Need Help with Infected Computer

I have a desktop computer running Wndows XP. At some point yesterday it became infected with a virus and/or spyware. Now whenever I try to run anything I get a message about do I want to start anti virus protection on the computer because the program is infected. It happens with everything and the message is not from my anti virus software. I run a virus scan in safe mode as it is the only place I can do anything but the infection is still there. I was unable to run Hijack This from normal or safe mode so I restored to a restore point from Saturday 9/11 which I know should be good. The computer is running now but could I still be inected? Below is the hijackthis scan from the computer after the restore:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:31:51 PM, on 9/13/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Documents and Settings\Bill\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6028\SiteAdv.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: GamesBarBHO Class - {CB0D163C-E9F4-4236-9496-0597E24B23A5} - C:\Program Files\GamesBar\2.0.1.53\oberontb.dll
O2 - BHO: MSN Toolbar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\4.0.0314.0\npwinext.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6028\SiteAdv.dll
O3 - Toolbar: MSN Toolbar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\4.0.0314.0\npwinext.dll
O3 - Toolbar: GamesBar - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\2.0.1.53\oberontb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\SYSTEM32\Adobe\SHOCKW~1\SWHELP~2.EXE -Update -1103472 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://www.bbc.co.uk/schools/laac/numbers/ch1.shtml"
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Popup Stopper - Add to Black List - C:\Program Files\iolo\System Mechanic 5\AddToPSBlackList.htm
O8 - Extra context menu item: Popup Stopper - Add to White List - C:\Program Files\iolo\System Mechanic 5\AddToPSWhiteList.htm
O9 - Extra button: (no name) - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\2.0.1.53\oberontb.dll
O9 - Extra 'Tools' menuitem: GamesBar - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\2.0.1.53\oberontb.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} (PogoWebLauncher Control) - http://www.pogo.com/cdl/launcher/PogoWebLa…erInstaller.CAB
O16 - DPF: {38AB6A6C-CC4C-4F9E-A3DD-3C5681EF18A1} (SonyOnlineInstallerX) - http://www-cdn.freerealms.com/gamedata/plu…ller.cab?v=1042
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.av.aol.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {A27C56D2-3F58-4ABB-AA31-1168EDA6636F} (PCMaticVer Class) - http://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.av.aol.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Blue Coat K9 Web Protection (bckwfs) - Unknown owner - C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iolo DMV Service (ioloDMV) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

–
End of file - 9728 bytes

Any help would be appreciated

Thanks

Here is the OTL log:

OTL logfile created on: 9/16/2010 1:04:07 AM - Run 1
OTL by OldTimer - Version 3.2.12.1 Folder = C:\Documents and Settings\Bill\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 61.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 67.00% Paging File free
Paging file location(s): C:\pagefile.sys 192 384 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.47 Gb Total Space | 26.21 Gb Free Space | 35.19% Space Free | Partition Type: NTFS
Unable to calculate disk information.
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: LILDER
Current User Name: Bill
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Bill\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe ()
PRC - C:\Program Files\Common Files\AOL\1102215848\EE\aolsoftware.exe (AOL LLC)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe ()
PRC - C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (AOL LLC)
PRC - C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Bill\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\SYSTEM32\msscript.ocx (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (GameConsoleService) – C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe (WildTangent, Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (wlidsvc) – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (bckwfs) – C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe ()
SRV - (ioloDMV) – C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe ()
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (KodakCCS) – C:\WINDOWS\SYSTEM32\DRIVERS\KodakCCS.exe (Eastman Kodak Company)
SRV - (WANMiniportService) WAN Miniport (ATW) – C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)


========== Driver Services (SafeList) ==========

DRV - (iAimTV2) – C:\WINDOWS\System32\DRIVERS\wATV03nt.sys File not found
DRV - (FreshIO) – C:\Program Files\FreshDevices\FreshDiagnose\FreshIO.sys File not found
DRV - (ENTECH) – C:\WINDOWS\System32\DRIVERS\ENTECH.SYS File not found
DRV - (avgntflt) – C:\WINDOWS\SYSTEM32\DRIVERS\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\SYSTEM32\DRIVERS\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) – C:\WINDOWS\SYSTEM32\DRIVERS\avipbb.sys (Avira GmbH)
DRV - (avgio) – C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (bckd) – C:\WINDOWS\SYSTEM32\DRIVERS\bckd.sys ()
DRV - (ATWPKT2) – C:\WINDOWS\SYSTEM32\DRIVERS\atwpkt2.sys (America Online)
DRV - (amdagp) – C:\WINDOWS\System32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\System32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (ALWIL Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (ALWIL Software)
DRV - (MxlW2k) – C:\WINDOWS\System32\drivers\MxlW2k.sys (MusicMatch, Inc.)
DRV - (ASPI32) – C:\WINDOWS\SYSTEM32\DRIVERS\ASPI32.SYS (Adaptec)
DRV - (DcCam) – C:\WINDOWS\SYSTEM32\DRIVERS\DcCam.sys (Eastman Kodak Company)
DRV - (Exportit) – C:\WINDOWS\SYSTEM32\DRIVERS\ExportIt.sys (Eastman Kodak Company)
DRV - (DcPTP) – C:\WINDOWS\SYSTEM32\DRIVERS\DcPtp.sys (Eastman Kodak Company)
DRV - (DcLps) – C:\WINDOWS\SYSTEM32\DRIVERS\DcLps.sys (Eastman Kodak Company)
DRV - (DCFS2K) – C:\WINDOWS\SYSTEM32\DRIVERS\DCFS2k.sys (Eastman Kodak Company)
DRV - (DcFpoint) – C:\WINDOWS\SYSTEM32\DRIVERS\DcFpoint.sys (Eastman Kodak Company)
DRV - (nv) – C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (iAimFP4) – C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys (Intel® Corporation)
DRV - (iAimFP3) – C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys (Intel® Corporation)
DRV - (iAimTV4) – C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys (Intel® Corporation)
DRV - (iAimTV3) – C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys (Intel® Corporation)
DRV - (iAimTV1) – C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys (Intel® Corporation)
DRV - (iAimTV0) – C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys (Intel® Corporation)
DRV - (iAimFP0) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys (Intel® Corporation)
DRV - (iAimFP1) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys (Intel® Corporation)
DRV - (iAimFP2) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys (Intel® Corporation)
DRV - (i81x) – C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys (Intel® Corporation)
DRV - (BCMModem) – C:\WINDOWS\SYSTEM32\DRIVERS\BCMSM.sys (Broadcom Corporation)
DRV - (tfsnudfa) – C:\WINDOWS\SYSTEM32\dla\tfsnudfa.sys (Sonic Solutions)
DRV - (tfsnudf) – C:\WINDOWS\SYSTEM32\dla\tfsnudf.sys (Sonic Solutions)
DRV - (tfsnifs) – C:\WINDOWS\SYSTEM32\dla\tfsnifs.sys (Sonic Solutions)
DRV - (tfsncofs) – C:\WINDOWS\SYSTEM32\dla\tfsncofs.sys (Sonic Solutions)
DRV - (tfsnboio) – C:\WINDOWS\SYSTEM32\dla\tfsnboio.sys (Sonic Solutions)
DRV - (tfsnopio) – C:\WINDOWS\SYSTEM32\dla\tfsnopio.sys (Sonic Solutions)
DRV - (tfsnpool) – C:\WINDOWS\SYSTEM32\dla\tfsnpool.sys (Sonic Solutions)
DRV - (tfsndrct) – C:\WINDOWS\SYSTEM32\dla\tfsndrct.sys (Sonic Solutions)
DRV - (tfsndres) – C:\WINDOWS\SYSTEM32\dla\tfsndres.sys (Sonic Solutions)
DRV - (drvmcdb) – C:\WINDOWS\system32\drivers\drvmcdb.sys (Sonic Solutions)
DRV - (sscdbhk5) – C:\WINDOWS\SYSTEM32\DRIVERS\sscdbhk5.sys (Sonic Solutions)
DRV - (ssrtln) – C:\WINDOWS\SYSTEM32\DRIVERS\ssrtln.sys (Sonic Solutions)
DRV - (drvnddm) – C:\WINDOWS\SYSTEM32\DRIVERS\drvnddm.sys (Sonic Solutions)
DRV - (bcm4sbxp) – C:\WINDOWS\SYSTEM32\DRIVERS\bcm4sbxp.sys (Broadcom Corporation)
DRV - (ENETHUSB) – C:\WINDOWS\SYSTEM32\DRIVERS\enethusb.sys (Efficient Networks, Inc.)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\SYSTEM32\DRIVERS\wanatw4.sys (America Online, Inc.)
DRV - (omci) – C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys (Dell Computer Corporation)
DRV - (Sparrow) – C:\WINDOWS\System32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) – C:\WINDOWS\System32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\System32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) – C:\WINDOWS\System32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) – C:\WINDOWS\System32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (MODEMCSA) – C:\WINDOWS\SYSTEM32\DRIVERS\MODEMCSA.sys (Microsoft Corporation)
DRV - (ultra) – C:\WINDOWS\System32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) – C:\WINDOWS\System32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\System32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) – C:\WINDOWS\System32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) – C:\WINDOWS\System32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) – C:\WINDOWS\System32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) – C:\WINDOWS\System32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) – C:\WINDOWS\System32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) – C:\WINDOWS\System32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) – C:\WINDOWS\System32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (EL90XBC) – C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS (3Com Corporation)
DRV - (USBIO) USBIO Driver (usbio.sys) – C:\WINDOWS\SYSTEM32\DRIVERS\usbio.sys (Thesycon GmbH, Germany)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Data = C3 17 11 E0 B2 A4 AC 29 3E F1 D7 B3 41 49 19 66 EF FE DE 71 3C 18 BA 0A F9 AA 17 17 FE 78 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant_bak = res://C:\WINDOWS\system32\tdbqn.dll/sp.html#28129
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Yahoo!"
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..extensions.enabledItems: {1650a312-02bc-40ee-977e-83f158701739}:26.3
FF - prefs.js..extensions.enabledItems: [removed]:4.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {27182e60-b5f3-411c-b545-b44205977502}:1.0
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..keyword.URL: "http://searchservice.myspace.com/index.cfm?fuseaction=sitesearch.results&type;=Web&orig;=IMC-FF&qry;="


FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\MSN Toolbar\Platform\4.0.0314.0\Firefox [2009/10/21 18:21:28 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010/06/09 02:38:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/10 18:04:30 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/08/10 16:45:45 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010/08/01 22:32:05 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/07/30 15:07:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Mozilla\Extensions
[2010/08/30 12:14:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\extensions
[2010/07/30 20:44:21 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2006/12/17 23:22:23 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\extensions\{34274bf4-1d97-a289-e984-17e546307e4f}
[2008/04/28 17:19:17 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2006/12/23 17:29:05 | 000,000,000 | —D | M] (Yahoo! Photos Easy Upload Tool) – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\extensions\{DD99D76F-5129-4fd3-A2DC-AB41D6FBCF98}
[2006/10/15 20:52:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\extensions\temp
[2008/12/12 14:23:54 | 000,002,158 | —- | M] () – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\searchplugins\MySpace.xml
[2007/02/12 18:23:12 | 000,002,386 | —- | M] () – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\searchplugins\siteadvisor.xml
[2010/08/26 01:24:17 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2007/12/02 02:32:07 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}
[2005/04/27 16:10:49 | 000,102,400 | —- | M] (RealNetworks) – C:\Program Files\Mozilla Firefox\plugins\npracplug.dll

O1 HOSTS File: ([2008/11/30 07:40:29 | 000,000,736 | —- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6028\SiteAdv.dll (McAfee, Inc.)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (MSN Toolbar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\4.0.0314.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6028\SiteAdv.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\4.0.0314.0\npwinext.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {724D43A0-0D85-11D4-9908-00400523E39A} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\Adobe\SHOCKW~1\SWHELP~2.EXE -Update -1103472 -Mozilla\4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident\4.0; Mozilla\4.0 ( File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00 [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\SYSTEM32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} http://www.pogo.com/cdl/launcher/PogoWebLa…erInstaller.CAB (PogoWebLauncher Control)
O16 - DPF: {38AB6A6C-CC4C-4F9E-A3DD-3C5681EF18A1} http://www-cdn.freerealms.com/gamedata/plu…ller.cab?v=1042 (SonyOnlineInstallerX)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.av.aol.com/molbin/shared/m…83/mcinsctl.cab (Reg Error: Value error.)
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} http://mediaplayer.walmart.com/installer/install.cab (Reg Error: Value error.)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab (Reg Error: Value error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {A27C56D2-3F58-4ABB-AA31-1168EDA6636F} http://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab (PCMaticVer Class)
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://download.av.aol.com/molbin/shared/m…,20/mcgdmgr.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flash…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.254.254 192.168.254.254
O18 - Protocol\Handler\siteadvisor {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6028\SiteAdv.dll (McAfee, Inc.)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Bill\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Bill\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/09/03 10:59:58 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{a40381c5-75fd-11de-8f88-0013a3c7d057}\Shell - "" = AutoRun
O33 - MountPoints2\{a40381c5-75fd-11de-8f88-0013a3c7d057}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{a40381c5-75fd-11de-8f88-0013a3c7d057}\Shell\AutoRun\command - "" = E:\LaunchU3.exe – File not found
O33 - MountPoints2\{a40381c6-75fd-11de-8f88-0013a3c7d057}\Shell\AutoRun\command - "" = F:\asfocineLKNSD45835dsklnsdd8ssknfldk23nlekwqndlskanflckn324235wlskdn\asflkn434efodknzalknel2k3nqwdaslfe0ihreoitk\iexplorer.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (smrgdf C:\Documents and Settings\Bill\Application Data\iolo\) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/09/16 01:02:47 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Bill\Desktop\OTL.exe
[2010/09/13 13:13:46 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/09/04 09:28:07 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\McAfee
[2010/08/29 12:13:45 | 000,000,000 | —D | C] – C:\Planet 51 Online
[2010/08/28 07:48:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\iWin
[2010/08/27 16:24:45 | 000,000,000 | —D | C] – C:\Documents and Settings\Bill\Application Data\WildGames 3 Days Zoo Mystery
[2010/08/27 15:26:03 | 000,000,000 | —D | C] – C:\Documents and Settings\Bill\Application Data\Merscom
[2010/08/27 15:26:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Merscom
[2010/08/27 14:03:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Bill\My Documents\FunPark Beach Blast
[2010/08/27 08:45:10 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SugarGames
[2010/08/26 01:25:15 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee Security Scan
[2010/08/26 01:25:12 | 000,000,000 | —D | C] – C:\Program Files\McAfee Security Scan
[2010/08/24 12:43:49 | 000,000,000 | —D | C] – C:\Documents and Settings\Bill\Application Data\Brunhilda_wildgames
[2005/07/23 23:57:48 | 000,774,144 | —- | C] (RealNetworks, Inc.) – C:\Program Files\RngInterstitial.dll

========== Files - Modified Within 30 Days ==========

[2010/09/16 01:02:59 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Bill\Desktop\OTL.exe
[2010/09/16 00:25:42 | 000,000,420 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{42EC31E9-8F7C-49A0-9A1A-DFF0DC6B75B4}.job
[2010/09/15 14:02:32 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/09/15 13:58:28 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/09/15 13:58:23 | 000,002,048 | –S- | M] () – C:\WINDOWS\BOOTSTAT.DAT
[2010/09/15 13:58:21 | 1205,932,032 | -HS- | M] () – C:\hiberfil.sys
[2010/09/15 13:57:33 | 008,196,096 | —- | M] () – C:\Documents and Settings\Bill\ntuser.dat
[2010/09/15 13:57:33 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\Bill\NTUSER.INI
[2010/09/15 13:57:25 | 002,645,282 | -H– | M] () – C:\Documents and Settings\Bill\Local Settings\Application Data\IconCache.db
[2010/09/15 07:20:02 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/09/13 14:11:31 | 000,001,170 | —- | M] () – C:\WINDOWS\System32\WPA.DBL
[2010/09/13 07:45:50 | 000,000,444 | —- | M] () – C:\WINDOWS\System32\d3d8caps.dat
[2010/09/05 21:42:04 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/09/04 09:19:46 | 000,001,619 | —- | M] () – C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2010/09/04 09:19:46 | 000,001,611 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2010/08/29 12:14:22 | 000,001,466 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Planet 51 Online.lnk

========== Files Created - No Company Name ==========

[2010/09/13 14:08:40 | 1205,932,032 | -HS- | C] () – C:\hiberfil.sys
[2010/09/13 07:45:50 | 000,000,444 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2010/09/11 07:51:12 | 008,196,096 | —- | C] () – C:\Documents and Settings\Bill\ntuser.dat
[2010/08/29 12:14:22 | 000,001,466 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Planet 51 Online.lnk
[2010/08/26 01:25:13 | 000,001,619 | —- | C] () – C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2010/08/26 01:25:13 | 000,001,611 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2010/07/27 09:28:08 | 000,000,022 | -HS- | C] () – C:\Documents and Settings\Bill\Application Data\Sys6925.Config Collection.sys
[2009/11/19 16:32:45 | 000,000,056 | RHS- | C] () – C:\WINDOWS\System32\5765BFF273.sys
[2009/11/19 16:32:42 | 000,000,952 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2009/07/10 23:53:18 | 000,815,104 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/07/10 23:53:17 | 000,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/01/31 17:46:39 | 000,000,028 | —- | C] () – C:\WINDOWS\pdf995.ini
[2009/01/31 17:45:24 | 000,000,059 | —- | C] () – C:\WINDOWS\wpd99.drv
[2009/01/31 17:45:19 | 000,051,716 | —- | C] () – C:\WINDOWS\System32\pdf995mon.dll
[2009/01/13 19:39:06 | 000,072,992 | —- | C] () – C:\WINDOWS\System32\drivers\bckd.sys
[2008/10/07 09:13:30 | 000,197,912 | —- | C] () – C:\WINDOWS\System32\physxcudart_20.dll
[2008/10/07 09:13:22 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelKorean.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelGerman.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelFrench.dll
[2008/10/06 21:41:40 | 000,118,784 | —- | C] () – C:\WINDOWS\System32\PTTreeIcons.dll
[2008/06/24 21:32:55 | 000,000,346 | —- | C] () – C:\WINDOWS\cncscore.ini
[2007/07/25 13:49:35 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2007/03/30 14:31:20 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\dec_jl6.dll
[2007/03/25 11:16:44 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\vetntmsg.dll
[2007/03/03 13:39:50 | 000,696,320 | —- | C] () – C:\WINDOWS\System32\libeay32.dll
[2007/03/03 13:39:50 | 000,155,648 | —- | C] () – C:\WINDOWS\System32\ssleay32.dll
[2006/11/21 18:12:21 | 000,000,026 | —- | C] () – C:\WINDOWS\WAR2R.INI
[2006/10/15 13:39:00 | 000,000,000 | —- | C] () – C:\WINDOWS\PestPatrol5.INI
[2006/07/11 22:25:44 | 000,002,455 | —- | C] () – C:\WINDOWS\ULEAD32.INI
[2006/07/11 21:57:39 | 000,700,416 | —- | C] () – C:\WINDOWS\System32\FreeImage.dll
[2006/01/19 18:27:35 | 000,000,198 | —- | C] () – C:\WINDOWS\QTW.INI
[2006/01/04 22:57:31 | 000,004,678 | —- | C] () – C:\WINDOWS\CDMaster.ini
[2005/08/30 01:00:00 | 000,781,312 | —- | C] () – C:\WINDOWS\System32\RGSS102J.dll
[2005/08/30 01:00:00 | 000,778,752 | —- | C] () – C:\WINDOWS\System32\RGSS102E.dll
[2005/08/30 01:00:00 | 000,771,584 | —- | C] () – C:\WINDOWS\System32\RGSS100J.dll
[2005/05/14 09:18:33 | 000,000,823 | —- | C] () – C:\WINDOWS\tsc.ini
[2005/05/14 09:18:32 | 000,071,749 | —- | C] () – C:\WINDOWS\hcextoutput.dll
[2005/05/14 08:42:43 | 000,000,170 | —- | C] () – C:\WINDOWS\GetServer.ini
[2005/03/18 23:55:40 | 000,436,840 | —- | C] () – C:\WINDOWS\System32\Incinerator.dll
[2005/03/13 11:36:22 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxbkvs.dll
[2005/03/13 11:36:21 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\LXBKLCNP.DLL
[2005/03/13 11:35:32 | 000,000,266 | —- | C] () – C:\WINDOWS\System32\lxbkcoin.ini
[2005/02/11 21:59:47 | 000,000,004 | —- | C] () – C:\WINDOWS\msoffice.ini
[2005/02/07 18:16:33 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
[2005/02/05 20:30:21 | 000,006,306 | —- | C] () – C:\WINDOWS\Pnkqmmug.ini
[2005/01/24 19:02:30 | 000,000,000 | —- | C] () – C:\WINDOWS\MSDraw.ini
[2005/01/11 22:44:57 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/12/24 21:22:00 | 000,001,147 | —- | C] () – C:\WINDOWS\hmpro4.ini
[2004/12/24 20:53:23 | 000,000,000 | —- | C] () – C:\WINDOWS\addwt32.dll
[2004/12/12 20:36:58 | 000,000,022 | —- | C] () – C:\WINDOWS\kodakpcd.Bill.ini
[2004/12/10 20:31:35 | 000,000,000 | —- | C] () – C:\WINDOWS\apifx.dll
[2004/12/09 01:42:27 | 000,000,000 | —- | C] () – C:\WINDOWS\netmx.dll
[2004/12/05 01:26:06 | 000,000,000 | —- | C] () – C:\WINDOWS\javanu32.dll
[2004/12/03 22:09:40 | 000,000,045 | —- | C] () – C:\WINDOWS\CHKLKIKP.ini
[2004/12/01 17:45:16 | 000,000,000 | —- | C] () – C:\WINDOWS\apiec32.dll
[2004/11/30 22:35:03 | 000,000,029 | —- | C] () – C:\WINDOWS\atid.ini
[2004/11/20 09:23:53 | 000,000,000 | -HS- | C] () – C:\WINDOWS\kqsdb.dll
[2004/11/17 03:56:46 | 000,000,000 | —- | C] () – C:\WINDOWS\mskz.dll
[2004/11/17 00:13:09 | 000,000,175 | —- | C] () – C:\WINDOWS\upst.ini
[2004/11/13 12:44:26 | 000,000,000 | —- | C] () – C:\WINDOWS\apphn32.dll
[2004/10/31 11:05:21 | 000,000,000 | —- | C] () – C:\WINDOWS\hiawi.dll
[2004/10/30 17:55:00 | 000,011,640 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/10/21 02:31:37 | 000,000,413 | —- | C] () – C:\WINDOWS\lexstat.ini
[2004/09/28 23:05:16 | 000,057,923 | -H– | C] () – C:\Documents and Settings\Bill\Application Data\ptads.bin
[2004/08/28 21:36:41 | 000,000,078 | -H– | C] () – C:\WINDOWS\System32\014132.SYS
[2004/08/28 21:31:07 | 000,292,864 | —- | C] () – C:\WINDOWS\System32\tcl75.dll
[2004/08/28 21:31:07 | 000,027,648 | —- | C] () – C:\WINDOWS\System32\pdo20132.dll
[2004/08/28 21:31:06 | 000,034,304 | —- | C] () – C:\WINDOWS\System32\odma32.dll
[2004/08/28 21:30:55 | 000,007,168 | —- | C] () – C:\WINDOWS\System32\dtctrace.dll
[2004/08/28 21:30:52 | 000,029,008 | —- | C] () – C:\WINDOWS\System32\helphelp.dll
[2004/04/20 10:36:02 | 000,000,398 | —- | C] () – C:\WINDOWS\System32\master.dll
[2004/04/03 16:31:04 | 000,011,264 | —- | C] () – C:\Documents and Settings\Bill\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/04/03 15:54:50 | 000,000,406 | —- | C] () – C:\WINDOWS\cdPlayer.ini
[2004/03/28 10:40:22 | 000,001,266 | —- | C] () – C:\WINDOWS\disney.ini
[2004/03/12 00:51:53 | 000,000,127 | —- | C] () – C:\Documents and Settings\Bill\Local Settings\Application Data\fusioncache.dat
[2004/03/12 00:04:26 | 000,017,380 | —- | C] () – C:\Documents and Settings\Bill\Application Data\wklnhst.dat
[2004/03/06 01:46:25 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/03/06 01:34:46 | 000,000,892 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/03/06 01:13:30 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/03/06 01:13:01 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/03/06 00:55:20 | 000,000,550 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2003/08/14 00:54:00 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/03/27 17:28:44 | 000,004,955 | —- | C] () – C:\WINDOWS\System32\DProg.ini
[2002/11/14 14:58:04 | 000,200,192 | —- | C] () – C:\WINDOWS\System32\ir50_qc.dll
[2002/11/14 14:58:04 | 000,183,808 | —- | C] () – C:\WINDOWS\System32\ir50_qcx.dll
[2002/11/14 14:58:02 | 000,755,200 | —- | C] () – C:\WINDOWS\System32\ir50_32.dll
[2002/11/14 14:58:02 | 000,338,432 | —- | C] () – C:\WINDOWS\System32\ir41_qcx.dll
[2002/11/14 14:58:02 | 000,120,320 | —- | C] () – C:\WINDOWS\System32\ir41_qc.dll
[2002/11/01 16:17:50 | 000,000,256 | —- | C] () – C:\WINDOWS\aucfg.ini
[2002/07/04 15:05:34 | 000,000,269 | —- | C] () – C:\WINDOWS\tmupdate.ini
[2001/12/14 13:34:46 | 000,164,864 | —- | C] () – C:\WINDOWS\patchw32.dll
[2000/09/08 18:53:50 | 000,073,839 | —- | C] () – C:\WINDOWS\System32\KodakOneTouch.dll
[1999/07/23 13:46:48 | 000,000,116 | —- | C] () – C:\WINDOWS\AuHCcup1.ini
[1999/07/23 10:53:20 | 000,129,536 | —- | C] () – C:\WINDOWS\AuHCcup1.dll
[1997/06/13 22:56:08 | 000,056,832 | —- | C] () – C:\WINDOWS\System32\iyvu9_32.dll

========== LOP Check ==========

[2010/05/15 08:38:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\2DBoy
[2010/02/21 16:06:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alawar Stargaze
[2009/10/27 13:01:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Astar Games
[2010/02/14 16:08:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\blg
[2010/02/16 12:35:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Burger Island 2
[2005/03/13 11:42:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BVRP Software
[2008/09/01 18:32:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Christmasville
[2005/04/22 22:14:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EA
[2008/05/21 20:16:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EscapeTheMuseum
[2010/04/06 19:40:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EscapeTheMuseum2
[2009/10/27 14:11:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Far Mills
[2009/03/22 12:54:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FarmFrenzy-PizzaParty
[2008/08/30 21:59:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FarmFrenzy2
[2009/10/03 15:15:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FarmFrenzy3
[2010/03/10 20:09:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FarmFrenzy3_Arctica
[2010/04/09 18:48:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Flood Light Games
[2009/09/08 09:14:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FlyWheelGames
[2008/09/16 21:47:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Forge of Games
[2008/07/11 21:16:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FreshGames
[2008/05/14 13:07:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Friends Games
[2010/08/02 10:21:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Fugazo
[2010/05/30 10:58:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GameHouse
[2010/07/19 11:10:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GamesBar
[2009/06/21 12:24:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Gogii
[2010/02/21 16:34:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Gogii Games
[2008/07/23 21:39:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Hazard Shield
[2010/07/26 10:55:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\HipSoft
[2009/02/07 11:08:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Intenium
[2010/08/11 13:35:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\InterAction studios
[2008/03/07 18:45:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iolo
[2010/08/28 07:48:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iWin
[2008/08/13 22:25:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iWin Games
[2010/08/02 14:08:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iWin_generic
[2010/06/22 18:28:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\JollyBear
[2010/08/04 14:46:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Kristanix Games
[2010/07/06 10:15:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Little Games Company
[2010/03/08 18:51:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Mandragora
[2010/02/02 18:16:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Mean Hamster Software
[2010/08/27 15:26:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Merscom
[2009/08/08 15:13:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\mevo
[2009/10/27 22:59:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2009/11/01 08:23:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nanovor
[2009/11/09 19:41:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Oberon Media
[2010/08/04 20:04:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCPitstop
[2009/05/29 16:07:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\pdf995
[2010/08/27 18:58:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PlayFirst
[2010/07/31 12:45:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\rionix
[2010/03/10 18:34:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Rumbic Studio
[2010/02/18 10:11:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sandlot Games
[2010/04/08 17:38:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sprouts Adventure
[2010/08/27 08:45:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SugarGames
[2010/02/18 15:14:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TangleBee - Data
[2010/08/30 12:14:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/02/21 11:41:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TikGames
[2010/02/16 10:28:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Valusoft
[2010/08/31 18:29:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WildTangent
[2010/08/01 21:28:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WindSolutions
[2010/02/15 09:15:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Zylom
[2010/08/01 22:39:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/01/18 21:42:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2010/02/16 13:02:31 | 000,000,000 | -HSD | M] – C:\Documents and Settings\Bill\Application Data\.#
[2008/12/14 00:00:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\acccore
[2009/08/10 11:22:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Alawar
[2010/07/26 11:43:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\AlterLab
[2008/09/16 18:53:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\BeachPartyCraze
[2010/06/18 11:25:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Blender Foundation
[2010/02/14 16:08:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\blg
[2009/09/08 09:43:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Bloom RU
[2010/02/18 09:30:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Boolat Games
[2010/08/13 08:01:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Boomzap
[2010/08/24 12:48:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Brunhilda_wildgames
[2009/01/23 09:01:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Burdaloo
[2010/08/02 14:19:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Camel101
[2010/08/02 13:58:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\CupcakeCafe
[2005/04/22 22:16:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\EA
[2009/03/23 20:32:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\EleFun Games
[2010/04/09 18:48:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Flood Light Games
[2009/04/27 22:43:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\FreshDiagnose
[2009/02/07 12:37:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\FrimaStudio
[2009/10/22 18:56:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\funkitron
[2010/08/28 08:19:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Gamelab
[2010/02/21 16:34:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Gogii Games
[2008/09/04 16:45:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Home Sweet Home
[2009/10/21 23:55:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Interact Commerce
[2009/06/18 19:55:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\IObit
[2008/06/19 21:06:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\ITTNord
[2010/08/28 07:48:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\iWin
[2010/08/02 14:08:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\iWin_generic
[2004/03/12 01:12:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Leadertech
[2010/07/06 10:15:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Little Games Company
[2008/05/02 22:17:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Ludia
[2010/02/02 18:16:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Mean Hamster Software
[2009/08/08 13:41:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Meridian93
[2010/08/27 15:26:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Merscom
[2010/05/29 12:03:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\mif2000's Hamlet
[2006/12/01 00:39:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\MyMovieCollection1
[2010/07/19 11:08:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Oberon Media
[2010/04/08 19:50:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Oberonv1003
[2010/02/19 11:19:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Ohana Games
[2009/07/23 22:52:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\OpenOffice.org
[2009/08/19 19:52:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\PetRush
[2010/08/27 18:58:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\PlayFirst
[2010/07/17 19:17:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Playrix Entertainment
[2009/11/03 22:02:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Pogo Games
[2010/01/05 15:41:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\PokemonPMDInstaller[1]
[2010/01/05 15:42:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\PokemonPMDWidget
[2010/02/02 20:56:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\SaveThePuppy
[2010/02/03 20:42:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\SBTT
[2007/12/26 21:58:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\School Zone Preferences
[2006/07/03 14:30:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Sereniti
[2010/08/01 09:06:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\ShinyTales
[2009/12/18 18:51:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Sony Online Entertainment
[2009/11/02 19:38:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\SpinTop Games
[2009/10/23 17:59:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Sudden Games
[2010/06/06 15:10:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Super-Cow
[2009/09/12 14:28:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Thunderbird
[2009/05/01 13:51:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\TikGames
[2010/04/28 08:31:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Unity
[2010/02/16 10:28:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Valusoft
[2007/03/02 17:02:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\VersionTracker Pro
[2007/02/28 17:03:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Viewpoint
[2009/04/27 22:43:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Wildfire
[2010/08/27 16:25:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\WildGames 3 Days Zoo Mystery
[2010/01/19 19:36:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\WildTangent
[2010/08/01 21:30:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\WindSolutions
[2008/08/21 16:17:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Wizards of the Coast
[2010/09/15 14:02:32 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2010/09/16 00:25:42 | 000,000,420 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{42EC31E9-8F7C-49A0-9A1A-DFF0DC6B75B4}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >
[2005/12/05 22:08:25 | 000,010,920 | —- | M] () – C:\aolconnfix.exe


< MD5 for: AGP440.SYS >
[2005/05/02 23:18:23 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp2.cab:AGP440.sys
[2008/08/22 21:43:47 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp3.cab:AGP440.sys
[2005/05/02 23:18:23 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2008/08/22 21:43:47 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 14:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 14:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\SYSTEM32\DRIVERS\agp440.sys
[2004/08/04 02:07:41 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
[2001/08/17 15:58:00 | 000,025,472 | —- | M] (Microsoft Corporation) MD5=65880045C51AA36184841CEE915A61DF – C:\I386\AGP440.SYS

< MD5 for: ATAPI.SYS >
[2002/08/29 07:00:00 | 010,158,890 | —- | M] () .cab file – C:\I386\sp1.cab:atapi.sys
[2002/08/29 07:00:00 | 010,158,890 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp1.cab:atapi.sys
[2005/05/02 23:18:23 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp2.cab:atapi.sys
[2008/08/22 21:43:47 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp3.cab:atapi.sys
[2005/05/02 23:18:23 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2008/08/22 21:43:47 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\SYSTEM32\DRIVERS\atapi.sys
[2004/08/04 01:59:42 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2003/04/23 11:29:54 | 000,087,296 | —- | M] (Microsoft Corporation) MD5=E52B3B3F78C9AE85806CE49DCDD80C18 – C:\I386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 20:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 20:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\SYSTEM32\eventlog.dll
[2004/08/04 03:56:42 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
[2002/08/29 07:00:00 | 000,049,152 | —- | M] (Microsoft Corporation) MD5=BF3C8CF53C77B48206B39910B6D6CBCC – C:\I386\EVENTLOG.DLL

< MD5 for: NETLOGON.DLL >
[2008/04/13 20:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 20:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\SYSTEM32\netlogon.dll
[2002/08/29 07:00:00 | 000,399,360 | —- | M] (Microsoft Corporation) MD5=3ADD563ED7A1C66E6F5E0F7A661AA96D – C:\I386\NETLOGON.DLL
[2004/08/04 03:56:44 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 03:56:44 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2002/08/29 07:00:00 | 000,174,592 | —- | M] (Microsoft Corporation) MD5=97418A5C642A5C748A28BD7CF6860B57 – C:\I386\SCECLI.DLL
[2008/04/13 20:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\SYSTEM32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2002/09/03 10:47:18 | 000,094,208 | —- | M] () – C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.SAV
[2002/09/03 10:47:18 | 000,602,112 | —- | M] () – C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.SAV
[2002/09/03 10:47:18 | 000,380,928 | —- | M] () – C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.SAV

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\WINDOWS\System32\LEXPPS.EXE:SummaryInformation
@Alternate Data Stream - 7305 bytes -> C:\WINDOWS\Zcodzne.cjt:gpgtys
@Alternate Data Stream - 7305 bytes -> C:\WINDOWS\TWAIN.DLL:ocits
@Alternate Data Stream - 7305 bytes -> C:\WINDOWS\EXPLORER.SCF:rtwurj
@Alternate Data Stream - 3567 bytes -> C:\WINDOWS\Soqevahzci.ujs:lcvekl
@Alternate Data Stream - 3547 bytes -> C:\WINDOWS\Zmodwlfokk.uua:yqzyad
@Alternate Data Stream - 3362 bytes -> C:\WINDOWS\Uzipprkze.qlk:hthib
@Alternate Data Stream - 3362 bytes -> C:\WINDOWS\FeatherTexture.bmp:wgyah
@Alternate Data Stream - 3347 bytes -> C:\WINDOWS\WMSysPrx.prx:trkym
@Alternate Data Stream - 3347 bytes -> C:\WINDOWS\FeatherTexture.bmp:kugztt
@Alternate Data Stream - 3347 bytes -> C:\WINDOWS\Clonrklid.kwk:gbisq
@Alternate Data Stream - 304 bytes -> C:\Documents and Settings\Bill\My Documents\and wedding.jpg:SummaryInformation
@Alternate Data Stream - 195 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D091E13E
@Alternate Data Stream - 191 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E7123C4C
@Alternate Data Stream - 186 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F30757AC
@Alternate Data Stream - 152 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1941675B
@Alternate Data Stream - 151 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D20FFA63
@Alternate Data Stream - 151 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CE0A077E
@Alternate Data Stream - 151 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:63596073
@Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5856B2C0
@Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2556A8A0
@Alternate Data Stream - 147 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6EAE3ABC
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C3B04546
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4CD2D817
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:07348C09
@Alternate Data Stream - 144 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4EAD6852
@Alternate Data Stream - 143 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2F34C507
@Alternate Data Stream - 142 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:898C038B
@Alternate Data Stream - 141 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:588B60C7
@Alternate Data Stream - 141 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:55CC8080
@Alternate Data Stream - 141 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3447AB86
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FDD78BE5
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E8A39657
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:70DA7E92
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:68C4BECC
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5711EF65
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3064D21D
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0656FCD2
@Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E6D38BF2
@Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:860D9052
@Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B8B102B9
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:512B5648
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:01442FD8
@Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9B7E8561
@Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C270C64
@Alternate Data Stream - 132 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CD2ECCEC
@Alternate Data Stream - 132 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AA6C7C38
@Alternate Data Stream - 131 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:23FA878E
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A86C3734
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8810E5F6
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3C9CF9A7
@Alternate Data Stream - 128 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B894C266
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:93DE1838
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:50A11A00
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E6E9EB6C
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:81B52FA6
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6A97C459
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A15D6B27
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:38317199
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CBEB737E
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BB48E5A3
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6468C896
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4D1D6B2D
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:34BCB6A9
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DAFD38AE
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:69EC5FA7
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:38849DE5
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2FF0CA93
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1FA51BA6
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2D723B3A
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:30C46519
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9446E8B9
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:42228396
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:002640E3
@Alternate Data Stream - 11592 bytes -> C:\WINDOWS\Ybzbotrdi.pll:vodikx
@Alternate Data Stream - 11592 bytes -> C:\WINDOWS\Qovmhiu.cun:yybdvg
@Alternate Data Stream - 11592 bytes -> C:\WINDOWS\DELL.BMP:ikcjaf
@Alternate Data Stream - 11592 bytes -> C:\WINDOWS\CONTROL.INI:zzydic
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\Zcodzne.cjt:xvvie
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\Vfdlzvgwj.nrn:upald
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\TWAIN.DLL:mrmkk
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\Kctmpiihnev.kov:gitbc
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\Dygxoromb.vlx:ynmgl
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\Dygxoromb.vlx:navtp
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\Dygxoromb.vlx:gskjvw
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:68F126E0
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5EC637CB
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:29468260
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7715B65F
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C4A1F01E
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4BB26BE9
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:86F3B593
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C07C19F
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E35A81F4
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A18FC5E4
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:45FE2B4E
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AF8E48E2
< End of report >

And here is the Extras log:

OTL Extras logfile created on: 9/16/2010 1:04:07 AM - Run 1
OTL by OldTimer - Version 3.2.12.1 Folder = C:\Documents and Settings\Bill\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 61.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 67.00% Paging File free
Paging file location(s): C:\pagefile.sys 192 384 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.47 Gb Total Space | 26.21 Gb Free Space | 35.19% Space Free | Partition Type: NTFS
Unable to calculate disk information.
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: LILDER
Current User Name: Bill
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.scr [@ = scrfile] – "%1" /s

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /s
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"67:UDP" = 67:UDP:*:Enabled:DHCP Discovery Service

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe" = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare – ()
"C:\Program Files\Microsoft Games\Age of Empires II\EMPIRES2.ICD" = C:\Program Files\Microsoft Games\Age of Empires II\EMPIRES2.ICD:*:Disabled:Age of Empires II – (Microsoft Corporation)
"C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe" = C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe:*:Enabled:AOL TopSpeed – (AOL LLC)
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL Connectivity Service Dialer – (AOL LLC)
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL Connectivity Service – (AOL LLC)
"C:\Program Files\Common Files\AOL\1102215848\EE\aolsoftware.exe" = C:\Program Files\Common Files\AOL\1102215848\EE\aolsoftware.exe:*:Enabled:AOL Shared Components – (AOL LLC)
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader – (AOL LLC)
"C:\Program Files\Common Files\AOL\1102215848\EE\AOLDesktop.exe" = C:\Program Files\Common Files\AOL\1102215848\EE\AOLDesktop.exe:*:Enabled:AOL Desktop – (AOL LLC)
"C:\Program Files\Google\Google Talk\googletalk.exe" = C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk – (Google)
"C:\Program Files\MySpace\IM\MySpaceIM.exe" = C:\Program Files\MySpace\IM\MySpaceIM.exe:*:Enabled:MySpaceIM – ()
"C:\Program Files\Warcraft III\Warcraft III.exe" = C:\Program Files\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III – (Blizzard Entertainment)
"C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java™ Platform SE binary – (Sun Microsystems, Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0008546E-DF6E-4CC1-AFD0-2CB8E16C95A2}" = Notifier
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = MSN Toolbar
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{11F1920A-56A2-4642-B6E0-3B31A12C9288}" = Dell Solution Center
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
"{224C47F4-CB95-406C-8AD6-81002FEED0CF}" = Hoyle Casino 2004
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Dell Media Experience
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 18
"{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}" = Microsoft SQL Server 2005 Tools Express Edition
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
"{2E0C1913-886B-4C5C-8DAF-D1E649CE5FCC}" = Creative MediaSource
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0150100}" = J2SE Runtime Environment 5.0 Update 10
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java™ SE Runtime Environment 6
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{33BEE6F3-9987-4F98-A069-97A64EC8321A}" = Microsoft Works Suite Add-in for Microsoft Word
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page
"{38441BE7-79B0-42B8-8297-833704F949FE}" = HLPIndex
"{3CA39B0C-BA85-4D42-AC0F-1FF5F60C3353}" = OTtBPSDK
"{3D9892BB-A751-4E48-ADC8-E4289956CE1D}" = QuickTime
"{45EBDA59-D33B-433A-956E-B2F236468B56}" = MUSICMATCH® Jukebox
"{4723f199-fa64-4233-8e6e-9fccc95a18ee}" = Python 2.6.5
"{48C82F7A-F100-4DAB-A310-8E18BF2159E1}" = ESSvpot
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B9F45E8-E3CE-40B4-9463-80A9B3481DEF}" = Banctec Service Agreement
"{4E868D3D-6EEB-4273-926C-2287236B5B79}" = 3DVIA Player 4.1
"{4F677FC7-7AA8-412B-A957-F13CBE1C7331}" = ESSSONIC
"{5A9FE525-8B8F-4701-A937-7F6745A4E9C7}" = RGSS-RTP Standard
"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
"{61BEA823-ECAF-49F1-8378-A59B3B8AD247}" = Microsoft Default Manager
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr
"{68D60342-7686-45C9-B8EB-40EF843D0460}" = Dell Networking Guide
"{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}" = Power Tab Editor 1.7
"{703DE3AE-513C-11D6-B2F9-0002A5E32BEF}" = Pinball Panic
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{797EE0CA-8165-405C-B5CE-F11EC20F1BB0}" = Microsoft VC9 runtime libraries
"{7B117343-5C58-45E4-9DAD-3DCFD6FA6835}" = Nanovor
"{7EE454FB-531E-47F9-BA45-ED65496EEB09}" = Wal-Mart Music Downloads Store
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111175233}" = Plantasia
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111232687}" = Ocean Express
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113149420}" = GHOST Hunters
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114462137}" = Babysitting Mania
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115286387}" = Operation Mania
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115581157}" = Vanilla and Chocolate
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-116530713}" = Strike Ball 3
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-116757403}" = Mevo and The Groove Riders
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-116894440}" = Mandragora
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-116983990}" = Virtual Families
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117164797}" = Dream Vacation Solitaire FREE
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117371277}" = Pure Hidden
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117579150}" = Women’s Murder Club Twice in a Blue Moon
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117643617}" = Sprouts Adventure
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117785367}" = Gemini Lost
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117800857}" = Zombie Bowl-O-Rama
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117890193}" = Gardenscapes
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117933957}" = Amazing Adventures - The Carribean Secret
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117969177}" = Escape the Museum 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-118215540}" = DogTown
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{87843A41-7808-4F2E-B13F-25C1E67CF2FD}" = ESShelp
"{89EE857B-8970-4F9F-AB58-A1C873AC72B3}" = Broadcom Management Programs
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics Driver
"{8BB4B58A-A402-4DE8-8FCD-287E60B88DD8}" = ESSCT
"{8DD94CA3-BCD2-49C0-B537-F3B5D95FF0C8}" = HLPSFO
"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
"{90D55A3F-1D99-4C94-A77E-46DC14F0BF08}" = Help and Support Customization
"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
"{91F7F3F3-CE80-48C3-8327-7D24A0A5716A}" = iTunes
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B34CAC6-738F-4A20-B428-A115C3E3474C}" = RPGXP
"{9D8FEE90-0377-49A9-AEFB-525BDE549BA4}" = ESScore
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A5B3EB8A-4071-42F0-8E8E-7A8342AA8E69}" = ESSvpaht
"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
"{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}" = OfotoXMI
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
"{B9966F27-9678-4620-9579-925E3084647E}" = Microsoft Works
"{B997C2A0-4383-41BF-B76E-9B8B7ECFB267}" = KSU
"{BA77ADEE-C78B-447A-82B5-FE86BD932248}" = MSN Toolbar Platform
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CA60320D-6A16-49C8-A34F-84EEF4799567}" = ESSTUTOR
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC000127-5E5D-4A1C-90CB-EEAAAC1E3AC0}" = Jasc Paint Shop Photo Album
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0E00594-73C0-4640-A54C-2201268844BB}_is1" = DS Game Maker 4.5
"{D1973749-F5E7-40EB-B528-F2B78685B9FF}" = essvcpt
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare software
"{D56B0E27-4A3E-46C9-B5C1-D93D580C099C}" = NVIDIA PhysX v8.10.29
"{D78653C3-A8FF-415F-92E6-D774E634FF2D}" = Dell ResourceCD
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{DBA8B9E1-C6FF-4624-9598-73D3B41A0903}" = Microsoft Picture It! Photo Premium 9
"{E5110FB0-8B04-475E-9C81-55C4F834B93F}_is1" = Planet 51 Online v.1.3.2
"{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1
"{F45298E5-0083-426F-A668-1A2C5F04B8A0}" = FaxTools
"{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
"{F71760CD-0F8B-4DCC-B7B7-6B223CC3843C}" = OTtBP
"{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
"{FC4ED75D-916C-4A8C-BB67-3C6F6E06D62B}" = Banctec Service Agreement
"{FDF9943A-3D5C-46B3-9679-586BD237DDEE}" = SKIN0001
"{FEDE2483-87B7-44C1-A5BB-D75AEB8B6340}" = ESSEMAIL
"3DGroove" = 3D Groove Playback Engine
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Age of Empires 2.0" = Microsoft Age of Empires II
"Age of Empires II: The Conquerors Expansion 1.0" = Microsoft Age of Empires II: The Conquerors Expansion
"AIMars" = Kids Cam Sticker Factory
"AOL Regclient" = AOL Registration
"AOL Uninstaller" = AOL Uninstaller (Choose which Products to Remove)
"AolCoach2_en" = AOL Coach Version 2.0(Build:20041026.5 en)
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"BCM V.92 56K Modem" = BCM V.92 56K Modem
"Blender" = Blender (remove only)
"Blue Coat K9 Web Protection" = Blue Coat® K9 Web Protection 4.0.288
"CCleaner" = CCleaner
"Colors, Shapes & More" = Colors, Shapes & More
"Dell Digital Jukebox Driver" = Dell Digital Jukebox Driver
"DellSupport" = Dell Support 5.0.0 (734)
"Dual Mode Camera_is1" = Uninstall Dual Mode Camera
"EfntSSDSL" = Siemens SpeedStream DSL
"FA Alphabet and Numbers" = FA Alphabet and Numbers
"Foxit Reader" = Foxit Reader
"GamesBar" = GamesBar [removed]
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{224C47F4-CB95-406C-8AD6-81002FEED0CF}" = Hoyle Casino 2004
"InstallShield_{89EE857B-8970-4F9F-AB58-A1C873AC72B3}" = Broadcom Management Programs
"Lexmark X1100 Series" = Lexmark X1100 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"McAfee Security Scan" = McAfee Security Scan Plus
"McAfee SiteAdvisor" = McAfee SiteAdvisor
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"Mozilla Thunderbird (2.0.0.24)" = Mozilla Thunderbird (2.0.0.24)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MuVo Driver" = Creative Mass Storage Drivers
"MySpaceIM" = MySpaceIM
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OpenAL" = OpenAL
"PictureIt_v9" = Microsoft Picture It! Photo Premium 9
"PokerStars" = PokerStars
"RealPlayer 6.0" = RealPlayer
"Risk" = Risk
"Risk II_is1" = Risk II
"Risk_is1" = Risk
"Risk®" = Risk®
"Shockwave" = Shockwave
"ST5UNST #1" = STAR 2000
"UnityWebPlayer" = Unity Web Player
"Viewpoint Toolbar" = Viewpoint Toolbar
"ViewpointMediaPlayer" = Viewpoint Media Player
"VRCreator" = VRCreator 2.0
"WildTangent wildgames Master Uninstall" = WildTangent Games
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Works2004Setup" = Microsoft Works 2004 Setup Launcher
"WT076385" = 3 Days - Zoo Mystery
"WT084178" = Nanny 911
"WTA-6cb8c92e-11a2-487c-bd3b-ac4a33805e9b" = Tropical Fish Shop - Annabels Adventure
"WTA-e58f704e-1e29-494d-a2a6-abc23dca5631" = FunPark Beach Blast
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xvid_is1" = Xvid 1.2.1 final uninstall

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{373B1718-8CC5-4567-8EE2-9033AD08A680}" = Roblox for Bill
"CopyTrans Suite" = CopyTrans Suite Remove Only
"Dock Demo" = Dock Demo
"Move Media Player" = Move Media Player
"Online Boxing 2D" = Online Boxing 2D
"SOE-Free Realms" = Free Realms
"Warcraft III" = Warcraft III

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 5/21/2008 2:02:37 AM | Computer Name = LILDER | Source = avast! | ID = 33554522
Description =

Error - 5/21/2008 2:02:37 AM | Computer Name = LILDER | Source = avast! | ID = 33554522
Description =

Error - 5/21/2008 2:02:37 AM | Computer Name = LILDER | Source = avast! | ID = 33554522
Description =

Error - 5/21/2008 2:03:00 AM | Computer Name = LILDER | Source = avast! | ID = 33554522
Description =

Error - 5/21/2008 2:03:21 AM | Computer Name = LILDER | Source = avast! | ID = 33554522
Description =

Error - 5/21/2008 2:03:30 AM | Computer Name = LILDER | Source = avast! | ID = 33554522
Description =

Error - 5/21/2008 2:03:36 AM | Computer Name = LILDER | Source = avast! | ID = 33554522
Description =

Error - 5/21/2008 2:03:39 AM | Computer Name = LILDER | Source = avast! | ID = 33554522
Description =

Error - 5/21/2008 2:03:39 AM | Computer Name = LILDER | Source = avast! | ID = 33554522
Description =

Error - 7/10/2008 10:20:31 PM | Computer Name = LILDER | Source = avast! | ID = 33554522
Description =

[ Application Events ]
Error - 9/5/2010 12:02:09 PM | Computer Name = LILDER | Source = Avira AntiVir | ID = 4118
Description = EXCEPTION calling function for the file C:\Documents and Settings\Bill\Local
Settings\Temporary Internet Files\Content.IE5\873EAFK9\xd_receiver[1].htm [ACCESS_VIOLATION
Exception!! EIP = ] Please inform Avira and submit the appropriate file!

Error - 9/5/2010 12:04:22 PM | Computer Name = LILDER | Source = Avira AntiVir | ID = 4118
Description = EXCEPTION calling function for the file C:\Documents and Settings\Bill\Local
Settings\Temporary Internet Files\Content.IE5\CTKV84JR\gen_store_can_pyramid_icon[1].png

[ACCESS_VIOLATION Exception!! EIP = ] Please inform Avira and submit the appropriate
file!

Error - 9/5/2010 8:41:00 PM | Computer Name = LILDER | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module flash10d.ocx, version 10.0.42.34, fault address 0x0011d71b.

Error - 9/7/2010 9:14:12 AM | Computer Name = LILDER | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module unknown, version 0.0.0.0, fault address 0x10dec28e.

Error - 9/12/2010 12:47:49 PM | Computer Name = LILDER | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module flash10d.ocx, version 10.0.42.34, fault address 0x000df343.

Error - 9/13/2010 1:45:19 PM | Computer Name = LILDER | Source = MsiInstaller | ID = 1008
Description = The installation of C:\Storage\HiJackThis.msi is not permitted due
to an error in software restriction policy processing. The object cannot be trusted.

Error - 9/13/2010 1:45:34 PM | Computer Name = LILDER | Source = MsiInstaller | ID = 1008
Description = The installation of C:\Storage\HiJackThis.msi is not permitted due
to an error in software restriction policy processing. The object cannot be trusted.

Error - 9/13/2010 1:45:40 PM | Computer Name = LILDER | Source = MsiInstaller | ID = 1008
Description = The installation of C:\Storage\HiJackThis.msi is not permitted due
to an error in software restriction policy processing. The object cannot be trusted.

Error - 9/13/2010 2:00:55 PM | Computer Name = LILDER | Source = MsiInstaller | ID = 1008
Description = The installation of C:\Storage\HiJackThis.msi is not permitted due
to an error in software restriction policy processing. The object cannot be trusted.

Error - 9/13/2010 2:02:10 PM | Computer Name = LILDER | Source = MsiInstaller | ID = 1008
Description = The installation of C:\HiJackThis.msi is not permitted due to an error
in software restriction policy processing. The object cannot be trusted.

[ System Events ]
Error - 9/15/2010 1:30:06 PM | Computer Name = LILDER | Source = Service Control Manager | ID = 7034
Description = The Creative Service for CDROM Access service terminated unexpectedly.
It has done this 1 time(s).

Error - 9/15/2010 1:30:06 PM | Computer Name = LILDER | Source = Service Control Manager | ID = 7034
Description = The Bonjour Service service terminated unexpectedly. It has done
this 1 time(s).

Error - 9/15/2010 1:30:06 PM | Computer Name = LILDER | Source = Service Control Manager | ID = 7034
Description = The iolo DMV Service service terminated unexpectedly. It has done
this 1 time(s).

Error - 9/15/2010 1:30:06 PM | Computer Name = LILDER | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).

Error - 9/15/2010 1:30:07 PM | Computer Name = LILDER | Source = Service Control Manager | ID = 7034
Description = The WAN Miniport (ATW) Service service terminated unexpectedly. It
has done this 1 time(s).

Error - 9/15/2010 1:30:07 PM | Computer Name = LILDER | Source = Service Control Manager | ID = 7034
Description = The SeaPort service terminated unexpectedly. It has done this 1 time(s).

Error - 9/15/2010 1:30:09 PM | Computer Name = LILDER | Source = Service Control Manager | ID = 7031
Description = The Windows Live ID Sign-in Assistant service terminated unexpectedly.
It has done this 1 time(s). The following corrective action will be taken in
10000 milliseconds: Restart the service.

Error - 9/15/2010 2:02:15 PM | Computer Name = LILDER | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM
Service service to connect.

Error - 9/15/2010 2:02:15 PM | Computer Name = LILDER | Source = Service Control Manager | ID = 7000
Description = The IMAPI CD-Burning COM Service service failed to start due to the
following error: %%1053

Error - 9/15/2010 2:02:36 PM | Computer Name = LILDER | Source = Service Control Manager | ID = 7034
Description = The AOL Connectivity Service service terminated unexpectedly. It
has done this 1 time(s).


< End of report >

Again thanks for your help

Here is the combofix log:

ComboFix 10-09-16.03 - Bill 09/16/2010 15:13:16.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1150.663 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Bill\Application Data\.#
c:\documents and settings\Bill\Application Data\ptads.bin
c:\documents and settings\Bill\Local Settings\Application Data\Pulse
c:\documents and settings\Bill\Local Settings\Application Data\Pulse\shell.prf
c:\windows\bundles
c:\windows\patch.exe
c:\windows\system32\tmp.reg

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_MYWEBSEARCHSERVICE


((((((((((((((((((((((((( Files Created from 2010-08-16 to 2010-09-16 )))))))))))))))))))))))))))))))
.

2010-09-13 18:06 . 2010-09-13 18:06 ——– d—–w- c:\windows\system32\wbem\Repository
2010-09-13 17:59 . 2010-09-13 17:59 ——– d—–w- c:\documents and settings\Administrator.LILDER\IETldCache
2010-09-13 17:13 . 2010-09-13 17:13 ——– d—–w- c:\program files\Trend Micro
2010-09-13 11:45 . 2010-09-13 11:45 444 —-a-w- c:\windows\system32\d3d8caps.dat
2010-09-04 13:28 . 2010-09-04 13:28 ——– d—–w- c:\documents and settings\LocalService\Application Data\McAfee
2010-08-29 16:13 . 2010-08-29 16:15 ——– d—–w- C:\Planet 51 Online
2010-08-28 11:48 . 2010-08-28 11:48 ——– d—–w- c:\documents and settings\All Users\Application Data\iWin
2010-08-27 20:24 . 2010-08-27 20:25 ——– d—–w- c:\documents and settings\Bill\Application Data\WildGames 3 Days Zoo Mystery
2010-08-27 19:26 . 2010-08-27 19:26 ——– d—–w- c:\documents and settings\Bill\Application Data\Merscom
2010-08-27 19:26 . 2010-08-27 19:26 ——– d—–w- c:\documents and settings\All Users\Application Data\Merscom
2010-08-27 12:45 . 2010-08-27 12:45 ——– d—–w- c:\documents and settings\All Users\Application Data\SugarGames
2010-08-26 05:25 . 2010-08-26 05:25 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2010-08-26 05:25 . 2010-09-04 13:19 ——– d—–w- c:\program files\McAfee Security Scan
2010-08-24 16:43 . 2010-08-24 16:48 ——– d—–w- c:\documents and settings\Bill\Application Data\Brunhilda_wildgames

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-16 19:30 . 2009-05-14 03:00 ——– d—–w- c:\program files\Blue Coat K9 Web Protection
2010-09-13 18:17 . 2008-11-30 12:36 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-09-10 01:57 . 2005-03-13 15:35 ——– d—–w- c:\program files\Lexmark X1100 Series
2010-09-09 23:57 . 2009-07-24 02:53 1 —-a-w- c:\documents and settings\Bill\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-09-03 22:26 . 2009-09-12 18:27 ——– d—–w- c:\program files\Mozilla Thunderbird
2010-09-03 15:18 . 2010-09-03 15:18 451118 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\burgerbustle\installerui_1.0.0.192.exe
2010-09-03 15:18 . 2010-09-03 15:18 208459 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\burgerbustle\brandinfo_wildgames_1.0.0.294.exe
2010-09-03 15:18 . 2010-09-03 15:18 368569 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\burgerbustle\prodinfo_burgerbustle_1.0.0.2815.exe
2010-09-03 15:18 . 2010-09-03 15:18 76235 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\burgerbustle\pkgtype_1.0.0.63.exe
2010-09-03 15:18 . 2010-09-03 15:18 453958 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\burgerbustle\catalyst_1.0.0.420.exe
2010-09-03 15:18 . 2010-09-03 15:18 466160 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\WTDownloader\burgerbustle\Temp\WTDownloader.exe
2010-09-03 15:18 . 2010-09-03 15:17 466160 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\burgerbustle-wildgames[pm].exe
2010-08-31 22:29 . 2010-01-19 23:34 ——– d—–w- c:\documents and settings\All Users\Application Data\WildTangent
2010-08-30 16:14 . 2009-05-30 15:38 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-08-29 16:14 . 2007-07-31 03:13 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-08-28 12:19 . 2010-02-21 16:35 ——– d—–w- c:\documents and settings\Bill\Application Data\Gamelab
2010-08-28 11:48 . 2009-06-21 14:28 ——– d—–w- c:\documents and settings\Bill\Application Data\iWin
2010-08-27 22:58 . 2009-08-08 20:01 ——– d—–w- c:\documents and settings\All Users\Application Data\PlayFirst
2010-08-27 22:58 . 2008-04-28 21:27 ——– d—–w- c:\documents and settings\Bill\Application Data\PlayFirst
2010-08-27 13:08 . 2010-01-19 23:34 ——– d—–w- c:\program files\WildGames
2010-08-13 12:01 . 2009-03-26 19:11 ——– d—–w- c:\documents and settings\Bill\Application Data\Boomzap
2010-08-11 17:35 . 2009-06-04 00:34 ——– d—–w- c:\documents and settings\All Users\Application Data\InterAction studios
2010-08-06 17:35 . 2010-08-06 14:52 321580 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\bananabugs\launch_1.0.0.105.exe
2010-08-06 17:35 . 2010-08-06 14:52 75205697 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\bananabugs\game_bananabugs_1.0.0.1947.exe
2010-08-06 17:26 . 2010-08-06 15:01 4339710 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\bananabugs\wire_1.0.0.207.exe
2010-08-06 17:25 . 2010-08-06 14:52 722308 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\bananabugs\brand_wildgames_1.0.0.349.exe
2010-08-06 17:25 . 2010-08-06 14:52 373204 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\bananabugs\touchpoints_1.0.0.137.exe
2010-08-06 17:25 . 2010-08-06 14:52 535174 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\bananabugs\uninstall_1.0.0.138.exe
2010-08-06 17:25 . 2010-08-06 14:52 451118 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\bananabugs\installerui_1.0.0.192.exe
2010-08-06 17:25 . 2010-08-06 14:51 208459 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\bananabugs\brandinfo_wildgames_1.0.0.294.exe
2010-08-06 17:22 . 2010-08-06 14:51 76235 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\bananabugs\pkgtype_1.0.0.63.exe
2010-08-06 17:22 . 2010-08-06 14:51 453958 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\bananabugs\catalyst_1.0.0.420.exe
2010-08-06 17:22 . 2010-08-06 14:51 466160 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\WTDownloader\bananabugs\Temp\WTDownloader.exe
2010-08-06 17:22 . 2010-08-06 14:51 466160 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\bananabugs-wildgames[pm].exe
2010-08-06 00:14 . 2009-09-21 23:56 ——– d—–w- c:\program files\7-Zip
2010-08-06 00:14 . 2006-10-16 00:48 ——– d—–w- c:\program files\Yahoo!
2010-08-05 00:17 . 2004-03-06 05:36 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-08-05 00:16 . 2009-11-09 23:43 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-08-05 00:04 . 2010-08-05 00:04 ——– d—–w- c:\documents and settings\All Users\Application Data\PCPitstop
2010-08-04 18:46 . 2010-08-04 18:46 ——– d—–w- c:\documents and settings\All Users\Application Data\Kristanix Games
2010-08-04 17:21 . 2010-01-20 01:29 2292760 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\SetupGamesClient.exe
2010-08-02 18:19 . 2010-08-02 18:19 ——– d—–w- c:\documents and settings\Bill\Application Data\Camel101
2010-08-02 18:08 . 2010-08-02 18:08 ——– d—–w- c:\documents and settings\Bill\Application Data\iWin_generic
2010-08-02 18:08 . 2010-08-02 18:08 ——– d—–w- c:\documents and settings\All Users\Application Data\iWin_generic
2010-08-02 17:58 . 2010-08-02 17:58 ——– d—–w- c:\documents and settings\Bill\Application Data\CupcakeCafe
2010-08-02 14:21 . 2008-08-16 14:09 ——– d—–w- c:\documents and settings\All Users\Application Data\Fugazo
2010-08-02 02:39 . 2010-08-02 02:37 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-08-02 02:39 . 2004-04-02 10:37 ——– d—–w- c:\program files\iTunes
2010-08-02 02:37 . 2010-08-02 02:37 ——– d—–w- c:\program files\iPod
2010-08-02 02:37 . 2010-01-19 01:34 ——– d—–w- c:\program files\Common Files\Apple
2010-08-02 02:32 . 2010-08-02 02:30 ——– d—–w- c:\program files\QuickTime
2010-08-02 02:27 . 2010-08-02 02:27 ——– d—–w- c:\program files\Apple Software Update
2010-08-02 02:07 . 2010-08-02 02:07 ——– d—–w- c:\program files\Bonjour
2010-08-02 01:30 . 2010-08-02 01:23 ——– d—–w- c:\documents and settings\Bill\Application Data\WindSolutions
2010-08-02 01:28 . 2010-08-02 01:23 ——– d—–w- c:\documents and settings\All Users\Application Data\WindSolutions
2010-08-02 01:28 . 2010-08-02 01:28 5443752 —-a-w- c:\documents and settings\Bill\Application Data\WindSolutions\CopyTransControlCenter\Applications\CopyTrans.exe
2010-08-02 01:27 . 2010-08-02 01:27 6437560 —-a-w- c:\documents and settings\Bill\Application Data\WindSolutions\CopyTransControlCenter\Applications\CopyTransManager.exe
2010-08-02 01:23 . 2010-08-02 01:23 2671840 —-a-w- c:\documents and settings\Bill\Application Data\WindSolutions\CopyTransControlCenter\Applications\CopyTransControlCenter.exe
2010-08-02 01:06 . 2004-04-02 10:47 ——– d—–w- c:\documents and settings\Bill\Application Data\Apple Computer
2010-08-01 13:06 . 2010-08-01 13:06 ——– d—–w- c:\documents and settings\Bill\Application Data\ShinyTales
2010-07-31 22:06 . 2010-07-30 23:00 466160 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\WTDownloader\barnyardssherlockshooves\Temp\WTDownloader.exe
2010-07-31 22:06 . 2010-07-30 23:00 466160 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\barnyardssherlockshooves-wildgames[pm].exe
2010-07-31 21:07 . 2010-07-31 21:07 722308 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\virtualcity\brand_wildgames_1.0.0.349.exe
2010-07-31 21:07 . 2010-07-31 20:59 66546672 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\virtualcity\game_virtualcity_1.0.0.1450.exe
2010-07-31 20:59 . 2010-07-31 20:58 4339710 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\virtualcity\wire_1.0.0.207.exe
2010-07-31 20:58 . 2010-07-31 20:58 321580 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\virtualcity\launch_1.0.0.105.exe
2010-07-31 20:58 . 2010-07-31 20:58 535174 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\virtualcity\uninstall_1.0.0.138.exe
2010-07-31 20:58 . 2010-07-31 20:58 373204 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\virtualcity\touchpoints_1.0.0.137.exe
2010-07-31 20:58 . 2010-07-31 20:58 451118 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\virtualcity\installerui_1.0.0.192.exe
2010-07-31 20:10 . 2010-07-31 20:10 208459 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\virtualcity\brandinfo_wildgames_1.0.0.294.exe
2010-07-31 20:10 . 2010-07-31 20:10 76235 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\virtualcity\pkgtype_1.0.0.63.exe
2010-07-31 20:10 . 2010-07-31 20:10 453958 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\virtualcity\catalyst_1.0.0.420.exe
2010-07-31 20:09 . 2010-07-31 20:09 466160 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\WTDownloader\virtualcity\Temp\WTDownloader.exe
2010-07-31 20:09 . 2010-07-31 20:09 466160 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\virtualcity-wildgames[pm].exe
2010-07-31 17:28 . 2010-07-31 17:28 535174 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\dreamchroniclesthebookofair\uninstall_1.0.0.138.exe
2010-07-31 17:28 . 2010-07-31 17:28 373204 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\dreamchroniclesthebookofair\touchpoints_1.0.0.137.exe
2010-07-31 17:28 . 2010-07-31 17:28 321580 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\dreamchroniclesthebookofair\launch_1.0.0.105.exe
2010-07-31 17:27 . 2010-07-31 17:09 150046490 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\dreamchroniclesthebookofair\game_dreamchroniclesthebookofair_1.0.0.1910.exe
2010-07-31 17:09 . 2010-07-31 17:08 4339710 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\dreamchroniclesthebookofair\wire_1.0.0.207.exe
2010-07-31 17:08 . 2010-07-31 17:08 722308 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\dreamchroniclesthebookofair\brand_wildgames_1.0.0.349.exe
2010-07-31 17:08 . 2010-07-31 17:08 451118 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\dreamchroniclesthebookofair\installerui_1.0.0.192.exe
2010-07-31 17:08 . 2010-07-31 17:08 208459 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\dreamchroniclesthebookofair\brandinfo_wildgames_1.0.0.294.exe
2010-07-31 17:08 . 2010-07-31 17:08 76235 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\dreamchroniclesthebookofair\pkgtype_1.0.0.63.exe
2010-07-31 17:08 . 2010-07-31 17:08 453958 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\dreamchroniclesthebookofair\catalyst_1.0.0.420.exe
2010-07-31 17:07 . 2010-07-31 17:07 466160 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\WTDownloader\dreamchroniclesthebookofair\Temp\WTDownloader.exe
2010-07-31 17:07 . 2010-07-31 17:07 466160 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\dreamchroniclesthebookofair-wildgames[pm].exe
2010-07-31 16:56 . 2010-07-31 15:52 111890120 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\drdespicablesdastardlydeeds\game_drdespicablesdastardlydeeds_1.0.0.1915.exe
2010-07-31 16:45 . 2010-07-31 16:45 ——– d—–w- c:\documents and settings\All Users\Application Data\rionix
2010-07-31 16:41 . 2010-07-31 16:06 321580 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\drdespicablesdastardlydeeds\launch_1.0.0.105.exe
2010-07-31 16:41 . 2010-07-31 15:52 4339710 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\drdespicablesdastardlydeeds\wire_1.0.0.207.exe
2010-07-31 16:41 . 2010-07-31 15:51 535174 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\drdespicablesdastardlydeeds\uninstall_1.0.0.138.exe
2010-07-31 16:41 . 2010-07-31 16:06 722308 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\drdespicablesdastardlydeeds\brand_wildgames_1.0.0.349.exe
2010-07-31 16:41 . 2010-07-31 15:52 373204 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\drdespicablesdastardlydeeds\touchpoints_1.0.0.137.exe
2010-07-31 16:41 . 2010-07-31 15:51 451118 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\drdespicablesdastardlydeeds\installerui_1.0.0.192.exe
2010-07-31 16:41 . 2010-07-31 15:51 208459 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\drdespicablesdastardlydeeds\brandinfo_wildgames_1.0.0.294.exe
2010-07-31 16:40 . 2010-07-31 15:51 76235 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\drdespicablesdastardlydeeds\pkgtype_1.0.0.63.exe
2010-07-31 16:40 . 2010-07-31 15:51 453958 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\drdespicablesdastardlydeeds\catalyst_1.0.0.420.exe
2010-07-31 16:40 . 2010-07-31 15:51 466160 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\WTDownloader\drdespicablesdastardlydeeds\Temp\WTDownloader.exe
2010-07-31 16:40 . 2010-07-31 15:50 466160 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\drdespicablesdastardlydeeds-wildgames[pm].exe
2010-07-30 23:08 . 2010-07-30 23:08 535174 —-a-w- c:\documents and settings\All Users\Application Data\WildTangent\Game Console - WildGames\Downloads\en-us\Installers\barnyardssherlockshooves\uninstall_1.0.0.138.exe
2004-11-20 13:23 . 2004-11-20 13:23 0 –sha-w- c:\windows\kqsdb.dll
2004-12-26 09:31 . 2004-12-26 09:31 3547 –sha-w- c:\windows\mbuce.dat
2009-12-02 21:32 . 2009-11-19 20:32 56 –sh–r- c:\windows\SYSTEM32\5765BFF273.sys
2009-12-02 21:32 . 2009-11-19 20:32 952 –sha-w- c:\windows\SYSTEM32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-10-19 155648]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-19 421888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0smrgdf c:\documents and settings\Bill\Application Data\iolo\

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^Bill^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^Bill^Start Menu^Programs^Startup^SpywareGuard.lnk]
backup=c:\windows\pss\SpywareGuard.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"aswUpdSv"=2 (0x2)
"avast! Web Scanner"=3 (0x3)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"HostManager"=c:\program files\Common Files\AOL\1102215848\ee\AOLSoftware.exe
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe"
"dla"=c:\windows\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\1102215848\\EE\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1102215848\\EE\\AOLDesktop.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service

R1 bckd;bckd;c:\windows\SYSTEM32\DRIVERS\bckd.sys [1/13/2009 7:39 PM 72992]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11/30/2009 8:26 AM 108289]
R2 bckwfs;Blue Coat K9 Web Protection;c:\program files\Blue Coat K9 Web Protection\k9filter.exe [1/13/2009 7:39 PM 1078560]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 8:19 PM 13592]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 8:49 AM 227232]
.
Contents of the 'Scheduled Tasks' folder

2010-09-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 15:50]

2010-09-16 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]

2010-09-16 c:\windows\Tasks\User_Feed_Synchronization-{42EC31E9-8F7C-49A0-9A1A-DFF0DC6B75B4}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
mStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: &AOL; Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Popup Stopper - Add to Black List - c:\program files\iolo\System Mechanic 5\AddToPSBlackList.htm
IE: Popup Stopper - Add to White List - c:\program files\iolo\System Mechanic 5\AddToPSWhiteList.htm
DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} - hxxp://www.pogo.com/cdl/launcher/PogoWebLauncherInstaller.CAB
DPF: {A27C56D2-3F58-4ABB-AA31-1168EDA6636F} - hxxp://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab
FF - ProfilePath - c:\documents and settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo!
FF - prefs.js: browser.startup.homepage -
FF - prefs.js: keyword.URL - hxxp://searchservice.myspace.com/index.cfm?fuseaction=sitesearch.results&type;=Web&orig;=IMC-FF&qry;=
FF - component: c:\program files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\components\SEPsearchhelperff.dll
FF - component: c:\program files\SiteAdvisor\6028\FF\components\FFHook.dll
FF - plugin: c:\documents and settings\Bill\Application Data\Move Networks\plugins\npqmp071503000010.dll
FF - plugin: c:\documents and settings\Bill\Application Data\Move Networks\plugins\npqmp071701000002.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\MSN Toolbar\Platform\4.0.0314.0\npwinext.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Sony Online Entertainment\npsoe.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - fales
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: browser.xul.error_pages.enabled - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 8191
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 32
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: network.http.max-persistent-connections-per-proxy - 8
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
——- File Associations ——-
.
JSEFile=NOTEPAD.EXE %1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-16 15:30
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\.application\bootstrap]
@DACL=(02 0000)
@="bootstrap.application.1"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(2496)
c:\windows\system32\WININET.dll
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\CTsvcCDA.EXE
c:\program files\iolo\Common\Lib\ioloDMVSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\wanmpsvc.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
.
**************************************************************************
.
Completion time: 2010-09-16 15:42:41 - machine was rebooted
ComboFix-quarantined-files.txt 2010-09-16 19:42

Pre-Run: 27,922,747,392 bytes free
Post-Run: 27,949,514,752 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - 877A551D8A6AF7CF373D308D964DEA4C

Here is the new log file:

OTL logfile created on: 9/17/2010 5:08:12 PM - Run 2
OTL by OldTimer - Version 3.2.12.1 Folder = C:\Documents and Settings\Bill\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 54.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 63.00% Paging File free
Paging file location(s): C:\pagefile.sys 192 384 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.47 Gb Total Space | 29.49 Gb Free Space | 39.60% Space Free | Partition Type: NTFS
Unable to calculate disk information.
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: LILDER
Current User Name: Bill
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Bill\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe ()
PRC - C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (AOL LLC)
PRC - C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Bill\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\SYSTEM32\msscript.ocx (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe File not found
SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (GameConsoleService) – C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe (WildTangent, Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (wlidsvc) – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (bckwfs) – C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe ()
SRV - (ioloDMV) – C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe ()
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (KodakCCS) – C:\WINDOWS\SYSTEM32\DRIVERS\KodakCCS.exe (Eastman Kodak Company)
SRV - (WANMiniportService) WAN Miniport (ATW) – C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)


========== Driver Services (SafeList) ==========

DRV - (iAimTV2) – C:\WINDOWS\System32\DRIVERS\wATV03nt.sys File not found
DRV - (FreshIO) – C:\Program Files\FreshDevices\FreshDiagnose\FreshIO.sys File not found
DRV - (ENTECH) – C:\WINDOWS\System32\DRIVERS\ENTECH.SYS File not found
DRV - (catchme) – C:\ComboFix\catchme.sys File not found
DRV - (avgntflt) – C:\WINDOWS\SYSTEM32\DRIVERS\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\SYSTEM32\DRIVERS\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) – C:\WINDOWS\SYSTEM32\DRIVERS\avipbb.sys (Avira GmbH)
DRV - (avgio) – C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (bckd) – C:\WINDOWS\SYSTEM32\DRIVERS\bckd.sys ()
DRV - (ATWPKT2) – C:\WINDOWS\SYSTEM32\DRIVERS\atwpkt2.sys (America Online)
DRV - (amdagp) – C:\WINDOWS\System32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\System32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (ALWIL Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (ALWIL Software)
DRV - (MxlW2k) – C:\WINDOWS\System32\drivers\MxlW2k.sys (MusicMatch, Inc.)
DRV - (ASPI32) – C:\WINDOWS\SYSTEM32\DRIVERS\ASPI32.SYS (Adaptec)
DRV - (DcCam) – C:\WINDOWS\SYSTEM32\DRIVERS\DcCam.sys (Eastman Kodak Company)
DRV - (Exportit) – C:\WINDOWS\SYSTEM32\DRIVERS\ExportIt.sys (Eastman Kodak Company)
DRV - (DcPTP) – C:\WINDOWS\SYSTEM32\DRIVERS\DcPtp.sys (Eastman Kodak Company)
DRV - (DcLps) – C:\WINDOWS\SYSTEM32\DRIVERS\DcLps.sys (Eastman Kodak Company)
DRV - (DCFS2K) – C:\WINDOWS\SYSTEM32\DRIVERS\DCFS2k.sys (Eastman Kodak Company)
DRV - (DcFpoint) – C:\WINDOWS\SYSTEM32\DRIVERS\DcFpoint.sys (Eastman Kodak Company)
DRV - (nv) – C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (iAimFP4) – C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys (Intel® Corporation)
DRV - (iAimFP3) – C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys (Intel® Corporation)
DRV - (iAimTV4) – C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys (Intel® Corporation)
DRV - (iAimTV3) – C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys (Intel® Corporation)
DRV - (iAimTV1) – C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys (Intel® Corporation)
DRV - (iAimTV0) – C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys (Intel® Corporation)
DRV - (iAimFP0) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys (Intel® Corporation)
DRV - (iAimFP1) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys (Intel® Corporation)
DRV - (iAimFP2) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys (Intel® Corporation)
DRV - (i81x) – C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys (Intel® Corporation)
DRV - (BCMModem) – C:\WINDOWS\SYSTEM32\DRIVERS\BCMSM.sys (Broadcom Corporation)
DRV - (tfsnudfa) – C:\WINDOWS\SYSTEM32\dla\tfsnudfa.sys (Sonic Solutions)
DRV - (tfsnudf) – C:\WINDOWS\SYSTEM32\dla\tfsnudf.sys (Sonic Solutions)
DRV - (tfsnifs) – C:\WINDOWS\SYSTEM32\dla\tfsnifs.sys (Sonic Solutions)
DRV - (tfsncofs) – C:\WINDOWS\SYSTEM32\dla\tfsncofs.sys (Sonic Solutions)
DRV - (tfsnboio) – C:\WINDOWS\SYSTEM32\dla\tfsnboio.sys (Sonic Solutions)
DRV - (tfsnopio) – C:\WINDOWS\SYSTEM32\dla\tfsnopio.sys (Sonic Solutions)
DRV - (tfsnpool) – C:\WINDOWS\SYSTEM32\dla\tfsnpool.sys (Sonic Solutions)
DRV - (tfsndrct) – C:\WINDOWS\SYSTEM32\dla\tfsndrct.sys (Sonic Solutions)
DRV - (tfsndres) – C:\WINDOWS\SYSTEM32\dla\tfsndres.sys (Sonic Solutions)
DRV - (drvmcdb) – C:\WINDOWS\system32\drivers\drvmcdb.sys (Sonic Solutions)
DRV - (sscdbhk5) – C:\WINDOWS\SYSTEM32\DRIVERS\sscdbhk5.sys (Sonic Solutions)
DRV - (ssrtln) – C:\WINDOWS\SYSTEM32\DRIVERS\ssrtln.sys (Sonic Solutions)
DRV - (drvnddm) – C:\WINDOWS\SYSTEM32\DRIVERS\drvnddm.sys (Sonic Solutions)
DRV - (bcm4sbxp) – C:\WINDOWS\SYSTEM32\DRIVERS\bcm4sbxp.sys (Broadcom Corporation)
DRV - (ENETHUSB) – C:\WINDOWS\SYSTEM32\DRIVERS\enethusb.sys (Efficient Networks, Inc.)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\SYSTEM32\DRIVERS\wanatw4.sys (America Online, Inc.)
DRV - (omci) – C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys (Dell Computer Corporation)
DRV - (Sparrow) – C:\WINDOWS\System32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) – C:\WINDOWS\System32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\System32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) – C:\WINDOWS\System32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) – C:\WINDOWS\System32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (MODEMCSA) – C:\WINDOWS\SYSTEM32\DRIVERS\MODEMCSA.sys (Microsoft Corporation)
DRV - (ultra) – C:\WINDOWS\System32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) – C:\WINDOWS\System32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\System32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) – C:\WINDOWS\System32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) – C:\WINDOWS\System32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) – C:\WINDOWS\System32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) – C:\WINDOWS\System32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) – C:\WINDOWS\System32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) – C:\WINDOWS\System32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) – C:\WINDOWS\System32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (EL90XBC) – C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS (3Com Corporation)
DRV - (USBIO) USBIO Driver (usbio.sys) – C:\WINDOWS\SYSTEM32\DRIVERS\usbio.sys (Thesycon GmbH, Germany)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Data = C3 17 11 E0 B2 A4 AC 29 3E F1 D7 B3 41 49 19 66 EF FE DE 71 3C 18 BA 0A F9 AA 17 17 FE 78 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant_bak = res://C:\WINDOWS\system32\tdbqn.dll/sp.html#28129
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Yahoo!"
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..extensions.enabledItems: {1650a312-02bc-40ee-977e-83f158701739}:26.3
FF - prefs.js..extensions.enabledItems: [removed]:4.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {27182e60-b5f3-411c-b545-b44205977502}:1.0
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..keyword.URL: "http://searchservice.myspace.com/index.cfm?fuseaction=sitesearch.results&type;=Web&orig;=IMC-FF&qry;="


FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\MSN Toolbar\Platform\4.0.0314.0\Firefox [2009/10/21 18:21:28 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010/06/09 02:38:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/10 18:04:30 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/08/10 16:45:45 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010/08/01 22:32:05 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/07/30 15:07:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Mozilla\Extensions
[2010/08/30 12:14:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\extensions
[2010/07/30 20:44:21 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2006/12/17 23:22:23 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\extensions\{34274bf4-1d97-a289-e984-17e546307e4f}
[2008/04/28 17:19:17 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2006/12/23 17:29:05 | 000,000,000 | —D | M] (Yahoo! Photos Easy Upload Tool) – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\extensions\{DD99D76F-5129-4fd3-A2DC-AB41D6FBCF98}
[2006/10/15 20:52:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\extensions\temp
[2008/12/12 14:23:54 | 000,002,158 | —- | M] () – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\searchplugins\MySpace.xml
[2007/02/12 18:23:12 | 000,002,386 | —- | M] () – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\searchplugins\siteadvisor.xml
[2010/08/26 01:24:17 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2007/12/02 02:32:07 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}
[2005/04/27 16:10:49 | 000,102,400 | —- | M] (RealNetworks) – C:\Program Files\Mozilla Firefox\plugins\npracplug.dll

O1 HOSTS File: ([2010/09/16 15:28:05 | 000,000,027 | —- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6028\SiteAdv.dll (McAfee, Inc.)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (MSN Toolbar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\4.0.0314.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6028\SiteAdv.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\4.0.0314.0\npwinext.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {724D43A0-0D85-11D4-9908-00400523E39A} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\Adobe\SHOCKW~1\SWHELP~2.EXE -Update -1103472 -Mozilla\4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident\4.0; Mozilla\4.0 ( File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\SYSTEM32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} http://www.pogo.com/cdl/launcher/PogoWebLa…erInstaller.CAB (PogoWebLauncher Control)
O16 - DPF: {38AB6A6C-CC4C-4F9E-A3DD-3C5681EF18A1} http://www-cdn.freerealms.com/gamedata/plu…ller.cab?v=1042 (SonyOnlineInstallerX)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.av.aol.com/molbin/shared/m…83/mcinsctl.cab (Reg Error: Value error.)
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} http://mediaplayer.walmart.com/installer/install.cab (Reg Error: Value error.)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab (Reg Error: Value error.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {A27C56D2-3F58-4ABB-AA31-1168EDA6636F} http://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab (PCMaticVer Class)
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://download.av.aol.com/molbin/shared/m…,20/mcgdmgr.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flash…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.254.254 192.168.254.254
O18 - Protocol\Handler\siteadvisor {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6028\SiteAdv.dll (McAfee, Inc.)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Bill\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Bill\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/09/03 10:59:58 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (smrgdf C:\Documents and Settings\Bill\Application Data\iolo\) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/09/17 17:07:39 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Bill\Desktop\OTL.exe
[2010/09/16 22:55:40 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2010/09/16 16:07:15 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/09/16 15:07:29 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/09/16 15:03:19 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/09/16 15:03:19 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/09/16 15:03:19 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/09/13 13:13:46 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/09/04 09:28:07 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\McAfee
[2010/08/29 12:13:45 | 000,000,000 | —D | C] – C:\Planet 51 Online
[2010/08/28 07:48:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\iWin
[2010/08/27 16:24:45 | 000,000,000 | —D | C] – C:\Documents and Settings\Bill\Application Data\WildGames 3 Days Zoo Mystery
[2010/08/27 15:26:03 | 000,000,000 | —D | C] – C:\Documents and Settings\Bill\Application Data\Merscom
[2010/08/27 15:26:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Merscom
[2010/08/27 14:03:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Bill\My Documents\FunPark Beach Blast
[2010/08/27 08:45:10 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SugarGames
[2010/08/24 12:43:49 | 000,000,000 | —D | C] – C:\Documents and Settings\Bill\Application Data\Brunhilda_wildgames
[2005/07/23 23:57:48 | 000,774,144 | —- | C] (RealNetworks, Inc.) – C:\Program Files\RngInterstitial.dll

========== Files - Modified Within 30 Days ==========

[2010/09/17 17:11:40 | 000,000,420 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{42EC31E9-8F7C-49A0-9A1A-DFF0DC6B75B4}.job
[2010/09/17 17:07:50 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Bill\Desktop\OTL.exe
[2010/09/17 17:04:12 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/09/17 17:00:06 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/09/17 17:00:01 | 000,002,048 | –S- | M] () – C:\WINDOWS\BOOTSTAT.DAT
[2010/09/17 16:59:59 | 1205,932,032 | -HS- | M] () – C:\hiberfil.sys
[2010/09/17 16:59:06 | 008,196,096 | —- | M] () – C:\Documents and Settings\Bill\ntuser.dat
[2010/09/17 16:59:06 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\Bill\NTUSER.INI
[2010/09/17 16:58:56 | 002,113,328 | -H– | M] () – C:\Documents and Settings\Bill\Local Settings\Application Data\IconCache.db
[2010/09/16 15:29:57 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/09/16 15:28:05 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\ETC\hosts
[2010/09/16 15:07:38 | 000,000,327 | RHS- | M] () – C:\BOOT.INI
[2010/09/15 07:20:02 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/09/13 14:11:31 | 000,001,170 | —- | M] () – C:\WINDOWS\System32\WPA.DBL
[2010/09/13 07:45:50 | 000,000,444 | —- | M] () – C:\WINDOWS\System32\d3d8caps.dat
[2010/09/05 21:42:04 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/08/29 12:14:22 | 000,001,466 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Planet 51 Online.lnk

========== Files Created - No Company Name ==========

[2010/09/16 15:07:38 | 000,000,211 | —- | C] () – C:\Boot.bak
[2010/09/16 15:07:31 | 000,260,272 | RHS- | C] () – C:\cmldr
[2010/09/16 15:03:20 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/09/16 15:03:19 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/09/16 15:03:19 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/09/16 15:03:19 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/09/16 15:03:19 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/09/13 14:08:40 | 1205,932,032 | -HS- | C] () – C:\hiberfil.sys
[2010/09/13 07:45:50 | 000,000,444 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2010/09/11 07:51:12 | 008,196,096 | —- | C] () – C:\Documents and Settings\Bill\ntuser.dat
[2010/08/29 12:14:22 | 000,001,466 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Planet 51 Online.lnk
[2010/07/27 09:28:08 | 000,000,022 | -HS- | C] () – C:\Documents and Settings\Bill\Application Data\Sys6925.Config Collection.sys
[2009/11/19 16:32:45 | 000,000,056 | RHS- | C] () – C:\WINDOWS\System32\5765BFF273.sys
[2009/11/19 16:32:42 | 000,000,952 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2009/07/10 23:53:18 | 000,815,104 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/07/10 23:53:17 | 000,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/01/31 17:46:39 | 000,000,028 | —- | C] () – C:\WINDOWS\pdf995.ini
[2009/01/31 17:45:24 | 000,000,059 | —- | C] () – C:\WINDOWS\wpd99.drv
[2009/01/31 17:45:19 | 000,051,716 | —- | C] () – C:\WINDOWS\System32\pdf995mon.dll
[2009/01/13 19:39:06 | 000,072,992 | —- | C] () – C:\WINDOWS\System32\drivers\bckd.sys
[2008/10/07 09:13:30 | 000,197,912 | —- | C] () – C:\WINDOWS\System32\physxcudart_20.dll
[2008/10/07 09:13:22 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelKorean.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelGerman.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelFrench.dll
[2008/10/06 21:41:40 | 000,118,784 | —- | C] () – C:\WINDOWS\System32\PTTreeIcons.dll
[2008/06/24 21:32:55 | 000,000,346 | —- | C] () – C:\WINDOWS\cncscore.ini
[2007/07/25 13:49:35 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2007/03/30 14:31:20 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\dec_jl6.dll
[2007/03/25 11:16:44 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\vetntmsg.dll
[2007/03/03 13:39:50 | 000,696,320 | —- | C] () – C:\WINDOWS\System32\libeay32.dll
[2007/03/03 13:39:50 | 000,155,648 | —- | C] () – C:\WINDOWS\System32\ssleay32.dll
[2006/11/21 18:12:21 | 000,000,026 | —- | C] () – C:\WINDOWS\WAR2R.INI
[2006/10/15 13:39:00 | 000,000,000 | —- | C] () – C:\WINDOWS\PestPatrol5.INI
[2006/07/11 22:25:44 | 000,002,455 | —- | C] () – C:\WINDOWS\ULEAD32.INI
[2006/07/11 21:57:39 | 000,700,416 | —- | C] () – C:\WINDOWS\System32\FreeImage.dll
[2006/01/19 18:27:35 | 000,000,198 | —- | C] () – C:\WINDOWS\QTW.INI
[2006/01/04 22:57:31 | 000,004,678 | —- | C] () – C:\WINDOWS\CDMaster.ini
[2005/08/30 01:00:00 | 000,781,312 | —- | C] () – C:\WINDOWS\System32\RGSS102J.dll
[2005/08/30 01:00:00 | 000,778,752 | —- | C] () – C:\WINDOWS\System32\RGSS102E.dll
[2005/08/30 01:00:00 | 000,771,584 | —- | C] () – C:\WINDOWS\System32\RGSS100J.dll
[2005/05/14 09:18:33 | 000,000,823 | —- | C] () – C:\WINDOWS\tsc.ini
[2005/05/14 09:18:32 | 000,071,749 | —- | C] () – C:\WINDOWS\hcextoutput.dll
[2005/05/14 08:42:43 | 000,000,170 | —- | C] () – C:\WINDOWS\GetServer.ini
[2005/03/18 23:55:40 | 000,436,840 | —- | C] () – C:\WINDOWS\System32\Incinerator.dll
[2005/03/13 11:36:22 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxbkvs.dll
[2005/03/13 11:36:21 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\LXBKLCNP.DLL
[2005/03/13 11:35:32 | 000,000,266 | —- | C] () – C:\WINDOWS\System32\lxbkcoin.ini
[2005/02/11 21:59:47 | 000,000,004 | —- | C] () – C:\WINDOWS\msoffice.ini
[2005/02/07 18:16:33 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
[2005/02/05 20:30:21 | 000,006,306 | —- | C] () – C:\WINDOWS\Pnkqmmug.ini
[2005/01/24 19:02:30 | 000,000,000 | —- | C] () – C:\WINDOWS\MSDraw.ini
[2005/01/11 22:44:57 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/12/24 21:22:00 | 000,001,147 | —- | C] () – C:\WINDOWS\hmpro4.ini
[2004/12/24 20:53:23 | 000,000,000 | —- | C] () – C:\WINDOWS\addwt32.dll
[2004/12/12 20:36:58 | 000,000,022 | —- | C] () – C:\WINDOWS\kodakpcd.Bill.ini
[2004/12/10 20:31:35 | 000,000,000 | —- | C] () – C:\WINDOWS\apifx.dll
[2004/12/09 01:42:27 | 000,000,000 | —- | C] () – C:\WINDOWS\netmx.dll
[2004/12/05 01:26:06 | 000,000,000 | —- | C] () – C:\WINDOWS\javanu32.dll
[2004/12/03 22:09:40 | 000,000,045 | —- | C] () – C:\WINDOWS\CHKLKIKP.ini
[2004/12/01 17:45:16 | 000,000,000 | —- | C] () – C:\WINDOWS\apiec32.dll
[2004/11/30 22:35:03 | 000,000,029 | —- | C] () – C:\WINDOWS\atid.ini
[2004/11/20 09:23:53 | 000,000,000 | -HS- | C] () – C:\WINDOWS\kqsdb.dll
[2004/11/17 03:56:46 | 000,000,000 | —- | C] () – C:\WINDOWS\mskz.dll
[2004/11/17 00:13:09 | 000,000,175 | —- | C] () – C:\WINDOWS\upst.ini
[2004/11/13 12:44:26 | 000,000,000 | —- | C] () – C:\WINDOWS\apphn32.dll
[2004/10/31 11:05:21 | 000,000,000 | —- | C] () – C:\WINDOWS\hiawi.dll
[2004/10/30 17:55:00 | 000,011,640 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/10/21 02:31:37 | 000,000,413 | —- | C] () – C:\WINDOWS\lexstat.ini
[2004/08/28 21:36:41 | 000,000,078 | -H– | C] () – C:\WINDOWS\System32\014132.SYS
[2004/08/28 21:31:07 | 000,292,864 | —- | C] () – C:\WINDOWS\System32\tcl75.dll
[2004/08/28 21:31:07 | 000,027,648 | —- | C] () – C:\WINDOWS\System32\pdo20132.dll
[2004/08/28 21:31:06 | 000,034,304 | —- | C] () – C:\WINDOWS\System32\odma32.dll
[2004/08/28 21:30:55 | 000,007,168 | —- | C] () – C:\WINDOWS\System32\dtctrace.dll
[2004/08/28 21:30:52 | 000,029,008 | —- | C] () – C:\WINDOWS\System32\helphelp.dll
[2004/04/20 10:36:02 | 000,000,398 | —- | C] () – C:\WINDOWS\System32\master.dll
[2004/04/03 16:31:04 | 000,011,264 | —- | C] () – C:\Documents and Settings\Bill\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/04/03 15:54:50 | 000,000,406 | —- | C] () – C:\WINDOWS\cdPlayer.ini
[2004/03/28 10:40:22 | 000,001,266 | —- | C] () – C:\WINDOWS\disney.ini
[2004/03/12 00:51:53 | 000,000,127 | —- | C] () – C:\Documents and Settings\Bill\Local Settings\Application Data\fusioncache.dat
[2004/03/12 00:04:26 | 000,017,380 | —- | C] () – C:\Documents and Settings\Bill\Application Data\wklnhst.dat
[2004/03/06 01:46:25 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/03/06 01:34:46 | 000,000,892 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/03/06 01:13:30 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/03/06 01:13:01 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/03/06 00:55:20 | 000,000,550 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2003/08/14 00:54:00 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/03/27 17:28:44 | 000,004,955 | —- | C] () – C:\WINDOWS\System32\DProg.ini
[2002/11/14 14:58:04 | 000,200,192 | —- | C] () – C:\WINDOWS\System32\ir50_qc.dll
[2002/11/14 14:58:04 | 000,183,808 | —- | C] () – C:\WINDOWS\System32\ir50_qcx.dll
[2002/11/14 14:58:02 | 000,755,200 | —- | C] () – C:\WINDOWS\System32\ir50_32.dll
[2002/11/14 14:58:02 | 000,338,432 | —- | C] () – C:\WINDOWS\System32\ir41_qcx.dll
[2002/11/14 14:58:02 | 000,120,320 | —- | C] () – C:\WINDOWS\System32\ir41_qc.dll
[2002/11/01 16:17:50 | 000,000,256 | —- | C] () – C:\WINDOWS\aucfg.ini
[2002/07/04 15:05:34 | 000,000,269 | —- | C] () – C:\WINDOWS\tmupdate.ini
[2001/12/14 13:34:46 | 000,164,864 | —- | C] () – C:\WINDOWS\patchw32.dll
[2000/09/08 18:53:50 | 000,073,839 | —- | C] () – C:\WINDOWS\System32\KodakOneTouch.dll
[1999/07/23 13:46:48 | 000,000,116 | —- | C] () – C:\WINDOWS\AuHCcup1.ini
[1999/07/23 10:53:20 | 000,129,536 | —- | C] () – C:\WINDOWS\AuHCcup1.dll
[1997/06/13 22:56:08 | 000,056,832 | —- | C] () – C:\WINDOWS\System32\iyvu9_32.dll

========== LOP Check ==========

[2010/05/15 08:38:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\2DBoy
[2010/02/21 16:06:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alawar Stargaze
[2009/10/27 13:01:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Astar Games
[2010/02/14 16:08:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\blg
[2010/02/16 12:35:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Burger Island 2
[2005/03/13 11:42:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BVRP Software
[2008/09/01 18:32:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Christmasville
[2005/04/22 22:14:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EA
[2008/05/21 20:16:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EscapeTheMuseum
[2010/04/06 19:40:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EscapeTheMuseum2
[2009/10/27 14:11:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Far Mills
[2009/03/22 12:54:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FarmFrenzy-PizzaParty
[2008/08/30 21:59:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FarmFrenzy2
[2009/10/03 15:15:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FarmFrenzy3
[2010/03/10 20:09:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FarmFrenzy3_Arctica
[2010/04/09 18:48:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Flood Light Games
[2009/09/08 09:14:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FlyWheelGames
[2008/09/16 21:47:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Forge of Games
[2008/07/11 21:16:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FreshGames
[2008/05/14 13:07:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Friends Games
[2010/08/02 10:21:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Fugazo
[2010/05/30 10:58:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GameHouse
[2010/07/19 11:10:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GamesBar
[2009/06/21 12:24:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Gogii
[2010/02/21 16:34:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Gogii Games
[2008/07/23 21:39:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Hazard Shield
[2010/07/26 10:55:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\HipSoft
[2009/02/07 11:08:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Intenium
[2010/08/11 13:35:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\InterAction studios
[2008/03/07 18:45:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iolo
[2010/08/28 07:48:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iWin
[2008/08/13 22:25:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iWin Games
[2010/08/02 14:08:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iWin_generic
[2010/06/22 18:28:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\JollyBear
[2010/08/04 14:46:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Kristanix Games
[2010/07/06 10:15:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Little Games Company
[2010/03/08 18:51:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Mandragora
[2010/02/02 18:16:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Mean Hamster Software
[2010/08/27 15:26:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Merscom
[2009/08/08 15:13:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\mevo
[2009/10/27 22:59:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2009/11/01 08:23:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nanovor
[2009/11/09 19:41:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Oberon Media
[2010/08/04 20:04:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCPitstop
[2009/05/29 16:07:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\pdf995
[2010/08/27 18:58:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PlayFirst
[2010/07/31 12:45:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\rionix
[2010/03/10 18:34:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Rumbic Studio
[2010/02/18 10:11:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sandlot Games
[2010/04/08 17:38:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sprouts Adventure
[2010/08/27 08:45:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SugarGames
[2010/02/18 15:14:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TangleBee - Data
[2010/08/30 12:14:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/02/21 11:41:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TikGames
[2010/02/16 10:28:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Valusoft
[2010/08/31 18:29:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WildTangent
[2010/08/01 21:28:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WindSolutions
[2010/02/15 09:15:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Zylom
[2010/08/01 22:39:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/01/18 21:42:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2008/12/14 00:00:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\acccore
[2009/08/10 11:22:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Alawar
[2010/07/26 11:43:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\AlterLab
[2008/09/16 18:53:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\BeachPartyCraze
[2010/06/18 11:25:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Blender Foundation
[2010/02/14 16:08:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\blg
[2009/09/08 09:43:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Bloom RU
[2010/02/18 09:30:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Boolat Games
[2010/08/13 08:01:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Boomzap
[2010/08/24 12:48:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Brunhilda_wildgames
[2009/01/23 09:01:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Burdaloo
[2010/08/02 14:19:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Camel101
[2010/08/02 13:58:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\CupcakeCafe
[2005/04/22 22:16:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\EA
[2009/03/23 20:32:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\EleFun Games
[2010/04/09 18:48:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Flood Light Games
[2009/04/27 22:43:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\FreshDiagnose
[2009/02/07 12:37:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\FrimaStudio
[2009/10/22 18:56:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\funkitron
[2010/08/28 08:19:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Gamelab
[2010/02/21 16:34:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Gogii Games
[2008/09/04 16:45:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Home Sweet Home
[2009/10/21 23:55:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Interact Commerce
[2009/06/18 19:55:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\IObit
[2008/06/19 21:06:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\ITTNord
[2010/08/28 07:48:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\iWin
[2010/08/02 14:08:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\iWin_generic
[2004/03/12 01:12:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Leadertech
[2010/07/06 10:15:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Little Games Company
[2008/05/02 22:17:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Ludia
[2010/02/02 18:16:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Mean Hamster Software
[2009/08/08 13:41:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Meridian93
[2010/08/27 15:26:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Merscom
[2010/05/29 12:03:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\mif2000's Hamlet
[2006/12/01 00:39:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\MyMovieCollection1
[2010/07/19 11:08:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Oberon Media
[2010/04/08 19:50:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Oberonv1003
[2010/02/19 11:19:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Ohana Games
[2009/07/23 22:52:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\OpenOffice.org
[2009/08/19 19:52:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\PetRush
[2010/08/27 18:58:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\PlayFirst
[2010/07/17 19:17:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Playrix Entertainment
[2009/11/03 22:02:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Pogo Games
[2010/01/05 15:41:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\PokemonPMDInstaller[1]
[2010/01/05 15:42:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\PokemonPMDWidget
[2010/02/02 20:56:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\SaveThePuppy
[2010/02/03 20:42:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\SBTT
[2007/12/26 21:58:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\School Zone Preferences
[2006/07/03 14:30:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Sereniti
[2010/08/01 09:06:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\ShinyTales
[2009/12/18 18:51:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Sony Online Entertainment
[2009/11/02 19:38:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\SpinTop Games
[2009/10/23 17:59:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Sudden Games
[2010/06/06 15:10:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Super-Cow
[2009/09/12 14:28:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Thunderbird
[2009/05/01 13:51:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\TikGames
[2010/04/28 08:31:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Unity
[2010/02/16 10:28:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Valusoft
[2007/03/02 17:02:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\VersionTracker Pro
[2007/02/28 17:03:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Viewpoint
[2009/04/27 22:43:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Wildfire
[2010/08/27 16:25:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\WildGames 3 Days Zoo Mystery
[2010/01/19 19:36:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\WildTangent
[2010/08/01 21:30:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\WindSolutions
[2008/08/21 16:17:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Wizards of the Coast
[2010/09/17 17:04:12 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2010/09/17 17:11:40 | 000,000,420 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{42EC31E9-8F7C-49A0-9A1A-DFF0DC6B75B4}.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\WINDOWS\System32\LEXPPS.EXE:SummaryInformation
@Alternate Data Stream - 7305 bytes -> C:\WINDOWS\Zcodzne.cjt:gpgtys
@Alternate Data Stream - 7305 bytes -> C:\WINDOWS\TWAIN.DLL:ocits
@Alternate Data Stream - 7305 bytes -> C:\WINDOWS\EXPLORER.SCF:rtwurj
@Alternate Data Stream - 3567 bytes -> C:\WINDOWS\Soqevahzci.ujs:lcvekl
@Alternate Data Stream - 3547 bytes -> C:\WINDOWS\Zmodwlfokk.uua:yqzyad
@Alternate Data Stream - 3362 bytes -> C:\WINDOWS\Uzipprkze.qlk:hthib
@Alternate Data Stream - 3362 bytes -> C:\WINDOWS\FeatherTexture.bmp:wgyah
@Alternate Data Stream - 3347 bytes -> C:\WINDOWS\WMSysPrx.prx:trkym
@Alternate Data Stream - 3347 bytes -> C:\WINDOWS\FeatherTexture.bmp:kugztt
@Alternate Data Stream - 3347 bytes -> C:\WINDOWS\Clonrklid.kwk:gbisq
@Alternate Data Stream - 304 bytes -> C:\Documents and Settings\Bill\My Documents\and wedding.jpg:SummaryInformation
@Alternate Data Stream - 195 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D091E13E
@Alternate Data Stream - 191 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E7123C4C
@Alternate Data Stream - 186 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F30757AC
@Alternate Data Stream - 152 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1941675B
@Alternate Data Stream - 151 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D20FFA63
@Alternate Data Stream - 151 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CE0A077E
@Alternate Data Stream - 151 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:63596073
@Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5856B2C0
@Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2556A8A0
@Alternate Data Stream - 147 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6EAE3ABC
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C3B04546
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4CD2D817
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:07348C09
@Alternate Data Stream - 144 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4EAD6852
@Alternate Data Stream - 143 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2F34C507
@Alternate Data Stream - 142 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:898C038B
@Alternate Data Stream - 141 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:588B60C7
@Alternate Data Stream - 141 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:55CC8080
@Alternate Data Stream - 141 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3447AB86
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FDD78BE5
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E8A39657
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:70DA7E92
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:68C4BECC
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5711EF65
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3064D21D
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0656FCD2
@Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E6D38BF2
@Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:860D9052
@Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B8B102B9
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:512B5648
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:01442FD8
@Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9B7E8561
@Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C270C64
@Alternate Data Stream - 132 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CD2ECCEC
@Alternate Data Stream - 132 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AA6C7C38
@Alternate Data Stream - 131 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:23FA878E
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A86C3734
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8810E5F6
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3C9CF9A7
@Alternate Data Stream - 128 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B894C266
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:93DE1838
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:50A11A00
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E6E9EB6C
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:81B52FA6
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6A97C459
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A15D6B27
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:38317199
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CBEB737E
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BB48E5A3
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6468C896
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4D1D6B2D
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:34BCB6A9
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DAFD38AE
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:69EC5FA7
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:38849DE5
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2FF0CA93
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1FA51BA6
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2D723B3A
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:30C46519
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9446E8B9
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:42228396
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:002640E3
@Alternate Data Stream - 11592 bytes -> C:\WINDOWS\Ybzbotrdi.pll:vodikx
@Alternate Data Stream - 11592 bytes -> C:\WINDOWS\Qovmhiu.cun:yybdvg
@Alternate Data Stream - 11592 bytes -> C:\WINDOWS\DELL.BMP:ikcjaf
@Alternate Data Stream - 11592 bytes -> C:\WINDOWS\CONTROL.INI:zzydic
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\Zcodzne.cjt:xvvie
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\Vfdlzvgwj.nrn:upald
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\TWAIN.DLL:mrmkk
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\Kctmpiihnev.kov:gitbc
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\Dygxoromb.vlx:ynmgl
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\Dygxoromb.vlx:navtp
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\Dygxoromb.vlx:gskjvw
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:68F126E0
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5EC637CB
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:29468260
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7715B65F
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C4A1F01E
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4BB26BE9
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:86F3B593
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C07C19F
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E35A81F4
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A18FC5E4
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:45FE2B4E
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AF8E48E2
< End of report >

Here is the OTL log after the fix was run.

OTL logfile created on: 9/17/2010 10:30:52 PM - Run 3
OTL by OldTimer - Version 3.2.12.1 Folder = C:\Documents and Settings\Bill\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 66.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 192 384 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.47 Gb Total Space | 29.56 Gb Free Space | 39.70% Space Free | Partition Type: NTFS
Unable to calculate disk information.
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: LILDER
Current User Name: Bill
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Bill\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe ()
PRC - C:\Program Files\Windows Defender\MpCmdRun.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (AOL LLC)
PRC - C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Bill\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\SYSTEM32\msscript.ocx (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe File not found
SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (GameConsoleService) – C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe (WildTangent, Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (wlidsvc) – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (bckwfs) – C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe ()
SRV - (ioloDMV) – C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe ()
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (KodakCCS) – C:\WINDOWS\SYSTEM32\DRIVERS\KodakCCS.exe (Eastman Kodak Company)
SRV - (WANMiniportService) WAN Miniport (ATW) – C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)


========== Driver Services (SafeList) ==========

DRV - (iAimTV2) – C:\WINDOWS\System32\DRIVERS\wATV03nt.sys File not found
DRV - (FreshIO) – C:\Program Files\FreshDevices\FreshDiagnose\FreshIO.sys File not found
DRV - (ENTECH) – C:\WINDOWS\System32\DRIVERS\ENTECH.SYS File not found
DRV - (catchme) – C:\ComboFix\catchme.sys File not found
DRV - (avgntflt) – C:\WINDOWS\SYSTEM32\DRIVERS\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\SYSTEM32\DRIVERS\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) – C:\WINDOWS\SYSTEM32\DRIVERS\avipbb.sys (Avira GmbH)
DRV - (avgio) – C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (bckd) – C:\WINDOWS\SYSTEM32\DRIVERS\bckd.sys ()
DRV - (ATWPKT2) – C:\WINDOWS\SYSTEM32\DRIVERS\atwpkt2.sys (America Online)
DRV - (amdagp) – C:\WINDOWS\System32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\System32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (ALWIL Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (ALWIL Software)
DRV - (MxlW2k) – C:\WINDOWS\System32\drivers\MxlW2k.sys (MusicMatch, Inc.)
DRV - (ASPI32) – C:\WINDOWS\SYSTEM32\DRIVERS\ASPI32.SYS (Adaptec)
DRV - (DcCam) – C:\WINDOWS\SYSTEM32\DRIVERS\DcCam.sys (Eastman Kodak Company)
DRV - (Exportit) – C:\WINDOWS\SYSTEM32\DRIVERS\ExportIt.sys (Eastman Kodak Company)
DRV - (DcPTP) – C:\WINDOWS\SYSTEM32\DRIVERS\DcPtp.sys (Eastman Kodak Company)
DRV - (DcLps) – C:\WINDOWS\SYSTEM32\DRIVERS\DcLps.sys (Eastman Kodak Company)
DRV - (DCFS2K) – C:\WINDOWS\SYSTEM32\DRIVERS\DCFS2k.sys (Eastman Kodak Company)
DRV - (DcFpoint) – C:\WINDOWS\SYSTEM32\DRIVERS\DcFpoint.sys (Eastman Kodak Company)
DRV - (nv) – C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (iAimFP4) – C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys (Intel® Corporation)
DRV - (iAimFP3) – C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys (Intel® Corporation)
DRV - (iAimTV4) – C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys (Intel® Corporation)
DRV - (iAimTV3) – C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys (Intel® Corporation)
DRV - (iAimTV1) – C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys (Intel® Corporation)
DRV - (iAimTV0) – C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys (Intel® Corporation)
DRV - (iAimFP0) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys (Intel® Corporation)
DRV - (iAimFP1) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys (Intel® Corporation)
DRV - (iAimFP2) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys (Intel® Corporation)
DRV - (i81x) – C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys (Intel® Corporation)
DRV - (BCMModem) – C:\WINDOWS\SYSTEM32\DRIVERS\BCMSM.sys (Broadcom Corporation)
DRV - (tfsnudfa) – C:\WINDOWS\SYSTEM32\dla\tfsnudfa.sys (Sonic Solutions)
DRV - (tfsnudf) – C:\WINDOWS\SYSTEM32\dla\tfsnudf.sys (Sonic Solutions)
DRV - (tfsnifs) – C:\WINDOWS\SYSTEM32\dla\tfsnifs.sys (Sonic Solutions)
DRV - (tfsncofs) – C:\WINDOWS\SYSTEM32\dla\tfsncofs.sys (Sonic Solutions)
DRV - (tfsnboio) – C:\WINDOWS\SYSTEM32\dla\tfsnboio.sys (Sonic Solutions)
DRV - (tfsnopio) – C:\WINDOWS\SYSTEM32\dla\tfsnopio.sys (Sonic Solutions)
DRV - (tfsnpool) – C:\WINDOWS\SYSTEM32\dla\tfsnpool.sys (Sonic Solutions)
DRV - (tfsndrct) – C:\WINDOWS\SYSTEM32\dla\tfsndrct.sys (Sonic Solutions)
DRV - (tfsndres) – C:\WINDOWS\SYSTEM32\dla\tfsndres.sys (Sonic Solutions)
DRV - (drvmcdb) – C:\WINDOWS\system32\drivers\drvmcdb.sys (Sonic Solutions)
DRV - (sscdbhk5) – C:\WINDOWS\SYSTEM32\DRIVERS\sscdbhk5.sys (Sonic Solutions)
DRV - (ssrtln) – C:\WINDOWS\SYSTEM32\DRIVERS\ssrtln.sys (Sonic Solutions)
DRV - (drvnddm) – C:\WINDOWS\SYSTEM32\DRIVERS\drvnddm.sys (Sonic Solutions)
DRV - (bcm4sbxp) – C:\WINDOWS\SYSTEM32\DRIVERS\bcm4sbxp.sys (Broadcom Corporation)
DRV - (ENETHUSB) – C:\WINDOWS\SYSTEM32\DRIVERS\enethusb.sys (Efficient Networks, Inc.)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\SYSTEM32\DRIVERS\wanatw4.sys (America Online, Inc.)
DRV - (omci) – C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys (Dell Computer Corporation)
DRV - (Sparrow) – C:\WINDOWS\System32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) – C:\WINDOWS\System32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\System32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) – C:\WINDOWS\System32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) – C:\WINDOWS\System32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (MODEMCSA) – C:\WINDOWS\SYSTEM32\DRIVERS\MODEMCSA.sys (Microsoft Corporation)
DRV - (ultra) – C:\WINDOWS\System32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) – C:\WINDOWS\System32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\System32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) – C:\WINDOWS\System32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) – C:\WINDOWS\System32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) – C:\WINDOWS\System32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) – C:\WINDOWS\System32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) – C:\WINDOWS\System32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) – C:\WINDOWS\System32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) – C:\WINDOWS\System32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (EL90XBC) – C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS (3Com Corporation)
DRV - (USBIO) USBIO Driver (usbio.sys) – C:\WINDOWS\SYSTEM32\DRIVERS\usbio.sys (Thesycon GmbH, Germany)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Data = C3 17 11 E0 B2 A4 AC 29 3E F1 D7 B3 41 49 19 66 EF FE DE 71 3C 18 BA 0A F9 AA 17 17 FE 78 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant_bak = res://C:\WINDOWS\system32\tdbqn.dll/sp.html#28129
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Yahoo!"
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..extensions.enabledItems: {1650a312-02bc-40ee-977e-83f158701739}:26.3
FF - prefs.js..extensions.enabledItems: [removed]:4.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {27182e60-b5f3-411c-b545-b44205977502}:1.0
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..keyword.URL: "http://searchservice.myspace.com/index.cfm?fuseaction=sitesearch.results&type;=Web&orig;=IMC-FF&qry;="


FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\MSN Toolbar\Platform\4.0.0314.0\Firefox [2009/10/21 18:21:28 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010/06/09 02:38:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/10 18:04:30 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/08/10 16:45:45 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010/08/01 22:32:05 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/07/30 15:07:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Mozilla\Extensions
[2010/08/30 12:14:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\extensions
[2010/07/30 20:44:21 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2006/12/17 23:22:23 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\extensions\{34274bf4-1d97-a289-e984-17e546307e4f}
[2008/04/28 17:19:17 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2006/12/23 17:29:05 | 000,000,000 | —D | M] (Yahoo! Photos Easy Upload Tool) – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\extensions\{DD99D76F-5129-4fd3-A2DC-AB41D6FBCF98}
[2006/10/15 20:52:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\extensions\temp
[2008/12/12 14:23:54 | 000,002,158 | —- | M] () – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\searchplugins\MySpace.xml
[2007/02/12 18:23:12 | 000,002,386 | —- | M] () – C:\Documents and Settings\Bill\Application Data\Mozilla\Firefox\Profiles\cbt8ye04.default\searchplugins\siteadvisor.xml
[2010/08/26 01:24:17 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2007/12/02 02:32:07 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}
[2005/04/27 16:10:49 | 000,102,400 | —- | M] (RealNetworks) – C:\Program Files\Mozilla Firefox\plugins\npracplug.dll

O1 HOSTS File: ([2010/09/16 15:28:05 | 000,000,027 | —- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6028\SiteAdv.dll (McAfee, Inc.)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (MSN Toolbar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\4.0.0314.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6028\SiteAdv.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\4.0.0314.0\npwinext.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {724D43A0-0D85-11D4-9908-00400523E39A} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\Adobe\SHOCKW~1\SWHELP~2.EXE -Update -1103472 -Mozilla\4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident\4.0; Mozilla\4.0 ( File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\SYSTEM32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} http://www.pogo.com/cdl/launcher/PogoWebLa…erInstaller.CAB (PogoWebLauncher Control)
O16 - DPF: {38AB6A6C-CC4C-4F9E-A3DD-3C5681EF18A1} http://www-cdn.freerealms.com/gamedata/plu…ller.cab?v=1042 (SonyOnlineInstallerX)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.av.aol.com/molbin/shared/m…83/mcinsctl.cab (Reg Error: Value error.)
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} http://mediaplayer.walmart.com/installer/install.cab (Reg Error: Value error.)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab (Reg Error: Value error.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {A27C56D2-3F58-4ABB-AA31-1168EDA6636F} http://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab (PCMaticVer Class)
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://download.av.aol.com/molbin/shared/m…,20/mcgdmgr.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flash…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.254.254 192.168.254.254
O18 - Protocol\Handler\siteadvisor {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6028\SiteAdv.dll (McAfee, Inc.)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Bill\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Bill\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/09/03 10:59:58 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (smrgdf C:\Documents and Settings\Bill\Application Data\iolo\) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/09/17 22:01:49 | 000,000,000 | —D | C] – C:\_OTL
[2010/09/17 17:07:39 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Bill\Desktop\OTL.exe
[2010/09/16 22:55:40 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2010/09/16 16:07:15 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/09/16 15:07:29 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/09/16 15:03:19 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/09/16 15:03:19 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/09/16 15:03:19 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/09/13 13:13:46 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/09/04 09:28:07 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\McAfee
[2010/08/29 12:13:45 | 000,000,000 | —D | C] – C:\Planet 51 Online
[2010/08/28 07:48:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\iWin
[2010/08/27 16:24:45 | 000,000,000 | —D | C] – C:\Documents and Settings\Bill\Application Data\WildGames 3 Days Zoo Mystery
[2010/08/27 15:26:03 | 000,000,000 | —D | C] – C:\Documents and Settings\Bill\Application Data\Merscom
[2010/08/27 15:26:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Merscom
[2010/08/27 14:03:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Bill\My Documents\FunPark Beach Blast
[2010/08/27 08:45:10 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SugarGames
[2010/08/24 12:43:49 | 000,000,000 | —D | C] – C:\Documents and Settings\Bill\Application Data\Brunhilda_wildgames
[2005/07/23 23:57:48 | 000,774,144 | —- | C] (RealNetworks, Inc.) – C:\Program Files\RngInterstitial.dll

========== Files - Modified Within 30 Days ==========

[2010/09/17 22:22:14 | 000,000,420 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{42EC31E9-8F7C-49A0-9A1A-DFF0DC6B75B4}.job
[2010/09/17 22:19:07 | 000,001,170 | —- | M] () – C:\WINDOWS\System32\WPA.DBL
[2010/09/17 22:13:51 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/09/17 22:10:21 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/09/17 22:10:16 | 000,002,048 | –S- | M] () – C:\WINDOWS\BOOTSTAT.DAT
[2010/09/17 22:10:14 | 1205,932,032 | -HS- | M] () – C:\hiberfil.sys
[2010/09/17 22:09:24 | 008,196,096 | —- | M] () – C:\Documents and Settings\Bill\ntuser.dat
[2010/09/17 22:09:24 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\Bill\NTUSER.INI
[2010/09/17 17:07:50 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Bill\Desktop\OTL.exe
[2010/09/17 16:58:56 | 002,113,328 | -H– | M] () – C:\Documents and Settings\Bill\Local Settings\Application Data\IconCache.db
[2010/09/16 15:29:57 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/09/16 15:28:05 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\ETC\hosts
[2010/09/16 15:07:38 | 000,000,327 | RHS- | M] () – C:\BOOT.INI
[2010/09/15 07:20:02 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/09/13 07:45:50 | 000,000,444 | —- | M] () – C:\WINDOWS\System32\d3d8caps.dat
[2010/09/05 21:42:04 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/08/29 12:14:22 | 000,001,466 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Planet 51 Online.lnk

========== Files Created - No Company Name ==========

[2010/09/16 15:07:38 | 000,000,211 | —- | C] () – C:\Boot.bak
[2010/09/16 15:07:31 | 000,260,272 | RHS- | C] () – C:\cmldr
[2010/09/16 15:03:20 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/09/16 15:03:19 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/09/16 15:03:19 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/09/16 15:03:19 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/09/16 15:03:19 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/09/13 14:08:40 | 1205,932,032 | -HS- | C] () – C:\hiberfil.sys
[2010/09/13 07:45:50 | 000,000,444 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2010/09/11 07:51:12 | 008,196,096 | —- | C] () – C:\Documents and Settings\Bill\ntuser.dat
[2010/08/29 12:14:22 | 000,001,466 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Planet 51 Online.lnk
[2010/07/27 09:28:08 | 000,000,022 | -HS- | C] () – C:\Documents and Settings\Bill\Application Data\Sys6925.Config Collection.sys
[2009/11/19 16:32:45 | 000,000,056 | RHS- | C] () – C:\WINDOWS\System32\5765BFF273.sys
[2009/11/19 16:32:42 | 000,000,952 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2009/07/10 23:53:18 | 000,815,104 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/07/10 23:53:17 | 000,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/01/31 17:46:39 | 000,000,028 | —- | C] () – C:\WINDOWS\pdf995.ini
[2009/01/31 17:45:24 | 000,000,059 | —- | C] () – C:\WINDOWS\wpd99.drv
[2009/01/31 17:45:19 | 000,051,716 | —- | C] () – C:\WINDOWS\System32\pdf995mon.dll
[2009/01/13 19:39:06 | 000,072,992 | —- | C] () – C:\WINDOWS\System32\drivers\bckd.sys
[2008/10/07 09:13:30 | 000,197,912 | —- | C] () – C:\WINDOWS\System32\physxcudart_20.dll
[2008/10/07 09:13:22 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelKorean.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelGerman.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelFrench.dll
[2008/10/06 21:41:40 | 000,118,784 | —- | C] () – C:\WINDOWS\System32\PTTreeIcons.dll
[2008/06/24 21:32:55 | 000,000,346 | —- | C] () – C:\WINDOWS\cncscore.ini
[2007/07/25 13:49:35 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2007/03/30 14:31:20 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\dec_jl6.dll
[2007/03/25 11:16:44 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\vetntmsg.dll
[2007/03/03 13:39:50 | 000,696,320 | —- | C] () – C:\WINDOWS\System32\libeay32.dll
[2007/03/03 13:39:50 | 000,155,648 | —- | C] () – C:\WINDOWS\System32\ssleay32.dll
[2006/11/21 18:12:21 | 000,000,026 | —- | C] () – C:\WINDOWS\WAR2R.INI
[2006/10/15 13:39:00 | 000,000,000 | —- | C] () – C:\WINDOWS\PestPatrol5.INI
[2006/07/11 22:25:44 | 000,002,455 | —- | C] () – C:\WINDOWS\ULEAD32.INI
[2006/07/11 21:57:39 | 000,700,416 | —- | C] () – C:\WINDOWS\System32\FreeImage.dll
[2006/01/19 18:27:35 | 000,000,198 | —- | C] () – C:\WINDOWS\QTW.INI
[2006/01/04 22:57:31 | 000,004,678 | —- | C] () – C:\WINDOWS\CDMaster.ini
[2005/08/30 01:00:00 | 000,781,312 | —- | C] () – C:\WINDOWS\System32\RGSS102J.dll
[2005/08/30 01:00:00 | 000,778,752 | —- | C] () – C:\WINDOWS\System32\RGSS102E.dll
[2005/08/30 01:00:00 | 000,771,584 | —- | C] () – C:\WINDOWS\System32\RGSS100J.dll
[2005/05/14 09:18:33 | 000,000,823 | —- | C] () – C:\WINDOWS\tsc.ini
[2005/05/14 09:18:32 | 000,071,749 | —- | C] () – C:\WINDOWS\hcextoutput.dll
[2005/05/14 08:42:43 | 000,000,170 | —- | C] () – C:\WINDOWS\GetServer.ini
[2005/03/18 23:55:40 | 000,436,840 | —- | C] () – C:\WINDOWS\System32\Incinerator.dll
[2005/03/13 11:36:22 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxbkvs.dll
[2005/03/13 11:36:21 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\LXBKLCNP.DLL
[2005/03/13 11:35:32 | 000,000,266 | —- | C] () – C:\WINDOWS\System32\lxbkcoin.ini
[2005/02/11 21:59:47 | 000,000,004 | —- | C] () – C:\WINDOWS\msoffice.ini
[2005/02/07 18:16:33 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
[2005/02/05 20:30:21 | 000,006,306 | —- | C] () – C:\WINDOWS\Pnkqmmug.ini
[2005/01/24 19:02:30 | 000,000,000 | —- | C] () – C:\WINDOWS\MSDraw.ini
[2005/01/11 22:44:57 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/12/24 21:22:00 | 000,001,147 | —- | C] () – C:\WINDOWS\hmpro4.ini
[2004/12/24 20:53:23 | 000,000,000 | —- | C] () – C:\WINDOWS\addwt32.dll
[2004/12/12 20:36:58 | 000,000,022 | —- | C] () – C:\WINDOWS\kodakpcd.Bill.ini
[2004/12/10 20:31:35 | 000,000,000 | —- | C] () – C:\WINDOWS\apifx.dll
[2004/12/09 01:42:27 | 000,000,000 | —- | C] () – C:\WINDOWS\netmx.dll
[2004/12/05 01:26:06 | 000,000,000 | —- | C] () – C:\WINDOWS\javanu32.dll
[2004/12/03 22:09:40 | 000,000,045 | —- | C] () – C:\WINDOWS\CHKLKIKP.ini
[2004/12/01 17:45:16 | 000,000,000 | —- | C] () – C:\WINDOWS\apiec32.dll
[2004/11/30 22:35:03 | 000,000,029 | —- | C] () – C:\WINDOWS\atid.ini
[2004/11/20 09:23:53 | 000,000,000 | -HS- | C] () – C:\WINDOWS\kqsdb.dll
[2004/11/17 03:56:46 | 000,000,000 | —- | C] () – C:\WINDOWS\mskz.dll
[2004/11/17 00:13:09 | 000,000,175 | —- | C] () – C:\WINDOWS\upst.ini
[2004/11/13 12:44:26 | 000,000,000 | —- | C] () – C:\WINDOWS\apphn32.dll
[2004/10/31 11:05:21 | 000,000,000 | —- | C] () – C:\WINDOWS\hiawi.dll
[2004/10/30 17:55:00 | 000,011,640 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/10/21 02:31:37 | 000,000,413 | —- | C] () – C:\WINDOWS\lexstat.ini
[2004/08/28 21:36:41 | 000,000,078 | -H– | C] () – C:\WINDOWS\System32\014132.SYS
[2004/08/28 21:31:07 | 000,292,864 | —- | C] () – C:\WINDOWS\System32\tcl75.dll
[2004/08/28 21:31:07 | 000,027,648 | —- | C] () – C:\WINDOWS\System32\pdo20132.dll
[2004/08/28 21:31:06 | 000,034,304 | —- | C] () – C:\WINDOWS\System32\odma32.dll
[2004/08/28 21:30:55 | 000,007,168 | —- | C] () – C:\WINDOWS\System32\dtctrace.dll
[2004/08/28 21:30:52 | 000,029,008 | —- | C] () – C:\WINDOWS\System32\helphelp.dll
[2004/04/20 10:36:02 | 000,000,398 | —- | C] () – C:\WINDOWS\System32\master.dll
[2004/04/03 16:31:04 | 000,011,264 | —- | C] () – C:\Documents and Settings\Bill\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/04/03 15:54:50 | 000,000,406 | —- | C] () – C:\WINDOWS\cdPlayer.ini
[2004/03/28 10:40:22 | 000,001,266 | —- | C] () – C:\WINDOWS\disney.ini
[2004/03/12 00:51:53 | 000,000,127 | —- | C] () – C:\Documents and Settings\Bill\Local Settings\Application Data\fusioncache.dat
[2004/03/12 00:04:26 | 000,017,380 | —- | C] () – C:\Documents and Settings\Bill\Application Data\wklnhst.dat
[2004/03/06 01:46:25 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/03/06 01:34:46 | 000,000,892 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/03/06 01:13:30 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/03/06 01:13:01 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/03/06 00:55:20 | 000,000,550 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2003/08/14 00:54:00 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/03/27 17:28:44 | 000,004,955 | —- | C] () – C:\WINDOWS\System32\DProg.ini
[2002/11/01 16:17:50 | 000,000,256 | —- | C] () – C:\WINDOWS\aucfg.ini
[2002/07/04 15:05:34 | 000,000,269 | —- | C] () – C:\WINDOWS\tmupdate.ini
[2001/12/14 13:34:46 | 000,164,864 | —- | C] () – C:\WINDOWS\patchw32.dll
[2000/09/08 18:53:50 | 000,073,839 | —- | C] () – C:\WINDOWS\System32\KodakOneTouch.dll
[1999/07/23 13:46:48 | 000,000,116 | —- | C] () – C:\WINDOWS\AuHCcup1.ini
[1999/07/23 10:53:20 | 000,129,536 | —- | C] () – C:\WINDOWS\AuHCcup1.dll
[1997/06/13 22:56:08 | 000,056,832 | —- | C] () – C:\WINDOWS\System32\iyvu9_32.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\WINDOWS\System32\LEXPPS.EXE:SummaryInformation
@Alternate Data Stream - 7305 bytes -> C:\WINDOWS\Zcodzne.cjt:gpgtys
@Alternate Data Stream - 7305 bytes -> C:\WINDOWS\TWAIN.DLL:ocits
@Alternate Data Stream - 7305 bytes -> C:\WINDOWS\EXPLORER.SCF:rtwurj
@Alternate Data Stream - 3567 bytes -> C:\WINDOWS\Soqevahzci.ujs:lcvekl
@Alternate Data Stream - 3547 bytes -> C:\WINDOWS\Zmodwlfokk.uua:yqzyad
@Alternate Data Stream - 3362 bytes -> C:\WINDOWS\Uzipprkze.qlk:hthib
@Alternate Data Stream - 3362 bytes -> C:\WINDOWS\FeatherTexture.bmp:wgyah
@Alternate Data Stream - 3347 bytes -> C:\WINDOWS\WMSysPrx.prx:trkym
@Alternate Data Stream - 3347 bytes -> C:\WINDOWS\FeatherTexture.bmp:kugztt
@Alternate Data Stream - 3347 bytes -> C:\WINDOWS\Clonrklid.kwk:gbisq
@Alternate Data Stream - 304 bytes -> C:\Documents and Settings\Bill\My Documents\and wedding.jpg:SummaryInformation
@Alternate Data Stream - 195 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D091E13E
@Alternate Data Stream - 191 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E7123C4C
@Alternate Data Stream - 186 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F30757AC
@Alternate Data Stream - 152 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1941675B
@Alternate Data Stream - 151 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D20FFA63
@Alternate Data Stream - 151 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CE0A077E
@Alternate Data Stream - 151 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:63596073
@Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5856B2C0
@Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2556A8A0
@Alternate Data Stream - 147 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6EAE3ABC
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C3B04546
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4CD2D817
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:07348C09
@Alternate Data Stream - 144 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4EAD6852
@Alternate Data Stream - 143 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2F34C507
@Alternate Data Stream - 142 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:898C038B
@Alternate Data Stream - 141 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:588B60C7
@Alternate Data Stream - 141 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:55CC8080
@Alternate Data Stream - 141 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3447AB86
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FDD78BE5
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E8A39657
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:70DA7E92
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:68C4BECC
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5711EF65
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3064D21D
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0656FCD2
@Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E6D38BF2
@Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:860D9052
@Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B8B102B9
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:512B5648
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:01442FD8
@Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9B7E8561
@Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C270C64
@Alternate Data Stream - 132 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CD2ECCEC
@Alternate Data Stream - 132 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AA6C7C38
@Alternate Data Stream - 131 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:23FA878E
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A86C3734
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8810E5F6
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3C9CF9A7
@Alternate Data Stream - 128 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B894C266
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:93DE1838
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:50A11A00
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E6E9EB6C
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:81B52FA6
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6A97C459
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A15D6B27
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:38317199
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CBEB737E
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BB48E5A3
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6468C896
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4D1D6B2D
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:34BCB6A9
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DAFD38AE
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:69EC5FA7
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:38849DE5
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2FF0CA93
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1FA51BA6
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2D723B3A
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:30C46519
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9446E8B9
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:42228396
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:002640E3
@Alternate Data Stream - 11592 bytes -> C:\WINDOWS\Ybzbotrdi.pll:vodikx
@Alternate Data Stream - 11592 bytes -> C:\WINDOWS\Qovmhiu.cun:yybdvg
@Alternate Data Stream - 11592 bytes -> C:\WINDOWS\DELL.BMP:ikcjaf
@Alternate Data Stream - 11592 bytes -> C:\WINDOWS\CONTROL.INI:zzydic
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\Zcodzne.cjt:xvvie
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\Vfdlzvgwj.nrn:upald
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\TWAIN.DLL:mrmkk
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\Kctmpiihnev.kov:gitbc
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\Dygxoromb.vlx:ynmgl
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\Dygxoromb.vlx:navtp
@Alternate Data Stream - 11591 bytes -> C:\WINDOWS\Dygxoromb.vlx:gskjvw
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:68F126E0
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5EC637CB
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:29468260
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7715B65F
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C4A1F01E
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4BB26BE9
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:86F3B593
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C07C19F
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E35A81F4
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A18FC5E4
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:45FE2B4E
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AF8E48E2
< End of report >