Spyware / Malware / Virus Removal

[Resolved] Computer Keeps Shutting Down By Itself

29 min read

Looking for the outcome? Ask AI

annie1963 Topic Starter

Post #1February 28, 2010, 3:00 AM UTC

My computer is slow, freezes FREQUENTLY, and shuts down after giving various error messages. Following is one of the error messages I get;

BCCode:1000008e BCP1:C0000005 BCP2:7263694D BCP3:F0161C44
BCP4:00000000 OSVer:5_1_2600 SP:3_0 Product:256_1

I ran a malwarebytes scan(log included) and it says nothing is infected.

I also ran a hijackthis scan(log included). You will have to interpret that for me!

I have run several virus scans and spyware scans, to no avail. I used avast, spybotSD, lavasoft virus scan, super antispyware, and spyware blaster. Little to no help.

PLEASE HELP!! Thank you for your time and patience in this matter!
Malwarebytes' Anti-Malware 1.35
Database version: 1917
Windows 5.1.2600 Service Pack 3

2/27/2010 6:53:59 PM
mbam-log-2010-02-27 (18-53-59).txt

Scan type: Quick Scan
Objects scanned: 94131
Time elapsed: 6 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:42:21 PM, on 2/27/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fisher-Price\FP3 Player\sspnotifier.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Documents and Settings\Annie\My Documents\matt\ZuneLauncher.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Annie\Local Settings\Temporary Internet Files\Content.IE5\30IRC6T6\HijackThis[1].exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search

Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows

Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: - {C7C9FC25-88B0-4682-9C9F-2608E9117647} - C:\Program Files\BfgBar\bfg.dll
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Big Fish Games Toolbar - {C7C9FC25-88B0-4682-9C9F-2608E9117647} - C:\Program Files\BfgBar\bfg.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SSP Notifier] C:\Program Files\Fisher-Price\FP3 Player\sspnotifier.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Zune Launcher] "c:\Documents and Settings\Annie\My Documents\matt\ZuneLauncher.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows

Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search

& Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) -

http://cdn.scan.onecare.live.com/resource/…lscbase8942.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

http://www.update.microsoft.com/microsoftu…b?1225828672620
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) -

http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

–
End of file - 8411 bytes

inzanity

Post #2March 1, 2010, 6:14 AM UTC

Hello and

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise. This may cause a delay, but I will do my best to keep it as short as possible. I am checking over your log , I will post back shortly with instructions.

inzanity

Post #3March 3, 2010, 12:02 AM UTC

Hi,

I will be helping you on removing malwares on your computer. Log research takes time, so please be patient and I'd be grateful if you would note the following:

The fixes are specific to your problem and should only be used for the issues on this machine.
Do not install/uninstall anything on your computer unless advised.
Do not run any other scanning tools other than those instructed for you to use.
Follow the instructions on the order they are given.
Stay with this thread until advised when your computer is clean. Absence of symptoms does not necessarily mean a clean computer.
If you are being helped regarding this problem on another forum please advice us so that we can close this thread.
And lastly, if you have any questions, please ask before proceeding with any of the advised fixes.

_________________________________________________

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent our tools from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your log is clean.

Open Spybot Search & Destroy.
In the Mode menu click Advanced mode if not already selected.
Choose Yes at the Warning prompt.
Expand the Tools menu.
Click Resident.
Uncheck the Resident TeaTimer (Protection of overall system settings) active. box.
In the File menu click Exit to exit Spybot Search & Destroy.

–Next–

OTL:

Download OTL to your desktop.
Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
Check the boxes beside LOP Check and Purity Check.
Copy and paste the following bold text into the box under Custom Scan

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
/md5stop
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of the OTL.txt and post it with your next reply along with the OTL fix log.

–Next–

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- Sections
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

To post in your next reply:
1. OTL logs.
2. GMER log.

annie1963

Post #4March 4, 2010, 10:58 PM UTC

I ran the scans you asked for. The OTL ran and saved just fine. The first link to Gmer only served to freeze my computer. I finally got it to restart and ran the Gmer scan from the second link you provided (geeksquad I believe). The scan info saved, but then my computer would not allow me to open an internet window. I finally got the computer to restart so I could send these. Sorry it took so long, but this thing just keeps getting worse.

OTL logfile created on: 3/3/2010 7:23:22 PM - Run 1
OTL by OldTimer - Version 3.1.32.0 Folder = C:\Documents and Settings\Annie\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

639.00 Mb Total Physical Memory | 475.00 Mb Available Physical Memory | 74.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 960 1920 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.87 Gb Total Space | 23.02 Gb Free Space | 41.21% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ANNIE-7B392A84C
Current User Name: Annie
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Annie\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\WINDOWS\system32\ZuneBusEnum.exe (Microsoft Corporation)
PRC - C:\Documents and Settings\Annie\My Documents\matt\ZuneLauncher.exe (Microsoft Corporation)
PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\system32\wbem\unsecapp.exe (Microsoft Corporation)
PRC - C:\Program Files\Fisher-Price\FP3 Player\sspnotifier.exe (Fisher-Price, Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Annie\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (ZuneWlanCfgSvc) – C:\WINDOWS\system32\ZuneWlanCfgSvc.exe (Microsoft Corporation)
SRV - (ZuneBusEnum) – C:\WINDOWS\system32\ZuneBusEnum.exe (Microsoft Corporation)
SRV - (ZuneNetworkSvc) – c:\Documents and Settings\Annie\My Documents\matt\ZuneNss.exe (Microsoft Corporation)
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
SRV - (aswUpdSv) – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (zumbus) – C:\WINDOWS\system32\drivers\zumbus.sys (Microsoft Corporation)
DRV - (aswTdi) – C:\WINDOWS\system32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\system32\drivers\aswRdr.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\system32\drivers\aavmker4.sys (ALWIL Software)
DRV - (aswMon2) – C:\WINDOWS\system32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswSP) – C:\WINDOWS\system32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (fssfltr) – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (Secdrv) – C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (Ptilink) – C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)
DRV - (ROOTMODEM) – C:\WINDOWS\system32\drivers\rootmdm.sys (Microsoft Corporation)
DRV - (RimUsb) – C:\WINDOWS\system32\drivers\RimUsb.sys (Research In Motion Limited)
DRV - (RimVSerPort) – C:\WINDOWS\system32\drivers\RimSerial.sys (Research in Motion Ltd)
DRV - (WinUSB) – C:\WINDOWS\system32\drivers\winusb.sys (Microsoft Corporation)
DRV - (Afc) – C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (AN983) – C:\WINDOWS\system32\drivers\an983.sys (ADMtek Incorporated.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (VIAudio) VIA AC'97 Audio Controller (WDM) – C:\WINDOWS\system32\drivers\viaudio.sys (VIA Technologies, Inc.)
DRV - (ms_mpu401) – C:\WINDOWS\system32\drivers\msmpu401.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?ocid=hmlogout
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C0 F0 07 25 22 B4 CA 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[2009/11/08 19:29:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Mozilla\Extensions
[2009/11/08 19:29:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Mozilla\Extensions\[removed]

O1 HOSTS File: ([2007/07/27 05:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (Big Fish Games Toolbar) - {C7C9FC25-88B0-4682-9C9F-2608E9117647} - C:\Program Files\BfgBar\bfg.dll ()
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (&Windows; Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (&Google;) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Big Fish Games Toolbar) - {C7C9FC25-88B0-4682-9C9F-2608E9117647} - C:\Program Files\BfgBar\bfg.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows; Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google;) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [SSP Notifier] C:\Program Files\Fisher-Price\FP3 Player\sspnotifier.exe (Fisher-Price, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Zune Launcher] c:\Documents and Settings\Annie\My Documents\matt\ZuneLauncher.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Annie\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog; This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase8942.cab (Windows Live Safety Center Base Module)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1225828672620 (MUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/11/04 11:05:22 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{b8dbd775-aad5-11dd-a5b9-00121750a3a0}\Shell - "" = AutoRun
O33 - MountPoints2\{b8dbd775-aad5-11dd-a5b9-00121750a3a0}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{b8dbd775-aad5-11dd-a5b9-00121750a3a0}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2008/11/04 12:21:51 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16891891626803200)

========== Files/Folders - Created Within 30 Days ==========

[2010/03/03 19:20:53 | 000,551,424 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Annie\Desktop\OTL.exe
[2010/03/01 23:19:12 | 000,528,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_6.dll
[2010/03/01 23:19:12 | 000,238,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_6.dll
[2010/03/01 23:19:12 | 000,074,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_4.dll
[2010/03/01 23:19:11 | 000,515,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_5.dll
[2010/03/01 23:19:11 | 000,022,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_7.dll
[2010/03/01 23:19:10 | 000,238,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_5.dll
[2010/03/01 23:19:09 | 001,974,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_42.dll
[2010/03/01 23:19:07 | 005,501,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dcsx_42.dll
[2010/03/01 23:19:07 | 000,235,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx11_42.dll
[2010/03/01 23:19:06 | 000,453,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_42.dll
[2010/03/01 23:19:05 | 001,892,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_42.dll
[2010/03/01 23:19:05 | 001,846,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_41.dll
[2010/03/01 23:19:04 | 004,178,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_41.dll
[2010/03/01 23:19:04 | 000,453,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_41.dll
[2010/03/01 23:19:03 | 000,517,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_4.dll
[2010/03/01 23:19:03 | 000,069,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_3.dll
[2010/03/01 23:19:02 | 000,235,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_4.dll
[2010/03/01 23:19:02 | 000,022,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_6.dll
[2010/03/01 23:19:01 | 002,036,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_40.dll
[2010/03/01 23:19:01 | 000,452,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_40.dll
[2010/03/01 23:19:00 | 004,379,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_40.dll
[2010/03/01 23:18:59 | 000,514,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_3.dll
[2010/03/01 23:18:59 | 000,235,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_3.dll
[2010/03/01 23:18:59 | 000,070,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_2.dll
[2010/03/01 23:18:58 | 000,509,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_2.dll
[2010/03/01 23:18:58 | 000,068,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_1.dll
[2010/03/01 23:18:58 | 000,023,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_5.dll
[2010/03/01 23:18:57 | 000,238,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_2.dll
[2010/03/01 23:18:56 | 001,493,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_39.dll
[2010/03/01 23:18:56 | 000,467,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_39.dll
[2010/03/01 23:18:55 | 003,851,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_39.dll
[2010/03/01 23:18:54 | 000,507,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_1.dll
[2010/03/01 23:18:54 | 000,238,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_1.dll
[2010/03/01 23:18:54 | 000,065,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_0.dll
[2010/03/01 23:18:53 | 000,025,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_4.dll
[2010/03/01 23:18:52 | 003,850,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_38.dll
[2010/03/01 23:18:52 | 001,491,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_38.dll
[2010/03/01 23:18:52 | 000,467,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_38.dll
[2010/03/01 23:18:51 | 000,479,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_0.dll
[2010/03/01 23:18:50 | 000,238,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_0.dll
[2010/03/01 23:18:50 | 000,025,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_3.dll
[2010/03/01 23:18:49 | 001,420,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_37.dll
[2010/03/01 23:18:49 | 000,462,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_37.dll
[2010/03/01 23:18:48 | 003,786,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_37.dll
[2010/03/01 23:18:47 | 000,267,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_10.dll
[2010/03/01 23:18:46 | 001,374,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_36.dll
[2010/03/01 23:18:46 | 000,444,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_36.dll
[2010/03/01 23:18:45 | 003,734,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_36.dll
[2010/03/01 23:18:44 | 000,444,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_35.dll
[2010/03/01 23:18:44 | 000,267,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_9.dll
[2010/03/01 23:18:43 | 003,727,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_35.dll
[2010/03/01 23:18:43 | 001,358,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_35.dll
[2010/03/01 23:18:42 | 000,266,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_8.dll
[2010/03/01 23:18:42 | 000,017,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_2.dll
[2010/03/01 23:18:41 | 001,124,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_34.dll
[2010/03/01 23:18:41 | 000,443,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_34.dll
[2010/03/01 23:18:40 | 003,497,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_34.dll
[2010/03/01 23:18:40 | 000,081,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xinput1_3.dll
[2010/03/01 23:18:39 | 000,261,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_7.dll
[2010/03/01 23:18:34 | 001,123,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_33.dll
[2010/03/01 23:18:34 | 000,443,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_33.dll
[2010/03/01 23:18:30 | 003,495,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_33.dll
[2010/03/01 23:18:29 | 000,255,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_6.dll
[2010/03/01 23:18:29 | 000,251,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_5.dll
[2010/03/01 23:18:28 | 002,414,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_31.dll
[2010/03/01 23:18:28 | 000,237,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_4.dll
[2010/03/01 23:18:28 | 000,015,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\x3daudio1_1.dll
[2010/03/01 23:18:27 | 000,236,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_3.dll
[2010/03/01 23:18:27 | 000,062,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xinput1_2.dll
[2010/03/01 23:18:26 | 000,230,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_2.dll
[2010/03/01 23:18:26 | 000,062,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xinput1_1.dll
[2010/03/01 23:18:25 | 000,229,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_1.dll
[2010/03/01 23:18:20 | 002,388,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_30.dll
[2010/03/01 23:18:19 | 000,230,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_0.dll
[2010/03/01 23:18:19 | 000,014,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\x3daudio1_0.dll
[2010/03/01 23:18:18 | 002,332,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_29.dll
[2010/03/01 23:18:18 | 002,323,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_28.dll
[2010/03/01 23:18:17 | 002,319,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_27.dll
[2010/03/01 23:18:17 | 000,061,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xinput9_1_0.dll
[2010/03/01 23:18:16 | 002,297,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_26.dll
[2010/03/01 23:18:15 | 002,337,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_25.dll
[2010/03/01 23:18:12 | 002,222,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_24.dll
[2010/03/01 22:52:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Annie\Desktop\TimeSheets
[2010/02/27 16:54:17 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/02/27 16:54:17 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
[2010/02/27 16:39:33 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2010/02/27 15:25:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\SITEguard
[2010/02/27 15:24:12 | 000,000,000 | —D | C] – C:\Program Files\Common Files\iS3
[2010/02/27 15:24:11 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\STOPzilla!
[2010/02/27 15:00:23 | 000,000,000 | —D | C] – C:\Program Files\Windows Live Safety Center
[2010/02/22 17:50:04 | 000,000,000 | —D | C] – C:\Documents and Settings\Annie\Application Data\Windows Search
[2010/02/22 17:32:02 | 000,000,000 | —D | C] – C:\Documents and Settings\Annie\Tracing
[2010/02/22 17:23:41 | 000,054,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\fssfltr_tdi.sys
[2010/02/22 17:22:59 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Sync Framework
[2010/02/22 17:22:04 | 003,426,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_32.dll
[2010/02/22 17:21:55 | 000,000,000 | —D | C] – C:\Program Files\Microsoft SQL Server Compact Edition
[2010/02/22 17:20:28 | 000,000,000 | —D | C] – C:\Program Files\Microsoft
[2010/02/22 17:20:15 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Documents\microsoft
[2010/02/22 17:20:07 | 000,000,000 | —D | C] – C:\Program Files\Windows Live SkyDrive
[2010/02/22 17:19:41 | 000,000,000 | —D | C] – C:\Program Files\Windows Live
[2010/02/22 16:26:37 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Windows Live
[2010/02/22 16:23:32 | 000,000,000 | —D | C] – C:\WINDOWS\System32\windowspowershell
[2010/02/22 16:23:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Annie\Application Data\Windows Desktop Search
[2010/02/22 16:22:44 | 000,000,000 | —D | C] – C:\Program Files\Windows Desktop Search
[2010/02/22 16:22:44 | 000,000,000 | —D | C] – C:\WINDOWS\System32\GroupPolicy
[2010/02/20 23:45:41 | 000,000,000 | —D | C] – C:\Program Files\Gardenscapes
[2010/02/20 19:27:00 | 000,000,000 | —D | C] – C:\Documents and Settings\Annie\Application Data\TripleHippo
[2010/02/20 14:55:57 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Silverlight
[2010/02/20 10:32:51 | 000,000,000 | —D | C] – C:\Program Files\The Tarot's Misfortune
[2010/02/19 23:32:57 | 000,000,000 | —D | C] – C:\Program Files\Sarah Maribu and the Lost World
[2010/02/19 20:00:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Annie\Application Data\BigFishGames
[2010/02/19 14:40:13 | 000,000,000 | —D | C] – C:\Documents and Settings\Annie\Application Data\ERS G-Studio
[2010/02/13 22:31:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Big Fish Games
[2010/02/11 20:43:06 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Casual Box
[2010/02/11 14:53:10 | 000,000,000 | —D | C] – C:\Program Files\Love Story - Letters from the Past
[2010/02/05 19:08:59 | 000,000,000 | —D | C] – C:\Documents and Settings\Annie\Application Data\HorizonWimba
[2008/11/04 11:14:19 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2008/11/04 11:14:11 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2008/11/04 11:05:15 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2008/11/04 11:05:15 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/03/03 19:20:55 | 000,551,424 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Annie\Desktop\OTL.exe
[2010/03/03 18:53:43 | 000,000,422 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{AEB68CEF-67EE-4441-B472-5989A54E4937}.job
[2010/03/03 18:51:25 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/03/03 17:29:46 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/03/03 17:29:36 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/03/03 17:29:34 | 670,621,696 | -HS- | M] () – C:\hiberfil.sys
[2010/03/02 22:04:53 | 004,980,736 | -H– | M] () – C:\Documents and Settings\Annie\NTUSER.DAT
[2010/03/02 22:04:53 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Annie\ntuser.ini
[2010/03/01 12:23:23 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/02/27 16:54:23 | 000,000,933 | —- | M] () – C:\Documents and Settings\Annie\Desktop\Spybot - Search & Destroy.lnk
[2010/02/27 15:32:39 | 000,000,240 | —- | M] () – C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2010/02/24 23:50:27 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/02/22 19:28:49 | 000,462,830 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/02/22 19:28:49 | 000,078,666 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/02/22 19:28:48 | 000,551,164 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/02/22 17:37:28 | 000,000,617 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Zune.lnk
[2010/02/22 16:22:53 | 000,001,787 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Windows Search.lnk
[2010/02/20 23:46:31 | 000,001,602 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Play Gardenscapes.lnk
[2010/02/20 23:46:31 | 000,001,190 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\More Great Games.lnk
[2010/02/20 10:35:32 | 000,001,688 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Play The Tarot's Misfortune.lnk
[2010/02/19 23:34:54 | 000,001,811 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Play Sarah Maribu and the Lost World.lnk
[2010/02/19 14:55:04 | 000,000,054 | —- | M] () – C:\WINDOWS\System32\rp_stats.dat
[2010/02/19 14:55:04 | 000,000,039 | —- | M] () – C:\WINDOWS\System32\rp_rules.dat
[2010/02/12 21:14:16 | 000,002,626 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2010/02/04 10:01:14 | 000,528,216 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_6.dll
[2010/02/04 10:01:14 | 000,238,936 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_6.dll
[2010/02/04 10:01:14 | 000,074,072 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_4.dll
[2010/02/04 10:01:14 | 000,022,360 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_7.dll
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/02/27 16:54:23 | 000,000,933 | —- | C] () – C:\Documents and Settings\Annie\Desktop\Spybot - Search & Destroy.lnk
[2010/02/27 15:32:39 | 000,000,240 | —- | C] () – C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2010/02/22 16:22:53 | 000,001,787 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Windows Search.lnk
[2010/02/20 23:46:31 | 000,001,602 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Play Gardenscapes.lnk
[2010/02/20 23:46:31 | 000,001,190 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\More Great Games.lnk
[2010/02/20 10:35:32 | 000,001,688 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Play The Tarot's Misfortune.lnk
[2010/02/19 23:34:54 | 000,001,811 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Play Sarah Maribu and the Lost World.lnk
[2009/12/03 21:13:31 | 000,210,944 | —- | C] () – C:\WINDOWS\System32\MSVCRT10.DLL
[2009/11/26 15:06:56 | 000,003,584 | —- | C] () – C:\Documents and Settings\Annie\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/20 18:40:52 | 000,001,584 | —- | C] () – C:\WINDOWS\tefview.ini
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2009/02/20 16:53:17 | 000,000,082 | —- | C] () – C:\Documents and Settings\Annie\Application Data\Ad Annihilator.aap
[2008/12/28 19:10:00 | 000,000,128 | —- | C] () – C:\Documents and Settings\Annie\Local Settings\Application Data\fusioncache.dat
[2008/11/09 12:18:54 | 000,000,097 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2008/11/09 12:16:35 | 000,000,044 | —- | C] () – C:\WINDOWS\EPSCX9000F.ini
[2007/09/27 10:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini

========== LOP Check ==========

[2009/01/03 20:46:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\AdventureChronicles1
[2008/12/08 20:20:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Alawar Stargaze
[2009/08/30 21:15:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Astar Games
[2009/11/26 23:41:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Awem
[2009/10/16 22:08:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Becky Brogan
[2010/02/13 22:31:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Big Fish Games
[2009/11/13 23:15:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\blg
[2010/02/11 20:43:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Casual Box
[2008/11/09 12:31:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\EPSON
[2010/01/08 14:09:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Flood Light Games
[2009/06/24 18:52:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\GAMESHASTRA
[2010/01/27 19:13:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Green Clover Games
[2009/01/11 15:35:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\HiddenSecretsNightmare
[2009/02/25 21:03:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\HoverBee Studios
[2009/09/26 20:31:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\JollyBear
[2009/09/24 22:32:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Merscom
[2009/07/25 16:57:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\MumboJumbo
[2008/12/22 00:11:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\NeptunesAdve
[2009/02/05 23:05:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Nick Chase A Detective Story
[2010/01/26 17:54:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\PlayFirst
[2009/01/04 19:24:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\PlayPond
[2008/11/09 17:02:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Playrix Entertainment
[2009/03/05 21:59:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Playtonium Games
[2009/08/21 18:28:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\PoBros
[2009/08/25 14:29:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Princess Isabella
[2009/09/19 16:35:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Sandlot Games
[2010/02/27 15:25:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\SITEguard
[2009/01/06 22:20:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\SpecialBit
[2010/02/27 16:39:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\STOPzilla!
[2009/08/20 22:25:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\SulusGames
[2010/02/28 23:15:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
[2009/12/30 21:31:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\The Mirror Mysteries
[2009/06/24 13:19:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\UClick
[2009/02/05 12:17:59 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
[2010/01/26 16:51:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
[2009/02/26 20:08:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Abra Academy2
[2009/03/05 17:00:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Ad Annihilator.files
[2009/07/25 22:07:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Aisle 5 Games, Inc
[2009/03/29 21:46:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Anabel
[2009/11/18 22:24:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Artogon
[2009/10/20 22:42:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Awem
[2009/08/31 23:56:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\BfgBar
[2010/02/13 22:31:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Big Fish Games
[2009/11/13 23:15:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\blg
[2009/11/18 18:04:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Blitware
[2009/12/28 19:27:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\BloodTies
[2010/01/22 23:37:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Boomzap
[2009/03/01 23:53:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\BrandX Games
[2009/10/24 22:42:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\casanova
[2009/01/01 14:22:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Cat's Eye Games
[2009/02/12 22:37:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Coyotes Tale
[2009/11/06 23:37:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Dekovir
[2010/01/16 16:12:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Dragon Altar Games
[2009/11/20 20:08:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\EleFun Games
[2009/11/11 22:16:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\ElementalsTheMagicKey
[2009/10/17 00:12:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Enki Games
[2009/06/28 22:29:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Enlightenus
[2009/06/26 14:20:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\EPSON
[2010/02/19 21:24:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\ERS G-Studio
[2009/01/08 17:20:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Fabulous Finds
[2009/06/13 18:23:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Faerie Solitaire
[2008/12/28 19:09:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Fisher-Price
[2010/01/08 14:09:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Flood Light Games
[2009/02/26 00:29:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Friday's games
[2009/07/25 18:23:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Games
[2009/06/24 18:52:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\GAMESHASTRA
[2010/01/27 19:13:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Green Clover Games
[2009/11/08 20:15:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\GTM_Bodie
[2010/01/08 13:08:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Harmonic Flow
[2009/04/27 14:57:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\HiT-MM
[2009/01/18 21:25:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Home Sweet Home Christmas
[2010/02/05 19:08:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\HorizonWimba
[2009/01/04 20:25:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\IOMediaSupport6SZZ001s
[2009/06/09 21:59:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\IronCode
[2009/12/27 23:22:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\JoyBits
[2009/11/07 15:41:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Lazy Turtle Games
[2008/11/09 12:27:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Leadertech
[2010/01/21 21:40:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\LimeWire
[2009/04/03 22:55:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Lost in the City
[2009/08/28 13:33:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\MA
[2009/10/08 19:24:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Magic Academy
[2009/10/17 00:11:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Magic Academy 2
[2009/08/25 20:15:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Meridian93
[2009/09/24 22:32:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Merscom
[2010/01/04 22:29:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Orneon
[2009/07/31 18:21:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Peace Craft
[2009/10/16 23:10:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Ph03nixNewMedia
[2010/01/26 17:54:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\PlayFirst
[2009/08/21 18:28:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\PoBros
[2008/12/11 11:24:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Pogo Games
[2009/06/24 22:37:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Private Moon Studios
[2009/01/30 01:14:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\RobinsonCrusoe
[2009/03/02 01:30:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\SerpentOfIsis
[2009/04/20 09:31:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Skunk Studios
[2009/10/28 19:43:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Smith Micro
[2009/01/04 20:25:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Spinapse
[2009/08/20 22:25:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\SulusGames
[2009/02/05 12:16:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\SuperAdBlocker.com
[2009/01/04 20:25:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Suspects and Clues Players
[2009/01/04 20:25:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Suspects and Clues Prefs
[2009/10/25 22:49:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\TikisLab
[2010/02/20 19:27:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\TripleHippo
[2009/05/10 20:28:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Twintale Entertainment
[2009/06/24 13:19:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\UClick
[2009/11/17 22:28:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\URSE Games
[2009/07/23 08:31:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\V-Games
[2009/02/05 21:58:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\ViquaSoft
[2010/02/22 16:23:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Windows Desktop Search
[2010/02/22 17:50:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Windows Search
[2009/01/16 07:51:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\World-LooM
[2010/01/05 19:54:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\YoudaGames
[2010/03/01 12:23:23 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2009/11/18 18:04:12 | 000,000,456 | —- | M] () – C:\WINDOWS\Tasks\Driver Robot.job
[2010/03/03 18:53:43 | 000,000,422 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{AEB68CEF-67EE-4441-B472-5989A54E4937}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2007/07/27 05:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/11/04 13:49:26 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/11/04 13:49:26 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 11:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 11:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >
[2007/07/27 05:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/11/04 13:49:26 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/11/04 13:49:26 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 11:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 11:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2007/07/27 05:00:00 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 17:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 17:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2007/07/27 05:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/13 17:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 17:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2007/07/27 05:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2007/07/27 05:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 17:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 17:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 94 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:E3CEEC4C
@Alternate Data Stream - 245 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:270A3983
@Alternate Data Stream - 241 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F8F070C2
@Alternate Data Stream - 239 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:2495D97A
@Alternate Data Stream - 236 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0EC7A545
@Alternate Data Stream - 234 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:E7B4296D
@Alternate Data Stream - 233 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F84B8DB5
@Alternate Data Stream - 233 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:1181620C
@Alternate Data Stream - 232 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A02025CE
@Alternate Data Stream - 231 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:9E76E7F3
@Alternate Data Stream - 231 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:4A448DB2
@Alternate Data Stream - 228 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:700B9342
@Alternate Data Stream - 228 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:57176330
@Alternate Data Stream - 227 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7FD903D7
@Alternate Data Stream - 227 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6710EF08
@Alternate Data Stream - 226 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:FC4EA67C
@Alternate Data Stream - 225 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:DB77E2C4
@Alternate Data Stream - 225 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:B8384DB6
@Alternate Data Stream - 224 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:918B7566
@Alternate Data Stream - 224 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:89CF6F9C
@Alternate Data Stream - 223 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:97C4F81F
@Alternate Data Stream - 223 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:8944C195
@Alternate Data Stream - 222 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:90865A6D
@Alternate Data Stream - 221 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6F55EB66
@Alternate Data Stream - 221 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6E86D926
@Alternate Data Stream - 221 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:69AF9D20
@Alternate Data Stream - 220 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A58B27C9
@Alternate Data Stream - 220 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:8DF68137
@Alternate Data Stream - 219 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C5E2BAEE
@Alternate Data Stream - 218 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6425A235
@Alternate Data Stream - 217 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:CF61CE5A
@Alternate Data Stream - 217 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6AF67671
@Alternate Data Stream - 217 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:614F17D3
@Alternate Data Stream - 216 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:FC8FFA4E
@Alternate Data Stream - 216 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:E80802C7
@Alternate Data Stream - 216 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D2397415
@Alternate Data Stream - 216 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:8E7F155B
@Alternate Data Stream - 216 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:370E4EFB
@Alternate Data Stream - 216 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:2871B698
@Alternate Data Stream - 216 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0AC32449
@Alternate Data Stream - 215 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D48500F8
@Alternate Data Stream - 215 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7A0FEE87
@Alternate Data Stream - 215 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5EF1AD34
@Alternate Data Stream - 215 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:56C17A93
@Alternate Data Stream - 214 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:85C3B823
@Alternate Data Stream - 214 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:80F63EC3
@Alternate Data Stream - 213 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:870649A4
@Alternate Data Stream - 213 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:3E06C78F
@Alternate Data Stream - 213 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0F0A5896
@Alternate Data Stream - 212 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D92485C9
@Alternate Data Stream - 212 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:8247A199
@Alternate Data Stream - 212 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7B52659E
@Alternate Data Stream - 212 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:61AF2B29
@Alternate Data Stream - 212 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:24FECE50
@Alternate Data Stream - 212 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:1B9E79B3
@Alternate Data Stream - 211 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:53DF59D1
@Alternate Data Stream - 210 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:BB3CECA4
@Alternate Data Stream - 210 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:42509EA1
@Alternate Data Stream - 209 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:EC0A74A1
@Alternate Data Stream - 209 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D226A81A
@Alternate Data Stream - 209 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C67CB31A
@Alternate Data Stream - 209 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:BD9F7E4E
@Alternate Data Stream - 209 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:B845F669
@Alternate Data Stream - 209 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:89A5891E
@Alternate Data Stream - 209 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0D3CE40A
@Alternate Data Stream - 207 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:BD27B7FC
@Alternate Data Stream - 207 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:732E4B72
@Alternate Data Stream - 207 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:55E1514E
@Alternate Data Stream - 206 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F14D1F80
@Alternate Data Stream - 206 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C22674B6
@Alternate Data Stream - 206 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:848CC150
@Alternate Data Stream - 205 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:569CEE83
@Alternate Data Stream - 204 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F3EFA8A8
@Alternate Data Stream - 203 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:FB97DB91
@Alternate Data Stream - 202 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C9FD258B
@Alternate Data Stream - 201 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A3B8F70C
@Alternate Data Stream - 201 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:66AA0486
@Alternate Data Stream - 201 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:598E0FFA
@Alternate Data Stream - 201 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:3559A02E
@Alternate Data Stream - 201 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:1DEE6B65
@Alternate Data Stream - 201 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0ED4AC2F
@Alternate Data Stream - 200 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7547DA5B
@Alternate Data Stream - 199 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:FDDD8917
@Alternate Data Stream - 199 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D507B5A8
@Alternate Data Stream - 199 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C07A6A6B
@Alternate Data Stream - 199 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6F1F66C0
@Alternate Data Stream - 199 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:4FE30352
@Alternate Data Stream - 199 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:3FD496E1
@Alternate Data Stream - 199 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:3D36932D
@Alternate Data Stream - 198 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:70E897B5
@Alternate Data Stream - 198 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5E9B629B
@Alternate Data Stream - 198 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:52641FBE
@Alternate Data Stream - 197 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A688EF17
@Alternate Data Stream - 197 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:177313FB
@Alternate Data Stream - 195 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F67AAFC5
@Alternate Data Stream - 195 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:BE7C4A02
@Alternate Data Stream - 194 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:462A7C89
@Alternate Data Stream - 194 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0459F5AC
@Alternate Data Stream - 193 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A3750BE5
@Alternate Data Stream - 192 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:88E3B9B6
@Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:123A86B5
@Alternate Data Stream - 141 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:E29063FF
@Alternate Data Stream - 141 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0F38B460
@Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5025C6E4
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:147A3409
@Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D93AABC7
@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:62525FE7
@Alternate Data Stream - 131 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:EF5B3572
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7E082023
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:2D3CB929
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:FED25C29
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F8435088
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:BDCD8531
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A3251D01
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:27790C06
@Alternate Data Stream - 128 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0E22C5DB
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:627B7F7C
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:98982C88
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:71612023
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:9B9B0020
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:92A815D8
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5C321E34
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:38B32B54
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C2151AD3
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:96C9689F
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:3178E4B6
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:EF794BCD
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C10635F6
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:971DCCE2
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:48977386
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A2865730
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6017A808
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:3B812EE0
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:315B4A13
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C928F3BE
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C15969A6
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:4F8B72C9
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:4DCAC4BC
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:2B1EA607
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0DAD93FF
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:04CE8640
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A7DA2BCD
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:DF0BC727
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:55374FBA
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:4A1628E5
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:BBCB4421
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:27D1368B
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:059167AF
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:12D2EB9C
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:4CF76F21
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F8EBAB95
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:9DF07E8F
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:EEB25EAE
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7AA6FC81
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5C6EBC69
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:EE39C93C
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:E91ADC66
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C63E7DE2
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:667565EE
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:40D8F125
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5D351BC6
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:28CDD861
@Alternate Data Stream - 101 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A4ACFB14
@Alternate Data Stream - 101 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:02A78DF6
< End of report >
OTL Extras logfile created on: 3/3/2010 7:23:22 PM - Run 1
OTL by OldTimer - Version 3.1.32.0 Folder = C:\Documents and Settings\Annie\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

639.00 Mb Total Physical Memory | 475.00 Mb Available Physical Memory | 74.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 960 1920 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.87 Gb Total Space | 23.02 Gb Free Space | 41.21% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ANNIE-7B392A84C
Current User Name: Annie
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.exe [@ = exefile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE" = C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote – (Microsoft Corporation)
"C:\Program Files\Blubster\Blubster.exe" = C:\Program Files\Blubster\Blubster.exe:*:Enabled:Blubster – File not found
"C:\WINDOWS\system32\LEXPPS.EXE" = C:\WINDOWS\system32\LEXPPS.EXE:*:Disabled:LEXPPS.EXE – (Lexmark International, Inc.)
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent – File not found
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire – File not found
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync – (Microsoft Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0076E1AC-9E7B-4B9F-A62A-4CC9511AD8E3}" = Zune Language Pack (FR)
"{0D6D96F4-0CAF-4522-B05F-70A88EDECDFD}" = ArcSoft Print Creations
"{139E303E-1050-497F-98B1-9AE87B15C463}" = Windows Live Family Safety
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1CA2E5E4-F4FE-44B4-95E9-77523FB95838}" = EPSON Stylus CX9400Fax Series Scanner Driver Update
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{370BCBBA-67D7-4535-ADCD-58CD1C8DEC99}" = Zune Language Pack (DE)
"{40EC6323-497B-44DA-8A88-74578622D9B3}" = Zune Language Pack (IT)
"{44170B31-F47A-4FF9-9D77-382D1FE2A728}" = FP3 Player
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{48AFBB60-8CF5-4605-BB04-704DD8702B80}" = VZAccess Manager for RIM
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{888FFC82-688D-46AB-A776-B417885432B6}" = Zune
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D03E7B00-CA85-4684-9321-1888873C34BD}" = ArcSoft PhotoImpression 6
"{D454287E-4755-4477-9CAF-3F5B918AA2D1}" = ID EDS Provider Electronic Solutions
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{ECA1A3B6-898F-4DCE-9F04-714CF3BA126B}" = Adobe Flash Player 10 Plugin
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EE4ACABF-531E-419A-9225-B8E0FA4955AF}" = Zune Language Pack (ES)
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{FA237125-51FF-408C-8BB8-30C2B3DFFF9C}" = Windows Resource Kit Tools
"Ad-Aware" = Ad-Aware
"Adobe Acrobat 4.0" = Adobe Acrobat 4.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"avast!" = avast! Antivirus
"BFG-4 Elements" = 4 Elements
"BFG-Adventure Chronicles - The Search for Lost Treasure" = Adventure Chronicles: The Search for Lost Treasure
"BFG-Adventures of Robinson Crusoe" = Adventures of Robinson Crusoe
"BFG-Agatha Christie - Dead Man's Folly" = Agatha Christie: Dead Man's Folly
"BFG-Age Of Oracles - Taras Journey" = Age Of Oracles: Tara`s Journey
"BFG-AGON - The London Scene" = AGON - The London Scene
"BFG-Alabama Smith - Escape from Pompeii" = Alabama Smith: Escape from Pompeii
"BFG-Anka" = Anka
"BFG-Annabel" = Annabel
"BFG-Autumn's Treasures - The Jade Coin" = Autumn's Treasures: The Jade Coin
"BFG-Azada" = Azada ™
"BFG-Azada - Ancient Magic" = Azada : Ancient Magic
"BfgBar" = Big Fish Games Toolbar 2.0
"BFG-Blood Ties" = Blood Ties
"BFG-Bob the Builder - Can Do Zoo" = Bob the Builder - Can Do Zoo
"BFGC" = Big Fish Games: Game Manager
"BFG-Cake Shop 2" = Cake Shop 2
"BFG-Cassandra's Journey - The Legacy of Nostradamus" = Cassandra's Journey: The Legacy of Nostradamus
"BFG-Cassandra's Journey 2 - The Fifth Sun of Nostradamus" = Cassandra's Journey 2: The Fifth Sun of Nostradamus
"BFG-Cate West - The Velvet Keys" = Cate West - The Velvet Keys
"BFG-Coyote's Tale - Fire and Water" = Coyote`s Tale: Fire and Water
"BFG-Cradle of Persia" = Cradle of Persia
"BFG-Curse of the Pharaoh - Napoleons Secret" = Curse of the Pharaoh: Napoleon's Secret ™
"BFG-Curse of the Pharaoh - The Quest for Nefertiti" = Curse of the Pharaoh: The Quest for Nefertiti
"BFG-Department 42 - The Mystery of the Nine" = Department 42: The Mystery of the Nine
"BFG-Diego`s Dinosaur Adventure" = Diego`s Dinosaur Adventure
"BFG-Diego`s Safari Adventure" = Diego`s Safari Adventure
"BFG-Dr. Lynch - Grave Secrets" = Dr. Lynch: Grave Secrets
"BFG-Drawn - The Painted Tower" = Drawn: The Painted Tower ™
"BFG-Dream Chronicles" = Dream Chronicles
"BFG-Dream Chronicles - The Chosen Child" = Dream Chronicles: The Chosen Child
"BFG-Dream Chronicles 2 - The Eternal Maze" = Dream Chronicles ™ 2: The Eternal Maze
"BFG-Echoes of the Past - Royal House of Stone" = Echoes of the Past: Royal House of Stone
"BFG-Enlightenus" = Enlightenus
"BFG-Escape Rosecliff Island" = Escape Rosecliff Island
"BFG-Fabulous Finds" = Fabulous Finds
"BFG-Faerie Solitaire" = Faerie Solitaire
"BFG-Fix-it-up - Kates Adventure" = Fix-it-up: Kate`s Adventure
"BFG-Flux Family Secrets - The Ripple Effect" = Flux Family Secrets: The Ripple Effect
"BFG-Gardenscapes" = Gardenscapes
"BFG-Green Moon" = Green Moon
"BFG-Grimm's Hatchery" = Grimm's Hatchery
"BFG-Herods Lost Tomb" = National Geographic ™ presents: Herod's Lost Tomb
"BFG-Hidden Expedition - Amazon" = Hidden Expedition: Amazon ™
"BFG-Hidden in Time - Mirror Mirror" = Hidden in Time: Mirror Mirror
"BFG-Hidden Mysteries - Buckingham Palace" = Hidden Mysteries: Buckingham Palace ™
"BFG-Hidden Mysteries - Civil War" = Hidden Mysteries: Civil War
"BFG-Hidden Secrets - The Nightmare" = Hidden Secrets: The Nightmare
"BFG-Hide and Secret" = Hide and Secret
"BFG-Keys to Manhattan" = Keys to Manhattan
"BFG-Kuros" = Kuros
"BFG-Laura Jones and the Gates of Good and Evil" = Laura Jones and the Gates of Good and Evil
"BFG-Laura Jones and the Secret Legacy of Nikola Tesla" = Laura Jones and the Secret Legacy of Nikola Tesla
"BFG-Liong - The Lost Amulets" = Liong: The Lost Amulets
"BFG-Lost City of Z - Special Edition" = Lost City of Z: Special Edition
"BFG-Lost in the City" = Lost in the City
"BFG-Lost Realms - Legacy of the Sun Princess" = Lost Realms: Legacy of the Sun Princess
"BFG-Lost Realms - The Curse of Babylon" = Lost Realms: The Curse of Babylon
"BFG-Love Story - Letters from the Past" = Love Story: Letters from the Past
"BFG-Magic Academy" = Magic Academy
"BFG-Magic Encyclopedia" = Magic Encyclopedia
"BFG-Magic Encyclopedia - Moon Light" = Magic Encyclopedia: Moon Light
"BFG-Magic Farm - Ultimate Flower" = Magic Farm: Ultimate Flower
"BFG-Mahjong Towers Eternity" = Mahjong Towers Eternity
"BFG-Margrave Manor 2 - Lost Ship" = Margrave Manor 2: Lost Ship
"BFG-Megaplex Madness - Now Playing" = Megaplex Madness: Now Playing ™
"BFG-Mr. Biscuits - The Case of the Ocean Pearl" = Mr. Biscuits: The Case of the Ocean Pearl
"BFG-My Kingdom for the Princess" = My Kingdom for the Princess
"BFG-Mystery Age - The Imperial Staff" = Mystery Age: The Imperial Staff
"BFG-Mystery Case Files - Dire Grove" = Mystery Case Files®: Dire Grove™
"BFG-Mystery Case Files - Huntsville - Detective Training" = Mystery Case Files: Huntsville - Detective Training
"BFG-Mystery Case Files - Return to Ravenhearst" = Mystery Case Files: Return to Ravenhearst ™
"BFG-Mystery of Unicorn Castle" = Mystery of Unicorn Castle
"BFG-Mystery Stories - Berlin Nights" = Mystery Stories: Berlin Nights
"BFG-Mystic Inn" = Mystic Inn
"BFG-Natalie Brooks - Secrets of Treasure House" = Natalie Brooks: Secrets of Treasure House
"BFG-Natalie Brooks - The Treasures of the Lost Kingdom" = Natalie Brooks: The Treasures of the Lost Kingdom
"BFG-Neptunes Secret" = Neptune's Secret
"BFG-Pahelika - Secret Legends" = Pahelika: Secret Legends
"BFG-Penny Dreadfuls - Sweeney Todd Collector's Edition" = Penny Dreadfuls: Sweeney Todd Collector`s Edition
"BFG-Princess Isabella - A Witch's Curse" = Princess Isabella: A Witch's Curse
"BFG-Rangy Lil's Wild West Adventure" = Rangy Lil's Wild West Adventure
"BFG-Rhianna Ford - The Da Vinci Letter" = Rhianna Ford & The Da Vinci Letter
"BFG-Safecracker" = Safecracker
"BFG-Samantha Swift and the Golden Touch" = Samantha Swift and the Golden Touch
"BFG-Samantha Swift and the Hidden Roses of Athena" = Samantha Swift and the Hidden Roses of Athena
"BFG-Sarah Maribu and the Lost World" = Sarah Maribu and the Lost World
"BFG-Spa Mania" = Spa Mania
"BFG-Syberia" = Syberia
"BFG-Syberia II" = Syberia II
"BFG-The Hardy Boys - The Perfect Crime" = The Hardy Boys - The Perfect Crime
"BFG-The Legend of Crystal Valley" = The Legend of Crystal Valley
"BFG-The Mirror Mysteries" = The Mirror Mysteries
"BFG-The Mystery of the Crystal Portal" = The Mystery of the Crystal Portal
"BFG-The Return of Monte Cristo" = The Return of Monte Cristo
"BFG-The Serpent of Isis" = The Serpent of Isis ™
"BFG-The Spirit of Wandering - The Legend" = The Spirit of Wandering: The Legend
"BFG-The Stone of Destiny" = The Stone of Destiny
"BFG-The Tarot's Misfortune" = The Tarot's Misfortune
"BFG-The Treasures of Mystery Island" = The Treasures of Mystery Island
"BFG-Treasure Seekers - The Enchanted Canvases" = Treasure Seekers: The Enchanted Canvases
"BFG-Treasure Seekers - Visions of Gold" = Treasure Seekers: Visions of Gold ™
"BFG-Undiscovered World - The Incan Sun" = Undiscovered World: The Incan Sun
"BFG-Veronica Rivers - Portals to the Unknown" = Veronica Rivers: Portals to the Unknown
"BFG-Veronica Rivers - The Order Of Conspiracy" = Veronica Rivers: The Order Of Conspiracy
"BFG-Youda Legend - The Curse of the Amsterdam Diamond" = Youda Legend: The Curse of the Amsterdam Diamond
"BFG-Youda Legend - The Golden Bird of Paradise" = Youda Legend: The Golden Bird of Paradise
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"EPSON Printer and Utilities" = EPSON Printer Software
"EPSON Scanner" = EPSON Scan
"Free 3GP Video Converter_is1" = Free 3GP Video Converter version 3.2
"HijackThis" = HijackThis 2.0.2
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{44170B31-F47A-4FF9-9D77-382D1FE2A728}" = FP3 Player
"Kazoo Player" = Kazoo Player
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MusicManager" = Music Manager
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Silent Package Run-Time Sample" = EPSON CX9400 User's Guide
"SpywareBlaster_is1" = SpywareBlaster 4.2
"TEFView_is1" = TEFView 2.65
"Uninstall_is1" = Uninstall 1.0.0.1
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"winusb0100" = Microsoft WinUsb 1.0
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01009" = Microsoft User-Mode Driver Framework Feature Pack 1.9
"Zune" = Zune

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 12/26/2009 12:38:52 AM | Computer Name = ANNIE-7B392A84C | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://cdn.pch.com/media/v2/Products/Group…330x330_001.jpg failed,
0000A413.

Error - 12/26/2009 12:38:52 AM | Computer Name = ANNIE-7B392A84C | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://cdn.pch.com/media/v2/Products/Group…330x330_001.jpg failed,
0000A413.

Error - 12/26/2009 12:38:54 AM | Computer Name = ANNIE-7B392A84C | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://cdn.pch.com/media/v2/Products/Group…330x330_001.jpg failed,
0000A413.

Error - 12/26/2009 12:38:54 AM | Computer Name = ANNIE-7B392A84C | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://cdn.pch.com/media/v2/Products/Group…330x330_001.jpg failed,
0000A413.

Error - 12/26/2009 12:38:56 AM | Computer Name = ANNIE-7B392A84C | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://cdn.pch.com/media/v2/Products/Group…330x330_001.jpg failed,
0000A413.

Error - 12/26/2009 12:38:56 AM | Computer Name = ANNIE-7B392A84C | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://cdn.pch.com/media/v2/Products/Group…330x330_001.jpg failed,
0000A413.

Error - 12/26/2009 12:38:56 AM | Computer Name = ANNIE-7B392A84C | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://cdn.pch.com/media/v2/Products/Group…330x330_001.jpg failed,
0000A413.

Error - 12/26/2009 12:38:57 AM | Computer Name = ANNIE-7B392A84C | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://a1708.g.akamai.net/7/1708/5303/2653…header_save.jpg
failed, 0000A413.

Error - 12/26/2009 12:38:57 AM | Computer Name = ANNIE-7B392A84C | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://cdn.pch.com/media/v2/Products/Group…330x330_001.jpg failed,
0000A413.

Error - 12/26/2009 12:38:58 AM | Computer Name = ANNIE-7B392A84C | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://cdn.pch.com/media/v2/Products/Group…330x330_001.jpg failed,
0000A413.

[ Application Events ]
Error - 2/27/2010 8:39:16 PM | Computer Name = ANNIE-7B392A84C | Source = PerfNet | ID = 2004
Description = Unable to open the Server service. Server performance data will not
be returned. Error code returned is in data DWORD 0.

Error - 2/28/2010 12:25:00 AM | Computer Name = ANNIE-7B392A84C | Source = PerfNet | ID = 2004
Description = Unable to open the Server service. Server performance data will not
be returned. Error code returned is in data DWORD 0.

Error - 3/1/2010 2:08:25 AM | Computer Name = ANNIE-7B392A84C | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module flash10e.ocx, version 10.0.45.2, fault address 0x0023fdde.

Error - 3/1/2010 1:40:38 PM | Computer Name = ANNIE-7B392A84C | Source = Application Hang | ID = 1002
Description = Hanging application escndv.exe, version 3.2.1.1, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 3/1/2010 1:44:09 PM | Computer Name = ANNIE-7B392A84C | Source = Windows Search Service | ID = 3013
Description = The entry in
the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 3/1/2010 1:44:09 PM | Computer Name = ANNIE-7B392A84C | Source = Windows Search Service | ID = 3013
Description = The entry in the
hash map cannot be updated. Context: Application, SystemIndex Catalog Details: A
device attached to the system is not functioning. (0x8007001f)

Error - 3/3/2010 12:14:13 AM | Computer Name = ANNIE-7B392A84C | Source = PerfNet | ID = 2004
Description = Unable to open the Server service. Server performance data will not
be returned. Error code returned is in data DWORD 0.

Error - 3/3/2010 12:19:47 AM | Computer Name = ANNIE-7B392A84C | Source = Application Error | ID = 1000
Description = Faulting application teatimer.exe, version 1.6.6.32, faulting module
teatimer.exe, version 1.6.6.32, fault address 0x0006e66e.

Error - 3/3/2010 10:16:10 PM | Computer Name = ANNIE-7B392A84C | Source = Application Hang | ID = 1002
Description = Hanging application SpybotSD.exe, version 1.6.2.46, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 3/3/2010 10:17:04 PM | Computer Name = ANNIE-7B392A84C | Source = Application Hang | ID = 1002
Description = Hanging application SpybotSD.exe, version 1.6.2.46, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 3/3/2010 12:16:29 AM | Computer Name = ANNIE-7B392A84C | Source = Service Control Manager | ID = 7000
Description = The avast! Web Scanner service failed to start due to the following
error: %%1053

Error - 3/3/2010 12:17:04 AM | Computer Name = ANNIE-7B392A84C | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the avast! Web Scanner service
to connect.

Error - 3/3/2010 12:17:04 AM | Computer Name = ANNIE-7B392A84C | Source = Service Control Manager | ID = 7000
Description = The avast! Web Scanner service failed to start due to the following
error: %%1053

Error - 3/3/2010 12:17:35 AM | Computer Name = ANNIE-7B392A84C | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the avast! Web Scanner service
to connect.

Error - 3/3/2010 12:17:35 AM | Computer Name = ANNIE-7B392A84C | Source = Service Control Manager | ID = 7000
Description = The avast! Web Scanner service failed to start due to the following
error: %%1053

Error - 3/3/2010 12:18:06 AM | Computer Name = ANNIE-7B392A84C | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the avast! Web Scanner service
to connect.

Error - 3/3/2010 12:18:06 AM | Computer Name = ANNIE-7B392A84C | Source = Service Control Manager | ID = 7000
Description = The avast! Web Scanner service failed to start due to the following
error: %%1053

Error - 3/3/2010 12:21:13 AM | Computer Name = ANNIE-7B392A84C | Source = Service Control Manager | ID = 7034
Description = The avast! Web Scanner service terminated unexpectedly. It has done
this 1 time(s).

Error - 3/3/2010 8:30:03 PM | Computer Name = ANNIE-7B392A84C | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
SABKUTIL

Error - 3/3/2010 8:31:06 PM | Computer Name = ANNIE-7B392A84C | Source = Print | ID = 23
Description = Printer Lexmark Z23-Z33 failed to initialize because a suitable Lexmark
Z23-Z33 driver could not be found.

< End of report >
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-04 15:39:40
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Annie\LOCALS~1\Temp\fwkiakog.sys

—- System - GMER 1.0.15 —-

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xEFCC86B8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xEFCC8574]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xEFCC8A52]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xEFCC814C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xEFCC864E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xEFCC808C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xEFCC80F0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xEFCC876E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xEFCC872E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xEFCC88AE]

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\$NtUninstallKB926139-v2$\PSCustomSetupUtil.exe 20480 bytes executable
File C:\WINDOWS\$NtUninstallKB926139-v2$\PSSetupNativeUtils.exe 7680 bytes executable
File C:\WINDOWS\$NtUninstallKB926139-v2$\spuninst 0 bytes
File C:\WINDOWS\$NtUninstallKB926139-v2$\spuninst\spuninst.exe 213216 bytes executable
File C:\WINDOWS\$NtUninstallKB926139-v2$\spuninst\spuninst.inf 33555 bytes
File C:\WINDOWS\$NtUninstallKB926139-v2$\spuninst\spuninst.txt 7287 bytes
File C:\WINDOWS\$NtUninstallKB926139-v2$\spuninst\updspapi.dll 371424 bytes executable
File C:\WINDOWS\$NtUninstallKB929399$\msscp.dll 414208 bytes executable
File C:\WINDOWS\$NtUninstallKB929399$\spuninst 0 bytes
File C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe 213216 bytes executable
File C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.inf 7867 bytes
File C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.txt 301 bytes
File C:\WINDOWS\$NtUninstallKB929399$\spuninst\updspapi.dll 371424 bytes executable
File C:\WINDOWS\$NtUninstallKB932716-v2$\cdrom.sys 62976 bytes executable
File C:\WINDOWS\$NtUninstallKB932716-v2$\spuninst 0 bytes
File C:\WINDOWS\$NtUninstallKB932716-v2$\spuninst\spuninst.exe 231288 bytes executable
File C:\WINDOWS\$NtUninstallKB932716-v2$\spuninst\spuninst.inf 17111 bytes
File C:\WINDOWS\$NtUninstallKB932716-v2$\spuninst\spuninst.txt 496 bytes
File C:\WINDOWS\$NtUninstallKB932716-v2$\spuninst\updspapi.dll 382840 bytes executable
File C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst 0 bytes
File C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe 213216 bytes executable
File C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.inf 7632 bytes
File C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.txt 317 bytes
File C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\updspapi.dll 371424 bytes executable
File C:\WINDOWS\$NtUninstallKB936782_WMP11$\wmp.dll 10834432 bytes executable
File C:\WINDOWS\$NtUninstallKB938464$\kb938464.cat 12305 bytes
File C:\WINDOWS\$NtUninstallKB938464$\spuninst 0 bytes
File C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe 231288 bytes executable
File C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.inf 3479 bytes
File C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.txt 122 bytes
File C:\WINDOWS\$NtUninstallKB938464$\spuninst\updspapi.dll 382840 bytes executable
File C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst 0 bytes
File C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\KB938464-v2.asms 600 bytes
File C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe 231288 bytes executable
File C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.inf 7891 bytes
File C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.txt 128 bytes
File C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\updspapi.dll 382840 bytes executable
File C:\WINDOWS\$NtUninstallKB939683$\spuninst 0 bytes
File C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe 213216 bytes executable
File C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.inf 7534 bytes
File C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.txt 308 bytes
File C:\WINDOWS\$NtUninstallKB939683$\spuninst\updspapi.dll 371424 bytes executable
File C:\WINDOWS\$NtUninstallKB939683$\unregmp2.exe 315904 bytes executable

—- EOF - GMER 1.0.15 —-

inzanity

Post #5March 6, 2010, 3:20 AM UTC

Hi,

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
@Alternate Data Stream - 94 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:E3CEEC4C
@Alternate Data Stream - 245 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:270A3983
@Alternate Data Stream - 241 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F8F070C2
@Alternate Data Stream - 239 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:2495D97A
@Alternate Data Stream - 236 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0EC7A545
@Alternate Data Stream - 234 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:E7B4296D
@Alternate Data Stream - 233 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F84B8DB5
@Alternate Data Stream - 233 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:1181620C
@Alternate Data Stream - 232 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A02025CE
@Alternate Data Stream - 231 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:9E76E7F3
@Alternate Data Stream - 231 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:4A448DB2
@Alternate Data Stream - 228 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:700B9342
@Alternate Data Stream - 228 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:57176330
@Alternate Data Stream - 227 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7FD903D7
@Alternate Data Stream - 227 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6710EF08
@Alternate Data Stream - 226 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:FC4EA67C
@Alternate Data Stream - 225 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:DB77E2C4
@Alternate Data Stream - 225 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:B8384DB6
@Alternate Data Stream - 224 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:918B7566
@Alternate Data Stream - 224 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:89CF6F9C
@Alternate Data Stream - 223 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:97C4F81F
@Alternate Data Stream - 223 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:8944C195
@Alternate Data Stream - 222 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:90865A6D
@Alternate Data Stream - 221 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6F55EB66
@Alternate Data Stream - 221 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6E86D926
@Alternate Data Stream - 221 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:69AF9D20
@Alternate Data Stream - 220 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A58B27C9
@Alternate Data Stream - 220 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:8DF68137
@Alternate Data Stream - 219 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C5E2BAEE
@Alternate Data Stream - 218 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6425A235
@Alternate Data Stream - 217 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:CF61CE5A
@Alternate Data Stream - 217 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6AF67671
@Alternate Data Stream - 217 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:614F17D3
@Alternate Data Stream - 216 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:FC8FFA4E
@Alternate Data Stream - 216 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:E80802C7
@Alternate Data Stream - 216 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D2397415
@Alternate Data Stream - 216 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:8E7F155B
@Alternate Data Stream - 216 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:370E4EFB
@Alternate Data Stream - 216 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:2871B698
@Alternate Data Stream - 216 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0AC32449
@Alternate Data Stream - 215 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D48500F8
@Alternate Data Stream - 215 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7A0FEE87
@Alternate Data Stream - 215 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5EF1AD34
@Alternate Data Stream - 215 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:56C17A93
@Alternate Data Stream - 214 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:85C3B823
@Alternate Data Stream - 214 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:80F63EC3
@Alternate Data Stream - 213 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:870649A4
@Alternate Data Stream - 213 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:3E06C78F
@Alternate Data Stream - 213 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0F0A5896
@Alternate Data Stream - 212 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D92485C9
@Alternate Data Stream - 212 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:8247A199
@Alternate Data Stream - 212 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7B52659E
@Alternate Data Stream - 212 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:61AF2B29
@Alternate Data Stream - 212 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:24FECE50
@Alternate Data Stream - 212 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:1B9E79B3
@Alternate Data Stream - 211 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:53DF59D1
@Alternate Data Stream - 210 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:BB3CECA4
@Alternate Data Stream - 210 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:42509EA1
@Alternate Data Stream - 209 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:EC0A74A1
@Alternate Data Stream - 209 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D226A81A
@Alternate Data Stream - 209 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C67CB31A
@Alternate Data Stream - 209 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:BD9F7E4E
@Alternate Data Stream - 209 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:B845F669
@Alternate Data Stream - 209 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:89A5891E
@Alternate Data Stream - 209 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0D3CE40A
@Alternate Data Stream - 207 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:BD27B7FC
@Alternate Data Stream - 207 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:732E4B72
@Alternate Data Stream - 207 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:55E1514E
@Alternate Data Stream - 206 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F14D1F80
@Alternate Data Stream - 206 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C22674B6
@Alternate Data Stream - 206 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:848CC150
@Alternate Data Stream - 205 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:569CEE83
@Alternate Data Stream - 204 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F3EFA8A8
@Alternate Data Stream - 203 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:FB97DB91
@Alternate Data Stream - 202 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C9FD258B
@Alternate Data Stream - 201 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A3B8F70C
@Alternate Data Stream - 201 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:66AA0486
@Alternate Data Stream - 201 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:598E0FFA
@Alternate Data Stream - 201 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:3559A02E
@Alternate Data Stream - 201 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:1DEE6B65
@Alternate Data Stream - 201 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0ED4AC2F
@Alternate Data Stream - 200 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7547DA5B
@Alternate Data Stream - 199 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:FDDD8917
@Alternate Data Stream - 199 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D507B5A8
@Alternate Data Stream - 199 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C07A6A6B
@Alternate Data Stream - 199 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6F1F66C0
@Alternate Data Stream - 199 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:4FE30352
@Alternate Data Stream - 199 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:3FD496E1
@Alternate Data Stream - 199 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:3D36932D
@Alternate Data Stream - 198 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:70E897B5
@Alternate Data Stream - 198 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5E9B629B
@Alternate Data Stream - 198 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:52641FBE
@Alternate Data Stream - 197 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A688EF17
@Alternate Data Stream - 197 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:177313FB
@Alternate Data Stream - 195 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F67AAFC5
@Alternate Data Stream - 195 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:BE7C4A02
@Alternate Data Stream - 194 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:462A7C89
@Alternate Data Stream - 194 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0459F5AC
@Alternate Data Stream - 193 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A3750BE5
@Alternate Data Stream - 192 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:88E3B9B6
@Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:123A86B5
@Alternate Data Stream - 141 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:E29063FF
@Alternate Data Stream - 141 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0F38B460
@Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5025C6E4
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:147A3409
@Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D93AABC7
@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:62525FE7
@Alternate Data Stream - 131 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:EF5B3572
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7E082023
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:2D3CB929
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:FED25C29
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F8435088
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:BDCD8531
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A3251D01
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:27790C06
@Alternate Data Stream - 128 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0E22C5DB
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:627B7F7C
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:98982C88
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:71612023
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:9B9B0020
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:92A815D8
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5C321E34
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:38B32B54
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C2151AD3
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:96C9689F
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:3178E4B6
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:EF794BCD
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C10635F6
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:971DCCE2
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:48977386
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A2865730
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6017A808
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:3B812EE0
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:315B4A13
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C928F3BE
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C15969A6
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:4F8B72C9
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:4DCAC4BC
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:2B1EA607
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0DAD93FF
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:04CE8640
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A7DA2BCD
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:DF0BC727
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:55374FBA
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:4A1628E5
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:BBCB4421
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:27D1368B
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:059167AF
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:12D2EB9C
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:4CF76F21
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F8EBAB95
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:9DF07E8F
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:EEB25EAE
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7AA6FC81
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5C6EBC69
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:EE39C93C
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:E91ADC66
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C63E7DE2
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:667565EE
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:40D8F125
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5D351BC6
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:28CDD861
@Alternate Data Stream - 101 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A4ACFB14
@Alternate Data Stream - 101 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:02A78DF6

:Files
C:\WINDOWS\Tasks\Driver Robot.job

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top.
Let the program run unhindered, reboot when it is done.
Then post the result and a new OTL log in your next reply. ( don't check the boxes beside LOP Check or Purity this time )

–Next–

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post back the log.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer, please do so immediately.

To post in your next reply:
1. OTL fix log.
2. Malwarebytes' log.

annie1963

Post #6March 6, 2010, 9:42 PM UTC

Hi! I did as you asked and am including the new OTL and MBAM logs. I (in one of my moron moments

), clicked x on the log of results of the custom fix before I saved it. Sorry! It said at the top that all processes were killed successfully, if thats any help. Following are the logs;
OTL logfile created on: 3/6/2010 2:08:39 PM - Run 2
OTL by OldTimer - Version 3.1.32.0 Folder = C:\Documents and Settings\Annie\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

639.00 Mb Total Physical Memory | 246.00 Mb Available Physical Memory | 39.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 69.00% Paging File free
Paging file location(s): C:\pagefile.sys 960 1920 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.87 Gb Total Space | 23.45 Gb Free Space | 41.98% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ANNIE-7B392A84C
Current User Name: Annie
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Annie\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files\Alwil Software\Avast4\Setup\avast.setup (ALWIL Software)
PRC - C:\WINDOWS\system32\ZuneBusEnum.exe (Microsoft Corporation)
PRC - C:\Documents and Settings\Annie\My Documents\matt\ZuneLauncher.exe (Microsoft Corporation)
PRC - C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\system32\wbem\unsecapp.exe (Microsoft Corporation)
PRC - C:\Program Files\Fisher-Price\FP3 Player\sspnotifier.exe (Fisher-Price, Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Annie\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (ZuneWlanCfgSvc) – C:\WINDOWS\system32\ZuneWlanCfgSvc.exe (Microsoft Corporation)
SRV - (ZuneBusEnum) – C:\WINDOWS\system32\ZuneBusEnum.exe (Microsoft Corporation)
SRV - (ZuneNetworkSvc) – c:\Documents and Settings\Annie\My Documents\matt\ZuneNss.exe (Microsoft Corporation)
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
SRV - (aswUpdSv) – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (zumbus) – C:\WINDOWS\system32\drivers\zumbus.sys (Microsoft Corporation)
DRV - (aswTdi) – C:\WINDOWS\system32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\system32\drivers\aswRdr.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\system32\drivers\aavmker4.sys (ALWIL Software)
DRV - (aswMon2) – C:\WINDOWS\system32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswSP) – C:\WINDOWS\system32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (fssfltr) – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (Secdrv) – C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (Ptilink) – C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)
DRV - (ROOTMODEM) – C:\WINDOWS\system32\drivers\rootmdm.sys (Microsoft Corporation)
DRV - (RimUsb) – C:\WINDOWS\system32\drivers\RimUsb.sys (Research In Motion Limited)
DRV - (RimVSerPort) – C:\WINDOWS\system32\drivers\RimSerial.sys (Research in Motion Ltd)
DRV - (WinUSB) – C:\WINDOWS\system32\drivers\winusb.sys (Microsoft Corporation)
DRV - (Afc) – C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (AN983) – C:\WINDOWS\system32\drivers\an983.sys (ADMtek Incorporated.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (VIAudio) VIA AC'97 Audio Controller (WDM) – C:\WINDOWS\system32\drivers\viaudio.sys (VIA Technologies, Inc.)
DRV - (ms_mpu401) – C:\WINDOWS\system32\drivers\msmpu401.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?ocid=hmlogout
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C0 F0 07 25 22 B4 CA 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[2009/11/08 19:29:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Mozilla\Extensions
[2009/11/08 19:29:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Annie\Application Data\Mozilla\Extensions\[removed]

O1 HOSTS File: ([2007/07/27 05:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (Big Fish Games Toolbar) - {C7C9FC25-88B0-4682-9C9F-2608E9117647} - C:\Program Files\BfgBar\bfg.dll ()
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (&Windows; Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (&Google;) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Big Fish Games Toolbar) - {C7C9FC25-88B0-4682-9C9F-2608E9117647} - C:\Program Files\BfgBar\bfg.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows; Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google;) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [SSP Notifier] C:\Program Files\Fisher-Price\FP3 Player\sspnotifier.exe (Fisher-Price, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Zune Launcher] c:\Documents and Settings\Annie\My Documents\matt\ZuneLauncher.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Annie\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog; This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase8942.cab (Windows Live Safety Center Base Module)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1225828672620 (MUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/11/04 11:05:22 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{b8dbd775-aad5-11dd-a5b9-00121750a3a0}\Shell - "" = AutoRun
O33 - MountPoints2\{b8dbd775-aad5-11dd-a5b9-00121750a3a0}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{b8dbd775-aad5-11dd-a5b9-00121750a3a0}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/03/06 13:58:45 | 000,000,000 | —D | C] – C:\_OTL
[2010/03/05 18:04:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Annie\Application Data\.SunRay Games
[2010/03/05 18:02:32 | 000,000,000 | —D | C] – C:\Program Files\Mystic Diary 2 Survey
[2010/03/04 19:12:54 | 000,000,000 | —D | C] – C:\Documents and Settings\Annie\Application Data\Facebook
[2010/03/03 19:20:53 | 000,551,424 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Annie\Desktop\OTL.exe
[2010/03/01 23:19:12 | 000,528,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_6.dll
[2010/03/01 23:19:12 | 000,238,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_6.dll
[2010/03/01 23:19:12 | 000,074,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_4.dll
[2010/03/01 23:19:11 | 000,515,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_5.dll
[2010/03/01 23:19:11 | 000,022,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_7.dll
[2010/03/01 23:19:10 | 000,238,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_5.dll
[2010/03/01 23:19:09 | 001,974,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_42.dll
[2010/03/01 23:19:07 | 005,501,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dcsx_42.dll
[2010/03/01 23:19:07 | 000,235,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx11_42.dll
[2010/03/01 23:19:06 | 000,453,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_42.dll
[2010/03/01 23:19:05 | 001,892,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_42.dll
[2010/03/01 23:19:05 | 001,846,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_41.dll
[2010/03/01 23:19:04 | 004,178,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_41.dll
[2010/03/01 23:19:04 | 000,453,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_41.dll
[2010/03/01 23:19:03 | 000,517,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_4.dll
[2010/03/01 23:19:03 | 000,069,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_3.dll
[2010/03/01 23:19:02 | 000,235,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_4.dll
[2010/03/01 23:19:02 | 000,022,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_6.dll
[2010/03/01 23:19:01 | 002,036,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_40.dll
[2010/03/01 23:19:01 | 000,452,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_40.dll
[2010/03/01 23:19:00 | 004,379,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_40.dll
[2010/03/01 23:18:59 | 000,514,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_3.dll
[2010/03/01 23:18:59 | 000,235,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_3.dll
[2010/03/01 23:18:59 | 000,070,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_2.dll
[2010/03/01 23:18:58 | 000,509,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_2.dll
[2010/03/01 23:18:58 | 000,068,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_1.dll
[2010/03/01 23:18:58 | 000,023,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_5.dll
[2010/03/01 23:18:57 | 000,238,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_2.dll
[2010/03/01 23:18:56 | 001,493,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_39.dll
[2010/03/01 23:18:56 | 000,467,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_39.dll
[2010/03/01 23:18:55 | 003,851,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_39.dll
[2010/03/01 23:18:54 | 000,507,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_1.dll
[2010/03/01 23:18:54 | 000,238,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_1.dll
[2010/03/01 23:18:54 | 000,065,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_0.dll
[2010/03/01 23:18:53 | 000,025,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_4.dll
[2010/03/01 23:18:52 | 003,850,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_38.dll
[2010/03/01 23:18:52 | 001,491,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_38.dll
[2010/03/01 23:18:52 | 000,467,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_38.dll
[2010/03/01 23:18:51 | 000,479,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_0.dll
[2010/03/01 23:18:50 | 000,238,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_0.dll
[2010/03/01 23:18:50 | 000,025,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_3.dll
[2010/03/01 23:18:49 | 001,420,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_37.dll
[2010/03/01 23:18:49 | 000,462,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_37.dll
[2010/03/01 23:18:48 | 003,786,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_37.dll
[2010/03/01 23:18:47 | 000,267,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_10.dll
[2010/03/01 23:18:46 | 001,374,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_36.dll
[2010/03/01 23:18:46 | 000,444,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_36.dll
[2010/03/01 23:18:45 | 003,734,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_36.dll
[2010/03/01 23:18:44 | 000,444,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_35.dll
[2010/03/01 23:18:44 | 000,267,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_9.dll
[2010/03/01 23:18:43 | 003,727,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_35.dll
[2010/03/01 23:18:43 | 001,358,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_35.dll
[2010/03/01 23:18:42 | 000,266,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_8.dll
[2010/03/01 23:18:42 | 000,017,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_2.dll
[2010/03/01 23:18:41 | 001,124,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_34.dll
[2010/03/01 23:18:41 | 000,443,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_34.dll
[2010/03/01 23:18:40 | 003,497,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_34.dll
[2010/03/01 23:18:40 | 000,081,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xinput1_3.dll
[2010/03/01 23:18:39 | 000,261,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_7.dll
[2010/03/01 23:18:34 | 001,123,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_33.dll
[2010/03/01 23:18:34 | 000,443,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_33.dll
[2010/03/01 23:18:30 | 003,495,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_33.dll
[2010/03/01 23:18:29 | 000,255,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_6.dll
[2010/03/01 23:18:29 | 000,251,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_5.dll
[2010/03/01 23:18:28 | 002,414,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_31.dll
[2010/03/01 23:18:28 | 000,237,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_4.dll
[2010/03/01 23:18:28 | 000,015,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\x3daudio1_1.dll
[2010/03/01 23:18:27 | 000,236,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_3.dll
[2010/03/01 23:18:27 | 000,062,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xinput1_2.dll
[2010/03/01 23:18:26 | 000,230,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_2.dll
[2010/03/01 23:18:26 | 000,062,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xinput1_1.dll
[2010/03/01 23:18:25 | 000,229,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_1.dll
[2010/03/01 23:18:20 | 002,388,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_30.dll
[2010/03/01 23:18:19 | 000,230,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_0.dll
[2010/03/01 23:18:19 | 000,014,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\x3daudio1_0.dll
[2010/03/01 23:18:18 | 002,332,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_29.dll
[2010/03/01 23:18:18 | 002,323,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_28.dll
[2010/03/01 23:18:17 | 002,319,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_27.dll
[2010/03/01 23:18:17 | 000,061,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xinput9_1_0.dll
[2010/03/01 23:18:16 | 002,297,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_26.dll
[2010/03/01 23:18:15 | 002,337,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_25.dll
[2010/03/01 23:18:12 | 002,222,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_24.dll
[2010/03/01 22:52:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Annie\Desktop\TimeSheets
[2010/02/27 16:54:17 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/02/27 16:54:17 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
[2010/02/27 16:39:33 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2010/02/27 15:25:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\SITEguard
[2010/02/27 15:24:12 | 000,000,000 | —D | C] – C:\Program Files\Common Files\iS3
[2010/02/27 15:24:11 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\STOPzilla!
[2010/02/27 15:00:23 | 000,000,000 | —D | C] – C:\Program Files\Windows Live Safety Center
[2010/02/22 17:50:04 | 000,000,000 | —D | C] – C:\Documents and Settings\Annie\Application Data\Windows Search
[2010/02/22 17:32:02 | 000,000,000 | —D | C] – C:\Documents and Settings\Annie\Tracing
[2010/02/22 17:23:41 | 000,054,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\fssfltr_tdi.sys
[2010/02/22 17:22:59 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Sync Framework
[2010/02/22 17:22:04 | 003,426,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_32.dll
[2010/02/22 17:21:55 | 000,000,000 | —D | C] – C:\Program Files\Microsoft SQL Server Compact Edition
[2010/02/22 17:20:28 | 000,000,000 | —D | C] – C:\Program Files\Microsoft
[2010/02/22 17:20:15 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Documents\microsoft
[2010/02/22 17:20:07 | 000,000,000 | —D | C] – C:\Program Files\Windows Live SkyDrive
[2010/02/22 17:19:41 | 000,000,000 | —D | C] – C:\Program Files\Windows Live
[2010/02/22 16:26:37 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Windows Live
[2010/02/22 16:23:32 | 000,000,000 | —D | C] – C:\WINDOWS\System32\windowspowershell
[2010/02/22 16:23:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Annie\Application Data\Windows Desktop Search
[2010/02/22 16:22:44 | 000,000,000 | —D | C] – C:\Program Files\Windows Desktop Search
[2010/02/22 16:22:44 | 000,000,000 | —D | C] – C:\WINDOWS\System32\GroupPolicy
[2010/02/20 23:45:41 | 000,000,000 | —D | C] – C:\Program Files\Gardenscapes
[2010/02/20 19:27:00 | 000,000,000 | —D | C] – C:\Documents and Settings\Annie\Application Data\TripleHippo
[2010/02/20 14:55:57 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Silverlight
[2010/02/20 10:32:51 | 000,000,000 | —D | C] – C:\Program Files\The Tarot's Misfortune
[2010/02/19 23:32:57 | 000,000,000 | —D | C] – C:\Program Files\Sarah Maribu and the Lost World
[2010/02/19 20:00:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Annie\Application Data\BigFishGames
[2010/02/19 14:40:13 | 000,000,000 | —D | C] – C:\Documents and Settings\Annie\Application Data\ERS G-Studio
[2010/02/13 22:31:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Big Fish Games
[2010/02/11 20:43:06 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Casual Box
[2010/02/11 14:53:10 | 000,000,000 | —D | C] – C:\Program Files\Love Story - Letters from the Past
[2010/02/05 19:08:59 | 000,000,000 | —D | C] – C:\Documents and Settings\Annie\Application Data\HorizonWimba
[2008/11/04 11:14:19 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2008/11/04 11:14:11 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2008/11/04 11:05:15 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2008/11/04 11:05:15 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft

========== Files - Modified Within 30 Days ==========

[2010/03/06 14:05:35 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/03/06 14:05:16 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/03/06 14:05:05 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/03/06 14:05:03 | 670,621,696 | -HS- | M] () – C:\hiberfil.sys
[2010/03/06 14:03:50 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Annie\ntuser.ini
[2010/03/06 14:03:49 | 004,980,736 | -H– | M] () – C:\Documents and Settings\Annie\NTUSER.DAT
[2010/03/06 13:57:35 | 000,000,422 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{AEB68CEF-67EE-4441-B472-5989A54E4937}.job
[2010/03/05 18:03:06 | 000,001,665 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Play Mystic Diary 2 Survey.lnk
[2010/03/05 18:03:06 | 000,001,208 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\More Great Games.lnk
[2010/03/03 19:20:55 | 000,551,424 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Annie\Desktop\OTL.exe
[2010/03/01 12:23:23 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/02/27 16:54:23 | 000,000,933 | —- | M] () – C:\Documents and Settings\Annie\Desktop\Spybot - Search & Destroy.lnk
[2010/02/27 15:32:39 | 000,000,240 | —- | M] () – C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2010/02/24 23:50:27 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/02/22 19:28:49 | 000,462,830 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/02/22 19:28:49 | 000,078,666 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/02/22 19:28:48 | 000,551,164 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/02/22 17:37:28 | 000,000,617 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Zune.lnk
[2010/02/22 16:22:53 | 000,001,787 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Windows Search.lnk
[2010/02/20 23:46:31 | 000,001,602 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Play Gardenscapes.lnk
[2010/02/20 10:35:32 | 000,001,688 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Play The Tarot's Misfortune.lnk
[2010/02/19 23:34:54 | 000,001,811 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Play Sarah Maribu and the Lost World.lnk
[2010/02/19 14:55:04 | 000,000,054 | —- | M] () – C:\WINDOWS\System32\rp_stats.dat
[2010/02/19 14:55:04 | 000,000,039 | —- | M] () – C:\WINDOWS\System32\rp_rules.dat
[2010/02/12 21:14:16 | 000,002,626 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT

========== Files Created - No Company Name ==========

[2010/03/05 18:04:19 | 000,053,646 | —- | C] () – C:\Program Files\log.txt
[2010/03/05 18:03:06 | 000,001,665 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Play Mystic Diary 2 Survey.lnk
[2010/03/05 18:03:06 | 000,001,208 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\More Great Games.lnk
[2010/02/27 16:54:23 | 000,000,933 | —- | C] () – C:\Documents and Settings\Annie\Desktop\Spybot - Search & Destroy.lnk
[2010/02/27 15:32:39 | 000,000,240 | —- | C] () – C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2010/02/22 16:22:53 | 000,001,787 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Windows Search.lnk
[2010/02/20 23:46:31 | 000,001,602 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Play Gardenscapes.lnk
[2010/02/20 10:35:32 | 000,001,688 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Play The Tarot's Misfortune.lnk
[2010/02/19 23:34:54 | 000,001,811 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Play Sarah Maribu and the Lost World.lnk
[2009/12/03 21:13:31 | 000,210,944 | —- | C] () – C:\WINDOWS\System32\MSVCRT10.DLL
[2009/11/26 15:06:56 | 000,003,584 | —- | C] () – C:\Documents and Settings\Annie\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/20 18:40:52 | 000,001,584 | —- | C] () – C:\WINDOWS\tefview.ini
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2009/02/20 16:53:17 | 000,000,082 | —- | C] () – C:\Documents and Settings\Annie\Application Data\Ad Annihilator.aap
[2008/12/28 19:10:00 | 000,000,128 | —- | C] () – C:\Documents and Settings\Annie\Local Settings\Application Data\fusioncache.dat
[2008/11/09 12:18:54 | 000,000,097 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2008/11/09 12:16:35 | 000,000,044 | —- | C] () – C:\WINDOWS\EPSCX9000F.ini
[2007/09/27 10:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini

========== Alternate Data Streams ==========

@Alternate Data Stream - 148 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F3D65F99
< End of report >
Malwarebytes' Anti-Malware 1.44
Database version: 3510
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

3/6/2010 2:33:42 PM
mbam-log-2010-03-06 (14-33-42).txt

Scan type: Quick Scan
Objects scanned: 147214
Time elapsed: 6 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{0ed403e8-470a-4a8a-85a4-d7688cfe39a3} (Adware.Gamevance) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

annie1963

Post #7March 6, 2010, 9:50 PM UTC

Hi, again! This log window popped up on my screen a few days ago and saved itself to my desktop. Just thought I would send it along to you in case its something I need to worry about. Could you please let me know what you think? Thanks for all your hard work! Its really appreciated!

#
# An unexpected error has been detected by Java Runtime Environment:
#
# EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x255a255a, pid=168, tid=2744
#
# Java VM: Java HotSpot™ Client VM (1.6.0_03-b05 mixed mode)
# Problematic frame:
# C 0x255a255a
#
# If you would like to submit a bug report, please visit:
# http://java.sun.com/webapps/bugreport/crash.jsp
#

————— T H R E A D —————

Current thread (0x175a6400): JavaThread "thread applet-AppletX.class" [_thread_in_native, id=2744]

siginfo: ExceptionCode=0xc0000005, reading address 0x255a255a

Registers:
EAX=0x00000000, EBX=0x5561bee0, ECX=0x175a5ae0, EDX=0x00000000
ESP=0x185afa4c, EBP=0x255a255a, ESI=0x5561bee0, EDI=0x175a6400
EIP=0x255a255a, EFLAGS=0x00010246

Top of Stack: (sp=0x185afa4c)
0x185afa4c: 175a6d00 0000001a 00000085 000002d4
0x185afa5c: 185afa5c 5561bee0 185afa90 5561c5a8
0x185afa6c: 00000000 5561bee0 00000000 185afa8c
0x185afa7c: 185afab8 14bb2d5b 00000000 14bb8319
0x185afa8c: 4f100ba0 4f10bdb8 4f10bdb8 185afa98
0x185afa9c: 5561be3f 185afac8 5561c5a8 00000000
0x185afaac: 5561be60 185afa8c 185afac4 185afaec
0x185afabc: 14bb2c87 4f10def0 4f100ba0 4f10bdb8

Instructions: (pc=0x255a255a)
0x255a254a:
[error occurred during error reporting, step 100, id 0xc0000005]

Stack: [0x184b0000,0x185b0000), sp=0x185afa4c, free space=1022k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C 0x255a255a

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j com.sun.media.sound.HeadspaceSoundbank.nOpenResource(Ljava/lang/String;)J+0
j com.sun.media.sound.HeadspaceSoundbank.initialize(Ljava/lang/String;)V+7
j com.sun.media.sound.HeadspaceSoundbank.(Ljava/net/URL;)V+89
j com.sun.media.sound.HsbParser.getSoundbank(Ljava/net/URL;)Ljavax/sound/midi/Soundbank;+5
j javax.sound.midi.MidiSystem.getSoundbank(Ljava/net/URL;)Ljavax/sound/midi/Soundbank;+36
j AppletX.init()V+147
j sun.applet.AppletPanel.run()V+205
j java.lang.Thread.run()V+11
v ~StubRoutines::call_stub

————— P R O C E S S —————

Java Threads: ( => current thread )
0x173dc400 JavaThread "Java Sound Event Dispatcher" daemon [_thread_blocked, id=3096]
0x0a50f800 JavaThread "AWT-EventQueue-2" [_thread_blocked, id=2680]
0x175ab000 JavaThread "Keep-Alive-Timer" daemon [_thread_blocked, id=3660]
0x17fbac00 JavaThread "Thread-12" [_thread_blocked, id=2284]
0x1742ec00 JavaThread "Thread-11" [_thread_in_native, id=3472]
0x175aa000 JavaThread "thread applet-myf.y.AppletX.class" [_thread_blocked, id=3652]
=>0x175a6400 JavaThread "thread applet-AppletX.class" [_thread_in_native, id=2744]
0x1741c400 JavaThread "AWT-EventQueue-0" [_thread_blocked, id=2888]
0x17421800 JavaThread "AWT-Shutdown" [_thread_blocked, id=4032]
0x173f7000 JavaThread "CacheCleanUpThread" daemon [_thread_blocked, id=1616]
0x173edc00 JavaThread "traceMsgQueueThread" daemon [_thread_blocked, id=3716]
0x173dd000 JavaThread "AWT-Windows" daemon [_thread_in_native, id=3872]
0x173d9800 JavaThread "Java2D Disposer" daemon [_thread_blocked, id=3352]
0x0a51f000 JavaThread "Low Memory Detector" daemon [_thread_blocked, id=4052]
0x0a51a400 JavaThread "CompilerThread0" daemon [_thread_blocked, id=4056]
0x0a519000 JavaThread "Attach Listener" daemon [_thread_blocked, id=3484]
0x0a518400 JavaThread "Signal Dispatcher" daemon [_thread_blocked, id=3308]
0x0a507000 JavaThread "Finalizer" daemon [_thread_blocked, id=3948]
0x0a506000 JavaThread "Reference Handler" daemon [_thread_blocked, id=1172]
0x03fca000 JavaThread "main" [_thread_in_native, id=2564]

Other Threads:
0x0a501800 VMThread [id=1736]
0x0a520800 WatcherThread [id=3528]

VM state:not at safepoint (normal execution)

VM Mutex/Monitor currently owned by a thread: None

Heap
def new generation total 5184K, used 3132K [0x4ee00000, 0x4f390000, 0x4f560000)
eden space 4672K, 67% used [0x4ee00000, 0x4f10f000, 0x4f290000)
from space 512K, 0% used [0x4f290000, 0x4f290180, 0x4f310000)
to space 512K, 0% used [0x4f310000, 0x4f310000, 0x4f390000)
tenured generation total 67600K, used 48750K [0x4f560000, 0x53764000, 0x54e00000)
the space 67600K, 72% used [0x4f560000, 0x524fba80, 0x524fbc00, 0x53764000)
compacting perm gen total 12288K, used 8397K [0x54e00000, 0x55a00000, 0x58e00000)
the space 12288K, 68% used [0x54e00000, 0x556336e0, 0x55633800, 0x55a00000)
No shared spaces configured.

Dynamic libraries:
0x00400000 - 0x0049c000 C:\Program Files\Internet Explorer\iexplore.exe
0x7c900000 - 0x7c9b2000 C:\WINDOWS\system32\ntdll.dll
0x7c800000 - 0x7c8f6000 C:\WINDOWS\system32\kernel32.dll
0x77dd0000 - 0x77e6b000 C:\WINDOWS\system32\ADVAPI32.dll
0x77e70000 - 0x77f02000 C:\WINDOWS\system32\RPCRT4.dll
0x77fe0000 - 0x77ff1000 C:\WINDOWS\system32\Secur32.dll
0x7e410000 - 0x7e4a1000 C:\WINDOWS\system32\USER32.dll
0x77f10000 - 0x77f59000 C:\WINDOWS\system32\GDI32.dll
0x77c10000 - 0x77c68000 C:\WINDOWS\system32\msvcrt.dll
0x77f60000 - 0x77fd6000 C:\WINDOWS\system32\SHLWAPI.dll
0x7c9c0000 - 0x7d1d7000 C:\WINDOWS\system32\SHELL32.dll
0x774e0000 - 0x7761d000 C:\WINDOWS\system32\ole32.dll
0x3dfd0000 - 0x3e1b8000 C:\WINDOWS\system32\iertutil.dll
0x78130000 - 0x78262000 C:\WINDOWS\system32\urlmon.dll
0x77120000 - 0x771ab000 C:\WINDOWS\system32\OLEAUT32.dll
0x5cb70000 - 0x5cb96000 C:\WINDOWS\system32\ShimEng.dll
0x71590000 - 0x71609000 C:\WINDOWS\AppPatch\AcLayers.DLL
0x769c0000 - 0x76a74000 C:\WINDOWS\system32\USERENV.dll
0x73000000 - 0x73026000 C:\WINDOWS\system32\WINSPOOL.DRV
0x76390000 - 0x763ad000 C:\WINDOWS\system32\IMM32.DLL
0x773d0000 - 0x774d3000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
0x5d090000 - 0x5d12a000 C:\WINDOWS\system32\comctl32.dll
0x3e1c0000 - 0x3ec53000 C:\WINDOWS\system32\IEFRAME.dll
0x763b0000 - 0x763f9000 C:\WINDOWS\system32\comdlg32.dll
0x451f0000 - 0x451f6000 C:\Program Files\Internet Explorer\xpshims.dll
0x74720000 - 0x7476c000 C:\WINDOWS\system32\MSCTF.dll
0x015e0000 - 0x018a5000 C:\WINDOWS\system32\xpsp2res.dll
0x77920000 - 0x77a13000 C:\WINDOWS\system32\SETUPAPI.dll
0x76fd0000 - 0x7704f000 C:\WINDOWS\system32\CLBCATQ.DLL
0x77050000 - 0x77115000 C:\WINDOWS\system32\COMRes.dll
0x77c00000 - 0x77c08000 C:\WINDOWS\system32\VERSION.dll
0x439b0000 - 0x439f0000 C:\Program Files\Internet Explorer\ieproxy.dll
0x3d930000 - 0x3da16000 C:\WINDOWS\system32\WININET.dll
0x01bd0000 - 0x01bd9000 C:\WINDOWS\system32\Normaliz.dll
0x71ab0000 - 0x71ac7000 C:\WINDOWS\system32\ws2_32.dll
0x71aa0000 - 0x71aa8000 C:\WINDOWS\system32\WS2HELP.dll
0x77b40000 - 0x77b62000 C:\WINDOWS\system32\appHelp.dll
0x76ee0000 - 0x76f1c000 C:\WINDOWS\system32\RASAPI32.dll
0x76e90000 - 0x76ea2000 C:\WINDOWS\system32\rasman.dll
0x5b860000 - 0x5b8b5000 C:\WINDOWS\system32\NETAPI32.dll
0x76eb0000 - 0x76edf000 C:\WINDOWS\system32\TAPI32.dll
0x76e80000 - 0x76e8e000 C:\WINDOWS\system32\rtutils.dll
0x76b40000 - 0x76b6d000 C:\WINDOWS\system32\WINMM.dll
0x77c70000 - 0x77c95000 C:\WINDOWS\system32\msv1_0.dll
0x76790000 - 0x7679c000 C:\WINDOWS\system32\cryptdll.dll
0x76d60000 - 0x76d79000 C:\WINDOWS\system32\iphlpapi.dll
0x68000000 - 0x68036000 C:\WINDOWS\system32\rsaenh.dll
0x722b0000 - 0x722b5000 C:\WINDOWS\system32\sensapi.dll
0x71a50000 - 0x71a8f000 C:\WINDOWS\system32\mswsock.dll
0x662b0000 - 0x66308000 C:\WINDOWS\system32\hnetcfg.dll
0x71a90000 - 0x71a98000 C:\WINDOWS\System32\wshtcpip.dll
0x76fc0000 - 0x76fc6000 C:\WINDOWS\system32\rasadhlp.dll
0x75cf0000 - 0x75d81000 C:\WINDOWS\system32\MLANG.dll
0x76f20000 - 0x76f47000 C:\WINDOWS\system32\DNSAPI.dll
0x5ad70000 - 0x5ada8000 C:\WINDOWS\system32\UxTheme.dll
0x755c0000 - 0x755ee000 C:\WINDOWS\system32\msctfime.ime
0x10000000 - 0x10017000 C:\Program Files\BfgBar\bfg.dll
0x74980000 - 0x74aa3000 C:\WINDOWS\system32\msxml3.dll
0x38a70000 - 0x38a7c000 C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
0x03230000 - 0x032cb000 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
0x032e0000 - 0x03350000 C:\Program Files\BfgBar\bfgbar.dll
0x4ec50000 - 0x4edfb000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\gdiplus.dll
0x61880000 - 0x618ba000 C:\WINDOWS\system32\OLEACC.dll
0x3da20000 - 0x3dfce000 C:\WINDOWS\system32\mshtml.dll
0x034b0000 - 0x034d9000 C:\WINDOWS\system32\msls31.dll
0x76bf0000 - 0x76bfb000 C:\WINDOWS\system32\PSAPI.DLL
0x72ea0000 - 0x72f0f000 C:\WINDOWS\system32\ieapfltr.dll
0x77a80000 - 0x77b15000 C:\WINDOWS\system32\CRYPT32.dll
0x77b20000 - 0x77b32000 C:\WINDOWS\system32\MSASN1.dll
0x03870000 - 0x03881000 C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
0x7c420000 - 0x7c4a7000 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCP80.dll
0x038a0000 - 0x038b0000 C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
0x038c0000 - 0x03a96000 C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
0x71ad0000 - 0x71ad9000 C:\WINDOWS\system32\wsock32.dll
0x76380000 - 0x76385000 C:\WINDOWS\system32\msimg32.dll
0x69450000 - 0x69466000 C:\WINDOWS\system32\faultrep.dll
0x76360000 - 0x76370000 C:\WINDOWS\system32\WINSTA.dll
0x76f50000 - 0x76f58000 C:\WINDOWS\system32\WTSAPI32.dll
0x5edd0000 - 0x5ede7000 C:\WINDOWS\system32\olepro32.dll
0x42b80000 - 0x42b89000 C:\WINDOWS\system32\jsproxy.dll
0x46c60000 - 0x46c84000 C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
0x46ca0000 - 0x46ccf000 C:\Program Files\Microsoft\Search Enhancement Pack\SeaNote\SeaNote.dll
0x7e720000 - 0x7e7d0000 C:\WINDOWS\system32\SXS.DLL
0x46d00000 - 0x46d2b000 C:\Program Files\Microsoft\Search Enhancement Pack\Search Box Extension\srchbxex.dll
0x6d7c0000 - 0x6d839000 C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
0x7c340000 - 0x7c396000 C:\Program Files\Java\jre1.6.0_03\bin\MSVCR71.dll
0x29500000 - 0x29567000 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
0x27500000 - 0x2761a000 C:\Program Files\Common Files\Microsoft Shared\Windows Live\msidcrl40.dll
0x76c30000 - 0x76c5e000 C:\WINDOWS\system32\WINTRUST.dll
0x76c90000 - 0x76cb8000 C:\WINDOWS\system32\IMAGEHLP.dll
0x041f0000 - 0x0456f000 c:\program files\google\googletoolbar1.dll
0x7d1e0000 - 0x7d49c000 C:\WINDOWS\system32\msi.dll
0x75e60000 - 0x75e73000 C:\WINDOWS\system32\cryptnet.dll
0x4d4f0000 - 0x4d549000 C:\WINDOWS\system32\WINHTTP.dll
0x76f60000 - 0x76f8c000 C:\WINDOWS\system32\WLDAP32.dll
0x42070000 - 0x4209f000 C:\WINDOWS\system32\iepeers.dll
0x746f0000 - 0x7471a000 C:\WINDOWS\system32\msimtf.dll
0x3d7a0000 - 0x3d854000 C:\WINDOWS\system32\jscript.dll
0x075d0000 - 0x076a8000 c:\Program Files\Microsoft Silverlight\3.0.50106.0\npctrl.dll
0x73f10000 - 0x73f6c000 C:\WINDOWS\system32\DSOUND.dll
0x74000000 - 0x74056000 C:\WINDOWS\system32\pdh.dll
0x74320000 - 0x7435d000 C:\WINDOWS\system32\ODBC32.dll
0x711a0000 - 0x711a6000 C:\WINDOWS\system32\odbcbcp.dll
0x6c900000 - 0x6cd5c000 c:\Program Files\Microsoft Silverlight\3.0.50106.0\agcore.dll
0x077d0000 - 0x077e7000 C:\WINDOWS\system32\odbcint.dll
0x1b000000 - 0x1b00c000 C:\WINDOWS\system32\ImgUtil.dll
0x1b060000 - 0x1b06e000 C:\WINDOWS\system32\pngfilt.dll
0x07e70000 - 0x08314000 C:\WINDOWS\system32\Macromed\Flash\Flash10e.ocx
0x73b30000 - 0x73b45000 C:\WINDOWS\system32\mscms.dll
0x72d20000 - 0x72d29000 C:\WINDOWS\system32\wdmaud.drv
0x72d10000 - 0x72d18000 C:\WINDOWS\system32\msacm32.drv
0x77be0000 - 0x77bf5000 C:\WINDOWS\system32\MSACM32.dll
0x77bd0000 - 0x77bd7000 C:\WINDOWS\system32\midimap.dll
0x35c50000 - 0x35c89000 C:\WINDOWS\system32\Dxtrans.dll
0x76b20000 - 0x76b31000 C:\WINDOWS\system32\ATL.DLL
0x6d430000 - 0x6d43a000 C:\WINDOWS\system32\ddrawex.dll
0x73760000 - 0x737ab000 C:\WINDOWS\system32\DDRAW.dll
0x73bc0000 - 0x73bc6000 C:\WINDOWS\system32\DCIMAN32.dll
0x0aad0000 - 0x0ab3a000 C:\WINDOWS\system32\vbscript.dll
0x767f0000 - 0x76818000 C:\WINDOWS\system32\schannel.dll
0x71d40000 - 0x71d5b000 C:\WINDOWS\system32\actxprxy.dll
0x7b780000 - 0x7ba75000 c:\Program Files\Microsoft Silverlight\3.0.50106.0\coreclr.dll
0x76780000 - 0x76789000 C:\WINDOWS\system32\shfolder.dll
0x735a0000 - 0x735ca000 C:\WINDOWS\system32\scrrun.dll
0x35cb0000 - 0x35d07000 C:\WINDOWS\system32\Dxtmsft.dll
0x73940000 - 0x73a10000 C:\WINDOWS\system32\D3DIM700.DLL
0x68100000 - 0x68126000 C:\WINDOWS\system32\dssenh.dll
0x0a7e0000 - 0x0a881000 C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll

VM Arguments:
jvm_args: -Xbootclasspath/a:C:\PROGRA~1\Java\JRE16~1.0_0\lib\deploy.jar;C:\PROGRA~1\Java\JRE16~1.0_0\lib\plugin.jar -Xmx96m -Djavaplugin.maxHeapSize=96m -Xverify:remote -Djavaplugin.version=1.6.0_03 -Djavaplugin.nodotversion=160_03 -Dbrowser=sun.plugin -DtrustProxy=true -Dapplication.home=C:\PROGRA~1\Java\JRE16~1.0_0 -Djavaplugin.vm.options=-Djava.class.path=C:\PROGRA~1\Java\JRE16~1.0_0\classes -Xbootclasspath/a:C:\PROGRA~1\Java\JRE16~1.0_0\lib\deploy.jar;C:\PROGRA~1\Java\JRE16~1.0_0\lib\plugin.jar -Xmx96m -Djavaplugin.maxHeapSize=96m -Xverify:remote -Djavaplugin.version=1.6.0_03 -Djavaplugin.nodotversion=160_03 -Dbrowser=sun.plugin -DtrustProxy=true -Dapplication.home=C:\PROGRA~1\Java\JRE16~1.0_0
java_command:
Launcher Type: generic

Environment Variables:
PATH=C:\PROGRA~1\Java\JRE16~1.0_0\bin;C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins;C:\Program Files\Adobe\Reader 9.0\Reader\;C:\Program Files\Internet Explorer;;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\Windows Resource Kits\Tools;C:\WINDOWS\system32\WindowsPowerShell\v1.0;.
USERNAME=Annie
OS=Windows_NT
PROCESSOR_IDENTIFIER=x86 Family 6 Model 6 Stepping 2, AuthenticAMD

————— S Y S T E M —————

OS: Windows XP Build 2600 Service Pack 3

CPU:total 1 (1 cores per cpu, 1 threads per core) family 6 model 6 stepping 2, cmov, cx8, fxsr, mmx, sse, mmxext, 3dnow, 3dnowext

Memory: 4k page, physical 654836k(22296k free), swap 1599616k(862756k free)

vm_info: Java HotSpot™ Client VM (1.6.0_03-b05) for windows-x86, built on Sep 24 2007 22:24:33 by "java_re" with unknown MS VC++:1310

annie1963

Post #8March 7, 2010, 1:49 AM UTC

Hello, again! I keep getting a popup screen that says the system has recovered from a serious error. The latest string of code that its giving me is; BCCode:10000050 BCP:82C00001 BCP2:00000000 BCP3:EFA861FA BCP4:00000000 OSVer:5_1_2600 SP:3_0 Product:256_1 The error report details always have info on some temp files. I try to do a disc cleanup but my computer always resarts itself! AARRRRGGGGHHHHH!!!!! I can't even play any of my BigFish games because this stupid computer just freezes up and then I have to restart it.

I just feel like working on this stupid thing is me doing this….

inzanity

Post #9March 7, 2010, 6:00 AM UTC

Hi,

Please navigate to this folder then post the contents of the log:
C:\_OTL\Moved Files

–Next–

Your problem seems to be hardware related and Java. We'll try to address your java problem then make sure there aren't anymore malwares running on your computer.

–Next–

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

The latest update is Java 6 update 18

Now to Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon.

Under Temporary Internet Files, click the Settings… button
click the Delete Files button.
There are two options in the window to clear the cache - Leave both Checked
Applications and Applets
Trace and Log Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Settings
Click OK to leave the Java Control Panel.

–Next–

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

To post in your next reply:
1. OTL fix log.
2. Kaspersky log.
3. Have you updated java successfully? How is your computer?

annie1963

Post #10March 8, 2010, 9:11 PM UTC last edited March 9, 2010, 2:15 AM UTC

Hi! Here are the logs you requested! I am going to try out a few games, etc. to see how it acts, and will let you know how it does. All processes killed ========== OTL ========== No active process named explorer.exe was found! ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:E3CEEC4C deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:270A3983 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F8F070C2 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:2495D97A deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0EC7A545 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:E7B4296D deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F84B8DB5 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:1181620C deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A02025CE deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:9E76E7F3 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:4A448DB2 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:700B9342 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:57176330 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7FD903D7 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6710EF08 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:FC4EA67C deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:DB77E2C4 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:B8384DB6 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:918B7566 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:89CF6F9C deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:97C4F81F deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:8944C195 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:90865A6D deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6F55EB66 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6E86D926 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:69AF9D20 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A58B27C9 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:8DF68137 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C5E2BAEE deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6425A235 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:CF61CE5A deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6AF67671 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:614F17D3 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:FC8FFA4E deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:E80802C7 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D2397415 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:8E7F155B deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:370E4EFB deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:2871B698 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0AC32449 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D48500F8 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7A0FEE87 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5EF1AD34 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:56C17A93 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:85C3B823 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:80F63EC3 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:870649A4 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:3E06C78F deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0F0A5896 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D92485C9 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:8247A199 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7B52659E deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:61AF2B29 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:24FECE50 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:1B9E79B3 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:53DF59D1 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:BB3CECA4 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:42509EA1 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:EC0A74A1 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D226A81A deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C67CB31A deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:BD9F7E4E deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:B845F669 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:89A5891E deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0D3CE40A deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:BD27B7FC deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:732E4B72 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:55E1514E deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F14D1F80 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C22674B6 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:848CC150 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:569CEE83 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F3EFA8A8 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:FB97DB91 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C9FD258B deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A3B8F70C deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:66AA0486 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:598E0FFA deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:3559A02E deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:1DEE6B65 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0ED4AC2F deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7547DA5B deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:FDDD8917 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D507B5A8 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C07A6A6B deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6F1F66C0 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:4FE30352 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:3FD496E1 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:3D36932D deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:70E897B5 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5E9B629B deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:52641FBE deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A688EF17 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:177313FB deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F67AAFC5 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:BE7C4A02 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:462A7C89 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0459F5AC deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A3750BE5 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:88E3B9B6 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:123A86B5 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:E29063FF deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0F38B460 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5025C6E4 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:147A3409 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:D93AABC7 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:62525FE7 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:EF5B3572 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7E082023 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:2D3CB929 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:FED25C29 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F8435088 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:BDCD8531 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A3251D01 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:27790C06 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0E22C5DB deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:627B7F7C deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:98982C88 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:71612023 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:9B9B0020 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:92A815D8 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5C321E34 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:38B32B54 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C2151AD3 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:96C9689F deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:3178E4B6 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:EF794BCD deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C10635F6 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:971DCCE2 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:48977386 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A2865730 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6017A808 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:3B812EE0 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:315B4A13 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C928F3BE deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C15969A6 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:4F8B72C9 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:4DCAC4BC deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:2B1EA607 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:0DAD93FF deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:04CE8640 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A7DA2BCD deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:DF0BC727 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:55374FBA deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:4A1628E5 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:BBCB4421 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:27D1368B deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:059167AF deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:12D2EB9C deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:4CF76F21 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:F8EBAB95 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:9DF07E8F deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:EEB25EAE deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7AA6FC81 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5C6EBC69 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:EE39C93C deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:E91ADC66 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:C63E7DE2 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:667565EE deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:40D8F125 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:5D351BC6 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:28CDD861 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:A4ACFB14 deleted successfully. ADS C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:02A78DF6 deleted successfully. ========== FILES ========== C:\WINDOWS\Tasks\Driver Robot.job moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: All Users User: All Users.WINDOWS User: Annie ->Temp folder emptied: 28362083 bytes ->Temporary Internet Files folder emptied: 72886000 bytes ->Java cache emptied: 33749023 bytes ->Flash cache emptied: 139414 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: Default User.WINDOWS ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 41620 bytes User: Guest ->Temp folder emptied: 4822616 bytes ->Temporary Internet Files folder emptied: 35630219 bytes ->Flash cache emptied: 46251 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY ->Temp folder emptied: 66284 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: NetworkService.NT AUTHORITY ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2190207 bytes %systemroot%\System32 .tmp files removed: 2832913 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 468199 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 23944234 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 284915 bytes Total Files Cleaned = 196.00 mb OTL by OldTimer - Version 3.1.32.0 log created on 03062010_135845 Files\Folders moved on Reboot… File\Folder C:\Documents and Settings\Annie\Local Settings\Temp\Perflib_Perfdata_d08.dat not found! File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot. C:\WINDOWS\temp\Perflib_Perfdata_50c.dat moved successfully. C:\WINDOWS\temp\Perflib_Perfdata_c74.dat moved successfully. Registry entries deleted on Reboot… ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Monday, March 8, 2010 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Sunday, March 07, 2010 17:06:29 Records in database: 3730576 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ Scan statistics: Objects scanned: 146667 Threats found: 0 Infected objects found: 0 Suspicious objects found: 0 Scan duration: 16:34:06 No threats found. Scanned area is clean. Selected area has been scanned. ——————————– Ok, here is what went on today when trying to do anything on this computer……… during a facebook session the computer froze and then restarted itself. got an error msg; system recovered from a serious error BCCode: 1000000a BCP1:00000007 BCP2:00000002 BCP3:00000000 BCP4:804DC510 OSVer:5_1_2600 SP:3_0 Product:256_1 then when I tried to play farmville(beta) on FB it just kept freezing again and again. I tried a BigFish trial game and it froze. no error msg. had to restart by hand. pushing ctl+alt+del does absolutely nothing. then tried to play a full purchased version of a BigFish game and it froze and the screen went all fragmented looking. had to restart by hand.

I think that it has something to do with Avast. everytime its little ball down in the toolbar stops, my computer freezes.

I am trying right now to find something else to put on my computer. I'm thinking of going back to AVG. Any thoughts on the matter?!

inzanity

Post #11March 9, 2010, 4:13 AM UTC

Hi,

Let's try uninstalling Avast and Spybot but first we need to download the installers.
Avast
Spybot

Save it your desktop.

–Next–

NOTE: Do not surf the web as you will be uninstalling your security programs and will be very vulnerable to attacks!

Uninstall:

Click on Start > Control Panel and double click on Programs and Features.
Locate Avast and click on the Uninstall button to uninstall it.
Close Control Panel when done.

Do the same with Spybot.

–Next–

Reboot your computer. Upon reboot, re-install Avast and Spybot.

Were you able to update your java?

To post in your next reply:
1. Regarding java.
2. How is your computer?

inzanity

Post #12March 12, 2010, 4:23 AM UTC

Hi, It's been several days. Do you still need help on this? This thread will be closed if you don't respond within 24 hours.

annie1963

Post #13March 13, 2010, 4:49 AM UTC

Sorry I haven't been able toget to this every day. Sometimes I have to put in 30 hour shifts. I got rid of avast. Put on AVG. Got rid of spybot. Updated my video driver through ATI. Updated Java. This thing is faster somewhat, but it still will just freeze up and restart itself out of the blue. When it comes back on it pops up a window that says the system has recovered from a serious error and gives the BCP codes again. It still messes up and freezes on my BigFish games that I know for sure were playing all the way through with no problems.

I don't know what its problem is.

inzanity

Post #14March 13, 2010, 12:15 PM UTC

Hi,

Your remaining issues maybe related to hardware or faulty device drivers. It would be best if you could create a new topic at the Microsoft Windows section of the forum.
Please read this article before creating a new topic as it would greatly help our Tech Team in determining your problem. Also, please provide a link to your new topic back here in order for the team there to review your logs.

Before you go, we need to do some clean up of the tools we used first.

Please delete GMER and all the logs we've created.

You can keep Malwarebytes, it is an excellent malware removal tool. Update atleast once a week then run a complete scan.

–Next–

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

–Next–

You need to create a new Clean restore point.
Click Start Menu > Run > copy and paste

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.

Remove all previous Restore Points
Click Start Menu > Run > copy and paste

cleanmgr

At top, click on More Options tab. Click Clean up… button in the System Restore box. Click on Yes button. When finished, click on Cancel button to exit.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.

–Next–

Adobe
You can get the latest version here.
Or you can download and install Foxit Reader.

To keep your operating system up to date visit

Secunia Software inspector to check your program update status.
Microsoft Windows Update .

Here are some tips to reduce the potential for spyware infection in the future:

1. It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them
Then consider a password keeper, to keep all your passwords safe.

2. Make your Internet Explorer More Secure

From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab.
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
- Change the Download signed ActiveX controls to Prompt.
- Change the Download unsigned ActiveX controls to Disable.
- Change the Initialise and script ActiveX controls not marked as safe to Disable.
- Change the Installation of desktop items to Prompt.
- Change the Launching programs and files in an IFRAME to Prompt.
- Change the Navigate sub-frames across different domains to Prompt.
- When all these settings have been made, click on the OK button.
- If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

3. Update your Anti-Virus Software - I can not overemphasize the need for you to update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

4. Make sure you keep your Windows OS current by visiting Windows update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

5. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

6. Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

7. SpywareBlaster - Download and install SpywareBlaster. This program prevents the installation of ActiveX-based spyware and other potentially unwanted programs.

8. Protect your computer from internet threats with SandboxIE. This program isolates Internet Explorer from the rest of your operating system, 'sandboxing' it away - so malicious websites can't do damage to the rest of your system. There is a Getting Started guide on their website.

9. Some excellent free firewalls. Note: Use only one firewall at a time.
Agnitum Outpost Firewall
Comodo Firewall - If you are installing this and already have an anti spyware then please do not install Comodo's anti spyware program.
Online Armor Personal Firewall

10. And finally, please read these excellent articles:
Malware: Help prevent the Infection by Sandi Hardmeier,
Preventing Malware - Tools and Practices for Safe Computing

For more safe computing tips please read the guide by Rorschach112 on how to prevent malware and about safe computing here.

Good luck, happy computing and stay clean!

Tomk

Post #15March 16, 2010, 3:12 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Computer Keeps Shutting Down By Itself

✨ Ask AI

Ask AI