Logfile created: 3/20/2012 09:38:35 Ad-Aware version: 9.6.0 Extended engine: 3 Extended engine version: 3.1.

2770 User performing scan: HP_Administrator *********************** Definitions database information *********************** Lavasoft definition file: 150.760 Genotype definition file version: 2012/02/13 12:34:34 Extended engine definition file: 11686.0 ******************************** Scan results: ********************************* Scan profile name: Smart Scan (ID: smart) Objects scanned: 9970 Objects detected: 0 Type Detected ========================== Processes.......: 0 Registry entries: 0 Hostfile entries: 0 Files...........: 0 Folders.........: 0 LSPs............: 0 Cookies.........: 0 Browser hijacks.: 0 MRU objects.....: 0

Scan and cleaning complete: Finished correctly after 175 seconds *********************************** Settings *********************************** Scan profile: ID: smart, enabled:1, value: Smart Scan ID: folderstoscan, enabled:1, value: ID: useantivirus, enabled:1, value: true ID: sections, enabled:1 ID: scancriticalareas, enabled:1, value: true ID: scanrunningapps, enabled:1, value: true ID: scanregistry, enabled:1, value: true ID: scanlsp, enabled:1, value: true ID: scanads, enabled:1, value: false ID: scanhostsfile, enabled:1, value: false ID: scanmru, enabled:1, value: false ID: scanbrowserhijacks, enabled:1, value: true ID: scantrackingcookies, enabled:1, value: true ID: closebrowsers, enabled:1, value: false ID: filescanningoptions, enabled:1 ID: archives, enabled:1, value: false ID: onlyexecutables, enabled:1, value: true ID: skiplargerthan, enabled:1, value: 20480 ID: scanrootkits, enabled:1, value: true ID: rootkitlevel, enabled:1, value: mild, domain: medium,mild,strict ID: usespywareheuristics, enabled:1, value: true Scan global: ID: global, enabled:1

ID: addtocontextmenu, enabled:1, value: true ID: playsoundoninfection, enabled:1, value: false ID: soundfile, enabled:0, value: N/A Scheduled scan settings: <Empty> Update settings: ID: updates, enabled:1 ID: launchthreatworksafterscan, enabled:1, value: silently, domain: normal,off ,silently ID: deffiles, enabled:1, value: downloadandinstall, domain: dontcheck,download andinstall ID: licenseandinfo, enabled:1, value: downloadandinstall, domain: dontcheck,do wnloadandinstall ID: schedules, enabled:1, value: true ID: updatedaily1, enabled:1, value: Daily 1 ID: time, enabled:1, value: Mon Mar 19 19:39:00 2012 ID: frequency, enabled:1, value: daily, domain: daily,monthly,once,systems tart,weekly ID: weekdays, enabled:1 ID: monday, enabled:1, value: false ID: tuesday, enabled:1, value: false ID: wednesday, enabled:1, value: false ID: thursday, enabled:1, value: false ID: friday, enabled:1, value: false ID: saturday, enabled:1, value: false ID: sunday, enabled:1, value: false ID: monthly, enabled:1, value: 1, minvalue: 1, maxvalue: 31 ID: scanprofile, enabled:1, value: ID: auto_deal_with_infections, enabled:1, value: false ID: updatedaily2, enabled:1, value: Daily 2 ID: time, enabled:1, value: Mon Mar 19 01:39:00 2012 ID: frequency, enabled:1, value: daily, domain: daily,monthly,once,systems tart,weekly ID: weekdays, enabled:1 ID: monday, enabled:1, value: false ID: tuesday, enabled:1, value: false ID: wednesday, enabled:1, value: false ID: thursday, enabled:1, value: false ID: friday, enabled:1, value: false ID: saturday, enabled:1, value: false ID: sunday, enabled:1, value: false ID: monthly, enabled:1, value: 1, minvalue: 1, maxvalue: 31 ID: scanprofile, enabled:1, value: ID: auto_deal_with_infections, enabled:1, value: false ID: updatedaily3, enabled:1, value: Daily 3 ID: time, enabled:1, value: Mon Mar 19 07:39:00 2012 ID: frequency, enabled:1, value: daily, domain: daily,monthly,once,systems tart,weekly ID: weekdays, enabled:1 ID: monday, enabled:1, value: false ID: tuesday, enabled:1, value: false ID: wednesday, enabled:1, value: false ID: thursday, enabled:1, value: false ID: friday, enabled:1, value: false ID: saturday, enabled:1, value: false ID: sunday, enabled:1, value: false ID: monthly, enabled:1, value: 1, minvalue: 1, maxvalue: 31 ID: scanprofile, enabled:1, value:

ID: auto_deal_with_infections, enabled:1, value: false ID: updatedaily4, enabled:1, value: Daily 4 ID: time, enabled:1, value: Mon Mar 19 13:39:00 2012 ID: frequency, enabled:1, value: daily, domain: daily,monthly,once,systems tart,weekly ID: weekdays, enabled:1 ID: monday, enabled:1, value: false ID: tuesday, enabled:1, value: false ID: wednesday, enabled:1, value: false ID: thursday, enabled:1, value: false ID: friday, enabled:1, value: false ID: saturday, enabled:1, value: false ID: sunday, enabled:1, value: false ID: monthly, enabled:1, value: 1, minvalue: 1, maxvalue: 31 ID: scanprofile, enabled:1, value: ID: auto_deal_with_infections, enabled:1, value: false ID: updateweekly1, enabled:1, value: Weekly ID: time, enabled:1, value: Mon Mar 19 19:39:00 2012 ID: frequency, enabled:1, value: weekly, domain: daily,monthly,once,system start,weekly ID: weekdays, enabled:1 ID: monday, enabled:1, value: true ID: tuesday, enabled:1, value: false ID: wednesday, enabled:1, value: false ID: thursday, enabled:1, value: true ID: friday, enabled:1, value: false ID: saturday, enabled:1, value: false ID: sunday, enabled:1, value: false ID: monthly, enabled:1, value: 1, minvalue: 1, maxvalue: 31 ID: scanprofile, enabled:1, value: ID: auto_deal_with_infections, enabled:1, value: false Appearance settings: ID: appearance, enabled:1 ID: skin, enabled:1, value: default.egl, reglocation: HKEY_LOCAL_MACHINE\SOFTW ARE\Lavasoft\Ad-Aware\Resource ID: showtrayicon, enabled:1, value: true ID: autoentertainmentmode, enabled:1, value: true ID: guimode, enabled:1, value: mode_advanced, domain: mode_advanced,mode_simpl e ID: language, enabled:1, value: en, reglocation: HKEY_LOCAL_MACHINE\SOFTWARE\L avasoft\Ad-Aware\Language Realtime protection settings: ID: realtime, enabled:1 ID: infomessages, enabled:1, value: onlyimportant, domain: display,dontnotify, onlyimportant ID: modules, enabled:1 ID: processprotection, enabled:1, value: true ID: onaccessprotection, enabled:1, value: true ID: registryprotection, enabled:1, value: true ID: networkprotection, enabled:1, value: true ID: layers, enabled:1 ID: useantivirus, enabled:1, value: true ID: usespywareheuristics, enabled:1, value: true ID: maintainbackup, enabled:1, value: true ****************************** System information ****************************** Computer name: YOUR-4DACD0EA75

Processor name: AMD Athlon(tm) 64 X2 Dual Core Processor 4200+ Processor identifier: x86 Family 15 Model 43 Stepping 1 Processor speed: ~2188MHZ Raw info: processorarchitecture 0, processortype 586, processorlevel 15, process or revision 11009, number of processors 2, processor features: [MMX,SSE,SSE2,3DN ow] Physical memory available: 1243676672 bytes Physical memory total: 2078777344 bytes Virtual memory available: 1644150784 bytes Virtual memory total: 2147352576 bytes Memory load: 40% Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Windows startup mode: Running processes: PID: 744 name: \SystemRoot\System32\smss.exe owner: SYSTEM domain: NT AUTHORITY PID: 784 name: C:\PROGRA~1\AVG\AVG2012\avgrsx.exe owner: SYSTEM domain: NT AUTHO RITY PID: 820 name: C:\Program Files\AVG\AVG2012\avgcsrvx.exe owner: SYSTEM domain: N T AUTHORITY PID: 1040 name: C:\WINDOWS\system32\csrss.exe owner: SYSTEM domain: NT AUTHORITY PID: 1080 name: C:\WINDOWS\system32\winlogon.exe owner: SYSTEM domain: NT AUTHOR ITY PID: 1132 name: C:\WINDOWS\system32\services.exe owner: SYSTEM domain: NT AUTHOR ITY PID: 1144 name: C:\WINDOWS\system32\lsass.exe owner: SYSTEM domain: NT AUTHORITY PID: 1328 name: C:\WINDOWS\system32\Ati2evxx.exe owner: SYSTEM domain: NT AUTHOR ITY PID: 1348 name: C:\WINDOWS\system32\svchost.exe owner: SYSTEM domain: NT AUTHORI TY PID: 1404 name: C:\WINDOWS\system32\svchost.exe owner: NETWORK SERVICE domain: N T AUTHORITY PID: 1480 name: C:\WINDOWS\System32\svchost.exe owner: SYSTEM domain: NT AUTHORI TY PID: 1552 name: C:\WINDOWS\system32\svchost.exe owner: NETWORK SERVICE domain: N T AUTHORITY PID: 1664 name: C:\WINDOWS\system32\svchost.exe owner: LOCAL SERVICE domain: NT AUTHORITY PID: 1972 name: C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe owner: SYSTEM domain: NT AUTHORITY PID: 1996 name: C:\WINDOWS\system32\Ati2evxx.exe owner: HP_Administrator domain: YOUR-4DACD0EA75 PID: 212 name: C:\WINDOWS\Explorer.EXE owner: HP_Administrator domain: YOUR-4DAC D0EA75 PID: 304 name: C:\WINDOWS\system32\spoolsv.exe owner: SYSTEM domain: NT AUTHORIT Y PID: 656 name: C:\WINDOWS\system32\svchost.exe owner: LOCAL SERVICE domain: NT A UTHORITY PID: 708 name: C:\WINDOWS\arservice.exe owner: SYSTEM domain: NT AUTHORITY PID: 728 name: C:\Program Files\AVG\AVG2012\avgwdsvc.exe owner: <UNKNOWN> domain : <UNKNOWN> PID: 1016 name: C:\Program Files\Common Files\LightScribe\LSSrvc.exe owner: SYST EM domain: NT AUTHORITY PID: 1232 name: C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE owner: SYSTEM domain: NT AUTHORITY PID: 1820 name: C:\WINDOWS\system32\svchost.exe owner: LOCAL SERVICE domain: NT AUTHORITY PID: 1868 name: C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\ 10.0.6\ToolbarUpdater.exe owner: SYSTEM domain: NT AUTHORITY PID: 428 name: C:\Program Files\AVG\AVG2012\avgnsx.exe owner: SYSTEM domain: NT

AUTHORITY PID: 444 name: C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe owner: <UNKNOWN> dom ain: <UNKNOWN> PID: 620 name: C:\WINDOWS\ehome\mcrdsvc.exe owner: LOCAL SERVICE domain: NT AUTH ORITY PID: 2608 name: C:\WINDOWS\system32\wbem\unsecapp.exe owner: SYSTEM domain: NT A UTHORITY PID: 2616 name: C:\WINDOWS\system32\wbem\wmiprvse.exe owner: SYSTEM domain: NT A UTHORITY PID: 2740 name: C:\WINDOWS\System32\alg.exe owner: LOCAL SERVICE domain: NT AUTH ORITY PID: 3352 name: C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe owner: HP_Adminis trator domain: YOUR-4DACD0EA75 PID: 2464 name: C:\WINDOWS\system32\wbem\wmiprvse.exe owner: NETWORK SERVICE dom ain: NT AUTHORITY PID: 3156 name: C:\WINDOWS\ehome\ehtray.exe owner: HP_Administrator domain: YOUR -4DACD0EA75 PID: 3172 name: C:\WINDOWS\ARPWRMSG.EXE owner: HP_Administrator domain: YOUR-4DA CD0EA75 PID: 3188 name: C:\Program Files\DISC\DISCover.exe owner: HP_Administrator domai n: YOUR-4DACD0EA75 PID: 3196 name: C:\Program Files\DISC\DiscUpdateMgr.exe owner: HP_Administrator domain: YOUR-4DACD0EA75 PID: 3216 name: C:\Program Files\HP\HP Software Update\HPwuSchd2.exe owner: HP_A dministrator domain: YOUR-4DACD0EA75 PID: 3232 name: C:\Program Files\AVG\AVG2012\avgtray.exe owner: <UNKNOWN> domain : <UNKNOWN> PID: 3248 name: C:\Program Files\AVG Secure Search\vprot.exe owner: HP_Administr ator domain: YOUR-4DACD0EA75 PID: 3264 name: C:\Documents and Settings\All Users\Application Data\Ad-Aware Br owsing Protection\adawarebp.exe owner: HP_Administrator domain: YOUR-4DACD0EA75 PID: 3368 name: C:\WINDOWS\system32\ctfmon.exe owner: HP_Administrator domain: Y OUR-4DACD0EA75 PID: 3392 name: C:\WINDOWS\eHome\ehmsas.exe owner: HP_Administrator domain: YOUR -4DACD0EA75 PID: 3456 name: C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe owner: HP_A dministrator domain: YOUR-4DACD0EA75 PID: 3452 name: C:\WINDOWS\system32\wuauclt.exe owner: HP_Administrator domain: YOUR-4DACD0EA75 PID: 3472 name: C:\Program Files\Updates from HP\9972322\Program\Updates from HP .exe owner: HP_Administrator domain: YOUR-4DACD0EA75 PID: 3628 name: C:\Program Files\DISC\DiscGui.exe owner: HP_Administrator domain : YOUR-4DACD0EA75 PID: 2020 name: C:\WINDOWS\eHome\ehSched.exe owner: SYSTEM domain: NT AUTHORITY PID: 1884 name: C:\WINDOWS\system32\dllhost.exe owner: SYSTEM domain: NT AUTHORI TY PID: 2508 name: C:\Program Files\DISC\DiscStreamHub.exe owner: HP_Administrator domain: YOUR-4DACD0EA75 PID: 3624 name: C:\WINDOWS\System32\svchost.exe owner: SYSTEM domain: NT AUTHORI TY PID: 1256 name: C:\HP\KBD\KBD.EXE owner: HP_Administrator domain: YOUR-4DACD0EA7 5 PID: 4068 name: C:\WINDOWS\ALCXMNTR.EXE owner: HP_Administrator domain: YOUR-4DA CD0EA75 PID: 1252 name: C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe owner: HP_Administrator domain: YOUR-4DACD0EA75 PID: 2408 name: c:\windows\system\hpsysdrv.exe owner: HP_Administrator domain: Y OUR-4DACD0EA75 PID: 2480 name: C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe owner: HP_Admi nistrator domain: YOUR-4DACD0EA75

PID: 3784 name: C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe owner: HP_Admini strator domain: YOUR-4DACD0EA75 Startup items: Name: PostBootReminder imagepath: {7849596a-48ea-486e-8937-a2a3009f31a9} Name: CDBurn imagepath: {fbeb8a05-beee-4442-804e-409d6c4515e9} Name: WebCheck imagepath: {E6FB5E20-DE35-11CF-9C87-00AA005127ED} Name: SysTray imagepath: {35CEC8A3-2BE6-11D2-8773-92E220524153} Name: ehTray imagepath: C:\WINDOWS\ehome\ehtray.exe Name: AlwaysReady Power Message APP imagepath: ARPWRMSG.EXE Name: HPHUPD08 imagepath: c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11 D-98895B3A3729}\hphupd08.exe Name: DISCover imagepath: C:\Program Files\DISC\DISCover.exe Name: DiscUpdateManager imagepath: C:\Program Files\DISC\DiscUpdateMgr.exe Name: PCDrProfiler Name: HPBootOp imagepath: "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootO p.exe" /run Name: HP Software Update imagepath: C:\Program Files\HP\HP Software Update\HPwuSchd2.exe Name: AVG_TRAY imagepath: "C:\Program Files\AVG\AVG2012\avgtray.exe" Name: vProt imagepath: "C:\Program Files\AVG Secure Search\vprot.exe" Name: Ad-Aware Browsing Protection imagepath: "C:\Documents and Settings\All Users\Application Data\Ad-Aw are Browsing Protection\adawarebp.exe" Name: {438755C2-A8BA-11D1-B96B-00A0C90312E1} imagepath: Browseui preloader Name: {8C7461EF-2B13-11d2-BE35-3078302C2030} imagepath: Component Categories cache daemon Name: adaware imagepath: reg.exe delete "HKCU\Software\AppDataLow\Software\adaware" /f Name: adaware_XP imagepath: reg.exe delete "HKCU\Software\adaware" /f Name: imagepath: C:\Documents and Settings\All Users\Start Menu\Programs\Sta rtup\desktop.ini Name: location: C:\Documents and Settings\All Users\Start Menu\Programs\Star tup\HP Digital Imaging Monitor.lnk imagepath: C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe Name: location: C:\Documents and Settings\All Users\Start Menu\Programs\Star tup\Updates from HP.lnk imagepath: C:\Program Files\Updates from HP\9972322\Program\Updates fr om HP.exe Name: imagepath: C:\WINDOWS\system32\config\systemprofile\Start Menu\Program s\Startup\desktop.ini

Bootexecute items: Name: imagepath: autocheck autochk * Name: imagepath: C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart Name: imagepath: lsdelete Running services: Name: ALG displayname: Application Layer Gateway Service Name: ARSVC displayname: ARSVC Name: Ati HotKey Poller displayname: Ati HotKey Poller Name: AudioSrv displayname: Windows Audio Name: AVGIDSAgent displayname: AVGIDSAgent Name: avgwd displayname: AVG WatchDog Name: BITS displayname: Background Intelligent Transfer Service Name: COMSysApp displayname: COM+ System Application Name: CryptSvc displayname: Cryptographic Services Name: DcomLaunch displayname: DCOM Server Process Launcher Name: Dhcp displayname: DHCP Client Name: dmserver displayname: Logical Disk Manager Name: Dnscache displayname: DNS Client Name: ERSvc displayname: Error Reporting Service Name: Eventlog displayname: Event Log Name: EventSystem displayname: COM+ Event System Name: FastUserSwitchingCompatibility displayname: Fast User Switching Compatibility Name: helpsvc displayname: Help and Support Name: HidServ displayname: HID Input Service Name: HTTPFilter displayname: HTTP SSL Name: lanmanserver displayname: Server Name: lanmanworkstation displayname: Workstation Name: Lavasoft Ad-Aware Service displayname: Lavasoft Ad-Aware Service Name: LightScribeService displayname: LightScribeService Direct Disc Labeling Service Name: LmHosts displayname: TCP/IP NetBIOS Helper

Name: McrdSvc displayname: Name: MDM displayname: Name: Netman displayname: Name: Nla displayname: Name: PlugPlay displayname: Name: PolicyAgent displayname: Name: ProtectedStorage displayname: Name: RasMan displayname: Name: RemoteRegistry displayname: Name: RpcSs displayname: Name: SamSs displayname: Name: Schedule displayname: Name: seclogon displayname: Name: SENS displayname: Name: SharedAccess displayname: Name: ShellHWDetection displayname: Name: Spooler displayname: Name: srservice displayname: Name: SSDPSRV displayname: Name: TapiSrv displayname: Name: TermService displayname: Name: Themes displayname: Name: TrkWks displayname: Name: vToolbarUpdater displayname: Name: W32Time displayname: Name: WebClient displayname: Name: winmgmt displayname: Name: wscsvc displayname: Name: wuauserv displayname: Name: WZCSVC displayname:

Media Center Extender Service Machine Debug Manager Network Connections Network Location Awareness (NLA) Plug and Play IPSEC Services Protected Storage Remote Access Connection Manager Remote Registry Remote Procedure Call (RPC) Security Accounts Manager Task Scheduler Secondary Logon System Event Notification Windows Firewall/Internet Connection Sharing (ICS) Shell Hardware Detection Print Spooler System Restore Service SSDP Discovery Service Telephony Terminal Services Themes Distributed Link Tracking Client vToolbarUpdater Windows Time WebClient Windows Management Instrumentation Security Center Automatic Updates Wireless Zero Configuration

Name: ehSched displayname: Media Center Scheduler Service