Spyware / Malware / Virus Removal

[Closed] Spyware Protect 2009

24 min read

Looking for the outcome? Ask AI

SpySentinel

Post #16May 27, 2009, 2:35 PM UTC

Hi Al1mh12,

If you want, once you are all clean from me, you can go over to the Tech Forum and see if they can help with your sound problem.

I recommend that you remove the AOL Spyware Protection. I will have a list of good free AntiSpyware programs for you once you are all clean.

Please go to Start > Control Panel > Add/Remove Programs and remove the following (if present):

AOL Spyware Protection

Please double-click OTM.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:processes
explorer.exe

:Files
C:\Program Files\Fast Browser Search
C:\Documents and Settings\Debbie\Desktop\LimeWire

:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1BB22D38-A411-4B13-A746-C2A4F4EC7344}"=-

:commands
[purity]
[emptytemp]
[start explorer]

Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Al1mh12

Post #17May 27, 2009, 3:20 PM UTC

Not having any luck getting OTM.exe to run…double click no go…."run otm.exe" no go notice I can't read or follow directions well….it is in "shared documents"….cut and paste to desktop…ne getz….cut and paste back into "shared documents" no go…try to remove and re-download……"Control panel/add and remove"…..can't find otm…… "search C/All files" …seems to go into a loop open file security warning……run…."hourglass" for a few seconds then nada chit!!!

what I did??

SpySentinel

Post #18May 28, 2009, 7:14 PM UTC

Try this:

Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:processes
explorer.exe

:Files
C:\Program Files\Fast Browser Search
C:\Documents and Settings\Debbie\Desktop\LimeWire

:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1BB22D38-A411-4B13-A746-C2A4F4EC7344}"=-

:commands
[purity]
[emptytemp]
[start explorer]

Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Al1mh12

Post #19May 28, 2009, 10:00 PM UTC

Sorry to report that it doesn't seem to run any better today than it did yesterday morning. Appearently my broken English was unintelligible. The OTMoveIt3 had ran on 24 May 2009. It did not on 27 May 2009. It does not seem to run on 28 May 2009. Any guidance out of my evident ignorance would be greatly appreciated. Thank you.

SpySentinel

Post #20May 30, 2009, 10:50 PM UTC

Hi Al1mh12,

Please delete OTMoveIt3, as there as been a new release.

Please download the OTM.

Save it to your desktop.
Please double-click OTM.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:processes
explorer.exe

:Files
C:\Program Files\Fast Browser Search
C:\Documents and Settings\Debbie\Desktop\LimeWire

:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1BB22D38-A411-4B13-A746-C2A4F4EC7344}"=-

:commands
[purity]
[emptytemp]
[start explorer]

Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTM

Al1mh12

Post #21May 31, 2009, 12:12 AM UTC

Deleting and downloading OTM on 30 May 2009 seems to perform the same as that which I have deleted and down-loaded on the 27th, 28th, and 29th of May 2009. After double-clicking to run, the "hour-glass" is displayed for about five seconds, it then disappears and nothing else seems to happen. It does show up in task manager as a running process utilizing 50% of CPU Usage. Over the last two days I have allowed it to go on for over an hour with no noticable change. When I ran it on the 24th of May 2009, I was presented with a screen that allowed me to do the enter the commands you requested. Since that initial success, there have been no other screens come up. I would greatly appreciate it if you could give me some thoughts on what I may be doing incorrectly. Thank you.

SpySentinel

Post #22June 2, 2009, 12:14 AM UTC

Hi Al1mh12,

Can you please navigate to C:\_OTM\MovedFiles folder and if there are any logs, to please post them here.

Al1mh12

Post #23June 2, 2009, 12:39 AM UTC

========== PROCESSES ========== Process explorer.exe killed successfully. ========== FILES ========== C:\Documents and Settings\Debbie\Desktop\Music\saving abel - 18 days.mp3 moved successfully. C:\Documents and Settings\Debbie\Desktop\Music\sex nickelback.mp3 moved successfully. ========== COMMANDS ========== User's Temp folder emptied. User's Internet Explorer cache folder emptied. File delete failed. C:\Documents and Settings\Debbie\Local Settings\Temporary Internet Files\Content.IE5\V4MO2PTI\Spyware_Protect_2009_t103314[1].html scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Debbie\Local Settings\Temporary Internet Files\Content.IE5\QH5879G0\Include[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Debbie\Local Settings\Temporary Internet Files\Content.IE5\QH5879G0\Sync[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Debbie\Local Settings\Temporary Internet Files\Content.IE5\GK03W8UW\defaulta[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Debbie\Local Settings\Temporary Internet Files\Content.IE5\GK03W8UW\iframe[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Debbie\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Debbie\Local Settings\Temporary Internet Files\AntiPhishing\4069DF2E-0DD4-4F34-9DE6-67F136F30810.dat scheduled to be deleted on reboot. User's Temporary Internet Files folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Network Service Temp folder emptied. Network Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\logishrd\LVPrcInj01.dll scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_110.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTM by OldTimer - Version 2.1.0.0 log created on 05242009_172227 Files moved on Reboot… C:\Documents and Settings\Debbie\Local Settings\Temporary Internet Files\Content.IE5\V4MO2PTI\Spyware_Protect_2009_t103314[1].html moved successfully. C:\Documents and Settings\Debbie\Local Settings\Temporary Internet Files\Content.IE5\QH5879G0\Include[1].htm moved successfully. C:\Documents and Settings\Debbie\Local Settings\Temporary Internet Files\Content.IE5\QH5879G0\Sync[1].htm moved successfully. C:\Documents and Settings\Debbie\Local Settings\Temporary Internet Files\Content.IE5\GK03W8UW\defaulta[1].htm moved successfully. C:\Documents and Settings\Debbie\Local Settings\Temporary Internet Files\Content.IE5\GK03W8UW\iframe[1].htm moved successfully. C:\Documents and Settings\Debbie\Local Settings\Temporary Internet Files\AntiPhishing\4069DF2E-0DD4-4F34-9DE6-67F136F30810.dat moved successfully. DllUnregisterServer procedure not found in C:\WINDOWS\temp\logishrd\LVPrcInj01.dll C:\WINDOWS\temp\logishrd\LVPrcInj01.dll NOT unregistered. File move failed. C:\WINDOWS\temp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot. File C:\WINDOWS\temp\Perflib_Perfdata_110.dat not found! Registry entries deleted on Reboot… This is the log that was in the folder….looks a lot like the one from the 24th of May 2009

SpySentinel

Post #24June 2, 2009, 7:18 PM UTC

New Plan:

Download OTListIt2 to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

Al1mh12

Post #25June 3, 2009, 12:53 AM UTC

OTL logfile created on: 6/2/2009 7:22:32 PM - Run 1
OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\Debbie\Desktop
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18372)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 100.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 112.60 Gb Free Space | 75.55% Space Free | Partition Type: NTFS
Drive D: | 698.96 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DEBBIE-LAPTOP
Current User Name: Debbie
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\system32\agrsmsvc.exe (Agere Systems)
PRC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (America Online)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe (TOSHIBA Corporation)
PRC - C:\WINDOWS\system32\TDispVol.exe (TOSHIBA Corporation)
PRC - C:\WINDOWS\system32\igfxtray.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\hkcmd.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\igfxpers.exe (Intel Corporation)
PRC - C:\WINDOWS\ehome\ehtray.exe (Microsoft Corporation)
PRC - C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe (TOSHIBA)
PRC - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
PRC - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe (America Online, Inc)
PRC - C:\Program Files\ltmoh\Ltmoh.exe (Agere Systems)
PRC - C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
PRC - C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple, Inc.)
PRC - C:\Program Files\Synaptics\SynTP\Toshiba.exe (Synaptics, Inc.)
PRC - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe (America Online Inc)
PRC - C:\Program Files\Toshiba\Tvs\TvsTray.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\WINDOWS\system32\TPSMain.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
PRC - C:\WINDOWS\system32\dla\DLACTRLW.exe (Sonic Solutions)
PRC - C:\toshiba\ivp\ism\pinger.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
PRC - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
PRC - C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.)
PRC - C:\WINDOWS\eHome\ehRecvr.exe (Microsoft Corporation)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
PRC - C:\WINDOWS\system32\TPSBattM.exe (TOSHIBA Corporation)
PRC - C:\WINDOWS\eHome\ehSched.exe (Microsoft Corporation)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Nova Development\Photo Explosion Deluxe 3.0\calcheck.exe (Ulead Systems, Inc.)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
PRC - C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe (TOSHIBA)
PRC - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.)
PRC - C:\WINDOWS\system32\RAMASST.exe (Matsushita Electric Industrial Co., Ltd.)
PRC - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe ()
PRC - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe (TOSHIBA Corp.)
PRC - C:\WINDOWS\ehome\mcrdsvc.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe ()
PRC - C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\wscntfy.exe (Microsoft Corporation)
PRC - C:\WINDOWS\eHome\ehmsas.exe (Microsoft Corporation)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe (Yahoo! Inc.)
PRC - C:\Documents and Settings\Debbie\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (AgereModemAudio [Auto | Running]) – C:\WINDOWS\system32\agrsmsvc.exe (Agere Systems)
SRV - (AOL ACS [Auto | Running]) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (America Online)
SRV - (AOL TopSpeedMonitor [Auto | Running]) – C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe (America Online, Inc)
SRV - (Apple Mobile Device [Auto | Running]) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple, Inc.)
SRV - (aspnet_state [On_Demand | Stopped]) – File not found
SRV - (CFSvcs [Auto | Running]) – C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (DVD-RAM_Service [Auto | Running]) – C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.)
SRV - (ehRecvr [Auto | Running]) – C:\WINDOWS\eHome\ehRecvr.exe (Microsoft Corporation)
SRV - (ehSched [Auto | Running]) – C:\WINDOWS\eHome\ehSched.exe (Microsoft Corporation)
SRV - (EvtEng [Auto | Running]) – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (iPod Service [On_Demand | Running]) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (JavaQuickStarterService [Auto | Running]) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (LVPrcSrv [Auto | Running]) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (McrdSvc [Auto | Running]) – C:\WINDOWS\ehome\mcrdsvc.exe (Microsoft Corporation)
SRV - (McShield [Unknown | Stopped]) – File not found
SRV - (McSysmon [On_Demand | Stopped]) – File not found
SRV - (MHN [On_Demand | Stopped]) – C:\WINDOWS\System32\mhn.dll (Microsoft Corporation)
SRV - (ose [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (RegSrvc [Auto | Running]) – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (S24EventMonitor [Auto | Running]) – C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
SRV - (SeaPort [Auto | Running]) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.)
SRV - (Swupdtmr [Auto | Running]) – c:\TOSHIBA\IVP\swupdate\swupdtmr.exe ()
SRV - (TAPPSRV [Auto | Running]) – C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe (TOSHIBA Corp.)
SRV - (UMWdf [On_Demand | Stopped]) – C:\WINDOWS\system32\wdfmgr.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (AegisP [Auto | Running]) – C:\WINDOWS\system32\DRIVERS\AegisP.sys (Meetinghouse Data Communications)
DRV - (AgereSoftModem [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\AGRSM.sys (Agere Systems)
DRV - (ASCTRM [Auto | Running]) – C:\WINDOWS\System32\drivers\asctrm.sys (Windows ® 2000 DDK provider)
DRV - (DLABOIOM [Auto | Running]) – C:\WINDOWS\System32\DLA\DLABOIOM.SYS (Sonic Solutions)
DRV - (DLACDBHM [System | Running]) – C:\WINDOWS\System32\Drivers\DLACDBHM.SYS (Sonic Solutions)
DRV - (DLADResN [Auto | Running]) – C:\WINDOWS\System32\DLA\DLADResN.SYS (Sonic Solutions)
DRV - (DLAIFS_M [Auto | Running]) – C:\WINDOWS\System32\DLA\DLAIFS_M.SYS (Sonic Solutions)
DRV - (DLAOPIOM [Auto | Running]) – C:\WINDOWS\System32\DLA\DLAOPIOM.SYS (Sonic Solutions)
DRV - (DLAPoolM [Auto | Running]) – C:\WINDOWS\System32\DLA\DLAPoolM.SYS (Sonic Solutions)
DRV - (DLARTL_N [System | Running]) – C:\WINDOWS\System32\Drivers\DLARTL_N.SYS (Sonic Solutions)
DRV - (DLAUDFAM [Auto | Running]) – C:\WINDOWS\System32\DLA\DLAUDFAM.SYS (Sonic Solutions)
DRV - (DLAUDF_M [Auto | Running]) – C:\WINDOWS\System32\DLA\DLAUDF_M.SYS (Sonic Solutions)
DRV - (DRVMCDB [Boot | Running]) – C:\WINDOWS\System32\Drivers\DRVMCDB.SYS (Sonic Solutions)
DRV - (DRVNDDM [Auto | Running]) – C:\WINDOWS\System32\Drivers\DRVNDDM.SYS (Sonic Solutions)
DRV - (E100B [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\e100b325.sys (Intel Corporation)
DRV - (e1express [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\e1e5132.sys (Intel Corporation)
DRV - (GEARAspiWDM [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (HDAudBus [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider)
DRV - (ialm [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (IntcAzAudAddService [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Iviaspi [On_Demand | Running]) – C:\WINDOWS\system32\drivers\iviaspi.sys (InterVideo, Inc.)
DRV - (KR10N [Boot | Running]) – C:\WINDOWS\system32\drivers\KR10N.sys (TOSHIBA CORPORATION)
DRV - (LVPr2Mon [On_Demand | Running]) – C:\WINDOWS\system32\Drivers\LVPr2Mon.sys ()
DRV - (LVRS [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\lvrs.sys (Logitech Inc.)
DRV - (LVUSBSta [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (meiudf [System | Running]) – C:\WINDOWS\System32\Drivers\meiudf.sys (Matsushita Electric Industrial Co.,Ltd.)
DRV - (mfeavfk [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfebopk [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mfehidk [System | Running]) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mferkdk [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (mfesmfk [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (Netdevio [Auto | Running]) – C:\WINDOWS\system32\DRIVERS\netdevio.sys (TOSHIBA Corporation.)
DRV - (pepifilter [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\lv302af.sys (Logitech Inc.)
DRV - (PID_PEPI [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\LV302V32.SYS (Logitech Inc.)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (s24trans [Auto | Running]) – C:\WINDOWS\system32\DRIVERS\s24trans.sys (Intel Corporation)
DRV - (SASDIFSV [System | Running]) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM [On_Demand | Running]) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL [System | Running]) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SynTP [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\SynTP.sys (Synaptics, Inc.)
DRV - (tbiosdrv [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\tbiosdrv.sys ()
DRV - (tifm21 [On_Demand | Running]) – C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments)
DRV - (tosrfec [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\tosrfec.sys (TOSHIBA Corporation)
DRV - (TVALD [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\NBSMI.sys (Toshiba Corporation)
DRV - (Tvs [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\Tvs.sys (TOSHIBA Corporation)
DRV - (USBAAPL [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\usbaapl.sys (Apple, Inc.)
DRV - (usbaudio [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (w39n51 [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\w39n51.sys (Intel® Corporation)
DRV - (wanatw [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\wanatw4.sys (America Online, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.msn.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.4

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009/03/29 10:44:27 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.4\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2008/12/12 13:33:43 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.4\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/03/29 10:44:53 | 00,000,000 | —D | M]

[2008/12/12 13:33:44 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\mozilla\Extensions
[2008/12/12 13:33:44 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2008/12/12 13:33:44 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\mozilla\Firefox\Profiles\wofiocwj.default\extensions
[2009/01/30 09:28:52 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\mozilla\Firefox\Profiles\wofiocwj.default\extensions\[removed]
[2009/03/29 10:45:02 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions
[2008/12/12 13:28:22 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/03/29 10:45:02 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2008/10/31 15:56:14 | 00,023,040 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2008/10/31 15:56:15 | 00,134,656 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2008/10/30 01:00:50 | 00,001,394 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2008/10/30 01:00:50 | 00,002,193 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2008/10/30 01:00:50 | 00,001,534 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2008/10/30 01:00:50 | 00,002,343 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2008/10/30 01:00:50 | 00,001,706 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google.xml
[2008/10/30 01:00:50 | 00,001,178 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2008/10/30 01:00:50 | 00,000,792 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo.xml

O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (Fast Browser Search Toolbar Helper) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll ()
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Fast Browser Search Toolbar) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll ()
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AGRSMMSG] AGRSMMSG.exe (Agere Systems)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent File not found
O4 - HKLM..\Run: [dla] C:\WINDOWS\system32\dla\DLACTRLW.exe (Sonic Solutions)
O4 - HKLM..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe (Microsoft Corporation)
O4 - HKLM..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" (Intel Corporation)
O4 - HKLM..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" (Apple Inc.)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide ()
O4 - HKLM..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe (Agere Systems)
O4 - HKLM..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume (Microsoft Corp.)
O4 - HKLM..\Run: [NDSTray.exe] NDSTray.exe File not found
O4 - HKLM..\Run: [PhotoExplosionCalCheck] C:\Program Files\Nova Development\Photo Explosion Deluxe 3.0\calcheck.exe (Ulead Systems, Inc.)
O4 - HKLM..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run (TOSHIBA Corporation)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [RTHDCPL] RTHDCPL.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TDispVol] TDispVol.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TFncKy] TFncKy.exe File not found
O4 - HKLM..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe (TOSHIBA)
O4 - HKLM..\Run: [TPSMain] TPSMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe (TOSHIBA Corporation)
O4 - HKCU..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet (Yahoo! Inc.)
O4 - HKCU..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe (TOSHIBA)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe (Matsushita Electric Industrial Co., Ltd.)
O4 - Startup: C:\Documents and Settings\Debbie\Start Menu\Programs\Startup\Logitech . Product Registration.lnk = C:\Program Files\Logitech\QuickCam\eReg.exe (Leader Technologies/Logitech)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &ieSpell; Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM (Red Egg Software)
O8 - Extra context menu item: &Search; - Reg Error: Value error. File not found
O8 - Extra context menu item: Check &Spelling; - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM (Red Egg Software)
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation)
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM File not found
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM File not found
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [Bluetooth Namespace] - C:\WINDOWS\system32\wshbth.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} http://cdn2.zone.msn.com/binFramework/v10/…rk.cab56649.cab (StagingUI Object)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab (MSN Games – Buddy Invite)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab (ZonePAChat Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} http://zone.msn.com/bingame/zpagames/ZPA_B…on.cab64162.cab (MSN Games – Backgammon)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/02/15 10:38:58 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2009/04/20 09:29:09 | 00,000,143 | R— | M] () - D:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - * [2009/06/02 19:17:23 | 00,000,000 | —D | M]

========== Files/Folders - Created Within 30 Days ==========

[2009/06/02 19:17:19 | 00,501,760 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Debbie\Desktop\OTL.exe
[2009/06/02 06:40:40 | 00,054,156 | -H– | C] () – C:\WINDOWS\QTFont.qfn
[2009/06/02 06:40:40 | 00,001,409 | —- | C] () – C:\WINDOWS\QTFont.for
[2009/05/30 20:36:04 | 32,107,92960 | -HS- | C] () – C:\hiberfil.sys
[2009/05/30 19:02:00 | 00,389,632 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Debbie\Desktop\OTM.exe
[2009/05/30 18:49:24 | 00,000,000 | —D | C] – C:\Program Files\ieSpell
[2009/05/25 14:53:33 | 00,000,000 | —D | C] – C:\Documents and Settings\Debbie\Desktop\Adobe Reader 9 Installer
[2009/05/25 14:46:40 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS
[2009/05/25 14:46:39 | 00,000,000 | —D | C] – C:\Program Files\NOS
[2009/05/25 14:41:16 | 00,000,000 | —D | C] – C:\Program Files\trend micro
[2009/05/25 14:41:15 | 00,000,000 | —D | C] – C:\rsit
[2009/05/25 14:39:03 | 00,781,909 | —- | C] () – C:\Documents and Settings\Debbie\Desktop\RSIT.exe
[2009/05/24 21:33:59 | 02,967,739 | R— | C] () – C:\Documents and Settings\Debbie\Desktop\ComboFix.exe
[2009/05/24 19:34:22 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2009/05/24 19:34:15 | 00,000,832 | —- | C] () – C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2009/05/24 19:34:12 | 00,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2009/05/24 19:34:12 | 00,000,000 | —D | C] – C:\Documents and Settings\Debbie\Application Data\SUPERAntiSpyware.com
[2009/05/24 17:22:27 | 00,000,000 | —D | C] – C:\_OTM
[2009/05/24 16:44:13 | 00,000,000 | -HSD | C] – C:\RECYCLER
[2009/05/22 22:22:23 | 24,699,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MRT.exe
[2009/05/22 21:13:07 | 00,401,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rpcss.dll
[2009/05/22 21:13:07 | 00,284,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pdh.dll
[2009/05/22 21:13:07 | 00,060,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\colbact.dll
[2009/05/22 21:13:07 | 00,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sc.exe
[2009/05/22 21:13:06 | 00,715,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntdll.dll
[2009/05/22 21:13:06 | 00,617,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\advapi32.dll
[2009/05/22 21:13:06 | 00,473,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fastprox.dll
[2009/05/22 21:13:06 | 00,227,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiprvse.exe
[2009/05/22 21:13:06 | 00,110,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\services.exe
[2009/05/22 21:12:49 | 00,000,000 | —D | C] – C:\Documents and Settings\Debbie\Local Settings\temp
[2009/05/22 21:10:52 | 01,193,414 | —- | C] () – C:\WINDOWS\System32\dllcache\sysmain.sdb
[2009/05/22 21:10:50 | 00,215,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wordpad.exe
[2009/05/22 21:05:43 | 00,000,000 | —D | C] – C:\WINDOWS\temp
[2009/05/22 19:25:03 | 05,646,838 | —- | C] () – C:\Documents and Settings\All Users\Documents\untitled.bmp
[2009/05/22 18:04:49 | 00,000,209 | —- | C] () – C:\Boot.bak
[2009/05/22 18:04:46 | 00,260,272 | —- | C] () – C:\cmldr
[2009/05/22 18:04:43 | 00,000,000 | RHSD | C] – C:\cmdcons
[2009/05/22 18:02:37 | 00,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2009/05/22 18:02:37 | 00,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2009/05/22 18:02:37 | 00,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2009/05/22 18:02:37 | 00,130,048 | —- | C] () – C:\WINDOWS\PEV.exe
[2009/05/22 18:02:37 | 00,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2009/05/22 18:02:37 | 00,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2009/05/22 18:02:37 | 00,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2009/05/22 18:02:37 | 00,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2009/05/22 18:02:31 | 00,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2009/05/22 18:02:27 | 00,000,000 | —D | C] – C:\Qoobox
[2009/05/22 18:00:24 | 02,967,739 | R— | C] () – C:\Documents and Settings\All Users\Documents\ComboFix.exe
[2009/05/22 13:13:51 | 00,000,000 | —D | C] – C:\Program Files\Enigma Software Group
[2009/05/22 13:13:14 | 10,177,288 | —- | C] () – C:\Documents and Settings\Debbie\Desktop\SpyHunter-Scanner-Install.exe
[2009/05/22 11:47:49 | 00,015,504 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/05/22 11:47:49 | 00,000,707 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/05/22 11:47:46 | 00,038,496 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/05/22 11:47:43 | 00,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2009/05/22 10:57:19 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Wise Installation Wizard
[2009/05/22 10:52:15 | 00,000,000 | —D | C] – C:\WINDOWS\U3DNX7HR1AKU3DNX
[2009/05/22 09:24:10 | 00,023,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\psapi.dll
[2009/05/22 09:24:07 | 00,009,483 | —- | C] () – C:\WINDOWS\System32\Config.MPF
[2009/05/22 07:49:18 | 06,367,264 | —- | C] () – C:\Documents and Settings\Debbie\Desktop\SUPERAntiSpyware.exe
[2009/05/22 07:15:35 | 00,000,000 | —D | C] – C:\Documents and Settings\Debbie\Application Data\Malwarebytes
[2009/05/22 07:15:30 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/05/22 07:14:34 | 02,967,800 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Debbie\Desktop\gogetum001.exe
[2009/05/21 19:06:18 | 00,000,000 | —D | C] – C:\WINDOWS\Minidump
[2008/12/16 22:58:54 | 00,025,624 | —- | C] () – C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2008/12/16 22:50:56 | 00,013,584 | —- | C] () – C:\WINDOWS\System32\drivers\iKeyLgFT.dll
[2008/11/27 17:17:18 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2008/07/26 15:42:52 | 00,081,110 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2006/02/24 23:28:54 | 00,045,056 | —- | C] () – C:\WINDOWS\System32\TDispVol.dll
[2006/02/16 10:07:58 | 00,000,012 | —- | C] () – C:\WINDOWS\dirsaver.ini
[2006/02/16 04:50:52 | 00,000,222 | —- | C] () – C:\WINDOWS\wininit.ini
[2006/02/16 04:25:21 | 00,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2006/02/16 04:25:21 | 00,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2006/02/16 04:25:21 | 00,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2006/02/16 04:25:21 | 00,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2006/02/16 04:25:21 | 00,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2006/02/16 04:25:21 | 00,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2006/02/15 11:41:53 | 00,036,736 | —- | C] () – C:\WINDOWS\System32\drivers\CSIIDecoder_kern_i386.sys
[2006/02/15 11:41:53 | 00,029,184 | —- | C] () – C:\WINDOWS\System32\drivers\TSXT_kern_i386.sys
[2006/02/15 11:40:07 | 00,000,000 | —- | C] () – C:\WINDOWS\NDSTray.INI
[2006/02/15 11:28:50 | 00,128,113 | —- | C] () – C:\WINDOWS\System32\csellang.ini
[2006/02/15 11:28:50 | 00,045,056 | —- | C] () – C:\WINDOWS\System32\csellang.dll
[2006/02/15 11:28:50 | 00,010,165 | —- | C] () – C:\WINDOWS\System32\tosmreg.ini
[2006/02/15 11:28:50 | 00,007,671 | —- | C] () – C:\WINDOWS\System32\cseltbl.ini
[2006/02/15 11:25:00 | 00,118,784 | —- | C] () – C:\WINDOWS\System32\TCtrlIO.dll
[2006/02/15 11:25:00 | 00,053,248 | —- | C] ( ) – C:\WINDOWS\System32\DLLVGA.dll
[2006/02/15 10:44:19 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/02/15 10:34:07 | 00,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2006/02/15 09:09:00 | 00,000,341 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2006/02/15 09:04:21 | 00,000,712 | —- | C] () – C:\WINDOWS\win.ini
[2006/02/15 09:04:05 | 00,000,227 | —- | C] () – C:\WINDOWS\system.ini
[2005/11/28 23:33:56 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/09/02 17:44:08 | 00,110,592 | —- | C] () – C:\WINDOWS\System32\TosBtAcc.dll
[2005/08/24 18:20:28 | 00,009,472 | —- | C] () – C:\WINDOWS\System32\drivers\tbiosdrv.sys
[2005/08/05 17:01:54 | 00,239,104 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2005/07/23 00:30:20 | 00,065,536 | —- | C] () – C:\WINDOWS\System32\TosCommAPI.dll
[2004/07/20 20:04:02 | 00,094,208 | —- | C] () – C:\WINDOWS\System32\TosBtHcrpAPI.dll
[2004/01/15 17:43:28 | 00,114,688 | —- | C] () – C:\WINDOWS\System32\TBTMonUI.dll
[2003/01/07 18:05:08 | 00,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI

========== Files - Modified Within 30 Days ==========

[1 C:\WINDOWS\System32\*.tmp files]
[2009/06/02 19:17:23 | 00,501,760 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Debbie\Desktop\OTL.exe
[2009/06/02 19:13:14 | 00,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2009/06/02 19:12:32 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/06/02 19:12:26 | 00,000,062 | -HS- | M] () – C:\Documents and Settings\Debbie\Local Settings\desktop.ini
[2009/06/02 19:12:18 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/06/02 19:12:13 | 32,107,92960 | -HS- | M] () – C:\hiberfil.sys
[2009/06/02 06:40:40 | 00,001,409 | —- | M] () – C:\WINDOWS\QTFont.for
[2009/05/30 19:02:15 | 00,389,632 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Debbie\Desktop\OTM.exe
[2009/05/25 14:39:09 | 00,781,909 | —- | M] () – C:\Documents and Settings\Debbie\Desktop\RSIT.exe
[2009/05/24 19:34:15 | 00,000,832 | —- | M] () – C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2009/05/24 19:33:37 | 06,367,264 | —- | M] () – C:\Documents and Settings\Debbie\Desktop\SUPERAntiSpyware.exe
[2009/05/23 06:48:44 | 00,467,158 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/05/23 06:48:44 | 00,399,284 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/05/23 06:48:44 | 00,061,440 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/05/23 01:37:23 | 00,130,048 | —- | M] () – C:\WINDOWS\PEV.exe
[2009/05/22 22:23:57 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/05/22 21:08:57 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2009/05/22 21:07:12 | 00,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2009/05/22 19:25:04 | 05,646,838 | —- | M] () – C:\Documents and Settings\All Users\Documents\untitled.bmp
[2009/05/22 18:04:49 | 00,000,279 | RHS- | M] () – C:\boot.ini
[2009/05/22 17:55:34 | 02,967,739 | R— | M] () – C:\Documents and Settings\Debbie\Desktop\ComboFix.exe
[2009/05/22 17:55:34 | 02,967,739 | R— | M] () – C:\Documents and Settings\All Users\Documents\ComboFix.exe
[2009/05/22 13:11:45 | 10,177,288 | —- | M] () – C:\Documents and Settings\Debbie\Desktop\SpyHunter-Scanner-Install.exe
[2009/05/22 11:47:49 | 00,000,707 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/05/22 09:24:05 | 00,009,483 | —- | M] () – C:\WINDOWS\System32\Config.MPF
[2009/05/22 07:14:51 | 02,967,800 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Debbie\Desktop\gogetum001.exe
[2009/05/07 00:16:30 | 24,699,336 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MRT.exe

========== LOP Check ==========

[2009/05/25 14:46:40 | 00,000,000 | RH-D | M] – C:\Documents and Settings\All Users\Application Data
[2006/02/16 04:34:11 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Adobe
[2009/05/27 09:43:26 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AOL
[2008/11/28 14:30:17 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple
[2008/11/28 14:31:43 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple Computer
[2009/02/18 17:20:43 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BVRP Software
[2006/02/17 04:57:21 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DIGStream
[2008/11/27 17:22:00 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Intel
[2009/01/06 14:41:38 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Kodak
[2009/02/06 07:15:57 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Logishrd
[2009/02/04 13:20:43 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Logitech
[2009/05/22 07:15:30 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/05/01 08:16:34 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\McAfee
[2009/03/03 11:47:15 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\McAfee.com
[2009/03/29 10:47:25 | 00,000,000 | –SD | M] – C:\Documents and Settings\All Users\Application Data\Microsoft
[2009/05/25 17:53:32 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NOS
[2006/02/16 04:55:50 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Pure Networks
[2006/02/16 04:56:13 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\QuickTime
[2008/12/25 10:24:04 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SiteAdvisor
[2009/05/24 19:34:22 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2009/05/21 21:32:45 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/04/09 12:00:31 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ulead Systems
[2006/02/16 04:55:51 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2008/11/27 18:44:58 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2008/11/27 18:16:04 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Yahoo!
[2008/11/27 18:10:15 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
[2009/05/24 19:34:12 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Debbie\Application Data
[2008/12/01 14:41:23 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\Adobe
[2008/12/04 08:35:07 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\AdobeUM
[2009/02/10 19:06:05 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\aicon
[2006/02/16 04:59:01 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\AOL
[2008/11/28 14:32:05 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\Apple Computer
[2009/02/10 23:41:57 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\Eclipsit
[2008/11/28 15:05:17 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\FTPRush
[2006/02/15 10:39:07 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\Identities
[2008/11/27 17:21:51 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\Intel
[2008/12/18 18:48:04 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\iWin
[2009/02/04 13:20:55 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\Leadertech
[2008/11/30 11:02:16 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\LimeWire
[2008/11/27 15:27:41 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\Macromedia
[2009/05/22 07:15:35 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\Malwarebytes
[2009/03/03 14:36:38 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\McAfee
[2009/04/15 20:20:26 | 00,000,000 | –SD | M] – C:\Documents and Settings\Debbie\Application Data\Microsoft
[2008/12/12 13:33:44 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\Mozilla
[2008/12/12 22:38:35 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\Sun
[2009/05/24 19:34:12 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\SUPERAntiSpyware.com
[2006/02/16 04:18:29 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\toshiba
[2009/02/23 18:48:19 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\U3
[2009/01/01 13:04:30 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\Ulead Systems
[2008/11/27 18:08:38 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\Yahoo!
[2006/02/16 04:56:37 | 00,000,000 | —D | M] – C:\Documents and Settings\Debbie\Application Data\You've Got Pictures Screensaver
[2004/08/10 07:00:00 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\desktop.ini
[2009/06/02 19:12:32 | 00,000,006 | -H– | M] () – C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Debbie\Desktop\videopanaweb.zip:SummaryInformation
@Alternate Data Stream - 25214 bytes -> C:\Documents and Settings\All Users\Desktop\Play More Great Games!.url:favicon
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:08948D52
< End of report >

OTL Extras logfile created on: 6/2/2009 7:22:32 PM - Run 1
OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\Debbie\Desktop
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18372)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 100.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 112.60 Gb Free Space | 75.55% Space Free | Partition Type: NTFS
Drive D: | 698.96 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DEBBIE-LAPTOP
Current User Name: Debbie
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
C:\TOSHIBA\ivp\NetInt\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrade Engine (TOSHIBA Corporation)
C:\TOSHIBA\IVP\ISM\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger (TOSHIBA Corporation)
C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Application Loader (America Online, Inc.)
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL (America Online)
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL (America Online)
C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL (America Online, Inc.)
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe:*:Enabled:AOLTsMon (America Online, Inc)
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe:*:Enabled:AOLTopSpeed (America Online Inc)
C:\Program Files\Common Files\AOL\1140083713\EE\AOLServiceHost.exe:*:Enabled:AOL (America Online, Inc.)
C:\Program Files\Common Files\AOL\System Information\sinf.exe:*:Enabled:AOL (America Online Inc.)
C:\Program Files\Common Files\AOL\AOL Spyware Protection\AOLSP Scheduler.exe:*:Enabled:AOL File not found
C:\Program Files\Common Files\AOL\AOL Spyware Protection\asp.exe:*:Enabled:AOL File not found
C:\Program Files\Common Files\AolCoach\en_en\player\AOLNySEV.exe:*:Enabled:AOL (Gteko Ltd.)
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger (Yahoo! Inc.)
C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes (Apple Inc.)
C:\Documents and Settings\Debbie\Desktop\LimeWire\LimeWire.exe:*:Enabled:LimeWire File not found
C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger (Microsoft Corporation)
C:\Program Files\QuickTime\QTTask.exe:*:Enabled:QTTask (Apple Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{008D69EB-70FF-46AB-9C75-924620DF191A}" = TOSHIBA Speech System SR Engine(U.S.) Version1.0
"{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}" = mLogView
"{1034BE34-1569-4889-831D-C2C3F2CB2F73}" = Photo Explosion Deluxe 3.0
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 13
"{2FCE4FC5-6930-40E7-A4F1-F862207424EF}" = InterVideo WinDVD Creator 2
"{3248F0A8-6813-11D6-A77B-00B0D0150040}" = J2SE Runtime Environment 5.0 Update 4
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3E0B8A20-B239-11D3-9850-00C04F7AC096}" = YAMAHA DS-XG WDM
"{3E9D596A-61D4-4239-BD19-2DB984D2A16F}" = mIWA
"{3EBD3749-304E-4A4C-9575-C00E5F015217}" = Apple Mobile Device Support
"{3FBF6F99-8EC6-41B4-8527-0A32241B5496}" = TOSHIBA Speech System TTS Engine(U.S.) Version1.0
"{425A2BC2-AA64-4107-9C29-484245BBEA05}" = TOSHIBA Software Upgrades
"{4497AFF6-98C4-4F49-B073-F48F42BCBF9E}" = TIPCI
"{47D2103B-FD51-4017-9C20-DD408B17D726}" = Office 2003 Trial Assistant
"{48CF9A66-5F03-4025-ABD0-B3A3FA095A59}" = TOSHIBA SD Memory Card Format
"{626C4560-0B8F-11D6-8125-00105A533D72}" = PHOTOVU LINK 2.10
"{64212898-097F-4F3F-AECA-6D34A7EF82DF}" = TOSHIBA Zooming Utility
"{64DD71BC-3109-4C88-9AD3-D5422644B722}" = TOSHIBA Hotkey Utility
"{6815FCDD-401D-481E-BA88-31B4754C2B46}" = Macromedia Flash Player 8
"{69BE47C2-36FE-4397-8199-85D8EAE69982}" = TOSHIBA TouchPad ON/Off Utility
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{78C68CB9-3DF5-44F3-AB9D-FA305C5EB85C}" = TOSHIBA Utilities
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver
"{8B12BA86-ADAC-4BA6-B441-FFC591087252}" = TOSHIBA Virtual Sound
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8C6BB412-D3A8-4AAE-A01B-35B681789D68}" = mHelp
"{90B0D222-8C21-4B35-9262-53B042F18AF9}" = mPfWiz
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD for TOSHIBA
"{91A10409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office OneNote 2003
"{937B232D-9776-471E-92BD-D424E514EF14}" = Logitech QuickCam
"{94658027-9F16-4509-BBD7-A59FE57C3023}" = mZConfig
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}" = QuickTime
"{98177940-C048-4831-A279-F3888B1E2C7F}" = InstallMgr
"{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders
"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
"{9CC89556-3578-48DD-8408-04E66EBEF401}" = mXML
"{9D765FA6-F2BC-40AF-8145-50808F9BDF4E}" = DVD-RAM Driver
"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
"{A6690C0E-B96E-4F0F-A8EB-D5B332454AC6}" = TOSHIBA Controls
"{A8AC89BA-D8CB-4372-9743-1C54D23286B0}" = MSN Toolbar
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0
"{B7148D71-0A8F-4501-96B4-4E1CC67F874E}" = Microsoft Default Manager
"{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}" = Apple Software Update
"{B8A204BC-7177-470E-BBDD-47256D05B325}" = iTunes
"{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}" = TOSHIBA ConfigFree
"{BE3F89C0-42D5-11D5-A40A-00105AC8331A}" = Metamail (Toshiba Registration Utility)
"{C45F4811-31D5-4786-801D-F79CD06EDD85}" = SD Secure Module
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D0E604A0-5C90-4212-88B5-2AFCFF134FB5}" = MSN Toolbar
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{EE033C1F-443E-41EC-A0E2-559B539A4E4D}" = TOSHIBA Speech System Applications
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6090A17-0967-4A8A-B3C3-422A1B514D49}" = mDrWiFi
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"12133444-BF36-4d4e-B7FB-A3424C645DE4" = GemMaster Mystic
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"America Online us" = America Online (Choose which version to remove)
"AOL Connectivity Services" = AOL Connectivity Services
"AOL YGP Screensaver" = AOL You've Got Pictures Screensaver
"AolCoach2_en" = AOL Coach Version 2.0(Build:20041026.5 en)
"B3EE3001-DC24-4cd1-8743-5692C716659F" = Otto
"Banner Maker Pro 7_is1" = Banner Maker Pro Version 7
"Bejeweled 2 Deluxe 1.1" = Bejeweled 2 Deluxe 1.1
"Bejeweled 2 Deluxe™" = Bejeweled 2 Deluxe™
"ESPNMotion" = ESPNMotion
"HijackThis" = HijackThis 2.0.2
"ie8" = Windows Internet Explorer 8 Release Candidate 1
"ieSpell" = ieSpell
"InstallShield_{4497AFF6-98C4-4F49-B073-F48F42BCBF9E}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"Jewel Quest II" = Jewel Quest II
"lvdrivers_11.90" = Logitech QuickCam Driver Package
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microangelo Creation" = Microangelo Creation
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox (3.0.4)" = Mozilla Firefox (3.0.4)
"PC Diagnostic Tool" = TOSHIBA PC Diagnostic Tool
"Port Magic" = Pure Networks Port Magic
"Power Saver" = TOSHIBA Power Saver
"ProInst" = Intel® PROSet/Wireless Software
"PROSet" = Intel® PRO Network Connections Drivers
"RealPlayer 6.0" = RealPlayer Basic
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TBSB07183.TBSB07183Toolbar" = Fast Browser Search (My Web Tattoo)
"ToneThis" = ToneThis
"TOSHIBA Game Console" = TOSHIBA Game Console
"TOSHIBA Software Modem" = TOSHIBA Software Modem
"TOSHIBA TV Tuner" = TOSHIBA TV Tuner [removed]
"ViewpointMediaPlayer" = Viewpoint Media Player
"WebPost" = Microsoft Web Publishing Wizard 1.52
"WildTangent CDA" = WildTangent Web Driver
"Windows Media Format Runtime" = Windows Media Format Runtime
"WT004722" = Bejeweled 2 Deluxe
"WT004723" = Blasterball 2 Revolution
"WT004725" = SCRABBLE
"WT006066" = FATE
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Music Engine" = Yahoo! Music Engine

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/26/2009 5:14:45 PM | Computer Name = DEBBIE-LAPTOP | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18372, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/27/2009 12:48:29 PM | Computer Name = DEBBIE-LAPTOP | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18372, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/27/2009 1:48:03 PM | Computer Name = DEBBIE-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18372, faulting
module msvcrt.dll, version 7.0.2600.2180, fault address 0x00037fd4.

Error - 4/27/2009 9:57:06 PM | Computer Name = DEBBIE-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18372, faulting
module ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

Error - 4/28/2009 7:05:20 AM | Computer Name = DEBBIE-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18372, faulting
module ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

Error - 4/28/2009 7:05:35 AM | Computer Name = DEBBIE-LAPTOP | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18372, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/29/2009 7:03:02 AM | Computer Name = DEBBIE-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application SeaPort.exe, version 1.2.123.0, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

Error - 4/29/2009 10:57:43 AM | Computer Name = DEBBIE-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18372, faulting
module ieframe.dll, version 8.0.6001.18372, fault address 0x000f52af.

Error - 4/29/2009 8:06:23 PM | Computer Name = DEBBIE-LAPTOP | Source = McLogEvent | ID = 5019
Description = Exception in McShield.Exe! Exception details follow : VSCORE.14.0.0.423
Exception
Code : 0XC0000005 Exception Address : 0X7C918FEA Exception Parameters :
2 Param 1 = 0X00000001 Param 2 = 0X01C9C937 More information : ScanRequest : NTName
is \Device\HarddiskVolume1\Documents and Settings\Debbie\Desktop\Motorola Phone
Tools\MPT_TEST_Info.exe.

Error - 4/29/2009 8:06:27 PM | Computer Name = DEBBIE-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application Mcshield.exe, version 14.0.0.423, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

[ Application Events ]
Error - 4/26/2009 5:14:45 PM | Computer Name = DEBBIE-LAPTOP | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18372, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/27/2009 12:48:29 PM | Computer Name = DEBBIE-LAPTOP | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18372, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/27/2009 1:48:03 PM | Computer Name = DEBBIE-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18372, faulting
module msvcrt.dll, version 7.0.2600.2180, fault address 0x00037fd4.

Error - 4/27/2009 9:57:06 PM | Computer Name = DEBBIE-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18372, faulting
module ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

Error - 4/28/2009 7:05:20 AM | Computer Name = DEBBIE-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18372, faulting
module ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

Error - 4/28/2009 7:05:35 AM | Computer Name = DEBBIE-LAPTOP | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18372, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/29/2009 7:03:02 AM | Computer Name = DEBBIE-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application SeaPort.exe, version 1.2.123.0, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

Error - 4/29/2009 10:57:43 AM | Computer Name = DEBBIE-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18372, faulting
module ieframe.dll, version 8.0.6001.18372, fault address 0x000f52af.

Error - 4/29/2009 8:06:23 PM | Computer Name = DEBBIE-LAPTOP | Source = McLogEvent | ID = 5019
Description = Exception in McShield.Exe! Exception details follow : VSCORE.14.0.0.423
Exception
Code : 0XC0000005 Exception Address : 0X7C918FEA Exception Parameters :
2 Param 1 = 0X00000001 Param 2 = 0X01C9C937 More information : ScanRequest : NTName
is \Device\HarddiskVolume1\Documents and Settings\Debbie\Desktop\Motorola Phone
Tools\MPT_TEST_Info.exe.

Error - 4/29/2009 8:06:27 PM | Computer Name = DEBBIE-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application Mcshield.exe, version 14.0.0.423, faulting module
ntdll.dll, version 5.1.2600.2180, fault address 0x00018fea.

[ System Events ]
Error - 5/31/2009 12:54:10 PM | Computer Name = DEBBIE-LAPTOP | Source = Service Control Manager | ID = 7000
Description = The McAfee Real-time Scanner service failed to start due to the following
error: %%2

Error - 5/31/2009 3:20:48 PM | Computer Name = DEBBIE-LAPTOP | Source = Service Control Manager | ID = 7000
Description = The McAfee Real-time Scanner service failed to start due to the following
error: %%2

Error - 5/31/2009 10:13:46 PM | Computer Name = DEBBIE-LAPTOP | Source = Service Control Manager | ID = 7000
Description = The McAfee Real-time Scanner service failed to start due to the following
error: %%2

Error - 6/1/2009 7:28:40 AM | Computer Name = DEBBIE-LAPTOP | Source = Service Control Manager | ID = 7000
Description = The McAfee Real-time Scanner service failed to start due to the following
error: %%2

Error - 6/1/2009 1:59:46 PM | Computer Name = DEBBIE-LAPTOP | Source = Service Control Manager | ID = 7000
Description = The McAfee Real-time Scanner service failed to start due to the following
error: %%2

Error - 6/2/2009 7:40:31 AM | Computer Name = DEBBIE-LAPTOP | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an unreachable
host. (0x80072751)

Error - 6/2/2009 7:40:31 AM | Computer Name = DEBBIE-LAPTOP | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.

Error - 6/2/2009 7:40:44 AM | Computer Name = DEBBIE-LAPTOP | Source = Service Control Manager | ID = 7000
Description = The McAfee Real-time Scanner service failed to start due to the following
error: %%2

Error - 6/2/2009 1:04:35 PM | Computer Name = DEBBIE-LAPTOP | Source = Service Control Manager | ID = 7000
Description = The McAfee Real-time Scanner service failed to start due to the following
error: %%2

Error - 6/2/2009 8:13:39 PM | Computer Name = DEBBIE-LAPTOP | Source = Service Control Manager | ID = 7000
Description = The McAfee Real-time Scanner service failed to start due to the following
error: %%2

< End of report >

Not using this one much….seemed like I took a step backwards when the OTMoveit failed to function…am I just a "nervous nellie"?

SpySentinel

Post #26June 3, 2009, 9:13 PM UTC

Not using this one much….seemed like I took a step backwards when the OTMoveit failed to function…am I just a "nervous nellie"?

No worries, for some reason OTMoveIt is not working.

Run OTList2.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
O2 - BHO: (Fast Browser Search Toolbar Helper) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll ()

:Files
C:\Program Files\Fast Browser Search
C:\Documents and Settings\Debbie\Desktop\LimeWire

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done

Al1mh12

Post #27June 3, 2009, 10:48 PM UTC

========== OTL ========== Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}\ deleted successfully. C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll unregistered successfully. C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll moved successfully. ========== FILES ========== Folder move failed. C:\Program Files\Fast Browser Search\IE scheduled to be moved on reboot. Folder move failed. C:\Program Files\Fast Browser Search scheduled to be moved on reboot. File\Folder C:\Documents and Settings\Debbie\Desktop\LimeWire not found. ========== COMMANDS ========== User's Temp folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Network Service Temp folder emptied. Network Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\logishrd\LVPrcInj01.dll scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_374.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. Temp folders emptied. Explorer started successfully OTL by OldTimer - Version 2.1.1.0 log created on 06032009_173911 Files moved on Reboot… File C:\Program Files\Fast Browser Search\IE not found! File C:\Program Files\Fast Browser Search not found! DllUnregisterServer procedure not found in C:\WINDOWS\temp\logishrd\LVPrcInj01.dll C:\WINDOWS\temp\logishrd\LVPrcInj01.dll NOT unregistered. File move failed. C:\WINDOWS\temp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot. File C:\WINDOWS\temp\Perflib_Perfdata_374.dat not found! Registry entries deleted on Reboot… Thanks for looking

SpySentinel

Post #28June 3, 2009, 11:10 PM UTC

You're welcome.

How is your computer running?

Your Adobe Acrobat Reader is out of date. Older versions are vulnerable to attack.

Please go to the link below to update.

http://www.adobe.com/products/acrobat/readstep2.html

Download TFC by OldTimer to your desktop

Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
It will close all programs when run, so make sure you have saved all your work before you begin.
Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion.
Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

Al1mh12

Post #29June 5, 2009, 12:58 PM UTC

File cleaner ran and re-booted automatically. I hadn't been doing much with this one. Seems to be operating alright. It's slow on start-up but there is quite a bit of stuff in the start-up. I need to re-activate the McAfee, and download the other suggested spyware programs. This recent issue has caused me to lose quite a bit of confidence in my McAfee suite. I was considering trying the Comodo firewall, McAfee anti-virus, and the SpywareBlaster, SpywareGuard, MalWarebytes, Super Anti-spyware, and the McAfee Site advisor. I've gone to the Firefox browser. I do still use the MSN default for a homepage on Firefox. Is this defeating the purpose? There is a fair amount of un-used space on this hard drive. I have been looking at Ubuntu and have it running on one dual-boot box now. Would it serve any purpose to install it on this laptop for possible diagnosis and recovery? I'll hold off on installing the proposed programs and "test-driving" this thing like a rental until I hear from you on the bundle I'm considering. Thank you for your help and time. The wife will love to have her machine back!

SpySentinel

Post #30June 5, 2009, 10:52 PM UTC

Hi Al1mh12, I agree, McAfee is not one of the best suites. If you still have time for your subscription, I say continue to use the AntiVirus. I like the bundle you proposed, like I said, if you want to keep McAfee, just use the AntiVirus, if not, I can recommend some great free alternatives. As for Comodo, its a pretty good firewall, I also recommend Online Armor which is a free firewall as well. The thing about comodo is that is comes with a suite now, not just the firewall itself. so if you install it, make sure to just install the firewall. Comodo firewall, McAfee anti-virus, and the SpywareBlaster, SpywareGuard, MalWarebytes, Super Anti-spyware, and the McAfee Site advisor. is a great bundle. If you want me to suggest alternatives to mcafee antivirus and comodo firewall let me know.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] Spyware Protect 2009

✨ Ask AI

Ask AI