JonTom
Spyware / Malware / Virus Removal
[Resolved] XP Antivirus Pro 2010 infection
35 min read
JonTom
Are you still with me?
Stormicats
Sorry about that – I wasn't feeling well on Thursday and Friday.
Here's the VirusTotal and OTL reports:
Virus Total:
Did not find this file at all: c:\documents and settings\michael\desktop\AdobeFlashPlayerExt.exe
Maybe it got removed?
File xx2gr.dll received on 2010.03.05 03:16:33 (UTC)
Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED
Result: 0/42 (0%)
Loading server information…
Your file is queued in position: 2.
Estimated start time is between 49 and 70 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.
You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:
Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.03.04 -
AhnLab-V3 5.0.0.2 2010.03.04 -
AntiVir 8.2.1.180 2010.03.04 -
Antiy-AVL 2.0.3.7 2010.03.04 -
Authentium 5.2.0.5 2010.03.05 -
Avast 4.8.1351.0 2010.03.04 -
Avast5 5.0.332.0 2010.03.04 -
AVG 9.0.0.730 2010.03.04 -
BitDefender 7.2 2010.03.05 -
CAT-QuickHeal 10.00 2010.03.04 -
ClamAV 0.96.0.0-git 2010.03.05 -
Comodo 4091 2010.02.28 -
DrWeb 5.0.1.12222 2010.03.05 -
eSafe 7.0.17.0 2010.03.04 -
eTrust-Vet 35.2.7340 2010.03.04 -
F-Prot 4.5.1.85 2010.03.04 -
F-Secure 9.0.15370.0 2010.03.05 -
Fortinet 4.0.14.0 2010.03.04 -
GData 19 2010.03.05 -
Ikarus T3.1.1.80.0 2010.03.04 -
Jiangmin 13.0.900 2010.03.04 -
K7AntiVirus 7.10.990 2010.03.04 -
Kaspersky 7.0.0.125 2010.03.05 -
McAfee 5910 2010.03.04 -
McAfee+Artemis 5910 2010.03.04 -
McAfee-GW-Edition 6.8.5 2010.03.04 -
Microsoft 1.5502 2010.03.04 -
NOD32 4916 2010.03.04 -
Norman 6.04.08 2010.03.04 -
nProtect 2009.1.8.0 2010.03.04 -
Panda 10.0.2.2 2010.03.04 -
PCTools 7.0.3.5 2010.03.04 -
Prevx 3.0 2010.03.05 -
Rising 22.37.04.01 2010.03.05 -
Sophos 4.51.0 2010.03.05 -
Sunbelt 5755 2010.03.05 -
Symantec 20091.2.0.41 2010.03.05 -
TheHacker [removed].221 2010.03.05 -
TrendMicro 9.120.0.1004 2010.03.04 -
VBA32 3.12.12.2 2010.03.04 -
ViRobot 2010.3.4.2212 2010.03.04 -
VirusBuster 5.0.27.0 2010.03.04 -
Additional information
File size: 193024 bytes
MD5…: 01a7e9da047717893e3b2abd3f34b020
SHA1..: 8bc3c5ec75cace1237e7f99b1354ff2863edb7dc
SHA256: 152d3f9371bca77e5ee3a4e1fd204147841a7a7e32b9640ff468b030e8b1e99c
ssdeep: 3072:KC8Kx2omhW+nutuPX8g70RDpsyl0ZPsAurT+hEQeFvDwF1hM99Qv/G+gXWr
Ech:Dx2NhnsuXIdeylXAutP7s1bv/GlbA
PEiD..: -
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x6d10
timedatestamp…..: 0x39343864 (Tue May 30 21:53:40 2000)
machinetype…….: 0x14c (I386)
( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1d566 0x1d600 6.60 3cd4fb4d64a17288449412c0b78e3955
.rdata 0x1f000 0x5892 0x5a00 4.30 15e21885b66115ee4fb008211d12650a
.data 0x25000 0x7b00 0x4600 2.84 e243cb0c47ae23210fedf2791c4ba3e4
.idata 0x2d000 0x1bc2 0x1c00 5.55 92eb4fda3dab9e50b3cace44b3cb61ec
.rsrc 0x2f000 0x1080 0x1200 4.13 ce3996f4b345d7ca200e08d0be50389f
.reloc 0x31000 0x4812 0x4a00 4.29 0c51c01216230902c1bb3ed4d5b1aeda
( 0 imports )
( 4 exports )
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer
RDS…: NSRL Reference Data Set
-
sigcheck:
publisher….: Headlight Software, Inc.
copyright….: Copyright © 2000 Headlight Software, Inc.
product……: GetRight
description..: IE/Shell Interface for GetRight. www.getright.com
original name: XX2GR.DLL
internal name: XX2GR
file version.: 4.2.0
comments…..: DLL to send info to GetRight. www.getright.com
signers……: -
signing date.: -
verified…..: Unsigned
trid..: DirectShow filter (37.8%)
Win32 Executable MS Visual C++ 4.x (25.2%)
Windows OCX File (23.1%)
Win32 Executable MS Visual C++ (generic) (7.0%)
Windows Screen Saver (2.4%)
pdfid.: -
File unknown_mini_F21A2B85742A4A7BA95E received on 2010.03.05 03:23:01 (UTC)
Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED
Result: 0/42 (0%)
Loading server information…
Your file is queued in position: 1.
Estimated start time is between 42 and 60 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.
You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:
Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.03.04 -
AhnLab-V3 5.0.0.2 2010.03.04 -
AntiVir 8.2.1.180 2010.03.04 -
Antiy-AVL 2.0.3.7 2010.03.04 -
Authentium 5.2.0.5 2010.03.05 -
Avast 4.8.1351.0 2010.03.04 -
Avast5 5.0.332.0 2010.03.04 -
AVG 9.0.0.730 2010.03.04 -
BitDefender 7.2 2010.03.05 -
CAT-QuickHeal 10.00 2010.03.04 -
ClamAV 0.96.0.0-git 2010.03.05 -
Comodo 4091 2010.02.28 -
DrWeb 5.0.1.12222 2010.03.05 -
eSafe 7.0.17.0 2010.03.04 -
eTrust-Vet 35.2.7340 2010.03.04 -
F-Prot 4.5.1.85 2010.03.04 -
F-Secure 9.0.15370.0 2010.03.05 -
Fortinet 4.0.14.0 2010.03.04 -
GData 19 2010.03.05 -
Ikarus T3.1.1.80.0 2010.03.04 -
Jiangmin 13.0.900 2010.03.04 -
K7AntiVirus 7.10.990 2010.03.04 -
Kaspersky 7.0.0.125 2010.03.05 -
McAfee 5910 2010.03.04 -
McAfee+Artemis 5910 2010.03.04 -
McAfee-GW-Edition 6.8.5 2010.03.04 -
Microsoft 1.5502 2010.03.04 -
NOD32 4916 2010.03.04 -
Norman 6.04.08 2010.03.04 -
nProtect 2009.1.8.0 2010.03.04 -
Panda 10.0.2.2 2010.03.04 -
PCTools 7.0.3.5 2010.03.04 -
Prevx 3.0 2010.03.05 -
Rising 22.37.04.01 2010.03.05 -
Sophos 4.51.0 2010.03.05 -
Sunbelt 5755 2010.03.05 -
Symantec 20091.2.0.41 2010.03.05 -
TheHacker [removed].221 2010.03.05 -
TrendMicro 9.120.0.1004 2010.03.04 -
VBA32 3.12.12.2 2010.03.04 -
ViRobot 2010.3.4.2212 2010.03.04 -
VirusBuster 5.0.27.0 2010.03.04 -
Additional information
File size: 40001 bytes
MD5…: 67557356ba224dac3619b7aa25c37d6b
SHA1..: db9af12c8e229a8d904d4ef318d18b4b83a40199
SHA256: a8996f39f7f79ff0d1a7071eac3ba436b71ce91e906dcea4b535fdb5101efd45
ssdeep: 768:n7NKF13C9YJqhphRBgft9wyBjncAV4AmU5nlfQnP/wD4pkAC9iXG:n7NCChX
RwkhAVVv5lfkwU4i2
PEiD..: -
PEInfo: -
RDS…: NSRL Reference Data Set
-
pdfid.: -
trid..: 7-Zip compressed archive (100.0%)
sigcheck:
publisher….: n/a
copyright….: n/a
product……: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments…..: n/a
signers……: -
signing date.: -
verified…..: Unsigned
packers (F-Prot): 7Z, Unicode
OTL:
OTL logfile created on: 3/6/2010 9:10:58 AM - Run 1
OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\Jennifer\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 42.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.48 Gb Total Space | 2.05 Gb Free Space | 2.75% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: MUSKRAT
Current User Name: Jennifer
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
========== Processes (SafeList) ==========
PRC - [2010/03/06 09:09:06 | 000,553,984 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Jennifer\Desktop\OTL.exe
PRC - [2010/02/20 10:41:48 | 000,117,640 | R— | M] (Symantec Corporation) – C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
PRC - [2010/02/19 20:25:42 | 000,908,248 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/11/19 22:29:16 | 000,623,960 | —- | M] (Research In Motion Limited) – C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
PRC - [2009/10/08 12:13:52 | 000,818,288 | —- | M] (The Weather Channel Interactive, Inc.) – C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe
PRC - [2009/08/12 16:11:02 | 008,318,056 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Thunderbird\thunderbird.exe
PRC - [2008/12/12 08:31:10 | 001,840,424 | —- | M] (Nero AG) – C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
PRC - [2008/12/02 15:29:52 | 002,221,352 | —- | M] (Nero AG) – C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
PRC - [2008/10/24 09:14:36 | 000,206,112 | —- | M] (Macrovision Corporation) – C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
PRC - [2008/10/24 09:14:34 | 001,000,736 | —- | M] (Macrovision Corporation) – C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
PRC - [2008/06/10 13:56:30 | 001,442,888 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft IntelliType Pro\itype.exe
PRC - [2008/05/03 12:31:46 | 000,071,096 | —- | M] () – C:\Program Files\BurnAware Free\nmsaccessu.exe
PRC - [2008/04/13 19:12:20 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2008/01/29 08:52:32 | 001,424,648 | —- | M] (Uniblue Software) – C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
PRC - [2007/12/30 05:23:34 | 001,365,504 | —- | M] () – C:\Program Files\Rainlendar2\Rainlendar2.exe
PRC - [2007/02/28 16:45:22 | 000,507,904 | —- | M] (Brother Industries, Ltd.) – C:\Program Files\Brother\ControlCenter3\BrccMCtl.exe
PRC - [2007/01/29 21:12:14 | 000,030,248 | —- | M] (Nuance Communications, Inc.) – C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
PRC - [2006/11/03 19:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Defender\MsMpEng.exe
PRC - [2006/04/21 13:26:38 | 005,358,592 | —- | M] (Linksys) – C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WUSB54GSC.exe
PRC - [2005/07/04 16:46:04 | 000,053,307 | —- | M] (GEMTEKS) – C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe
PRC - [2005/06/02 15:54:34 | 000,086,606 | —- | M] (Canon Inc.) – C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2005/01/26 11:47:42 | 000,065,604 | —- | M] (Boingo Wireless, Inc.) – C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
PRC - [2003/11/14 09:50:00 | 000,037,888 | —- | M] (Logitech Inc.) – C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE
PRC - [2003/04/07 01:42:52 | 000,217,190 | —- | M] (Adobe Systems Inc.) – C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
PRC - [2002/01/30 18:01:54 | 000,081,920 | —- | M] (Analog Devices, Inc.) – C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
PRC - [2002/01/24 16:10:40 | 000,126,976 | —- | M] (Iomega Corporation) – C:\Program Files\Iomega\AutoDisk\ADService.exe
PRC - [2002/01/14 07:49:38 | 000,073,728 | —- | M] (Iomega Corporation) – C:\Program Files\Iomega\System32\AppServices.exe
========== Modules (SafeList) ==========
MOD - [2010/03/06 09:09:06 | 000,553,984 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Jennifer\Desktop\OTL.exe
MOD - [2010/02/20 10:41:42 | 000,419,696 | R— | M] (Symantec Corporation) – C:\Program Files\Norton 360\Engine\3.8.0.41\asOEHook.dll
MOD - [2008/04/13 19:12:02 | 000,413,696 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msvcp60.dll
MOD - [2008/04/13 19:11:58 | 000,071,680 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msacm32.dll
MOD - [2008/04/13 19:11:48 | 001,852,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\AppPatch\acgenral.dll
MOD - [2003/11/14 09:50:00 | 000,024,064 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\Logitech\Scrolling\LGMSGHK.DLL
MOD - [2003/11/14 09:50:00 | 000,006,144 | —- | M] (Logitech Inc.) – C:\Program Files\Logitech\MouseWare\system\LgWndHk.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Auto | Running] – – (WUSB54GSCSVC)
SRV - File not found [Auto | Stopped] – – (Nero BackItUp Scheduler 4.0)
SRV - File not found [Disabled | Stopped] – – (Iomega Activity Disk2)
SRV - [2010/02/20 10:41:48 | 000,117,640 | R— | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe – (N360)
SRV - [2008/05/03 12:31:46 | 000,071,096 | —- | M] () [Auto | Running] – C:\Program Files\BurnAware Free\nmsaccessu.exe – (NMSAccessU)
SRV - [2008/01/29 16:09:02 | 000,394,704 | —- | M] (Symantec, Inc.) [On_Demand | Stopped] – C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe – (Symantec RemoteAssist)
SRV - [2007/11/30 12:27:22 | 000,558,592 | —- | M] (ReaSoft) [On_Demand | Stopped] – C:\Program Files\ReaConverter 5.5 Pro\rcp_scheduler.exe – (rcp_service)
SRV - [2006/11/03 19:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MsMpEng.exe – (WinDefend)
SRV - [2005/06/02 15:54:34 | 000,086,606 | —- | M] (Canon Inc.) [Auto | Running] – C:\Program Files\Canon\CAL\CALMAIN.exe – (CCALib8)
SRV - [2005/01/26 11:47:42 | 000,065,604 | —- | M] (Boingo Wireless, Inc.) [Auto | Running] – C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe – (EarthLinkMonitor)
SRV - [2002/08/16 13:51:00 | 000,204,876 | —- | M] (Network Associates, Inc.) [On_Demand | Stopped] – C:\WINDOWS\system\epoagent\naimas32.exe – (NAIMAGENT32)
SRV - [2002/01/24 16:10:40 | 000,126,976 | —- | M] (Iomega Corporation) [Auto | Running] – C:\Program Files\Iomega\AutoDisk\ADService.exe – (_IOMEGA_ACTIVE_DISK_SERVICE_)
SRV - [2002/01/14 07:49:38 | 000,073,728 | —- | M] (Iomega Corporation) [Auto | Running] – C:\Program Files\Iomega\System32\AppServices.exe – (Iomega App Services)
========== Driver Services (SafeList) ==========
DRV - [2010/02/21 06:53:40 | 000,102,448 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys – (EraserUtilRebootDrv)
DRV - [2010/02/20 10:41:54 | 000,124,976 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SYMEVENT.SYS – (SymEvent)
DRV - [2010/02/20 10:41:50 | 000,482,432 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\ccHPx86.sys – (ccHP)
DRV - [2010/02/20 10:41:50 | 000,310,320 | —- | M] (Symantec Corporation) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\N360\0308000.029\SYMEFA.SYS – (SymEFA)
DRV - [2010/02/20 10:41:50 | 000,308,272 | —- | M] (Symantec Corporation) [File_System | On_Demand | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SRTSP.SYS – (SRTSP)
DRV - [2010/02/20 10:41:50 | 000,259,632 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\BHDrvx86.sys – (BHDrvx86)
DRV - [2010/02/20 10:41:50 | 000,217,136 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMTDI.SYS – (SYMTDI)
DRV - [2010/02/20 10:41:50 | 000,089,904 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMFW.SYS – (SYMFW)
DRV - [2010/02/20 10:41:50 | 000,043,696 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\N360\0308000.029\SRTSPX.SYS – (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2010/02/20 10:41:50 | 000,036,400 | R— | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SymIM.sys – (SymIMMP)
DRV - [2010/02/20 10:41:50 | 000,036,400 | R— | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\SymIM.sys – (SymIM)
DRV - [2010/02/20 10:41:50 | 000,036,400 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMNDIS.SYS – (SYMNDIS)
DRV - [2010/02/20 10:41:50 | 000,033,072 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMIDS.SYS – (SYMIDS)
DRV - [2010/02/20 04:50:16 | 001,324,720 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100305.039\NAVEX15.SYS – (NAVEX15)
DRV - [2010/02/20 04:50:16 | 000,371,248 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys – (eeCtrl)
DRV - [2010/02/20 04:50:16 | 000,084,912 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100305.039\NAVENG.SYS – (NAVENG)
DRV - [2009/10/28 16:37:24 | 000,329,592 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\IDSXpx86.sys – (IDSxpx86)
DRV - [2009/03/05 15:21:38 | 000,027,136 | —- | M] (NCH Swift Sound) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nchssvad.sys – (NCHSSVAD)
DRV - [2009/02/18 14:44:00 | 006,308,224 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nv4_mini.sys – (nv)
DRV - [2008/04/13 13:45:30 | 000,010,624 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\gameenum.sys – (gameenum)
DRV - [2008/04/13 11:36:06 | 000,144,384 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Hdaudbus.sys – (HDAudBus)
DRV - [2007/01/26 21:09:40 | 000,068,954 | —- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\jl2005c.sys – (JL2005C)
DRV - [2006/12/12 07:43:18 | 000,052,224 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrSerIf.sys – (BrSerIf)
DRV - [2006/09/18 11:54:48 | 000,016,640 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tbhsd.sys – (tbhsd)
DRV - [2006/09/03 09:53:54 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrUsbSer.sys – (BrUsbSer)
DRV - [2006/07/11 08:38:30 | 000,020,480 | R— | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nvnetbus.sys – (nvnetbus)
DRV - [2006/07/11 08:38:28 | 000,057,856 | R— | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\NVENETFD.sys – (NVENETFD)
DRV - [2006/06/28 17:38:56 | 000,105,088 | —- | M] (NVIDIA Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\nvata.sys – (nvata)
DRV - [2006/06/18 23:37:34 | 000,036,864 | —- | M] (Advanced Micro Devices) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\AmdK8.sys – (AmdK8)
DRV - [2006/01/18 18:41:58 | 000,080,512 | —- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Rtnicxp.sys – (RTL8023xp)
DRV - [2005/09/23 18:56:28 | 003,966,976 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RtkHDAud.sys – (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2004/11/01 14:16:34 | 000,017,536 | R— | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BW2NDIS5.SYS – (BW2NDIS5)
DRV - [2004/10/15 12:50:20 | 000,015,295 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrScnUsb.sys – (BrScnUsb)
DRV - [2004/08/04 00:31:32 | 000,020,992 | —- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\rtl8139.sys – (rtl8139)
DRV - [2004/05/31 21:19:42 | 000,024,971 | R— | M] (Integrated Technology Express, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\iteraid.sys – (iteraid)
DRV - [2003/11/07 03:50:00 | 000,070,798 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LMouFlt2.Sys – (LMouFlt2)
DRV - [2003/11/07 03:50:00 | 000,051,486 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\L8042pr2.Sys – (L8042pr2)
DRV - [2003/10/07 10:42:40 | 000,067,200 | —- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Rtlnic51.sys – (RTL8023)
DRV - [2003/08/26 16:25:14 | 000,207,616 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSFHWBS2.sys – (HSFHWBS2)
DRV - [2003/08/26 16:24:06 | 000,675,840 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_CNXT.sys – (winachsf)
DRV - [2003/08/26 16:22:34 | 001,041,152 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_DP.sys – (HSF_DP)
DRV - [2002/04/15 14:31:50 | 000,107,776 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ac97ich4.sys – (ac97intc) Intel® 82801DB/DBM Audio Driver Service (WDM)
DRV - [2002/01/14 07:49:38 | 000,033,602 | —- | M] (Iomega Corporation) [Kernel | Boot | Running] – C:\WINDOWS\System32\DRIVERS\iomdisk.sys – (iomdisk)
DRV - [2001/08/17 13:28:12 | 000,488,383 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_v124.sys – (V124)
DRV - [2001/08/17 13:28:12 | 000,050,751 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_tone.sys – (Tones)
DRV - [2001/08/17 13:28:10 | 000,542,879 | —- | M] (Conexant) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\hsf_msft.sys – (hsf_msft)
DRV - [2001/08/17 13:28:10 | 000,057,471 | —- | M] (Conexant) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\hsf_samp.sys – (Rksample)
DRV - [2001/08/17 13:28:08 | 000,391,199 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_k56k.sys – (K56)
DRV - [2001/08/17 13:28:06 | 000,289,887 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_fall.sys – (Fallback)
DRV - [2001/08/17 13:28:06 | 000,199,711 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_faxx.sys – (SoftFax)
DRV - [2001/08/17 13:28:06 | 000,115,807 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_fsks.sys – (Fsks)
DRV - [2001/08/17 13:28:04 | 000,067,167 | —- | M] (Conexant) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\hsf_bsc2.sys – (basic2)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://start.earthlink.net/
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie…ton/search.html
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net/
IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://start.earthlink.net/
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie…ton/search.html
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net/
IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie…ton/search.html
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie…ton/search.html
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net/
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\..\URLSearchHook: {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll (EarthLink, Inc.)
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\..\URLSearchHook: ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\S-1-5-21-1809067083-3242847100-1996373590-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\S-1-5-21-1809067083-3242847100-1996373590-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007\S-1-5-21-1809067083-3242847100-1996373590-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKLM\software\mozilla\Firefox\Extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2010/03/06 06:32:28 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.1\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2004/08/02 07:05:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.1\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2002/09/16 20:25:56 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.6\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2004/08/02 07:05:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.6\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2002/09/16 20:25:56 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.7.1\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2004/08/02 07:05:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.7.1\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2002/09/16 20:25:56 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2006/03/19 08:10:04 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2006/03/19 08:10:02 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2009/10/27 21:24:16 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
[2008/08/31 22:31:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Mozilla\Extensions
[2008/09/24 16:14:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Mozilla\eclipse1\extensions
[2004/07/17 16:31:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Mozilla\Firefox\Profiles\default.bc7\extensions
[2009/07/01 19:42:24 | 000,000,000 | —D | M] (Flashblock) – C:\Documents and Settings\Jennifer\Application Data\Mozilla\Firefox\Profiles\default.bc7\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2006/03/19 08:10:06 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
O1 HOSTS File: ([2009/08/13 04:49:54 | 000,000,021 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.8.0.41\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (no name) - {B7FF285A-95E0-4C5A-AA93-C4C701533649} - No CLSID value found.
O2 - BHO: (no name) - {C9932651-3EB0-4B27-B701-714A6CE4495F} - No CLSID value found.
O2 - BHO: (no name) - {DE95B055-D183-49F7-873D-AEAB755869CA} - No CLSID value found.
O2 - BHO: (no name) - {F835EF2C-3621-41F6-8275-EFD2A4B2B6A2} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\..\Toolbar\WebBrowser: (no name) - {C7768536-96F8-4001-B1A2-90EE21279187} - No CLSID value found.
O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\..\Toolbar\WebBrowser: (no name) - {4064EA35-578D-4073-A834-C96D82CBCF40} - No CLSID value found.
O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [LexPPS.exe] C:\WINDOWS\System32\lexpps.exe File not found
O4 - HKLM..\Run: [Logitech Utility] C:\WINDOWS\Logi_MwX.Exe (Logitech Inc.)
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe (Analog Devices, Inc.)
O4 - HKU\.DEFAULT..\Run: [DWQueuedReporting] C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKU\S-1-5-18..\Run: [DWQueuedReporting] C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005..\Run: [ISUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005..\Run: [Uniblue SpyEraser] C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe (Uniblue Software)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006..\Run: [DW6] C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe (The Weather Channel Interactive, Inc.)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006..\Run: [ISUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe ()
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006..\Run: [scheduler_monitor] C:\Program Files\ReaConverter 5.5 Pro\init_scheduler.exe ()
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006..\Run: [srvsh] C:\WINDOWS\System32\wtcratmp.exe File not found
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006..\Run: [Uniblue SpyEraser] C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe (Uniblue Software)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe File not found
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007..\Run: [ISUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007..\Run: [Uniblue SpyEraser] C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe (Uniblue Software)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Event Reminder.lnk = C:\Program Files\Broderbund\Broderbund Homework Helpers\pmremind.exe (Broderbund Properties LLC)
O4 - Startup: C:\Documents and Settings\Antonia\Start Menu\Programs\Startup\Registration Dogz.LNK.disabled ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: TUxpvnTwnl = C:\Documents and Settings\Michael\Desktop\AdobeFlashPlayerExt.exe File not found
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 144
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005_Classes\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 144
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: SpecifyDefaultButtons = 0
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Btn_Search = 0
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006_Classes\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 144
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007_Classes\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\New Folder\aim.exe File not found
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} http://www.creative.com/su/ocx/15030/CTSUEng.cab (Creative Software AutoUpdate)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://pcpitstop.com/pcpitstop/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} http://mpijdecd01/wfica.cab (WficaCtl Object)
O16 - DPF: {50F65670-1729-11D2-A51F-0020AFE5D502} http://objects.compuserve.com/chat/RTCChat.cab (ForumChat)
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} http://office.microsoft.com/productupdates/content/opuc.cab (OPUCatalog Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://v5.windowsupdate.microsoft.com/v5co…b?1099769654536 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1124156383368 (MUWebControl Class)
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} http://www.nick.com/common/groove/gx/GrooveAX27.cab (Groove Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} http://mpijdecd01/oncall/msrdp.cab (Microsoft RDP Client Control (redist))
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab (YAddBook Class)
O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} http://hgtv1.view22.com/view22/app/view22rte.cab (View22RTE Class)
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} https://disney.go.com/games/downloads/gamem…GameManager.cab (CGameManagerCtrl Object)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D5EBF06F-9BAF-11D0-B12D-00C04FC39CEA} http://info.manpower.com/activex/pcanywhere/pawrem.cab (pcANYWHERE Remote)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://www.creative.com/su/ocx/15030/CTPID.cab (Creative Software AutoUpdate Support Package)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Jennifer\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - C:\eudora\EuShlExt.dll (Qualcomm Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/11/09 14:21:44 | 000,000,035 | —- | M] () - C:\AUTOEXEC.BAT – [ FAT32 ]
O33 - MountPoints2\{dc55bce0-5468-11db-83bf-0001800f37f9}\Shell\AutoRun\command - "" = F:\setupSNK.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*
NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2002/09/07 09:30:06 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: Ip6FwHlp - File not found
MsConfig - Services: "iPodService"
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 0
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: SymEFA.sys - C:\WINDOWS\system32\drivers\N360\0308000.029\SYMEFA.SYS (Symantec Corporation)
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: SymEFA.sys - C:\WINDOWS\system32\drivers\N360\0308000.029\SYMEFA.SYS (Symantec Corporation)
SafeBootNet: SYMTDI - C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMTDI.SYS (Symantec Corporation)
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: UploadMgr - Service
SafeBootNet: vga.sys - Driver
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SafeBootNet: {1a3e09be-1e45-494b-9174-d7385b45bbf5} - Reg Error: Value error.
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
ActiveX: {02f78298-8af6-495c-9ecb-b6ae68678186} - KB867282
ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {057997dd-71e4-43cc-b161-3f8180691a9e} - Q824145
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {0fde1f56-0d59-4fd7-9624-e3df6b419d0f} - IEEX
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 9.0
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0.3
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0.3
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2cc9d512-6db6-4f1c-8979-9a41fae88de0} - Q837009
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {377483c2-e4b4-4ee8-b577-9aed264c8735} - Q822925
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {429D8DD3-05E0-4F56-B6D6-AC0730567C02} - Euro Update Tool
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA851-CC51-11CF-AAFA-00AA00B6015C} - rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\wpie4x86.inf,PerUserStub
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5f3c70b3-ac2f-432c-8f9c-1624df61f54f} - Microsoft Data Access Components KB870669
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {795d0712-722c-43ec-906a-fc5e678eada9} - Q831167
ActiveX: {82ced0ff-a00d-4405-ba5f-ef4699159333} - KB896727
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {96543d59-497a-4801-a1f3-5936aacaf7b1} - Q828750
ActiveX: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - Reg Error: Value error.
ActiveX: {AA218328-0EA8-4D70-8972-E987A9190FF4} - Reg Error: Value error.
ActiveX: {abcdf74f-9a64-4e6e-b8eb-6e5a41de6550} -
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {B9191F79-5613-4C76-AA2A-398534BB8999} - Reg Error: Value error.
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CD26921B-9DC3-4D0B-89FF-2BA6068BB1B1} - DirectAnimation
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {eddbec60-89cb-44ef-8291-0850fd28ff6a} - Q832894
ActiveX: {F5776D81-AE53-4935-8E84-B0B283D8BCEF} - Q330994
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.voxacm160 - C:\WINDOWS\System32\vct3216.acm (Voxware, Inc.)
Drivers32: MSVideo - C:\WINDOWS\System32\CSvidcap.dll (TechSmith Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.JDCT - C:\WINDOWS\System32\jl_jdct.drv (JEILIN Tech.)
Drivers32: vidc.tscc - C:\WINDOWS\System32\tsccvid.dll (TechSmith Corporation)
Drivers32: VIDC.WMV3 - C:\WINDOWS\System32\wmv9vcm.dll (Microsoft Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (58268713203269632)
========== Files/Folders - Created Within 30 Days ==========
[2010/03/06 09:09:10 | 000,553,984 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Jennifer\Desktop\OTL.exe
[2010/03/06 06:22:16 | 000,000,000 | -HSD | C] – C:\FOUND.017
[2010/03/05 05:48:30 | 000,000,000 | -HSD | C] – C:\FOUND.016
[2010/03/01 05:03:02 | 000,000,000 | -HSD | C] – C:\FOUND.015
[2010/02/28 09:27:46 | 000,000,000 | -HSD | C] – C:\FOUND.014
[2010/02/27 11:30:10 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Silverlight
[2010/02/27 11:29:56 | 004,938,120 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Jennifer\Desktop\Silverlight.exe
[2010/02/27 05:57:12 | 000,000,000 | -HSD | C] – C:\FOUND.013
[2010/02/26 05:44:02 | 000,000,000 | -HSD | C] – C:\FOUND.012
[2010/02/25 05:42:52 | 000,000,000 | -HSD | C] – C:\FOUND.011
[2010/02/24 05:38:38 | 000,000,000 | -HSD | C] – C:\FOUND.010
[2010/02/23 22:04:06 | 000,000,000 | -HSD | C] – C:\FOUND.009
[2010/02/23 18:41:52 | 000,472,064 | —- | C] ( ) – C:\Documents and Settings\Jennifer\Desktop\RootRepeal.exe
[2010/02/22 09:19:22 | 000,000,000 | —D | C] – C:\WINDOWS\System32\N360_BACKUP
[2010/02/21 11:20:59 | 000,000,000 | —D | C] – C:\Documents and Settings\Jennifer\Application Data\Malwarebytes
[2010/02/21 07:01:04 | 000,000,000 | -HSD | C] – C:\FOUND.008
[2010/02/20 13:43:49 | 000,310,320 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.sys
[2010/02/20 13:43:49 | 000,217,136 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symtdi.sys
[2010/02/20 13:43:49 | 000,089,904 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symfw.sys
[2010/02/20 13:43:49 | 000,048,688 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symndisv.sys
[2010/02/20 13:43:49 | 000,036,400 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symndis.sys
[2010/02/20 13:43:49 | 000,033,072 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symids.sys
[2010/02/20 13:43:48 | 000,482,432 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\cchpx86.sys
[2010/02/20 13:43:48 | 000,308,272 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.sys
[2010/02/20 13:43:48 | 000,043,696 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.sys
[2010/02/20 13:43:47 | 000,259,632 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.sys
[2010/02/20 13:42:51 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\N360\0308000.029
[2010/02/20 10:41:58 | 000,036,400 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SymIM.sys
[2010/02/20 10:41:53 | 000,124,976 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/02/20 10:41:53 | 000,060,808 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2010/02/20 10:41:52 | 000,000,000 | —D | C] – C:\Program Files\Symantec
[2010/02/20 10:41:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\N360
[2010/02/20 10:41:27 | 000,000,000 | —D | C] – C:\Program Files\Norton 360
[2010/02/20 10:40:48 | 000,000,000 | —D | C] – C:\Program Files\NortonInstaller
[2010/02/19 19:42:21 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/02/19 19:42:19 | 000,019,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/02/19 19:42:19 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/02/19 19:42:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/02/19 19:24:25 | 000,000,000 | —D | C] – C:\Program Files\a-squared HiJackFree
[2010/02/18 04:01:00 | 000,000,000 | -HSD | C] – C:\FOUND.007
[2010/02/12 06:41:12 | 000,000,000 | -HSD | C] – C:\FOUND.006
[2010/02/11 18:28:27 | 000,000,000 | —D | C] – C:\Documents and Settings\Jennifer\Application Data\Tific
[2010/02/11 18:28:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Jennifer\Local Settings\Application Data\Symantec
[2010/02/09 05:55:00 | 000,000,000 | -HSD | C] – C:\FOUND.005
[2009/08/18 10:31:02 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2009/08/18 10:19:18 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2009/05/04 15:00:28 | 001,687,552 | —- | C] (Individual Software Incorporated) – C:\Program Files\TNGENG.EXE
[2007/12/15 02:20:52 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth
[2007/09/12 15:08:04 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2003/12/29 23:53:59 | 000,192,512 | —- | C] (America Online, Inc.) – C:\Program Files\wndutils.dll
[2003/12/29 23:53:59 | 000,126,976 | —- | C] (America Online, Inc.) – C:\Program Files\xprt.dll
[2003/12/29 23:53:59 | 000,094,208 | —- | C] (America Online, Inc.) – C:\Program Files\ticker.ocm
[2003/12/29 23:53:59 | 000,033,792 | —- | C] (America Online, Inc.) – C:\Program Files\startup.ocm
[2003/12/29 23:53:59 | 000,012,288 | —- | C] (America Online, Inc.) – C:\Program Files\xpcs.dll
[2003/12/29 23:53:59 | 000,008,192 | —- | C] (America Online, Inc.) – C:\Program Files\xptl.dll
[2003/12/29 23:53:58 | 000,339,968 | —- | C] (Netscape Communications Corporation) – C:\Program Files\softokn3.dll
[2003/12/29 23:53:58 | 000,327,680 | —- | C] (Netscape Communications Corporation) – C:\Program Files\nss3.dll
[2003/12/29 23:53:58 | 000,163,840 | —- | C] (America Online, Inc.) – C:\Program Files\oscore.dll
[2003/12/29 23:53:58 | 000,151,552 | —- | C] (America Online, Inc.) – C:\Program Files\oscarui.dll
[2003/12/29 23:53:58 | 000,147,456 | —- | C] (Netscape Communications Corporation) – C:\Program Files\nspr4.dll
[2003/12/29 23:53:58 | 000,110,592 | —- | C] (Netscape Communications Corporation) – C:\Program Files\ssl3.dll
[2003/12/29 23:53:58 | 000,102,400 | —- | C] (Netscape Communications Corporation) – C:\Program Files\smime3.dll
[2003/12/29 23:53:58 | 000,073,728 | —- | C] (America Online, Inc.) – C:\Program Files\OscSrch.ocm
[2003/12/29 23:53:58 | 000,061,440 | —- | C] (America Online, Inc.) – C:\Program Files\osclogin.ocm
[2003/12/29 23:53:58 | 000,056,320 | —- | C] (America Online, Inc.) – C:\Program Files\OscMail.ocm
[2003/12/29 23:53:58 | 000,034,304 | —- | C] (America Online, Inc.) – C:\Program Files\rvapps.ocm
[2003/12/29 23:53:58 | 000,032,768 | —- | C] (America Online, Inc.) – C:\Program Files\proto.ocm
[2003/12/29 23:53:58 | 000,028,672 | —- | C] (Netscape Communications Corporation) – C:\Program Files\plc4.dll
[2003/12/29 23:53:58 | 000,024,576 | —- | C] (Netscape Communications Corporation) – C:\Program Files\plds4.dll
[2003/12/29 23:53:58 | 000,011,776 | —- | C] (America Online, Inc.) – C:\Program Files\osconfig.ocm
[2003/12/29 23:53:58 | 000,011,776 | —- | C] (America Online, Inc.) – C:\Program Files\NTP.ocm
[2003/12/29 23:53:58 | 000,008,192 | —- | C] (America Online, Inc.) – C:\Program Files\popup.ocm
[2003/12/29 23:53:58 | 000,007,168 | —- | C] (America Online, Inc.) – C:\Program Files\oscmain.ocm
[2003/12/29 23:53:57 | 000,184,320 | —- | C] (America Online, Inc.) – C:\Program Files\icbmui.ocm
[2003/12/29 23:53:57 | 000,139,264 | —- | C] (Inner Media, Inc.) – C:\Program Files\dunzip32.dll
[2003/12/29 23:53:57 | 000,102,400 | —- | C] (America Online, Inc.) – C:\Program Files\miscui.ocm
[2003/12/29 23:53:57 | 000,070,656 | —- | C] (America Online) – C:\Program Files\jgtkaol.dll
[2003/12/29 23:53:57 | 000,069,632 | —- | C] (America Online) – C:\Program Files\jgataol.dll
[2003/12/29 23:53:57 | 000,061,440 | —- | C] (America Online, Inc.) – C:\Program Files\coolsocket.dll
[2003/12/29 23:53:57 | 000,061,440 | —- | C] (America Online) – C:\Program Files\jgedaol.dll
[2003/12/29 23:53:57 | 000,057,344 | —- | C] (America Online, Inc.) – C:\Program Files\locateui.ocm
[2003/12/29 23:53:57 | 000,057,344 | —- | C] (America Online, Inc.) – C:\Program Files\coolsecnss.dll
[2003/12/29 23:53:57 | 000,050,176 | —- | C] (Blue Sky Software Corporation) – C:\Program Files\csh.dll
[2003/12/29 23:53:57 | 000,045,056 | —- | C] (America Online) – C:\Program Files\jgseaol.dll
[2003/12/29 23:53:57 | 000,045,056 | —- | C] (America Online) – C:\Program Files\jga0aol.dll
[2003/12/29 23:53:57 | 000,040,960 | —- | C] (America Online) – C:\Program Files\jgs2aol.dll
[2003/12/29 23:53:57 | 000,036,864 | —- | C] (America Online) – C:\Program Files\jga1aol.dll
[2003/12/29 23:53:57 | 000,032,768 | —- | C] (America Online) – C:\Program Files\jgs3aol.dll
[2003/12/29 23:53:57 | 000,006,144 | —- | C] (America Online, Inc.) – C:\Program Files\idlemon.dll
[2003/12/29 23:53:57 | 000,003,584 | —- | C] (America Online, Inc.) – C:\Program Files\coolsos.dll
[2003/12/29 23:53:56 | 001,335,296 | —- | C] (America Online, Inc.) – C:\Program Files\AimRes.dll
[2003/12/29 23:53:56 | 000,196,608 | —- | C] (America Online, Inc.) – C:\Program Files\AimSecondarySvcs.dll
[2003/12/29 23:53:56 | 000,184,320 | —- | C] (America Online, Inc.) – C:\Program Files\coolbos.dll
[2003/12/29 23:53:56 | 000,180,224 | —- | C] (America Online, Inc.) – C:\Program Files\ate32.dll
[2003/12/29 23:53:56 | 000,163,840 | —- | C] (America Online, Inc.) – C:\Program Files\buddyui.ocm
[2003/12/29 23:53:56 | 000,143,360 | —- | C] (America Online, Inc.) – C:\Program Files\AimCoreSvcs.dll
[2003/12/29 23:53:56 | 000,131,072 | —- | C] (America Online, Inc.) – C:\Program Files\ateima32.dll
[2003/12/29 23:53:56 | 000,098,304 | —- | C] (America Online, Inc.) – C:\Program Files\coolbucky.dll
[2003/12/29 23:53:56 | 000,090,112 | —- | C] (America Online, Inc.) – C:\Program Files\ChatUI.ocm
[2003/12/29 23:53:56 | 000,073,728 | —- | C] (America Online, Inc.) – C:\Program Files\coolpeer.dll
[2003/12/29 23:53:56 | 000,054,272 | —- | C] (America Online, Inc.) – C:\Program Files\aimapi.dll
[2003/12/29 23:53:56 | 000,045,056 | —- | C] (America Online, Inc.) – C:\Program Files\coolhttp.dll
[2003/12/29 23:53:56 | 000,041,984 | —- | C] (America Online, Inc.) – C:\Program Files\AlertUI.ocm
[2003/12/29 23:53:56 | 000,024,064 | —- | C] (America Online, Inc.) – C:\Program Files\browse.ocm
[2003/12/29 23:53:56 | 000,018,944 | —- | C] (America Online, Inc.) – C:\Program Files\aimtalk.dll
[2003/12/29 23:53:55 | 000,364,544 | —- | C] (Red Bend Ltd.) – C:\Program Files\dBenderC.dll
[2003/12/29 23:53:55 | 000,069,632 | —- | C] (America Online, Inc.) – C:\Program Files\Patcher.dll
[2003/12/29 23:53:55 | 000,061,440 | —- | C] (America Online, Inc.) – C:\Program Files\aim.exe
[2003/12/29 23:53:55 | 000,049,152 | —- | C] (America Online, Inc.) – C:\Program Files\ProgressDlg.dll
[2003/12/29 23:53:55 | 000,013,312 | —- | C] (America Online, Inc.) – C:\Program Files\Admin.ocm
[2003/12/29 23:53:55 | 000,010,752 | —- | C] (America Online, Inc.) – C:\Program Files\advert.ocm
[2002/09/15 14:57:12 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Help
[2002/09/15 14:57:12 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Help
[2002/09/07 10:23:08 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2002/09/07 10:23:08 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2002/09/07 09:33:56 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2002/09/07 09:33:56 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[42 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[138 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2010/03/06 09:09:06 | 000,553,984 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Jennifer\Desktop\OTL.exe
[2010/03/06 08:50:08 | 000,203,077 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2010/03/06 08:50:02 | 000,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/03/06 08:42:02 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/03/06 06:52:34 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/03/06 06:46:30 | 000,000,468 | —- | M] () – C:\WINDOWS\BRWMARK.INI
[2010/03/06 06:32:38 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/03/06 06:32:36 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/03/06 06:32:18 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/03/06 06:32:16 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/03/05 22:46:02 | 009,699,328 | -H– | M] () – C:\Documents and Settings\Jennifer\NTUSER.DAT
[2010/03/04 21:34:28 | 000,020,992 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\cookie newsletter.doc
[2010/03/03 19:38:50 | 000,001,535 | —- | M] () – C:\WINDOWS\UserData
[2010/03/02 02:00:02 | 000,000,498 | —- | M] () – C:\WINDOWS\tasks\Norton AntiVirus - Michael - Full System Scan.job
[2010/03/01 06:55:16 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\Jennifer\ntuser.ini
[2010/02/28 22:25:18 | 000,000,000 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\settings.dat
[2010/02/27 11:29:54 | 004,938,120 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Jennifer\Desktop\Silverlight.exe
[2010/02/27 07:56:06 | 000,001,530 | —- | M] () – C:\WINDOWS\win.ini
[2010/02/24 09:16:06 | 000,181,632 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MpSigStub.exe
[2010/02/23 18:43:42 | 000,000,000 | —- | M] () – C:\Documents and Settings\Jennifer\defogger_reenable
[2010/02/23 18:40:20 | 000,050,477 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\Defogger.exe
[2010/02/21 13:13:16 | 000,293,376 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\cnp3ufl4.exe
[2010/02/21 13:11:54 | 000,005,699 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\Attach.zip
[2010/02/21 12:42:06 | 000,524,288 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\dds.scr
[2010/02/21 12:00:44 | 000,001,917 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/02/21 11:52:08 | 000,001,804 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton 360.LNK
[2010/02/21 09:37:22 | 000,207,848 | —- | M] () – C:\Documents and Settings\Jennifer\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/02/21 07:04:54 | 000,040,001 | —- | M] () – C:\WINDOWS\System32\unknown_mini_F21A2B85742A4A7BA95E67A150BC8BE5.7z
[2010/02/21 07:04:38 | 000,842,210 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\Cat.DB
[2010/02/20 19:22:22 | 000,024,064 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\wimpy 2.doc
[2010/02/20 13:42:52 | 000,000,172 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\isolate.ini
[2010/02/20 10:41:54 | 000,124,976 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/02/20 10:41:54 | 000,060,808 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2010/02/20 10:41:54 | 000,007,456 | —- | M] () – C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/02/20 10:41:54 | 000,000,806 | —- | M] () – C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/02/20 10:41:50 | 000,482,432 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\cchpx86.sys
[2010/02/20 10:41:50 | 000,310,320 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.sys
[2010/02/20 10:41:50 | 000,308,272 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.sys
[2010/02/20 10:41:50 | 000,259,632 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.sys
[2010/02/20 10:41:50 | 000,217,136 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symtdi.sys
[2010/02/20 10:41:50 | 000,089,904 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symfw.sys
[2010/02/20 10:41:50 | 000,048,688 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symndisv.sys
[2010/02/20 10:41:50 | 000,043,696 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.sys
[2010/02/20 10:41:50 | 000,036,400 | R— | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SymIM.sys
[2010/02/20 10:41:50 | 000,036,400 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symndis.sys
[2010/02/20 10:41:50 | 000,033,072 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symids.sys
[2010/02/20 10:41:44 | 000,107,368 | R— | M] (GEAR Software Inc.) – C:\WINDOWS\System32\GEARAspi.dll
[2010/02/20 10:41:38 | 000,003,373 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.inf
[2010/02/20 10:41:38 | 000,001,752 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.inf
[2010/02/20 10:41:38 | 000,001,562 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNetV.inf
[2010/02/20 10:41:38 | 000,001,561 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.inf
[2010/02/20 10:41:38 | 000,001,388 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.inf
[2010/02/20 10:41:38 | 000,001,382 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.inf
[2010/02/20 10:41:38 | 000,000,640 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.inf
[2010/02/20 10:41:30 | 000,009,412 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\symnetv.cat
[2010/02/20 10:41:30 | 000,009,402 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.cat
[2010/02/20 10:41:30 | 000,007,431 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.cat
[2010/02/20 10:41:30 | 000,007,429 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.cat
[2010/02/20 10:41:30 | 000,007,425 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.cat
[2010/02/20 10:41:30 | 000,007,400 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.CAT
[2010/02/20 10:41:30 | 000,007,383 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.cat
[2010/02/19 19:42:24 | 000,000,600 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/19 19:24:28 | 000,000,614 | —- | M] () – C:\Documents and Settings\All Users\Desktop\a-squared HiJackFree.lnk
[2010/02/19 19:13:34 | 000,003,468 | —- | M] () – C:\WINDOWS\wininit.ini
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[42 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[138 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2010/03/04 21:34:25 | 000,020,992 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\cookie newsletter.doc
[2010/02/28 22:25:16 | 000,000,000 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\settings.dat
[2010/02/23 18:43:41 | 000,000,000 | —- | C] () – C:\Documents and Settings\Jennifer\defogger_reenable
[2010/02/23 18:40:25 | 000,050,477 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\Defogger.exe
[2010/02/21 13:13:25 | 000,293,376 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\cnp3ufl4.exe
[2010/02/21 13:11:53 | 000,005,699 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\Attach.zip
[2010/02/21 12:42:18 | 000,524,288 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\dds.scr
[2010/02/21 07:04:53 | 000,040,001 | —- | C] () – C:\WINDOWS\System32\unknown_mini_F21A2B85742A4A7BA95E67A150BC8BE5.7z
[2010/02/21 07:04:37 | 000,842,210 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\Cat.DB
[2010/02/20 19:22:21 | 000,024,064 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\wimpy 2.doc
[2010/02/20 13:43:49 | 000,009,412 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\symnetv.cat
[2010/02/20 13:43:49 | 000,009,402 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.cat
[2010/02/20 13:43:49 | 000,003,373 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.inf
[2010/02/20 13:43:49 | 000,001,562 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNetV.inf
[2010/02/20 13:43:49 | 000,001,561 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.inf
[2010/02/20 13:43:48 | 000,007,431 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.cat
[2010/02/20 13:43:48 | 000,007,429 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.cat
[2010/02/20 13:43:48 | 000,007,425 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.cat
[2010/02/20 13:43:48 | 000,007,383 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.cat
[2010/02/20 13:43:48 | 000,001,752 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.inf
[2010/02/20 13:43:48 | 000,001,388 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.inf
[2010/02/20 13:43:48 | 000,001,382 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.inf
[2010/02/20 13:43:47 | 000,007,400 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.CAT
[2010/02/20 13:43:47 | 000,000,640 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.inf
[2010/02/20 13:42:51 | 000,000,172 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\isolate.ini
[2010/02/20 10:41:53 | 000,007,456 | —- | C] () – C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/02/20 10:41:53 | 000,000,806 | —- | C] () – C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/02/20 10:41:50 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Norton 360.LNK
[2010/02/19 19:42:23 | 000,000,600 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/19 19:24:25 | 000,000,614 | —- | C] () – C:\Documents and Settings\All Users\Desktop\a-squared HiJackFree.lnk
[2009/05/04 15:00:28 | 000,131,574 | —- | C] () – C:\Program Files\REGISTER.EXE
[2009/05/04 15:00:28 | 000,013,414 | —- | C] () – C:\Program Files\INDEX.DAT
[2009/05/04 15:00:28 | 000,001,082 | —- | C] () – C:\Program Files\PALETTE.BMP
[2009/05/04 15:00:28 | 000,000,648 | —- | C] () – C:\Program Files\START.DAT
[2009/05/04 15:00:28 | 000,000,417 | —- | C] () – C:\Program Files\ITECH.CFG
[2009/05/04 15:00:27 | 000,000,080 | —- | C] () – C:\Program Files\SN.DAT
[2009/04/12 13:24:01 | 000,000,252 | —- | C] () – C:\Documents and Settings\Jennifer\Application Data\default.rss
[2009/04/01 20:54:54 | 000,000,029 | —- | C] () – C:\WINDOWS\Irremote.ini
[2008/04/23 17:21:48 | 000,000,000 | —- | C] () – C:\WINDOWS\game.INI
[2008/03/13 04:44:29 | 000,005,819 | -HS- | C] () – C:\WINDOWS\System32\cbeeg.ini
[2008/03/01 17:26:13 | 013,255,661 | —- | C] () – C:\Program Files\Luxor.zip
[2008/02/18 16:37:40 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\GTW32N50.dll
[2008/02/18 16:37:05 | 000,000,609 | —- | C] () – C:\WINDOWS\System32\WLAN.INI
[2008/02/10 13:13:44 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2008/02/07 23:46:20 | 000,005,837 | —- | C] () – C:\WINDOWS\YAHELITE_IGNORE.INI
[2008/02/04 18:23:10 | 000,693,792 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.DLL
[2007/10/28 12:14:11 | 000,000,026 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2007/10/28 12:14:10 | 000,000,468 | —- | C] () – C:\WINDOWS\BRWMARK.INI
[2007/10/28 12:10:08 | 000,000,846 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2007/10/28 12:10:08 | 000,000,093 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2007/10/28 12:08:35 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\BRTCPCON.DLL
[2007/10/28 12:08:35 | 000,000,114 | —- | C] () – C:\WINDOWS\System32\BRLMW03A.INI
[2007/10/28 12:08:31 | 000,000,086 | —- | C] () – C:\WINDOWS\Brfaxrx.ini
[2007/10/28 12:08:30 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\BrMuSNMP.dll
[2007/10/28 12:07:11 | 000,031,567 | —- | C] () – C:\WINDOWS\maxlink.ini
[2007/09/11 20:16:02 | 000,001,359 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/06/06 05:11:57 | 000,000,026 | —- | C] () – C:\WINDOWS\dvdSanta.INI
[2007/06/06 04:52:00 | 001,216,512 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2007/06/06 04:52:00 | 000,921,600 | —- | C] () – C:\WINDOWS\System32\vorbisenc.dll
[2007/06/06 04:52:00 | 000,237,568 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2007/06/06 04:52:00 | 000,237,568 | —- | C] () – C:\WINDOWS\System32\OggDS.dll
[2007/06/06 04:52:00 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\vorbis.dll
[2007/06/06 04:52:00 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\ogg.dll
[2007/03/30 13:31:20 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\dec_jl6.dll
[2006/08/16 02:35:00 | 001,724,416 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/08/16 02:35:00 | 001,507,328 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/08/16 02:35:00 | 001,101,824 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/08/16 02:35:00 | 000,581,632 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2006/08/16 02:35:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/08/16 02:35:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2006/08/06 12:16:49 | 000,000,034 | —- | C] () – C:\WINDOWS\AuthMgr.INI
[2006/02/16 16:50:29 | 000,002,913 | —- | C] () – C:\WINDOWS\YAHELITE.INI
[2006/01/07 10:43:52 | 000,000,177 | —- | C] () – C:\WINDOWS\kpcms.ini
[2006/01/07 10:43:44 | 000,210,944 | —- | C] () – C:\WINDOWS\System32\MSVCRT10.DLL
[2005/12/26 08:06:30 | 000,000,157 | —- | C] () – C:\WINDOWS\disney.ini
[2005/10/22 11:50:25 | 000,000,885 | —- | C] () – C:\Documents and Settings\Jennifer\Application Data\AdobeDLM.log
[2005/07/12 16:17:58 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2005/05/26 21:33:26 | 000,000,264 | —- | C] () – C:\WINDOWS\System32\winsusrm.dll
[2005/04/13 13:52:45 | 000,000,884 | —- | C] () – C:\WINDOWS\shlfolder.sys
[2005/03/11 11:22:34 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\DXFLib.dll
[2004/11/30 12:12:40 | 000,000,063 | —- | C] () – C:\WINDOWS\mdm.ini
[2004/11/08 07:31:27 | 000,003,468 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/07/14 15:59:42 | 000,006,852 | —- | C] () – C:\WINDOWS\System32\drivers\Vcs.sys
[2004/07/14 12:31:41 | 000,000,016 | —- | C] () – C:\WINDOWS\odbctrap.ini
[2004/07/14 12:11:26 | 000,000,016 | —- | C] () – C:\WINDOWS\backodbc.ini
[2004/05/30 11:02:29 | 000,000,464 | —- | C] () – C:\Program Files\convert.lnk
[2004/02/05 21:10:38 | 000,000,026 | —- | C] () – C:\WINDOWS\earthlink.INI
[2004/01/14 18:50:09 | 000,017,408 | —- | C] () – C:\Documents and Settings\Jennifer\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2003/12/29 23:54:15 | 000,060,879 | —- | C] () – C:\Program Files\INSTALL.LOG
[2003/12/29 23:54:14 | 000,000,515 | —- | C] () – C:\Program Files\Uninstall AOL Instant Messenger.lnk
[2003/12/29 23:53:59 | 000,164,864 | —- | C] () – C:\Program Files\unwise32.exe
[2003/12/29 23:53:59 | 000,116,852 | —- | C] () – C:\Program Files\uninstll.exe
[2003/12/29 23:53:59 | 000,102,400 | —- | C] () – C:\Program Files\xmlparse.dll
[2003/12/29 23:53:59 | 000,005,632 | —- | C] () – C:\Program Files\stats.ocm
[2003/12/29 23:53:59 | 000,001,732 | —- | C] () – C:\Program Files\unwise32.ini
[2003/12/29 23:53:59 | 000,001,370 | —- | C] () – C:\Program Files\stockalert.gif
[2003/12/29 23:53:58 | 000,002,622 | —- | C] () – C:\Program Files\netwait.odl
[2003/12/29 23:53:58 | 000,002,048 | —- | C] () – C:\Program Files\ShareFile.exe
[2003/12/29 23:53:58 | 000,002,048 | —- | C] () – C:\Program Files\SendFile.exe
[2003/12/29 23:53:58 | 000,001,457 | —- | C] () – C:\Program Files\rvappstm.lst
[2003/12/29 23:53:57 | 000,221,184 | —- | C] () – C:\Program Files\inetsocket.dll
[2003/12/29 23:53:57 | 000,015,907 | —- | C] () – C:\Program Files\licens32.txt
[2003/12/29 23:53:57 | 000,001,559 | —- | C] () – C:\Program Files\icbmftvc.lst
[2003/12/29 23:53:56 | 000,477,346 | —- | C] () – C:\Program Files\AIM95.HLP
[2003/12/29 23:53:56 | 000,147,456 | —- | C] () – C:\Program Files\aimauto.exe
[2003/12/29 23:53:56 | 000,001,375 | —- | C] () – C:\Program Files\aimalert.gif
[2003/12/29 23:53:55 | 000,012,312 | —- | C] () – C:\Program Files\aim95.CNT
[2003/12/29 23:53:55 | 000,002,836 | —- | C] () – C:\Program Files\aim.odl
[2003/12/25 09:36:18 | 000,000,049 | —- | C] () – C:\WINDOWS\dmi.ini
[2003/11/30 22:15:08 | 000,000,156 | —- | C] () – C:\WINDOWS\winzip32.ini
[2003/11/11 17:59:19 | 000,000,026 | —- | C] () – C:\WINDOWS\ERegClnt.INI
[2003/08/28 18:20:18 | 000,000,185 | —- | C] () – C:\WINDOWS\QTW.INI
[2003/06/03 11:07:46 | 000,000,345 | —- | C] () – C:\WINDOWS\ka.ini
[2003/04/22 19:42:21 | 000,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2003/01/19 16:18:39 | 000,000,044 | —- | C] () – C:\WINDOWS\liveup.ini
[2002/12/02 14:15:44 | 000,001,979 | —- | C] () – C:\WINDOWS\ACROREAD.INI
[2002/11/28 21:23:20 | 000,122,946 | —- | C] () – C:\WINDOWS\System32\CSGina.dll
[2002/11/11 13:29:59 | 000,001,369 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2002/11/09 14:25:21 | 000,000,053 | —- | C] () – C:\WINDOWS\ASTROP.INI
[2002/11/02 11:24:59 | 000,000,691 | —- | C] () – C:\WINDOWS\hegames.ini
[2002/10/06 10:56:19 | 000,000,060 | —- | C] () – C:\WINDOWS\TLCAPPS.INI
[2002/10/05 21:21:29 | 000,061,678 | —- | C] () – C:\Documents and Settings\Jennifer\Application Data\PFP100JPR.{PB
[2002/10/05 21:21:29 | 000,012,358 | —- | C] () – C:\Documents and Settings\Jennifer\Application Data\PFP100JCM.{PB
[2002/09/24 20:49:50 | 000,000,416 | —- | C] () – C:\WINDOWS\SIERRA.INI
[2002/09/23 10:44:19 | 000,000,037 | —- | C] () – C:\WINDOWS\iltwain.ini
[2002/09/23 10:40:24 | 000,229,376 | —- | C] () – C:\WINDOWS\System32\ISP2000.dll
[2002/09/23 10:40:24 | 000,063,488 | —- | C] () – C:\WINDOWS\System32\Eztw32.dll
[2002/09/21 15:23:45 | 000,000,000 | —- | C] () – C:\WINDOWS\netscape.INI
[2002/09/16 20:22:39 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2002/09/15 17:44:44 | 000,000,000 | —- | C] () – C:\WINDOWS\SETUP32.INI
[2002/09/07 12:51:58 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2002/09/07 12:43:42 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\msssc.dll
[2002/09/07 12:37:49 | 000,262,144 | —- | C] () – C:\WINDOWS\System32\shpshftr.dll
[2002/09/07 11:18:00 | 000,002,080 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2002/03/13 15:46:46 | 000,053,248 | R— | C] () – C:\WINDOWS\System32\zlib.dll
[2001/09/19 13:41:46 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\opcode.dll
[1999/01/22 13:46:58 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL
[1998/08/16 06:00:00 | 000,004,096 | —- | C] () – C:\WINDOWS\System32\sysres.dll
[1997/11/17 17:13:16 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
========== LOP Check ==========
[2003/12/30 00:01:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2005/01/14 21:56:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Napster
[2005/02/14 17:50:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\4D
[2006/03/16 18:28:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SecTaskMan
[2006/11/03 09:06:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2007/05/29 07:59:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2007/06/18 13:15:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\YAHOO
[2007/10/28 12:06:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ScanSoft
[2008/01/24 14:37:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Broderbund Software
[2008/01/24 14:38:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Broderbund LLC
[2008/02/11 16:24:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ubisoft
[2008/03/09 11:04:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2008/03/17 15:59:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Uniblue
[2008/05/03 13:01:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sandlot Games
[2008/09/10 17:00:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Broderbund
[2008/09/12 15:05:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ipapungz
[2008/09/12 15:05:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\qjcjwvol
[2008/09/13 03:06:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ixcbyvir
[2008/09/13 03:36:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\pmdopqzo
[2008/09/13 04:06:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\bkfmzmlo
[2008/09/13 04:36:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ixgbexwj
[2008/09/13 05:07:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\razupkjg
[2008/09/13 05:37:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\gdazqvuh
[2008/09/13 06:07:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\fypavqrg
[2009/01/03 10:10:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DriverScanner
[2009/03/05 15:21:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2009/03/07 18:29:40 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{66E2F539-12B6-4870-A500-7689CDE75C5E}
[2009/03/11 14:09:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2009/05/04 15:02:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Individual Software
[2009/07/13 15:09:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Computer Business Solutions
[2009/12/17 20:33:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCSettings
[2010/01/05 13:19:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Research In Motion
[2002/09/16 19:53:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Active Disk
[2004/09/15 07:22:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Aladdin Systems
[2006/08/06 12:15:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Earthlink
[2006/08/06 12:31:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\ScamBlocker
[2007/05/31 07:30:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Sametime
[2008/02/18 20:51:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\PC-FAX TX
[2008/03/17 15:59:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Uniblue
[2008/03/17 20:18:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\System Tweaker
[2008/08/08 19:30:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Intalev
[2008/12/19 10:52:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\RCP 5
[2009/03/07 18:34:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\SystemRequirementsLab
[2009/10/27 21:24:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Thunderbird
[2010/01/06 21:41:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Research In Motion
[2010/02/11 18:28:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Tific
[2002/09/17 05:12:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Active Disk
[2004/06/29 13:58:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\WeatherBug
[2005/03/02 14:33:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Diary Defender
[2005/04/24 01:59:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Folder Guard
[2006/05/12 01:10:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\.bittorrent
[2006/07/27 11:54:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\tunebite
[2006/08/06 15:56:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\ScamBlocker
[2006/09/25 10:23:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\SlySoft
[2006/11/03 09:09:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\TuneUp Software
[2007/05/29 07:59:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\URSoft
[2007/11/17 01:47:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Orbit
[2008/04/01 15:15:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Uniblue
[2008/12/04 13:04:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\RCP 5
[2008/12/30 12:26:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Desktopicon
[2009/01/08 11:01:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\ScanSoft
[2009/02/11 13:03:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Canneverbe_Limited
[2009/03/05 15:21:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\NCH Swift Sound
[2009/03/19 12:56:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Scooter Software
[2009/03/21 10:36:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/04/28 12:01:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\InterVideo
[2009/05/04 15:05:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Individual Software
[2009/05/13 06:52:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Forte
[2009/11/07 20:04:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Thunderbird
[2010/01/05 15:03:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Research In Motion
[2010/02/02 06:08:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Tific
[2002/09/18 15:29:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Antonia\Application Data\Active Disk
[2005/01/11 13:29:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Antonia\Application Data\WeatherBug
[2008/01/02 14:21:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Antonia\Application Data\cerasus.media
[2008/08/13 16:59:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Antonia\Application Data\Intalev
[2008/08/25 12:54:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Antonia\Application Data\Total Eclipse
[2008/12/18 19:14:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Antonia\Application Data\RCP 5
[2009/05/29 07:59:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Antonia\Application Data\Uniblue
[2009/12/24 08:02:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Antonia\Application Data\Thunderbird
[2010/01/10 10:03:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Antonia\Application Data\Research In Motion
[2003/10/16 22:37:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Guest\Application Data\Active Disk
[2010/03/06 06:52:34 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2009/09/04 16:21:34 | 000,000,342 | —- | M] () – C:\WINDOWS\Tasks\Uniblue SpyEraser.job
========== Purity Check ==========
========== Custom Scans ==========
< %ALLUSERSPROFILE%\Application Data\*. >
[2002/09/07 09:33:56 | 000,000,000 | –SD | M] – C:\Documents and Settings\All Users\Application Data\Microsoft
[2002/09/16 19:20:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Symantec
[2002/09/26 13:44:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\QuickTime
[2003/12/23 20:55:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2003/12/30 00:01:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2005/01/14 21:56:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Napster
[2005/02/14 17:50:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\4D
[2005/03/09 13:30:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple Computer
[2005/10/22 11:54:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Adobe
[2006/01/20 21:22:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2006/02/05 21:35:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ahead
[2006/03/16 18:28:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SecTaskMan
[2006/04/04 10:10:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Trymedia
[2003/04/22 19:37:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Macrovision
[2006/08/06 11:54:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\InstallShield
[2006/11/03 09:06:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2006/12/05 10:00:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Yahoo!
[2007/04/08 23:38:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NVIDIA
[2007/05/29 07:59:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2007/05/31 10:15:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Pure Networks
[2007/06/18 13:15:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\YAHOO
[2007/10/28 12:05:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Brother
[2007/10/28 12:06:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ScanSoft
[2007/11/15 13:48:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nero
[2008/01/24 14:37:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Broderbund Software
[2008/01/24 14:38:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Broderbund LLC
[2008/02/11 16:24:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ubisoft
[2008/03/09 11:04:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2008/03/17 15:59:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Uniblue
[2008/03/18 13:38:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Avira
[2008/04/17 17:48:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
[2008/05/03 13:01:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sandlot Games
[2008/07/08 16:34:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple
[2008/09/10 17:00:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Broderbund
[2008/09/12 15:05:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ipapungz
[2008/09/12 15:05:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\qjcjwvol
[2008/09/13 03:06:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ixcbyvir
[2008/09/13 03:36:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\pmdopqzo
[2008/09/13 04:06:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\bkfmzmlo
[2008/09/13 04:36:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ixgbexwj
[2008/09/13 05:07:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\razupkjg
[2008/09/13 05:37:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\gdazqvuh
[2008/09/13 06:07:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\fypavqrg
[2009/01/03 10:10:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DriverScanner
[2009/03/05 15:21:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2009/03/05 15:21:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Software
[2009/03/07 18:29:40 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{66E2F539-12B6-4870-A500-7689CDE75C5E}
[2009/03/11 14:09:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2009/05/03 13:12:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVS4YOU
[2009/05/04 15:02:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Individual Software
[2009/07/13 15:09:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Computer Business Solutions
[2009/08/18 10:18:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Google Updater
[2009/09/11 19:38:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\McAfee Security Scan
[2009/09/13 19:38:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\McAfee
[2009/12/15 18:27:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Norton
[2009/12/17 20:32:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NortonInstaller
[2009/12/17 20:33:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCSettings
[2010/01/05 13:19:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Research In Motion
[2010/01/05 21:04:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Roxio
[2010/01/05 21:06:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sonic
[2010/01/27 17:12:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/02/19 19:42:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
[2008/12/22 01:35:14 | 002,652,467 | —- | M] (Uniblue Systems Ltd. ) – C:\Documents and Settings\All Users\Application Data\{66E2F539-12B6-4870-A500-7689CDE75C5E}\DriverScanner_Setup.exe
[2008/10/08 23:51:18 | 000,057,344 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\All Users\Application Data\{66E2F539-12B6-4870-A500-7689CDE75C5E}\driverscanner\3E39C89\2FB6E586\DriverScannerApi.exe
[2008/11/14 07:32:20 | 000,212,992 | —- | M] (Uniblue Systems) – C:\Documents and Settings\All Users\Application Data\{66E2F539-12B6-4870-A500-7689CDE75C5E}\driverscanner\5C40AA7E\8F9F9DCD\DriverScanner.exe
[2008/08/27 06:46:00 | 000,077,312 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\All Users\Application Data\{66E2F539-12B6-4870-A500-7689CDE75C5E}\driverscanner\CD77AC88\3DFD6AB6\DriverScannerApi.exe
[2007/03/14 19:10:30 | 000,116,288 | —- | M] (Apple Inc.) – C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.1.1.5\iTunesSetupAdmin.exe
[2001/02/08 10:18:58 | 000,069,632 | —- | M] (T.L.C.P.P. L.L.C.) – C:\Documents and Settings\All Users\Application Data\Broderbund Software\Print\vroomsap.exe
[2000/01/12 11:07:44 | 000,593,920 | —- | M] (InstallShield Software Corporation) – C:\Documents and Settings\All Users\Application Data\Broderbund Software\Print\iftw.exe
[1996/12/27 15:57:56 | 000,060,112 | —- | M] () – C:\Documents and Settings\All Users\Application Data\Individual Software\Professor Teaches Photoshop 6\UNWISE.EXE
[2001/09/17 15:30:42 | 000,119,291 | —- | M] () – C:\Documents and Settings\All Users\Application Data\Individual Software\Professor Teaches Photoshop 6\UnInstall.EXE
[2009/03/05 15:21:36 | 000,110,592 | —- | M] () – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound\Golden\lame.exe\lame.exe
[2009/12/10 20:29:04 | 001,782,128 | —- | M] (Symantec Corporation) – C:\Documents and Settings\All Users\Application Data\Norton\NUA.exe
[2009/12/22 12:11:34 | 080,528,056 | —- | M] (Symantec Corporation) – C:\Documents and Settings\All Users\Application Data\Norton\{NAV_Production_94_17.1.0.19_NUC}\NAV10UPEN.exe
< %APPDATA%\*. >
[2002/09/07 10:23:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Identities
[2002/09/07 09:33:56 | 000,000,000 | –SD | M] – C:\Documents and Settings\Jennifer\Application Data\Microsoft
[2002/09/16 19:53:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Active Disk
[2002/09/16 20:18:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Microsoft Web Folders
[2002/09/16 20:25:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Mozilla
[2002/09/16 21:01:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Help
[2002/10/05 21:21:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Corel
[2002/10/12 12:13:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Real
[2003/01/11 12:10:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Adobe
[2003/04/30 23:52:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Yahoo!
[2003/07/20 07:06:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Sun
[2003/12/10 18:36:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Macromedia
[2004/07/17 16:31:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Talkback
[2004/09/15 07:22:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Aladdin Systems
[2005/05/02 19:52:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Apple Computer
[2005/11/21 20:55:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\AdobeUM
[2006/08/06 12:15:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Earthlink
[2006/08/06 12:31:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\ScamBlocker
[2006/09/19 07:57:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Google
[2007/05/31 07:30:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Sametime
[2007/11/15 19:50:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Nero
[2007/12/15 12:13:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\DivX
[2007/12/17 10:15:56 | 000,000,000 | R–D | M] – C:\Documents and Settings\Jennifer\Application Data\Brother
[2008/02/18 20:51:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\PC-FAX TX
[2008/03/17 15:59:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Uniblue
[2008/03/17 20:18:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\System Tweaker
[2008/08/08 19:30:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Intalev
[2008/12/19 10:52:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\RCP 5
[2009/03/07 18:34:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\SystemRequirementsLab
[2009/04/24 22:06:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\vlc
[2009/10/09 23:14:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Creative
[2009/10/27 21:24:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Thunderbird
[2010/01/05 21:41:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\InstallShield
[2010/01/06 21:41:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Research In Motion
[2010/02/11 18:28:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Tific
[2010/02/21 11:21:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Malwarebytes
< %APPDATA%\*.exe /s >
[2007/03/16 21:19:46 | 021,277,080 | —- | M] ( ) – C:\Documents and Settings\Jennifer\Application Data\Adobe\Acrobat\7.0\Updater\AdbeRdr709_en_US.exe
[2008/02/25 20:06:46 | 001,523,040 | —- | M] (Adobe Systems Incorporated) – C:\Documents and Settings\Jennifer\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
[2008/09/24 16:12:22 | 000,335,872 | R— | M] (Macrovision Corporation) – C:\Documents and Settings\Jennifer\Application Data\Microsoft\Installer\{8C8ADD9C-1F30-4B1A-927E-B72CC4AADB91}\ARPPRODUCTICON.exe
< %SYSTEMDRIVE%\*.exe >
< MD5 for: AGP440.SYS >
[2005/08/19 15:35:20 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/08/31 14:37:42 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2005/08/19 15:35:20 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2008/08/31 14:37:42 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/04 01:07:42 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
< MD5 for: ATAPI.SYS >
[2002/08/29 03:50:10 | 010,158,890 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys
[2005/08/19 15:35:20 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/08/31 14:37:42 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2002/08/29 03:50:10 | 010,158,890 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp1.cab:atapi.sys
[2005/08/19 15:35:20 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2008/08/31 14:37:42 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2002/08/29 01:27:50 | 000,086,912 | —- | M] (Microsoft Corporation) MD5=95B858761A00E1D4F81F79A0DA019ACA – C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 00:59:42 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/04 00:59:42 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\atapi.sys
< MD5 for: EVENTLOG.DLL >
[2005/09/01 15:24:42 | 000,212,992 | —- | M] (EarthLink, Inc.) MD5=4B28CD532EA8AFE16A2A40B5D30DA277 – C:\Program Files\EarthLink TotalAccess\EventLog.dll
[2008/04/13 19:11:54 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 19:11:54 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/04 02:56:42 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
< MD5 for: NETLOGON.DLL >
[2008/04/13 19:12:02 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 19:12:02 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2004/08/04 02:56:44 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
< MD5 for: NVATA.SYS >
[2006/06/28 17:38:56 | 000,105,088 | —- | M] (NVIDIA Corporation) MD5=9ECCD189A9554C30A0D18A429778C7BA – C:\WINDOWS\system32\drivers\nvata.sys
< MD5 for: SCECLI.DLL >
[2004/08/04 02:56:44 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 19:12:06 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 19:12:06 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll
< %systemroot%\*. /mp /s >
< %systemroot%\system32\*.dll /lockedfiles >
[2010/01/05 04:00:22 | 000,214,528 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtrans.dll
[2010/01/05 04:00:20 | 000,347,136 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtmsft.dll
[138 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
< End of report >
Extras:
OTL Extras logfile created on: 3/6/2010 9:10:58 AM - Run 1
OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\Jennifer\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 42.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.48 Gb Total Space | 2.05 Gb Free Space | 2.75% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: MUSKRAT
Current User Name: Jennifer
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
[HKEY_USERS\S-1-5-21-1809067083-3242847100-1996373590-1005\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
[HKEY_USERS\S-1-5-21-1809067083-3242847100-1996373590-1006\SOFTWARE\Classes\]
.exe [@ = exefile] – Reg Error: Key error. File not found
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
[HKEY_USERS\S-1-5-21-1809067083-3242847100-1996373590-1007\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Print_Directory_Listing] – printdir.bat "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"67:UDP" = 67:UDP:*:Enabled:DHCP Discovery Service
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"8097:TCP" = 8097:TCP:*:Enabled:EarthLink UHP Modem Support
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 6.2 – File not found
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\System32\LEXPPS.EXE" = C:\WINDOWS\System32\LEXPPS.EXE:*:Disabled:LEXPPS.EXE – File not found
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – (Yahoo! Inc.)
"C:\Program Files\Yazak Chat\yazak.exe" = C:\Program Files\Yazak Chat\yazak.exe:*:Enabled:yazak – (ZakFromAnotherPlanet)
"C:\WINDOWS\System32\mmc.exe" = C:\WINDOWS\System32\mmc.exe:*:Disabled:Microsoft Management Console – (Microsoft Corporation)
"C:\Program Files\IBM\Sametime Connect\JRE\BIN\sametime75.exe" = C:\Program Files\IBM\Sametime Connect\JRE\BIN\sametime75.exe:*:Enabled:Lotus Sametime Connect – (International Business Machines Corporation)
"C:\Program Files\InterVideo\DVD8\WinDVD.exe" = C:\Program Files\InterVideo\DVD8\WinDVD.exe:*:Disabled:WinDVD – File not found
"C:\WINDOWS\System32\ftp.exe" = C:\WINDOWS\System32\ftp.exe:*:Disabled:File Transfer Program – (Microsoft Corporation)
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Disabled:bittorrent – File not found
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Disabled:iTunes – (Apple Inc.)
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Disabled:LimeWire – File not found
"C:\Program Files\Yahoo!\Yahoo! Music Engine\YahooMusicEngine.exe" = C:\Program Files\Yahoo!\Yahoo! Music Engine\YahooMusicEngine.exe:*:Disabled:Yahoo! Music Engine – File not found
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Premium
"{02DFF6B1-1654-411C-8D7B-FD6052EF016F}" = Apple Software Update
"{02F6993D-B763-4F40-8F93-2A9CD97586E3}" = Microsoft IntelliType Pro 6.3
"{07982F29-C7D6-423F-A100-C0FC67D0EC2F}" = EarthLink Wireless High Speed
"{08CA9554-B5FE-4313-938F-D4A417B81175}" = QuickTime
"{0A146245-DB79-4197-BF5D-FE1A699A2CC7}" = Camera Window DS
"{0B32D3F7-9241-4AAC-8C15-87530968E3A7}" = Eudora
"{0EAC5DEC-2AFD-4533-9416-3098BFEFDEC2}_is1" = Infine CaptureFlash version 1.6
"{10798AE3-DCBB-43C3-9C93-C23512427E25}" = The Sims Deluxe Edition
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{172423F9-522A-483A-AD65-03600CE4CA4F}" = Microsoft Works 6-9 Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1CA7ACD6-B21B-4240-AA05-4FC55F6E1033}" = Nero 8
"{205A5182-EFC8-4C25-B61D-C164F8FF4048}" = BlackBerry Desktop Software 5.0.1
"{20C53FA2-4307-4671-A93F-9463B29DFCF1}" = Symantec Technical Support Web Controls
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java™ 6 Update 18
"{26A24AE4-039D-4CA4-87B4-2F83216016F0}" = Java™ 6 Update 16
"{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1" = ConvertHelper 2.2
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{29D88826-2AB9-11D5-8854-00902761A46D}" = WordPerfect Office 2002 OEM
"{2E0C1913-886B-4C5C-8DAF-D1E649CE5FCC}" = Creative MediaSource
"{2EAF7E61-068E-11DF-953C-005056806466}" = Google Earth
"{32343DB6-9A52-40C9-87E4-5E7C79791C87}" = MSXML 4.0 SP2 and SOAP Toolkit 3.0
"{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}" = PaperPort Image Printer
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3F50AF3B-8997-4916-0095-99D63DDB785A}" = Harry Potter
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{40939C6D-8F27-40B8-9CBC-72701624185D}" = Redistributed Files
"{43DCF766-6838-4F9A-8C91-D92DA586DFA7}" = Microsoft Windows Journal Viewer
"{4572F220-0A56-402E-90F1-4D36DD22F108}" = TubeHunter Ultra
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4DBBF091-FACD-422C-B43C-786335BD5398}" = MovieEdit Task
"{4FD36BC0-18D0-4874-9E7D-24024066B990}" = Cayra
"{50E25180-3BDC-4B6D-80A2-3F1F0C9CF39D}" = Camera Window DVC
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5809E7CF-4DCF-11D4-9875-00105ACE7734}" = Logitech MouseWare 9.79
"{58628459-F393-4EBA-AA8B-990E92DA8AC4}" = AdWare & SpyWare
"{60D8CA34-642C-476F-AB4E-94DECCAEED69}" = The White Wolf of Icicle Creek
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{65563451-00B6-458C-9F9A-03A7757355A6}" = Compact Wireless-G USB Network Adapter with SpeedBooster
"{689E0AB3-50B2-4E5A-9DCE-6DA9F5BE1314}" = BlackBerry® Media Sync
"{6C3A75A6-9A90-44A3-A703-82AC1EA6A85D}" = Camera Window MC
"{7148F0A8-6813-11D6-A77B-00B0D0142000}" = Java 2 Runtime Environment, SE v1.4.2
"{71A4C7E7-1792-4895-A403-36814B2B4151}" = EarthLink FastLane
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72F9F82C-0A0D-44a7-9FBD-3804D2EEA9ED}" = The Sims™ 2 Sampler - Create-A-Sim
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7797C70B-11EB-446A-9B1E-3D9039DB581F}" = TotalAccess Core Applications
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{843E82A0-15CE-4587-9BF0-8C07FF90094D}" = Where in the USA is Carmen Sandiego for schools
"{874E44F3-B9A7-4AA1-B4BA-83E5684ED9C6}" = PhotoStitch
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics Driver
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8C8ADD9C-1F30-4B1A-927E-B72CC4AADB91}" = IBM Lotus Sametime Connect 7.5.1
"{901F8ED7-13E8-43EF-B738-2FE89B0588EB}" = Camera Access Library
"{91A4AD99-69CE-4745-97B7-0E0DFBECFDE5}" = Adobe Illustrator CS
"{93C3B6D2-8FB0-400F-A763-1B64F7C62B5B}" = Nancy Drew: Danger on Deception Island
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A1D0D14A-B776-4907-BC00-5149F2298086}" = Camera Support Core Library
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A2EB8F2E-6D9B-4F8B-96EB-F976D33F416F}" = Camera Window DVC
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}" = Windows Defender Signatures
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AB90749C-7422-4580-8A7A-66CC5E9E5F98}" = iTunes
"{AC76BA86-1033-0000-7760-000000000001}" = Adobe Acrobat 6.0 Professional
"{AD8780DE-96F5-454B-B551-E063B94AAD4F}" = Homework Helpers
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B6C89654-A6A2-477C-873B-724EC1C56407}" = ScanSoft PaperPort 11
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B98BE95C-E76F-4246-B8E6-BEB8EE791D06}" = Roxio Media Manager
"{B9BD9BF5-F1D1-4904-B348-40D0E9FF0023}" = Scooby-Doo 2 - Monsters Unleashed
"{BAA43DA2-B6C5-46EC-B163-0E8EEAF975A4}" = RAW Image Task 2.2
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BBBC2B89-E193-4348-A83C-C8DD8210A4AC}" = Canon PhotoRecord
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}" = Canon ZoomBrowser EX (E)
"{C427E746-4EC9-4E3C-AACB-C6BB1F714D7F}" = Uniblue DriverScanner 2009
"{C83FB11D-9EC6-49D7-99A7-DDDB2264883C}" = Brother MFL-Pro Suite
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D40CAD1B-AAC0-44D2-B662-232A183C5FE1}" = The 3D Globe
"{DBEE6A5D-7E83-BA08-6055-37F9E60D28D6}" = Cake Mania
"{DC3065BF-95B4-42C5-B47D-0B713CDA75D0}" = Creative Zen Vision M
"{EFB21DE7-8C19-4A88-BB28-A766E16493BC}" = Adobe Photoshop CS
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4EC2FB1-4255-4040-8DE6-5D75FA9D039F}" = Nancy Drew: The Creature of Kapu Cave
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT Extension to Microsoft Windows XP CD Writing Wizard
"{FF087B26-DD20-4DD0-B97F-0B08B76A04D1}" = Deal Info
"3DGroove" = 3D Groove Playback Engine
"53F13DB4D9611FD63BE580F06F0729BF236ABE68" = Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
"Active Disk" = Active Disk
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"a-squared HiJackFree_is1" = a-squared HiJackFree 3.1
"AudibleManager" = AudibleManager
"AVS DVD Copy_is1" = AVS DVD Copy version 1.4
"AVSCoverEditor_AVSMedia_is1" = AVS Cover Editor [removed] (AVSMedia)
"BlackBerry_{205A5182-EFC8-4C25-B61D-C164F8FF4048}" = BlackBerry Desktop Software 5.0.1
"BurnAware Free_is1" = BurnAware Free 2.3.0
"Cake Mania" = Cake Mania (remove only)
"Camtasia Studio 2" = Camtasia Studio 2
"CNXT_MODEM_PCI" = SoftV92 Data Fax Modem
"Cosmi Photo Editor Plus" = Cosmi Photo Editor Plus
"Creative Removable Disk Manager" = Creative Removable Disk Manager
"CyberSky" = CyberSky
"Dear America" = Dear America
"Diary Defender" = Diary Defender
"Disketch" = Disketch CD Label Software
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"drmtool.inf" = Personal License Update Wizard for Windows Media Player
"Dual Mode Camera_is1" = Uninstall Dual Mode Camera
"DVD Identifier_is1" = DVD Identifier
"dvdSanta 4.50 - Make your own DVD movies!_is1" = dvdSanta 4.50
"Earthlink Instant Messenger" = Earthlink Instant Messenger
"EarthLink TotalAccess 2004" = EarthLink Software
"eBay Icon" = eBay Icon
"Fetch" = Fetch
"FLVPlayer" = FLV Player 1.3.3
"Golden" = Golden Records Vinyl to CD Converter
"Google Updater" = Google Updater
"HijackThis" = HijackThis 2.0.2
"Hoyle Solitaire and Mahjong" = Hoyle Solitaire and Mahjong
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InSpheration" = InSpheration
"InstallShield_{0A146245-DB79-4197-BF5D-FE1A699A2CC7}" = Canon Camera Window DSLR 5 for ZoomBrowser EX
"InstallShield_{4DBBF091-FACD-422C-B43C-786335BD5398}" = Canon MovieEdit Task for ZoomBrowser EX
"InstallShield_{50E25180-3BDC-4B6D-80A2-3F1F0C9CF39D}" = Canon Camera Window DC_DV 6 for ZoomBrowser EX
"InstallShield_{6C3A75A6-9A90-44A3-A703-82AC1EA6A85D}" = Canon Camera Window MC 6 for ZoomBrowser EX
"InstallShield_{874E44F3-B9A7-4AA1-B4BA-83E5684ED9C6}" = Canon Utilities PhotoStitch 3.1
"InstallShield_{901F8ED7-13E8-43EF-B738-2FE89B0588EB}" = Canon Camera Access Library
"InstallShield_{A1D0D14A-B776-4907-BC00-5149F2298086}" = Canon Camera Support Core Library
"InstallShield_{A2EB8F2E-6D9B-4F8B-96EB-F976D33F416F}" = Canon Camera Window DC_DV 5 for ZoomBrowser EX
"InstallShield_{BAA43DA2-B6C5-46EC-B163-0E8EEAF975A4}" = Canon RAW Image Task for ZoomBrowser EX
"InstallShield_{D40CAD1B-AAC0-44D2-B662-232A183C5FE1}" = The 3D Globe
"Instant Home Design" = Instant Home Design
"Iomega App Services" = Iomega App Services
"IomegaWare" = IomegaWare
"IrfanView" = IrfanView (remove only)
"JetBee_is1" = JetBee FREE 4.0.7 (build 321)
"LunarPhase Pro Demo_is1" = LunarPhase Pro Demo
"Luxor_is1" = Luxor
"Luxor2" = Luxor 2 (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mavis Beacon Teaches Typing Deluxe 17" = Mavis Beacon Teaches Typing Deluxe 17
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla (1.7.1)" = Mozilla (1.7.1)
"Mozilla Firefox (3.5.8)" = Mozilla Firefox (3.5.8)
"Mozilla Thunderbird (2.0.0.23)" = Mozilla Thunderbird (2.0.0.23)
"MP3 CD Converter_is1" = MP3 CD Converter 4.02
"MPEG Joiner_is1" = MPEG Joiner
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSN Music Assistant" = MSN Music Assistant
"My Screen Recorder Pro_is1" = My Screen Recorder Pro 2.35
"N360" = Norton 360
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NoteWorthy Composer" = NoteWorthy Composer
"NVIDIA Drivers" = NVIDIA Drivers
"PercussionStudio3" = PercussionStudio3
"Personalized Learning Center" = Personalized Learning Center
"Pet Vet" = Pet Vet (remove only)
"Pet Vet 2_is1" = Pet Vet 2
"Pierresoft Adesign_is1" = Pierresoft Adesign 1.5
"Prism" = Prism Video Converter
"Professor Teaches Photoshop 6" = Professor Teaches Photoshop 6
"Rainlendar2" = Rainlendar2 (remove only)
"ReaConverter 5.5 Pro_is1" = ReaConverter 5.5 Pro
"Secret Agent™ Barbie™" = Secret Agent™ Barbie™
"Shockwave" = Shockwave
"SoundTap" = SoundTap Streaming Audio Recorder
"SpyEraser_is1" = Uniblue SpyEraser
"SpywareBlaster_is1" = SpywareBlaster 4.2
"Stellaluna" = Stellaluna
"Switch" = Switch Sound File Converter
"SysInfo" = Creative System Information
"System Tweaker_is1" = Uniblue System Tweaker
"SystemRequirementsLab" = System Requirements Lab
"The American Girls Dress Designer ™" = The American Girls Dress Designer ™
"The Mystery of the Mummy" = The Mystery of the Mummy
"The Weather Channel Desktop 6" = The Weather Channel Desktop 6
"Total 3D Home Deluxe" = Total 3D Home Deluxe
"TruVoice" = Lernout & Hauspie TruVoice for Microsoft Agent
"Tunebite_is1" = Tunebite [removed]
"Uniblue DriverScanner 2009" = Uniblue DriverScanner 2009
"Unlocker" = Unlocker 1.8.8
"Video Journal_is1" = Video Journal Version 1.4
"WavePad" = WavePad Sound Editor
"WebPost" = Microsoft Web Publishing Wizard 1.52
"WIC" = Windows Imaging Component
"WinAVIVideoConverter_is1" = WinAVIVideoConverter
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WinZip Self-Extractor" = WinZip Self-Extractor
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"Y!mLite_is1" = Y!mLite 292
"Y!TunnelPro V1.3 Build 272" = Y!TunnelPro V1.3 Build 272
"Yahoo! Mail" = Yahoo! Internet Mail
"Yahoo! Mail AutoComplete" = Yahoo! Address AutoComplete
"Yahoo! Messenger" = Yahoo! Messenger
"Yazak Chat" = Yazak Chat 8.80.0
"Your Uninstaller! 2006_is1" = Your Uninstaller! 2006 Version 5
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-1809067083-3242847100-1996373590-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BeyondCompare3_is1" = Beyond Compare Version 3.0.15
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 3/4/2010 12:45:05 PM | Computer Name = MUSKRAT | Source = Google Update | ID = 20
Description =
Error - 3/4/2010 1:45:05 PM | Computer Name = MUSKRAT | Source = Google Update | ID = 20
Description =
Error - 3/4/2010 2:45:05 PM | Computer Name = MUSKRAT | Source = Google Update | ID = 20
Description =
Error - 3/4/2010 8:45:05 PM | Computer Name = MUSKRAT | Source = Google Update | ID = 20
Description =
Error - 3/5/2010 7:55:54 AM | Computer Name = MUSKRAT | Source = WmiAdapter | ID = 4099
Description = Open of service failed.
Error - 3/5/2010 1:45:05 PM | Computer Name = MUSKRAT | Source = Google Update | ID = 20
Description =
Error - 3/5/2010 2:45:05 PM | Computer Name = MUSKRAT | Source = Google Update | ID = 20
Description =
Error - 3/5/2010 8:45:05 PM | Computer Name = MUSKRAT | Source = Google Update | ID = 20
Description =
Error - 3/5/2010 9:45:05 PM | Computer Name = MUSKRAT | Source = Google Update | ID = 20
Description =
Error - 3/5/2010 10:45:05 PM | Computer Name = MUSKRAT | Source = Google Update | ID = 20
Description =
[ System Events ]
Error - 3/5/2010 7:51:09 AM | Computer Name = MUSKRAT | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Roxio Hard Drive Watcher
9 service to connect.
Error - 3/5/2010 7:53:43 AM | Computer Name = MUSKRAT | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the N360 service.
Error - 3/5/2010 7:55:54 AM | Computer Name = MUSKRAT | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the WMI Performance Adapter
service to connect.
Error - 3/5/2010 7:55:54 AM | Computer Name = MUSKRAT | Source = Service Control Manager | ID = 7000
Description = The WMI Performance Adapter service failed to start due to the following
error: %%1053
Error - 3/6/2010 8:22:35 AM | Computer Name = MUSKRAT | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.101 for the Network Card with network
address 001A4D64E2D1 has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).
Error - 3/6/2010 8:24:10 AM | Computer Name = MUSKRAT | Source = Service Control Manager | ID = 7000
Description = The Nero BackItUp Scheduler 4.0 service failed to start due to the
following error: %%2
Error - 3/6/2010 8:24:10 AM | Computer Name = MUSKRAT | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Roxio Hard Drive Watcher
9 service to connect.
Error - 3/6/2010 8:33:01 AM | Computer Name = MUSKRAT | Source = Service Control Manager | ID = 7000
Description = The Nero BackItUp Scheduler 4.0 service failed to start due to the
following error: %%2
Error - 3/6/2010 8:33:01 AM | Computer Name = MUSKRAT | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Roxio Hard Drive Watcher
9 service to connect.
Error - 3/6/2010 8:37:45 AM | Computer Name = MUSKRAT | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the N360 service.
< End of report >
Here's the VirusTotal and OTL reports:
Virus Total:
Did not find this file at all: c:\documents and settings\michael\desktop\AdobeFlashPlayerExt.exe
Maybe it got removed?
File xx2gr.dll received on 2010.03.05 03:16:33 (UTC)
Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED
Result: 0/42 (0%)
Loading server information…
Your file is queued in position: 2.
Estimated start time is between 49 and 70 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.
You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:
Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.03.04 -
AhnLab-V3 5.0.0.2 2010.03.04 -
AntiVir 8.2.1.180 2010.03.04 -
Antiy-AVL 2.0.3.7 2010.03.04 -
Authentium 5.2.0.5 2010.03.05 -
Avast 4.8.1351.0 2010.03.04 -
Avast5 5.0.332.0 2010.03.04 -
AVG 9.0.0.730 2010.03.04 -
BitDefender 7.2 2010.03.05 -
CAT-QuickHeal 10.00 2010.03.04 -
ClamAV 0.96.0.0-git 2010.03.05 -
Comodo 4091 2010.02.28 -
DrWeb 5.0.1.12222 2010.03.05 -
eSafe 7.0.17.0 2010.03.04 -
eTrust-Vet 35.2.7340 2010.03.04 -
F-Prot 4.5.1.85 2010.03.04 -
F-Secure 9.0.15370.0 2010.03.05 -
Fortinet 4.0.14.0 2010.03.04 -
GData 19 2010.03.05 -
Ikarus T3.1.1.80.0 2010.03.04 -
Jiangmin 13.0.900 2010.03.04 -
K7AntiVirus 7.10.990 2010.03.04 -
Kaspersky 7.0.0.125 2010.03.05 -
McAfee 5910 2010.03.04 -
McAfee+Artemis 5910 2010.03.04 -
McAfee-GW-Edition 6.8.5 2010.03.04 -
Microsoft 1.5502 2010.03.04 -
NOD32 4916 2010.03.04 -
Norman 6.04.08 2010.03.04 -
nProtect 2009.1.8.0 2010.03.04 -
Panda 10.0.2.2 2010.03.04 -
PCTools 7.0.3.5 2010.03.04 -
Prevx 3.0 2010.03.05 -
Rising 22.37.04.01 2010.03.05 -
Sophos 4.51.0 2010.03.05 -
Sunbelt 5755 2010.03.05 -
Symantec 20091.2.0.41 2010.03.05 -
TheHacker [removed].221 2010.03.05 -
TrendMicro 9.120.0.1004 2010.03.04 -
VBA32 3.12.12.2 2010.03.04 -
ViRobot 2010.3.4.2212 2010.03.04 -
VirusBuster 5.0.27.0 2010.03.04 -
Additional information
File size: 193024 bytes
MD5…: 01a7e9da047717893e3b2abd3f34b020
SHA1..: 8bc3c5ec75cace1237e7f99b1354ff2863edb7dc
SHA256: 152d3f9371bca77e5ee3a4e1fd204147841a7a7e32b9640ff468b030e8b1e99c
ssdeep: 3072:KC8Kx2omhW+nutuPX8g70RDpsyl0ZPsAurT+hEQeFvDwF1hM99Qv/G+gXWr
Ech:Dx2NhnsuXIdeylXAutP7s1bv/GlbA
PEiD..: -
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x6d10
timedatestamp…..: 0x39343864 (Tue May 30 21:53:40 2000)
machinetype…….: 0x14c (I386)
( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1d566 0x1d600 6.60 3cd4fb4d64a17288449412c0b78e3955
.rdata 0x1f000 0x5892 0x5a00 4.30 15e21885b66115ee4fb008211d12650a
.data 0x25000 0x7b00 0x4600 2.84 e243cb0c47ae23210fedf2791c4ba3e4
.idata 0x2d000 0x1bc2 0x1c00 5.55 92eb4fda3dab9e50b3cace44b3cb61ec
.rsrc 0x2f000 0x1080 0x1200 4.13 ce3996f4b345d7ca200e08d0be50389f
.reloc 0x31000 0x4812 0x4a00 4.29 0c51c01216230902c1bb3ed4d5b1aeda
( 0 imports )
( 4 exports )
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer
RDS…: NSRL Reference Data Set
-
sigcheck:
publisher….: Headlight Software, Inc.
copyright….: Copyright © 2000 Headlight Software, Inc.
product……: GetRight
description..: IE/Shell Interface for GetRight. www.getright.com
original name: XX2GR.DLL
internal name: XX2GR
file version.: 4.2.0
comments…..: DLL to send info to GetRight. www.getright.com
signers……: -
signing date.: -
verified…..: Unsigned
trid..: DirectShow filter (37.8%)
Win32 Executable MS Visual C++ 4.x (25.2%)
Windows OCX File (23.1%)
Win32 Executable MS Visual C++ (generic) (7.0%)
Windows Screen Saver (2.4%)
pdfid.: -
File unknown_mini_F21A2B85742A4A7BA95E received on 2010.03.05 03:23:01 (UTC)
Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED
Result: 0/42 (0%)
Loading server information…
Your file is queued in position: 1.
Estimated start time is between 42 and 60 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.
You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:
Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.03.04 -
AhnLab-V3 5.0.0.2 2010.03.04 -
AntiVir 8.2.1.180 2010.03.04 -
Antiy-AVL 2.0.3.7 2010.03.04 -
Authentium 5.2.0.5 2010.03.05 -
Avast 4.8.1351.0 2010.03.04 -
Avast5 5.0.332.0 2010.03.04 -
AVG 9.0.0.730 2010.03.04 -
BitDefender 7.2 2010.03.05 -
CAT-QuickHeal 10.00 2010.03.04 -
ClamAV 0.96.0.0-git 2010.03.05 -
Comodo 4091 2010.02.28 -
DrWeb 5.0.1.12222 2010.03.05 -
eSafe 7.0.17.0 2010.03.04 -
eTrust-Vet 35.2.7340 2010.03.04 -
F-Prot 4.5.1.85 2010.03.04 -
F-Secure 9.0.15370.0 2010.03.05 -
Fortinet 4.0.14.0 2010.03.04 -
GData 19 2010.03.05 -
Ikarus T3.1.1.80.0 2010.03.04 -
Jiangmin 13.0.900 2010.03.04 -
K7AntiVirus 7.10.990 2010.03.04 -
Kaspersky 7.0.0.125 2010.03.05 -
McAfee 5910 2010.03.04 -
McAfee+Artemis 5910 2010.03.04 -
McAfee-GW-Edition 6.8.5 2010.03.04 -
Microsoft 1.5502 2010.03.04 -
NOD32 4916 2010.03.04 -
Norman 6.04.08 2010.03.04 -
nProtect 2009.1.8.0 2010.03.04 -
Panda 10.0.2.2 2010.03.04 -
PCTools 7.0.3.5 2010.03.04 -
Prevx 3.0 2010.03.05 -
Rising 22.37.04.01 2010.03.05 -
Sophos 4.51.0 2010.03.05 -
Sunbelt 5755 2010.03.05 -
Symantec 20091.2.0.41 2010.03.05 -
TheHacker [removed].221 2010.03.05 -
TrendMicro 9.120.0.1004 2010.03.04 -
VBA32 3.12.12.2 2010.03.04 -
ViRobot 2010.3.4.2212 2010.03.04 -
VirusBuster 5.0.27.0 2010.03.04 -
Additional information
File size: 40001 bytes
MD5…: 67557356ba224dac3619b7aa25c37d6b
SHA1..: db9af12c8e229a8d904d4ef318d18b4b83a40199
SHA256: a8996f39f7f79ff0d1a7071eac3ba436b71ce91e906dcea4b535fdb5101efd45
ssdeep: 768:n7NKF13C9YJqhphRBgft9wyBjncAV4AmU5nlfQnP/wD4pkAC9iXG:n7NCChX
RwkhAVVv5lfkwU4i2
PEiD..: -
PEInfo: -
RDS…: NSRL Reference Data Set
-
pdfid.: -
trid..: 7-Zip compressed archive (100.0%)
sigcheck:
publisher….: n/a
copyright….: n/a
product……: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments…..: n/a
signers……: -
signing date.: -
verified…..: Unsigned
packers (F-Prot): 7Z, Unicode
OTL:
OTL logfile created on: 3/6/2010 9:10:58 AM - Run 1
OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\Jennifer\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 42.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.48 Gb Total Space | 2.05 Gb Free Space | 2.75% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: MUSKRAT
Current User Name: Jennifer
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
========== Processes (SafeList) ==========
PRC - [2010/03/06 09:09:06 | 000,553,984 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Jennifer\Desktop\OTL.exe
PRC - [2010/02/20 10:41:48 | 000,117,640 | R— | M] (Symantec Corporation) – C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
PRC - [2010/02/19 20:25:42 | 000,908,248 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/11/19 22:29:16 | 000,623,960 | —- | M] (Research In Motion Limited) – C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
PRC - [2009/10/08 12:13:52 | 000,818,288 | —- | M] (The Weather Channel Interactive, Inc.) – C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe
PRC - [2009/08/12 16:11:02 | 008,318,056 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Thunderbird\thunderbird.exe
PRC - [2008/12/12 08:31:10 | 001,840,424 | —- | M] (Nero AG) – C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
PRC - [2008/12/02 15:29:52 | 002,221,352 | —- | M] (Nero AG) – C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
PRC - [2008/10/24 09:14:36 | 000,206,112 | —- | M] (Macrovision Corporation) – C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
PRC - [2008/10/24 09:14:34 | 001,000,736 | —- | M] (Macrovision Corporation) – C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
PRC - [2008/06/10 13:56:30 | 001,442,888 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft IntelliType Pro\itype.exe
PRC - [2008/05/03 12:31:46 | 000,071,096 | —- | M] () – C:\Program Files\BurnAware Free\nmsaccessu.exe
PRC - [2008/04/13 19:12:20 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2008/01/29 08:52:32 | 001,424,648 | —- | M] (Uniblue Software) – C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
PRC - [2007/12/30 05:23:34 | 001,365,504 | —- | M] () – C:\Program Files\Rainlendar2\Rainlendar2.exe
PRC - [2007/02/28 16:45:22 | 000,507,904 | —- | M] (Brother Industries, Ltd.) – C:\Program Files\Brother\ControlCenter3\BrccMCtl.exe
PRC - [2007/01/29 21:12:14 | 000,030,248 | —- | M] (Nuance Communications, Inc.) – C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
PRC - [2006/11/03 19:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Defender\MsMpEng.exe
PRC - [2006/04/21 13:26:38 | 005,358,592 | —- | M] (Linksys) – C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WUSB54GSC.exe
PRC - [2005/07/04 16:46:04 | 000,053,307 | —- | M] (GEMTEKS) – C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe
PRC - [2005/06/02 15:54:34 | 000,086,606 | —- | M] (Canon Inc.) – C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2005/01/26 11:47:42 | 000,065,604 | —- | M] (Boingo Wireless, Inc.) – C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
PRC - [2003/11/14 09:50:00 | 000,037,888 | —- | M] (Logitech Inc.) – C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE
PRC - [2003/04/07 01:42:52 | 000,217,190 | —- | M] (Adobe Systems Inc.) – C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
PRC - [2002/01/30 18:01:54 | 000,081,920 | —- | M] (Analog Devices, Inc.) – C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
PRC - [2002/01/24 16:10:40 | 000,126,976 | —- | M] (Iomega Corporation) – C:\Program Files\Iomega\AutoDisk\ADService.exe
PRC - [2002/01/14 07:49:38 | 000,073,728 | —- | M] (Iomega Corporation) – C:\Program Files\Iomega\System32\AppServices.exe
========== Modules (SafeList) ==========
MOD - [2010/03/06 09:09:06 | 000,553,984 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Jennifer\Desktop\OTL.exe
MOD - [2010/02/20 10:41:42 | 000,419,696 | R— | M] (Symantec Corporation) – C:\Program Files\Norton 360\Engine\3.8.0.41\asOEHook.dll
MOD - [2008/04/13 19:12:02 | 000,413,696 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msvcp60.dll
MOD - [2008/04/13 19:11:58 | 000,071,680 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msacm32.dll
MOD - [2008/04/13 19:11:48 | 001,852,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\AppPatch\acgenral.dll
MOD - [2003/11/14 09:50:00 | 000,024,064 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\Logitech\Scrolling\LGMSGHK.DLL
MOD - [2003/11/14 09:50:00 | 000,006,144 | —- | M] (Logitech Inc.) – C:\Program Files\Logitech\MouseWare\system\LgWndHk.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Auto | Running] – – (WUSB54GSCSVC)
SRV - File not found [Auto | Stopped] – – (Nero BackItUp Scheduler 4.0)
SRV - File not found [Disabled | Stopped] – – (Iomega Activity Disk2)
SRV - [2010/02/20 10:41:48 | 000,117,640 | R— | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe – (N360)
SRV - [2008/05/03 12:31:46 | 000,071,096 | —- | M] () [Auto | Running] – C:\Program Files\BurnAware Free\nmsaccessu.exe – (NMSAccessU)
SRV - [2008/01/29 16:09:02 | 000,394,704 | —- | M] (Symantec, Inc.) [On_Demand | Stopped] – C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe – (Symantec RemoteAssist)
SRV - [2007/11/30 12:27:22 | 000,558,592 | —- | M] (ReaSoft) [On_Demand | Stopped] – C:\Program Files\ReaConverter 5.5 Pro\rcp_scheduler.exe – (rcp_service)
SRV - [2006/11/03 19:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MsMpEng.exe – (WinDefend)
SRV - [2005/06/02 15:54:34 | 000,086,606 | —- | M] (Canon Inc.) [Auto | Running] – C:\Program Files\Canon\CAL\CALMAIN.exe – (CCALib8)
SRV - [2005/01/26 11:47:42 | 000,065,604 | —- | M] (Boingo Wireless, Inc.) [Auto | Running] – C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe – (EarthLinkMonitor)
SRV - [2002/08/16 13:51:00 | 000,204,876 | —- | M] (Network Associates, Inc.) [On_Demand | Stopped] – C:\WINDOWS\system\epoagent\naimas32.exe – (NAIMAGENT32)
SRV - [2002/01/24 16:10:40 | 000,126,976 | —- | M] (Iomega Corporation) [Auto | Running] – C:\Program Files\Iomega\AutoDisk\ADService.exe – (_IOMEGA_ACTIVE_DISK_SERVICE_)
SRV - [2002/01/14 07:49:38 | 000,073,728 | —- | M] (Iomega Corporation) [Auto | Running] – C:\Program Files\Iomega\System32\AppServices.exe – (Iomega App Services)
========== Driver Services (SafeList) ==========
DRV - [2010/02/21 06:53:40 | 000,102,448 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys – (EraserUtilRebootDrv)
DRV - [2010/02/20 10:41:54 | 000,124,976 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SYMEVENT.SYS – (SymEvent)
DRV - [2010/02/20 10:41:50 | 000,482,432 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\ccHPx86.sys – (ccHP)
DRV - [2010/02/20 10:41:50 | 000,310,320 | —- | M] (Symantec Corporation) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\N360\0308000.029\SYMEFA.SYS – (SymEFA)
DRV - [2010/02/20 10:41:50 | 000,308,272 | —- | M] (Symantec Corporation) [File_System | On_Demand | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SRTSP.SYS – (SRTSP)
DRV - [2010/02/20 10:41:50 | 000,259,632 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\BHDrvx86.sys – (BHDrvx86)
DRV - [2010/02/20 10:41:50 | 000,217,136 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMTDI.SYS – (SYMTDI)
DRV - [2010/02/20 10:41:50 | 000,089,904 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMFW.SYS – (SYMFW)
DRV - [2010/02/20 10:41:50 | 000,043,696 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\N360\0308000.029\SRTSPX.SYS – (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2010/02/20 10:41:50 | 000,036,400 | R— | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SymIM.sys – (SymIMMP)
DRV - [2010/02/20 10:41:50 | 000,036,400 | R— | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\SymIM.sys – (SymIM)
DRV - [2010/02/20 10:41:50 | 000,036,400 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMNDIS.SYS – (SYMNDIS)
DRV - [2010/02/20 10:41:50 | 000,033,072 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMIDS.SYS – (SYMIDS)
DRV - [2010/02/20 04:50:16 | 001,324,720 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100305.039\NAVEX15.SYS – (NAVEX15)
DRV - [2010/02/20 04:50:16 | 000,371,248 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys – (eeCtrl)
DRV - [2010/02/20 04:50:16 | 000,084,912 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100305.039\NAVENG.SYS – (NAVENG)
DRV - [2009/10/28 16:37:24 | 000,329,592 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\IDSXpx86.sys – (IDSxpx86)
DRV - [2009/03/05 15:21:38 | 000,027,136 | —- | M] (NCH Swift Sound) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nchssvad.sys – (NCHSSVAD)
DRV - [2009/02/18 14:44:00 | 006,308,224 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nv4_mini.sys – (nv)
DRV - [2008/04/13 13:45:30 | 000,010,624 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\gameenum.sys – (gameenum)
DRV - [2008/04/13 11:36:06 | 000,144,384 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Hdaudbus.sys – (HDAudBus)
DRV - [2007/01/26 21:09:40 | 000,068,954 | —- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\jl2005c.sys – (JL2005C)
DRV - [2006/12/12 07:43:18 | 000,052,224 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrSerIf.sys – (BrSerIf)
DRV - [2006/09/18 11:54:48 | 000,016,640 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tbhsd.sys – (tbhsd)
DRV - [2006/09/03 09:53:54 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrUsbSer.sys – (BrUsbSer)
DRV - [2006/07/11 08:38:30 | 000,020,480 | R— | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nvnetbus.sys – (nvnetbus)
DRV - [2006/07/11 08:38:28 | 000,057,856 | R— | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\NVENETFD.sys – (NVENETFD)
DRV - [2006/06/28 17:38:56 | 000,105,088 | —- | M] (NVIDIA Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\nvata.sys – (nvata)
DRV - [2006/06/18 23:37:34 | 000,036,864 | —- | M] (Advanced Micro Devices) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\AmdK8.sys – (AmdK8)
DRV - [2006/01/18 18:41:58 | 000,080,512 | —- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Rtnicxp.sys – (RTL8023xp)
DRV - [2005/09/23 18:56:28 | 003,966,976 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RtkHDAud.sys – (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2004/11/01 14:16:34 | 000,017,536 | R— | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BW2NDIS5.SYS – (BW2NDIS5)
DRV - [2004/10/15 12:50:20 | 000,015,295 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrScnUsb.sys – (BrScnUsb)
DRV - [2004/08/04 00:31:32 | 000,020,992 | —- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\rtl8139.sys – (rtl8139)
DRV - [2004/05/31 21:19:42 | 000,024,971 | R— | M] (Integrated Technology Express, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\iteraid.sys – (iteraid)
DRV - [2003/11/07 03:50:00 | 000,070,798 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LMouFlt2.Sys – (LMouFlt2)
DRV - [2003/11/07 03:50:00 | 000,051,486 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\L8042pr2.Sys – (L8042pr2)
DRV - [2003/10/07 10:42:40 | 000,067,200 | —- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Rtlnic51.sys – (RTL8023)
DRV - [2003/08/26 16:25:14 | 000,207,616 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSFHWBS2.sys – (HSFHWBS2)
DRV - [2003/08/26 16:24:06 | 000,675,840 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_CNXT.sys – (winachsf)
DRV - [2003/08/26 16:22:34 | 001,041,152 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_DP.sys – (HSF_DP)
DRV - [2002/04/15 14:31:50 | 000,107,776 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ac97ich4.sys – (ac97intc) Intel® 82801DB/DBM Audio Driver Service (WDM)
DRV - [2002/01/14 07:49:38 | 000,033,602 | —- | M] (Iomega Corporation) [Kernel | Boot | Running] – C:\WINDOWS\System32\DRIVERS\iomdisk.sys – (iomdisk)
DRV - [2001/08/17 13:28:12 | 000,488,383 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_v124.sys – (V124)
DRV - [2001/08/17 13:28:12 | 000,050,751 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_tone.sys – (Tones)
DRV - [2001/08/17 13:28:10 | 000,542,879 | —- | M] (Conexant) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\hsf_msft.sys – (hsf_msft)
DRV - [2001/08/17 13:28:10 | 000,057,471 | —- | M] (Conexant) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\hsf_samp.sys – (Rksample)
DRV - [2001/08/17 13:28:08 | 000,391,199 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_k56k.sys – (K56)
DRV - [2001/08/17 13:28:06 | 000,289,887 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_fall.sys – (Fallback)
DRV - [2001/08/17 13:28:06 | 000,199,711 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_faxx.sys – (SoftFax)
DRV - [2001/08/17 13:28:06 | 000,115,807 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_fsks.sys – (Fsks)
DRV - [2001/08/17 13:28:04 | 000,067,167 | —- | M] (Conexant) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\hsf_bsc2.sys – (basic2)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://start.earthlink.net/
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie…ton/search.html
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net/
IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://start.earthlink.net/
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie…ton/search.html
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net/
IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie…ton/search.html
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie…ton/search.html
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net/
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\..\URLSearchHook: {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll (EarthLink, Inc.)
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\..\URLSearchHook: ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\S-1-5-21-1809067083-3242847100-1996373590-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\S-1-5-21-1809067083-3242847100-1996373590-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007\S-1-5-21-1809067083-3242847100-1996373590-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKLM\software\mozilla\Firefox\Extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2010/03/06 06:32:28 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.1\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2004/08/02 07:05:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.1\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2002/09/16 20:25:56 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.6\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2004/08/02 07:05:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.6\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2002/09/16 20:25:56 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.7.1\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2004/08/02 07:05:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.7.1\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2002/09/16 20:25:56 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2006/03/19 08:10:04 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2006/03/19 08:10:02 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2009/10/27 21:24:16 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
[2008/08/31 22:31:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Mozilla\Extensions
[2008/09/24 16:14:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Mozilla\eclipse1\extensions
[2004/07/17 16:31:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Mozilla\Firefox\Profiles\default.bc7\extensions
[2009/07/01 19:42:24 | 000,000,000 | —D | M] (Flashblock) – C:\Documents and Settings\Jennifer\Application Data\Mozilla\Firefox\Profiles\default.bc7\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2006/03/19 08:10:06 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
O1 HOSTS File: ([2009/08/13 04:49:54 | 000,000,021 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.8.0.41\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (no name) - {B7FF285A-95E0-4C5A-AA93-C4C701533649} - No CLSID value found.
O2 - BHO: (no name) - {C9932651-3EB0-4B27-B701-714A6CE4495F} - No CLSID value found.
O2 - BHO: (no name) - {DE95B055-D183-49F7-873D-AEAB755869CA} - No CLSID value found.
O2 - BHO: (no name) - {F835EF2C-3621-41F6-8275-EFD2A4B2B6A2} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\..\Toolbar\WebBrowser: (no name) - {C7768536-96F8-4001-B1A2-90EE21279187} - No CLSID value found.
O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\..\Toolbar\WebBrowser: (no name) - {4064EA35-578D-4073-A834-C96D82CBCF40} - No CLSID value found.
O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [LexPPS.exe] C:\WINDOWS\System32\lexpps.exe File not found
O4 - HKLM..\Run: [Logitech Utility] C:\WINDOWS\Logi_MwX.Exe (Logitech Inc.)
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe (Analog Devices, Inc.)
O4 - HKU\.DEFAULT..\Run: [DWQueuedReporting] C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKU\S-1-5-18..\Run: [DWQueuedReporting] C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005..\Run: [ISUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005..\Run: [Uniblue SpyEraser] C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe (Uniblue Software)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006..\Run: [DW6] C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe (The Weather Channel Interactive, Inc.)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006..\Run: [ISUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe ()
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006..\Run: [scheduler_monitor] C:\Program Files\ReaConverter 5.5 Pro\init_scheduler.exe ()
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006..\Run: [srvsh] C:\WINDOWS\System32\wtcratmp.exe File not found
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006..\Run: [Uniblue SpyEraser] C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe (Uniblue Software)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe File not found
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007..\Run: [ISUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007..\Run: [Uniblue SpyEraser] C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe (Uniblue Software)
O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Event Reminder.lnk = C:\Program Files\Broderbund\Broderbund Homework Helpers\pmremind.exe (Broderbund Properties LLC)
O4 - Startup: C:\Documents and Settings\Antonia\Start Menu\Programs\Startup\Registration Dogz.LNK.disabled ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: TUxpvnTwnl = C:\Documents and Settings\Michael\Desktop\AdobeFlashPlayerExt.exe File not found
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 144
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005_Classes\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 144
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: SpecifyDefaultButtons = 0
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Btn_Search = 0
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006_Classes\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 144
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007_Classes\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\New Folder\aim.exe File not found
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} http://www.creative.com/su/ocx/15030/CTSUEng.cab (Creative Software AutoUpdate)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://pcpitstop.com/pcpitstop/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} http://mpijdecd01/wfica.cab (WficaCtl Object)
O16 - DPF: {50F65670-1729-11D2-A51F-0020AFE5D502} http://objects.compuserve.com/chat/RTCChat.cab (ForumChat)
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} http://office.microsoft.com/productupdates/content/opuc.cab (OPUCatalog Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://v5.windowsupdate.microsoft.com/v5co…b?1099769654536 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1124156383368 (MUWebControl Class)
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} http://www.nick.com/common/groove/gx/GrooveAX27.cab (Groove Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} http://mpijdecd01/oncall/msrdp.cab (Microsoft RDP Client Control (redist))
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab (YAddBook Class)
O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} http://hgtv1.view22.com/view22/app/view22rte.cab (View22RTE Class)
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} https://disney.go.com/games/downloads/gamem…GameManager.cab (CGameManagerCtrl Object)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D5EBF06F-9BAF-11D0-B12D-00C04FC39CEA} http://info.manpower.com/activex/pcanywhere/pawrem.cab (pcANYWHERE Remote)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://www.creative.com/su/ocx/15030/CTPID.cab (Creative Software AutoUpdate Support Package)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Jennifer\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - C:\eudora\EuShlExt.dll (Qualcomm Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/11/09 14:21:44 | 000,000,035 | —- | M] () - C:\AUTOEXEC.BAT – [ FAT32 ]
O33 - MountPoints2\{dc55bce0-5468-11db-83bf-0001800f37f9}\Shell\AutoRun\command - "" = F:\setupSNK.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*
NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2002/09/07 09:30:06 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: Ip6FwHlp - File not found
MsConfig - Services: "iPodService"
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 0
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: SymEFA.sys - C:\WINDOWS\system32\drivers\N360\0308000.029\SYMEFA.SYS (Symantec Corporation)
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: SymEFA.sys - C:\WINDOWS\system32\drivers\N360\0308000.029\SYMEFA.SYS (Symantec Corporation)
SafeBootNet: SYMTDI - C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMTDI.SYS (Symantec Corporation)
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: UploadMgr - Service
SafeBootNet: vga.sys - Driver
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SafeBootNet: {1a3e09be-1e45-494b-9174-d7385b45bbf5} - Reg Error: Value error.
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
ActiveX: {02f78298-8af6-495c-9ecb-b6ae68678186} - KB867282
ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {057997dd-71e4-43cc-b161-3f8180691a9e} - Q824145
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {0fde1f56-0d59-4fd7-9624-e3df6b419d0f} - IEEX
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 9.0
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0.3
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0.3
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2cc9d512-6db6-4f1c-8979-9a41fae88de0} - Q837009
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {377483c2-e4b4-4ee8-b577-9aed264c8735} - Q822925
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {429D8DD3-05E0-4F56-B6D6-AC0730567C02} - Euro Update Tool
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA851-CC51-11CF-AAFA-00AA00B6015C} - rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\wpie4x86.inf,PerUserStub
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5f3c70b3-ac2f-432c-8f9c-1624df61f54f} - Microsoft Data Access Components KB870669
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {795d0712-722c-43ec-906a-fc5e678eada9} - Q831167
ActiveX: {82ced0ff-a00d-4405-ba5f-ef4699159333} - KB896727
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {96543d59-497a-4801-a1f3-5936aacaf7b1} - Q828750
ActiveX: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - Reg Error: Value error.
ActiveX: {AA218328-0EA8-4D70-8972-E987A9190FF4} - Reg Error: Value error.
ActiveX: {abcdf74f-9a64-4e6e-b8eb-6e5a41de6550} -
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {B9191F79-5613-4C76-AA2A-398534BB8999} - Reg Error: Value error.
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CD26921B-9DC3-4D0B-89FF-2BA6068BB1B1} - DirectAnimation
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {eddbec60-89cb-44ef-8291-0850fd28ff6a} - Q832894
ActiveX: {F5776D81-AE53-4935-8E84-B0B283D8BCEF} - Q330994
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.voxacm160 - C:\WINDOWS\System32\vct3216.acm (Voxware, Inc.)
Drivers32: MSVideo - C:\WINDOWS\System32\CSvidcap.dll (TechSmith Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.JDCT - C:\WINDOWS\System32\jl_jdct.drv (JEILIN Tech.)
Drivers32: vidc.tscc - C:\WINDOWS\System32\tsccvid.dll (TechSmith Corporation)
Drivers32: VIDC.WMV3 - C:\WINDOWS\System32\wmv9vcm.dll (Microsoft Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (58268713203269632)
========== Files/Folders - Created Within 30 Days ==========
[2010/03/06 09:09:10 | 000,553,984 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Jennifer\Desktop\OTL.exe
[2010/03/06 06:22:16 | 000,000,000 | -HSD | C] – C:\FOUND.017
[2010/03/05 05:48:30 | 000,000,000 | -HSD | C] – C:\FOUND.016
[2010/03/01 05:03:02 | 000,000,000 | -HSD | C] – C:\FOUND.015
[2010/02/28 09:27:46 | 000,000,000 | -HSD | C] – C:\FOUND.014
[2010/02/27 11:30:10 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Silverlight
[2010/02/27 11:29:56 | 004,938,120 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Jennifer\Desktop\Silverlight.exe
[2010/02/27 05:57:12 | 000,000,000 | -HSD | C] – C:\FOUND.013
[2010/02/26 05:44:02 | 000,000,000 | -HSD | C] – C:\FOUND.012
[2010/02/25 05:42:52 | 000,000,000 | -HSD | C] – C:\FOUND.011
[2010/02/24 05:38:38 | 000,000,000 | -HSD | C] – C:\FOUND.010
[2010/02/23 22:04:06 | 000,000,000 | -HSD | C] – C:\FOUND.009
[2010/02/23 18:41:52 | 000,472,064 | —- | C] ( ) – C:\Documents and Settings\Jennifer\Desktop\RootRepeal.exe
[2010/02/22 09:19:22 | 000,000,000 | —D | C] – C:\WINDOWS\System32\N360_BACKUP
[2010/02/21 11:20:59 | 000,000,000 | —D | C] – C:\Documents and Settings\Jennifer\Application Data\Malwarebytes
[2010/02/21 07:01:04 | 000,000,000 | -HSD | C] – C:\FOUND.008
[2010/02/20 13:43:49 | 000,310,320 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.sys
[2010/02/20 13:43:49 | 000,217,136 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symtdi.sys
[2010/02/20 13:43:49 | 000,089,904 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symfw.sys
[2010/02/20 13:43:49 | 000,048,688 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symndisv.sys
[2010/02/20 13:43:49 | 000,036,400 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symndis.sys
[2010/02/20 13:43:49 | 000,033,072 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symids.sys
[2010/02/20 13:43:48 | 000,482,432 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\cchpx86.sys
[2010/02/20 13:43:48 | 000,308,272 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.sys
[2010/02/20 13:43:48 | 000,043,696 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.sys
[2010/02/20 13:43:47 | 000,259,632 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.sys
[2010/02/20 13:42:51 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\N360\0308000.029
[2010/02/20 10:41:58 | 000,036,400 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SymIM.sys
[2010/02/20 10:41:53 | 000,124,976 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/02/20 10:41:53 | 000,060,808 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2010/02/20 10:41:52 | 000,000,000 | —D | C] – C:\Program Files\Symantec
[2010/02/20 10:41:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\N360
[2010/02/20 10:41:27 | 000,000,000 | —D | C] – C:\Program Files\Norton 360
[2010/02/20 10:40:48 | 000,000,000 | —D | C] – C:\Program Files\NortonInstaller
[2010/02/19 19:42:21 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/02/19 19:42:19 | 000,019,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/02/19 19:42:19 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/02/19 19:42:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/02/19 19:24:25 | 000,000,000 | —D | C] – C:\Program Files\a-squared HiJackFree
[2010/02/18 04:01:00 | 000,000,000 | -HSD | C] – C:\FOUND.007
[2010/02/12 06:41:12 | 000,000,000 | -HSD | C] – C:\FOUND.006
[2010/02/11 18:28:27 | 000,000,000 | —D | C] – C:\Documents and Settings\Jennifer\Application Data\Tific
[2010/02/11 18:28:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Jennifer\Local Settings\Application Data\Symantec
[2010/02/09 05:55:00 | 000,000,000 | -HSD | C] – C:\FOUND.005
[2009/08/18 10:31:02 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2009/08/18 10:19:18 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2009/05/04 15:00:28 | 001,687,552 | —- | C] (Individual Software Incorporated) – C:\Program Files\TNGENG.EXE
[2007/12/15 02:20:52 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth
[2007/09/12 15:08:04 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2003/12/29 23:53:59 | 000,192,512 | —- | C] (America Online, Inc.) – C:\Program Files\wndutils.dll
[2003/12/29 23:53:59 | 000,126,976 | —- | C] (America Online, Inc.) – C:\Program Files\xprt.dll
[2003/12/29 23:53:59 | 000,094,208 | —- | C] (America Online, Inc.) – C:\Program Files\ticker.ocm
[2003/12/29 23:53:59 | 000,033,792 | —- | C] (America Online, Inc.) – C:\Program Files\startup.ocm
[2003/12/29 23:53:59 | 000,012,288 | —- | C] (America Online, Inc.) – C:\Program Files\xpcs.dll
[2003/12/29 23:53:59 | 000,008,192 | —- | C] (America Online, Inc.) – C:\Program Files\xptl.dll
[2003/12/29 23:53:58 | 000,339,968 | —- | C] (Netscape Communications Corporation) – C:\Program Files\softokn3.dll
[2003/12/29 23:53:58 | 000,327,680 | —- | C] (Netscape Communications Corporation) – C:\Program Files\nss3.dll
[2003/12/29 23:53:58 | 000,163,840 | —- | C] (America Online, Inc.) – C:\Program Files\oscore.dll
[2003/12/29 23:53:58 | 000,151,552 | —- | C] (America Online, Inc.) – C:\Program Files\oscarui.dll
[2003/12/29 23:53:58 | 000,147,456 | —- | C] (Netscape Communications Corporation) – C:\Program Files\nspr4.dll
[2003/12/29 23:53:58 | 000,110,592 | —- | C] (Netscape Communications Corporation) – C:\Program Files\ssl3.dll
[2003/12/29 23:53:58 | 000,102,400 | —- | C] (Netscape Communications Corporation) – C:\Program Files\smime3.dll
[2003/12/29 23:53:58 | 000,073,728 | —- | C] (America Online, Inc.) – C:\Program Files\OscSrch.ocm
[2003/12/29 23:53:58 | 000,061,440 | —- | C] (America Online, Inc.) – C:\Program Files\osclogin.ocm
[2003/12/29 23:53:58 | 000,056,320 | —- | C] (America Online, Inc.) – C:\Program Files\OscMail.ocm
[2003/12/29 23:53:58 | 000,034,304 | —- | C] (America Online, Inc.) – C:\Program Files\rvapps.ocm
[2003/12/29 23:53:58 | 000,032,768 | —- | C] (America Online, Inc.) – C:\Program Files\proto.ocm
[2003/12/29 23:53:58 | 000,028,672 | —- | C] (Netscape Communications Corporation) – C:\Program Files\plc4.dll
[2003/12/29 23:53:58 | 000,024,576 | —- | C] (Netscape Communications Corporation) – C:\Program Files\plds4.dll
[2003/12/29 23:53:58 | 000,011,776 | —- | C] (America Online, Inc.) – C:\Program Files\osconfig.ocm
[2003/12/29 23:53:58 | 000,011,776 | —- | C] (America Online, Inc.) – C:\Program Files\NTP.ocm
[2003/12/29 23:53:58 | 000,008,192 | —- | C] (America Online, Inc.) – C:\Program Files\popup.ocm
[2003/12/29 23:53:58 | 000,007,168 | —- | C] (America Online, Inc.) – C:\Program Files\oscmain.ocm
[2003/12/29 23:53:57 | 000,184,320 | —- | C] (America Online, Inc.) – C:\Program Files\icbmui.ocm
[2003/12/29 23:53:57 | 000,139,264 | —- | C] (Inner Media, Inc.) – C:\Program Files\dunzip32.dll
[2003/12/29 23:53:57 | 000,102,400 | —- | C] (America Online, Inc.) – C:\Program Files\miscui.ocm
[2003/12/29 23:53:57 | 000,070,656 | —- | C] (America Online) – C:\Program Files\jgtkaol.dll
[2003/12/29 23:53:57 | 000,069,632 | —- | C] (America Online) – C:\Program Files\jgataol.dll
[2003/12/29 23:53:57 | 000,061,440 | —- | C] (America Online, Inc.) – C:\Program Files\coolsocket.dll
[2003/12/29 23:53:57 | 000,061,440 | —- | C] (America Online) – C:\Program Files\jgedaol.dll
[2003/12/29 23:53:57 | 000,057,344 | —- | C] (America Online, Inc.) – C:\Program Files\locateui.ocm
[2003/12/29 23:53:57 | 000,057,344 | —- | C] (America Online, Inc.) – C:\Program Files\coolsecnss.dll
[2003/12/29 23:53:57 | 000,050,176 | —- | C] (Blue Sky Software Corporation) – C:\Program Files\csh.dll
[2003/12/29 23:53:57 | 000,045,056 | —- | C] (America Online) – C:\Program Files\jgseaol.dll
[2003/12/29 23:53:57 | 000,045,056 | —- | C] (America Online) – C:\Program Files\jga0aol.dll
[2003/12/29 23:53:57 | 000,040,960 | —- | C] (America Online) – C:\Program Files\jgs2aol.dll
[2003/12/29 23:53:57 | 000,036,864 | —- | C] (America Online) – C:\Program Files\jga1aol.dll
[2003/12/29 23:53:57 | 000,032,768 | —- | C] (America Online) – C:\Program Files\jgs3aol.dll
[2003/12/29 23:53:57 | 000,006,144 | —- | C] (America Online, Inc.) – C:\Program Files\idlemon.dll
[2003/12/29 23:53:57 | 000,003,584 | —- | C] (America Online, Inc.) – C:\Program Files\coolsos.dll
[2003/12/29 23:53:56 | 001,335,296 | —- | C] (America Online, Inc.) – C:\Program Files\AimRes.dll
[2003/12/29 23:53:56 | 000,196,608 | —- | C] (America Online, Inc.) – C:\Program Files\AimSecondarySvcs.dll
[2003/12/29 23:53:56 | 000,184,320 | —- | C] (America Online, Inc.) – C:\Program Files\coolbos.dll
[2003/12/29 23:53:56 | 000,180,224 | —- | C] (America Online, Inc.) – C:\Program Files\ate32.dll
[2003/12/29 23:53:56 | 000,163,840 | —- | C] (America Online, Inc.) – C:\Program Files\buddyui.ocm
[2003/12/29 23:53:56 | 000,143,360 | —- | C] (America Online, Inc.) – C:\Program Files\AimCoreSvcs.dll
[2003/12/29 23:53:56 | 000,131,072 | —- | C] (America Online, Inc.) – C:\Program Files\ateima32.dll
[2003/12/29 23:53:56 | 000,098,304 | —- | C] (America Online, Inc.) – C:\Program Files\coolbucky.dll
[2003/12/29 23:53:56 | 000,090,112 | —- | C] (America Online, Inc.) – C:\Program Files\ChatUI.ocm
[2003/12/29 23:53:56 | 000,073,728 | —- | C] (America Online, Inc.) – C:\Program Files\coolpeer.dll
[2003/12/29 23:53:56 | 000,054,272 | —- | C] (America Online, Inc.) – C:\Program Files\aimapi.dll
[2003/12/29 23:53:56 | 000,045,056 | —- | C] (America Online, Inc.) – C:\Program Files\coolhttp.dll
[2003/12/29 23:53:56 | 000,041,984 | —- | C] (America Online, Inc.) – C:\Program Files\AlertUI.ocm
[2003/12/29 23:53:56 | 000,024,064 | —- | C] (America Online, Inc.) – C:\Program Files\browse.ocm
[2003/12/29 23:53:56 | 000,018,944 | —- | C] (America Online, Inc.) – C:\Program Files\aimtalk.dll
[2003/12/29 23:53:55 | 000,364,544 | —- | C] (Red Bend Ltd.) – C:\Program Files\dBenderC.dll
[2003/12/29 23:53:55 | 000,069,632 | —- | C] (America Online, Inc.) – C:\Program Files\Patcher.dll
[2003/12/29 23:53:55 | 000,061,440 | —- | C] (America Online, Inc.) – C:\Program Files\aim.exe
[2003/12/29 23:53:55 | 000,049,152 | —- | C] (America Online, Inc.) – C:\Program Files\ProgressDlg.dll
[2003/12/29 23:53:55 | 000,013,312 | —- | C] (America Online, Inc.) – C:\Program Files\Admin.ocm
[2003/12/29 23:53:55 | 000,010,752 | —- | C] (America Online, Inc.) – C:\Program Files\advert.ocm
[2002/09/15 14:57:12 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Help
[2002/09/15 14:57:12 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Help
[2002/09/07 10:23:08 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2002/09/07 10:23:08 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2002/09/07 09:33:56 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2002/09/07 09:33:56 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[42 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[138 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2010/03/06 09:09:06 | 000,553,984 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Jennifer\Desktop\OTL.exe
[2010/03/06 08:50:08 | 000,203,077 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2010/03/06 08:50:02 | 000,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/03/06 08:42:02 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/03/06 06:52:34 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/03/06 06:46:30 | 000,000,468 | —- | M] () – C:\WINDOWS\BRWMARK.INI
[2010/03/06 06:32:38 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/03/06 06:32:36 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/03/06 06:32:18 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/03/06 06:32:16 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/03/05 22:46:02 | 009,699,328 | -H– | M] () – C:\Documents and Settings\Jennifer\NTUSER.DAT
[2010/03/04 21:34:28 | 000,020,992 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\cookie newsletter.doc
[2010/03/03 19:38:50 | 000,001,535 | —- | M] () – C:\WINDOWS\UserData
[2010/03/02 02:00:02 | 000,000,498 | —- | M] () – C:\WINDOWS\tasks\Norton AntiVirus - Michael - Full System Scan.job
[2010/03/01 06:55:16 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\Jennifer\ntuser.ini
[2010/02/28 22:25:18 | 000,000,000 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\settings.dat
[2010/02/27 11:29:54 | 004,938,120 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Jennifer\Desktop\Silverlight.exe
[2010/02/27 07:56:06 | 000,001,530 | —- | M] () – C:\WINDOWS\win.ini
[2010/02/24 09:16:06 | 000,181,632 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MpSigStub.exe
[2010/02/23 18:43:42 | 000,000,000 | —- | M] () – C:\Documents and Settings\Jennifer\defogger_reenable
[2010/02/23 18:40:20 | 000,050,477 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\Defogger.exe
[2010/02/21 13:13:16 | 000,293,376 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\cnp3ufl4.exe
[2010/02/21 13:11:54 | 000,005,699 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\Attach.zip
[2010/02/21 12:42:06 | 000,524,288 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\dds.scr
[2010/02/21 12:00:44 | 000,001,917 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/02/21 11:52:08 | 000,001,804 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton 360.LNK
[2010/02/21 09:37:22 | 000,207,848 | —- | M] () – C:\Documents and Settings\Jennifer\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/02/21 07:04:54 | 000,040,001 | —- | M] () – C:\WINDOWS\System32\unknown_mini_F21A2B85742A4A7BA95E67A150BC8BE5.7z
[2010/02/21 07:04:38 | 000,842,210 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\Cat.DB
[2010/02/20 19:22:22 | 000,024,064 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\wimpy 2.doc
[2010/02/20 13:42:52 | 000,000,172 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\isolate.ini
[2010/02/20 10:41:54 | 000,124,976 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/02/20 10:41:54 | 000,060,808 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2010/02/20 10:41:54 | 000,007,456 | —- | M] () – C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/02/20 10:41:54 | 000,000,806 | —- | M] () – C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/02/20 10:41:50 | 000,482,432 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\cchpx86.sys
[2010/02/20 10:41:50 | 000,310,320 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.sys
[2010/02/20 10:41:50 | 000,308,272 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.sys
[2010/02/20 10:41:50 | 000,259,632 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.sys
[2010/02/20 10:41:50 | 000,217,136 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symtdi.sys
[2010/02/20 10:41:50 | 000,089,904 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symfw.sys
[2010/02/20 10:41:50 | 000,048,688 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symndisv.sys
[2010/02/20 10:41:50 | 000,043,696 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.sys
[2010/02/20 10:41:50 | 000,036,400 | R— | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SymIM.sys
[2010/02/20 10:41:50 | 000,036,400 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symndis.sys
[2010/02/20 10:41:50 | 000,033,072 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symids.sys
[2010/02/20 10:41:44 | 000,107,368 | R— | M] (GEAR Software Inc.) – C:\WINDOWS\System32\GEARAspi.dll
[2010/02/20 10:41:38 | 000,003,373 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.inf
[2010/02/20 10:41:38 | 000,001,752 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.inf
[2010/02/20 10:41:38 | 000,001,562 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNetV.inf
[2010/02/20 10:41:38 | 000,001,561 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.inf
[2010/02/20 10:41:38 | 000,001,388 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.inf
[2010/02/20 10:41:38 | 000,001,382 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.inf
[2010/02/20 10:41:38 | 000,000,640 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.inf
[2010/02/20 10:41:30 | 000,009,412 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\symnetv.cat
[2010/02/20 10:41:30 | 000,009,402 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.cat
[2010/02/20 10:41:30 | 000,007,431 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.cat
[2010/02/20 10:41:30 | 000,007,429 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.cat
[2010/02/20 10:41:30 | 000,007,425 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.cat
[2010/02/20 10:41:30 | 000,007,400 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.CAT
[2010/02/20 10:41:30 | 000,007,383 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.cat
[2010/02/19 19:42:24 | 000,000,600 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/19 19:24:28 | 000,000,614 | —- | M] () – C:\Documents and Settings\All Users\Desktop\a-squared HiJackFree.lnk
[2010/02/19 19:13:34 | 000,003,468 | —- | M] () – C:\WINDOWS\wininit.ini
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[42 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[138 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2010/03/04 21:34:25 | 000,020,992 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\cookie newsletter.doc
[2010/02/28 22:25:16 | 000,000,000 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\settings.dat
[2010/02/23 18:43:41 | 000,000,000 | —- | C] () – C:\Documents and Settings\Jennifer\defogger_reenable
[2010/02/23 18:40:25 | 000,050,477 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\Defogger.exe
[2010/02/21 13:13:25 | 000,293,376 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\cnp3ufl4.exe
[2010/02/21 13:11:53 | 000,005,699 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\Attach.zip
[2010/02/21 12:42:18 | 000,524,288 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\dds.scr
[2010/02/21 07:04:53 | 000,040,001 | —- | C] () – C:\WINDOWS\System32\unknown_mini_F21A2B85742A4A7BA95E67A150BC8BE5.7z
[2010/02/21 07:04:37 | 000,842,210 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\Cat.DB
[2010/02/20 19:22:21 | 000,024,064 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\wimpy 2.doc
[2010/02/20 13:43:49 | 000,009,412 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\symnetv.cat
[2010/02/20 13:43:49 | 000,009,402 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.cat
[2010/02/20 13:43:49 | 000,003,373 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.inf
[2010/02/20 13:43:49 | 000,001,562 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNetV.inf
[2010/02/20 13:43:49 | 000,001,561 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.inf
[2010/02/20 13:43:48 | 000,007,431 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.cat
[2010/02/20 13:43:48 | 000,007,429 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.cat
[2010/02/20 13:43:48 | 000,007,425 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.cat
[2010/02/20 13:43:48 | 000,007,383 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.cat
[2010/02/20 13:43:48 | 000,001,752 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.inf
[2010/02/20 13:43:48 | 000,001,388 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.inf
[2010/02/20 13:43:48 | 000,001,382 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.inf
[2010/02/20 13:43:47 | 000,007,400 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.CAT
[2010/02/20 13:43:47 | 000,000,640 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.inf
[2010/02/20 13:42:51 | 000,000,172 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\isolate.ini
[2010/02/20 10:41:53 | 000,007,456 | —- | C] () – C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/02/20 10:41:53 | 000,000,806 | —- | C] () – C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/02/20 10:41:50 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Norton 360.LNK
[2010/02/19 19:42:23 | 000,000,600 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/19 19:24:25 | 000,000,614 | —- | C] () – C:\Documents and Settings\All Users\Desktop\a-squared HiJackFree.lnk
[2009/05/04 15:00:28 | 000,131,574 | —- | C] () – C:\Program Files\REGISTER.EXE
[2009/05/04 15:00:28 | 000,013,414 | —- | C] () – C:\Program Files\INDEX.DAT
[2009/05/04 15:00:28 | 000,001,082 | —- | C] () – C:\Program Files\PALETTE.BMP
[2009/05/04 15:00:28 | 000,000,648 | —- | C] () – C:\Program Files\START.DAT
[2009/05/04 15:00:28 | 000,000,417 | —- | C] () – C:\Program Files\ITECH.CFG
[2009/05/04 15:00:27 | 000,000,080 | —- | C] () – C:\Program Files\SN.DAT
[2009/04/12 13:24:01 | 000,000,252 | —- | C] () – C:\Documents and Settings\Jennifer\Application Data\default.rss
[2009/04/01 20:54:54 | 000,000,029 | —- | C] () – C:\WINDOWS\Irremote.ini
[2008/04/23 17:21:48 | 000,000,000 | —- | C] () – C:\WINDOWS\game.INI
[2008/03/13 04:44:29 | 000,005,819 | -HS- | C] () – C:\WINDOWS\System32\cbeeg.ini
[2008/03/01 17:26:13 | 013,255,661 | —- | C] () – C:\Program Files\Luxor.zip
[2008/02/18 16:37:40 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\GTW32N50.dll
[2008/02/18 16:37:05 | 000,000,609 | —- | C] () – C:\WINDOWS\System32\WLAN.INI
[2008/02/10 13:13:44 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2008/02/07 23:46:20 | 000,005,837 | —- | C] () – C:\WINDOWS\YAHELITE_IGNORE.INI
[2008/02/04 18:23:10 | 000,693,792 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.DLL
[2007/10/28 12:14:11 | 000,000,026 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2007/10/28 12:14:10 | 000,000,468 | —- | C] () – C:\WINDOWS\BRWMARK.INI
[2007/10/28 12:10:08 | 000,000,846 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2007/10/28 12:10:08 | 000,000,093 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2007/10/28 12:08:35 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\BRTCPCON.DLL
[2007/10/28 12:08:35 | 000,000,114 | —- | C] () – C:\WINDOWS\System32\BRLMW03A.INI
[2007/10/28 12:08:31 | 000,000,086 | —- | C] () – C:\WINDOWS\Brfaxrx.ini
[2007/10/28 12:08:30 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\BrMuSNMP.dll
[2007/10/28 12:07:11 | 000,031,567 | —- | C] () – C:\WINDOWS\maxlink.ini
[2007/09/11 20:16:02 | 000,001,359 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/06/06 05:11:57 | 000,000,026 | —- | C] () – C:\WINDOWS\dvdSanta.INI
[2007/06/06 04:52:00 | 001,216,512 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2007/06/06 04:52:00 | 000,921,600 | —- | C] () – C:\WINDOWS\System32\vorbisenc.dll
[2007/06/06 04:52:00 | 000,237,568 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2007/06/06 04:52:00 | 000,237,568 | —- | C] () – C:\WINDOWS\System32\OggDS.dll
[2007/06/06 04:52:00 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\vorbis.dll
[2007/06/06 04:52:00 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\ogg.dll
[2007/03/30 13:31:20 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\dec_jl6.dll
[2006/08/16 02:35:00 | 001,724,416 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/08/16 02:35:00 | 001,507,328 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/08/16 02:35:00 | 001,101,824 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/08/16 02:35:00 | 000,581,632 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2006/08/16 02:35:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/08/16 02:35:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2006/08/06 12:16:49 | 000,000,034 | —- | C] () – C:\WINDOWS\AuthMgr.INI
[2006/02/16 16:50:29 | 000,002,913 | —- | C] () – C:\WINDOWS\YAHELITE.INI
[2006/01/07 10:43:52 | 000,000,177 | —- | C] () – C:\WINDOWS\kpcms.ini
[2006/01/07 10:43:44 | 000,210,944 | —- | C] () – C:\WINDOWS\System32\MSVCRT10.DLL
[2005/12/26 08:06:30 | 000,000,157 | —- | C] () – C:\WINDOWS\disney.ini
[2005/10/22 11:50:25 | 000,000,885 | —- | C] () – C:\Documents and Settings\Jennifer\Application Data\AdobeDLM.log
[2005/07/12 16:17:58 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2005/05/26 21:33:26 | 000,000,264 | —- | C] () – C:\WINDOWS\System32\winsusrm.dll
[2005/04/13 13:52:45 | 000,000,884 | —- | C] () – C:\WINDOWS\shlfolder.sys
[2005/03/11 11:22:34 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\DXFLib.dll
[2004/11/30 12:12:40 | 000,000,063 | —- | C] () – C:\WINDOWS\mdm.ini
[2004/11/08 07:31:27 | 000,003,468 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/07/14 15:59:42 | 000,006,852 | —- | C] () – C:\WINDOWS\System32\drivers\Vcs.sys
[2004/07/14 12:31:41 | 000,000,016 | —- | C] () – C:\WINDOWS\odbctrap.ini
[2004/07/14 12:11:26 | 000,000,016 | —- | C] () – C:\WINDOWS\backodbc.ini
[2004/05/30 11:02:29 | 000,000,464 | —- | C] () – C:\Program Files\convert.lnk
[2004/02/05 21:10:38 | 000,000,026 | —- | C] () – C:\WINDOWS\earthlink.INI
[2004/01/14 18:50:09 | 000,017,408 | —- | C] () – C:\Documents and Settings\Jennifer\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2003/12/29 23:54:15 | 000,060,879 | —- | C] () – C:\Program Files\INSTALL.LOG
[2003/12/29 23:54:14 | 000,000,515 | —- | C] () – C:\Program Files\Uninstall AOL Instant Messenger.lnk
[2003/12/29 23:53:59 | 000,164,864 | —- | C] () – C:\Program Files\unwise32.exe
[2003/12/29 23:53:59 | 000,116,852 | —- | C] () – C:\Program Files\uninstll.exe
[2003/12/29 23:53:59 | 000,102,400 | —- | C] () – C:\Program Files\xmlparse.dll
[2003/12/29 23:53:59 | 000,005,632 | —- | C] () – C:\Program Files\stats.ocm
[2003/12/29 23:53:59 | 000,001,732 | —- | C] () – C:\Program Files\unwise32.ini
[2003/12/29 23:53:59 | 000,001,370 | —- | C] () – C:\Program Files\stockalert.gif
[2003/12/29 23:53:58 | 000,002,622 | —- | C] () – C:\Program Files\netwait.odl
[2003/12/29 23:53:58 | 000,002,048 | —- | C] () – C:\Program Files\ShareFile.exe
[2003/12/29 23:53:58 | 000,002,048 | —- | C] () – C:\Program Files\SendFile.exe
[2003/12/29 23:53:58 | 000,001,457 | —- | C] () – C:\Program Files\rvappstm.lst
[2003/12/29 23:53:57 | 000,221,184 | —- | C] () – C:\Program Files\inetsocket.dll
[2003/12/29 23:53:57 | 000,015,907 | —- | C] () – C:\Program Files\licens32.txt
[2003/12/29 23:53:57 | 000,001,559 | —- | C] () – C:\Program Files\icbmftvc.lst
[2003/12/29 23:53:56 | 000,477,346 | —- | C] () – C:\Program Files\AIM95.HLP
[2003/12/29 23:53:56 | 000,147,456 | —- | C] () – C:\Program Files\aimauto.exe
[2003/12/29 23:53:56 | 000,001,375 | —- | C] () – C:\Program Files\aimalert.gif
[2003/12/29 23:53:55 | 000,012,312 | —- | C] () – C:\Program Files\aim95.CNT
[2003/12/29 23:53:55 | 000,002,836 | —- | C] () – C:\Program Files\aim.odl
[2003/12/25 09:36:18 | 000,000,049 | —- | C] () – C:\WINDOWS\dmi.ini
[2003/11/30 22:15:08 | 000,000,156 | —- | C] () – C:\WINDOWS\winzip32.ini
[2003/11/11 17:59:19 | 000,000,026 | —- | C] () – C:\WINDOWS\ERegClnt.INI
[2003/08/28 18:20:18 | 000,000,185 | —- | C] () – C:\WINDOWS\QTW.INI
[2003/06/03 11:07:46 | 000,000,345 | —- | C] () – C:\WINDOWS\ka.ini
[2003/04/22 19:42:21 | 000,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2003/01/19 16:18:39 | 000,000,044 | —- | C] () – C:\WINDOWS\liveup.ini
[2002/12/02 14:15:44 | 000,001,979 | —- | C] () – C:\WINDOWS\ACROREAD.INI
[2002/11/28 21:23:20 | 000,122,946 | —- | C] () – C:\WINDOWS\System32\CSGina.dll
[2002/11/11 13:29:59 | 000,001,369 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2002/11/09 14:25:21 | 000,000,053 | —- | C] () – C:\WINDOWS\ASTROP.INI
[2002/11/02 11:24:59 | 000,000,691 | —- | C] () – C:\WINDOWS\hegames.ini
[2002/10/06 10:56:19 | 000,000,060 | —- | C] () – C:\WINDOWS\TLCAPPS.INI
[2002/10/05 21:21:29 | 000,061,678 | —- | C] () – C:\Documents and Settings\Jennifer\Application Data\PFP100JPR.{PB
[2002/10/05 21:21:29 | 000,012,358 | —- | C] () – C:\Documents and Settings\Jennifer\Application Data\PFP100JCM.{PB
[2002/09/24 20:49:50 | 000,000,416 | —- | C] () – C:\WINDOWS\SIERRA.INI
[2002/09/23 10:44:19 | 000,000,037 | —- | C] () – C:\WINDOWS\iltwain.ini
[2002/09/23 10:40:24 | 000,229,376 | —- | C] () – C:\WINDOWS\System32\ISP2000.dll
[2002/09/23 10:40:24 | 000,063,488 | —- | C] () – C:\WINDOWS\System32\Eztw32.dll
[2002/09/21 15:23:45 | 000,000,000 | —- | C] () – C:\WINDOWS\netscape.INI
[2002/09/16 20:22:39 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2002/09/15 17:44:44 | 000,000,000 | —- | C] () – C:\WINDOWS\SETUP32.INI
[2002/09/07 12:51:58 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2002/09/07 12:43:42 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\msssc.dll
[2002/09/07 12:37:49 | 000,262,144 | —- | C] () – C:\WINDOWS\System32\shpshftr.dll
[2002/09/07 11:18:00 | 000,002,080 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2002/03/13 15:46:46 | 000,053,248 | R— | C] () – C:\WINDOWS\System32\zlib.dll
[2001/09/19 13:41:46 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\opcode.dll
[1999/01/22 13:46:58 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL
[1998/08/16 06:00:00 | 000,004,096 | —- | C] () – C:\WINDOWS\System32\sysres.dll
[1997/11/17 17:13:16 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
========== LOP Check ==========
[2003/12/30 00:01:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2005/01/14 21:56:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Napster
[2005/02/14 17:50:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\4D
[2006/03/16 18:28:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SecTaskMan
[2006/11/03 09:06:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2007/05/29 07:59:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2007/06/18 13:15:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\YAHOO
[2007/10/28 12:06:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ScanSoft
[2008/01/24 14:37:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Broderbund Software
[2008/01/24 14:38:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Broderbund LLC
[2008/02/11 16:24:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ubisoft
[2008/03/09 11:04:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2008/03/17 15:59:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Uniblue
[2008/05/03 13:01:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sandlot Games
[2008/09/10 17:00:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Broderbund
[2008/09/12 15:05:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ipapungz
[2008/09/12 15:05:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\qjcjwvol
[2008/09/13 03:06:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ixcbyvir
[2008/09/13 03:36:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\pmdopqzo
[2008/09/13 04:06:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\bkfmzmlo
[2008/09/13 04:36:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ixgbexwj
[2008/09/13 05:07:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\razupkjg
[2008/09/13 05:37:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\gdazqvuh
[2008/09/13 06:07:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\fypavqrg
[2009/01/03 10:10:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DriverScanner
[2009/03/05 15:21:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2009/03/07 18:29:40 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{66E2F539-12B6-4870-A500-7689CDE75C5E}
[2009/03/11 14:09:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2009/05/04 15:02:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Individual Software
[2009/07/13 15:09:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Computer Business Solutions
[2009/12/17 20:33:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCSettings
[2010/01/05 13:19:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Research In Motion
[2002/09/16 19:53:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Active Disk
[2004/09/15 07:22:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Aladdin Systems
[2006/08/06 12:15:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Earthlink
[2006/08/06 12:31:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\ScamBlocker
[2007/05/31 07:30:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Sametime
[2008/02/18 20:51:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\PC-FAX TX
[2008/03/17 15:59:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Uniblue
[2008/03/17 20:18:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\System Tweaker
[2008/08/08 19:30:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Intalev
[2008/12/19 10:52:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\RCP 5
[2009/03/07 18:34:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\SystemRequirementsLab
[2009/10/27 21:24:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Thunderbird
[2010/01/06 21:41:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Research In Motion
[2010/02/11 18:28:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Tific
[2002/09/17 05:12:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Active Disk
[2004/06/29 13:58:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\WeatherBug
[2005/03/02 14:33:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Diary Defender
[2005/04/24 01:59:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Folder Guard
[2006/05/12 01:10:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\.bittorrent
[2006/07/27 11:54:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\tunebite
[2006/08/06 15:56:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\ScamBlocker
[2006/09/25 10:23:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\SlySoft
[2006/11/03 09:09:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\TuneUp Software
[2007/05/29 07:59:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\URSoft
[2007/11/17 01:47:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Orbit
[2008/04/01 15:15:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Uniblue
[2008/12/04 13:04:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\RCP 5
[2008/12/30 12:26:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Desktopicon
[2009/01/08 11:01:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\ScanSoft
[2009/02/11 13:03:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Canneverbe_Limited
[2009/03/05 15:21:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\NCH Swift Sound
[2009/03/19 12:56:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Scooter Software
[2009/03/21 10:36:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/04/28 12:01:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\InterVideo
[2009/05/04 15:05:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Individual Software
[2009/05/13 06:52:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Forte
[2009/11/07 20:04:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Thunderbird
[2010/01/05 15:03:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Research In Motion
[2010/02/02 06:08:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Michael\Application Data\Tific
[2002/09/18 15:29:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Antonia\Application Data\Active Disk
[2005/01/11 13:29:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Antonia\Application Data\WeatherBug
[2008/01/02 14:21:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Antonia\Application Data\cerasus.media
[2008/08/13 16:59:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Antonia\Application Data\Intalev
[2008/08/25 12:54:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Antonia\Application Data\Total Eclipse
[2008/12/18 19:14:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Antonia\Application Data\RCP 5
[2009/05/29 07:59:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Antonia\Application Data\Uniblue
[2009/12/24 08:02:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Antonia\Application Data\Thunderbird
[2010/01/10 10:03:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Antonia\Application Data\Research In Motion
[2003/10/16 22:37:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Guest\Application Data\Active Disk
[2010/03/06 06:52:34 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2009/09/04 16:21:34 | 000,000,342 | —- | M] () – C:\WINDOWS\Tasks\Uniblue SpyEraser.job
========== Purity Check ==========
========== Custom Scans ==========
< %ALLUSERSPROFILE%\Application Data\*. >
[2002/09/07 09:33:56 | 000,000,000 | –SD | M] – C:\Documents and Settings\All Users\Application Data\Microsoft
[2002/09/16 19:20:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Symantec
[2002/09/26 13:44:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\QuickTime
[2003/12/23 20:55:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2003/12/30 00:01:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2005/01/14 21:56:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Napster
[2005/02/14 17:50:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\4D
[2005/03/09 13:30:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple Computer
[2005/10/22 11:54:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Adobe
[2006/01/20 21:22:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2006/02/05 21:35:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ahead
[2006/03/16 18:28:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SecTaskMan
[2006/04/04 10:10:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Trymedia
[2003/04/22 19:37:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Macrovision
[2006/08/06 11:54:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\InstallShield
[2006/11/03 09:06:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2006/12/05 10:00:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Yahoo!
[2007/04/08 23:38:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NVIDIA
[2007/05/29 07:59:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2007/05/31 10:15:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Pure Networks
[2007/06/18 13:15:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\YAHOO
[2007/10/28 12:05:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Brother
[2007/10/28 12:06:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ScanSoft
[2007/11/15 13:48:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nero
[2008/01/24 14:37:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Broderbund Software
[2008/01/24 14:38:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Broderbund LLC
[2008/02/11 16:24:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ubisoft
[2008/03/09 11:04:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2008/03/17 15:59:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Uniblue
[2008/03/18 13:38:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Avira
[2008/04/17 17:48:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
[2008/05/03 13:01:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sandlot Games
[2008/07/08 16:34:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple
[2008/09/10 17:00:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Broderbund
[2008/09/12 15:05:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ipapungz
[2008/09/12 15:05:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\qjcjwvol
[2008/09/13 03:06:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ixcbyvir
[2008/09/13 03:36:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\pmdopqzo
[2008/09/13 04:06:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\bkfmzmlo
[2008/09/13 04:36:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ixgbexwj
[2008/09/13 05:07:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\razupkjg
[2008/09/13 05:37:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\gdazqvuh
[2008/09/13 06:07:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\fypavqrg
[2009/01/03 10:10:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DriverScanner
[2009/03/05 15:21:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2009/03/05 15:21:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Software
[2009/03/07 18:29:40 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{66E2F539-12B6-4870-A500-7689CDE75C5E}
[2009/03/11 14:09:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2009/05/03 13:12:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVS4YOU
[2009/05/04 15:02:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Individual Software
[2009/07/13 15:09:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Computer Business Solutions
[2009/08/18 10:18:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Google Updater
[2009/09/11 19:38:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\McAfee Security Scan
[2009/09/13 19:38:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\McAfee
[2009/12/15 18:27:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Norton
[2009/12/17 20:32:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NortonInstaller
[2009/12/17 20:33:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCSettings
[2010/01/05 13:19:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Research In Motion
[2010/01/05 21:04:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Roxio
[2010/01/05 21:06:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sonic
[2010/01/27 17:12:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/02/19 19:42:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
[2008/12/22 01:35:14 | 002,652,467 | —- | M] (Uniblue Systems Ltd. ) – C:\Documents and Settings\All Users\Application Data\{66E2F539-12B6-4870-A500-7689CDE75C5E}\DriverScanner_Setup.exe
[2008/10/08 23:51:18 | 000,057,344 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\All Users\Application Data\{66E2F539-12B6-4870-A500-7689CDE75C5E}\driverscanner\3E39C89\2FB6E586\DriverScannerApi.exe
[2008/11/14 07:32:20 | 000,212,992 | —- | M] (Uniblue Systems) – C:\Documents and Settings\All Users\Application Data\{66E2F539-12B6-4870-A500-7689CDE75C5E}\driverscanner\5C40AA7E\8F9F9DCD\DriverScanner.exe
[2008/08/27 06:46:00 | 000,077,312 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\All Users\Application Data\{66E2F539-12B6-4870-A500-7689CDE75C5E}\driverscanner\CD77AC88\3DFD6AB6\DriverScannerApi.exe
[2007/03/14 19:10:30 | 000,116,288 | —- | M] (Apple Inc.) – C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.1.1.5\iTunesSetupAdmin.exe
[2001/02/08 10:18:58 | 000,069,632 | —- | M] (T.L.C.P.P. L.L.C.) – C:\Documents and Settings\All Users\Application Data\Broderbund Software\Print\vroomsap.exe
[2000/01/12 11:07:44 | 000,593,920 | —- | M] (InstallShield Software Corporation) – C:\Documents and Settings\All Users\Application Data\Broderbund Software\Print\iftw.exe
[1996/12/27 15:57:56 | 000,060,112 | —- | M] () – C:\Documents and Settings\All Users\Application Data\Individual Software\Professor Teaches Photoshop 6\UNWISE.EXE
[2001/09/17 15:30:42 | 000,119,291 | —- | M] () – C:\Documents and Settings\All Users\Application Data\Individual Software\Professor Teaches Photoshop 6\UnInstall.EXE
[2009/03/05 15:21:36 | 000,110,592 | —- | M] () – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound\Golden\lame.exe\lame.exe
[2009/12/10 20:29:04 | 001,782,128 | —- | M] (Symantec Corporation) – C:\Documents and Settings\All Users\Application Data\Norton\NUA.exe
[2009/12/22 12:11:34 | 080,528,056 | —- | M] (Symantec Corporation) – C:\Documents and Settings\All Users\Application Data\Norton\{NAV_Production_94_17.1.0.19_NUC}\NAV10UPEN.exe
< %APPDATA%\*. >
[2002/09/07 10:23:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Identities
[2002/09/07 09:33:56 | 000,000,000 | –SD | M] – C:\Documents and Settings\Jennifer\Application Data\Microsoft
[2002/09/16 19:53:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Active Disk
[2002/09/16 20:18:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Microsoft Web Folders
[2002/09/16 20:25:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Mozilla
[2002/09/16 21:01:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Help
[2002/10/05 21:21:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Corel
[2002/10/12 12:13:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Real
[2003/01/11 12:10:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Adobe
[2003/04/30 23:52:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Yahoo!
[2003/07/20 07:06:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Sun
[2003/12/10 18:36:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Macromedia
[2004/07/17 16:31:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Talkback
[2004/09/15 07:22:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Aladdin Systems
[2005/05/02 19:52:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Apple Computer
[2005/11/21 20:55:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\AdobeUM
[2006/08/06 12:15:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Earthlink
[2006/08/06 12:31:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\ScamBlocker
[2006/09/19 07:57:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Google
[2007/05/31 07:30:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Sametime
[2007/11/15 19:50:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Nero
[2007/12/15 12:13:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\DivX
[2007/12/17 10:15:56 | 000,000,000 | R–D | M] – C:\Documents and Settings\Jennifer\Application Data\Brother
[2008/02/18 20:51:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\PC-FAX TX
[2008/03/17 15:59:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Uniblue
[2008/03/17 20:18:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\System Tweaker
[2008/08/08 19:30:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Intalev
[2008/12/19 10:52:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\RCP 5
[2009/03/07 18:34:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\SystemRequirementsLab
[2009/04/24 22:06:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\vlc
[2009/10/09 23:14:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Creative
[2009/10/27 21:24:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Thunderbird
[2010/01/05 21:41:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\InstallShield
[2010/01/06 21:41:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Research In Motion
[2010/02/11 18:28:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Tific
[2010/02/21 11:21:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Malwarebytes
< %APPDATA%\*.exe /s >
[2007/03/16 21:19:46 | 021,277,080 | —- | M] ( ) – C:\Documents and Settings\Jennifer\Application Data\Adobe\Acrobat\7.0\Updater\AdbeRdr709_en_US.exe
[2008/02/25 20:06:46 | 001,523,040 | —- | M] (Adobe Systems Incorporated) – C:\Documents and Settings\Jennifer\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
[2008/09/24 16:12:22 | 000,335,872 | R— | M] (Macrovision Corporation) – C:\Documents and Settings\Jennifer\Application Data\Microsoft\Installer\{8C8ADD9C-1F30-4B1A-927E-B72CC4AADB91}\ARPPRODUCTICON.exe
< %SYSTEMDRIVE%\*.exe >
< MD5 for: AGP440.SYS >
[2005/08/19 15:35:20 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/08/31 14:37:42 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2005/08/19 15:35:20 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2008/08/31 14:37:42 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/04 01:07:42 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
< MD5 for: ATAPI.SYS >
[2002/08/29 03:50:10 | 010,158,890 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys
[2005/08/19 15:35:20 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/08/31 14:37:42 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2002/08/29 03:50:10 | 010,158,890 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp1.cab:atapi.sys
[2005/08/19 15:35:20 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2008/08/31 14:37:42 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2002/08/29 01:27:50 | 000,086,912 | —- | M] (Microsoft Corporation) MD5=95B858761A00E1D4F81F79A0DA019ACA – C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 00:59:42 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/04 00:59:42 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\atapi.sys
< MD5 for: EVENTLOG.DLL >
[2005/09/01 15:24:42 | 000,212,992 | —- | M] (EarthLink, Inc.) MD5=4B28CD532EA8AFE16A2A40B5D30DA277 – C:\Program Files\EarthLink TotalAccess\EventLog.dll
[2008/04/13 19:11:54 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 19:11:54 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/04 02:56:42 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
< MD5 for: NETLOGON.DLL >
[2008/04/13 19:12:02 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 19:12:02 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2004/08/04 02:56:44 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
< MD5 for: NVATA.SYS >
[2006/06/28 17:38:56 | 000,105,088 | —- | M] (NVIDIA Corporation) MD5=9ECCD189A9554C30A0D18A429778C7BA – C:\WINDOWS\system32\drivers\nvata.sys
< MD5 for: SCECLI.DLL >
[2004/08/04 02:56:44 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 19:12:06 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 19:12:06 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll
< %systemroot%\*. /mp /s >
< %systemroot%\system32\*.dll /lockedfiles >
[2010/01/05 04:00:22 | 000,214,528 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtrans.dll
[2010/01/05 04:00:20 | 000,347,136 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtmsft.dll
[138 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
< End of report >
Extras:
OTL Extras logfile created on: 3/6/2010 9:10:58 AM - Run 1
OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\Jennifer\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 42.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.48 Gb Total Space | 2.05 Gb Free Space | 2.75% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: MUSKRAT
Current User Name: Jennifer
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
[HKEY_USERS\S-1-5-21-1809067083-3242847100-1996373590-1005\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
[HKEY_USERS\S-1-5-21-1809067083-3242847100-1996373590-1006\SOFTWARE\Classes\]
.exe [@ = exefile] – Reg Error: Key error. File not found
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
[HKEY_USERS\S-1-5-21-1809067083-3242847100-1996373590-1007\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Print_Directory_Listing] – printdir.bat "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"67:UDP" = 67:UDP:*:Enabled:DHCP Discovery Service
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"8097:TCP" = 8097:TCP:*:Enabled:EarthLink UHP Modem Support
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 6.2 – File not found
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\System32\LEXPPS.EXE" = C:\WINDOWS\System32\LEXPPS.EXE:*:Disabled:LEXPPS.EXE – File not found
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – (Yahoo! Inc.)
"C:\Program Files\Yazak Chat\yazak.exe" = C:\Program Files\Yazak Chat\yazak.exe:*:Enabled:yazak – (ZakFromAnotherPlanet)
"C:\WINDOWS\System32\mmc.exe" = C:\WINDOWS\System32\mmc.exe:*:Disabled:Microsoft Management Console – (Microsoft Corporation)
"C:\Program Files\IBM\Sametime Connect\JRE\BIN\sametime75.exe" = C:\Program Files\IBM\Sametime Connect\JRE\BIN\sametime75.exe:*:Enabled:Lotus Sametime Connect – (International Business Machines Corporation)
"C:\Program Files\InterVideo\DVD8\WinDVD.exe" = C:\Program Files\InterVideo\DVD8\WinDVD.exe:*:Disabled:WinDVD – File not found
"C:\WINDOWS\System32\ftp.exe" = C:\WINDOWS\System32\ftp.exe:*:Disabled:File Transfer Program – (Microsoft Corporation)
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Disabled:bittorrent – File not found
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Disabled:iTunes – (Apple Inc.)
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Disabled:LimeWire – File not found
"C:\Program Files\Yahoo!\Yahoo! Music Engine\YahooMusicEngine.exe" = C:\Program Files\Yahoo!\Yahoo! Music Engine\YahooMusicEngine.exe:*:Disabled:Yahoo! Music Engine – File not found
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Premium
"{02DFF6B1-1654-411C-8D7B-FD6052EF016F}" = Apple Software Update
"{02F6993D-B763-4F40-8F93-2A9CD97586E3}" = Microsoft IntelliType Pro 6.3
"{07982F29-C7D6-423F-A100-C0FC67D0EC2F}" = EarthLink Wireless High Speed
"{08CA9554-B5FE-4313-938F-D4A417B81175}" = QuickTime
"{0A146245-DB79-4197-BF5D-FE1A699A2CC7}" = Camera Window DS
"{0B32D3F7-9241-4AAC-8C15-87530968E3A7}" = Eudora
"{0EAC5DEC-2AFD-4533-9416-3098BFEFDEC2}_is1" = Infine CaptureFlash version 1.6
"{10798AE3-DCBB-43C3-9C93-C23512427E25}" = The Sims Deluxe Edition
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{172423F9-522A-483A-AD65-03600CE4CA4F}" = Microsoft Works 6-9 Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1CA7ACD6-B21B-4240-AA05-4FC55F6E1033}" = Nero 8
"{205A5182-EFC8-4C25-B61D-C164F8FF4048}" = BlackBerry Desktop Software 5.0.1
"{20C53FA2-4307-4671-A93F-9463B29DFCF1}" = Symantec Technical Support Web Controls
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java™ 6 Update 18
"{26A24AE4-039D-4CA4-87B4-2F83216016F0}" = Java™ 6 Update 16
"{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1" = ConvertHelper 2.2
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{29D88826-2AB9-11D5-8854-00902761A46D}" = WordPerfect Office 2002 OEM
"{2E0C1913-886B-4C5C-8DAF-D1E649CE5FCC}" = Creative MediaSource
"{2EAF7E61-068E-11DF-953C-005056806466}" = Google Earth
"{32343DB6-9A52-40C9-87E4-5E7C79791C87}" = MSXML 4.0 SP2 and SOAP Toolkit 3.0
"{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}" = PaperPort Image Printer
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3F50AF3B-8997-4916-0095-99D63DDB785A}" = Harry Potter
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{40939C6D-8F27-40B8-9CBC-72701624185D}" = Redistributed Files
"{43DCF766-6838-4F9A-8C91-D92DA586DFA7}" = Microsoft Windows Journal Viewer
"{4572F220-0A56-402E-90F1-4D36DD22F108}" = TubeHunter Ultra
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4DBBF091-FACD-422C-B43C-786335BD5398}" = MovieEdit Task
"{4FD36BC0-18D0-4874-9E7D-24024066B990}" = Cayra
"{50E25180-3BDC-4B6D-80A2-3F1F0C9CF39D}" = Camera Window DVC
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5809E7CF-4DCF-11D4-9875-00105ACE7734}" = Logitech MouseWare 9.79
"{58628459-F393-4EBA-AA8B-990E92DA8AC4}" = AdWare & SpyWare
"{60D8CA34-642C-476F-AB4E-94DECCAEED69}" = The White Wolf of Icicle Creek
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{65563451-00B6-458C-9F9A-03A7757355A6}" = Compact Wireless-G USB Network Adapter with SpeedBooster
"{689E0AB3-50B2-4E5A-9DCE-6DA9F5BE1314}" = BlackBerry® Media Sync
"{6C3A75A6-9A90-44A3-A703-82AC1EA6A85D}" = Camera Window MC
"{7148F0A8-6813-11D6-A77B-00B0D0142000}" = Java 2 Runtime Environment, SE v1.4.2
"{71A4C7E7-1792-4895-A403-36814B2B4151}" = EarthLink FastLane
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72F9F82C-0A0D-44a7-9FBD-3804D2EEA9ED}" = The Sims™ 2 Sampler - Create-A-Sim
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7797C70B-11EB-446A-9B1E-3D9039DB581F}" = TotalAccess Core Applications
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{843E82A0-15CE-4587-9BF0-8C07FF90094D}" = Where in the USA is Carmen Sandiego for schools
"{874E44F3-B9A7-4AA1-B4BA-83E5684ED9C6}" = PhotoStitch
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics Driver
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8C8ADD9C-1F30-4B1A-927E-B72CC4AADB91}" = IBM Lotus Sametime Connect 7.5.1
"{901F8ED7-13E8-43EF-B738-2FE89B0588EB}" = Camera Access Library
"{91A4AD99-69CE-4745-97B7-0E0DFBECFDE5}" = Adobe Illustrator CS
"{93C3B6D2-8FB0-400F-A763-1B64F7C62B5B}" = Nancy Drew: Danger on Deception Island
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A1D0D14A-B776-4907-BC00-5149F2298086}" = Camera Support Core Library
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A2EB8F2E-6D9B-4F8B-96EB-F976D33F416F}" = Camera Window DVC
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}" = Windows Defender Signatures
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AB90749C-7422-4580-8A7A-66CC5E9E5F98}" = iTunes
"{AC76BA86-1033-0000-7760-000000000001}" = Adobe Acrobat 6.0 Professional
"{AD8780DE-96F5-454B-B551-E063B94AAD4F}" = Homework Helpers
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B6C89654-A6A2-477C-873B-724EC1C56407}" = ScanSoft PaperPort 11
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B98BE95C-E76F-4246-B8E6-BEB8EE791D06}" = Roxio Media Manager
"{B9BD9BF5-F1D1-4904-B348-40D0E9FF0023}" = Scooby-Doo 2 - Monsters Unleashed
"{BAA43DA2-B6C5-46EC-B163-0E8EEAF975A4}" = RAW Image Task 2.2
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BBBC2B89-E193-4348-A83C-C8DD8210A4AC}" = Canon PhotoRecord
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}" = Canon ZoomBrowser EX (E)
"{C427E746-4EC9-4E3C-AACB-C6BB1F714D7F}" = Uniblue DriverScanner 2009
"{C83FB11D-9EC6-49D7-99A7-DDDB2264883C}" = Brother MFL-Pro Suite
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D40CAD1B-AAC0-44D2-B662-232A183C5FE1}" = The 3D Globe
"{DBEE6A5D-7E83-BA08-6055-37F9E60D28D6}" = Cake Mania
"{DC3065BF-95B4-42C5-B47D-0B713CDA75D0}" = Creative Zen Vision M
"{EFB21DE7-8C19-4A88-BB28-A766E16493BC}" = Adobe Photoshop CS
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4EC2FB1-4255-4040-8DE6-5D75FA9D039F}" = Nancy Drew: The Creature of Kapu Cave
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT Extension to Microsoft Windows XP CD Writing Wizard
"{FF087B26-DD20-4DD0-B97F-0B08B76A04D1}" = Deal Info
"3DGroove" = 3D Groove Playback Engine
"53F13DB4D9611FD63BE580F06F0729BF236ABE68" = Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
"Active Disk" = Active Disk
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"a-squared HiJackFree_is1" = a-squared HiJackFree 3.1
"AudibleManager" = AudibleManager
"AVS DVD Copy_is1" = AVS DVD Copy version 1.4
"AVSCoverEditor_AVSMedia_is1" = AVS Cover Editor [removed] (AVSMedia)
"BlackBerry_{205A5182-EFC8-4C25-B61D-C164F8FF4048}" = BlackBerry Desktop Software 5.0.1
"BurnAware Free_is1" = BurnAware Free 2.3.0
"Cake Mania" = Cake Mania (remove only)
"Camtasia Studio 2" = Camtasia Studio 2
"CNXT_MODEM_PCI" = SoftV92 Data Fax Modem
"Cosmi Photo Editor Plus" = Cosmi Photo Editor Plus
"Creative Removable Disk Manager" = Creative Removable Disk Manager
"CyberSky" = CyberSky
"Dear America" = Dear America
"Diary Defender" = Diary Defender
"Disketch" = Disketch CD Label Software
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"drmtool.inf" = Personal License Update Wizard for Windows Media Player
"Dual Mode Camera_is1" = Uninstall Dual Mode Camera
"DVD Identifier_is1" = DVD Identifier
"dvdSanta 4.50 - Make your own DVD movies!_is1" = dvdSanta 4.50
"Earthlink Instant Messenger" = Earthlink Instant Messenger
"EarthLink TotalAccess 2004" = EarthLink Software
"eBay Icon" = eBay Icon
"Fetch" = Fetch
"FLVPlayer" = FLV Player 1.3.3
"Golden" = Golden Records Vinyl to CD Converter
"Google Updater" = Google Updater
"HijackThis" = HijackThis 2.0.2
"Hoyle Solitaire and Mahjong" = Hoyle Solitaire and Mahjong
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InSpheration" = InSpheration
"InstallShield_{0A146245-DB79-4197-BF5D-FE1A699A2CC7}" = Canon Camera Window DSLR 5 for ZoomBrowser EX
"InstallShield_{4DBBF091-FACD-422C-B43C-786335BD5398}" = Canon MovieEdit Task for ZoomBrowser EX
"InstallShield_{50E25180-3BDC-4B6D-80A2-3F1F0C9CF39D}" = Canon Camera Window DC_DV 6 for ZoomBrowser EX
"InstallShield_{6C3A75A6-9A90-44A3-A703-82AC1EA6A85D}" = Canon Camera Window MC 6 for ZoomBrowser EX
"InstallShield_{874E44F3-B9A7-4AA1-B4BA-83E5684ED9C6}" = Canon Utilities PhotoStitch 3.1
"InstallShield_{901F8ED7-13E8-43EF-B738-2FE89B0588EB}" = Canon Camera Access Library
"InstallShield_{A1D0D14A-B776-4907-BC00-5149F2298086}" = Canon Camera Support Core Library
"InstallShield_{A2EB8F2E-6D9B-4F8B-96EB-F976D33F416F}" = Canon Camera Window DC_DV 5 for ZoomBrowser EX
"InstallShield_{BAA43DA2-B6C5-46EC-B163-0E8EEAF975A4}" = Canon RAW Image Task for ZoomBrowser EX
"InstallShield_{D40CAD1B-AAC0-44D2-B662-232A183C5FE1}" = The 3D Globe
"Instant Home Design" = Instant Home Design
"Iomega App Services" = Iomega App Services
"IomegaWare" = IomegaWare
"IrfanView" = IrfanView (remove only)
"JetBee_is1" = JetBee FREE 4.0.7 (build 321)
"LunarPhase Pro Demo_is1" = LunarPhase Pro Demo
"Luxor_is1" = Luxor
"Luxor2" = Luxor 2 (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mavis Beacon Teaches Typing Deluxe 17" = Mavis Beacon Teaches Typing Deluxe 17
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla (1.7.1)" = Mozilla (1.7.1)
"Mozilla Firefox (3.5.8)" = Mozilla Firefox (3.5.8)
"Mozilla Thunderbird (2.0.0.23)" = Mozilla Thunderbird (2.0.0.23)
"MP3 CD Converter_is1" = MP3 CD Converter 4.02
"MPEG Joiner_is1" = MPEG Joiner
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSN Music Assistant" = MSN Music Assistant
"My Screen Recorder Pro_is1" = My Screen Recorder Pro 2.35
"N360" = Norton 360
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NoteWorthy Composer" = NoteWorthy Composer
"NVIDIA Drivers" = NVIDIA Drivers
"PercussionStudio3" = PercussionStudio3
"Personalized Learning Center" = Personalized Learning Center
"Pet Vet" = Pet Vet (remove only)
"Pet Vet 2_is1" = Pet Vet 2
"Pierresoft Adesign_is1" = Pierresoft Adesign 1.5
"Prism" = Prism Video Converter
"Professor Teaches Photoshop 6" = Professor Teaches Photoshop 6
"Rainlendar2" = Rainlendar2 (remove only)
"ReaConverter 5.5 Pro_is1" = ReaConverter 5.5 Pro
"Secret Agent™ Barbie™" = Secret Agent™ Barbie™
"Shockwave" = Shockwave
"SoundTap" = SoundTap Streaming Audio Recorder
"SpyEraser_is1" = Uniblue SpyEraser
"SpywareBlaster_is1" = SpywareBlaster 4.2
"Stellaluna" = Stellaluna
"Switch" = Switch Sound File Converter
"SysInfo" = Creative System Information
"System Tweaker_is1" = Uniblue System Tweaker
"SystemRequirementsLab" = System Requirements Lab
"The American Girls Dress Designer ™" = The American Girls Dress Designer ™
"The Mystery of the Mummy" = The Mystery of the Mummy
"The Weather Channel Desktop 6" = The Weather Channel Desktop 6
"Total 3D Home Deluxe" = Total 3D Home Deluxe
"TruVoice" = Lernout & Hauspie TruVoice for Microsoft Agent
"Tunebite_is1" = Tunebite [removed]
"Uniblue DriverScanner 2009" = Uniblue DriverScanner 2009
"Unlocker" = Unlocker 1.8.8
"Video Journal_is1" = Video Journal Version 1.4
"WavePad" = WavePad Sound Editor
"WebPost" = Microsoft Web Publishing Wizard 1.52
"WIC" = Windows Imaging Component
"WinAVIVideoConverter_is1" = WinAVIVideoConverter
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WinZip Self-Extractor" = WinZip Self-Extractor
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"Y!mLite_is1" = Y!mLite 292
"Y!TunnelPro V1.3 Build 272" = Y!TunnelPro V1.3 Build 272
"Yahoo! Mail" = Yahoo! Internet Mail
"Yahoo! Mail AutoComplete" = Yahoo! Address AutoComplete
"Yahoo! Messenger" = Yahoo! Messenger
"Yazak Chat" = Yazak Chat 8.80.0
"Your Uninstaller! 2006_is1" = Your Uninstaller! 2006 Version 5
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-1809067083-3242847100-1996373590-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BeyondCompare3_is1" = Beyond Compare Version 3.0.15
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 3/4/2010 12:45:05 PM | Computer Name = MUSKRAT | Source = Google Update | ID = 20
Description =
Error - 3/4/2010 1:45:05 PM | Computer Name = MUSKRAT | Source = Google Update | ID = 20
Description =
Error - 3/4/2010 2:45:05 PM | Computer Name = MUSKRAT | Source = Google Update | ID = 20
Description =
Error - 3/4/2010 8:45:05 PM | Computer Name = MUSKRAT | Source = Google Update | ID = 20
Description =
Error - 3/5/2010 7:55:54 AM | Computer Name = MUSKRAT | Source = WmiAdapter | ID = 4099
Description = Open of service failed.
Error - 3/5/2010 1:45:05 PM | Computer Name = MUSKRAT | Source = Google Update | ID = 20
Description =
Error - 3/5/2010 2:45:05 PM | Computer Name = MUSKRAT | Source = Google Update | ID = 20
Description =
Error - 3/5/2010 8:45:05 PM | Computer Name = MUSKRAT | Source = Google Update | ID = 20
Description =
Error - 3/5/2010 9:45:05 PM | Computer Name = MUSKRAT | Source = Google Update | ID = 20
Description =
Error - 3/5/2010 10:45:05 PM | Computer Name = MUSKRAT | Source = Google Update | ID = 20
Description =
[ System Events ]
Error - 3/5/2010 7:51:09 AM | Computer Name = MUSKRAT | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Roxio Hard Drive Watcher
9 service to connect.
Error - 3/5/2010 7:53:43 AM | Computer Name = MUSKRAT | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the N360 service.
Error - 3/5/2010 7:55:54 AM | Computer Name = MUSKRAT | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the WMI Performance Adapter
service to connect.
Error - 3/5/2010 7:55:54 AM | Computer Name = MUSKRAT | Source = Service Control Manager | ID = 7000
Description = The WMI Performance Adapter service failed to start due to the following
error: %%1053
Error - 3/6/2010 8:22:35 AM | Computer Name = MUSKRAT | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.101 for the Network Card with network
address 001A4D64E2D1 has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).
Error - 3/6/2010 8:24:10 AM | Computer Name = MUSKRAT | Source = Service Control Manager | ID = 7000
Description = The Nero BackItUp Scheduler 4.0 service failed to start due to the
following error: %%2
Error - 3/6/2010 8:24:10 AM | Computer Name = MUSKRAT | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Roxio Hard Drive Watcher
9 service to connect.
Error - 3/6/2010 8:33:01 AM | Computer Name = MUSKRAT | Source = Service Control Manager | ID = 7000
Description = The Nero BackItUp Scheduler 4.0 service failed to start due to the
following error: %%2
Error - 3/6/2010 8:33:01 AM | Computer Name = MUSKRAT | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Roxio Hard Drive Watcher
9 service to connect.
Error - 3/6/2010 8:37:45 AM | Computer Name = MUSKRAT | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the N360 service.
< End of report >
JonTom
Hello Stormicats
I hope you are feeling better now.
I can see evidence of McAfee products on your system even though you are now using Norton 360. Do you still use McAfee products? If you no longer use them let me know and we will remove them.
I wasn't feeling well on Thursday and Friday.
I hope you are feeling better now.I can see evidence of McAfee products on your system even though you are now using Norton 360. Do you still use McAfee products? If you no longer use them let me know and we will remove them.
- Please open OTL
- Copy and paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.
:Processes explorer.exe :Files C:\Documents and Settings\All Users\Application Data\ipapungz C:\Documents and Settings\All Users\Application Data\qjcjwvol C:\Documents and Settings\All Users\Application Data\ixcbyvir C:\Documents and Settings\All Users\Application Data\pmdopqzo C:\Documents and Settings\All Users\Application Data\bkfmzmlo C:\Documents and Settings\All Users\Application Data\ixgbexwj C:\Documents and Settings\All Users\Application Data\razupkjg C:\Documents and Settings\All Users\Application Data\gdazqvuh C:\Documents and Settings\All Users\Application Data\fypavqrg :OTL IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\..\URLSearchHook: ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found O2 - BHO: (no name) - {B7FF285A-95E0-4C5A-AA93-C4C701533649} - No CLSID value found. O2 - BHO: (no name) - {C9932651-3EB0-4B27-B701-714A6CE4495F} - No CLSID value found. O2 - BHO: (no name) - {DE95B055-D183-49F7-873D-AEAB755869CA} - No CLSID value found. O2 - BHO: (no name) - {F835EF2C-3621-41F6-8275-EFD2A4B2B6A2} - No CLSID value found. O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found. O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\..\Toolbar\WebBrowser: (no name) - {C7768536-96F8-4001-B1A2-90EE21279187} - No CLSID value found. O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found. O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\..\Toolbar\WebBrowser: (no name) - {4064EA35-578D-4073-A834-C96D82CBCF40} - No CLSID value found. O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. O4 - HKLM..\Run: [] File not found O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006..\Run: [srvsh] C:\WINDOWS\System32\wtcratmp.exe O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: TUxpvnTwnl = C:\Documents and Settings\Michael\Desktop\AdobeFlashPlayerExt.exe O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Reg Error: Key error.) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) SafeBootNet: {1a3e09be-1e45-494b-9174-d7385b45bbf5} - Reg Error: Value error. ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player ActiveX: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - Reg Error: Value error. ActiveX: {AA218328-0EA8-4D70-8972-E987A9190FF4} - Reg Error: Value error. ActiveX: {abcdf74f-9a64-4e6e-b8eb-6e5a41de6550} - :Commands [purity] [emptytemp] [start explorer] [Reboot] - Once you have pasted the information into the Custom Scans/Fixes box, click the "Run Fix" button at the top.
- Allow the program to run unhindered.
- Your machine will re-start itself. This is normal.
- A log will be created after your machine reboots. Please post the contents of the log in your next reply.
- Copy and paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.
- Please perform the following scan(s):
- I can see from your logs that you have MalwareBytes AntiMalware installed.
- Double click on the MalwareBytes AntiMalware icon to launch the program.
- A screen will appear. It will look like this:
[external image: Posted Image]
- Click on the "Update" tab and then on "Check for Updates".
- The program will now install the latest Malware definition files.
- Once complete, click on the "Scanner" tab, select "Perform full scan"and then click on "Scan".
- Once the program has scanned your computer, a log file will be created in Notepad.
- Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
- If the scan detects any Malware-related objects, make sure that everything is checked, and click "Remove Selected" <– Very Important.
- When disinfection is completed, a log will open in Notepad and you may be prompted to restart your computer.
- The log is automatically saved by MBAM and can be viewed by clicking the "Logs" tab.
- Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart your computer, please do so immediately.
- Come back here to this thread and Paste the log in your next reply.
In your next reply, please provide the OTL and MBAM logs.
Also, please describe how your computer is behaving at the moment. Are you still experiencing problems?
Stormicats
Okay, I tried to run OTL three times, even leaving it running overnight. It hung up on this line and never finished:
SafeBootNet: {1a3e09be-1e45-494b-9174-d7385b45bbf5} - Reg Error: Value error.
Ran MBAM, it found a couple of things and removed them. Here's the log:
Malwarebytes' Anti-Malware 1.44
Database version: 3835
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11
3/8/2010 7:30:41 AM
mbam-log-2010-03-08 (07-30-41).txt
Scan type: Full Scan (A:\|C:\|D:\|E:\|)
Objects scanned: 399348
Time elapsed: 1 hour(s), 47 minute(s), 34 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Documents and Settings\Michael\Application Data\Desktopicon\eBayShortcuts.exe (Adware.ADON) -> Quarantined and deleted successfully.
C:\old c\WINDOWS\SYSTEM\JGAW400.DLL (Trojan.Hiloti) -> Quarantined and deleted successfully.
You asked about McAfee – I'm not sure where that came from, because I don't think I've ever subscribed to it. We can certainly get rid of it; it isn't doing me any good.
Current problems with the computer:
It takes at least 2 reboots before we can connect to the Internet (which may be our flaky modem, but it wasn't doing this as often previously); other times, it seems to be connected but we can't pull up any pages.
My husband has had problems opening a program by opening a pre-existing document (i.e., double-click on an Excel spreadsheet to open it without having Excel open already). He has to open the program, navigate to the document and then wait. He's finding documents are taking a long time to open up (these are household spreadsheets and word files; nothing huge or complicated).
And as you know, a couple of these diagnostics have decided they don't like me.
Sorry for the delay in getting back to you. I'd have had this to you last night if OTL had cooperated, and this morning if the Internet had talked to me.
JonTom
Hello Stormicats
Thank you for the log and extra information.
I am curious about the following entry:
C:\old c\WINDOWS\SYSTEM\JGAW400.DLL (Trojan.Hiloti) -> Quarantined and deleted successfully.
Do you have an old partition on your hard drive, or perhaps a cache of backed up files from a different ("old") machine?
Lets try this:
Thank you for the log and extra information.
No problem, just take your timeSorry for the delay in getting back to you. I'd have had this to you last night if OTL had cooperated, and this morning if the Internet had talked to me.
I will provide you with a removal tool once your machine is clean.You asked about McAfee – We can certainly get rid of it
I am curious about the following entry:
C:\old c\WINDOWS\SYSTEM\JGAW400.DLL (Trojan.Hiloti) -> Quarantined and deleted successfully.
Do you have an old partition on your hard drive, or perhaps a cache of backed up files from a different ("old") machine?
Strange?I tried to run OTL three times, even leaving it running overnight. It hung up
Lets try this:
- Please open OTL
- Copy and paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.
:Processes explorer.exe :Files c:\windows\system32\unknown_mini_F21A2B85742A4A7BA95E67A150BC8BE5.7z C:\Documents and Settings\All Users\Application Data\ipapungz C:\Documents and Settings\All Users\Application Data\qjcjwvol C:\Documents and Settings\All Users\Application Data\ixcbyvir C:\Documents and Settings\All Users\Application Data\pmdopqzo C:\Documents and Settings\All Users\Application Data\bkfmzmlo C:\Documents and Settings\All Users\Application Data\ixgbexwj C:\Documents and Settings\All Users\Application Data\razupkjg C:\Documents and Settings\All Users\Application Data\gdazqvuh C:\Documents and Settings\All Users\Application Data\fypavqrg :OTL IE - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\..\URLSearchHook: ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found O2 - BHO: (no name) - {B7FF285A-95E0-4C5A-AA93-C4C701533649} - No CLSID value found. O2 - BHO: (no name) - {C9932651-3EB0-4B27-B701-714A6CE4495F} - No CLSID value found. O2 - BHO: (no name) - {DE95B055-D183-49F7-873D-AEAB755869CA} - No CLSID value found. O2 - BHO: (no name) - {F835EF2C-3621-41F6-8275-EFD2A4B2B6A2} - No CLSID value found. O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found. O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1005\..\Toolbar\WebBrowser: (no name) - {C7768536-96F8-4001-B1A2-90EE21279187} - No CLSID value found. O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found. O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006\..\Toolbar\WebBrowser: (no name) - {4064EA35-578D-4073-A834-C96D82CBCF40} - No CLSID value found. O3 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1007\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. O4 - HKLM..\Run: [] File not found O4 - HKU\S-1-5-21-1809067083-3242847100-1996373590-1006..\Run: [srvsh] C:\WINDOWS\System32\wtcratmp.exe O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: TUxpvnTwnl = C:\Documents and Settings\Michael\Desktop\AdobeFlashPlayerExt.exe O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Reg Error: Key error.) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player ActiveX: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - Reg Error: Value error. ActiveX: {AA218328-0EA8-4D70-8972-E987A9190FF4} - Reg Error: Value error. ActiveX: {abcdf74f-9a64-4e6e-b8eb-6e5a41de6550} - :Commands [purity] [emptytemp] [start explorer] [Reboot] - Once you have pasted the information into the Custom Scans/Fixes box, click the "Run Fix" button at the top.
- Allow the program to run unhindered.
- Your machine will re-start itself. This is normal.
- A log will be created after your machine reboots. Please post the contents of the log in your next reply.
- Copy and paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.
- Please perform the following scan:
- This is a very deep scan that can take many hours. In some instances you may need to let it run overnight. Please be patient.
- It is recommended that you disable your onboard antivirus program and antispyware programs while performing scans to eliminate software conflicts and to speed up scan time.
- DO NOT surf the net while your resident protection is disabled!
- Once the scan is finished remember to re-enable your resident antivirus protection along with whatever antispyware applications you use.
Please perform a Kaspersky Online Scan of your computer by clicking here.
An alternative link to the Kaspersky Online Scan Tool can be found here.
You will be taken to a web page. It will look like this:
[external image: Posted Image]
- Click on the Accept button and install any components it needs.
- The program will install and then begin downloading the latest definition files.
- After the files have been downloaded on the left side of the page in the Scan section select My Computer.
- This will start the program and scan your system.
- The scan will take a while, so be patient and let it run (at times it may appear to stall).
- Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
- Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
- Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
- Once the scan is complete, click on View scan report. To obtain the report:
- Click on: Save Report As
- Next, in the Save as prompt, Save in area, select: Desktop
- In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select:Text file [*.txt]
- Then, click: Save
- Please post the Kaspersky Online Scanner Report in your reply.
- If you need help performing the above steps, an animated tutorial can be found here.
In your next reply please provide the OTL log and the Kaspersky Online Scan log.
Stormicats
JonTom – Here are the logs. I will get back to you (with any luck) on Thursday. Singing tonight, won't be home until 10-ish and need to be at work the following morning. Tea is my friend!
We do have an "old c" and "old d" which are the remnants of our old (and tiny) computer drives. As far as I can tell, there's nothing in either of them we need to save – all the stuff we actually use has long since been moved.
Here are the logs:
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
c:\windows\system32\unknown_mini_F21A2B85742A4A7BA95E67A150BC8BE5.7z moved successfully.
File\Folder C:\Documents and Settings\All Users\Application Data\ipapungz not found.
File\Folder C:\Documents and Settings\All Users\Application Data\qjcjwvol not found.
File\Folder C:\Documents and Settings\All Users\Application Data\ixcbyvir not found.
File\Folder C:\Documents and Settings\All Users\Application Data\pmdopqzo not found.
File\Folder C:\Documents and Settings\All Users\Application Data\bkfmzmlo not found.
File\Folder C:\Documents and Settings\All Users\Application Data\ixgbexwj not found.
File\Folder C:\Documents and Settings\All Users\Application Data\razupkjg not found.
File\Folder C:\Documents and Settings\All Users\Application Data\gdazqvuh not found.
File\Folder C:\Documents and Settings\All Users\Application Data\fypavqrg not found.
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-1809067083-3242847100-1996373590-1005\Software\Microsoft\Internet Explorer\URLSearchHooks\\~CFBFAE00-17A6-11D0-99CB-00C04FD64497} not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B7FF285A-95E0-4C5A-AA93-C4C701533649}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7FF285A-95E0-4C5A-AA93-C4C701533649}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C9932651-3EB0-4B27-B701-714A6CE4495F}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C9932651-3EB0-4B27-B701-714A6CE4495F}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE95B055-D183-49F7-873D-AEAB755869CA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE95B055-D183-49F7-873D-AEAB755869CA}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F835EF2C-3621-41F6-8275-EFD2A4B2B6A2}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F835EF2C-3621-41F6-8275-EFD2A4B2B6A2}\ not found.
Registry value HKEY_USERS\S-1-5-21-1809067083-3242847100-1996373590-1005\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
Registry value HKEY_USERS\S-1-5-21-1809067083-3242847100-1996373590-1005\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93}\ not found.
Registry value HKEY_USERS\S-1-5-21-1809067083-3242847100-1996373590-1005\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C7768536-96F8-4001-B1A2-90EE21279187} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7768536-96F8-4001-B1A2-90EE21279187}\ not found.
Registry value HKEY_USERS\S-1-5-21-1809067083-3242847100-1996373590-1006\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{C4069E3A-68F1-403E-B40E-20066696354B} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C4069E3A-68F1-403E-B40E-20066696354B}\ not found.
Registry value HKEY_USERS\S-1-5-21-1809067083-3242847100-1996373590-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4064EA35-578D-4073-A834-C96D82CBCF40} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4064EA35-578D-4073-A834-C96D82CBCF40}\ not found.
Registry key HKEY_USERS\S-1-5-21-1809067083-3242847100-1996373590-1007\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ not found.
Registry value HKEY_USERS\S-1-5-21-1809067083-3242847100-1996373590-1006\Software\Microsoft\Windows\CurrentVersion\Run\\srvsh not found.
File C:\WINDOWS\System32\wtcratmp.exe not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\TUxpvnTwnl not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}\ not found.
File oft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab not found.
Starting removal of ActiveX control Microsoft XML Parser for Java
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Microsoft XML Parser for Java\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A17E30C4-A9BA-11D4-8673-60DB54C10000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A17E30C4-A9BA-11D4-8673-60DB54C10000}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{A17E30C4-A9BA-11D4-8673-60DB54C10000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A17E30C4-A9BA-11D4-8673-60DB54C10000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AA218328-0EA8-4D70-8972-E987A9190FF4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AA218328-0EA8-4D70-8972-E987A9190FF4}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{AA218328-0EA8-4D70-8972-E987A9190FF4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AA218328-0EA8-4D70-8972-E987A9190FF4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{abcdf74f-9a64-4e6e-b8eb-6e5a41de6550}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{abcdf74f-9a64-4e6e-b8eb-6e5a41de6550}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{abcdf74f-9a64-4e6e-b8eb-6e5a41de6550}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{abcdf74f-9a64-4e6e-b8eb-6e5a41de6550}\ not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 25493442 bytes
->Flash cache emptied: 41 bytes
User: All Users
User: NetworkService
->Temp folder emptied: 41702 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Jennifer
->Temp folder emptied: 1558496 bytes
->Temporary Internet Files folder emptied: 5454644 bytes
->Java cache emptied: 57202509 bytes
->FireFox cache emptied: 71349735 bytes
->Flash cache emptied: 1606211 bytes
User: Michael
->Temp folder emptied: 176532 bytes
->Temporary Internet Files folder emptied: 3001208 bytes
->Java cache emptied: 41858631 bytes
->FireFox cache emptied: 177736184 bytes
->Flash cache emptied: 510527 bytes
User: Antonia
->Temp folder emptied: 1145088 bytes
->Temporary Internet Files folder emptied: 77767 bytes
->Java cache emptied: 37992632 bytes
->FireFox cache emptied: 83337845 bytes
->Flash cache emptied: 246389 bytes
User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 424488 bytes
%systemroot%\System32 .tmp files removed: 82036772 bytes
%systemroot%\System32\dllcache .tmp files removed: 23740928 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 318664 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 28356699 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 27092907 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 640.00 mb
OTL by OldTimer - Version 3.1.34.0 log created on 03092010_220011
Files\Folders moved on Reboot…
File\Folder C:\WINDOWS\temp\JETB2E4.tmp not found!
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_32c.dat not found!
Registry entries deleted on Reboot…
——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, March 10, 2010
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Tuesday, March 09, 2010 23:07:57
Records in database: 3751592
——————————————————————————–
Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes
Scan area - My Computer:
A:\
C:\
D:\
E:\
Scan statistics:
Objects scanned: 204938
Threats found: 6
Infected objects found: 9
Suspicious objects found: 0
Scan duration: 04:10:40
File name / Threat / Threats count
C:\Documents and Settings\Jennifer\.housecall6.6\Quarantine\css4[1].bac_a05992 Infected: not-a-virus:AdWare.Win32.Virtumonde.qvl 1
C:\Documents and Settings\Jennifer\.housecall6.6\Quarantine\A0111850.dll.bac_a05992 Infected: not-a-virus:AdWare.Win32.Virtumonde.qvl 1
C:\Documents and Settings\Jennifer\.housecall6.6\Quarantine\A0112884.dll.bac_a05992 Infected: Trojan.Win32.Monder.gen 1
C:\Documents and Settings\Jennifer\.housecall6.6\Quarantine\geebc.dll.bac_a05992 Infected: not-a-virus:AdWare.Win32.Virtumonde.qvl 1
C:\Documents and Settings\Jennifer\.housecall6.6\Quarantine\A0103366.exe.bac_a05992 Infected: Trojan.Win32.Agent.drm 1
C:\Documents and Settings\Michael\My Documents\Michael's stuff from Jenn's Flash drive\Other\Yazak_Install.exe Infected: Trojan-Dropper.Win32.VB.akpt 1
C:\Documents and Settings\Michael\My Documents\Software\yuchooz_toolbar2.exe Infected: not-a-virus:AdWare.Win32.Mostofate.bu 1
C:\Documents and Settings\Michael\Desktop\Michael's stuff from the laptop\Michael\Other\Yazak_Install.exe Infected: Trojan-Dropper.Win32.VB.akpt 1
C:\Program Files\Rainlendar2\uninst.exe Infected: Trojan-Dropper.Win32.Agent.bske 1
Selected area has been scanned.
JonTom
Hello Stormicats
The reason I ask is because MBAM detected and removed an infected file from one of your old drives. If you are sure that you no longer need the information held on these old drives, it may be a good idea to delete them from your system (it would also free up some drive space).
The Kaspersky Online Scan detected some infected files present in your Housecall quarantine folder. Please do the following:
We do have an "old c" and "old d" which are the remnants of our old (and tiny) computer drives. As far as I can tell, there's nothing in either of them we need to save – all the stuff we actually use has long since been moved.
The reason I ask is because MBAM detected and removed an infected file from one of your old drives. If you are sure that you no longer need the information held on these old drives, it may be a good idea to delete them from your system (it would also free up some drive space).
The Kaspersky Online Scan detected some infected files present in your Housecall quarantine folder. Please do the following:
- Please search for the following files/folders
- NOTE: DO NOT double click on ANY executable (.exe) files in the next step!!!
- Right-click your "Start" button and select "Explore".
- Navigate to and delete the following folder in bold.
C:\Documents and Settings\Jennifer\.housecall6.6\Quarantine <=== delete this folder.
The scan also detected some files that we must remove. From what I can see, it looks as though the infection may have been picked up from a USB Flash Drive.
If you have a Flash Drive, please make sure that it is plugged into your machine before running the fix:
- Please open OTL
- Copy and paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.
:Processes explorer.exe :Files C:\Documents and Settings\Michael\My Documents\Michael's stuff from Jenn's Flash drive\Other\Yazak_Install.exe C:\Documents and Settings\Michael\My Documents\Software\yuchooz_toolbar2.exe C:\Documents and Settings\Michael\Desktop\Michael's stuff from the laptop\Michael\Other\Yazak_Install.exe C:\Program Files\Rainlendar2\uninst.exe :Commands [purity] [emptytemp] [start explorer] [Reboot]
- Once you have pasted the information into the Custom Scans/Fixes box, click the "Run Fix" button at the top.
- Allow the program to run unhindered.
- Your machine will re-start itself. This is normal.
- A log will be created after your machine reboots. Please post the contents of the log in your next reply.
You can use the following tool to help keep your flash drives clean:
- Copy and paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL.
- Please download Flash Disinfector
- Click here to download Flash Disinfector and save the file (called Flash_Disinfector.exe) to your desktop.
- Double click on the Flash_Disinfector.exe icon to run the program and follow any prompts that may appear.
- The program may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so if prompted.
- Wait until Flash disinfector has finished scanning and then exit the program.
- Reboot your computer.
Please post the OTL log in your next reply.
Also, please scan your system again with OTL, post the scan log created and let me know how you machine is behaving now.
Stormicats
JonTom, are you telling me to remove my husband's Yazak and Rainlender installs? Is there a reason? I need to be able to tell him, if so – he does use those programs. If there's a problem with them, can you suggest some safer alternatives?
JonTom
Hello Stormicats
I asked you to perform an online scan of your system with Kaspersky Online Scanner. This is a reputable tool that has extremely good Malware detection rates.
The scan of your machine reported the following:
The Yazak and Rainlender installer files on your system are infected with Malware.
It is highly likely that the same infected files are present on your flash drive ("Jenn's Flash drive"). For this reason I provided you with Flash disinfector, a tool that you can use on your flash drives to reduce the chances of spreading the infection.
It is very important to make sure that your flash drives are plugged into your machine before running the OTL script (we need to remove the infected files from your computer and from your flash drive), otherwise the next time you plug your flash drive into your computer and run the installer it will infect your system again.
If you have any further questions please feel free to ask and I will try my best to answer. Otherwise, please carry out the instructions in post #23
Yes I am.JonTom, are you telling me to remove my husband's Yazak and Rainlender installs?
There is a very good reason. Please be assured that I would not ask you to remove these files unless it was absolutely necessary.Is there a reason?
I asked you to perform an online scan of your system with Kaspersky Online Scanner. This is a reputable tool that has extremely good Malware detection rates.
The scan of your machine reported the following:
File name / Threat / Threats count
C:\Documents and Settings\Jennifer\.housecall6.6\Quarantine\css4[1].bac_a05992 Infected: not-a-virus:AdWare.Win32.Virtumonde.qvl 1
C:\Documents and Settings\Jennifer\.housecall6.6\Quarantine\A0111850.dll.bac_a05992 Infected: not-a-virus:AdWare.Win32.Virtumonde.qvl 1
C:\Documents and Settings\Jennifer\.housecall6.6\Quarantine\A0112884.dll.bac_a05992 Infected: Trojan.Win32.Monder.gen 1
C:\Documents and Settings\Jennifer\.housecall6.6\Quarantine\geebc.dll.bac_a05992 Infected: not-a-virus:AdWare.Win32.Virtumonde.qvl 1
C:\Documents and Settings\Jennifer\.housecall6.6\Quarantine\A0103366.exe.bac_a05992 Infected: Trojan.Win32.Agent.drm 1
C:\Documents and Settings\Michael\My Documents\Michael's stuff from Jenn's Flash drive\Other\Yazak_Install.exe Infected: Trojan-Dropper.Win32.VB.akpt 1
C:\Documents and Settings\Michael\My Documents\Software\yuchooz_toolbar2.exe Infected: not-a-virus:AdWare.Win32.Mostofate.bu 1
C:\Documents and Settings\Michael\Desktop\Michael's stuff from the laptop\Michael\Other\Yazak_Install.exe Infected: Trojan-Dropper.Win32.VB.akpt 1
C:\Program Files\Rainlendar2\uninst.exe Infected: Trojan-Dropper.Win32.Agent.bske 1
The Yazak and Rainlender installer files on your system are infected with Malware.
It is highly likely that the same infected files are present on your flash drive ("Jenn's Flash drive"). For this reason I provided you with Flash disinfector, a tool that you can use on your flash drives to reduce the chances of spreading the infection.
It is very important to make sure that your flash drives are plugged into your machine before running the OTL script (we need to remove the infected files from your computer and from your flash drive), otherwise the next time you plug your flash drive into your computer and run the installer it will infect your system again.
My knowledge of this type of software is very limited. However, I can always point you in the direction of our software forum once your machine is malware free. I am sure that our software experts will have some good suggestions.can you suggest some safer alternatives?
If you have any further questions please feel free to ask and I will try my best to answer. Otherwise, please carry out the instructions in post #23
Stormicats
Okay, here we go. I missed the step of deleting the C:\Documents and Settings\Jennifer\.housecall6.6\Quarantine folder, and just did it. Sorry if that messes anything up.
Here's the log from the file removal:
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File\Folder C:\Documents and Settings\Michael\My Documents\Michael's stuff from Jenn's Flash drive\Other\Yazak_Install.exe not found.
C:\Documents and Settings\Michael\My Documents\Software\yuchooz_toolbar2.exe moved successfully.
C:\Documents and Settings\Michael\Desktop\Michael's stuff from the laptop\Michael\Other\Yazak_Install.exe moved successfully.
C:\Program Files\Rainlendar2\uninst.exe moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: All Users
User: NetworkService
->Temp folder emptied: 9520 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Jennifer
->Temp folder emptied: 2227 bytes
->Temporary Internet Files folder emptied: 1072420 bytes
->Java cache emptied: 128123 bytes
->FireFox cache emptied: 39990587 bytes
->Flash cache emptied: 4211 bytes
User: Michael
->Temp folder emptied: 3274 bytes
->Temporary Internet Files folder emptied: 1822938 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 53763497 bytes
->Flash cache emptied: 5787 bytes
User: Antonia
->Temp folder emptied: 623 bytes
->Temporary Internet Files folder emptied: 69884 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 12535335 bytes
->Flash cache emptied: 0 bytes
User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 38163 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 1129351601 bytes
Total Files Cleaned = 1,182.00 mb
OTL by OldTimer - Version 3.1.34.0 log created on 03142010_165244
Files\Folders moved on Reboot…
C:\Documents and Settings\Michael\Local Settings\Temporary Internet Files\Content.IE5\UVYCPYS0\print[1].htm moved successfully.
C:\Documents and Settings\Michael\Local Settings\Temporary Internet Files\Content.IE5\2OJ5WQW9\index_f[1].htm moved successfully.
C:\Documents and Settings\Michael\Local Settings\Temporary Internet Files\Content.IE5\PWX3PSKK\user[1].htm moved successfully.
C:\Documents and Settings\Michael\Local Settings\Temporary Internet Files\Content.IE5\NBVBMFCR\a_ds_pg_f[1].htm moved successfully.
File\Folder C:\WINDOWS\temp\JETC246.tmp not found!
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_260.dat not found!
Registry entries deleted on Reboot…
And here's the log after running the flash_disinfector and re-scanning:
OTL logfile created on: 3/14/2010 5:11:38 PM - Run 2
OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\Jennifer\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 67.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.48 Gb Total Space | 2.22 Gb Free Space | 2.99% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 1.88 Gb Total Space | 0.28 Gb Free Space | 14.75% Space Free | Partition Type: FAT
Drive G: | 994.72 Mb Total Space | 469.91 Mb Free Space | 47.24% Space Free | Partition Type: FAT
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: MUSKRAT
Current User Name: Jennifer
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
========== Processes (SafeList) ==========
PRC - [2010/03/06 09:09:06 | 000,553,984 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Jennifer\Desktop\OTL.exe
PRC - [2010/02/20 10:41:48 | 000,117,640 | R— | M] (Symantec Corporation) – C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
PRC - [2008/12/02 15:29:52 | 002,221,352 | —- | M] (Nero AG) – C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
PRC - [2008/10/24 09:14:36 | 000,206,112 | —- | M] (Macrovision Corporation) – C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
PRC - [2008/10/24 09:14:34 | 001,000,736 | —- | M] (Macrovision Corporation) – C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
PRC - [2008/05/03 12:31:46 | 000,071,096 | —- | M] () – C:\Program Files\BurnAware Free\nmsaccessu.exe
PRC - [2008/04/13 19:12:20 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2008/01/29 08:52:32 | 001,424,648 | —- | M] (Uniblue Software) – C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
PRC - [2007/02/28 16:45:22 | 000,507,904 | —- | M] (Brother Industries, Ltd.) – C:\Program Files\Brother\ControlCenter3\BrccMCtl.exe
PRC - [2006/11/03 19:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Defender\MsMpEng.exe
PRC - [2006/04/21 13:26:38 | 005,358,592 | —- | M] (Linksys) – C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WUSB54GSC.exe
PRC - [2005/07/04 16:46:04 | 000,053,307 | —- | M] (GEMTEKS) – C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe
PRC - [2005/06/02 15:54:34 | 000,086,606 | —- | M] (Canon Inc.) – C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2005/01/26 11:47:42 | 000,065,604 | —- | M] (Boingo Wireless, Inc.) – C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
PRC - [2003/11/14 09:50:00 | 000,037,888 | —- | M] (Logitech Inc.) – C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE
PRC - [2002/01/30 18:01:54 | 000,081,920 | —- | M] (Analog Devices, Inc.) – C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
PRC - [2002/01/24 16:10:40 | 000,126,976 | —- | M] (Iomega Corporation) – C:\Program Files\Iomega\AutoDisk\ADService.exe
PRC - [2002/01/14 07:49:38 | 000,073,728 | —- | M] (Iomega Corporation) – C:\Program Files\Iomega\System32\AppServices.exe
========== Modules (SafeList) ==========
MOD - [2010/03/06 09:09:06 | 000,553,984 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Jennifer\Desktop\OTL.exe
MOD - [2010/02/20 10:41:42 | 000,419,696 | R— | M] (Symantec Corporation) – C:\Program Files\Norton 360\Engine\3.8.0.41\asOEHook.dll
MOD - [2008/04/13 19:12:02 | 000,413,696 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msvcp60.dll
MOD - [2008/04/13 19:11:58 | 000,071,680 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msacm32.dll
MOD - [2008/04/13 19:11:48 | 001,852,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\AppPatch\acgenral.dll
MOD - [2003/11/14 09:50:00 | 000,024,064 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\Logitech\Scrolling\LGMSGHK.DLL
MOD - [2003/11/14 09:50:00 | 000,006,144 | —- | M] (Logitech Inc.) – C:\Program Files\Logitech\MouseWare\system\LgWndHk.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Auto | Running] – – (WUSB54GSCSVC)
SRV - File not found [Auto | Stopped] – – (Nero BackItUp Scheduler 4.0)
SRV - File not found [Disabled | Stopped] – – (Iomega Activity Disk2)
SRV - [2010/02/20 10:41:48 | 000,117,640 | R— | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe – (N360)
SRV - [2008/05/03 12:31:46 | 000,071,096 | —- | M] () [Auto | Running] – C:\Program Files\BurnAware Free\nmsaccessu.exe – (NMSAccessU)
SRV - [2008/01/29 16:09:02 | 000,394,704 | —- | M] (Symantec, Inc.) [On_Demand | Stopped] – C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe – (Symantec RemoteAssist)
SRV - [2007/11/30 12:27:22 | 000,558,592 | —- | M] (ReaSoft) [On_Demand | Stopped] – C:\Program Files\ReaConverter 5.5 Pro\rcp_scheduler.exe – (rcp_service)
SRV - [2006/11/03 19:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MsMpEng.exe – (WinDefend)
SRV - [2005/06/02 15:54:34 | 000,086,606 | —- | M] (Canon Inc.) [Auto | Running] – C:\Program Files\Canon\CAL\CALMAIN.exe – (CCALib8)
SRV - [2005/01/26 11:47:42 | 000,065,604 | —- | M] (Boingo Wireless, Inc.) [Auto | Running] – C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe – (EarthLinkMonitor)
SRV - [2002/08/16 13:51:00 | 000,204,876 | —- | M] (Network Associates, Inc.) [On_Demand | Stopped] – C:\WINDOWS\system\epoagent\naimas32.exe – (NAIMAGENT32)
SRV - [2002/01/24 16:10:40 | 000,126,976 | —- | M] (Iomega Corporation) [Auto | Running] – C:\Program Files\Iomega\AutoDisk\ADService.exe – (_IOMEGA_ACTIVE_DISK_SERVICE_)
SRV - [2002/01/14 07:49:38 | 000,073,728 | —- | M] (Iomega Corporation) [Auto | Running] – C:\Program Files\Iomega\System32\AppServices.exe – (Iomega App Services)
========== Driver Services (SafeList) ==========
DRV - [2010/02/21 06:53:40 | 000,102,448 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys – (EraserUtilRebootDrv)
DRV - [2010/02/20 10:41:54 | 000,124,976 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SYMEVENT.SYS – (SymEvent)
DRV - [2010/02/20 10:41:50 | 000,482,432 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\ccHPx86.sys – (ccHP)
DRV - [2010/02/20 10:41:50 | 000,310,320 | —- | M] (Symantec Corporation) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\N360\0308000.029\SYMEFA.SYS – (SymEFA)
DRV - [2010/02/20 10:41:50 | 000,308,272 | —- | M] (Symantec Corporation) [File_System | On_Demand | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SRTSP.SYS – (SRTSP)
DRV - [2010/02/20 10:41:50 | 000,259,632 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\BHDrvx86.sys – (BHDrvx86)
DRV - [2010/02/20 10:41:50 | 000,217,136 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMTDI.SYS – (SYMTDI)
DRV - [2010/02/20 10:41:50 | 000,089,904 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMFW.SYS – (SYMFW)
DRV - [2010/02/20 10:41:50 | 000,043,696 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\N360\0308000.029\SRTSPX.SYS – (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2010/02/20 10:41:50 | 000,036,400 | R— | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SymIM.sys – (SymIMMP)
DRV - [2010/02/20 10:41:50 | 000,036,400 | R— | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\SymIM.sys – (SymIM)
DRV - [2010/02/20 10:41:50 | 000,036,400 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMNDIS.SYS – (SYMNDIS)
DRV - [2010/02/20 10:41:50 | 000,033,072 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMIDS.SYS – (SYMIDS)
DRV - [2010/02/20 04:50:16 | 001,324,720 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100314.003\NAVEX15.SYS – (NAVEX15)
DRV - [2010/02/20 04:50:16 | 000,371,248 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys – (eeCtrl)
DRV - [2010/02/20 04:50:16 | 000,084,912 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100314.003\NAVENG.SYS – (NAVENG)
DRV - [2009/10/28 16:37:24 | 000,329,592 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100310.001\IDSXpx86.sys – (IDSxpx86)
DRV - [2009/03/05 15:21:38 | 000,027,136 | —- | M] (NCH Swift Sound) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nchssvad.sys – (NCHSSVAD)
DRV - [2009/02/18 14:44:00 | 006,308,224 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nv4_mini.sys – (nv)
DRV - [2008/04/13 13:45:30 | 000,010,624 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\gameenum.sys – (gameenum)
DRV - [2008/04/13 11:36:06 | 000,144,384 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Hdaudbus.sys – (HDAudBus)
DRV - [2007/01/26 21:09:40 | 000,068,954 | —- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\jl2005c.sys – (JL2005C)
DRV - [2006/12/12 07:43:18 | 000,052,224 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrSerIf.sys – (BrSerIf)
DRV - [2006/09/18 11:54:48 | 000,016,640 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tbhsd.sys – (tbhsd)
DRV - [2006/09/03 09:53:54 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrUsbSer.sys – (BrUsbSer)
DRV - [2006/07/11 08:38:30 | 000,020,480 | R— | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nvnetbus.sys – (nvnetbus)
DRV - [2006/07/11 08:38:28 | 000,057,856 | R— | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\NVENETFD.sys – (NVENETFD)
DRV - [2006/06/28 17:38:56 | 000,105,088 | —- | M] (NVIDIA Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\nvata.sys – (nvata)
DRV - [2006/06/18 23:37:34 | 000,036,864 | —- | M] (Advanced Micro Devices) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\AmdK8.sys – (AmdK8)
DRV - [2006/01/18 18:41:58 | 000,080,512 | —- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Rtnicxp.sys – (RTL8023xp)
DRV - [2005/09/23 18:56:28 | 003,966,976 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RtkHDAud.sys – (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2004/11/01 14:16:34 | 000,017,536 | R— | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BW2NDIS5.SYS – (BW2NDIS5)
DRV - [2004/10/15 12:50:20 | 000,015,295 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrScnUsb.sys – (BrScnUsb)
DRV - [2004/08/04 00:31:32 | 000,020,992 | —- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\rtl8139.sys – (rtl8139)
DRV - [2004/05/31 21:19:42 | 000,024,971 | R— | M] (Integrated Technology Express, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\iteraid.sys – (iteraid)
DRV - [2003/11/07 03:50:00 | 000,070,798 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LMouFlt2.Sys – (LMouFlt2)
DRV - [2003/11/07 03:50:00 | 000,051,486 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\L8042pr2.Sys – (L8042pr2)
DRV - [2003/10/07 10:42:40 | 000,067,200 | —- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Rtlnic51.sys – (RTL8023)
DRV - [2003/08/26 16:25:14 | 000,207,616 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSFHWBS2.sys – (HSFHWBS2)
DRV - [2003/08/26 16:24:06 | 000,675,840 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_CNXT.sys – (winachsf)
DRV - [2003/08/26 16:22:34 | 001,041,152 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_DP.sys – (HSF_DP)
DRV - [2002/04/15 14:31:50 | 000,107,776 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ac97ich4.sys – (ac97intc) Intel® 82801DB/DBM Audio Driver Service (WDM)
DRV - [2002/01/14 07:49:38 | 000,033,602 | —- | M] (Iomega Corporation) [Kernel | Boot | Running] – C:\WINDOWS\System32\DRIVERS\iomdisk.sys – (iomdisk)
DRV - [2001/08/17 13:28:12 | 000,488,383 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_v124.sys – (V124)
DRV - [2001/08/17 13:28:12 | 000,050,751 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_tone.sys – (Tones)
DRV - [2001/08/17 13:28:10 | 000,542,879 | —- | M] (Conexant) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\hsf_msft.sys – (hsf_msft)
DRV - [2001/08/17 13:28:10 | 000,057,471 | —- | M] (Conexant) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\hsf_samp.sys – (Rksample)
DRV - [2001/08/17 13:28:08 | 000,391,199 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_k56k.sys – (K56)
DRV - [2001/08/17 13:28:06 | 000,289,887 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_fall.sys – (Fallback)
DRV - [2001/08/17 13:28:06 | 000,199,711 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_faxx.sys – (SoftFax)
DRV - [2001/08/17 13:28:06 | 000,115,807 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_fsks.sys – (Fsks)
DRV - [2001/08/17 13:28:04 | 000,067,167 | —- | M] (Conexant) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\hsf_bsc2.sys – (basic2)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie…ton/search.html
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie…ton/search.html
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net/
IE - HKCU\..\URLSearchHook: {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll (EarthLink, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKLM\software\mozilla\Firefox\Extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2010/03/14 17:08:40 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.1\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2004/08/02 07:05:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.1\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2002/09/16 20:25:56 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.6\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2004/08/02 07:05:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.6\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2002/09/16 20:25:56 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.7.1\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2004/08/02 07:05:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.7.1\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2002/09/16 20:25:56 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2006/03/19 08:10:04 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2006/03/19 08:10:02 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2009/10/27 21:24:16 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
[2008/08/31 22:31:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Mozilla\Extensions
[2008/09/24 16:14:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Mozilla\eclipse1\extensions
[2004/07/17 16:31:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Mozilla\Firefox\Profiles\default.bc7\extensions
[2009/07/01 19:42:24 | 000,000,000 | —D | M] (Flashblock) – C:\Documents and Settings\Jennifer\Application Data\Mozilla\Firefox\Profiles\default.bc7\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2006/03/19 08:10:06 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
O1 HOSTS File: ([2009/08/13 04:49:54 | 000,000,021 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.8.0.41\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [LexPPS.exe] C:\WINDOWS\System32\lexpps.exe File not found
O4 - HKLM..\Run: [Logitech Utility] C:\WINDOWS\Logi_MwX.Exe (Logitech Inc.)
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe (Analog Devices, Inc.)
O4 - HKCU..\Run: [ISUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [Uniblue SpyEraser] C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe (Uniblue Software)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Event Reminder.lnk = C:\Program Files\Broderbund\Broderbund Homework Helpers\pmremind.exe (Broderbund Properties LLC)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 36
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF [binary data]
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\New Folder\aim.exe File not found
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} http://www.creative.com/su/ocx/15030/CTSUEng.cab (Creative Software AutoUpdate)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://pcpitstop.com/pcpitstop/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} http://mpijdecd01/wfica.cab (WficaCtl Object)
O16 - DPF: {50F65670-1729-11D2-A51F-0020AFE5D502} http://objects.compuserve.com/chat/RTCChat.cab (ForumChat)
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} http://office.microsoft.com/productupdates/content/opuc.cab (OPUCatalog Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://v5.windowsupdate.microsoft.com/v5co…b?1099769654536 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1124156383368 (MUWebControl Class)
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} http://www.nick.com/common/groove/gx/GrooveAX27.cab (Groove Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} http://mpijdecd01/oncall/msrdp.cab (Microsoft RDP Client Control (redist))
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab (YAddBook Class)
O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} http://hgtv1.view22.com/view22/app/view22rte.cab (View22RTE Class)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} https://disney.go.com/games/downloads/gamem…GameManager.cab (CGameManagerCtrl Object)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D5EBF06F-9BAF-11D0-B12D-00C04FC39CEA} http://info.manpower.com/activex/pcanywhere/pawrem.cab (pcANYWHERE Remote)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://www.creative.com/su/ocx/15030/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Jennifer\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Jennifer\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - C:\eudora\EuShlExt.dll (Qualcomm Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/11/09 14:21:44 | 000,000,035 | —- | M] () - C:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2010/03/14 17:00:56 | 000,000,000 | RHSD | M] - C:\autorun.inf – [ FAT32 ]
O32 - AutoRun File - [2007/04/20 07:50:36 | 000,000,090 | —- | M] () - F:\AUTORUN.INF – [ FAT ]
O32 - AutoRun File - [2010/03/14 17:00:58 | 000,000,000 | RHSD | M] - G:\autorun.inf – [ FAT ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2010/03/14 17:00:55 | 000,000,000 | RHSD | C] – C:\autorun.inf
[2010/03/14 16:50:56 | 000,000,000 | —D | C] – C:\Documents and Settings\Jennifer\My Documents\Downloads
[2010/03/12 06:37:04 | 000,000,000 | -HSD | C] – C:\FOUND.020
[2010/03/11 05:45:54 | 000,000,000 | -HSD | C] – C:\FOUND.019
[2010/03/09 21:24:36 | 003,558,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\moviemk.exe
[2010/03/07 21:07:58 | 000,000,000 | —D | C] – C:\_OTL
[2010/03/07 05:33:58 | 000,000,000 | -HSD | C] – C:\FOUND.018
[2010/03/06 09:09:10 | 000,553,984 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Jennifer\Desktop\OTL.exe
[2010/03/06 06:22:16 | 000,000,000 | -HSD | C] – C:\FOUND.017
[2010/03/05 05:48:30 | 000,000,000 | -HSD | C] – C:\FOUND.016
[2010/03/01 05:03:02 | 000,000,000 | -HSD | C] – C:\FOUND.015
[2010/02/28 09:27:46 | 000,000,000 | -HSD | C] – C:\FOUND.014
[2010/02/27 11:30:10 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Silverlight
[2010/02/27 11:29:56 | 004,938,120 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Jennifer\Desktop\Silverlight.exe
[2010/02/27 05:57:12 | 000,000,000 | -HSD | C] – C:\FOUND.013
[2010/02/26 05:44:02 | 000,000,000 | -HSD | C] – C:\FOUND.012
[2010/02/25 05:42:52 | 000,000,000 | -HSD | C] – C:\FOUND.011
[2010/02/24 05:38:38 | 000,000,000 | -HSD | C] – C:\FOUND.010
[2010/02/23 22:04:06 | 000,000,000 | -HSD | C] – C:\FOUND.009
[2010/02/23 18:41:52 | 000,472,064 | —- | C] ( ) – C:\Documents and Settings\Jennifer\Desktop\RootRepeal.exe
[2010/02/22 09:19:22 | 000,000,000 | —D | C] – C:\WINDOWS\System32\N360_BACKUP
[2010/02/21 11:20:59 | 000,000,000 | —D | C] – C:\Documents and Settings\Jennifer\Application Data\Malwarebytes
[2010/02/21 07:01:04 | 000,000,000 | -HSD | C] – C:\FOUND.008
[2010/02/20 13:43:49 | 000,310,320 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.sys
[2010/02/20 13:43:49 | 000,217,136 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symtdi.sys
[2010/02/20 13:43:49 | 000,089,904 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symfw.sys
[2010/02/20 13:43:49 | 000,048,688 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symndisv.sys
[2010/02/20 13:43:49 | 000,036,400 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symndis.sys
[2010/02/20 13:43:49 | 000,033,072 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symids.sys
[2010/02/20 13:43:48 | 000,482,432 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\cchpx86.sys
[2010/02/20 13:43:48 | 000,308,272 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.sys
[2010/02/20 13:43:48 | 000,043,696 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.sys
[2010/02/20 13:43:47 | 000,259,632 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.sys
[2010/02/20 13:42:51 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\N360\0308000.029
[2010/02/20 10:41:58 | 000,036,400 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SymIM.sys
[2010/02/20 10:41:53 | 000,124,976 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/02/20 10:41:53 | 000,060,808 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2010/02/20 10:41:52 | 000,000,000 | —D | C] – C:\Program Files\Symantec
[2010/02/20 10:41:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\N360
[2010/02/20 10:41:27 | 000,000,000 | —D | C] – C:\Program Files\Norton 360
[2010/02/20 10:40:48 | 000,000,000 | —D | C] – C:\Program Files\NortonInstaller
[2010/02/19 19:42:21 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/02/19 19:42:19 | 000,019,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/02/19 19:42:19 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/02/19 19:42:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/02/19 19:24:25 | 000,000,000 | —D | C] – C:\Program Files\a-squared HiJackFree
[2010/02/18 04:01:00 | 000,000,000 | -HSD | C] – C:\FOUND.007
[2009/08/18 10:31:02 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2009/08/18 10:19:18 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2009/05/04 15:00:28 | 001,687,552 | —- | C] (Individual Software Incorporated) – C:\Program Files\TNGENG.EXE
[2007/12/15 02:20:52 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth
[2007/09/12 15:08:04 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2003/12/29 23:53:59 | 000,192,512 | —- | C] (America Online, Inc.) – C:\Program Files\wndutils.dll
[2003/12/29 23:53:59 | 000,126,976 | —- | C] (America Online, Inc.) – C:\Program Files\xprt.dll
[2003/12/29 23:53:59 | 000,094,208 | —- | C] (America Online, Inc.) – C:\Program Files\ticker.ocm
[2003/12/29 23:53:59 | 000,033,792 | —- | C] (America Online, Inc.) – C:\Program Files\startup.ocm
[2003/12/29 23:53:59 | 000,012,288 | —- | C] (America Online, Inc.) – C:\Program Files\xpcs.dll
[2003/12/29 23:53:59 | 000,008,192 | —- | C] (America Online, Inc.) – C:\Program Files\xptl.dll
[2003/12/29 23:53:58 | 000,339,968 | —- | C] (Netscape Communications Corporation) – C:\Program Files\softokn3.dll
[2003/12/29 23:53:58 | 000,327,680 | —- | C] (Netscape Communications Corporation) – C:\Program Files\nss3.dll
[2003/12/29 23:53:58 | 000,163,840 | —- | C] (America Online, Inc.) – C:\Program Files\oscore.dll
[2003/12/29 23:53:58 | 000,151,552 | —- | C] (America Online, Inc.) – C:\Program Files\oscarui.dll
[2003/12/29 23:53:58 | 000,147,456 | —- | C] (Netscape Communications Corporation) – C:\Program Files\nspr4.dll
[2003/12/29 23:53:58 | 000,110,592 | —- | C] (Netscape Communications Corporation) – C:\Program Files\ssl3.dll
[2003/12/29 23:53:58 | 000,102,400 | —- | C] (Netscape Communications Corporation) – C:\Program Files\smime3.dll
[2003/12/29 23:53:58 | 000,073,728 | —- | C] (America Online, Inc.) – C:\Program Files\OscSrch.ocm
[2003/12/29 23:53:58 | 000,061,440 | —- | C] (America Online, Inc.) – C:\Program Files\osclogin.ocm
[2003/12/29 23:53:58 | 000,056,320 | —- | C] (America Online, Inc.) – C:\Program Files\OscMail.ocm
[2003/12/29 23:53:58 | 000,034,304 | —- | C] (America Online, Inc.) – C:\Program Files\rvapps.ocm
[2003/12/29 23:53:58 | 000,032,768 | —- | C] (America Online, Inc.) – C:\Program Files\proto.ocm
[2003/12/29 23:53:58 | 000,028,672 | —- | C] (Netscape Communications Corporation) – C:\Program Files\plc4.dll
[2003/12/29 23:53:58 | 000,024,576 | —- | C] (Netscape Communications Corporation) – C:\Program Files\plds4.dll
[2003/12/29 23:53:58 | 000,011,776 | —- | C] (America Online, Inc.) – C:\Program Files\osconfig.ocm
[2003/12/29 23:53:58 | 000,011,776 | —- | C] (America Online, Inc.) – C:\Program Files\NTP.ocm
[2003/12/29 23:53:58 | 000,008,192 | —- | C] (America Online, Inc.) – C:\Program Files\popup.ocm
[2003/12/29 23:53:58 | 000,007,168 | —- | C] (America Online, Inc.) – C:\Program Files\oscmain.ocm
[2003/12/29 23:53:57 | 000,184,320 | —- | C] (America Online, Inc.) – C:\Program Files\icbmui.ocm
[2003/12/29 23:53:57 | 000,139,264 | —- | C] (Inner Media, Inc.) – C:\Program Files\dunzip32.dll
[2003/12/29 23:53:57 | 000,102,400 | —- | C] (America Online, Inc.) – C:\Program Files\miscui.ocm
[2003/12/29 23:53:57 | 000,070,656 | —- | C] (America Online) – C:\Program Files\jgtkaol.dll
[2003/12/29 23:53:57 | 000,069,632 | —- | C] (America Online) – C:\Program Files\jgataol.dll
[2003/12/29 23:53:57 | 000,061,440 | —- | C] (America Online, Inc.) – C:\Program Files\coolsocket.dll
[2003/12/29 23:53:57 | 000,061,440 | —- | C] (America Online) – C:\Program Files\jgedaol.dll
[2003/12/29 23:53:57 | 000,057,344 | —- | C] (America Online, Inc.) – C:\Program Files\locateui.ocm
[2003/12/29 23:53:57 | 000,057,344 | —- | C] (America Online, Inc.) – C:\Program Files\coolsecnss.dll
[2003/12/29 23:53:57 | 000,050,176 | —- | C] (Blue Sky Software Corporation) – C:\Program Files\csh.dll
[2003/12/29 23:53:57 | 000,045,056 | —- | C] (America Online) – C:\Program Files\jgseaol.dll
[2003/12/29 23:53:57 | 000,045,056 | —- | C] (America Online) – C:\Program Files\jga0aol.dll
[2003/12/29 23:53:57 | 000,040,960 | —- | C] (America Online) – C:\Program Files\jgs2aol.dll
[2003/12/29 23:53:57 | 000,036,864 | —- | C] (America Online) – C:\Program Files\jga1aol.dll
[2003/12/29 23:53:57 | 000,032,768 | —- | C] (America Online) – C:\Program Files\jgs3aol.dll
[2003/12/29 23:53:57 | 000,006,144 | —- | C] (America Online, Inc.) – C:\Program Files\idlemon.dll
[2003/12/29 23:53:57 | 000,003,584 | —- | C] (America Online, Inc.) – C:\Program Files\coolsos.dll
[2003/12/29 23:53:56 | 001,335,296 | —- | C] (America Online, Inc.) – C:\Program Files\AimRes.dll
[2003/12/29 23:53:56 | 000,196,608 | —- | C] (America Online, Inc.) – C:\Program Files\AimSecondarySvcs.dll
[2003/12/29 23:53:56 | 000,184,320 | —- | C] (America Online, Inc.) – C:\Program Files\coolbos.dll
[2003/12/29 23:53:56 | 000,180,224 | —- | C] (America Online, Inc.) – C:\Program Files\ate32.dll
[2003/12/29 23:53:56 | 000,163,840 | —- | C] (America Online, Inc.) – C:\Program Files\buddyui.ocm
[2003/12/29 23:53:56 | 000,143,360 | —- | C] (America Online, Inc.) – C:\Program Files\AimCoreSvcs.dll
[2003/12/29 23:53:56 | 000,131,072 | —- | C] (America Online, Inc.) – C:\Program Files\ateima32.dll
[2003/12/29 23:53:56 | 000,098,304 | —- | C] (America Online, Inc.) – C:\Program Files\coolbucky.dll
[2003/12/29 23:53:56 | 000,090,112 | —- | C] (America Online, Inc.) – C:\Program Files\ChatUI.ocm
[2003/12/29 23:53:56 | 000,073,728 | —- | C] (America Online, Inc.) – C:\Program Files\coolpeer.dll
[2003/12/29 23:53:56 | 000,054,272 | —- | C] (America Online, Inc.) – C:\Program Files\aimapi.dll
[2003/12/29 23:53:56 | 000,045,056 | —- | C] (America Online, Inc.) – C:\Program Files\coolhttp.dll
[2003/12/29 23:53:56 | 000,041,984 | —- | C] (America Online, Inc.) – C:\Program Files\AlertUI.ocm
[2003/12/29 23:53:56 | 000,024,064 | —- | C] (America Online, Inc.) – C:\Program Files\browse.ocm
[2003/12/29 23:53:56 | 000,018,944 | —- | C] (America Online, Inc.) – C:\Program Files\aimtalk.dll
[2003/12/29 23:53:55 | 000,364,544 | —- | C] (Red Bend Ltd.) – C:\Program Files\dBenderC.dll
[2003/12/29 23:53:55 | 000,069,632 | —- | C] (America Online, Inc.) – C:\Program Files\Patcher.dll
[2003/12/29 23:53:55 | 000,061,440 | —- | C] (America Online, Inc.) – C:\Program Files\aim.exe
[2003/12/29 23:53:55 | 000,049,152 | —- | C] (America Online, Inc.) – C:\Program Files\ProgressDlg.dll
[2003/12/29 23:53:55 | 000,013,312 | —- | C] (America Online, Inc.) – C:\Program Files\Admin.ocm
[2003/12/29 23:53:55 | 000,010,752 | —- | C] (America Online, Inc.) – C:\Program Files\advert.ocm
[2002/09/15 14:57:12 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Help
[2002/09/15 14:57:12 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Help
[2002/09/07 10:23:08 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2002/09/07 10:23:08 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2002/09/07 09:33:56 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2002/09/07 09:33:56 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
========== Files - Modified Within 30 Days ==========
[2010/03/14 17:11:36 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/03/14 17:10:20 | 000,203,077 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2010/03/14 17:09:28 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/03/14 17:08:50 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/03/14 17:08:34 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/03/14 17:08:30 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/03/14 17:05:04 | 009,699,328 | -H– | M] () – C:\Documents and Settings\Jennifer\NTUSER.DAT
[2010/03/14 17:05:04 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\Jennifer\ntuser.ini
[2010/03/14 16:50:52 | 000,132,597 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\Flash_Disinfector.exe
[2010/03/14 16:42:02 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/03/14 10:37:06 | 000,000,468 | —- | M] () – C:\WINDOWS\BRWMARK.INI
[2010/03/14 10:26:52 | 000,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/03/14 09:50:48 | 000,001,535 | —- | M] () – C:\WINDOWS\UserData
[2010/03/14 07:46:38 | 000,590,184 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/03/13 22:12:46 | 000,010,773 | —- | M] () – C:\acrocrashlog.html
[2010/03/10 02:00:02 | 000,000,498 | —- | M] () – C:\WINDOWS\tasks\Norton AntiVirus - Michael - Full System Scan.job
[2010/03/06 09:09:06 | 000,553,984 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Jennifer\Desktop\OTL.exe
[2010/03/04 21:34:28 | 000,020,992 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\cookie newsletter.doc
[2010/02/28 22:25:18 | 000,000,000 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\settings.dat
[2010/02/27 11:29:54 | 004,938,120 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Jennifer\Desktop\Silverlight.exe
[2010/02/27 07:56:06 | 000,001,530 | —- | M] () – C:\WINDOWS\win.ini
[2010/02/24 09:16:06 | 000,181,632 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MpSigStub.exe
[2010/02/23 18:43:42 | 000,000,000 | —- | M] () – C:\Documents and Settings\Jennifer\defogger_reenable
[2010/02/23 18:40:20 | 000,050,477 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\Defogger.exe
[2010/02/23 18:08:22 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/02/21 13:13:16 | 000,293,376 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\cnp3ufl4.exe
[2010/02/21 13:11:54 | 000,005,699 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\Attach.zip
[2010/02/21 12:42:06 | 000,524,288 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\dds.scr
[2010/02/21 11:52:08 | 000,001,804 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton 360.LNK
[2010/02/21 09:37:22 | 000,207,848 | —- | M] () – C:\Documents and Settings\Jennifer\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/02/21 07:04:38 | 000,842,656 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\Cat.DB
[2010/02/20 19:22:22 | 000,024,064 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\wimpy 2.doc
[2010/02/20 13:42:52 | 000,000,172 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\isolate.ini
[2010/02/20 10:41:54 | 000,124,976 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/02/20 10:41:54 | 000,060,808 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2010/02/20 10:41:54 | 000,007,456 | —- | M] () – C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/02/20 10:41:54 | 000,000,806 | —- | M] () – C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/02/20 10:41:50 | 000,482,432 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\cchpx86.sys
[2010/02/20 10:41:50 | 000,310,320 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.sys
[2010/02/20 10:41:50 | 000,308,272 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.sys
[2010/02/20 10:41:50 | 000,259,632 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.sys
[2010/02/20 10:41:50 | 000,217,136 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symtdi.sys
[2010/02/20 10:41:50 | 000,089,904 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symfw.sys
[2010/02/20 10:41:50 | 000,048,688 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symndisv.sys
[2010/02/20 10:41:50 | 000,043,696 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.sys
[2010/02/20 10:41:50 | 000,036,400 | R— | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SymIM.sys
[2010/02/20 10:41:50 | 000,036,400 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symndis.sys
[2010/02/20 10:41:50 | 000,033,072 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symids.sys
[2010/02/20 10:41:44 | 000,107,368 | R— | M] (GEAR Software Inc.) – C:\WINDOWS\System32\GEARAspi.dll
[2010/02/20 10:41:38 | 000,003,373 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.inf
[2010/02/20 10:41:38 | 000,001,752 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.inf
[2010/02/20 10:41:38 | 000,001,562 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNetV.inf
[2010/02/20 10:41:38 | 000,001,561 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.inf
[2010/02/20 10:41:38 | 000,001,388 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.inf
[2010/02/20 10:41:38 | 000,001,382 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.inf
[2010/02/20 10:41:38 | 000,000,640 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.inf
[2010/02/20 10:41:30 | 000,009,412 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\symnetv.cat
[2010/02/20 10:41:30 | 000,009,402 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.cat
[2010/02/20 10:41:30 | 000,007,431 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.cat
[2010/02/20 10:41:30 | 000,007,429 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.cat
[2010/02/20 10:41:30 | 000,007,425 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.cat
[2010/02/20 10:41:30 | 000,007,400 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.CAT
[2010/02/20 10:41:30 | 000,007,383 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.cat
[2010/02/19 19:42:24 | 000,000,600 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/19 19:24:28 | 000,000,614 | —- | M] () – C:\Documents and Settings\All Users\Desktop\a-squared HiJackFree.lnk
[2010/02/19 19:13:34 | 000,003,468 | —- | M] () – C:\WINDOWS\wininit.ini
========== Files Created - No Company Name ==========
[2010/03/14 16:50:59 | 000,132,597 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\Flash_Disinfector.exe
[2010/03/04 21:34:25 | 000,020,992 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\cookie newsletter.doc
[2010/02/28 22:25:16 | 000,000,000 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\settings.dat
[2010/02/23 18:43:41 | 000,000,000 | —- | C] () – C:\Documents and Settings\Jennifer\defogger_reenable
[2010/02/23 18:40:25 | 000,050,477 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\Defogger.exe
[2010/02/21 13:13:25 | 000,293,376 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\cnp3ufl4.exe
[2010/02/21 13:11:53 | 000,005,699 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\Attach.zip
[2010/02/21 12:42:18 | 000,524,288 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\dds.scr
[2010/02/21 07:04:37 | 000,842,656 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\Cat.DB
[2010/02/20 19:22:21 | 000,024,064 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\wimpy 2.doc
[2010/02/20 13:43:49 | 000,009,412 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\symnetv.cat
[2010/02/20 13:43:49 | 000,009,402 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.cat
[2010/02/20 13:43:49 | 000,003,373 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.inf
[2010/02/20 13:43:49 | 000,001,562 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNetV.inf
[2010/02/20 13:43:49 | 000,001,561 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.inf
[2010/02/20 13:43:48 | 000,007,431 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.cat
[2010/02/20 13:43:48 | 000,007,429 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.cat
[2010/02/20 13:43:48 | 000,007,425 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.cat
[2010/02/20 13:43:48 | 000,007,383 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.cat
[2010/02/20 13:43:48 | 000,001,752 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.inf
[2010/02/20 13:43:48 | 000,001,388 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.inf
[2010/02/20 13:43:48 | 000,001,382 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.inf
[2010/02/20 13:43:47 | 000,007,400 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.CAT
[2010/02/20 13:43:47 | 000,000,640 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.inf
[2010/02/20 13:42:51 | 000,000,172 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\isolate.ini
[2010/02/20 10:41:53 | 000,007,456 | —- | C] () – C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/02/20 10:41:53 | 000,000,806 | —- | C] () – C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/02/20 10:41:50 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Norton 360.LNK
[2010/02/19 19:42:23 | 000,000,600 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/19 19:24:25 | 000,000,614 | —- | C] () – C:\Documents and Settings\All Users\Desktop\a-squared HiJackFree.lnk
[2009/05/04 15:00:28 | 000,131,574 | —- | C] () – C:\Program Files\REGISTER.EXE
[2009/05/04 15:00:28 | 000,013,414 | —- | C] () – C:\Program Files\INDEX.DAT
[2009/05/04 15:00:28 | 000,001,082 | —- | C] () – C:\Program Files\PALETTE.BMP
[2009/05/04 15:00:28 | 000,000,648 | —- | C] () – C:\Program Files\START.DAT
[2009/05/04 15:00:28 | 000,000,417 | —- | C] () – C:\Program Files\ITECH.CFG
[2009/05/04 15:00:27 | 000,000,080 | —- | C] () – C:\Program Files\SN.DAT
[2009/04/12 13:24:01 | 000,000,252 | —- | C] () – C:\Documents and Settings\Jennifer\Application Data\default.rss
[2009/04/01 20:54:54 | 000,000,029 | —- | C] () – C:\WINDOWS\Irremote.ini
[2008/04/23 17:21:48 | 000,000,000 | —- | C] () – C:\WINDOWS\game.INI
[2008/03/13 04:44:29 | 000,005,819 | -HS- | C] () – C:\WINDOWS\System32\cbeeg.ini
[2008/03/01 17:26:13 | 013,255,661 | —- | C] () – C:\Program Files\Luxor.zip
[2008/02/18 16:37:40 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\GTW32N50.dll
[2008/02/18 16:37:05 | 000,000,609 | —- | C] () – C:\WINDOWS\System32\WLAN.INI
[2008/02/10 13:13:44 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2008/02/07 23:46:20 | 000,005,837 | —- | C] () – C:\WINDOWS\YAHELITE_IGNORE.INI
[2008/02/04 18:23:10 | 000,693,792 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.DLL
[2007/10/28 12:14:11 | 000,000,026 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2007/10/28 12:14:10 | 000,000,468 | —- | C] () – C:\WINDOWS\BRWMARK.INI
[2007/10/28 12:10:08 | 000,000,846 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2007/10/28 12:10:08 | 000,000,093 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2007/10/28 12:08:35 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\BRTCPCON.DLL
[2007/10/28 12:08:35 | 000,000,114 | —- | C] () – C:\WINDOWS\System32\BRLMW03A.INI
[2007/10/28 12:08:31 | 000,000,086 | —- | C] () – C:\WINDOWS\Brfaxrx.ini
[2007/10/28 12:08:30 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\BrMuSNMP.dll
[2007/10/28 12:07:11 | 000,031,567 | —- | C] () – C:\WINDOWS\maxlink.ini
[2007/09/11 20:16:02 | 000,001,359 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/06/06 05:11:57 | 000,000,026 | —- | C] () – C:\WINDOWS\dvdSanta.INI
[2007/06/06 04:52:00 | 001,216,512 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2007/06/06 04:52:00 | 000,921,600 | —- | C] () – C:\WINDOWS\System32\vorbisenc.dll
[2007/06/06 04:52:00 | 000,237,568 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2007/06/06 04:52:00 | 000,237,568 | —- | C] () – C:\WINDOWS\System32\OggDS.dll
[2007/06/06 04:52:00 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\vorbis.dll
[2007/06/06 04:52:00 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\ogg.dll
[2007/03/30 13:31:20 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\dec_jl6.dll
[2006/08/16 02:35:00 | 001,724,416 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/08/16 02:35:00 | 001,507,328 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/08/16 02:35:00 | 001,101,824 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/08/16 02:35:00 | 000,581,632 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2006/08/16 02:35:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/08/16 02:35:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2006/08/06 12:16:49 | 000,000,034 | —- | C] () – C:\WINDOWS\AuthMgr.INI
[2006/02/16 16:50:29 | 000,002,913 | —- | C] () – C:\WINDOWS\YAHELITE.INI
[2006/01/07 10:43:52 | 000,000,177 | —- | C] () – C:\WINDOWS\kpcms.ini
[2006/01/07 10:43:44 | 000,210,944 | —- | C] () – C:\WINDOWS\System32\MSVCRT10.DLL
[2005/12/26 08:06:30 | 000,000,157 | —- | C] () – C:\WINDOWS\disney.ini
[2005/10/22 11:50:25 | 000,000,885 | —- | C] () – C:\Documents and Settings\Jennifer\Application Data\AdobeDLM.log
[2005/07/12 16:17:58 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2005/05/26 21:33:26 | 000,000,264 | —- | C] () – C:\WINDOWS\System32\winsusrm.dll
[2005/04/13 13:52:45 | 000,000,884 | —- | C] () – C:\WINDOWS\shlfolder.sys
[2005/03/11 11:22:34 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\DXFLib.dll
[2004/11/30 12:12:40 | 000,000,063 | —- | C] () – C:\WINDOWS\mdm.ini
[2004/11/08 07:31:27 | 000,003,468 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/07/14 15:59:42 | 000,006,852 | —- | C] () – C:\WINDOWS\System32\drivers\Vcs.sys
[2004/07/14 12:31:41 | 000,000,016 | —- | C] () – C:\WINDOWS\odbctrap.ini
[2004/07/14 12:11:26 | 000,000,016 | —- | C] () – C:\WINDOWS\backodbc.ini
[2004/05/30 11:02:29 | 000,000,464 | —- | C] () – C:\Program Files\convert.lnk
[2004/02/05 21:10:38 | 000,000,026 | —- | C] () – C:\WINDOWS\earthlink.INI
[2004/01/14 18:50:09 | 000,017,408 | —- | C] () – C:\Documents and Settings\Jennifer\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2003/12/29 23:54:15 | 000,060,879 | —- | C] () – C:\Program Files\INSTALL.LOG
[2003/12/29 23:54:14 | 000,000,515 | —- | C] () – C:\Program Files\Uninstall AOL Instant Messenger.lnk
[2003/12/29 23:53:59 | 000,164,864 | —- | C] () – C:\Program Files\unwise32.exe
[2003/12/29 23:53:59 | 000,116,852 | —- | C] () – C:\Program Files\uninstll.exe
[2003/12/29 23:53:59 | 000,102,400 | —- | C] () – C:\Program Files\xmlparse.dll
[2003/12/29 23:53:59 | 000,005,632 | —- | C] () – C:\Program Files\stats.ocm
[2003/12/29 23:53:59 | 000,001,732 | —- | C] () – C:\Program Files\unwise32.ini
[2003/12/29 23:53:59 | 000,001,370 | —- | C] () – C:\Program Files\stockalert.gif
[2003/12/29 23:53:58 | 000,002,622 | —- | C] () – C:\Program Files\netwait.odl
[2003/12/29 23:53:58 | 000,002,048 | —- | C] () – C:\Program Files\ShareFile.exe
[2003/12/29 23:53:58 | 000,002,048 | —- | C] () – C:\Program Files\SendFile.exe
[2003/12/29 23:53:58 | 000,001,457 | —- | C] () – C:\Program Files\rvappstm.lst
[2003/12/29 23:53:57 | 000,221,184 | —- | C] () – C:\Program Files\inetsocket.dll
[2003/12/29 23:53:57 | 000,015,907 | —- | C] () – C:\Program Files\licens32.txt
[2003/12/29 23:53:57 | 000,001,559 | —- | C] () – C:\Program Files\icbmftvc.lst
[2003/12/29 23:53:56 | 000,477,346 | —- | C] () – C:\Program Files\AIM95.HLP
[2003/12/29 23:53:56 | 000,147,456 | —- | C] () – C:\Program Files\aimauto.exe
[2003/12/29 23:53:56 | 000,001,375 | —- | C] () – C:\Program Files\aimalert.gif
[2003/12/29 23:53:55 | 000,012,312 | —- | C] () – C:\Program Files\aim95.CNT
[2003/12/29 23:53:55 | 000,002,836 | —- | C] () – C:\Program Files\aim.odl
[2003/12/25 09:36:18 | 000,000,049 | —- | C] () – C:\WINDOWS\dmi.ini
[2003/11/30 22:15:08 | 000,000,156 | —- | C] () – C:\WINDOWS\winzip32.ini
[2003/11/11 17:59:19 | 000,000,026 | —- | C] () – C:\WINDOWS\ERegClnt.INI
[2003/08/28 18:20:18 | 000,000,185 | —- | C] () – C:\WINDOWS\QTW.INI
[2003/06/03 11:07:46 | 000,000,345 | —- | C] () – C:\WINDOWS\ka.ini
[2003/04/22 19:42:21 | 000,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2003/01/19 16:18:39 | 000,000,044 | —- | C] () – C:\WINDOWS\liveup.ini
[2002/12/02 14:15:44 | 000,001,979 | —- | C] () – C:\WINDOWS\ACROREAD.INI
[2002/11/28 21:23:20 | 000,122,946 | —- | C] () – C:\WINDOWS\System32\CSGina.dll
[2002/11/11 13:29:59 | 000,001,369 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2002/11/09 14:25:21 | 000,000,053 | —- | C] () – C:\WINDOWS\ASTROP.INI
[2002/11/02 11:24:59 | 000,000,691 | —- | C] () – C:\WINDOWS\hegames.ini
[2002/10/06 10:56:19 | 000,000,060 | —- | C] () – C:\WINDOWS\TLCAPPS.INI
[2002/10/05 21:21:29 | 000,061,678 | —- | C] () – C:\Documents and Settings\Jennifer\Application Data\PFP100JPR.{PB
[2002/10/05 21:21:29 | 000,012,358 | —- | C] () – C:\Documents and Settings\Jennifer\Application Data\PFP100JCM.{PB
[2002/09/24 20:49:50 | 000,000,416 | —- | C] () – C:\WINDOWS\SIERRA.INI
[2002/09/23 10:44:19 | 000,000,037 | —- | C] () – C:\WINDOWS\iltwain.ini
[2002/09/23 10:40:24 | 000,229,376 | —- | C] () – C:\WINDOWS\System32\ISP2000.dll
[2002/09/23 10:40:24 | 000,063,488 | —- | C] () – C:\WINDOWS\System32\Eztw32.dll
[2002/09/21 15:23:45 | 000,000,000 | —- | C] () – C:\WINDOWS\netscape.INI
[2002/09/16 20:22:39 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2002/09/15 17:44:44 | 000,000,000 | —- | C] () – C:\WINDOWS\SETUP32.INI
[2002/09/07 12:51:58 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2002/09/07 12:43:42 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\msssc.dll
[2002/09/07 12:37:49 | 000,262,144 | —- | C] () – C:\WINDOWS\System32\shpshftr.dll
[2002/09/07 11:18:00 | 000,002,080 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2002/03/13 15:46:46 | 000,053,248 | R— | C] () – C:\WINDOWS\System32\zlib.dll
[2001/09/19 13:41:46 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\opcode.dll
[1999/01/22 13:46:58 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL
[1998/08/16 06:00:00 | 000,004,096 | —- | C] () – C:\WINDOWS\System32\sysres.dll
[1997/11/17 17:13:16 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
< End of report >
I am sorry this has been such a slow process. Thank you for sticking with me. I really do appreciate it.
Here's the log from the file removal:
All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File\Folder C:\Documents and Settings\Michael\My Documents\Michael's stuff from Jenn's Flash drive\Other\Yazak_Install.exe not found.
C:\Documents and Settings\Michael\My Documents\Software\yuchooz_toolbar2.exe moved successfully.
C:\Documents and Settings\Michael\Desktop\Michael's stuff from the laptop\Michael\Other\Yazak_Install.exe moved successfully.
C:\Program Files\Rainlendar2\uninst.exe moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: All Users
User: NetworkService
->Temp folder emptied: 9520 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Jennifer
->Temp folder emptied: 2227 bytes
->Temporary Internet Files folder emptied: 1072420 bytes
->Java cache emptied: 128123 bytes
->FireFox cache emptied: 39990587 bytes
->Flash cache emptied: 4211 bytes
User: Michael
->Temp folder emptied: 3274 bytes
->Temporary Internet Files folder emptied: 1822938 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 53763497 bytes
->Flash cache emptied: 5787 bytes
User: Antonia
->Temp folder emptied: 623 bytes
->Temporary Internet Files folder emptied: 69884 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 12535335 bytes
->Flash cache emptied: 0 bytes
User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 38163 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 1129351601 bytes
Total Files Cleaned = 1,182.00 mb
OTL by OldTimer - Version 3.1.34.0 log created on 03142010_165244
Files\Folders moved on Reboot…
C:\Documents and Settings\Michael\Local Settings\Temporary Internet Files\Content.IE5\UVYCPYS0\print[1].htm moved successfully.
C:\Documents and Settings\Michael\Local Settings\Temporary Internet Files\Content.IE5\2OJ5WQW9\index_f[1].htm moved successfully.
C:\Documents and Settings\Michael\Local Settings\Temporary Internet Files\Content.IE5\PWX3PSKK\user[1].htm moved successfully.
C:\Documents and Settings\Michael\Local Settings\Temporary Internet Files\Content.IE5\NBVBMFCR\a_ds_pg_f[1].htm moved successfully.
File\Folder C:\WINDOWS\temp\JETC246.tmp not found!
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_260.dat not found!
Registry entries deleted on Reboot…
And here's the log after running the flash_disinfector and re-scanning:
OTL logfile created on: 3/14/2010 5:11:38 PM - Run 2
OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\Jennifer\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 67.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.48 Gb Total Space | 2.22 Gb Free Space | 2.99% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 1.88 Gb Total Space | 0.28 Gb Free Space | 14.75% Space Free | Partition Type: FAT
Drive G: | 994.72 Mb Total Space | 469.91 Mb Free Space | 47.24% Space Free | Partition Type: FAT
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: MUSKRAT
Current User Name: Jennifer
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
========== Processes (SafeList) ==========
PRC - [2010/03/06 09:09:06 | 000,553,984 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Jennifer\Desktop\OTL.exe
PRC - [2010/02/20 10:41:48 | 000,117,640 | R— | M] (Symantec Corporation) – C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
PRC - [2008/12/02 15:29:52 | 002,221,352 | —- | M] (Nero AG) – C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
PRC - [2008/10/24 09:14:36 | 000,206,112 | —- | M] (Macrovision Corporation) – C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
PRC - [2008/10/24 09:14:34 | 001,000,736 | —- | M] (Macrovision Corporation) – C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
PRC - [2008/05/03 12:31:46 | 000,071,096 | —- | M] () – C:\Program Files\BurnAware Free\nmsaccessu.exe
PRC - [2008/04/13 19:12:20 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2008/01/29 08:52:32 | 001,424,648 | —- | M] (Uniblue Software) – C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
PRC - [2007/02/28 16:45:22 | 000,507,904 | —- | M] (Brother Industries, Ltd.) – C:\Program Files\Brother\ControlCenter3\BrccMCtl.exe
PRC - [2006/11/03 19:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Defender\MsMpEng.exe
PRC - [2006/04/21 13:26:38 | 005,358,592 | —- | M] (Linksys) – C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WUSB54GSC.exe
PRC - [2005/07/04 16:46:04 | 000,053,307 | —- | M] (GEMTEKS) – C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe
PRC - [2005/06/02 15:54:34 | 000,086,606 | —- | M] (Canon Inc.) – C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2005/01/26 11:47:42 | 000,065,604 | —- | M] (Boingo Wireless, Inc.) – C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
PRC - [2003/11/14 09:50:00 | 000,037,888 | —- | M] (Logitech Inc.) – C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE
PRC - [2002/01/30 18:01:54 | 000,081,920 | —- | M] (Analog Devices, Inc.) – C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
PRC - [2002/01/24 16:10:40 | 000,126,976 | —- | M] (Iomega Corporation) – C:\Program Files\Iomega\AutoDisk\ADService.exe
PRC - [2002/01/14 07:49:38 | 000,073,728 | —- | M] (Iomega Corporation) – C:\Program Files\Iomega\System32\AppServices.exe
========== Modules (SafeList) ==========
MOD - [2010/03/06 09:09:06 | 000,553,984 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Jennifer\Desktop\OTL.exe
MOD - [2010/02/20 10:41:42 | 000,419,696 | R— | M] (Symantec Corporation) – C:\Program Files\Norton 360\Engine\3.8.0.41\asOEHook.dll
MOD - [2008/04/13 19:12:02 | 000,413,696 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msvcp60.dll
MOD - [2008/04/13 19:11:58 | 000,071,680 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msacm32.dll
MOD - [2008/04/13 19:11:48 | 001,852,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\AppPatch\acgenral.dll
MOD - [2003/11/14 09:50:00 | 000,024,064 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\Logitech\Scrolling\LGMSGHK.DLL
MOD - [2003/11/14 09:50:00 | 000,006,144 | —- | M] (Logitech Inc.) – C:\Program Files\Logitech\MouseWare\system\LgWndHk.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Auto | Running] – – (WUSB54GSCSVC)
SRV - File not found [Auto | Stopped] – – (Nero BackItUp Scheduler 4.0)
SRV - File not found [Disabled | Stopped] – – (Iomega Activity Disk2)
SRV - [2010/02/20 10:41:48 | 000,117,640 | R— | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe – (N360)
SRV - [2008/05/03 12:31:46 | 000,071,096 | —- | M] () [Auto | Running] – C:\Program Files\BurnAware Free\nmsaccessu.exe – (NMSAccessU)
SRV - [2008/01/29 16:09:02 | 000,394,704 | —- | M] (Symantec, Inc.) [On_Demand | Stopped] – C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe – (Symantec RemoteAssist)
SRV - [2007/11/30 12:27:22 | 000,558,592 | —- | M] (ReaSoft) [On_Demand | Stopped] – C:\Program Files\ReaConverter 5.5 Pro\rcp_scheduler.exe – (rcp_service)
SRV - [2006/11/03 19:19:58 | 000,013,592 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MsMpEng.exe – (WinDefend)
SRV - [2005/06/02 15:54:34 | 000,086,606 | —- | M] (Canon Inc.) [Auto | Running] – C:\Program Files\Canon\CAL\CALMAIN.exe – (CCALib8)
SRV - [2005/01/26 11:47:42 | 000,065,604 | —- | M] (Boingo Wireless, Inc.) [Auto | Running] – C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe – (EarthLinkMonitor)
SRV - [2002/08/16 13:51:00 | 000,204,876 | —- | M] (Network Associates, Inc.) [On_Demand | Stopped] – C:\WINDOWS\system\epoagent\naimas32.exe – (NAIMAGENT32)
SRV - [2002/01/24 16:10:40 | 000,126,976 | —- | M] (Iomega Corporation) [Auto | Running] – C:\Program Files\Iomega\AutoDisk\ADService.exe – (_IOMEGA_ACTIVE_DISK_SERVICE_)
SRV - [2002/01/14 07:49:38 | 000,073,728 | —- | M] (Iomega Corporation) [Auto | Running] – C:\Program Files\Iomega\System32\AppServices.exe – (Iomega App Services)
========== Driver Services (SafeList) ==========
DRV - [2010/02/21 06:53:40 | 000,102,448 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys – (EraserUtilRebootDrv)
DRV - [2010/02/20 10:41:54 | 000,124,976 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SYMEVENT.SYS – (SymEvent)
DRV - [2010/02/20 10:41:50 | 000,482,432 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\ccHPx86.sys – (ccHP)
DRV - [2010/02/20 10:41:50 | 000,310,320 | —- | M] (Symantec Corporation) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\N360\0308000.029\SYMEFA.SYS – (SymEFA)
DRV - [2010/02/20 10:41:50 | 000,308,272 | —- | M] (Symantec Corporation) [File_System | On_Demand | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SRTSP.SYS – (SRTSP)
DRV - [2010/02/20 10:41:50 | 000,259,632 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\BHDrvx86.sys – (BHDrvx86)
DRV - [2010/02/20 10:41:50 | 000,217,136 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMTDI.SYS – (SYMTDI)
DRV - [2010/02/20 10:41:50 | 000,089,904 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMFW.SYS – (SYMFW)
DRV - [2010/02/20 10:41:50 | 000,043,696 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\N360\0308000.029\SRTSPX.SYS – (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2010/02/20 10:41:50 | 000,036,400 | R— | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SymIM.sys – (SymIMMP)
DRV - [2010/02/20 10:41:50 | 000,036,400 | R— | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\SymIM.sys – (SymIM)
DRV - [2010/02/20 10:41:50 | 000,036,400 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMNDIS.SYS – (SYMNDIS)
DRV - [2010/02/20 10:41:50 | 000,033,072 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMIDS.SYS – (SYMIDS)
DRV - [2010/02/20 04:50:16 | 001,324,720 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100314.003\NAVEX15.SYS – (NAVEX15)
DRV - [2010/02/20 04:50:16 | 000,371,248 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys – (eeCtrl)
DRV - [2010/02/20 04:50:16 | 000,084,912 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100314.003\NAVENG.SYS – (NAVENG)
DRV - [2009/10/28 16:37:24 | 000,329,592 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100310.001\IDSXpx86.sys – (IDSxpx86)
DRV - [2009/03/05 15:21:38 | 000,027,136 | —- | M] (NCH Swift Sound) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nchssvad.sys – (NCHSSVAD)
DRV - [2009/02/18 14:44:00 | 006,308,224 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nv4_mini.sys – (nv)
DRV - [2008/04/13 13:45:30 | 000,010,624 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\gameenum.sys – (gameenum)
DRV - [2008/04/13 11:36:06 | 000,144,384 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Hdaudbus.sys – (HDAudBus)
DRV - [2007/01/26 21:09:40 | 000,068,954 | —- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\jl2005c.sys – (JL2005C)
DRV - [2006/12/12 07:43:18 | 000,052,224 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrSerIf.sys – (BrSerIf)
DRV - [2006/09/18 11:54:48 | 000,016,640 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tbhsd.sys – (tbhsd)
DRV - [2006/09/03 09:53:54 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrUsbSer.sys – (BrUsbSer)
DRV - [2006/07/11 08:38:30 | 000,020,480 | R— | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nvnetbus.sys – (nvnetbus)
DRV - [2006/07/11 08:38:28 | 000,057,856 | R— | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\NVENETFD.sys – (NVENETFD)
DRV - [2006/06/28 17:38:56 | 000,105,088 | —- | M] (NVIDIA Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\nvata.sys – (nvata)
DRV - [2006/06/18 23:37:34 | 000,036,864 | —- | M] (Advanced Micro Devices) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\AmdK8.sys – (AmdK8)
DRV - [2006/01/18 18:41:58 | 000,080,512 | —- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Rtnicxp.sys – (RTL8023xp)
DRV - [2005/09/23 18:56:28 | 003,966,976 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RtkHDAud.sys – (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2004/11/01 14:16:34 | 000,017,536 | R— | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BW2NDIS5.SYS – (BW2NDIS5)
DRV - [2004/10/15 12:50:20 | 000,015,295 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrScnUsb.sys – (BrScnUsb)
DRV - [2004/08/04 00:31:32 | 000,020,992 | —- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\rtl8139.sys – (rtl8139)
DRV - [2004/05/31 21:19:42 | 000,024,971 | R— | M] (Integrated Technology Express, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\iteraid.sys – (iteraid)
DRV - [2003/11/07 03:50:00 | 000,070,798 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LMouFlt2.Sys – (LMouFlt2)
DRV - [2003/11/07 03:50:00 | 000,051,486 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\L8042pr2.Sys – (L8042pr2)
DRV - [2003/10/07 10:42:40 | 000,067,200 | —- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Rtlnic51.sys – (RTL8023)
DRV - [2003/08/26 16:25:14 | 000,207,616 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSFHWBS2.sys – (HSFHWBS2)
DRV - [2003/08/26 16:24:06 | 000,675,840 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_CNXT.sys – (winachsf)
DRV - [2003/08/26 16:22:34 | 001,041,152 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\HSF_DP.sys – (HSF_DP)
DRV - [2002/04/15 14:31:50 | 000,107,776 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ac97ich4.sys – (ac97intc) Intel® 82801DB/DBM Audio Driver Service (WDM)
DRV - [2002/01/14 07:49:38 | 000,033,602 | —- | M] (Iomega Corporation) [Kernel | Boot | Running] – C:\WINDOWS\System32\DRIVERS\iomdisk.sys – (iomdisk)
DRV - [2001/08/17 13:28:12 | 000,488,383 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_v124.sys – (V124)
DRV - [2001/08/17 13:28:12 | 000,050,751 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_tone.sys – (Tones)
DRV - [2001/08/17 13:28:10 | 000,542,879 | —- | M] (Conexant) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\hsf_msft.sys – (hsf_msft)
DRV - [2001/08/17 13:28:10 | 000,057,471 | —- | M] (Conexant) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\hsf_samp.sys – (Rksample)
DRV - [2001/08/17 13:28:08 | 000,391,199 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_k56k.sys – (K56)
DRV - [2001/08/17 13:28:06 | 000,289,887 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_fall.sys – (Fallback)
DRV - [2001/08/17 13:28:06 | 000,199,711 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_faxx.sys – (SoftFax)
DRV - [2001/08/17 13:28:06 | 000,115,807 | —- | M] (Conexant) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\hsf_fsks.sys – (Fsks)
DRV - [2001/08/17 13:28:04 | 000,067,167 | —- | M] (Conexant) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\hsf_bsc2.sys – (basic2)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie…ton/search.html
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie…ton/search.html
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net/
IE - HKCU\..\URLSearchHook: {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll (EarthLink, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKLM\software\mozilla\Firefox\Extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2010/03/14 17:08:40 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.1\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2004/08/02 07:05:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.1\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2002/09/16 20:25:56 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.6\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2004/08/02 07:05:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.6\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2002/09/16 20:25:56 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.7.1\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2004/08/02 07:05:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla 1.7.1\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2002/09/16 20:25:56 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2006/03/19 08:10:04 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2006/03/19 08:10:02 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2009/10/27 21:24:16 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
[2008/08/31 22:31:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Mozilla\Extensions
[2008/09/24 16:14:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Mozilla\eclipse1\extensions
[2004/07/17 16:31:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Jennifer\Application Data\Mozilla\Firefox\Profiles\default.bc7\extensions
[2009/07/01 19:42:24 | 000,000,000 | —D | M] (Flashblock) – C:\Documents and Settings\Jennifer\Application Data\Mozilla\Firefox\Profiles\default.bc7\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2006/03/19 08:10:06 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
O1 HOSTS File: ([2009/08/13 04:49:54 | 000,000,021 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.8.0.41\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [LexPPS.exe] C:\WINDOWS\System32\lexpps.exe File not found
O4 - HKLM..\Run: [Logitech Utility] C:\WINDOWS\Logi_MwX.Exe (Logitech Inc.)
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe (Analog Devices, Inc.)
O4 - HKCU..\Run: [ISUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [Uniblue SpyEraser] C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe (Uniblue Software)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Event Reminder.lnk = C:\Program Files\Broderbund\Broderbund Homework Helpers\pmremind.exe (Broderbund Properties LLC)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 36
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF [binary data]
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\New Folder\aim.exe File not found
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} http://www.creative.com/su/ocx/15030/CTSUEng.cab (Creative Software AutoUpdate)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://pcpitstop.com/pcpitstop/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} http://mpijdecd01/wfica.cab (WficaCtl Object)
O16 - DPF: {50F65670-1729-11D2-A51F-0020AFE5D502} http://objects.compuserve.com/chat/RTCChat.cab (ForumChat)
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} http://office.microsoft.com/productupdates/content/opuc.cab (OPUCatalog Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://v5.windowsupdate.microsoft.com/v5co…b?1099769654536 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1124156383368 (MUWebControl Class)
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} http://www.nick.com/common/groove/gx/GrooveAX27.cab (Groove Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} http://mpijdecd01/oncall/msrdp.cab (Microsoft RDP Client Control (redist))
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab (YAddBook Class)
O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} http://hgtv1.view22.com/view22/app/view22rte.cab (View22RTE Class)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} https://disney.go.com/games/downloads/gamem…GameManager.cab (CGameManagerCtrl Object)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D5EBF06F-9BAF-11D0-B12D-00C04FC39CEA} http://info.manpower.com/activex/pcanywhere/pawrem.cab (pcANYWHERE Remote)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://www.creative.com/su/ocx/15030/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Jennifer\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Jennifer\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - C:\eudora\EuShlExt.dll (Qualcomm Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/11/09 14:21:44 | 000,000,035 | —- | M] () - C:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2010/03/14 17:00:56 | 000,000,000 | RHSD | M] - C:\autorun.inf – [ FAT32 ]
O32 - AutoRun File - [2007/04/20 07:50:36 | 000,000,090 | —- | M] () - F:\AUTORUN.INF – [ FAT ]
O32 - AutoRun File - [2010/03/14 17:00:58 | 000,000,000 | RHSD | M] - G:\autorun.inf – [ FAT ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2010/03/14 17:00:55 | 000,000,000 | RHSD | C] – C:\autorun.inf
[2010/03/14 16:50:56 | 000,000,000 | —D | C] – C:\Documents and Settings\Jennifer\My Documents\Downloads
[2010/03/12 06:37:04 | 000,000,000 | -HSD | C] – C:\FOUND.020
[2010/03/11 05:45:54 | 000,000,000 | -HSD | C] – C:\FOUND.019
[2010/03/09 21:24:36 | 003,558,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\moviemk.exe
[2010/03/07 21:07:58 | 000,000,000 | —D | C] – C:\_OTL
[2010/03/07 05:33:58 | 000,000,000 | -HSD | C] – C:\FOUND.018
[2010/03/06 09:09:10 | 000,553,984 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Jennifer\Desktop\OTL.exe
[2010/03/06 06:22:16 | 000,000,000 | -HSD | C] – C:\FOUND.017
[2010/03/05 05:48:30 | 000,000,000 | -HSD | C] – C:\FOUND.016
[2010/03/01 05:03:02 | 000,000,000 | -HSD | C] – C:\FOUND.015
[2010/02/28 09:27:46 | 000,000,000 | -HSD | C] – C:\FOUND.014
[2010/02/27 11:30:10 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Silverlight
[2010/02/27 11:29:56 | 004,938,120 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Jennifer\Desktop\Silverlight.exe
[2010/02/27 05:57:12 | 000,000,000 | -HSD | C] – C:\FOUND.013
[2010/02/26 05:44:02 | 000,000,000 | -HSD | C] – C:\FOUND.012
[2010/02/25 05:42:52 | 000,000,000 | -HSD | C] – C:\FOUND.011
[2010/02/24 05:38:38 | 000,000,000 | -HSD | C] – C:\FOUND.010
[2010/02/23 22:04:06 | 000,000,000 | -HSD | C] – C:\FOUND.009
[2010/02/23 18:41:52 | 000,472,064 | —- | C] ( ) – C:\Documents and Settings\Jennifer\Desktop\RootRepeal.exe
[2010/02/22 09:19:22 | 000,000,000 | —D | C] – C:\WINDOWS\System32\N360_BACKUP
[2010/02/21 11:20:59 | 000,000,000 | —D | C] – C:\Documents and Settings\Jennifer\Application Data\Malwarebytes
[2010/02/21 07:01:04 | 000,000,000 | -HSD | C] – C:\FOUND.008
[2010/02/20 13:43:49 | 000,310,320 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.sys
[2010/02/20 13:43:49 | 000,217,136 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symtdi.sys
[2010/02/20 13:43:49 | 000,089,904 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symfw.sys
[2010/02/20 13:43:49 | 000,048,688 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symndisv.sys
[2010/02/20 13:43:49 | 000,036,400 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symndis.sys
[2010/02/20 13:43:49 | 000,033,072 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symids.sys
[2010/02/20 13:43:48 | 000,482,432 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\cchpx86.sys
[2010/02/20 13:43:48 | 000,308,272 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.sys
[2010/02/20 13:43:48 | 000,043,696 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.sys
[2010/02/20 13:43:47 | 000,259,632 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.sys
[2010/02/20 13:42:51 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\N360\0308000.029
[2010/02/20 10:41:58 | 000,036,400 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SymIM.sys
[2010/02/20 10:41:53 | 000,124,976 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/02/20 10:41:53 | 000,060,808 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2010/02/20 10:41:52 | 000,000,000 | —D | C] – C:\Program Files\Symantec
[2010/02/20 10:41:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\N360
[2010/02/20 10:41:27 | 000,000,000 | —D | C] – C:\Program Files\Norton 360
[2010/02/20 10:40:48 | 000,000,000 | —D | C] – C:\Program Files\NortonInstaller
[2010/02/19 19:42:21 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/02/19 19:42:19 | 000,019,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/02/19 19:42:19 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/02/19 19:42:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/02/19 19:24:25 | 000,000,000 | —D | C] – C:\Program Files\a-squared HiJackFree
[2010/02/18 04:01:00 | 000,000,000 | -HSD | C] – C:\FOUND.007
[2009/08/18 10:31:02 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2009/08/18 10:19:18 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2009/05/04 15:00:28 | 001,687,552 | —- | C] (Individual Software Incorporated) – C:\Program Files\TNGENG.EXE
[2007/12/15 02:20:52 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth
[2007/09/12 15:08:04 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2003/12/29 23:53:59 | 000,192,512 | —- | C] (America Online, Inc.) – C:\Program Files\wndutils.dll
[2003/12/29 23:53:59 | 000,126,976 | —- | C] (America Online, Inc.) – C:\Program Files\xprt.dll
[2003/12/29 23:53:59 | 000,094,208 | —- | C] (America Online, Inc.) – C:\Program Files\ticker.ocm
[2003/12/29 23:53:59 | 000,033,792 | —- | C] (America Online, Inc.) – C:\Program Files\startup.ocm
[2003/12/29 23:53:59 | 000,012,288 | —- | C] (America Online, Inc.) – C:\Program Files\xpcs.dll
[2003/12/29 23:53:59 | 000,008,192 | —- | C] (America Online, Inc.) – C:\Program Files\xptl.dll
[2003/12/29 23:53:58 | 000,339,968 | —- | C] (Netscape Communications Corporation) – C:\Program Files\softokn3.dll
[2003/12/29 23:53:58 | 000,327,680 | —- | C] (Netscape Communications Corporation) – C:\Program Files\nss3.dll
[2003/12/29 23:53:58 | 000,163,840 | —- | C] (America Online, Inc.) – C:\Program Files\oscore.dll
[2003/12/29 23:53:58 | 000,151,552 | —- | C] (America Online, Inc.) – C:\Program Files\oscarui.dll
[2003/12/29 23:53:58 | 000,147,456 | —- | C] (Netscape Communications Corporation) – C:\Program Files\nspr4.dll
[2003/12/29 23:53:58 | 000,110,592 | —- | C] (Netscape Communications Corporation) – C:\Program Files\ssl3.dll
[2003/12/29 23:53:58 | 000,102,400 | —- | C] (Netscape Communications Corporation) – C:\Program Files\smime3.dll
[2003/12/29 23:53:58 | 000,073,728 | —- | C] (America Online, Inc.) – C:\Program Files\OscSrch.ocm
[2003/12/29 23:53:58 | 000,061,440 | —- | C] (America Online, Inc.) – C:\Program Files\osclogin.ocm
[2003/12/29 23:53:58 | 000,056,320 | —- | C] (America Online, Inc.) – C:\Program Files\OscMail.ocm
[2003/12/29 23:53:58 | 000,034,304 | —- | C] (America Online, Inc.) – C:\Program Files\rvapps.ocm
[2003/12/29 23:53:58 | 000,032,768 | —- | C] (America Online, Inc.) – C:\Program Files\proto.ocm
[2003/12/29 23:53:58 | 000,028,672 | —- | C] (Netscape Communications Corporation) – C:\Program Files\plc4.dll
[2003/12/29 23:53:58 | 000,024,576 | —- | C] (Netscape Communications Corporation) – C:\Program Files\plds4.dll
[2003/12/29 23:53:58 | 000,011,776 | —- | C] (America Online, Inc.) – C:\Program Files\osconfig.ocm
[2003/12/29 23:53:58 | 000,011,776 | —- | C] (America Online, Inc.) – C:\Program Files\NTP.ocm
[2003/12/29 23:53:58 | 000,008,192 | —- | C] (America Online, Inc.) – C:\Program Files\popup.ocm
[2003/12/29 23:53:58 | 000,007,168 | —- | C] (America Online, Inc.) – C:\Program Files\oscmain.ocm
[2003/12/29 23:53:57 | 000,184,320 | —- | C] (America Online, Inc.) – C:\Program Files\icbmui.ocm
[2003/12/29 23:53:57 | 000,139,264 | —- | C] (Inner Media, Inc.) – C:\Program Files\dunzip32.dll
[2003/12/29 23:53:57 | 000,102,400 | —- | C] (America Online, Inc.) – C:\Program Files\miscui.ocm
[2003/12/29 23:53:57 | 000,070,656 | —- | C] (America Online) – C:\Program Files\jgtkaol.dll
[2003/12/29 23:53:57 | 000,069,632 | —- | C] (America Online) – C:\Program Files\jgataol.dll
[2003/12/29 23:53:57 | 000,061,440 | —- | C] (America Online, Inc.) – C:\Program Files\coolsocket.dll
[2003/12/29 23:53:57 | 000,061,440 | —- | C] (America Online) – C:\Program Files\jgedaol.dll
[2003/12/29 23:53:57 | 000,057,344 | —- | C] (America Online, Inc.) – C:\Program Files\locateui.ocm
[2003/12/29 23:53:57 | 000,057,344 | —- | C] (America Online, Inc.) – C:\Program Files\coolsecnss.dll
[2003/12/29 23:53:57 | 000,050,176 | —- | C] (Blue Sky Software Corporation) – C:\Program Files\csh.dll
[2003/12/29 23:53:57 | 000,045,056 | —- | C] (America Online) – C:\Program Files\jgseaol.dll
[2003/12/29 23:53:57 | 000,045,056 | —- | C] (America Online) – C:\Program Files\jga0aol.dll
[2003/12/29 23:53:57 | 000,040,960 | —- | C] (America Online) – C:\Program Files\jgs2aol.dll
[2003/12/29 23:53:57 | 000,036,864 | —- | C] (America Online) – C:\Program Files\jga1aol.dll
[2003/12/29 23:53:57 | 000,032,768 | —- | C] (America Online) – C:\Program Files\jgs3aol.dll
[2003/12/29 23:53:57 | 000,006,144 | —- | C] (America Online, Inc.) – C:\Program Files\idlemon.dll
[2003/12/29 23:53:57 | 000,003,584 | —- | C] (America Online, Inc.) – C:\Program Files\coolsos.dll
[2003/12/29 23:53:56 | 001,335,296 | —- | C] (America Online, Inc.) – C:\Program Files\AimRes.dll
[2003/12/29 23:53:56 | 000,196,608 | —- | C] (America Online, Inc.) – C:\Program Files\AimSecondarySvcs.dll
[2003/12/29 23:53:56 | 000,184,320 | —- | C] (America Online, Inc.) – C:\Program Files\coolbos.dll
[2003/12/29 23:53:56 | 000,180,224 | —- | C] (America Online, Inc.) – C:\Program Files\ate32.dll
[2003/12/29 23:53:56 | 000,163,840 | —- | C] (America Online, Inc.) – C:\Program Files\buddyui.ocm
[2003/12/29 23:53:56 | 000,143,360 | —- | C] (America Online, Inc.) – C:\Program Files\AimCoreSvcs.dll
[2003/12/29 23:53:56 | 000,131,072 | —- | C] (America Online, Inc.) – C:\Program Files\ateima32.dll
[2003/12/29 23:53:56 | 000,098,304 | —- | C] (America Online, Inc.) – C:\Program Files\coolbucky.dll
[2003/12/29 23:53:56 | 000,090,112 | —- | C] (America Online, Inc.) – C:\Program Files\ChatUI.ocm
[2003/12/29 23:53:56 | 000,073,728 | —- | C] (America Online, Inc.) – C:\Program Files\coolpeer.dll
[2003/12/29 23:53:56 | 000,054,272 | —- | C] (America Online, Inc.) – C:\Program Files\aimapi.dll
[2003/12/29 23:53:56 | 000,045,056 | —- | C] (America Online, Inc.) – C:\Program Files\coolhttp.dll
[2003/12/29 23:53:56 | 000,041,984 | —- | C] (America Online, Inc.) – C:\Program Files\AlertUI.ocm
[2003/12/29 23:53:56 | 000,024,064 | —- | C] (America Online, Inc.) – C:\Program Files\browse.ocm
[2003/12/29 23:53:56 | 000,018,944 | —- | C] (America Online, Inc.) – C:\Program Files\aimtalk.dll
[2003/12/29 23:53:55 | 000,364,544 | —- | C] (Red Bend Ltd.) – C:\Program Files\dBenderC.dll
[2003/12/29 23:53:55 | 000,069,632 | —- | C] (America Online, Inc.) – C:\Program Files\Patcher.dll
[2003/12/29 23:53:55 | 000,061,440 | —- | C] (America Online, Inc.) – C:\Program Files\aim.exe
[2003/12/29 23:53:55 | 000,049,152 | —- | C] (America Online, Inc.) – C:\Program Files\ProgressDlg.dll
[2003/12/29 23:53:55 | 000,013,312 | —- | C] (America Online, Inc.) – C:\Program Files\Admin.ocm
[2003/12/29 23:53:55 | 000,010,752 | —- | C] (America Online, Inc.) – C:\Program Files\advert.ocm
[2002/09/15 14:57:12 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Help
[2002/09/15 14:57:12 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Help
[2002/09/07 10:23:08 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2002/09/07 10:23:08 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2002/09/07 09:33:56 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2002/09/07 09:33:56 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
========== Files - Modified Within 30 Days ==========
[2010/03/14 17:11:36 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/03/14 17:10:20 | 000,203,077 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2010/03/14 17:09:28 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/03/14 17:08:50 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/03/14 17:08:34 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/03/14 17:08:30 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/03/14 17:05:04 | 009,699,328 | -H– | M] () – C:\Documents and Settings\Jennifer\NTUSER.DAT
[2010/03/14 17:05:04 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\Jennifer\ntuser.ini
[2010/03/14 16:50:52 | 000,132,597 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\Flash_Disinfector.exe
[2010/03/14 16:42:02 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/03/14 10:37:06 | 000,000,468 | —- | M] () – C:\WINDOWS\BRWMARK.INI
[2010/03/14 10:26:52 | 000,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/03/14 09:50:48 | 000,001,535 | —- | M] () – C:\WINDOWS\UserData
[2010/03/14 07:46:38 | 000,590,184 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/03/13 22:12:46 | 000,010,773 | —- | M] () – C:\acrocrashlog.html
[2010/03/10 02:00:02 | 000,000,498 | —- | M] () – C:\WINDOWS\tasks\Norton AntiVirus - Michael - Full System Scan.job
[2010/03/06 09:09:06 | 000,553,984 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Jennifer\Desktop\OTL.exe
[2010/03/04 21:34:28 | 000,020,992 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\cookie newsletter.doc
[2010/02/28 22:25:18 | 000,000,000 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\settings.dat
[2010/02/27 11:29:54 | 004,938,120 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Jennifer\Desktop\Silverlight.exe
[2010/02/27 07:56:06 | 000,001,530 | —- | M] () – C:\WINDOWS\win.ini
[2010/02/24 09:16:06 | 000,181,632 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MpSigStub.exe
[2010/02/23 18:43:42 | 000,000,000 | —- | M] () – C:\Documents and Settings\Jennifer\defogger_reenable
[2010/02/23 18:40:20 | 000,050,477 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\Defogger.exe
[2010/02/23 18:08:22 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/02/21 13:13:16 | 000,293,376 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\cnp3ufl4.exe
[2010/02/21 13:11:54 | 000,005,699 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\Attach.zip
[2010/02/21 12:42:06 | 000,524,288 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\dds.scr
[2010/02/21 11:52:08 | 000,001,804 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton 360.LNK
[2010/02/21 09:37:22 | 000,207,848 | —- | M] () – C:\Documents and Settings\Jennifer\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/02/21 07:04:38 | 000,842,656 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\Cat.DB
[2010/02/20 19:22:22 | 000,024,064 | —- | M] () – C:\Documents and Settings\Jennifer\Desktop\wimpy 2.doc
[2010/02/20 13:42:52 | 000,000,172 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\isolate.ini
[2010/02/20 10:41:54 | 000,124,976 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/02/20 10:41:54 | 000,060,808 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2010/02/20 10:41:54 | 000,007,456 | —- | M] () – C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/02/20 10:41:54 | 000,000,806 | —- | M] () – C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/02/20 10:41:50 | 000,482,432 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\cchpx86.sys
[2010/02/20 10:41:50 | 000,310,320 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.sys
[2010/02/20 10:41:50 | 000,308,272 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.sys
[2010/02/20 10:41:50 | 000,259,632 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.sys
[2010/02/20 10:41:50 | 000,217,136 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symtdi.sys
[2010/02/20 10:41:50 | 000,089,904 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symfw.sys
[2010/02/20 10:41:50 | 000,048,688 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symndisv.sys
[2010/02/20 10:41:50 | 000,043,696 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.sys
[2010/02/20 10:41:50 | 000,036,400 | R— | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SymIM.sys
[2010/02/20 10:41:50 | 000,036,400 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symndis.sys
[2010/02/20 10:41:50 | 000,033,072 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0308000.029\symids.sys
[2010/02/20 10:41:44 | 000,107,368 | R— | M] (GEAR Software Inc.) – C:\WINDOWS\System32\GEARAspi.dll
[2010/02/20 10:41:38 | 000,003,373 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.inf
[2010/02/20 10:41:38 | 000,001,752 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.inf
[2010/02/20 10:41:38 | 000,001,562 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNetV.inf
[2010/02/20 10:41:38 | 000,001,561 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.inf
[2010/02/20 10:41:38 | 000,001,388 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.inf
[2010/02/20 10:41:38 | 000,001,382 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.inf
[2010/02/20 10:41:38 | 000,000,640 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.inf
[2010/02/20 10:41:30 | 000,009,412 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\symnetv.cat
[2010/02/20 10:41:30 | 000,009,402 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.cat
[2010/02/20 10:41:30 | 000,007,431 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.cat
[2010/02/20 10:41:30 | 000,007,429 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.cat
[2010/02/20 10:41:30 | 000,007,425 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.cat
[2010/02/20 10:41:30 | 000,007,400 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.CAT
[2010/02/20 10:41:30 | 000,007,383 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.cat
[2010/02/19 19:42:24 | 000,000,600 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/19 19:24:28 | 000,000,614 | —- | M] () – C:\Documents and Settings\All Users\Desktop\a-squared HiJackFree.lnk
[2010/02/19 19:13:34 | 000,003,468 | —- | M] () – C:\WINDOWS\wininit.ini
========== Files Created - No Company Name ==========
[2010/03/14 16:50:59 | 000,132,597 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\Flash_Disinfector.exe
[2010/03/04 21:34:25 | 000,020,992 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\cookie newsletter.doc
[2010/02/28 22:25:16 | 000,000,000 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\settings.dat
[2010/02/23 18:43:41 | 000,000,000 | —- | C] () – C:\Documents and Settings\Jennifer\defogger_reenable
[2010/02/23 18:40:25 | 000,050,477 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\Defogger.exe
[2010/02/21 13:13:25 | 000,293,376 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\cnp3ufl4.exe
[2010/02/21 13:11:53 | 000,005,699 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\Attach.zip
[2010/02/21 12:42:18 | 000,524,288 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\dds.scr
[2010/02/21 07:04:37 | 000,842,656 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\Cat.DB
[2010/02/20 19:22:21 | 000,024,064 | —- | C] () – C:\Documents and Settings\Jennifer\Desktop\wimpy 2.doc
[2010/02/20 13:43:49 | 000,009,412 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\symnetv.cat
[2010/02/20 13:43:49 | 000,009,402 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.cat
[2010/02/20 13:43:49 | 000,003,373 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.inf
[2010/02/20 13:43:49 | 000,001,562 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNetV.inf
[2010/02/20 13:43:49 | 000,001,561 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.inf
[2010/02/20 13:43:48 | 000,007,431 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.cat
[2010/02/20 13:43:48 | 000,007,429 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.cat
[2010/02/20 13:43:48 | 000,007,425 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.cat
[2010/02/20 13:43:48 | 000,007,383 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.cat
[2010/02/20 13:43:48 | 000,001,752 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.inf
[2010/02/20 13:43:48 | 000,001,388 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.inf
[2010/02/20 13:43:48 | 000,001,382 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.inf
[2010/02/20 13:43:47 | 000,007,400 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.CAT
[2010/02/20 13:43:47 | 000,000,640 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.inf
[2010/02/20 13:42:51 | 000,000,172 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0308000.029\isolate.ini
[2010/02/20 10:41:53 | 000,007,456 | —- | C] () – C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/02/20 10:41:53 | 000,000,806 | —- | C] () – C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/02/20 10:41:50 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Norton 360.LNK
[2010/02/19 19:42:23 | 000,000,600 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/19 19:24:25 | 000,000,614 | —- | C] () – C:\Documents and Settings\All Users\Desktop\a-squared HiJackFree.lnk
[2009/05/04 15:00:28 | 000,131,574 | —- | C] () – C:\Program Files\REGISTER.EXE
[2009/05/04 15:00:28 | 000,013,414 | —- | C] () – C:\Program Files\INDEX.DAT
[2009/05/04 15:00:28 | 000,001,082 | —- | C] () – C:\Program Files\PALETTE.BMP
[2009/05/04 15:00:28 | 000,000,648 | —- | C] () – C:\Program Files\START.DAT
[2009/05/04 15:00:28 | 000,000,417 | —- | C] () – C:\Program Files\ITECH.CFG
[2009/05/04 15:00:27 | 000,000,080 | —- | C] () – C:\Program Files\SN.DAT
[2009/04/12 13:24:01 | 000,000,252 | —- | C] () – C:\Documents and Settings\Jennifer\Application Data\default.rss
[2009/04/01 20:54:54 | 000,000,029 | —- | C] () – C:\WINDOWS\Irremote.ini
[2008/04/23 17:21:48 | 000,000,000 | —- | C] () – C:\WINDOWS\game.INI
[2008/03/13 04:44:29 | 000,005,819 | -HS- | C] () – C:\WINDOWS\System32\cbeeg.ini
[2008/03/01 17:26:13 | 013,255,661 | —- | C] () – C:\Program Files\Luxor.zip
[2008/02/18 16:37:40 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\GTW32N50.dll
[2008/02/18 16:37:05 | 000,000,609 | —- | C] () – C:\WINDOWS\System32\WLAN.INI
[2008/02/10 13:13:44 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2008/02/07 23:46:20 | 000,005,837 | —- | C] () – C:\WINDOWS\YAHELITE_IGNORE.INI
[2008/02/04 18:23:10 | 000,693,792 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.DLL
[2007/10/28 12:14:11 | 000,000,026 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2007/10/28 12:14:10 | 000,000,468 | —- | C] () – C:\WINDOWS\BRWMARK.INI
[2007/10/28 12:10:08 | 000,000,846 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2007/10/28 12:10:08 | 000,000,093 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2007/10/28 12:08:35 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\BRTCPCON.DLL
[2007/10/28 12:08:35 | 000,000,114 | —- | C] () – C:\WINDOWS\System32\BRLMW03A.INI
[2007/10/28 12:08:31 | 000,000,086 | —- | C] () – C:\WINDOWS\Brfaxrx.ini
[2007/10/28 12:08:30 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\BrMuSNMP.dll
[2007/10/28 12:07:11 | 000,031,567 | —- | C] () – C:\WINDOWS\maxlink.ini
[2007/09/11 20:16:02 | 000,001,359 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/06/06 05:11:57 | 000,000,026 | —- | C] () – C:\WINDOWS\dvdSanta.INI
[2007/06/06 04:52:00 | 001,216,512 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2007/06/06 04:52:00 | 000,921,600 | —- | C] () – C:\WINDOWS\System32\vorbisenc.dll
[2007/06/06 04:52:00 | 000,237,568 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2007/06/06 04:52:00 | 000,237,568 | —- | C] () – C:\WINDOWS\System32\OggDS.dll
[2007/06/06 04:52:00 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\vorbis.dll
[2007/06/06 04:52:00 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\ogg.dll
[2007/03/30 13:31:20 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\dec_jl6.dll
[2006/08/16 02:35:00 | 001,724,416 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/08/16 02:35:00 | 001,507,328 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/08/16 02:35:00 | 001,101,824 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/08/16 02:35:00 | 000,581,632 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2006/08/16 02:35:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/08/16 02:35:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2006/08/06 12:16:49 | 000,000,034 | —- | C] () – C:\WINDOWS\AuthMgr.INI
[2006/02/16 16:50:29 | 000,002,913 | —- | C] () – C:\WINDOWS\YAHELITE.INI
[2006/01/07 10:43:52 | 000,000,177 | —- | C] () – C:\WINDOWS\kpcms.ini
[2006/01/07 10:43:44 | 000,210,944 | —- | C] () – C:\WINDOWS\System32\MSVCRT10.DLL
[2005/12/26 08:06:30 | 000,000,157 | —- | C] () – C:\WINDOWS\disney.ini
[2005/10/22 11:50:25 | 000,000,885 | —- | C] () – C:\Documents and Settings\Jennifer\Application Data\AdobeDLM.log
[2005/07/12 16:17:58 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2005/05/26 21:33:26 | 000,000,264 | —- | C] () – C:\WINDOWS\System32\winsusrm.dll
[2005/04/13 13:52:45 | 000,000,884 | —- | C] () – C:\WINDOWS\shlfolder.sys
[2005/03/11 11:22:34 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\DXFLib.dll
[2004/11/30 12:12:40 | 000,000,063 | —- | C] () – C:\WINDOWS\mdm.ini
[2004/11/08 07:31:27 | 000,003,468 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/07/14 15:59:42 | 000,006,852 | —- | C] () – C:\WINDOWS\System32\drivers\Vcs.sys
[2004/07/14 12:31:41 | 000,000,016 | —- | C] () – C:\WINDOWS\odbctrap.ini
[2004/07/14 12:11:26 | 000,000,016 | —- | C] () – C:\WINDOWS\backodbc.ini
[2004/05/30 11:02:29 | 000,000,464 | —- | C] () – C:\Program Files\convert.lnk
[2004/02/05 21:10:38 | 000,000,026 | —- | C] () – C:\WINDOWS\earthlink.INI
[2004/01/14 18:50:09 | 000,017,408 | —- | C] () – C:\Documents and Settings\Jennifer\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2003/12/29 23:54:15 | 000,060,879 | —- | C] () – C:\Program Files\INSTALL.LOG
[2003/12/29 23:54:14 | 000,000,515 | —- | C] () – C:\Program Files\Uninstall AOL Instant Messenger.lnk
[2003/12/29 23:53:59 | 000,164,864 | —- | C] () – C:\Program Files\unwise32.exe
[2003/12/29 23:53:59 | 000,116,852 | —- | C] () – C:\Program Files\uninstll.exe
[2003/12/29 23:53:59 | 000,102,400 | —- | C] () – C:\Program Files\xmlparse.dll
[2003/12/29 23:53:59 | 000,005,632 | —- | C] () – C:\Program Files\stats.ocm
[2003/12/29 23:53:59 | 000,001,732 | —- | C] () – C:\Program Files\unwise32.ini
[2003/12/29 23:53:59 | 000,001,370 | —- | C] () – C:\Program Files\stockalert.gif
[2003/12/29 23:53:58 | 000,002,622 | —- | C] () – C:\Program Files\netwait.odl
[2003/12/29 23:53:58 | 000,002,048 | —- | C] () – C:\Program Files\ShareFile.exe
[2003/12/29 23:53:58 | 000,002,048 | —- | C] () – C:\Program Files\SendFile.exe
[2003/12/29 23:53:58 | 000,001,457 | —- | C] () – C:\Program Files\rvappstm.lst
[2003/12/29 23:53:57 | 000,221,184 | —- | C] () – C:\Program Files\inetsocket.dll
[2003/12/29 23:53:57 | 000,015,907 | —- | C] () – C:\Program Files\licens32.txt
[2003/12/29 23:53:57 | 000,001,559 | —- | C] () – C:\Program Files\icbmftvc.lst
[2003/12/29 23:53:56 | 000,477,346 | —- | C] () – C:\Program Files\AIM95.HLP
[2003/12/29 23:53:56 | 000,147,456 | —- | C] () – C:\Program Files\aimauto.exe
[2003/12/29 23:53:56 | 000,001,375 | —- | C] () – C:\Program Files\aimalert.gif
[2003/12/29 23:53:55 | 000,012,312 | —- | C] () – C:\Program Files\aim95.CNT
[2003/12/29 23:53:55 | 000,002,836 | —- | C] () – C:\Program Files\aim.odl
[2003/12/25 09:36:18 | 000,000,049 | —- | C] () – C:\WINDOWS\dmi.ini
[2003/11/30 22:15:08 | 000,000,156 | —- | C] () – C:\WINDOWS\winzip32.ini
[2003/11/11 17:59:19 | 000,000,026 | —- | C] () – C:\WINDOWS\ERegClnt.INI
[2003/08/28 18:20:18 | 000,000,185 | —- | C] () – C:\WINDOWS\QTW.INI
[2003/06/03 11:07:46 | 000,000,345 | —- | C] () – C:\WINDOWS\ka.ini
[2003/04/22 19:42:21 | 000,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2003/01/19 16:18:39 | 000,000,044 | —- | C] () – C:\WINDOWS\liveup.ini
[2002/12/02 14:15:44 | 000,001,979 | —- | C] () – C:\WINDOWS\ACROREAD.INI
[2002/11/28 21:23:20 | 000,122,946 | —- | C] () – C:\WINDOWS\System32\CSGina.dll
[2002/11/11 13:29:59 | 000,001,369 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2002/11/09 14:25:21 | 000,000,053 | —- | C] () – C:\WINDOWS\ASTROP.INI
[2002/11/02 11:24:59 | 000,000,691 | —- | C] () – C:\WINDOWS\hegames.ini
[2002/10/06 10:56:19 | 000,000,060 | —- | C] () – C:\WINDOWS\TLCAPPS.INI
[2002/10/05 21:21:29 | 000,061,678 | —- | C] () – C:\Documents and Settings\Jennifer\Application Data\PFP100JPR.{PB
[2002/10/05 21:21:29 | 000,012,358 | —- | C] () – C:\Documents and Settings\Jennifer\Application Data\PFP100JCM.{PB
[2002/09/24 20:49:50 | 000,000,416 | —- | C] () – C:\WINDOWS\SIERRA.INI
[2002/09/23 10:44:19 | 000,000,037 | —- | C] () – C:\WINDOWS\iltwain.ini
[2002/09/23 10:40:24 | 000,229,376 | —- | C] () – C:\WINDOWS\System32\ISP2000.dll
[2002/09/23 10:40:24 | 000,063,488 | —- | C] () – C:\WINDOWS\System32\Eztw32.dll
[2002/09/21 15:23:45 | 000,000,000 | —- | C] () – C:\WINDOWS\netscape.INI
[2002/09/16 20:22:39 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2002/09/15 17:44:44 | 000,000,000 | —- | C] () – C:\WINDOWS\SETUP32.INI
[2002/09/07 12:51:58 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2002/09/07 12:43:42 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\msssc.dll
[2002/09/07 12:37:49 | 000,262,144 | —- | C] () – C:\WINDOWS\System32\shpshftr.dll
[2002/09/07 11:18:00 | 000,002,080 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2002/03/13 15:46:46 | 000,053,248 | R— | C] () – C:\WINDOWS\System32\zlib.dll
[2001/09/19 13:41:46 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\opcode.dll
[1999/01/22 13:46:58 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL
[1998/08/16 06:00:00 | 000,004,096 | —- | C] () – C:\WINDOWS\System32\sysres.dll
[1997/11/17 17:13:16 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
< End of report >
I am sorry this has been such a slow process. Thank you for sticking with me. I really do appreciate it.
JonTom
Hello Stormicats
Thank you for the logs.
Your OTL log appears to be clean! Great job Please work your way through the following procedures:
Thank you for the logs.
No problem at all, its what we are here for.I am sorry this has been such a slow process. Thank you for sticking with me. I really do appreciate it.
It does not mess anything up, but please do make sure that you have have removed the folder. It contains infected items that have to go.I missed the step of deleting the C:\Documents and Settings\Jennifer\.housecall6.6\Quarantine folder, and just did it. Sorry if that messes anything up.
If you would like some advice about replacing the software that we had to remove, you can post a question in our general software forum.can you suggest some safer alternatives?
Your OTL log appears to be clean! Great job
Please work your way through the following procedures:- Re-enable your drivers
- To re-enable your Emulation drivers, double click on DeFogger to run the tool.
- The application window will appear.
- Click the Re-enable button to re-enable your CD Emulation drivers.
- Click Yes to continue
- A 'Finished!' message will appear.
- Click OK
- DeFogger will now ask to reboot the machine - click OK
Your Emulation drivers are now re-enabled.
- Download and run the McAfee Removal Tool
- I can see that you have remnants of McAfee present on your system. To remove these, please do the following:
- Download the McAfee Removal Tool by clicking here and save the file (called MCPR.exe) to your desktop.
- Double click on MCPR.exe to run the removal tool.
- Once you receive the "Cleanup Successful" message, restart your computer.
For more information about this removal tool please click here.
- RootRepeal
- You no longer need Rootrepeal. Please delete it from your system.
- Please perform the following cleanup procedure
- Double click on the OTL.exe icon on your desktop to run the program. (Note: If you are running Vista, right-click on the file and choose Run As Administrator).
- Once OTL has opened, click on the "CleanUp!" button.
- Follow any prompts that you receive.
- Please create a new System Restore point
- Click on "Start" > "All Programs" > "Accessories" > "System tools" > "System Restore".
- In the dialogue box that appears select "Create a Restore Point".
- Click "Next".
- Enter a name
- e.g. Clean.
- Click "Create".
- Please purge the old System Restore points from your system
- Malware can sometimes hide in the old System Restore points saved on your computer.
- Follow the steps below to flush the old Restore Points from your system.
- Click on "Start" > "All Programs" > "Accessories" > "System tools" > "Disk Cleanup".
- In the drop down box that appears, select your main drive e.g. "C".
- Click on "OK".
- Your system will perform a quick calculation and then display a dialogue box containing various tabs.
- Select the "More Options" tab.
- At the bottom of this tab, there will be a system restore box with a "Cleanup" button.
- click on the "Cleanup" button, accept the warning and select "OK".
- Your Adobe is out of date
- You can obtain the latest version of Adobe Reader from here, and the latest version of Flash Player from here.
- For more information and links to Adobe updates and downloads click here.
Once you have completed the above steps you should be good to go! If you have any further questions, please feel free to ask.
- Finally, please take the time to read through the information provided below:
Enhance your System Security
- For an excellent list of free anti virus software, free online virus scanners, free spyware detection/removal and free firewalls, click here.
- IMPORTANT! Do not run more than ONE firewall and ONE real-time antivirus on your system at any one time. When using "on demand" scanners, first update the detection signature files, then disconnect from the internet and disable your resident security program before running the scan.
- Once complete, remember to re-engage your resident security before going online.
Web Browsers and Browser Security
Firefox
- Firefox is generally considered to have greater browsing security in comparison to other popular programs. You can download Firefox 3.0 from here.
No-Script
- If you use Firefox as your default browser, No-Script can provide additional security by preventing malicious scripts from being executed on your system.
- You can download No-Script by clicking here.
Internet Explorer
- The newest version of Internet Explorer is available from here.
SpywareBlaster
- If you use Internet Explorer as your default browser, SpywareBlaster would be a valuable addition to your online security.
- SpywareBlaster prevents malicious ActiveX objects from being downloaded onto your system.
- You can download SpywareBlaster by clicking here.
Web of Trust
- When using search engines, Web of Trust provides you with an easy way of telling the good sites from the bad and is compatible with both Firefox and Internet Explorer.
- Coloured symbols are displayed next to search results, giving you more confidence in the links you choose to click on: Green (To go), Yellow (Caution) and Red (Stop).
- You can download Web of Trust by clicking here.
Keep your Software Updated
- Outdated software can sometimes have vulnerabilities that are exploitable by malware.
- Check if there are available updates for your installed software with Secunia's Online Software Inspector by clicking here.
Passwords
- Learn how to create strong passwords by clicking here and test the strength of the passwords you already use by clicking here.
General Reading
- How did I get infected in the first place?
- PC Safety and Security - What do I need?
- How to prevent Malware (by Miekiemoes)
Learn How To Combat Malware
- Would you like to learn how to fight back against malware and help others? Enroll at the What The Tech (Formerly Tom Coyotes) Malware Classroom by clicking here.
Stormicats
JonTom, you have been a gentleman and a scholar and you have incredible amounts of patience. Thank you for all your help!
JonTom
Hello Stormicats
Best wishes
JonTom
Good luck with your writingsince I hope my writing to be my future
You are Very Welcome. Glad we could help.Thank you for all your help
Best wishes
JonTom
extremeboy
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI