I'm running Vista 64 bit.
      Logged

      harry 48



        Egghead

      • lay back , relax and chill out
        • Thanked: 129
        • Yes
        • Yes
        • Yes
        • Dribbling Pensioner
      • Certifications: List
      • Experience: Familiar
      • OS: Windows 7
      Re: Malware removal - can't perform any suggested steps with .exe file
      « Reply #2 on: August 14, 2010, 02:14:57 PM »
      if you can download hjt rename it to snipper.exe run it and post the log
      Logged

      Carlos Medrano



        Rookie

      • I've Allways enjoyed computers!
        • Experience: Beginner
        • OS: Windows XP
        Re: Malware removal - can't perform any suggested steps with .exe file
        « Reply #3 on: August 14, 2010, 07:14:12 PM »
        Wait for a specialist to answer your thread.
        Logged
        Do Computers Think for them selfs?
        If they do tell them to write a report of your mind.

        lcarco

          Topic Starter


          Rookie

          Re: Malware removal - can't perform any suggested steps with .exe file
          « Reply #4 on: August 14, 2010, 08:51:19 PM »
          I have been unable to run ANY .exe file, even after renaming it.  I don't want to try anything more without the assistance of a specialist.   

          Thanks though!
          Logged

          harry 48



            Egghead

          • lay back , relax and chill out
            • Thanked: 129
            • Yes
            • Yes
            • Yes
            • Dribbling Pensioner
          • Certifications: List
          • Experience: Familiar
          • OS: Windows 7
          Re: Malware removal - can't perform any suggested steps with .exe file
          « Reply #5 on: August 15, 2010, 07:51:18 AM »
          Quote from: Carlos Medrano on August 14, 2010, 07:14:12 PM
          Wait for a specialist to answer your thread.

          these downloads and logs have to be provided for the malware expert to read it saves them time in telling the OP to do them

          but thank you for your comment  ::)

          @lcarco ; ok , a malware expert will be along to help you , the weekend is a bad time
          Logged

          SuperDave

          • Malware Removal Specialist


            • Genius
            • Thanked: 1020
          • Certifications: List
          • Experience: Expert
          • OS: Windows 10
          Re: Malware removal - can't perform any suggested steps with .exe file
          « Reply #6 on: August 15, 2010, 01:06:17 PM »
          Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.

          1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
          2. The fixes are specific to your problem and should only be used for this issue on this machine.
          3. If you don't know or understand something, please don't hesitate to ask.
          4. Please DO NOT run any other tools or scans while I am helping you.
          5. It is important that you reply to this thread. Do not start a new topic.
          6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
          7. Absence of symptoms does not mean that everything is clear.

          Let me get this straight. You can boot your computer in Normal Mode but you can't connect to the internet? When you try to run any program you get an error message?
          Logged
          Windows 8 and Windows 10 dual boot with two SSD's

          lcarco

            Topic Starter


            Rookie

            Re: Malware removal - can't perform any suggested steps with .exe file
            « Reply #7 on: August 15, 2010, 01:13:38 PM »
            I did the RKILL

            Here is the log

            This log file is located at C:\rkill.log.
            Please post this only if requested to by the person helping you.
            Otherwise you can close this log when you wish.
            Ran as Lisa on 08/15/2010 at 15:24:57.


            Processes terminated by Rkill or while it was running:


            C:\Users\Lisa\AppData\Local\tconxtygj\yqidoqdshdw.exe


            Rkill completed on 08/15/2010  at 15:25:03.
            Logged

            SuperDave

            • Malware Removal Specialist


              • Genius
              • Thanked: 1020
            • Certifications: List
            • Experience: Expert
            • OS: Windows 10
            Re: Malware removal - can't perform any suggested steps with .exe file
            « Reply #8 on: August 15, 2010, 05:03:33 PM »
            You didn't answer my question.
            Quote
            Let me get this straight. You can boot your computer in Normal Mode but you can't connect to the internet? When you try to run any program you get an error message?
            Logged
            Windows 8 and Windows 10 dual boot with two SSD's

            lcarco

              Topic Starter


              Rookie

              Re: Malware removal - can't perform any suggested steps with .exe file
              « Reply #9 on: August 15, 2010, 06:23:57 PM »
              Yes, I can boot in normal mode, but I can't connect to the internet and I get the error message when trying to run any .exe file.  But for example, I can open outlook and look at my calendar and old mail, I can open Word, but when I try to run any .exe file, it goes immediately to the dang error message.  I cannot connect to the internet because I have a wireless connection with this laptop.
              Logged

              lcarco

                Topic Starter


                Rookie

                Re: Malware removal - can't perform any suggested steps with .exe file
                « Reply #10 on: August 15, 2010, 06:30:00 PM »
                OK, this is so weird, I CAN connect to the internet now since running that RKILL.  I did not restart or shut down though, I'm sure the problem is still there.  How do I test it?
                Logged

                lcarco

                  Topic Starter


                  Rookie

                  Re: Malware removal - can't perform any suggested steps with .exe file
                  « Reply #11 on: August 15, 2010, 06:43:41 PM »
                  Firefox works, but not i.e. 7.
                  Logged

                  lcarco

                    Topic Starter


                    Rookie

                    Re: Malware removal - can't perform any suggested steps with .exe file
                    « Reply #12 on: August 16, 2010, 09:11:45 AM »
                    I ran mbam.exe this morning, here is the log, which confuses me, it almost appears as if I don't have a problem, but i know if I reboot, it's sure to be back.  Now I am at a total loss and await your guidance....

                    Thanks!


                    Malwarebytes' Anti-Malware 1.46
                    www.malwarebytes.org

                    Database version: 4052

                    Windows 6.0.6001 Service Pack 1
                    Internet Explorer 8.0.6001.18943

                    8/16/2010 11:12:07 AM
                    mbam-log-2010-08-16 (11-12-07).txt

                    Scan type: Full scan (C:\|D:\|)
                    Objects scanned: 378551
                    Time elapsed: 1 hour(s), 50 minute(s), 21 second(s)

                    Memory Processes Infected: 0
                    Memory Modules Infected: 0
                    Registry Keys Infected: 0
                    Registry Values Infected: 0
                    Registry Data Items Infected: 0
                    Folders Infected: 0
                    Files Infected: 0

                    Memory Processes Infected:
                    (No malicious items detected)

                    Memory Modules Infected:
                    (No malicious items detected)

                    Registry Keys Infected:
                    (No malicious items detected)

                    Registry Values Infected:
                    (No malicious items detected)

                    Registry Data Items Infected:
                    (No malicious items detected)

                    Folders Infected:
                    (No malicious items detected)

                    Files Infected:
                    (No malicious items detected)
                    Logged

                    SuperDave

                    • Malware Removal Specialist


                      • Genius
                      • Thanked: 1020
                    • Certifications: List
                    • Experience: Expert
                    • OS: Windows 10
                    Re: Malware removal - can't perform any suggested steps with .exe file
                    « Reply #13 on: August 16, 2010, 05:22:49 PM »
                    Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.

                    1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
                    2. The fixes are specific to your problem and should only be used for this issue on this machine.
                    3. If you don't know or understand something, please don't hesitate to ask.
                    4. Please DO NOT run any other tools or scans while I am helping you.
                    5. It is important that you reply to this thread. Do not start a new topic.
                    6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
                    7. Absence of symptoms does not mean that everything is clear.

                    *************************************************
                    Ok. We need to clear your DNS cache.

                    Please navigate to Start>Run and type cmd

                    in the window that pops up type ipconfig /flushdns

                    ********************************************8
                    Download the Fix IE Utility to your desktop.

                    Before running the utility, make sure that all your Internet Explorer windows are closed!

                    * Extract the contents of the .zip file to your desktop.
                    * Double click the Fix IE Utility button to run the tool.
                    * Click Run Utility
                    * Click OK when you see 'Re-registered all files'
                    * Open Internet Explorer and see how it works.
                    **********************************************
                    SUPERAntiSpyware

                    If you already have SUPERAntiSpyware be sure to check for updates before scanning!

                    Download SuperAntispyware Free Edition (SAS)
                    * Double-click the icon on your desktop to run the installer.
                    * When asked to Update the program definitions, click Yes
                    * If you encounter any problems while downloading the updates, manually download and unzip them from here
                    * Next click the Preferences button.

                    •Under Start-Up Options uncheck Start SUPERAntiSpyware when Windows starts
                    * Click the Scanning Control tab.
                    * Under Scanner Options make sure only the following are checked:

                    •Close browsers before scanning
                    •Scan for tracking cookies
                    •Terminate memory threats before quarantining
                    •Please leave the others unchecked

                    •Click the Close button to leave the control center screen.

                    * On the main screen click Scan your computer
                    * On the left check the box for the drive you are scanning.
                    * On the right choose Perform Complete Scan
                    * Click Next to start the scan. Please be patient while it scans your computer.
                    * After the scan is complete a summary box will appear. Click OK
                    * Make sure everything in the white box has a check next to it, then click Next
                    * It will quarantine what it found and if it asks if you want to reboot, click Yes

                    •To retrieve the removal information please do the following:
                    •After reboot, double-click the SUPERAntiSpyware icon on your desktop.
                    •Click Preferences. Click the Statistics/Logs tab.

                    •Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.

                    •It will open in your default text editor (preferably Notepad).
                    •Save the notepad file to your desktop by clicking (in notepad) File > Save As...

                    * Save the log somewhere you can easily find it. (normally the desktop)
                    * Click close and close again to exit the program.
                    *Copy and Paste the log in your post.
                    *************************************************

                    Download Security Check by screen317 from one of the following links and save it to your desktop.

                    Link 1
                    Link 2

                    * Unzip SecurityCheck.zip and a folder named Security Check should appear.
                    * Open the Security Check folder and double-click Security Check.bat
                    * Follow the on-screen instructions inside of the black box.
                    * A Notepad document should open automatically called checkup.txt
                    * Post the contents of that document in your next reply.

                    Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.

                    **************************************************
                    Please download: HiJackThis to your Desktop.
                    • Double Click the HijackThis icon, located on your Desktop.
                    • By Default, it will install to: C:\Program Files\Trend Micro\HijackThis
                    • Accept the license agreement.
                    • Click the Open the Misc Tools section button.
                    • Place a checkmark beside Calculate MD5 of files if possible. Then, click Back.
                    • Click Do a System Scan and Save a Logfile. Or, if you see a white screen, click Scan.
                    • Please post the log in your next reply.
                    **************************************************
                    Logged
                    Windows 8 and Windows 10 dual boot with two SSD's

                    lcarco

                      Topic Starter


                      Rookie

                      Re: Malware removal - can't perform any suggested steps with .exe file
                      « Reply #14 on: August 16, 2010, 08:42:45 PM »
                      OK I cleared the DNS cache and ran the Fix IE Utility.  I am connected to the internet (wireless connection) but IE still does not work and now neither does Firefox.  I can send and receive email though via Outlook.  I won't do anything else until I hear back from you. 

                      Thanks for your help....
                      Logged

                      lcarco

                        Topic Starter


                        Rookie

                        Re: Malware removal - can't perform any suggested steps with .exe file
                        « Reply #15 on: August 17, 2010, 08:41:57 AM »
                        I ran superantispyware this morning and rebooted per your instructions. Once I did that, I could not open any progeam, I get the error message about .exe file being infected.  So I ran rkill again since that is what enabled me to do ANYTHING yesterday.

                        This is the rkill log:

                        This log file is located at C:\rkill.log.
                        Please post this only if requested to by the person helping you.
                        Otherwise you can close this log when you wish.
                        Ran as Lisa on 08/17/2010 at 10:36:51.


                        Processes terminated by Rkill or while it was running:


                        C:\Users\Lisa\AppData\Local\tconxtygj\yqidoqdshdw.exe
                        C:\Users\Lisa\Desktop\rkill.scr


                        Rkill completed on 08/17/2010  at 10:36:57.

                        Then I was able to run Super anti spyware and get the log below:

                        SUPERAntiSpyware Scan Log
                        http://www.superantispyware.com

                        Generated 08/17/2010 at 09:48 AM

                        Application Version : 4.41.1000

                        Core Rules Database Version : 5347
                        Trace Rules Database Version: 3159

                        Scan type       : Complete Scan
                        Total Scan Time : 01:27:59

                        Memory items scanned      : 649
                        Memory threats detected   : 0
                        Registry items scanned    : 16216
                        Registry threats detected : 0
                        File items scanned        : 48107
                        File threats detected     : 24

                        Adware.Tracking Cookie
                           .hitbox.com [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .ehg-verizon.hitbox.com [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .ehg-verizon.hitbox.com [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .ehg-verizon.hitbox.com [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .hitbox.com [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .atdmt.com [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .atdmt.com [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .revsci.net [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .revsci.net [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .revsci.net [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .doubleclick.net [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .statcounter.com [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .revsci.net [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .revsci.net [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .kontera.com [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .kontera.com [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .kontera.com [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .kontera.com [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .collective-media.net [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .collective-media.net [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .collective-media.net [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           .collective-media.net [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           ad.yieldmanager.com [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]
                           ad.yieldmanager.com [ C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\cookies.sqlite ]


                        Ran Security Check, log follows:

                         Results of screen317's Security Check version 0.99.5 
                         Windows Vista  (UAC is enabled)
                         Out of date service pack!![/b]
                         Internet Explorer 8 
                        ``````````````````````````````
                        Antivirus/Firewall Check:
                         Windows Firewall Enabled! 
                         Avira AntiVir Personal - Free Antivirus
                         WMI entry may not exist for antivirus; attempting automatic update.
                         Avira successfully updated!
                        ```````````````````````````````
                        Anti-malware/Other Utilities Check:
                         Malwarebytes' Anti-Malware   
                         CCleaner     
                         Java(TM) 6 Update 15 
                         Java(TM) 6 Update 2 
                         Java(TM) 6 Update 4 
                         Java(TM) 6 Update 7 
                         Out of date Java installed!
                         Adobe Flash Player 10.0.2.54 
                        Adobe Reader 8.1.0
                        Out of date Adobe Reader installed!
                         Mozilla Firefox (3.6.6) Firefox Out of Date! 
                        ````````````````````````````````
                        Process Check: 
                        objlist.exe by Laurent
                         Avira Antivir avgnt.exe
                         Avira Antivir avguard.exe
                         Verizon Online Backup & Sharing Filesystem Watcher DigiData.FilesystemWatcher.Service.Watc her.exe
                         Verizon Online Backup & Sharing Scheduler OnlineBackup.SchedulerService.exe
                         Verizon Online Backup & Sharing Auto Update OnlineBackup.UpdateSystemTray.exe
                         Verizon Online Backup & Sharing vewatch.exe 
                        ````````````````````````````````
                        DNS Vulnerability Check:
                         GREAT! (Not vulnerable to DNS cache poisoning)

                        ``````````End of Log````````````


                        Ran Hijack this, log follows:

                        Logfile of Trend Micro HijackThis v2.0.2
                        Scan saved at 10:54:21 AM, on 8/17/2010
                        Platform: Windows Vista SP1 (WinNT 6.00.1905)
                        MSIE: Internet Explorer v8.00 (8.00.6001.18943)
                        Boot mode: Normal

                        Running processes:
                        C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
                        C:\Windows\vsnp2uvc.exe
                        C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
                        C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                        C:\Program Files (x86)\HP\QuickPlay\QPService.exe
                        C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
                        C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
                        C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
                        C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
                        C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
                        C:\Program Files (x86)\Java\jre6\bin\jusched.exe
                        C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
                        C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
                        C:\Program Files (x86)\iTunes\iTunesHelper.exe
                        C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
                        C:\Program Files (x86)\VERIZONDM\bin\sprtcmd.exe
                        C:\Program Files (x86)\Internet Content Filter\mfp.exe
                        C:\Program Files (x86)\Verizon\VSP\VerizonServicepoint.exe
                        C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe
                        C:\Program Files (x86)\Common Files\Motive\McciContextHookShim.exe
                        C:\Program Files (x86)\Verizon\VSP\VerizonServicepointComHandler.exe
                        C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe
                        C:\Windows\SysWOW64\DllHost.exe

                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=ho_central
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
                        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:6522
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                        O1 - Hosts: ::1 localhost
                        O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
                        O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (filesize 75128 bytes, MD5 5CF6190CD875DA6B35256FEE573E7908)
                        O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
                        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (filesize 278192 bytes, MD5 389947CAD1A9C504DF6285AA1E7BE6F1)
                        O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (filesize 349576 bytes, MD5 C0E4908B752509D795E79496530BFD69)
                        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (filesize 814648 bytes, MD5 42CB4EE0B0FC259C8AD20B460FA7D72A)
                        O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (filesize 41760 bytes, MD5 1E57B1A44C7DFFA1C38534279C14B3CE)
                        O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (filesize 349576 bytes, MD5 C0E4908B752509D795E79496530BFD69)
                        O2 - BHO: HP Print Clips - {FFFFFFFF-FF12-44C5-91EC-068E3AA1B2D7} - c:\Program Files (x86)\HP\Smart Web Printing\hpswp_framework.dll (filesize 177504 bytes, MD5 7D5759CDDC966369EF460B552DB465BD)
                        O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
                        O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (filesize 349576 bytes, MD5 C0E4908B752509D795E79496530BFD69)
                        O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (filesize 278192 bytes, MD5 389947CAD1A9C504DF6285AA1E7BE6F1)
                        O4 - HKLM\..\Run: [QPService] "C:\Program Files (x86)\HP\QuickPlay\QPService.exe" (filesize 468264 bytes, MD5 F08A76C5E56BDB6F98F41BD22A4692E1)
                        O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles(x86)%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
                        O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0" (filesize 218408 bytes, MD5 D2A93F854393C7D3BA09893F1EA264CD)
                        O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exeC:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
                        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe" (filesize 40048 bytes, MD5 66D4456C920E21BD2188F8CC33680DF5)
                        O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exeC:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
                        O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exeC:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
                        O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exeC:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
                        O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exec:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
                        O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" (filesize 236016 bytes, MD5 B1FB1C4396A9D0FB074D8E90369F5129)
                        O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min (filesize 209153 bytes, MD5 29680A793F690EEF4AAA68479D2A6DF8)
                        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe" (filesize 149280 bytes, MD5 90E0F7FDCAC66FB50C1CE1A1C7396642)
                        O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exeC:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
                        O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin (filesize 611712 bytes, MD5 E43A851F7B12DE589424D6C656155CFC)
                        O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" (filesize 38768 bytes, MD5 81A990CA9644D2CCB9D903183D9A0F58)
                        O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" (filesize 640376 bytes, MD5 A1ED44DABCD252B95CD09487B65F734C)
                        O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXEC:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
                        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime (filesize 417792 bytes, MD5 55D7A219AD8D0DB8980528944152A6FD)
                        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" (filesize 141608 bytes, MD5 8DC7685764B22DB97891012026FA7ED1)
                        O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" (filesize 935288 bytes, MD5 3103FE27C967675B019E880AA6DA3D6D)
                        O4 - HKLM\..\Run: [VERIZONDM] "C:\Program Files (x86)\VERIZONDM\bin\sprtcmd.exe" /P VERIZONDM (filesize 206120 bytes, MD5 0153701206D2CF9A43F88B40AF1FBC22)
                        O4 - HKLM\..\Run: [Online Backup Auto Update] "C:\Program Files (x86)\Verizon\Online Backup & Sharing\Auto Update\OnlineBackup.UpdateSystemTray.exe" (filesize 233472 bytes, MD5 D5420C4E17E34BE1A30858D697B38492)
                        O4 - HKLM\..\Run: [Vault Explorer Cache Watcher] "C:\Program Files (x86)\Verizon\Online Backup & Sharing\vewatch.exe" (filesize 28672 bytes, MD5 870DFA3469F6C9A0C6EE0C13D062B692)
                        O4 - HKLM\..\Run: [ICF] "C:\Program Files (x86)\Internet Content Filter\mfp.exe" -noact (filesize 1275408 bytes, MD5 91443B66F7492A4F66D456522120A132)
                        O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files (x86)\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN (filesize 4269296 bytes, MD5 BC5F401099CEA5F55879E0F24E5584B4)
                        O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (filesize 1555968 bytes, MD5 5213EB5405A886A9B4FED6724C392C07)
                        O4 - HKCU\..\Run: [lightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden (filesize 455968 bytes, MD5 3C62EAE05B76BA809FA1DE327922E846)
                        O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exeC:\Windows\ehome\ehTray.exe
                        O4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" (filesize 39408 bytes, MD5 5D61BE7DB55B026A5D61A3EED09D0EAD)
                        O4 - HKCU\..\Run: [rjyqbvyn] C:\Users\Lisa\AppData\Local\tconxtygj\yqidoqdshdw.exeC:\Users\Lisa\AppData\Local\tconxtygj\yqidoqdshdw.exe
                        O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exeC:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
                        O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
                        O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
                        O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
                        O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
                        O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
                        O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
                        O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
                        O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
                        O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
                        O9 - Extra button: HP Smart Select - {58ECB495-38F0-49cb-A538-10282ABF65E7} - c:\Program Files (x86)\HP\Smart Web Printing\hpswp_extensions.dll (filesize 152928 bytes, MD5 A1230D9DFAEF1219CDA8E4FA122F106A)
                        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL (filesize 39464 bytes, MD5 AEF204E782BFA2C8448CB43A58960744)
                        O10 - Unknown file in Winsock LSP: c:\windows\syswow64\icf.dll
                        O10 - Unknown file in Winsock LSP: c:\windows\syswow64\icf.dll
                        O10 - Unknown file in Winsock LSP: c:\windows\syswow64\icf.dll
                        O10 - Unknown file in Winsock LSP: c:\windows\syswow64\icf.dll
                        O10 - Unknown file in Winsock LSP: c:\windows\syswow64\icf.dll
                        O13 - Gopher Prefix:
                        O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} (UploadListView Class) - http://picasaweb.google.com/s/v/62.12/uploader2.cab
                        O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
                        O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://picture.vzw.com/activex/VerizonWirelessUploadControl.cab
                        O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
                        O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (filesize 1959208 bytes, MD5 1E79B48BC50B99FDC0066860BCEFBC23)
                        O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXEC:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
                        O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exeC:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
                        O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exeC:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
                        O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
                        O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exeC:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
                        O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
                        O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                        O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exeC:\Program Files (x86)\Bonjour\mDNSResponder.exe
                        O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exeC:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
                        O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
                        O23 - Service: Filesystem Watcher (FilesystemWatcher) - DigiData Corp. - C:\Program Files (x86)\Verizon\Online Backup & Sharing\Filesystem Watcher\DigiData.FilesystemWatcher.Service.Watcher.exeC:\Program Files (x86)\Verizon\Online Backup & Sharing\Filesystem Watcher\DigiData.FilesystemWatcher.Service.Watcher.exe
                        O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exeC:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
                        O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exeC:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
                        O23 - Service: Family Protection Update Service (fpUpdateSvc) - McAfee, Inc. - C:\Program Files (x86)\Internet Content Filter\UpdateService.exeC:\Program Files (x86)\Internet Content Filter\UpdateService.exe
                        O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exeC:\Program Files (x86)\Google\Update\GoogleUpdate.exe
                        O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exeC:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
                        O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exec:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
                        O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exeC:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
                        O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exeC:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
                        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeC:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                        O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeC:\Program Files\iPod\bin\iPodService.exe
                        O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
                        O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exeC:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
                        O23 - Service: McciCMService - Alcatel-Lucent - C:\Program Files (x86)\Common Files\Motive\McciCMService.exeC:\Program Files (x86)\Common Files\Motive\McciCMService.exe
                        O23 - Service: McciCMService64 - Alcatel-Lucent - C:\Program Files\Common Files\Motive\McciCMService.exeC:\Program Files\Common Files\Motive\McciCMService.exe
                        O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
                        O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
                        O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
                        O23 - Service: Online Backup Scheduler (OnlineBackupSchedulerService) - Unknown owner - C:\Program Files (x86)\Verizon\Online Backup & Sharing\Scheduler\OnlineBackup.SchedulerService.exeC:\Program Files (x86)\Verizon\Online Backup & Sharing\Scheduler\OnlineBackup.SchedulerService.exe
                        O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
                        O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files (x86)\HP\QuickPlay\Kernel\TV\QPCapSvc.exeC:\Program Files (x86)\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
                        O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files (x86)\HP\QuickPlay\Kernel\TV\QPSched.exeC:\Program Files (x86)\HP\QuickPlay\Kernel\TV\QPSched.exe
                        O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exeC:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe
                        O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUPnPRenderer9.exeC:\Program Files (x86)\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
                        O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUpnpService9.exeC:\Program Files (x86)\Roxio\Digital Home 9\RoxioUpnpService9.exe
                        O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exeC:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
                        O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exeC:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
                        O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exeC:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
                        O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
                        O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
                        O23 - Service: ServicepointService - Radialpoint Inc. - C:\Program Files (x86)\Verizon\VSP\ServicepointService.exeC:\Program Files (x86)\Verizon\VSP\ServicepointService.exe
                        O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
                        O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
                        O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
                        O23 - Service: SupportSoft Sprocket Service (verizondm) (sprtsvc_verizondm) - SupportSoft, Inc. - C:\Program Files (x86)\VERIZONDM\bin\sprtsvc.exeC:\Program Files (x86)\VERIZONDM\bin\sprtsvc.exe
                        O23 - Service: SupportSoft Repair Service (verizondm) (tgsrvc_verizondm) - SupportSoft, Inc. - C:\Program Files (x86)\VERIZONDM\bin\tgsrvc.exeC:\Program Files (x86)\VERIZONDM\bin\tgsrvc.exe
                        O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
                        O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
                        O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
                        O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
                        O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

                        --
                        End of file - 22393 bytes


                        OK, now I am very proud of myself - haha  :)
                        Logged

                        SuperDave

                        • Malware Removal Specialist


                          • Genius
                          • Thanked: 1020
                        • Certifications: List
                        • Experience: Expert
                        • OS: Windows 10
                        Re: Malware removal - can't perform any suggested steps with .exe file
                        « Reply #16 on: August 17, 2010, 01:29:42 PM »
                        Quote
                        OK, now I am very proud of myself - haha 
                        Good job well done!

                        Update Your Java (JRE)

                        Old versions of Java have vulnerabilities that malware can use to infect your system.

                        First Verify your Java Version

                        If there are any other version(s) installed then update now.

                        Get the new version (if needed)

                        If your version is out of date install the newest version of the Sun Java Runtime Environment.

                        Note: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

                        Be sure to close ALL open web browsers before starting the installation.

                        Remove any old versions

                        1. Download JavaRa and unzip the file to your Desktop.
                        2. Open JavaRA.exe and choose Remove Older Versions
                        3. Once complete exit JavaRA.
                        4. Run CCleaner.

                        Additional Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and reboot your computer.

                        *************************************

                        Please download the newest version of Adobe Acrobat Reader from Adobe.com

                        Before installing: it is important to remove older versions of Acrobat Reader since it does not do so automatically and old versions still leave you vulnerable.
                        Go to the Control Panel and enter Add or Remove Programs.
                        Search in the list for all previous installed versions of Adobe Acrobat Reader. Uninstall/Remove each of them.

                        Once old versions are gone, please install the newest version.

                        ***************************************

                        Open HijackThis and select Do a system scan only

                        Place a check mark next to the following entries: (if there)

                        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:6522
                        O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
                        O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
                        O4 - HKCU\..\Run: [rjyqbvyn]

                        Important: Close all open windows except for HijackThis and then click Fix checked.

                        Once completed, exit HijackThis.

                        ****************************************

                        Download ComboFix by sUBs from one of the below links. 

                        Important! You MUST save ComboFix to your desktop

                        link # 1
                        Link # 2

                        Temporarily disable your Anti-virus and any Antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

                        Double click on ComboFix.exe & follow the prompts.

                        Vista users Right-Click on ComboFix.exe and select Run as administrator (you will receive a UAC prompt, please allow it)

                        Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

                        When the scan completes it will open a text window.
                         
                        Post the contents of that log in your next reply.

                        Remember to re-enable your Anti-virus and Antispyware protection when ComboFix is complete.
                        Logged
                        Windows 8 and Windows 10 dual boot with two SSD's

                        lcarco

                          Topic Starter


                          Rookie

                          Re: Malware removal - can't perform any suggested steps with .exe file
                          « Reply #17 on: August 18, 2010, 08:18:59 PM »
                          I did everything, except ComboFix will not install is pops u[ an Error - Win32 only.

                          I have 64 bit, Vista.
                          Logged

                          SuperDave

                          • Malware Removal Specialist


                            • Genius
                            • Thanked: 1020
                          • Certifications: List
                          • Experience: Expert
                          • OS: Windows 10
                          Re: Malware removal - can't perform any suggested steps with .exe file
                          « Reply #18 on: August 19, 2010, 01:11:49 PM »
                          Quote
                          I have 64 bit, Vista.
                          Oops. 64 bit machines severely limits the number of tools I can use to clean your computer. Sorry.

                          Download OTL  to your Desktop
                          • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
                          • Under the Custom Scan box paste this in
                          netsvcs
                          msconfig
                          safebootminimal
                          safebootnetwork
                          activex
                          drivers32
                          %SYSTEMDRIVE%\*.exe
                          %systemroot%\*. /mp /s
                          c:\$recycle.bin\*.* /s
                          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
                          /md5start
                          eventlog.dll
                          scecli.dll
                          netlogon.dll
                          cngaudit.dll
                          sceclt.dll
                          ntelogon.dll
                          logevent.dll
                          iaStor.sys
                          nvstor.sys
                          nvstor32.sys
                          atapi.sys
                          IdeChnDr.sys
                          viasraid.sys
                          AGP440.sys
                          vaxscsi.sys
                          nvatabus.sys
                          viamraid.sys
                          nvata.sys
                          nvgts.sys
                          iastorv.sys
                          ViPrt.sys
                          eNetHook.dll
                          explorer.exe
                          svchost.exe
                          userinit.exe
                          qmgr.dll
                          ws2_32.dll
                          proquota.exe
                          imm32.dll
                          kernel32.dll
                          ndis.sys
                          autochk.exe
                          spoolsv.exe
                          xmlprov.dll
                          ntmssvc.dll
                          mswsock.dll
                          Beep.SYS
                          ntfs.sys
                          termsrv.dll
                          sfcfiles.dll
                          st3shark.sys
                          ahcix86.sys
                          srsvc.dll
                          nvrd32.sys
                          /md5stop
                          %systemroot%\system32\*.dll /lockedfiles
                          %systemroot%\Tasks\*.job /lockedfiles
                          • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
                            • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
                            • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time
                          Logged
                          Windows 8 and Windows 10 dual boot with two SSD's

                          lcarco

                            Topic Starter


                            Rookie

                            Re: Malware removal - can't perform any suggested steps with .exe file
                            « Reply #19 on: August 22, 2010, 01:10:51 PM »
                            ok, sorry I've been delinquent!  The computer at this point seems to be working ok but not sure the problem is 100% solved (ya never know right??).

                            Here is the OTL log:

                            OTL logfile created on: 8/22/2010 1:14:00 PM - Run 1
                            OTL by OldTimer - Version 3.2.10.0     Folder = C:\Users\Lisa\Desktop
                            64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
                            Internet Explorer (Version = 8.0.6001.18943)
                            Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
                             
                            4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 52.00% Memory free
                            8.00 Grb Paging File | 6.00 Gb Available in Paging File | 73.00% Paging File free
                            Paging file location(s): ?:\pagefile.sys [binary data]
                             
                            %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
                            Drive C: | 219.91 Gb Total Space | 68.89 Gb Free Space | 31.32% Space Free | Partition Type: NTFS
                            Drive D: | 12.97 Gb Total Space | 2.43 Gb Free Space | 18.77% Space Free | Partition Type: NTFS
                            Drive E: | 7.24 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
                            F: Drive not present or media not loaded
                            G: Drive not present or media not loaded
                            H: Drive not present or media not loaded
                            I: Drive not present or media not loaded
                             
                            Computer Name: LISA-LAPTOP
                            Current User Name: Lisa
                            Logged in as Administrator.
                             
                            Current Boot Mode: Normal
                            Scan Mode: Current user
                            Include 64bit Scans
                            Company Name Whitelist: On
                            Skip Microsoft Files: On
                            File Age = 90 Days
                            Output = Standard
                            Quick Scan
                             
                            ========== Processes (SafeList) ==========
                             
                            PRC - [2010/08/22 13:10:52 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Lisa\Desktop\OTL.exe
                            PRC - [2010/06/19 12:36:46 | 000,640,440 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
                            PRC - [2010/06/11 09:37:26 | 000,185,640 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\VERIZONDM\bin\tgsrvc.exe
                            PRC - [2010/06/11 09:37:24 | 000,206,120 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\VERIZONDM\bin\sprtsvc.exe
                            PRC - [2010/06/11 09:37:10 | 000,206,120 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\VERIZONDM\bin\sprtcmd.exe
                            PRC - [2010/05/14 11:00:26 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
                            PRC - [2010/04/22 10:25:38 | 000,039,408 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                            PRC - [2010/03/17 16:53:24 | 000,207,872 | ---- | M] (Alcatel-Lucent) -- C:\Program Files (x86)\Common Files\Motive\McciContextHookShim.exe
                            PRC - [2010/02/12 11:02:08 | 000,240,992 | ---- | M] (Microsoft Corp.) -- C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0401.0\mswinext.exe
                            PRC - [2010/02/09 17:07:22 | 001,275,408 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\Internet Content Filter\mfp.exe
                            PRC - [2010/01/26 20:58:38 | 000,256,280 | R--- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10e.exe
                            PRC - [2009/11/18 10:50:40 | 000,668,912 | ---- | M] (Radialpoint Inc.) -- C:\Program Files (x86)\Verizon\VSP\ServicepointService.exe
                            PRC - [2009/11/18 10:50:32 | 000,468,208 | ---- | M] (Radialpoint Inc.) -- C:\Program Files (x86)\Verizon\VSP\VerizonServicepointComHandler.exe
                            PRC - [2009/11/18 10:50:30 | 004,269,296 | ---- | M] (Verizon) -- C:\Program Files (x86)\Verizon\VSP\VerizonServicepoint.exe
                            PRC - [2009/08/05 22:11:05 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
                            PRC - [2009/05/13 16:48:22 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
                            PRC - [2009/04/11 02:28:15 | 000,247,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
                            PRC - [2009/03/02 13:08:47 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
                            PRC - [2008/08/01 20:10:54 | 000,675,840 | ---- | M] (Sonix) -- C:\Windows\vsnp2uvc.exe
                            PRC - [2008/04/15 18:54:42 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
                            PRC - [2008/04/15 18:54:40 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
                             
                             
                            ========== Modules (SafeList) ==========
                             
                            MOD - [2010/08/22 13:10:52 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Lisa\Desktop\OTL.exe
                            MOD - [2008/01/20 22:50:01 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\msscript.ocx
                             
                             
                            ========== Win32 Services (SafeList) ==========
                             
                            SRV:64bit: - [2010/06/29 13:49:27 | 000,128,752 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE -- (!SASCORE)
                            SRV:64bit: - [2009/10/28 10:05:15 | 001,038,088 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64)
                            SRV:64bit: - [2009/08/18 12:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
                            SRV:64bit: - [2008/01/20 22:47:32 | 000,383,544 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
                            SRV - [2010/06/11 09:37:26 | 000,185,640 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\VERIZONDM\bin\tgsrvc.exe -- (tgsrvc_verizondm) SupportSoft Repair Service (verizondm)
                            SRV - [2010/06/11 09:37:24 | 000,206,120 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\VERIZONDM\bin\sprtsvc.exe -- (sprtsvc_verizondm) SupportSoft Sprocket Service (verizondm)
                            SRV - [2010/05/14 11:00:26 | 000,249,136 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
                            SRV - [2010/03/18 14:27:14 | 001,020,768 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
                            SRV - [2010/03/18 14:27:14 | 000,138,576 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_64)
                            SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
                            SRV - [2010/02/10 19:11:00 | 000,020,480 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Verizon\Online Backup & Sharing\Scheduler\OnlineBackup.SchedulerService.exe -- (OnlineBackupSchedulerService)
                            SRV - [2010/02/09 17:13:32 | 000,275,456 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files (x86)\Internet Content Filter\UpdateService.exe -- (fpUpdateSvc)
                            SRV - [2010/02/02 20:02:52 | 000,024,576 | ---- | M] (DigiData Corp.) [Auto | Running] -- C:\Program Files (x86)\Verizon\Online Backup & Sharing\Filesystem Watcher\DigiData.FilesystemWatcher.Service.Watcher.exe -- (FilesystemWatcher)
                            SRV - [2009/11/18 10:50:40 | 000,668,912 | ---- | M] (Radialpoint Inc.) [Auto | Running] -- C:\Program Files (x86)\Verizon\VSP\ServicepointService.exe -- (ServicepointService)
                            SRV - [2009/10/28 10:02:52 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
                            SRV - [2009/08/05 22:11:05 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
                            SRV - [2009/05/13 16:48:22 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
                            SRV - [2008/08/15 05:46:20 | 000,284,016 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe -- (Adobe Version Cue CS4)
                            SRV - [2008/04/15 18:54:42 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
                            SRV - [2007/03/05 13:30:06 | 000,110,592 | ---- | M] (Hewlett-Packard Development Company, L.P.) [On_Demand | Stopped] -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe -- (Com4Qlb)
                             
                             
                            ========== Driver Services (SafeList) ==========
                             
                            DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\SymIM.sys -- (SymIMMP)
                            DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\SymIM.sys -- (SymIM)
                            DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
                            DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
                            DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ipinip.sys -- (IpInIp)
                            DRV:64bit: - [2009/12/07 10:30:10 | 000,074,880 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\DRIVERS\avgntflt.sys -- (avgntflt)
                            DRV:64bit: - [2009/09/30 20:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
                            DRV:64bit: - [2009/08/28 20:42:52 | 000,049,152 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\usbaapl64.sys -- (USBAAPL64)
                            DRV:64bit: - [2009/06/09 17:16:06 | 003,557,376 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
                            DRV:64bit: - [2009/05/18 15:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM)
                            DRV:64bit: - [2009/04/11 01:03:32 | 000,111,104 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\sdbus.sys -- (sdbus)
                            DRV:64bit: - [2008/07/07 13:23:56 | 000,025,600 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\NwUsbCdFil64.sys -- (NWUSBCDFIL64)
                            DRV:64bit: - [2008/06/02 17:28:52 | 000,247,808 | ---- | M] (Novatel Wireless Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\NWADIenum.sys -- (NWADI)
                            DRV:64bit: - [2008/05/09 12:08:40 | 000,213,120 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\nwusbser2.sys -- (NWUSBPort2)
                            DRV:64bit: - [2008/05/09 12:08:40 | 000,213,120 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\nwusbser.sys -- (NWUSBPort)
                            DRV:64bit: - [2008/05/09 12:08:40 | 000,213,120 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\nwusbmdm.sys -- (NWUSBModem)
                            DRV:64bit: - [2008/04/15 18:54:16 | 000,388,120 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\iaStor.sys -- (iaStor)
                            DRV:64bit: - [2008/01/20 22:49:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\RootMdm.sys -- (ROOTMODEM)
                            DRV:64bit: - [2008/01/20 22:46:57 | 001,523,712 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\VSTDPV6.SYS -- (HSF_DPV)
                            DRV:64bit: - [2008/01/20 22:46:57 | 000,724,480 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\VSTCNXT6.SYS -- (winachsf)
                            DRV:64bit: - [2008/01/20 22:46:57 | 000,286,720 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\VSTAZL6.SYS -- (HSFHWAZL)
                            DRV:64bit: - [2008/01/18 07:31:30 | 000,320,560 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\SynTP.sys -- (SynTP)
                            DRV:64bit: - [2007/09/17 19:17:46 | 000,135,680 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys -- (RTL8169)
                            DRV:64bit: - [2007/07/11 13:30:34 | 000,009,088 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\HpqRemHid.sys -- (HpqRemHid)
                            DRV:64bit: - [2007/06/28 11:09:56 | 003,148,288 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\NETw4v64.sys -- (NETw4v64) Intel(R)
                            DRV:64bit: - [2007/06/18 20:13:12 | 000,018,432 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\HpqKbFiltr.sys -- (HpqKbFiltr)
                            DRV:64bit: - [2007/05/31 14:39:32 | 000,027,520 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\RimUsb_AMD64.sys -- (RimUsb)
                            DRV:64bit: - [2007/05/01 04:00:00 | 000,052,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\PxHlpa64.sys -- (PxHlpa64)
                            DRV:64bit: - [2007/03/26 22:48:24 | 000,055,808 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\rixdpx64.sys -- (rismxdp)
                            DRV:64bit: - [2007/03/19 15:09:36 | 000,055,808 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\rimmpx64.sys -- (rimmptsk)
                            DRV:64bit: - [2007/02/27 19:10:38 | 000,053,760 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\rimspx64.sys -- (rimsptsk)
                            DRV:64bit: - [2007/01/18 16:10:22 | 000,030,336 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\RimSerial_AMD64.sys -- (RimVSerPort)
                            DRV:64bit: - [2007/01/17 09:48:30 | 001,455,616 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\smserial.sys -- (smserial)
                            DRV:64bit: - [2006/10/09 22:09:03 | 000,742,696 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\nvm60x64.sys -- (NVENETFD)
                            DRV:64bit: - [2006/10/06 22:13:22 | 000,550,912 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\bcmwl664.sys -- (BCM43XV)
                            DRV:64bit: - [2006/09/18 17:36:24 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\Wbem\ntfs.mof -- (Ntfs)
                            DRV - [2010/03/17 16:53:38 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Motive\MREMP50.sys -- (MREMP50)
                            DRV - [2010/03/17 16:53:22 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Motive\MRESP50.sys -- (MRESP50)
                            DRV - [2009/03/20 20:03:36 | 000,043,032 | ---- | M] (Smith Micro Inc.) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\Verizon Wireless\VZAccess Manager\SMSIVZAM5X64.sys -- (SMSIVZAM5X64)
                            DRV - [2008/08/14 07:57:42 | 000,074,720 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysWow64\drivers\adfs.sys -- (adfs)
                             
                             
                            ========== Standard Registry (SafeList) ==========
                             
                             
                            ========== Internet Explorer ==========
                             
                            IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
                            IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
                            IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
                            IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
                            IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
                             
                            IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
                            IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
                            IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=ho_central
                            IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
                            IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
                            IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
                            IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522
                             
                            ========== FireFox ==========
                             
                            FF - prefs.js..browser.startup.homepage: "http://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=ho_central"
                            FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:3.3.0.3971
                            FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546
                             
                             
                            FF - HKLM\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010/08/20 03:03:48 | 000,000,000 | ---D | M]
                            FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/08/16 22:44:40 | 000,000,000 | ---D | M]
                            FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/08/19 22:19:51 | 000,000,000 | ---D | M]
                             
                            [2008/08/29 16:19:26 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\Mozilla\Extensions
                            [2010/08/16 21:10:08 | 000,000,000 | ---D | M] -- C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\extensions
                            [2009/09/03 12:31:02 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
                            [2009/09/24 21:08:55 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\wo7p8zwu.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
                            [2010/08/18 22:12:34 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\Mozilla Firefox\extensions
                            [2010/08/18 22:12:34 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
                            [2010/07/17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
                             
                            O1 HOSTS File: ([2006/09/18 17:37:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
                            O1 - Hosts: 127.0.0.1       localhost
                            O1 - Hosts: ::1             localhost
                            O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
                            O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
                            O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg64.dll (Google Inc.)
                            O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
                            O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
                            O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
                            O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
                            O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
                            O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
                            O2 - BHO: (MSN Toolbar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN Toolbar\Platform\4.0.0401.0\npwinext.dll (Microsoft Corporation)
                            O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
                            O2 - BHO: (HP Print Clips) - {FFFFFFFF-FF12-44C5-91EC-068E3AA1B2D7} - c:\Program Files (x86)\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.)
                            O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
                            O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
                            O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
                            O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
                            O3 - HKLM\..\Toolbar: (MSN Toolbar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\Program Files (x86)\MSN Toolbar\Platform\4.0.0401.0\npwinext.dll (Microsoft Corporation)
                            O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
                            O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
                            O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
                            O4:64bit: - HKLM..\Run: [HP Health Check Scheduler]  File not found
                            O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)
                            O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor)
                            O4:64bit: - HKLM..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
                            O4:64bit: - HKLM..\Run: [snp2uvc] C:\Windows\vsnp2uvc.exe (Sonix)
                            O4:64bit: - HKLM..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe (Alcatel-Lucent)
                            O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
                            O4 - HKLM..\Run: []  File not found
                            O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
                            O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
                            O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
                            O4 - HKLM..\Run: [Adobe_ID0ENQBO] C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4Tray.exe (Adobe Systems Incorporated)
                            O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
                            O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
                            O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
                            O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
                            O4 - HKLM..\Run: [ICF] C:\Program Files (x86)\Internet Content Filter\mfp.exe (McAfee, Inc.)
                            O4 - HKLM..\Run: [Microsoft Default Manager] C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corporation)
                            O4 - HKLM..\Run: [MSN Toolbar] c:\Program Files (x86)\MSN Toolbar\Platform\4.0.0401.0\mswinext.exe (Microsoft Corp.)
                            O4 - HKLM..\Run: [Online Backup Auto Update] C:\Program Files (x86)\Verizon\Online Backup & Sharing\Auto Update\OnlineBackup.UpdateSystemTray.exe ()
                            O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
                            O4 - HKLM..\Run: [UCam_Menu] C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
                            O4 - HKLM..\Run: [Vault Explorer Cache Watcher] C:\Program Files (x86)\Verizon\Online Backup & Sharing\vewatch.exe (DigiData Corp.)
                            O4 - HKLM..\Run: [VERIZONDM] C:\Program Files (x86)\VERIZONDM\bin\sprtcmd.exe (SupportSoft, Inc.)
                            O4 - HKLM..\Run: [VerizonServicepoint.exe] C:\Program Files (x86)\Verizon\VSP\VerizonServicepoint.exe (Verizon)
                            O4 - HKCU..\Run: [AdobeBridge]  File not found
                            O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
                            O4 - HKCU..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
                            O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
                            O8:64bit: - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
                            O8:64bit: - Extra context menu item: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
                            O8:64bit: - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
                            O8:64bit: - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
                            O8:64bit: - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
                            O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
                            O8 - Extra context menu item: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
                            O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
                            O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
                            O8 - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
                            O9 - Extra Button: HP Smart Select - {58ECB495-38F0-49cb-A538-10282ABF65E7} - c:\Program Files (x86)\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
                            O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SYSWOW64\icf.dll (McAfee, Inc.)
                            O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SYSWOW64\icf.dll (McAfee, Inc.)
                            O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SYSWOW64\icf.dll (McAfee, Inc.)
                            O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SYSWOW64\icf.dll (McAfee, Inc.)
                            O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\SYSWOW64\icf.dll (McAfee, Inc.)
                            O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SYSWOW64\icf.dll (McAfee, Inc.)
                            O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SYSWOW64\icf.dll (McAfee, Inc.)
                            O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SYSWOW64\icf.dll (McAfee, Inc.)
                            O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SYSWOW64\icf.dll (McAfee, Inc.)
                            O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\SYSWOW64\icf.dll (McAfee, Inc.)
                            O13 - gopher Prefix: missing
                            O13 - gopher Prefix: missing
                            O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} http://picasaweb.google.com/s/v/62.12/uploader2.cab (UploadListView Class)
                            O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab (DLM Control)
                            O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} http://picture.vzw.com/activex/VerizonWirelessUploadControl.cab (Verizon Wireless Media Upload)
                            O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
                            O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
                            O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04)
                            O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
                            O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
                            O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
                            O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
                            O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 71.250.0.12
                            O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
                            O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
                            O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
                            O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
                            O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
                            O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\HPSplash.jpg
                            O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\HPSplash.jpg
                            O32 - HKLM CDRom: AutoRun - 1
                            O32 - AutoRun File - [2005/09/11 11:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ]
                            O33 - MountPoints2\{0d1e4c97-6bbf-11de-818e-001e68767086}\Shell - "" = AutoRun
                            O33 - MountPoints2\{60aed025-a83a-11de-9cc3-001e68767086}\Shell - "" = AutoRun
                            O33 - MountPoints2\{b9b5e17e-5c46-11de-8b9b-001e68767086}\Shell - "" = AutoRun
                            O33 - MountPoints2\{dc3f7eeb-ef0c-11de-8248-001e68767086}\Shell - "" = AutoRun
                            O33 - MountPoints2\{dc3f7f27-ef0c-11de-8248-001e68767086}\Shell - "" = AutoRun
                            O33 - MountPoints2\{dc3f7f27-ef0c-11de-8248-001e68767086}\Shell\AutoRun\command - "" = F:\VZAccess_Manager.exe -- File not found
                            O33 - MountPoints2\F\Shell - "" = AutoRun
                            O33 - MountPoints2\G\Shell - "" = AutoRun
                            O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
                            O35:64bit: - HKLM\..comfile [open] -- "%1" %*
                            O35:64bit: - HKLM\..exefile [open] -- "%1" %*
                            O35 - HKLM\..comfile [open] -- "%1" %*
                            O35 - HKLM\..exefile [open] -- "%1" %*
                            O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
                            O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
                            O37 - HKLM\...com [@ = comfile] -- "%1" %*
                            O37 - HKLM\...exe [@ = exefile] -- "%1" %*
                             
                             
                             
                            SafeBootMin:64bit: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)
                            SafeBootMin:64bit: AppMgmt - Service
                            SafeBootMin:64bit: Base - Driver Group
                            SafeBootMin:64bit: Boot Bus Extender - Driver Group
                            SafeBootMin:64bit: Boot file system - Driver Group
                            SafeBootMin:64bit: File system - Driver Group
                            SafeBootMin:64bit: Filter - Driver Group
                            SafeBootMin:64bit: HelpSvc - Service
                            SafeBootMin:64bit: mcmscsvc - Service
                            SafeBootMin:64bit: MCODS - Service
                            SafeBootMin:64bit: PCI Configuration - Driver Group
                            SafeBootMin:64bit: PEVSystemStart - Service
                            SafeBootMin:64bit: PNP Filter - Driver Group
                            SafeBootMin:64bit: Primary disk - Driver Group
                            SafeBootMin:64bit: procexp90.Sys - Driver
                            SafeBootMin:64bit: sacsvr - Service
                            SafeBootMin:64bit: SCSI Class - Driver Group
                            SafeBootMin:64bit: System Bus Extender - Driver Group
                            SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
                            SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
                            SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
                            SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
                            SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
                            SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
                            SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
                            SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
                            SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
                            SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
                            SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
                            SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
                            SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
                            SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
                            SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
                            SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
                            SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
                            SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
                            SafeBootMin: AppMgmt - Service
                            SafeBootMin: Base - Driver Group
                            SafeBootMin: Boot Bus Extender - Driver Group
                            SafeBootMin: Boot file system - Driver Group
                            SafeBootMin: File system - Driver Group
                            SafeBootMin: Filter - Driver Group
                            SafeBootMin: HelpSvc - Service
                            SafeBootMin: mcmscsvc - Service
                            SafeBootMin: MCODS - Service
                            SafeBootMin: PCI Configuration - Driver Group
                            SafeBootMin: PEVSystemStart - Service
                            SafeBootMin: PNP Filter - Driver Group
                            SafeBootMin: Primary disk - Driver Group
                            SafeBootMin: procexp90.Sys - Driver
                            SafeBootMin: sacsvr - Service
                            SafeBootMin: SCSI Class - Driver Group
                            SafeBootMin: System Bus Extender - Driver Group
                            SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
                            SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
                            SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
                            SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
                            SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
                            SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
                            SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
                            SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
                            SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
                            SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
                            SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
                            SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
                            SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
                            SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
                            SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
                            SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
                            SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
                             
                            SafeBootNet:64bit: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware.com)
                            SafeBootNet:64bit: AppMgmt - Service
                            SafeBootNet:64bit: Base - Driver Group
                            SafeBootNet:64bit: Boot Bus Extender - Driver Group
                            SafeBootNet:64bit: Boot file system - Driver Group
                            SafeBootNet:64bit: File system - Driver Group
                            SafeBootNet:64bit: Filter - Driver Group
                            SafeBootNet:64bit: HelpSvc - Service
                            SafeBootNet:64bit: mcmscsvc - Service
                            SafeBootNet:64bit: MCODS - Service
                            SafeBootNet:64bit: Messenger - Service
                            SafeBootNet:64bit: MpfService - Service
                            SafeBootNet:64bit: NDIS Wrapper - Driver Group
                            SafeBootNet:64bit: NetBIOSGroup - Driver Group
                            SafeBootNet:64bit: NetDDEGroup - Driver Group
                            SafeBootNet:64bit: Network - Driver Group
                            SafeBootNet:64bit: NetworkProvider - Driver Group
                            SafeBootNet:64bit: PCI Configuration - Driver Group
                            SafeBootNet:64bit: PEVSystemStart - Service
                            SafeBootNet:64bit: PNP Filter - Driver Group
                            SafeBootNet:64bit: PNP_TDI - Driver Group
                            SafeBootNet:64bit: Primary disk - Driver Group
                            SafeBootNet:64bit: procexp90.Sys - Driver
                            SafeBootNet:64bit: rdsessmgr - Service
                            SafeBootNet:64bit: sacsvr - Service
                            SafeBootNet:64bit: SCSI Class - Driver Group
                            SafeBootNet:64bit: Streams Drivers - Driver Group
                            SafeBootNet:64bit: System Bus Extender - Driver Group
                            SafeBootNet:64bit: TDI - Driver Group
                            SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
                            SafeBootNet:64bit: WudfPf - Driver
                            SafeBootNet:64bit: WudfUsbccidDriver - Driver
                            SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
                            SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
                            SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
                            SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
                            SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
                            SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
                            SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
                            SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
                            SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
                            SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
                            SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
                            SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
                            SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
                            SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
                            SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
                            SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
                            SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
                            SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
                            SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
                            SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
                            SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
                            SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
                            SafeBootNet: AppMgmt - Service
                            SafeBootNet: Base - Driver Group
                            SafeBootNet: Boot Bus Extender - Driver Group
                            SafeBootNet: Boot file system - Driver Group
                            SafeBootNet: File system - Driver Group
                            SafeBootNet: Filter - Driver Group
                            SafeBootNet: HelpSvc - Service
                            SafeBootNet: mcmscsvc - Service
                            SafeBootNet: MCODS - Service
                            SafeBootNet: Messenger - Service
                            SafeBootNet: MpfService - Service
                            SafeBootNet: NDIS Wrapper - Driver Group
                            SafeBootNet: NetBIOSGroup - Driver Group
                            SafeBootNet: NetDDEGroup - Driver Group
                            SafeBootNet: Network - Driver Group
                            SafeBootNet: NetworkProvider - Driver Group
                            SafeBootNet: PCI Configuration - Driver Group
                            SafeBootNet: PEVSystemStart - Service
                            SafeBootNet: PNP Filter - Driver Group
                            SafeBootNet: PNP_TDI - Driver Group
                            SafeBootNet: Primary disk - Driver Group
                            SafeBootNet: procexp90.Sys - Driver
                            SafeBootNet: rdsessmgr - Service
                            SafeBootNet: sacsvr - Service
                            SafeBootNet: SCSI Class - Driver Group
                            SafeBootNet: Streams Drivers - Driver Group
                            SafeBootNet: System Bus Extender - Driver Group
                            SafeBootNet: TDI - Driver Group
                            SafeBootNet: WudfPf - Driver
                            SafeBootNet: WudfUsbccidDriver - Driver
                            SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
                            SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
                            SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
                            SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
                            SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
                            SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
                            SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
                            SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
                            SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
                            SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
                            SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
                            SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
                            SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
                            SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
                            SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
                            SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
                            SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
                            SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
                            SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
                            SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
                            SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
                            SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
                             
                            ActiveX:64bit: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
                            ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
                            ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
                            ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
                            ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
                            ActiveX:64bit: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
                            ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
                            ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
                            ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
                            ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
                            ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
                            ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
                            ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
                            ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
                            ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
                            ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
                            ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
                            ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
                            ActiveX:64bit: {96BFD4F7-F575-5C17-05D3-688924F854EB} - Browser Customizations
                            ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
                            ActiveX:64bit: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
                            ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
                            ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
                            ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
                            ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
                            ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
                            ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
                            ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
                            ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
                            ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
                            ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
                            ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
                            ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player
                            ActiveX: {25E8E74C-C20D-210C-870C-510830400FBC} - Microsoft Windows Media Player
                            ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
                            ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
                            ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
                            ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
                            ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
                            ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
                            ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
                            ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
                            ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
                            ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
                            ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
                            ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
                            ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
                            ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
                            ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
                            ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
                            ActiveX: {B466C5AD-B9F4-24CE-66A7-2AF39C67E7A7} - Microsoft VM
                            ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
                            ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
                            ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
                            ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
                            ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
                            ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
                            ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
                            ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
                             
                            Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
                            Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
                            Drivers32: msacm.l3codecp - C:\Windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
                            Drivers32: vidc.3IV2 - C:\Windows\SysWow64\3ivxVfWCodec.dll (3ivx Technologies Pty. Ltd.)
                            Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
                             
                            ========== Files/Folders - Created Within 90 Days ==========
                             
                            [2010/08/22 13:10:48 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\Lisa\Desktop\OTL.exe
                            [2010/08/20 03:24:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Portable Devices
                            [2010/08/20 03:24:28 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Portable Devices
                            [2010/08/20 03:03:46 | 000,000,000 | -HSD | C] -- C:\Config.Msi
                            [2010/08/19 11:00:37 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\vi-VN
                            [2010/08/19 11:00:37 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\eu-ES
                            [2010/08/19 11:00:37 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\eu-ES
                            [2010/08/19 11:00:37 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\ca-ES
                            [2010/08/19 11:00:37 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\ca-ES
                            [2010/08/19 11:00:33 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\vi-VN
                            [2010/08/19 10:31:01 | 000,000,000 | ---D | C] -- C:\Users\Lisa\Desktop\virus stuff
                            [2010/08/18 22:37:52 | 000,000,000 | ---D | C] -- C:\Users\Lisa\Desktop\TURTLE template 8610-446 *censored*
                            [2010/08/18 22:32:10 | 000,000,000 | R--D | C] -- C:\32788R22FWJFW
                            [2010/08/18 22:23:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft
                            [2010/08/18 22:23:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSN Toolbar
                            [2010/08/18 22:17:02 | 000,000,000 | ---D | C] -- C:\Windows\Sun
                            [2010/08/18 22:14:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSN Toolbar Installer
                            [2010/08/18 22:14:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
                            [2010/08/17 10:49:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro
                            [2010/08/17 08:11:37 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Roaming\SUPERAntiSpyware.com
                            [2010/08/17 08:11:27 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
                            [2010/08/14 15:18:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CCleaner
                            [2010/08/13 22:14:55 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Roaming\Malwarebytes
                            [2010/08/13 22:14:43 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
                            [2010/08/13 22:14:41 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
                            [2010/08/13 22:14:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
                            [2010/08/13 22:14:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
                            [2010/08/13 13:47:10 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
                            [2010/08/13 13:47:05 | 000,000,000 | ---D | C] -- C:\ProgramData\!SASCORE
                            [2010/08/13 09:58:32 | 000,000,000 | ---D | C] -- C:\Users\Lisa\Desktop\INNOVATION
                            [2010/08/12 23:03:56 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\tconxtygj
                            [2010/08/12 09:38:16 | 000,000,000 | ---D | C] -- C:\Users\Lisa\Desktop\Converted
                            [2010/08/10 16:15:47 | 000,000,000 | ---D | C] -- C:\Users\Lisa\Documents\Joe Z Banner file (3)
                            [2010/08/04 20:23:07 | 000,000,000 | ---D | C] -- C:\Users\Lisa\Documents\personal and confidential
                            [2010/07/30 15:33:44 | 000,000,000 | ---D | C] -- C:\Users\Lisa\Desktop\File Folders USB Files
                            [2010/07/30 15:15:18 | 000,000,000 | ---D | C] -- C:\Users\Lisa\Documents\Resumes
                            [2010/07/30 15:14:42 | 000,000,000 | ---D | C] -- C:\Users\Lisa\Documents\Personal
                            [2010/07/27 11:57:24 | 000,000,000 | ---D | C] -- C:\Users\Lisa\Desktop\SOE documents
                            [2010/07/26 09:24:45 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Roaming\Motive
                            [2010/07/26 09:24:42 | 000,000,000 | ---D | C] -- C:\Program Files\Verizon
                            [2010/07/22 10:33:07 | 000,000,000 | ---D | C] -- C:\Users\Lisa\Desktop\Verizon
                            [2010/07/21 18:53:39 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Roaming\Verizon
                            [2010/07/21 18:53:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Radialpoint
                            [2010/07/21 18:53:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Verizon
                            [2010/07/21 18:53:28 | 000,000,000 | ---D | C] -- C:\Windows\bin
                            [2010/07/21 18:52:45 | 000,409,928 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysNative\seinst.dll
                            [2010/07/21 18:52:45 | 000,378,696 | ---- | C] (McAfee, Inc.) -- C:\Windows\sediag.exe
                            [2010/07/21 18:52:45 | 000,318,280 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysWow64\seinst.dll
                            [2010/07/21 18:52:45 | 000,299,024 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysWow64\ICF.dll
                            [2010/07/21 18:52:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Internet Content Filter
                            [2010/07/21 18:52:42 | 000,335,376 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysNative\ICF.dll
                            [2010/07/21 18:51:45 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\Citrix
                            [2010/07/21 18:50:44 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\Apps
                            [2010/07/21 18:50:41 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\Deployment
                            [2010/07/21 18:47:14 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
                            [2010/07/21 18:46:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\verizon_broad
                            [2010/07/21 18:46:54 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Roaming\DigiData
                            [2010/07/21 18:46:26 | 000,000,000 | ---D | C] -- C:\ProgramData\DigiData
                            [2010/07/21 18:46:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Verizon Online Backup
                            [2010/07/21 18:44:21 | 000,000,000 | ---D | C] -- C:\Windows\FIOS
                            [2010/07/21 18:13:48 | 000,000,000 | ---D | C] -- C:\Users\Lisa\AppData\Local\SupportSoft
                            [2010/07/21 18:13:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VERIZONDM
                            [2010/07/21 18:13:30 | 000,000,000 | ---D | C] -- C:\ProgramData\SupportSoft
                            [2010/07/21 18:13:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\SupportSoft
                            [2010/07/21 17:19:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Motive
                            [2010/07/21 17:19:18 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Motive
                            [2010/07/21 17:19:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Motive
                            [2010/07/21 17:15:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Verizon
                            [2010/07/14 12:49:07 | 000,000,000 | ---D | C] -- C:\Users\Lisa\Documents\Aurobindo Generics Support Catalogue and Monograph (2)
                            [2010/06/15 09:51:36 | 000,000,000 | ---D | C] -- C:\Users\Lisa\Desktop\RE new ecard_files
                            [2010/05/26 09:55:20 | 000,000,000 | ---D | C] -- C:\Users\Lisa\Desktop\Repository
                            [1 C:\Users\Lisa\Desktop\*.tmp files -> C:\Users\Lisa\Desktop\*.tmp -> ]
                             
                            ========== Files - Modified Within 90 Days ==========
                             
                            [2010/08/22 13:14:08 | 004,718,592 | -HS- | M] () -- C:\Users\Lisa\NTUSER.DAT
                            [2010/08/22 13:10:52 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Lisa\Desktop\OTL.exe
                            [2010/08/22 12:38:35 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
                            [2010/08/22 12:38:34 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
                            [2010/08/22 12:22:00 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
                            [2010/08/22 10:38:50 | 000,060,096 | ---- | M] () -- C:\ProgramData\nvModes.dat
                            [2010/08/22 10:38:48 | 000,060,096 | ---- | M] () -- C:\ProgramData\nvModes.001
                            [2010/08/22 10:38:40 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
                            [2010/08/21 17:04:43 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
                            [2010/08/20 09:54:01 | 000,000,703 | ---- | M] () -- C:\Users\Public\Documents\hpqp.ini
                            [2010/08/20 03:35:23 | 000,703,388 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
                            [2010/08/20 03:35:23 | 000,604,502 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
                            [2010/08/20 03:35:23 | 000,104,170 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
                            [2010/08/20 03:27:37 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
                            [2010/08/20 03:26:56 | 4293,320,704 | -HS- | M] () -- C:\hiberfil.sys
                            [2010/08/20 03:24:03 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
                            [2010/08/20 03:23:46 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_07_00.Wdf
                            [2010/08/20 03:23:39 | 000,524,288 | -HS- | M] () -- C:\Users\Lisa\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TMContainer00000000000000000001.regtrans-ms
                            [2010/08/20 03:23:39 | 000,065,536 | -HS- | M] () -- C:\Users\Lisa\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TM.blf
                            [2010/08/20 03:23:34 | 001,526,296 | -H-- | M] () -- C:\Users\Lisa\AppData\Local\IconCache.db
                            [2010/08/19 22:38:11 | 000,115,850 | ---- | M] () -- C:\Users\Lisa\Desktop\Innovation logo.jpg
                            [2010/08/19 22:22:25 | 000,113,221 | ---- | M] () -- C:\Users\Lisa\Desktop\Static Innovation eCard v4.jpg
                            [2010/08/19 15:42:33 | 000,417,024 | ---- | M] () -- C:\Users\Lisa\Desktop\Static Innovation eCard v3.jpg
                            [2010/08/19 15:36:42 | 000,398,052 | ---- | M] () -- C:\Users\Lisa\Desktop\Static Innovation eCard v2.jpg
                            [2010/08/19 15:30:16 | 000,421,005 | ---- | M] () -- C:\Users\Lisa\Desktop\Static Innovation eCard.jpg
                            [2010/08/19 11:10:19 | 003,824,136 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
                            [2010/08/18 22:43:35 | 000,013,618 | ---- | M] () -- C:\Users\Lisa\Desktop\IndiaVisaApplication_Carco_Matthew_15YL.pdf
                            [2010/08/13 22:05:57 | 000,000,680 | ---- | M] () -- C:\Users\Lisa\AppData\Local\d3d9caps.dat
                            [2010/08/12 23:50:14 | 000,032,256 | ---- | M] () -- C:\Users\Lisa\Desktop\WE Innovate Posters - Print Grid 8-11-10 v2.xls
                            [2010/08/12 19:26:52 | 065,744,817 | ---- | M] () -- C:\Users\Lisa\Desktop\I-innovate - flower resized.psd
                            [2010/08/12 13:32:40 | 090,099,109 | ---- | M] () -- C:\Users\Lisa\Desktop\I-innovate - SEEK2 resized.psd
                            [2010/08/11 23:43:30 | 065,278,521 | ---- | M] () -- C:\Users\Lisa\Desktop\I-innovate mohawk mirror resized.psd
                            [2010/08/11 23:05:46 | 001,706,233 | ---- | M] () -- C:\Users\Lisa\Desktop\Ryan family background.ai
                            [2010/08/10 13:11:52 | 000,045,568 | ---- | M] () -- C:\Users\Lisa\Documents\calendar INNOVATION dates.doc
                            [2010/08/07 13:53:42 | 000,205,312 | ---- | M] () -- C:\Users\Lisa\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
                            [2010/08/06 20:30:58 | 000,012,455 | ---- | M] () -- C:\Users\Lisa\Documents\HBO job.docx
                            [2010/08/04 20:27:56 | 000,066,982 | ---- | M] () -- C:\Users\Lisa\Desktop\Volunteer-Abroad-US[1].pdf
                            [2010/08/03 18:02:19 | 000,101,858 | ---- | M] () -- C:\Users\Lisa\Desktop\Horizon billing form.pdf
                            [2010/08/01 21:21:12 | 000,794,320 | ---- | M] () -- C:\Users\Lisa\Desktop\our_path_forward_2009.pdf
                            [2010/07/28 18:38:26 | 000,041,404 | ---- | M] () -- C:\Users\Lisa\Documents\Engagement via SkipLevelLunchesWithTheCEO.pdf
                            [2010/07/27 10:16:03 | 000,184,333 | ---- | M] () -- C:\Users\Lisa\Documents\Matt EOB 7_24_2010.pdf
                            [2010/07/21 18:51:45 | 000,103,720 | ---- | M] () -- C:\Users\Lisa\GoToAssistDownloadHelper.exe
                            [2010/07/21 18:51:44 | 000,000,251 | ---- | M] () -- C:\Windows\win.ini
                            [2010/07/19 23:13:40 | 000,000,162 | -H-- | M] () -- C:\Users\Lisa\Desktop\~$oxicillin_WIP_7-14-2010_v2.docx
                            [2010/07/14 12:49:53 | 000,000,162 | -H-- | M] () -- C:\Users\Lisa\Desktop\~$robindo Generics Support Catalogue and Monograph_Amoxicillin_WIP_7-14-2010.doc
                            [2010/07/12 19:38:01 | 000,000,056 | -H-- | M] () -- C:\ProgramData\ezsidmv.dat
                            [2010/07/09 18:47:42 | 001,535,488 | ---- | M] () -- C:\Users\Lisa\Desktop\Prescriber-Based Multi-Channel Non-Personal Promotion.ppt
                            [2010/07/09 18:46:00 | 001,751,552 | ---- | M] () -- C:\Users\Lisa\Desktop\PAH Promotion Resource Optimization Proposal by ZS v3.0.ppt
                            [2010/06/14 22:11:00 | 000,274,144 | ---- | M] () -- C:\Users\Lisa\AppData\Local\GDIPFONTCACHEV1.DAT
                            [2010/06/11 22:16:54 | 009,830,400 | ---- | M] () -- C:\Windows\VerizonDM.msi
                            [2010/06/09 10:53:29 | 000,726,349 | ---- | M] () -- C:\Users\Lisa\Documents\Kidnapped 3rd edition.pdf
                            [2010/05/27 12:25:25 | 000,000,732 | ---- | M] () -- C:\Users\Lisa\AppData\Local\d3d9caps64.dat
                            [1 C:\Users\Lisa\Desktop\*.tmp files -> C:\Users\Lisa\Desktop\*.tmp -> ]
                             
                            ========== Files Created - No Company Name ==========
                             
                            [2010/08/20 03:24:03 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
                            [2010/08/20 03:23:46 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_07_00.Wdf
                            [2010/08/19 22:38:09 | 000,115,850 | ---- | C] () -- C:\Users\Lisa\Desktop\Innovation logo.jpg
                            [2010/08/19 15:43:44 | 000,113,221 | ---- | C] () -- C:\Users\Lisa\Desktop\Static Innovation eCard v4.jpg
                            [2010/08/19 15:42:31 | 000,417,024 | ---- | C] () -- C:\Users\Lisa\Desktop\Static Innovation eCard v3.jpg
                            [2010/08/19 15:36:40 | 000,398,052 | ---- | C] () -- C:\Users\Lisa\Desktop\Static Innovation eCard v2.jpg
                            [2010/08/19 15:30:12 | 000,421,005 | ---- | C] () -- C:\Users\Lisa\Desktop\Static Innovation eCard.jpg
                            [2010/08/18 22:43:26 | 000,01
                            Logged

                            lcarco

                              Topic Starter


                              Rookie

                              Re: Malware removal - can't perform any suggested steps with .exe file
                              « Reply #20 on: August 22, 2010, 01:13:36 PM »
                              And here is the other.

                              OTL Extras logfile created on: 8/22/2010 1:14:00 PM - Run 1
                              OTL by OldTimer - Version 3.2.10.0     Folder = C:\Users\Lisa\Desktop
                              64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
                              Internet Explorer (Version = 8.0.6001.18943)
                              Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
                               
                              4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 52.00% Memory free
                              8.00 Gb Paging File | 6.00 Gb Available in Paging File | 73.00% Paging File free
                              Paging file location(s): ?:\pagefile.sys [binary data]
                               
                              %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
                              Drive C: | 219.91 Gb Total Space | 68.89 Gb Free Space | 31.32% Space Free | Partition Type: NTFS
                              Drive D: | 12.97 Gb Total Space | 2.43 Gb Free Space | 18.77% Space Free | Partition Type: NTFS
                              Drive E: | 7.24 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
                              F: Drive not present or media not loaded
                              G: Drive not present or media not loaded
                              H: Drive not present or media not loaded
                              I: Drive not present or media not loaded
                               
                              Computer Name: LISA-LAPTOP
                              Current User Name: Lisa
                              Logged in as Administrator.
                               
                              Current Boot Mode: Normal
                              Scan Mode: Current user
                              Include 64bit Scans
                              Company Name Whitelist: On
                              Skip Microsoft Files: On
                              File Age = 90 Days
                              Output = Standard
                              Quick Scan
                               
                              ========== Extra Registry (SafeList) ==========
                               
                               
                              ========== File Associations ==========
                               
                              64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
                               
                              [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
                              .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
                               
                              [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
                              .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
                               
                              ========== Shell Spawning ==========
                               
                              64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
                              batfile [open] -- "%1" %* File not found
                              cmdfile [open] -- "%1" %* File not found
                              comfile [open] -- "%1" %* File not found
                              exefile [open] -- "%1" %* File not found
                              helpfile [open] -- Reg Error: Key error.
                              htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
                              htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
                              inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
                              InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
                              piffile [open] -- "%1" %* File not found
                              regfile [merge] -- Reg Error: Key error.
                              scrfile [config] -- "%1" File not found
                              scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
                              scrfile [open] -- "%1" /S File not found
                              txtfile [edit] -- Reg Error: Key error.
                              Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
                              Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
                              Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
                              Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
                              Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
                              Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
                               
                              [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
                              batfile [open] -- "%1" %*
                              cmdfile [open] -- "%1" %*
                              comfile [open] -- "%1" %*
                              cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
                              exefile [open] -- "%1" %*
                              helpfile [open] -- Reg Error: Key error.
                              htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
                              htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
                              inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
                              piffile [open] -- "%1" %*
                              regfile [merge] -- Reg Error: Key error.
                              scrfile [config] -- "%1"
                              scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
                              scrfile [open] -- "%1" /S
                              txtfile [edit] -- Reg Error: Key error.
                              Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
                              Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
                              Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
                              Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
                              Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
                              Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
                               
                              ========== Security Center Settings ==========
                               
                              64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
                              "cval" = 1
                              "UacDisableNotify" = 0
                              "InternetSettingsDisableNotify" = 0
                              "AutoUpdateDisableNotify" = 0
                               
                              64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
                               
                              64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
                              "AntiVirusOverride" = 0
                              "AntiSpywareOverride" = 0
                              "FirewallOverride" = 0
                              "VistaSp1" = 9F 9E 16 8C DC 5B C8 01  [binary data]
                              "VistaSp2" = 17 66 AF 91 B1 3F CB 01  [binary data]
                               
                              64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
                               
                              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
                               
                              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
                              "oobe_av" = 1
                               
                              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
                              "EnableFirewall" = 1
                              "DisableNotifications" = 0
                               
                              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
                              "EnableFirewall" = 1
                              "DisableNotifications" = 0
                               
                              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
                              "EnableFirewall" = 1
                              "DisableNotifications" = 0
                              "DoNotAllowExceptions" = 0
                               
                              ========== Authorized Applications List ==========
                               
                              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
                              "C:\Program Files (x86)\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files (x86)\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink -- (EarthLink, Inc.)
                              "C:\Program Files (x86)\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files (x86)\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink -- (EarthLink, Inc.)
                               
                               
                              ========== Vista Active Open Ports Exception List ==========
                               
                              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
                              "{5625AE28-4574-41FB-A4DE-1CC871FAF451}" = lport=51001 | protocol=6 | dir=in | name=adobe version cue cs4 server |
                              "{5E892D33-CFF7-40D7-A4E4-824AD5251D47}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |
                              "{8DA6F7F6-CA3D-4CEE-A3BB-DEA851E17C9F}" = lport=3703 | protocol=6 | dir=in | name=adobe version cue cs4 server |
                              "{8E995BE9-4939-4533-B171-9A54CDC0979A}" = lport=3704 | protocol=6 | dir=in | name=adobe version cue cs4 server |
                              "{A65378CF-363F-40F9-914E-6D89560ABDB9}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 |
                              "{BE1FEBAB-975B-4588-80C8-932CF374934D}" = lport=51000 | protocol=6 | dir=in | name=adobe version cue cs4 server |
                               
                              ========== Vista Active Application Exception List ==========
                               
                              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
                              "{23A3F5AC-386D-4A57-81F0-8A37F0A47244}" = protocol=17 | dir=in | app=c:\program files (x86)\verizon\vsp\servicepointservice.exe |
                              "{2DD8283C-15DF-4A15-BED3-964E69FFDC73}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\live meeting 8\console\pwconsole.exe |
                              "{30ABFFFF-488F-43AD-996C-B6F5EA10E71B}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
                              "{34276E30-E762-4410-A4FA-28E892D9CA3A}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
                              "{3915D1B0-AF9B-4E63-A0D3-9C9D163407FF}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
                              "{433A6A18-2AD5-45B9-A8A0-298C95484410}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector\pdr.exe |
                              "{4E37717E-3A3F-4A82-874A-4FFB80A97219}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\live meeting 8\console\pwconsole.exe |
                              "{5EB2E882-0441-4BA0-9F5A-EEC7FC24553C}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\aol\loader\aolload.exe |
                              "{68258586-E440-4BA9-B667-B490D866971E}" = protocol=6 | dir=in | app=c:\program files (x86)\verizon\vsp\servicepointservice.exe |
                              "{731E5AD2-37AB-4D8F-A03F-2F1EFB658B87}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\live meeting 8\console\pwconsole.exe |
                              "{827F11E7-010A-4F53-919F-B6D5690315D6}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\adobe\adobe version cue cs4\server\bin\versioncuecs4.exe |
                              "{9CFD211B-FCB0-42A7-8F90-EC8202E47207}" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
                              "{A6DA8734-DE4B-4E23-9DA1-B4E0D54F7009}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
                              "{AFF0FA27-3D85-4CC4-818C-D60013EC36A8}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
                              "{BF5CA861-59EE-442F-8135-907F35F3C52C}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\aol\loader\aolload.exe |
                              "{C963D5FD-CC67-4899-A390-155F9368A8AA}" = dir=in | app=c:\program files (x86)\hp\quickplay\qp.exe |
                              "{D240A1BF-E625-4A99-B27A-DDAAA7B6DB62}" = dir=in | app=c:\program files (x86)\hp\quickplay\qpservice.exe |
                              "{E6EDE86C-A88D-4A2A-96B9-D03F6E5BB1A0}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\adobe\adobe version cue cs4\server\bin\versioncuecs4.exe |
                              "{EB743B3C-82ED-4D04-8BB0-18DCE5633780}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\live meeting 8\console\pwconsole.exe |
                              "{EDED57E6-1299-44B0-9492-0843BF83102F}" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
                              "TCP Query User{034AB4B4-31EB-47E6-9060-EFF85738A9C9}C:\program files (x86)\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
                              "TCP Query User{95ED204A-58C2-47F7-A973-FF64EF774398}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
                              "TCP Query User{CF882BE5-FAC7-4DA9-9718-2665997523CF}C:\program files (x86)\microsoft office\live meeting 8\console\pwconsole.exe" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\live meeting 8\console\pwconsole.exe |
                              "UDP Query User{14BC8FCA-DF02-46E0-A18F-685ADA7A066C}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
                              "UDP Query User{4D1D29DC-A63E-40C8-9D5A-D359936F874B}C:\program files (x86)\microsoft office\live meeting 8\console\pwconsole.exe" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\live meeting 8\console\pwconsole.exe |
                              "UDP Query User{9268EB9E-E61C-4A3D-9742-111F7462D417}C:\program files (x86)\itunes\itunes.exe" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
                               
                              ========== HKEY_LOCAL_MACHINE Uninstall List ==========
                               
                              64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
                              "{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
                              "{11192F89-510C-4E23-A62A-D3BEA9139596}" = HP QuickTouch 1.00 C3
                              "{209CDA54-D390-46A2-A97C-7BF61734418D}" = WeatherBug Gadget
                              "{22ABA92B-6C1B-46D8-AC2B-C48EEAE172A9}" = VD64Inst
                              "{295CFB7C-A57E-4313-93E7-68E7CE1D0332}" = Adobe WinSoft Linguistics Plugin x64
                              "{2D74E972-5A85-44DC-9193-8A302BA8C181}" = Photoshop Camera Raw_x64
                              "{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
                              "{6631325A-9B1B-4EE7-8E64-8CC4A6F10643}" = Adobe Fonts All x64
                              "{68451E5C-0A9C-4D5C-8D06-6E296242E908}" = 64 Bit HP CIO Components Installer
                              "{84BC87D4-0480-4E10-B15D-1E7886D55180}" = iTunes
                              "{8875A1C0-6308-4790-8CF6-D34E89880052}" = Adobe Linguistics CS4 x64
                              "{887797BF-37A5-4199-B0C9-0D38D6196E9A}" = Adobe Anchor Service x64 CS4
                              "{8C8D673B-20FB-43E6-BCB7-9B3F78F2E762}" = Adobe Type Support x64 CS4
                              "{8DAA31EB-6830-4006-A99F-4DF8AB24714F}" = Adobe CSI CS4 x64
                              "{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
                              "{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
                              "{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
                              "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
                              "{90B5B05F-AFDA-4922-A153-45B14200BA77}" = SPBBC 64bit
                              "{90BA8112-80B3-4617-A3C1-BD2771B60F74}" = Adobe CMaps x64 CS4
                              "{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
                              "{9EFC40E3-5F31-4F75-8445-286273F74D8E}" = Apple Mobile Device Support
                              "{A3454894-144A-4D80-B605-C128FE0D7329}" = Adobe Drive CS4 x64
                              "{B37A99DD-88E2-4ED0-80B4-1E054AB354BF}" = Adobe InDesign CS4 Icon Handler x64
                              "{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
                              "{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
                              "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
                              "{D40172D6-CE2D-4B72-BF5F-26A04A900B7B}" = Adobe Photoshop CS4 (64 Bit)
                              "{DAE239CE-EB9D-4EB3-B0D4-528D6BAA48FD}" = Bonjour
                              "{DFFABE78-8173-4E97-9C5C-22FB26192FC5}" = Adobe PDF Library Files x64 CS4
                              "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
                              "HP Photosmart Essential" = HP Photosmart Essential 2.5
                              "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
                              "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
                              "NVIDIA Drivers" = NVIDIA Drivers
                              "SMSERIAL" = Motorola SM56 Data Fax Modem
                              "SynTPDeinstKey" = Synaptics Pointing Device Driver
                               
                              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
                              "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
                              "{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}" = Adobe Color NA Recommended Settings CS4
                              "{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
                              "{03DEEAD2-F3B7-45BF-9006-A25D015F00D2}" = Adobe Flash Player 10 Plugin
                              "{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
                              "{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
                              "{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack
                              "{06E74B9B-631F-4378-BF3A-40D868450C05}" = HPPhotoSmartPhotobookHolidayPack1
                              "{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = MSN Toolbar
                              "{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer
                              "{082F8ABA-84D5-4837-9DFC-F365D91A07D4}" = HP Smart Web Printing
                              "{08DE682A-3858-4591-9EBB-E5290E4DC3DD}" = Family Protection
                              "{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
                              "{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
                              "{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
                              "{12A76360-388E-4B27-ABEB-D5FC5378DD2A}" = HPPhotoSmartPhotobookWebPack1
                              "{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
                              "{15BF7AAF-846C-4A6D-80E1-5D1FC7FB461B}" = Adobe SGM CS4
                              "{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
                              "{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
                              "{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
                              "{172AEB5E-CBB2-4CDD-A4CF-388600825839}" = HPPhotoSmartPhotobookPlayfulPack1
                              "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
                              "{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}" = Adobe AIR
                              "{1A21FC72-611F-4ADC-B6A6-795E06D72324}" = Verizon Download Manager
                              "{1B7C06E1-4888-47A6-992A-0990B9683486}" = Adobe Version Cue CS4 Server
                              "{1DCA3EAA-6EB5-4563-A970-EA14D75037BA}" = Adobe InDesign CS4
                              "{1E04CB54-AF4E-4AC3-B4B7-C0A160BE57F1}" = Adobe InDesign CS4 Icon Handler
                              "{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = DVD Suite
                              "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
                              "{250E9609-E830-43EB-B379-DAB7546A2422}" = muvee autoProducer 6.1
                              "{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check for Health Check
                              "{2656D0AB-9EA4-4C58-A117-635F3CED8B93}" = Microsoft UI Engine
                              "{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 21
                              "{2BAF2B96-7560-48B4-87D4-10178DDBE217}" = Adobe InDesign CS4 Application Feature Set Files (Roman)
                              "{303379C9-8610-4CCF-AF37-C4BF8998C591}" = Roxio Media Manager
                              "{303F7619-4E67-450F-985A-A2DF51B30AC8}" = Adobe Setup
                              "{31216452-5540-4C96-B754-94890A63D5AB}" = HP Help and Support
                              "{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
                              "{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java(TM) 6 Update 4
                              "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
                              "{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE
                              "{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.30 E1
                              "{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
                              "{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
                              "{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
                              "{3AC54383-31D1-4907-961B-B12CBB1D0AE8}" = MobileMe Control Panel
                              "{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
                              "{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
                              "{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
                              "{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
                              "{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP QuickPlay 3.6
                              "{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
                              "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
                              "{4A52555C-032A-4083-BDD9-6A85ABFB39A8}" = Adobe SING CS4
                              "{4CACFCD9-F71B-413A-8DF5-1A6419D5CDC6}" = Cards_Calendar_OrderGift_DoMorePlugout
                              "{4D49757C-367A-4333-BDB3-68966162B14E}" = HP User Guides 0087
                              "{535A4F3D-06C3-446C-A2AA-DBB71EC192B8}" = LightScribe Applications
                              "{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
                              "{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}" = Adobe Color EU Extra Settings CS4
                              "{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
                              "{5DAA9C36-8F8B-462F-8CCA-E205BC3751F5}" = HP Active Support Library
                              "{5F89E4AF-07EF-48C7-9F3D-46E96E338D1D}" = Verizon Online Backup and Sharing
                              "{61BEA823-ECAF-49F1-8378-A59B3B8AD247}" = Microsoft Default Manager
                              "{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
                              "{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
                              "{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
                              "{66468F4D-BC4E-470C-9093-B3B6A1BB378C}" = MSN Toolbar Platform
                              "{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check
                              "{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
                              "{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
                              "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
                              "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
                              "{7641FD7D-E94E-424E-A95C-0593C84DC0C0}" = VZAccess Manager
                              "{76A38425-741A-415C-96CF-AAD907FAB421}" = Vz In Home Agent
                              "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
                              "{7B2ADCB5-3F3D-478A-90A9-A8C04EF82BF6}" = Mobile Broadband Generic Drivers
                              "{7CC7BDD5-6F10-4724-96A1-EAC7D9F2831C}" = Adobe InDesign CS4 Common Base Files
                              "{818ABC3C-635C-4651-8183-D0E9640B7DD1}" = HP Update
                              "{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
                              "{82CA0A0C-A3EC-4167-B694-909205B2EDEC}" = muvee Plugin 1.0
                              "{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
                              "{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
                              "{87532CAB-7932-4F84-8937-823337622807}" = Adobe Illustrator CS4
                              "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
                              "{89E052B2-5CA5-4B7A-AF0C-28CA2836B030}" = HPPhotoSmartPhotobookModernPack1
                              "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
                              "{8C8224B7-AA9B-4807-97CD-55899BAC83FE}" = YouSendIt Express
                              "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
                              "{90120000-0016-0409-0000-0000000FF1CE}_STANDARDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
                              "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
                              "{90120000-0018-0409-0000-0000000FF1CE}_STANDARDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
                              "{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
                              "{90120000-001A-0409-0000-0000000FF1CE}_STANDARDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
                              "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
                              "{90120000-001B-0409-0000-0000000FF1CE}_STANDARDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
                              "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
                              "{90120000-001F-0409-0000-0000000FF1CE}_STANDARDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
                              "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
                              "{90120000-001F-040C-0000-0000000FF1CE}_STANDARDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
                              "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
                              "{90120000-001F-0C0A-0000-0000000FF1CE}_STANDARDR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
                              "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
                              "{90120000-002A-0000-1000-0000000FF1CE}_STANDARDR_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
                              "{90120000-002A-0409-1000-0000000FF1CE}_STANDARDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
                              "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
                              "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
                              "{90120000-006E-0409-0000-0000000FF1CE}_STANDARDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
                              "{90120000-00B0-0409-0000-0000000FF1CE}" = Microsoft Save as PDF Add-in for 2007 Microsoft Office programs
                              "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
                              "{90120000-0115-0409-0000-0000000FF1CE}_STANDARDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
                              "{90120000-0116-0409-1000-0000000FF1CE}_STANDARDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
                              "{91120000-0012-0000-0000-0000000FF1CE}" = Microsoft Office Standard 2007
                              "{91120000-0012-0000-0000-0000000FF1CE}_STANDARDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
                              "{91120000-0012-0000-0000-0000000FF1CE}_STANDARDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
                              "{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
                              "{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
                              "{9885A11E-60E4-417C-B58B-8B31B21C0B8A}" = HP Easy Setup - Frontend
                              "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
                              "{A07840FC-CE63-4CB8-8030-EF4B9805925A}" = HPPhotoSmartDiscLabel_PaperLabel
                              "{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
                              "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
                              "{AC388C78-2619-452C-BFBE-FABCC3194387}" = Microsoft Office Live Meeting 2007
                              "{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
                              "{AC76BA86-1033-F400-7760-000000000004}_934" = Adobe Acrobat 9.3.4 - CPSID_83708
                              "{AC76BA86-7AD7-1033-7B44-A81000000003}" = Adobe Reader 8.1.0
                              "{AC95121F-1576-45B8-82F7-3911D27882E6}" = HPPhotoSmartPhotobookScrapbookPack1
                              "{ADFB9653-F44C-460C-BF58-189CC552DFFE}" = hpphotosmartdisclabelplugin
                              "{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
                              "{B4E91E95-A5BA-4E50-A465-DB7EFEB176E8}" = HPPhotoSmartDiscLabel_PrintOnDisc
                              "{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
                              "{B74D4E10-6884-0000-0000-000000000103}" = Adobe Bridge 1.0
                              "{B7F98125-4955-41E3-8A71-4CE11CE9C198}" = KODAK Gallery Upload Software
                              "{B9F4561A-924D-4510-A85A-BB0960C338CB}" = Adobe Asset Services CS4
                              "{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5
                              "{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
                              "{BC7E2C06-D255-4300-AA12-33AB54D009AC}" = Adobe Creative Suite 4 Design Standard
                              "{BD0E2B92-3814-46F0-893B-4612EA010C7E}" = HP Customer Experience Enhancements
                              "{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
                              "{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
                              "{C86E7C99-E4AD-79C7-375B-1AEF9A91EC2B}" = Acrobat.com
                              "{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
                              "{CBAE4F50-9FC9-4557-AB36-9826DF3C103C}" = HP Wireless Assistant
                              "{CC4A73BF-938E-4C19-A553-853C035C9BA1}" = LightScribe System Software  1.10.13.1
                              "{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
                              "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
                              "{D793A12F-E362-48BB-B332-1DA5E936B52D}" = BlackBerry Desktop Software 4.3
                              "{DD3C88A0-C53C-41D0-A21B-6D021981D23E}" = HPPhotoSmartDiscLabelContent1
                              "{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01
                              "{E63E34A7-E552-412B-9E40-FD6FC5227ABA}_is1" = Uniblue RegistryBooster 2010
                              "{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
                              "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
                              "{F636EE9A-F9EC-4606-BCFA-77DD0E210788}" = HPPhotoSmartDiscLabel_Tattoo
                              "{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
                              "{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
                              "{FCBE0690-CBE1-4C60-87B0-4A70A6F5434E}" = LightScribe Template Labeler
                              "{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
                              "3ivx MPEG-4 5.0.3" = 3ivx MPEG-4 5.0.3 (remove only)
                              "Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
                              "Adobe AIR" = Adobe AIR
                              "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
                              "Adobe SVG Viewer" = Adobe SVG Viewer 3.0
                              "Adobe_1e3ba55b33b1e8227645fb9c82acca3" = Adobe Creative Suite 4 Design Standard
                              "Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.9
                              "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
                              "BlackBerry_{D793A12F-E362-48BB-B332-1DA5E936B52D}" = BlackBerry Desktop Software 4.3
                              "CCleaner" = CCleaner
                              "com.adobe.amp.4875E02D9FB21EE389F73B8D1 702B320485DF8CE.1" = Adobe Media Player
                              "com.adobe.mauby.4875E02D9FB21EE389F73B8 D1702B320485DF8CE.1" = Acrobat.com
                              "Hauppauge MCE2005 Software Encoder" = Hauppauge MCE XP/Vista Software Encoder (2.0.25149)
                              "HijackThis" = HijackThis 2.0.2
                              "HP Smart Web Printing" = HP Smart Web Printing
                              "InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
                              "InstallShield_{8C8224B7-AA9B-4807-97CD-55899BAC83FE}" = YouSendIt Express
                              "InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
                              "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
                              "Mobile Broadband Generic Drivers" = Mobile Broadband Generic Drivers
                              "Mozilla Firefox (3.6.6)" = Mozilla Firefox (3.6.6)
                              "RadialpointClientGateway_is1" = Verizon Servicepoint 3.5.10
                              "SlingMedia.QPSlingPlayer_is1" = QuickPlay SlingPlayer 0.4.6
                              "SpiceFX for Movie Maker" = SpiceFX for Movie Maker
                              "STANDARDR" = Microsoft Office Standard 2007
                              "Verizon FiOS Activation_is1" = Verizon FiOS Activation
                              "Verizon Help and Support" = Verizon Help and Support Tool
                              "Xilisoft Video Converter Platinum" = Xilisoft Video Converter Platinum
                               
                              ========== HKEY_CURRENT_USER Uninstall List ==========
                               
                              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
                              "ActiveTouchMeetingClient" = WebEx
                              "GoToMeeting" = GoToMeeting 4.1.0.366
                              "Move Media Player" = Move Media Player
                               
                              ========== Last 10 Event Log Errors ==========
                               
                              [ Application Events ]
                              Error - 8/17/2010 3:36:25 PM | Computer Name = Lisa-laptop | Source = Microsoft Office 12 | ID = 2000
                              Description = Accepted Safe Mode action : Microsoft Office Outlook.
                               
                              Error - 8/18/2010 10:57:41 PM | Computer Name = Lisa-laptop | Source = Application Error | ID = 1000
                              Description = Faulting application iexplore.exe, version 8.0.6001.18943, time stamp
                               0x4c25813d, faulting module Flash10e.ocx, version 10.0.45.2, time stamp 0x4b5f8faa,
                               exception code 0xc0000005, fault offset 0x001582b2,  process id 0x1a98, application
                               start time 0x01cb3f49cd978970.
                               
                              Error - 8/19/2010 11:10:58 AM | Computer Name = Lisa-laptop | Source = WinMgmt | ID = 10
                              Description =
                               
                              Error - 8/19/2010 11:14:47 AM | Computer Name = Lisa-laptop | Source = WinMgmt | ID = 10
                              Description =
                               
                              Error - 8/19/2010 11:22:05 AM | Computer Name = Lisa-laptop | Source = Google Update | ID = 20
                              Description =
                               
                              Error - 8/19/2010 11:29:01 AM | Computer Name = Lisa-laptop | Source = ESENT | ID = 215
                              Description = WinMail (4116) WindowsMail0: The backup has been stopped because it
                               was halted by the client or the connection with the client failed.
                               
                              Error - 8/19/2010 11:29:44 AM | Computer Name = Lisa-laptop | Source = SideBySide | ID = 16842830
                              Description = Activation context generation failed for "C:\Program Files (x86)\Adobe\Acrobat
                               9.0\Designer 8.2\FormDesigner.exe".Error in manifest or policy file "" on line
                              .  A component version required by the application conflicts with another component
                               version already active.  Conflicting components are:.  Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_1509f8bef40ee4da.manifest.
                              Component
                               2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0.manifest.
                               
                              Error - 8/19/2010 12:29:30 PM | Computer Name = Lisa-laptop | Source = Google Update | ID = 20
                              Description =
                               
                              Error - 8/19/2010 9:10:16 PM | Computer Name = Lisa-laptop | Source = Google Update | ID = 20
                              Description =
                               
                              Error - 8/19/2010 9:22:11 PM | Computer Name = Lisa-laptop | Source = Google Update | ID = 20
                              Description =
                               
                              [ OSession Events ]
                              Error - 9/5/2009 3:17:17 PM | Computer Name = Lisa-laptop | Source = Microsoft Office 12 Sessions | ID = 7001
                              Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
                              Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session
                              lasted 3354 seconds with 1740 seconds of active time.  This session ended with a
                               crash.
                               
                              Error - 10/2/2009 8:30:18 AM | Computer Name = Lisa-laptop | Source = Microsoft Office 12 Sessions | ID = 7001
                              Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
                               12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 533
                               seconds with 420 seconds of active time.  This session ended with a crash.
                               
                              Error - 11/8/2009 7:52:21 PM | Computer Name = Lisa-laptop | Source = Microsoft Office 12 Sessions | ID = 7001
                              Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
                               12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 8
                               seconds with 0 seconds of active time.  This session ended with a crash.
                               
                              Error - 11/8/2009 7:52:48 PM | Computer Name = Lisa-laptop | Source = Microsoft Office 12 Sessions | ID = 7001
                              Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
                               12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 9
                               seconds with 0 seconds of active time.  This session ended with a crash.
                               
                              Error - 11/13/2009 12:59:38 PM | Computer Name = Lisa-laptop | Source = Microsoft Office 12 Sessions | ID = 7001
                              Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
                              Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session
                              lasted 7918 seconds with 5040 seconds of active time.  This session ended with a
                               crash.
                               
                              Error - 12/3/2009 10:20:04 AM | Computer Name = Lisa-laptop | Source = Microsoft Office 12 Sessions | ID = 7001
                              Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
                               12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2189
                               seconds with 780 seconds of active time.  This session ended with a crash.
                               
                              Error - 1/12/2010 4:20:35 PM | Computer Name = Lisa-laptop | Source = Microsoft Office 12 Sessions | ID = 7001
                              Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
                               12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 118044
                               seconds with 13860 seconds of active time.  This session ended with a crash.
                               
                              Error - 3/1/2010 10:54:26 AM | Computer Name = Lisa-laptop | Source = Microsoft Office 12 Sessions | ID = 7001
                              Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
                               12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2409
                               seconds with 600 seconds of active time.  This session ended with a crash.
                               
                              Error - 4/19/2010 8:20:15 PM | Computer Name = Lisa-laptop | Source = Microsoft Office 12 Sessions | ID = 7001
                              Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
                               12.0.6524.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 188234
                               seconds with 3840 seconds of active time.  This session ended with a crash.
                               
                              Error - 4/23/2010 12:58:18 PM | Computer Name = Lisa-laptop | Source = Microsoft Office 12 Sessions | ID = 7001
                              Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
                               12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 97760
                               seconds with 13260 seconds of active time.  This session ended with a crash.
                               
                              [ System Events ]
                              Error - 6/4/2009 8:59:23 PM | Computer Name = Lisa-laptop | Source = HTTP | ID = 15016
                              Description =
                               
                              Error - 6/4/2009 9:00:58 PM | Computer Name = Lisa-laptop | Source = Service Control Manager | ID = 7022
                              Description =
                               
                              Error - 6/4/2009 9:00:59 PM | Computer Name = Lisa-laptop | Source = Service Control Manager | ID = 7001
                              Description =
                               
                              Error - 6/6/2009 5:02:04 PM | Computer Name = Lisa-laptop | Source = EventLog | ID = 6008
                              Description = The previous system shutdown at 5:00:04 PM on 6/6/2009 was unexpected.
                               
                              Error - 6/6/2009 5:02:05 PM | Computer Name = Lisa-laptop | Source = HTTP | ID = 15016
                              Description =
                               
                              Error - 6/6/2009 5:03:52 PM | Computer Name = Lisa-laptop | Source = Service Control Manager | ID = 7022
                              Description =
                               
                              Error - 6/6/2009 5:03:53 PM | Computer Name = Lisa-laptop | Source = Service Control Manager | ID = 7001
                              Description =
                               
                              Error - 6/6/2009 5:29:49 PM | Computer Name = Lisa-laptop | Source = HTTP | ID = 15016
                              Description =
                               
                              Error - 6/6/2009 5:31:23 PM | Computer Name = Lisa-laptop | Source = Service Control Manager | ID = 7022
                              Description =
                               
                              Error - 6/6/2009 5:31:24 PM | Computer Name = Lisa-laptop | Source = Service Control Manager | ID = 7001
                              Description =
                               
                               
                              < End of report >
                              Logged

                              SuperDave

                              • Malware Removal Specialist


                                • Genius
                                • Thanked: 1020
                              • Certifications: List
                              • Experience: Expert
                              • OS: Windows 10
                              Re: Malware removal - can't perform any suggested steps with .exe file
                              « Reply #21 on: August 22, 2010, 05:55:00 PM »
                              You have Viewpoint installed.

                              Viewpoint Media Player/Manager/Toolbar is considered as Foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad".

                              More information:

                              * ViewMgr.exe - Useless
                              * Viewpoint to Plunge Into Adware

                              It is suggested to remove the program now. Go to Start > Control Panel > Add/Remove Programs - (Vista & Win7 is Programs and Features) and remove the following programs if present.

                              * Viewpoint
                              * Viewpoint Manager
                              * Viewpoint Media Player
                              * Viewpoint Toolbar
                              * Viewpoint Experience Technology
                              *************************************

                              You can also remove these from your programs:
                              Java(TM) 6 Update 2
                              Java(TM) 6 Update 4
                              Java(TM) 6 Update 7
                              *****************************************

                              * Open OTL
                              * Copy and Paste the following text in the codebox into the Custom Scans/Fixes window.

                              Code: [Select]
                              :OTL

                              IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
                              IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522
                              O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.

                              :COMMANDS
                              [resethosts]
                              [purity]
                              [clearrestorepoints]
                              [emptytemp]
                              [start explorer]

                              * Click Run Fix
                              * OTLI2 may ask to reboot the machine. Please do so if asked.
                              * Click OK
                              * A report will open. Copy and Paste that report in your next reply.

                              **********************************************

                              I'd like to scan your machine with ESET OnlineScan

                              •Hold down Control and click on the following link to open ESET OnlineScan in a new window.
                              ESET OnlineScan
                              •Click the button.
                              •For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
                              • Click on to download the ESET Smart Installer. Save it to your desktop.
                              • Double click on the icon on your desktop.
                              •Check
                              •Click the button.
                              •Accept any security warnings from your browser.
                              •Check
                              •Push the Start button.
                              •ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
                              •When the scan completes, push
                              •Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
                              •Push the button.
                              •Push
                              A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

                              Logged
                              Windows 8 and Windows 10 dual boot with two SSD's

                              lcarco

                                Topic Starter


                                Rookie

                                Re: Malware removal - can't perform any suggested steps with .exe file
                                « Reply #22 on: August 22, 2010, 09:21:02 PM »
                                Viewpoint is not in the list of currently installed programs (fromthe control panel).

                                Is there some way it can be hidden?

                                Should I continue with the next steps without uninstalling it?

                                Please let me know.  Thanks....
                                Lisa
                                Logged

                                lcarco

                                  Topic Starter


                                  Rookie

                                  Re: Malware removal - can't perform any suggested steps with .exe file
                                  « Reply #23 on: August 23, 2010, 07:22:23 AM »
                                  Here is the OTL log:

                                  All processes killed
                                  ========== OTL ==========
                                  HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
                                  HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
                                  Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
                                  Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
                                  ========== COMMANDS ==========
                                  File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.
                                  HOSTS file reset successfully
                                  Error: Unable to interpret <[clearrestorepoints]> in the current context!
                                   
                                  [EMPTYTEMP]
                                   
                                  User: Administrator
                                   
                                  User: All Users
                                   
                                  User: Default
                                  ->Temp folder emptied: 0 bytes
                                  ->Temporary Internet Files folder emptied: 33170 bytes
                                   
                                  User: Default User
                                  ->Temp folder emptied: 0 bytes
                                  ->Temporary Internet Files folder emptied: 0 bytes
                                   
                                  User: Lisa
                                  ->Temp folder emptied: 12351101 bytes
                                  ->Temporary Internet Files folder emptied: 1547608380 bytes
                                  ->Java cache emptied: 80336527 bytes
                                  ->FireFox cache emptied: 36530560 bytes
                                  ->Flash cache emptied: 202717 bytes
                                   
                                  User: Public
                                   
                                  %systemdrive% .tmp files removed: 0 bytes
                                  %systemroot% .tmp files removed: 0 bytes
                                  %systemroot%\System32 .tmp files removed: 0 bytes
                                  %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
                                  %systemroot%\System32\drivers .tmp files removed: 0 bytes
                                  Windows Temp folder emptied: 52115250 bytes
                                  %systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 17307307 bytes
                                  %systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 7620233 bytes
                                  %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
                                  RecycleBin emptied: 816013 bytes
                                   
                                  Total Files Cleaned = 1,674.00 mb
                                   
                                   
                                  OTL by OldTimer - Version 3.2.10.0 log created on 08222010_233947

                                  Files\Folders moved on Reboot...
                                  File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\N7IDM4YU\hover[6].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\N7IDM4YU\ifr[1].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\N7IDM4YU\ifr[2].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\N7IDM4YU\ifr[3].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\N7IDM4YU\index[5].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\N7IDM4YU\msnbc_msn_com[1].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\N7IDM4YU\wrap-widget[2].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GA2P6UL0\5731[1].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GA2P6UL0\7454-43775-2060-322[1].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GA2P6UL0\huffingtonpost_com[1].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GA2P6UL0\ifr[1].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GA2P6UL0\ifr[2].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GA2P6UL0\ifr[3].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GA2P6UL0\ifr[4].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GA2P6UL0\ig[1].txt not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GA2P6UL0\mailhome[2].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GA2P6UL0\pid=NBCFC1_A[1].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GA2P6UL0\xd_proxy[1].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\B0OZU93S\1234569222[1].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\B0OZU93S\all[1].html not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\B0OZU93S\bind[1].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\B0OZU93S\google_ads_iframe_loader[1].html not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\B0OZU93S\hips=1;sex=1;sex-advice=1;sexuality=1;women=1;global=1;cap_12=n;qcs=D;;load_mode=inline;page_type=bpage;pos=leaderboard_top;sz=728x90;tile=1;ord=7841259748[1].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\B0OZU93S\ifr[1].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\B0OZU93S\ifr[2].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\B0OZU93S\ifr[3].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\B0OZU93S\mole[6].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\B0OZU93S\rpc_relay[1].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4I0ECJGQ\01[2].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4I0ECJGQ\AdDisplayTrackerServlet[1].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4I0ECJGQ\flash[1].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4I0ECJGQ\flash[2].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4I0ECJGQ\freq[1].html not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4I0ECJGQ\ifr[1].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4I0ECJGQ\notifierclient[2].htm not found!
                                  File\Folder C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4I0ECJGQ\SetGridCookie[1].htm not found!
                                  C:\Users\Lisa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.

                                  Registry entries deleted on Reboot...
                                  Logged

                                  lcarco

                                    Topic Starter


                                    Rookie

                                    Re: Malware removal - can't perform any suggested steps with .exe file
                                    « Reply #24 on: August 23, 2010, 12:11:03 PM »
                                    ESET LOG:
                                    C:\SWSetup\AOLIMS\setup.exe   probably a variant of Win32/Agent.HZHBURL trojan   cleaned by deleting - quarantined
                                    C:\Users\Lisa\AppData\Local\Temp\jar_cache8398643626540035938.tmp   a variant of Java/TrojanDownloader.Agent.NAC trojan   deleted - quarantined
                                    Logged

                                    SuperDave

                                    • Malware Removal Specialist


                                      • Genius
                                      • Thanked: 1020
                                    • Certifications: List
                                    • Experience: Expert
                                    • OS: Windows 10
                                    Re: Malware removal - can't perform any suggested steps with .exe file
                                    « Reply #25 on: August 23, 2010, 01:17:19 PM »
                                    Quote
                                    Viewpoint is not in the list of currently installed programs (fromthe control panel).

                                    Is there some way it can be hidden?
                                    Please try this to see if you can find it there.

                                    Delete An Uninstall Entry

                                    •Start HijackThis

                                    •Click on the Open the Misc Tools section

                                    •Click on the Open Uninstall Manager button.

                                    •Highlight the entry you want to remove.
                                    •Click Delete this entry
                                    Logged
                                    Windows 8 and Windows 10 dual boot with two SSD's
                                    Pages: 1 2 [All]   Go Up
                                    « previous next »