Google redirects, audio drivers uninstalling, and more!

Hello, I am in need of some assistance and after reading a few of the threads on the site it looks like I have come to the right place. I am having some issues on my Gateway Media Center PC (Pen4 CPU, 4gb RAM, 32-bit). When searching Google or any other engine for that matter, I randomly get redirected to ads or fake sites unless I right-click “open in new tab”. When this occurs, my PC starts to become sluggish or non-responsive. From there I checked my task manager to find that I have several svchost.exe apps running and one will really be doing a number on my CPU output. If I end process on this task all running’s return to normal immediately….but all of a sudden my audio drivers uninstall or something (highjacker perhaps??). I have to reinstall the audio drivers and then upon reboot everything seems fine, but later on the whole process starts over and this has been going on for almost a week now. In addition to all that (I know…I know…), I am running Norton as my antivirus and every 3-5 minutes “something” is trying to “phone home” or connect to some third party or whatever, and Norton just keeps on blocking it but won’t give me any info (other than the originating IP) about how to stop it from connecting but comes up with nothing when a scan is performed.

Now before I started doing any research about these issues, I was already thinking about backing up my important files and doing a clean install since I had a whole lot of accumulated junk. So once these issues arose I just said “screw it” and reformatted using my Recovery Drive. Since I have reformatted, I still have around 5 svchost.exe processes in my task manager, my internet connections have disappeared other than LAN (I am using my PC at work to post this, and download any necessary files), and I cannot create or configure any new broadband connections. When I run the Network Connection Wizard and try to setup a new broadband connection I get a notification that “all broadband connections are configured correctly”…. “ for more info on broadband connections click here blah, blah, blah”. So I have no clue where to go from here. I have a external drive with me at work that I can download any necessary files such as ComboFix, Highjack This, DDS ect… but will have to return home to run the programs, and then post the logs the following day. Any help would be GREATLY appreciated. Thanks in advance!

I would like to apologize to the forum gods here for not pre-reading the Are You Infected topic before posting. I have downloaded the necessary files from that thread and will run them as soon as I get home and post logs tomorrow unless I get my broadband connection fixed in which case I will post the logs tonight.

Thanks again.

Sorry for the delay, attached are the logs requested. Please note that the extras.txt file posted is a result of a first can that did not have the pasted custom scan info. When I re-ran the scan with the info no extras file appeared.

OTL logfile created on: 2/26/2011 12:39:45 AM - Run 3
OTL by OldTimer - Version 3.2.21.0 Folder = C:Documents and SettingsJDesktop
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 52.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 83.00% Paging File free
Paging file location(s): C:pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:WINDOWS | %ProgramFiles% = C:Program Files
Drive C: | 143.72 Gb Total Space | 134.20 Gb Free Space | 93.38% Space Free | Partition Type: NTFS
Drive D: | 5.31 Gb Total Space | 2.24 Gb Free Space | 42.13% Space Free | Partition Type: FAT32
Drive J: | 1.88 Gb Total Space | 1.40 Gb Free Space | 74.41% Space Free | Partition Type: FAT32

Computer Name: CARROLLS_PC | User Name: J | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:Program FilesCommon FilesNew BoundaryPrismXLPRISMXL.SYS (New Boundary Technologies, Inc.)
PRC - C:Documents and SettingsJDesktopOTL.exe (OldTimer Tools)
PRC - C:Program FilesBillP StudiosWinPatrolWinPatrol.exe (BillP Studios)
PRC - C:Program FilesNorton Security SuiteEngine4.0.0.127ccSvcHst.exe (Symantec Corporation)
PRC - C:Program FilesDigital Media Readerreadericon45G.exe (Alcor Micro, Corp.)
PRC - C:WINDOWSexplorer.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:Documents and SettingsJDesktopOTL.exe (OldTimer Tools)
MOD - C:Program FilesNorton Security SuiteEngine4.0.0.127asOEHook.dll (Symantec Corporation)
MOD - C:Program FilesNorton Security SuiteEngine4.0.0.127Microsoft.VC90.CRTmsvcr90.dll (Microsoft Corporation)
MOD - C:Program FilesNorton Security SuiteEngine4.0.0.127Microsoft.VC90.CRTmsvcp90.dll (Microsoft Corporation)
MOD - C:Program FilesBillP StudiosWinPatrolpatrolpro.dll (BillP Studios)
MOD - C:WINDOWSWinSxSx86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (PrismXL) – C:Program FilesCommon FilesNew BoundaryPrismXLPRISMXL.SYS (New Boundary Technologies, Inc.)
SRV - (N360) – C:Program FilesNorton Security SuiteEngine4.0.0.127ccSvcHst.exe (Symantec Corporation)


========== Driver Services (SafeList) ==========

DRV - (SymEvent) – C:WINDOWSsystem32driversSYMEVENT.SYS (Symantec Corporation)
DRV - (NAVEX15) – C:Documents and SettingsAll UsersApplication DataNorton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}N360_4.0.0.127DefinitionsVirusDefs20110225.018NAVEX15.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:Program FilesCommon FilesSymantec SharedEENGINEeeCtrl.sys (Symantec Corporation)
DRV - (NAVENG) – C:Documents and SettingsAll UsersApplication DataNorton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}N360_4.0.0.127DefinitionsVirusDefs20110225.018NAVENG.SYS (Symantec Corporation)
DRV - (IDSxpx86) – C:Documents and SettingsAll UsersApplication DataNorton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}N360_4.0.0.127DefinitionsIPSDefs20110225.001IDSXpx86.sys (Symantec Corporation)
DRV - (BHDrvx86) – C:Documents and SettingsAll UsersApplication DataNorton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}N360_4.0.0.127DefinitionsBASHDefs20110114.001BHDrvx86.sys (Symantec Corporation)
DRV - (nv) – C:WINDOWSsystem32driversnv4_mini.sys (NVIDIA Corporation)
DRV - (ccHP) – C:WINDOWSsystem32driversN360\0400000.07FccHPx86.sys (Symantec Corporation)
DRV - (SRTSP) – C:WINDOWSsystem32driversN360\0400000.07FSRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:WINDOWSsystem32driversN360\0400000.07FSRTSPX.SYS (Symantec Corporation)
DRV - (SymEFA) – C:WINDOWSsystem32driversN360\0400000.07FSYMEFA.SYS (Symantec Corporation)
DRV - (SymIRON) – C:WINDOWSsystem32driversN360\0400000.07FIronx86.SYS (Symantec Corporation)
DRV - (SYMTDI) – C:WINDOWSsystem32driversN360\0400000.07FSYMTDI.SYS (Symantec Corporation)
DRV - (SymDS) – C:WINDOWSsystem32driversN360\0400000.07FSYMDS.SYS (Symantec Corporation)
DRV - (HSF_DPV) – C:WINDOWSsystem32driversHSF_DPV.sys (Conexant Systems, Inc.)
DRV - (HSFHWBS2) – C:WINDOWSsystem32driversHSFHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:WINDOWSsystem32driversHSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (iaStor) – C:WINDOWSSYSTEM32DRIVERSIASTOR.SYS (Intel Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:WINDOWSsystem32driversRtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (nvnetbus) – C:WINDOWSsystem32driversnvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:WINDOWSsystem32driversNVENETFD.sys (NVIDIA Corporation)
DRV - (HDAudBus) – C:WINDOWSsystem32driversHdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (HdAudAddService) – C:WINDOWSsystem32driversHdaudio.sys (Windows ® Server 2003 DDK provider)
DRV - (dac2w2k) – C:WINDOWSsystem32DRIVERSdac2w2k.sys (Mylex Corporation)
DRV - (ql1280) – C:WINDOWSsystem32DRIVERSql1280.sys (QLogic Corporation)
DRV - (ql12160) – C:WINDOWSsystem32DRIVERSql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:WINDOWSsystem32DRIVERSql1080.sys (QLogic Corporation)
DRV - (ultra) – C:WINDOWSsystem32DRIVERSultra.sys (Promise Technology, Inc.)
DRV - (symc8xx) – C:WINDOWSsystem32DRIVERSsymc8xx.sys (LSI Logic)
DRV - (sym_u3) – C:WINDOWSsystem32DRIVERSsym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:WINDOWSsystem32DRIVERSsym_hi.sys (LSI Logic)
DRV - (asc) – C:WINDOWSsystem32DRIVERSasc.sys (Advanced System Products, Inc.)
DRV - (Sparrow) – C:WINDOWSsystem32DRIVERSsparrow.sys (Adaptec, Inc.)
DRV - (mraid35x) – C:WINDOWSsystem32DRIVERSmraid35x.sys (American Megatrends Inc.)
DRV - (symc810) – C:WINDOWSsystem32DRIVERSsymc810.sys (Symbios Logic Inc.)
DRV - (asc3550) – C:WINDOWSsystem32DRIVERSasc3550.sys (Advanced System Products, Inc.)
DRV - (CmdIde) – C:WINDOWSsystem32DRIVERScmdide.sys (CMD Technology, Inc.)
DRV - (AliIde) – C:WINDOWSsystem32DRIVERSaliide.sys (Acer Laboratories Inc.)
DRV - (amdagp) – C:WINDOWSsystem32DRIVERSamdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:WINDOWSsystem32DRIVERSsisagp.sys (Silicon Integrated Systems Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLMSOFTWAREMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.gateway.com/g/sidepanel.html?Ch…d&M;=GT5242E

IE - HKCUSOFTWAREMicrosoftInternet ExplorerMain,Start Page = http://www.ask.com/
IE - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings: "ProxyEnable" = 0

FF - HKLMsoftwaremozillaFirefoxExtensions{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:Documents and SettingsAll UsersApplication DataNorton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}N360_4.0.0.127IPSFFPlgn [2011/02/25 14:45:50 | 000,000,000 | —D | M]
FF - HKLMsoftwaremozillaFirefoxExtensions{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:Documents and SettingsAll UsersApplication DataNorton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}N360_4.0.0.127coFFPlgn [2011/02/25 14:45:51 | 000,000,000 | —D | M]


O1 HOSTS File: ([2004/08/10 14:00:00 | 000,000,734 | —- | M]) - C:WINDOWSsystem32driversetchosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:Program FilesNorton Security SuiteEngine4.0.0.127CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:Program FilesNorton Security SuiteEngine4.0.0.127IPSBHO.dll (Symantec Corporation)
O3 - HKLM..Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:Program FilesNorton Security SuiteEngine4.0.0.127CoIEPlg.dll (Symantec Corporation)
O3 - HKCU..ToolbarWebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:Program FilesNorton Security SuiteEngine4.0.0.127CoIEPlg.dll (Symantec Corporation)
O4 - HKLM..Run: [Alcmtr] C:WINDOWSALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..Run: [High Definition Audio Property Page Shortcut] C:WINDOWSSystem32HdAShCut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..Run: [NvCplDaemon] C:WINDOWSSystem32NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..Run: [NvMediaCenter] C:WINDOWSSystem32NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..Run: [nwiz] C:Program FilesNVIDIA CorporationnViewnwiz.exe ()
O4 - HKLM..Run: [readericon] C:Program FilesDigital Media Readerreadericon45G.exe (Alcor Micro, Corp.)
O4 - HKLM..Run: [WinPatrol] C:Program FilesBillP StudiosWinPatrolwinpatrol.exe (BillP Studios)
O4 - HKCU..Run: [Power2GoExpress] File not found
O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesSystem: InstallVisualStyle = C:WINDOWSResourcesThemesRoyaleRoyale.msstyles (Microsoft)
O6 - HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesSystem: InstallTheme = C:WINDOWSResourcesThemesRoyale.theme ()
O7 - HKCUSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer: NoDriveTypeAutoRun = 145
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1298664894125 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_02)
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_02)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLMSystemCCSServicesTcpipParameters: DhcpNameServer = [removed] [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:WINDOWSexplorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:Documents and SettingsJLocal SettingsApplication DataMicrosoftWallpaper1.bmp
O24 - Desktop BackupWallPaper: C:Documents and SettingsJLocal SettingsApplication DataMicrosoftWallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/06/17 04:41:16 | 000,000,000 | —- | M] () - C:AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2004/09/13 12:15:24 | 000,000,053 | -HS- | M] () - D:Autorun.inf – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM..comfile [open] – "%1" %*
O35 - HKLM..exefile [open] – "%1" %*
O37 - HKLM…com [@ = comfile] – "%1" %*
O37 - HKLM…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.clmp3enc - C:Program FilesCyberLinkPower2GoCLMP3Enc.ACM (CyberLink Corp.)
Drivers32: msacm.iac2 - C:WINDOWSsystem32iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:WINDOWSsystem32l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:WINDOWSSystem32sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:WINDOWSSystem32tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:WINDOWSSystem32iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:WINDOWSSystem32ir32_32.dll ()
Drivers32: vidc.iv32 - C:WINDOWSSystem32ir32_32.dll ()
Drivers32: vidc.iv41 - C:WINDOWSSystem32ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:WINDOWSSystem32ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17746534284132352)

========== Files/Folders - Created Within 30 Days ==========

[2011/02/26 00:05:59 | 000,000,000 | —D | C] – C:WINDOWSpss
[2011/02/25 23:59:16 | 000,577,024 | —- | C] (OldTimer Tools) – C:Documents and SettingsJDesktopOTL.exe
[2011/02/25 23:59:16 | 000,472,064 | —- | C] ( ) – C:Documents and SettingsJDesktopRootRepeal.exe
[2011/02/25 23:27:41 | 000,000,000 | —D | C] – C:Documents and SettingsAll UsersDesktopxp_exe_fix
[2011/02/25 23:17:59 | 000,000,000 | —D | C] – C:Documents and SettingsNetworkServiceApplication Datawhitesmoketoolbar
[2011/02/25 23:17:57 | 000,000,000 | —D | C] – C:Program Fileswhitesmoketoolbar
[2011/02/25 23:17:50 | 000,000,000 | —D | C] – C:Documents and SettingsAll UsersApplication DataTarma Installer
[2011/02/25 23:17:50 | 000,000,000 | —D | C] – C:Program FilesDrop Down Deals
[2011/02/25 16:57:37 | 000,176,128 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvunrm.exe
[2011/02/25 16:57:37 | 000,100,480 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32driversnvtcp.sys
[2011/02/25 16:57:35 | 000,176,128 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvusmb.exe
[2011/02/25 16:53:40 | 000,208,896 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvudisp.exe
[2011/02/25 16:53:40 | 000,000,000 | —D | C] – C:WINDOWSnview
[2011/02/25 16:53:26 | 000,208,896 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32NVUNINST.EXE
[2011/02/25 15:09:38 | 000,000,000 | -HSD | C] – C:WINDOWSCSC
[2011/02/25 14:58:53 | 000,000,000 | -H-D | C] – C:WINDOWSSystem32GroupPolicy
[2011/02/25 14:58:51 | 000,000,000 | -HSD | C] – C:Config.Msi
[2011/02/25 14:45:10 | 000,107,368 | R— | C] (GEAR Software Inc.) – C:WINDOWSSystem32GEARAspi.dll
[2011/02/25 14:45:05 | 000,000,000 | —D | C] – C:WINDOWSSystem32DRVSTORE
[2011/02/25 14:45:00 | 000,124,976 | —- | C] (Symantec Corporation) – C:WINDOWSSystem32driversSYMEVENT.SYS
[2011/02/25 14:45:00 | 000,060,808 | —- | C] (Symantec Corporation) – C:WINDOWSSystem32S32EVNT1.DLL
[2011/02/25 14:45:00 | 000,000,000 | —D | C] – C:Program FilesCommon FilesSymantec Shared
[2011/02/25 14:45:00 | 000,000,000 | —D | C] – C:Program FilesSymantec
[2011/02/25 14:44:51 | 000,362,032 | R— | C] (Symantec Corporation) – C:WINDOWSSystem32driversN360\0400000.07Fsymtdi.sys
[2011/02/25 14:44:51 | 000,340,016 | R— | C] (Symantec Corporation) – C:WINDOWSSystem32driversN360\0400000.07Fsymtdiv.sys
[2011/02/25 14:44:51 | 000,328,752 | R— | C] (Symantec Corporation) – C:WINDOWSSystem32driversN360\0400000.07FSymDS.sys
[2011/02/25 14:44:51 | 000,325,168 | R— | C] (Symantec Corporation) – C:WINDOWSSystem32driversN360\0400000.07Fsrtsp.sys
[2011/02/25 14:44:51 | 000,172,592 | R— | C] (Symantec Corporation) – C:WINDOWSSystem32driversN360\0400000.07FSymEFA.sys
[2011/02/25 14:44:51 | 000,043,696 | R— | C] (Symantec Corporation) – C:WINDOWSSystem32driversN360\0400000.07Fsrtspx.sys
[2011/02/25 14:44:50 | 000,501,888 | R— | C] (Symantec Corporation) – C:WINDOWSSystem32driversN360\0400000.07Fcchpx86.sys
[2011/02/25 14:44:50 | 000,116,272 | R— | C] (Symantec Corporation) – C:WINDOWSSystem32driversN360\0400000.07FIronx86.sys
[2011/02/25 14:44:27 | 000,000,000 | —D | C] – C:WINDOWSSystem32driversN360
[2011/02/25 14:44:27 | 000,000,000 | —D | C] – C:WINDOWSSystem32driversN360\0400000.07F
[2011/02/25 14:44:26 | 000,000,000 | —D | C] – C:Program FilesWindows Sidebar
[2011/02/25 14:44:26 | 000,000,000 | —D | C] – C:Program FilesNorton Security Suite
[2011/02/25 14:44:26 | 000,000,000 | —D | C] – C:Documents and SettingsAll UsersStart MenuProgramsNorton Security Suite
[2011/02/25 14:44:05 | 000,000,000 | —D | C] – C:Program FilesNortonInstaller
[2011/02/25 14:44:05 | 000,000,000 | —D | C] – C:Documents and SettingsAll UsersApplication DataNortonInstaller
[2011/02/25 14:44:04 | 000,000,000 | —D | C] – C:Documents and SettingsJMy DocumentsSymantec
[2011/02/25 14:42:16 | 000,000,000 | —D | C] – C:Documents and SettingsAll UsersDocumentsNorton
[2011/02/25 14:42:15 | 000,000,000 | —D | C] – C:Documents and SettingsAll UsersApplication DataNorton
[2011/02/25 14:40:00 | 000,000,000 | -HSD | C] – C:Documents and SettingsJIECompatCache
[2011/02/25 14:39:47 | 000,000,000 | -HSD | C] – C:Documents and SettingsJPrivacIE
[2011/02/25 14:37:55 | 000,000,000 | -HSD | C] – C:Documents and SettingsJIETldCache
[2011/02/25 14:36:15 | 000,000,000 | —D | C] – C:WINDOWSWBEM
[2011/02/25 14:35:34 | 000,000,000 | -H-D | C] – C:WINDOWSie8
[2011/02/25 14:35:34 | 000,000,000 | —D | C] – C:WINDOWSSystem32en-US
[2011/02/25 14:33:33 | 000,000,000 | -HSD | C] – C:Documents and SettingsJUserData
[2011/02/25 13:24:43 | 000,000,000 | —D | C] – C:Documents and SettingsJApplication DataWinPatrol
[2011/02/25 13:24:38 | 000,000,000 | —D | C] – C:WINDOWSSystem32Lang
[2011/02/25 13:19:03 | 000,000,000 | —D | C] – C:Documents and SettingsAll UsersStart MenuProgramsWinPatrol
[2011/02/25 13:19:02 | 000,000,000 | —D | C] – C:Program FilesBillP Studios
[2011/02/25 13:19:01 | 000,000,000 | —D | C] – C:Documents and SettingsAll UsersApplication DataInstallMate
[2011/02/25 13:18:59 | 000,222,080 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32MpSigStub.exe
[2011/02/25 13:14:46 | 000,000,000 | —D | C] – C:Documents and SettingsAll UsersApplication DataWindows Genuine Advantage
[2011/02/25 13:14:00 | 000,016,928 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32spmsg.dll
[2011/02/25 13:12:43 | 007,866,472 | —- | C] (Microsoft Corporation) – C:Documents and SettingsJDesktopmseinstall.exe
[2011/02/25 13:08:25 | 000,000,000 | —D | C] – C:Documents and SettingsAll UsersApplication DatanView_Profiles
[2011/02/25 13:01:19 | 000,000,000 | —D | C] – C:Documents and SettingsAll UsersApplication DataNVIDIA Corporation
[2011/02/25 13:00:33 | 004,980,736 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvcuda.dll
[2011/02/25 13:00:33 | 002,916,968 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvcuvid.dll
[2011/02/25 13:00:33 | 002,251,368 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvcuvenc.dll
[2011/02/25 13:00:33 | 000,941,160 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvdispco322090.dll
[2011/02/25 13:00:33 | 000,837,736 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvgenco322040.dll
[2011/02/25 13:00:33 | 000,061,440 | —- | C] (Khronos Group) – C:WINDOWSSystem32OpenCL.dll
[2011/02/25 13:00:31 | 013,004,800 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvcompiler.dll
[2011/02/25 13:00:24 | 000,000,000 | —D | C] – C:Program FilesNVIDIA Corporation
[2011/02/25 13:00:07 | 000,000,000 | —D | C] – C:NVIDIA
[2011/02/25 12:58:59 | 000,006,400 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32dllcachesplitter.sys
[2011/02/25 12:58:58 | 000,082,944 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32dllcachewdmaud.sys
[2011/02/25 12:58:58 | 000,052,864 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32dllcachedmusic.sys
[2011/02/25 12:58:54 | 000,054,272 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32dllcacheswmidi.sys
[2011/02/25 12:58:53 | 000,171,776 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32dllcachekmixer.sys
[2011/02/25 12:58:52 | 000,002,944 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32dllcachedrmkaud.sys
[2011/02/25 12:58:51 | 000,060,800 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32dllcachesysaudio.sys
[2011/02/25 12:58:50 | 000,007,552 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32dllcachemskssrv.sys
[2011/02/25 12:58:49 | 000,004,992 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32dllcachemspqm.sys
[2011/02/25 12:58:48 | 000,005,376 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32dllcachemspclock.sys
[2011/02/25 12:58:43 | 000,060,288 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32driversdrmk.sys
[2011/02/25 12:58:43 | 000,060,288 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32dllcachedrmk.sys
[2011/02/25 12:58:42 | 000,130,048 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32ksproxy.ax
[2011/02/25 12:58:42 | 000,130,048 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32dllcacheksproxy.ax
[2011/02/25 12:58:42 | 000,004,096 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32ksuser.dll
[2011/02/25 12:58:42 | 000,004,096 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32dllcacheksuser.dll
[2011/02/25 12:58:26 | 000,069,632 | —- | C] (Realtek Semiconductor Corp.) – C:WINDOWSALCMTR.EXE
[2011/02/25 12:58:25 | 002,806,784 | —- | C] (RealTek Semicoductor Corp.) – C:WINDOWSALCWZRD.EXE
[2011/02/25 12:58:24 | 002,121,728 | —- | C] (Realtek Semiconductor Corp.) – C:WINDOWSMicCal.exe
[2011/02/25 12:58:24 | 000,086,016 | —- | C] (Realtek Semiconductor Corp.) – C:WINDOWSSOUNDMAN.EXE
[2011/02/25 12:58:23 | 009,703,424 | —- | C] (Realtek Semiconductor Corp.) – C:WINDOWSRTLCPL.EXE
[2011/02/25 12:58:23 | 003,856,896 | —- | C] (Realtek Semiconductor Corp.) – C:WINDOWSSystem32driversRtkHDAud.sys
[2011/02/25 12:58:23 | 000,294,912 | —- | C] (Realtek Semiconductor Corp.) – C:WINDOWSSystem32ALSNDMGR.CPL
[2011/02/25 12:58:23 | 000,262,144 | —- | C] (Realtek Semiconductor Corp.) – C:WINDOWSSystem32RTSndMgr.CPL
[2011/02/25 12:58:23 | 000,000,000 | —D | C] – C:WINDOWSSystem32RTCOM
[2011/02/25 12:58:15 | 000,000,000 | —D | C] – C:Program FilesRealtek
[2011/02/25 12:58:05 | 000,487,424 | —- | C] (Realtek Semiconductor Corp.) – C:WINDOWSRtlExUpd.dll
[2011/02/25 09:34:38 | 001,740,800 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwssr.dll
[2011/02/25 09:34:38 | 001,257,472 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwss.dll
[2011/02/25 09:34:37 | 000,315,392 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrsru.dll
[2011/02/25 09:34:37 | 000,303,104 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrstr.dll
[2011/02/25 09:34:37 | 000,303,104 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrssl.dll
[2011/02/25 09:34:37 | 000,299,008 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrssk.dll
[2011/02/25 09:34:37 | 000,294,912 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrssv.dll
[2011/02/25 09:34:37 | 000,167,936 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrszht.dll
[2011/02/25 09:34:37 | 000,163,840 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrszhc.dll
[2011/02/25 09:34:36 | 000,323,584 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrspt.dll
[2011/02/25 09:34:36 | 000,319,488 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrsptb.dll
[2011/02/25 09:34:36 | 000,319,488 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrsnl.dll
[2011/02/25 09:34:36 | 000,299,008 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrsno.dll
[2011/02/25 09:34:36 | 000,294,912 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrspl.dll
[2011/02/25 09:34:36 | 000,212,992 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrsja.dll
[2011/02/25 09:34:36 | 000,196,608 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrsko.dll
[2011/02/25 09:34:35 | 000,335,872 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrses.dll
[2011/02/25 09:34:35 | 000,335,872 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrsel.dll
[2011/02/25 09:34:35 | 000,327,680 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrsfr.dll
[2011/02/25 09:34:35 | 000,327,680 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrsesm.dll
[2011/02/25 09:34:35 | 000,323,584 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrsit.dll
[2011/02/25 09:34:35 | 000,315,392 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrshu.dll
[2011/02/25 09:34:35 | 000,303,104 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrsfi.dll
[2011/02/25 09:34:35 | 000,286,720 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrseng.dll
[2011/02/25 09:34:35 | 000,278,528 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrshe.dll
[2011/02/25 09:34:34 | 000,311,296 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrsde.dll
[2011/02/25 09:34:34 | 000,294,912 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrsda.dll
[2011/02/25 09:34:34 | 000,286,720 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrscs.dll
[2011/02/25 09:34:34 | 000,282,624 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvwrsar.dll
[2011/02/25 09:34:29 | 002,977,792 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvvitvsr.dll
[2011/02/25 09:34:28 | 002,932,736 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvvitvs.dll
[2011/02/25 09:34:28 | 000,122,880 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrszht.dll
[2011/02/25 09:34:27 | 000,249,856 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrstr.dll
[2011/02/25 09:34:27 | 000,249,856 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrssl.dll
[2011/02/25 09:34:27 | 000,245,760 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrssv.dll
[2011/02/25 09:34:27 | 000,221,184 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrszhc.dll
[2011/02/25 09:34:26 | 000,266,240 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrspt.dll
[2011/02/25 09:34:26 | 000,266,240 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrsnl.dll
[2011/02/25 09:34:26 | 000,262,144 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrsru.dll
[2011/02/25 09:34:26 | 000,262,144 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrsptb.dll
[2011/02/25 09:34:26 | 000,262,144 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrsja.dll
[2011/02/25 09:34:26 | 000,258,048 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrsko.dll
[2011/02/25 09:34:26 | 000,249,856 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrssk.dll
[2011/02/25 09:34:26 | 000,249,856 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrspl.dll
[2011/02/25 09:34:26 | 000,249,856 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrsno.dll
[2011/02/25 09:34:25 | 000,323,584 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrshe.dll
[2011/02/25 09:34:25 | 000,278,528 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrsfr.dll
[2011/02/25 09:34:25 | 000,274,432 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrsit.dll
[2011/02/25 09:34:25 | 000,274,432 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrses.dll
[2011/02/25 09:34:25 | 000,266,240 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrsesm.dll
[2011/02/25 09:34:25 | 000,249,856 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrshu.dll
[2011/02/25 09:34:25 | 000,241,664 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrsfi.dll
[2011/02/25 09:34:25 | 000,241,664 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrseng.dll
[2011/02/25 09:34:24 | 000,323,584 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrsar.dll
[2011/02/25 09:34:24 | 000,274,432 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrsel.dll
[2011/02/25 09:34:24 | 000,270,336 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrsde.dll
[2011/02/25 09:34:24 | 000,245,760 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrsda.dll
[2011/02/25 09:34:24 | 000,241,664 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvrscs.dll
[2011/02/25 09:34:23 | 014,671,872 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvoglnt.dll
[2011/02/25 09:34:21 | 002,859,008 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvmoblsr.dll
[2011/02/25 09:34:20 | 000,888,832 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvmobls.dll
[2011/02/25 09:34:18 | 000,462,848 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvmccssr.dll
[2011/02/25 09:34:18 | 000,188,416 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvmccss.dll
[2011/02/25 09:34:18 | 000,045,056 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvmccsrs.dll
[2011/02/25 09:34:16 | 002,887,680 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvgamesr.dll
[2011/02/25 09:34:15 | 003,035,136 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvgames.dll
[2011/02/25 09:34:15 | 000,311,296 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvexpbar.dll
[2011/02/25 09:34:08 | 005,246,976 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvdispsr.dll
[2011/02/25 09:34:06 | 005,656,576 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvdisps.dll
[2011/02/25 09:34:03 | 001,011,712 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvcpluir.dll
[2011/02/25 09:34:03 | 000,794,624 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvcplui.exe
[2011/02/25 09:33:57 | 000,069,632 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvcpl.cpl
[2011/02/25 09:33:54 | 001,958,400 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvapi.dll
[2011/02/25 09:33:54 | 000,035,840 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvcodins.dll
[2011/02/25 09:33:54 | 000,035,840 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nvcod.dll
[2011/02/25 09:33:53 | 009,888,672 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32driversnv4_mini.sys
[2011/02/25 09:33:53 | 009,888,672 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32dllcachenv4_mini.sys
[2011/02/25 09:33:52 | 006,397,824 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32nv4_disp.dll
[2011/02/25 09:33:52 | 004,493,568 | —- | C] (NVIDIA Corporation) – C:WINDOWSSystem32dllcachenv4_disp.dll
[2011/02/25 01:10:43 | 000,000,000 | –SD | C] – C:Documents and SettingsJApplication DataMicrosoft
[2011/02/25 01:10:43 | 000,000,000 | RH-D | C] – C:Documents and SettingsJSendTo
[2011/02/25 01:10:43 | 000,000,000 | RH-D | C] – C:Documents and SettingsJRecent
[2011/02/25 01:10:43 | 000,000,000 | RH-D | C] – C:Documents and SettingsJApplication Data
[2011/02/25 01:10:43 | 000,000,000 | R–D | C] – C:Documents and SettingsJStart MenuProgramsStartup
[2011/02/25 01:10:43 | 000,000,000 | R–D | C] – C:Documents and SettingsJStart Menu
[2011/02/25 01:10:43 | 000,000,000 | R–D | C] – C:Documents and SettingsJMy DocumentsMy Pictures
[2011/02/25 01:10:43 | 000,000,000 | R–D | C] – C:Documents and SettingsJMy DocumentsMy Music
[2011/02/25 01:10:43 | 000,000,000 | R–D | C] – C:Documents and SettingsJMy Documents
[2011/02/25 01:10:43 | 000,000,000 | R–D | C] – C:Documents and SettingsJFavorites
[2011/02/25 01:10:43 | 000,000,000 | R–D | C] – C:Documents and SettingsJStart MenuProgramsAccessories
[2011/02/25 01:10:43 | 000,000,000 | -HSD | C] – C:Documents and SettingsJCookies
[2011/02/25 01:10:43 | 000,000,000 | -H-D | C] – C:Documents and SettingsJTemplates
[2011/02/25 01:10:43 | 000,000,000 | -H-D | C] – C:Documents and SettingsJPrintHood
[2011/02/25 01:10:43 | 000,000,000 | -H-D | C] – C:Documents and SettingsJNetHood
[2011/02/25 01:10:43 | 000,000,000 | -H-D | C] – C:Documents and SettingsJLocal Settings
[2011/02/25 01:10:43 | 000,000,000 | —D | C] – C:Documents and SettingsJWINDOWS
[2011/02/25 01:10:43 | 000,000,000 | —D | C] – C:Documents and SettingsJLocal SettingsApplication DataMicrosoft
[2011/02/25 01:10:43 | 000,000,000 | —D | C] – C:Documents and SettingsJApplication DataIdentities
[2011/02/25 01:10:43 | 000,000,000 | —D | C] – C:Documents and SettingsJDesktop
[2011/02/25 01:10:43 | 000,000,000 | —D | C] – C:Documents and SettingsJLocal SettingsApplication DataApplicationHistory
[2011/02/25 01:10:43 | 000,000,000 | —D | C] – C:Documents and SettingsJLocal SettingsApplication Data{3248F0A6-6813-11D6-A77B-00B0D0150020}
[2011/02/25 00:41:47 | 000,000,000 | -HSD | C] – C:RECYCLER
[2011/02/24 23:57:39 | 000,020,480 | —- | C] (Gateway) – C:WINDOWSSystem32Marker32.exe
[2011/02/24 23:57:30 | 000,127,078 | —- | C] (Sun Microsystems, Inc.) – C:WINDOWSSystem32javaws.exe
[2011/02/24 23:57:30 | 000,049,265 | —- | C] (Sun Microsystems, Inc.) – C:WINDOWSSystem32jpicpl32.cpl
[2011/02/24 23:57:30 | 000,049,250 | —- | C] (Sun Microsystems, Inc.) – C:WINDOWSSystem32javaw.exe
[2011/02/24 23:57:30 | 000,049,248 | —- | C] (Sun Microsystems, Inc.) – C:WINDOWSSystem32java.exe
[2011/02/24 23:57:09 | 000,000,000 | —D | C] – C:Program FilesJava
[2011/02/24 23:57:09 | 000,000,000 | —D | C] – C:Program FilesCommon FilesJava
[2011/02/24 23:57:03 | 000,094,208 | —- | C] (Gateway Inc.) – C:WINDOWSSystem32bae.dll
[2011/02/24 23:56:56 | 000,013,352 | —- | C] (BigFix, Inc.) – C:WINDOWSBigFixClientOverride.dll
[2011/02/24 23:56:55 | 000,000,000 | —D | C] – C:Program FilesBigFix
[2011/02/24 23:56:07 | 000,000,000 | —D | C] – C:WINDOWSSystem32ReinstallBackups
[2011/02/24 23:56:02 | 000,000,000 | —D | C] – C:Program FilesDigital Media Reader
[2011/02/24 23:55:54 | 000,000,000 | —D | C] – C:WINDOWSDownloaded Installations
[2011/02/24 23:54:54 | 000,017,920 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32mdimon.dll
[2011/02/24 23:54:38 | 000,000,000 | —D | C] – C:Documents and SettingsAll UsersStart MenuProgramsMicrosoft Office
[2011/02/24 23:54:33 | 000,000,000 | —D | C] – C:Program FilesMicrosoft ActiveSync
[2011/02/24 23:54:30 | 000,000,000 | —D | C] – C:Program FilesCommon FilesDESIGNER
[2011/02/24 23:54:20 | 000,000,000 | —D | C] – C:WINDOWSSHELLNEW
[2011/02/24 23:54:04 | 000,000,000 | —D | C] – C:Program FilesMicrosoft.NET
[2011/02/24 23:54:04 | 000,000,000 | —D | C] – C:Program FilesMicrosoft Office
[2011/02/24 23:53:40 | 000,000,000 | RH-D | C] – C:MSOCache
[2011/02/24 23:53:01 | 000,000,000 | —D | C] – C:Documents and SettingsAll UsersStart MenuProgramsCyberLink DVD Solution
[2011/02/24 23:52:57 | 000,000,000 | -H-D | C] – C:Program FilesInstallShield Installation Information
[2011/02/24 23:52:57 | 000,000,000 | —D | C] – C:Program FilesCyberLink
[2011/02/24 23:52:53 | 000,000,000 | —D | C] – C:Program FilesCommon FilesInstallShield
[2011/02/24 23:50:45 | 000,005,632 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32ptpusb.dll
[2011/02/24 23:50:44 | 000,159,232 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32ptpusd.dll
[2011/02/24 23:50:18 | 000,000,000 | —D | C] – C:Program FilesCONEXANT
[2011/02/24 23:48:41 | 000,000,000 | -HSD | C] – C:System Volume Information
[2011/02/24 23:29:22 | 000,000,000 | —D | C] – C:WINDOWScreator
[2011/02/24 23:28:23 | 000,990,592 | —- | C] (Conexant Systems, Inc.) – C:WINDOWSSystem32driversHSF_DPV.sys
[2011/02/24 23:28:23 | 000,728,192 | —- | C] (Conexant Systems, Inc.) – C:WINDOWSSystem32driversHSF_CNXT.sys
[2011/02/24 23:28:23 | 000,256,128 | —- | C] (Conexant Systems, Inc.) – C:WINDOWSSystem32driversHSFHWBS2.sys
[2011/02/24 23:28:23 | 000,122,880 | —- | C] (Conexant Systems, Inc) – C:WINDOWSSystem32Uci32107.dll
[2011/02/24 23:28:23 | 000,094,208 | —- | C] (Conexant) – C:WINDOWSSystem32mdmxsdk.dll
[2011/02/24 23:28:23 | 000,000,000 | —D | C] – C:WINDOWSSMINST
[2011/02/24 23:28:19 | 000,000,000 | —D | C] – C:WINDOWSI386
[2011/02/24 23:28:01 | 000,013,824 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32wowfaxui.dll
[2011/02/24 23:27:59 | 000,003,200 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32wowfax.dll
[2011/02/24 23:27:53 | 000,049,211 | —- | C] (U.S. Robotics Corporation) – C:WINDOWSSystem32usrvpa.dll
[2011/02/24 23:27:50 | 000,045,116 | —- | C] (U.S. Robotics Corporation) – C:WINDOWSSystem32usrvoica.dll
[2011/02/24 23:27:47 | 000,049,209 | —- | C] (U.S. Robotics Corporation) – C:WINDOWSSystem32usrv80a.dll
[2011/02/24 23:27:45 | 000,102,457 | —- | C] (U.S. Robotics Corporation) – C:WINDOWSSystem32usrv42a.dll
[2011/02/24 23:27:42 | 000,041,019 | —- | C] (U.S. Robotics Corporation) – C:WINDOWSSystem32usrsvpia.dll
[2011/02/24 23:27:39 | 000,069,700 | —- | C] ( U.S. Robotics Corporation) – C:WINDOWSSystem32usrshuta.exe
[2011/02/24 23:27:37 | 000,049,211 | —- | C] ( U.S. Robotics Corporation) – C:WINDOWSSystem32usrsdpia.dll
[2011/02/24 23:27:34 | 000,077,883 | —- | C] (U.S. Robotics Corporation) – C:WINDOWSSystem32usrrtosa.dll
[2011/02/24 23:27:31 | 000,061,508 | —- | C] (U.S. Robotics Corporation) – C:WINDOWSSystem32usrprbda.exe
[2011/02/24 23:27:29 | 000,077,891 | —- | C] (U.S. Robotics Corporation) – C:WINDOWSSystem32usrmlnka.exe
[2011/02/24 23:27:26 | 000,053,305 | —- | C] (U.S. Robotics Corporation) – C:WINDOWSSystem32usrlbva.dll
[2011/02/24 23:27:23 | 000,086,073 | —- | C] (U.S. Robotics Corporation) – C:WINDOWSSystem32usrfaxa.dll
[2011/02/24 23:27:21 | 000,323,641 | —- | C] (U.S. Robotics Corporation) – C:WINDOWSSystem32usrdtea.dll
[2011/02/24 23:27:18 | 000,077,890 | —- | C] (U.S. Robotics Corporation) – C:WINDOWSSystem32usrdpa.dll
[2011/02/24 23:27:15 | 000,069,699 | —- | C] (U.S. Robotics Corporation) – C:WINDOWSSystem32usrcoina.dll
[2011/02/24 23:27:13 | 000,061,500 | —- | C] (U.S. Robotics Corporation) – C:WINDOWSSystem32usrcntra.dll
[2011/02/24 23:27:12 | 000,074,240 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32usbui.dll
[2011/02/24 23:27:07 | 000,008,192 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32streamci.dll
[2011/02/24 23:27:06 | 000,074,752 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32storprop.dll
[2011/02/24 23:27:04 | 000,072,192 | —- | C] (S3/Diamond Multimedia) – C:WINDOWSSystem32sprio800.dll
[2011/02/24 23:27:01 | 000,070,656 | —- | C] (S3/Diamond Multimedia) – C:WINDOWSSystem32sprio600.dll
[2011/02/24 23:26:57 | 000,069,632 | —- | C] (S3/Diamond Multimedia) – C:WINDOWSSystem32spnike.dll
[2011/02/24 23:26:52 | 000,035,328 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32pid.dll
[2011/02/24 23:26:52 | 000,015,360 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32pjlmon.dll
[2011/02/24 23:26:31 | 000,147,968 | —- | C] (RioPort) – C:WINDOWSSystem32mdwmdmsp.dll
[2011/02/24 23:26:27 | 000,020,992 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32hid.dll
[2011/02/24 23:26:23 | 000,058,112 | —- | C] (RAVISENT Technologies Inc.) – C:WINDOWSSystem32driversvdmindvd.sys
[2011/02/24 23:26:22 | 000,016,000 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32driversusbintel.sys
[2011/02/24 23:26:20 | 000,023,936 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32driversusbcamd2.sys
[2011/02/24 23:26:17 | 000,023,808 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32driversusbcamd.sys
[2011/02/24 23:26:14 | 000,021,376 | —- | C] (Toshiba Corporation) – C:WINDOWSSystem32driverstsbvcap.sys
[2011/02/24 23:26:11 | 000,051,712 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32driverstosdvd.sys
[2011/02/24 23:26:09 | 000,048,640 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32driversstream.sys
[2011/02/24 23:26:09 | 000,048,640 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32dllcachestream.sys
[2011/02/24 23:26:09 | 000,025,472 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32driverssonydcam.sys
[2011/02/24 23:26:06 | 000,012,032 | —- | C] (S3/Diamond Multimedia Systems) – C:WINDOWSSystem32driversriodrv.sys
[2011/02/24 23:26:04 | 000,012,032 | —- | C] (S3/Diamond Multimedia Systems) – C:WINDOWSSystem32driversrio8drv.sys
[2011/02/24 23:25:59 | 000,012,032 | —- | C] (S3/Diamond Multimedia Systems) – C:WINDOWSSystem32driversnikedrv.sys
[2011/02/24 23:25:54 | 000,140,928 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32driversks.sys
[2011/02/24 23:25:54 | 000,140,928 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32dllcacheks.sys
[2011/02/24 23:25:54 | 000,063,744 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32driversmf.sys
[2011/02/24 23:25:52 | 000,012,160 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32driversfsvga.sys
[2011/02/24 23:25:51 | 000,006,400 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32driversenum1394.sys
[2011/02/24 23:25:49 | 000,262,528 | —- | C] (RAVISENT Technologies Inc.) – C:WINDOWSSystem32driverscinemst2.sys
[2011/02/24 23:25:49 | 000,011,776 | —- | C] (Compaq Computer Corporation) – C:WINDOWSSystem32driverscpqdap01.sys
[2011/02/24 23:25:48 | 000,014,080 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32driversbattc.sys
[2011/02/24 23:25:47 | 000,036,992 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32driversamdk6.sys
[2011/02/24 23:25:45 | 000,041,088 | —- | C] (Silicon Integrated Systems Corporation) – C:WINDOWSSystem32driversSISAGP.SYS
[2011/02/24 23:25:44 | 000,043,008 | —- | C] (Advanced Micro Devices, Inc.) – C:WINDOWSSystem32driversAMDAGP.SYS
[2011/02/24 23:25:42 | 000,052,224 | —- | C] (Microsoft Corp.) – C:WINDOWSSystem32dmutil.dll
[2011/02/24 23:25:39 | 000,047,104 | —- | C] (Microsoft Corporation) – C:WINDOWSSystem32cnbjmon.dll
[2 C:WINDOWSSystem32*.tmp files -> C:WINDOWSSystem32*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/02/26 00:24:18 | 000,401,064 | —- | M] () – C:WINDOWSSystem32perfh009.dat
[2011/02/26 00:24:18 | 000,062,344 | —- | M] () – C:WINDOWSSystem32perfc009.dat
[2011/02/26 00:16:26 | 051,339,594 | —- | M] () – C:Documents and SettingsJDesktopregbackup2.reg
[2011/02/26 00:11:32 | 000,000,197 | RHS- | M] () – C:boot.ini
[2011/02/25 23:44:40 | 000,002,048 | –S- | M] () – C:WINDOWSbootstat.dat
[2011/02/25 23:44:38 | 2145,898,496 | -HS- | M] () – C:hiberfil.sys
[2011/02/25 16:53:59 | 000,073,451 | —- | M] () – C:WINDOWSSystem32nvapps.xml
[2011/02/25 14:59:45 | 000,001,945 | —- | M] () – C:WINDOWSepplauncher.mif
[2011/02/25 14:45:18 | 000,556,062 | —- | M] () – C:WINDOWSSystem32driversN360\0400000.07FCat.DB
[2011/02/25 14:45:00 | 000,124,976 | —- | M] (Symantec Corporation) – C:WINDOWSSystem32driversSYMEVENT.SYS
[2011/02/25 14:45:00 | 000,060,808 | —- | M] (Symantec Corporation) – C:WINDOWSSystem32S32EVNT1.DLL
[2011/02/25 14:45:00 | 000,007,443 | —- | M] () – C:WINDOWSSystem32driversSYMEVENT.CAT
[2011/02/25 14:45:00 | 000,000,805 | —- | M] () – C:WINDOWSSystem32driversSYMEVENT.INF
[2011/02/25 14:44:53 | 000,002,030 | —- | M] () – C:Documents and SettingsAll UsersDesktopNorton Security Suite.LNK
[2011/02/25 14:42:18 | 000,000,825 | —- | M] () – C:Documents and SettingsJDesktopNorton Installation Files.lnk
[2011/02/25 14:38:05 | 000,000,815 | —- | M] () – C:Documents and SettingsJApplication DataMicrosoftInternet ExplorerQuick LaunchLaunch Internet Explorer Browser.lnk
[2011/02/25 13:24:46 | 000,940,794 | —- | M] () – C:WINDOWSSystem32LoopyMusic.wav
[2011/02/25 13:24:46 | 000,146,650 | —- | M] () – C:WINDOWSSystem32BuzzingBee.wav
[2011/02/25 13:14:46 | 000,001,158 | —- | M] () – C:WINDOWSSystem32wpa.dbl
[2011/02/25 13:14:11 | 000,001,374 | —- | M] () – C:WINDOWSimsins.BAK
[2011/02/25 13:12:47 | 007,866,472 | —- | M] (Microsoft Corporation) – C:Documents and SettingsJDesktopmseinstall.exe
[2011/02/25 13:09:10 | 000,252,080 | —- | M] () – C:WINDOWSSystem32nvdrsdb0.bin
[2011/02/25 13:09:10 | 000,000,001 | —- | M] () – C:WINDOWSSystem32nvdrssel.bin
[2011/02/25 13:09:04 | 000,252,080 | —- | M] () – C:WINDOWSSystem32nvdrsdb1.bin
[2011/02/25 13:00:47 | 000,000,000 | —- | M] () – C:WINDOWSSystem32nvdrswr.lk
[2011/02/25 01:10:50 | 000,000,786 | —- | M] () – C:Documents and SettingsJDesktopWindows Media Player.lnk
[2011/02/25 01:10:48 | 000,001,478 | —- | M] () – C:Documents and SettingsJApplication DataMicrosoftInternet ExplorerQuick LaunchMedia Center.lnk
[2011/02/25 01:10:33 | 000,000,038 | —- | M] () – C:WINDOWSSystem32$winnt$.inf
[2011/02/25 00:43:30 | 000,008,192 | —- | M] () – C:WINDOWSREGLOCS.OLD
[2011/02/25 00:41:49 | 000,000,000 | —- | M] () – C:WINDOWSSystem32Gateway_GT5242E_Versionxx_CCH6AD1001094.MRK
[2011/02/25 00:41:44 | 000,000,333 | —- | M] () – C:WINDOWSSystem32$ncsp$.inf
[2011/02/25 00:41:00 | 000,114,176 | —- | M] () – C:WINDOWSSystem32FNTCACHE.DAT
[2011/02/24 23:57:40 | 000,000,579 | —- | M] () – C:RebootLog.ini
[2011/02/24 23:57:40 | 000,000,538 | —- | M] () – C:WINDOWSSystem32oeminfo.ini
[2011/02/24 23:56:53 | 000,000,469 | —- | M] () – C:WINDOWSSystem32emver.ini
[2011/02/24 23:56:14 | 000,000,000 | —- | M] () – C:REQUEST_OEMRESET_ENDUSER
[2011/02/24 23:54:59 | 000,000,376 | —- | M] () – C:WINDOWSODBC.INI
[2011/02/24 23:52:31 | 000,000,002 | —- | M] () – C:AUDIT_INSTALL_IN_PROGRESS
[2011/02/24 23:51:07 | 000,000,002 | RHS- | M] () – C:USER
[2011/02/24 23:29:24 | 000,000,060 | —- | M] () – C:WINDOWSSystem32SYSDRV.DAT
[2011/02/24 10:13:32 | 000,577,024 | —- | M] (OldTimer Tools) – C:Documents and SettingsJDesktopOTL.exe
[2011/02/24 08:44:16 | 004,274,226 | —- | M] () – C:Documents and SettingsJDesktopComboFix.exe
[2011/02/24 08:39:02 | 000,624,128 | —- | M] () – C:Documents and SettingsJDesktopdds.scr
[2011/02/24 08:37:32 | 001,402,880 | —- | M] () – C:Documents and SettingsJDesktopHiJackThis.msi
[2011/02/02 17:11:20 | 000,222,080 | —- | M] (Microsoft Corporation) – C:WINDOWSSystem32MpSigStub.exe
[2 C:WINDOWSSystem32*.tmp files -> C:WINDOWSSystem32*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/02/26 00:16:21 | 051,339,594 | —- | C] () – C:Documents and SettingsJDesktopregbackup2.reg
[2011/02/25 23:59:16 | 004,274,226 | —- | C] () – C:Documents and SettingsJDesktopComboFix.exe
[2011/02/25 23:59:16 | 001,402,880 | —- | C] () – C:Documents and SettingsJDesktopHiJackThis.msi
[2011/02/25 23:59:16 | 000,624,128 | —- | C] () – C:Documents and SettingsJDesktopdds.scr
[2011/02/25 23:44:38 | 2145,898,496 | -HS- | C] () – C:hiberfil.sys
[2011/02/25 16:57:37 | 000,003,632 | —- | C] () – C:WINDOWSSystem32nvnrm.nvu
[2011/02/25 16:57:35 | 000,001,391 | —- | C] () – C:WINDOWSSystem32nvsmb.nvu
[2011/02/25 16:53:45 | 000,073,451 | —- | C] () – C:WINDOWSSystem32nvapps.xml
[2011/02/25 16:53:40 | 000,016,960 | —- | C] () – C:WINDOWSSystem32nvdisp.nvu
[2011/02/25 14:45:07 | 000,556,062 | —- | C] () – C:WINDOWSSystem32driversN360\0400000.07FCat.DB
[2011/02/25 14:45:00 | 000,007,443 | —- | C] () – C:WINDOWSSystem32driversSYMEVENT.CAT
[2011/02/25 14:45:00 | 000,000,805 | —- | C] () – C:WINDOWSSystem32driversSYMEVENT.INF
[2011/02/25 14:44:53 | 000,002,030 | —- | C] () – C:Documents and SettingsAll UsersDesktopNorton Security Suite.LNK
[2011/02/25 14:44:28 | 000,003,374 | R— | C] () – C:WINDOWSSystem32driversN360\0400000.07FSymEFA.inf
[2011/02/25 14:44:28 | 000,002,793 | R— | C] () – C:WINDOWSSystem32driversN360\0400000.07FSymDS.inf
[2011/02/25 14:44:28 | 000,001,756 | R— | C] () – C:WINDOWSSystem32driversN360\0400000.07FccHPx86.inf
[2011/02/25 14:44:28 | 000,001,473 | R— | C] () – C:WINDOWSSystem32driversN360\0400000.07FSymNetV.inf
[2011/02/25 14:44:28 | 000,001,445 | R— | C] () – C:WINDOWSSystem32driversN360\0400000.07FSymNet.inf
[2011/02/25 14:44:28 | 000,001,388 | R— | C] () – C:WINDOWSSystem32driversN360\0400000.07Fsrtspx.inf
[2011/02/25 14:44:28 | 000,001,382 | R— | C] () – C:WINDOWSSystem32driversN360\0400000.07Fsrtsp.inf
[2011/02/25 14:44:28 | 000,000,742 | R— | C] () – C:WINDOWSSystem32driversN360\0400000.07FIron.inf
[2011/02/25 14:44:27 | 000,007,787 | R— | C] () – C:WINDOWSSystem32driversN360\0400000.07Fsymnetv.cat
[2011/02/25 14:44:27 | 000,007,444 | R— | C] () – C:WINDOWSSystem32driversN360\0400000.07FSymEFA.cat
[2011/02/25 14:44:27 | 000,007,442 | R— | C] () – C:WINDOWSSystem32driversN360\0400000.07Fsrtspx.cat
[2011/02/25 14:44:27 | 000,007,438 | R— | C] () – C:WINDOWSSystem32driversN360\0400000.07Fsrtsp.cat
[2011/02/25 14:44:27 | 000,007,438 | R— | C] () – C:WINDOWSSystem32driversN360\0400000.07Firon.cat
[2011/02/25 14:44:27 | 000,007,425 | R— | C] () – C:WINDOWSSystem32driversN360\0400000.07FSymDS.cat
[2011/02/25 14:44:27 | 000,007,396 | R— | C] () – C:WINDOWSSystem32driversN360\0400000.07Fcchpx86.cat
[2011/02/25 14:44:27 | 000,007,368 | R— | C] () – C:WINDOWSSystem32driversN360\0400000.07FSymNet.cat
[2011/02/25 14:44:27 | 000,000,172 | —- | C] () – C:WINDOWSSystem32driversN360\0400000.07Fisolate.ini
[2011/02/25 14:42:17 | 000,000,825 | —- | C] () – C:Documents and SettingsJDesktopNorton Installation Files.lnk
[2011/02/25 13:24:46 | 000,940,794 | —- | C] () – C:WINDOWSSystem32LoopyMusic.wav
[2011/02/25 13:24:46 | 000,146,650 | —- | C] () – C:WINDOWSSystem32BuzzingBee.wav
[2011/02/25 13:14:15 | 000,001,945 | —- | C] () – C:WINDOWSepplauncher.mif
[2011/02/25 13:00:48 | 000,252,080 | —- | C] () – C:WINDOWSSystem32nvdrsdb0.bin
[2011/02/25 13:00:47 | 000,252,080 | —- | C] () – C:WINDOWSSystem32nvdrsdb1.bin
[2011/02/25 13:00:47 | 000,000,001 | —- | C] () – C:WINDOWSSystem32nvdrssel.bin
[2011/02/25 13:00:47 | 000,000,000 | —- | C] () – C:WINDOWSSystem32nvdrswr.lk
[2011/02/25 13:00:33 | 002,292,678 | —- | C] () – C:WINDOWSSystem32nvdata.bin
[2011/02/25 13:00:33 | 000,003,630 | —- | C] () – C:WINDOWSSystem32nvinfo.pb
[2011/02/25 12:58:23 | 000,040,960 | —- | C] () – C:WINDOWSSystem32ChCfg.exe
[2011/02/25 09:34:39 | 001,519,616 | —- | C] () – C:WINDOWSSystem32nwiz.exe
[2011/02/25 09:34:33 | 001,019,904 | —- | C] () – C:WINDOWSSystem32nvwimg.dll
[2011/02/25 09:34:32 | 001,662,976 | —- | C] () – C:WINDOWSSystem32nvwdmcpl.dll
[2011/02/25 09:34:28 | 000,466,944 | —- | C] () – C:WINDOWSSystem32nvshell.dll
[2011/02/25 09:34:28 | 000,073,728 | —- | C] () – C:WINDOWSSystem32nvtuicpl.cpl
[2011/02/25 09:34:23 | 000,286,720 | —- | C] () – C:WINDOWSSystem32nvnt4cpl.dll
[2011/02/25 09:34:17 | 001,466,368 | —- | C] () – C:WINDOWSSystem32nview.dll
[2011/02/25 09:34:17 | 000,581,632 | —- | C] () – C:WINDOWSSystem32nvhwvid.dll
[2011/02/25 09:34:14 | 001,339,392 | —- | C] () – C:WINDOWSSystem32nvdspsch.exe
[2011/02/25 09:33:54 | 000,442,368 | —- | C] () – C:WINDOWSSystem32nvappbar.exe
[2011/02/25 09:33:48 | 000,425,984 | —- | C] () – C:WINDOWSSystem32keystone.exe
[2011/02/25 01:10:50 | 000,000,786 | —- | C] () – C:Documents and SettingsJDesktopWindows Media Player.lnk
[2011/02/25 01:10:44 | 000,001,478 | —- | C] () – C:Documents and SettingsJApplication DataMicrosoftInternet ExplorerQuick LaunchMedia Center.lnk
[2011/02/25 01:10:44 | 000,000,815 | —- | C] () – C:Documents and SettingsJApplication DataMicrosoftInternet ExplorerQuick LaunchLaunch Internet Explorer Browser.lnk
[2011/02/25 01:10:44 | 000,000,701 | —- | C] () – C:Documents and SettingsJApplication DataMicrosoftInternet ExplorerQuick LaunchAmerica Online 9.0.lnk
[2011/02/25 01:10:44 | 000,000,079 | —- | C] () – C:Documents and SettingsJApplication DataMicrosoftInternet ExplorerQuick LaunchShow Desktop.scf
[2011/02/25 01:10:43 | 000,001,599 | —- | C] () – C:Documents and SettingsJStart MenuProgramsRemote Assistance.lnk
[2011/02/25 01:10:43 | 000,000,803 | —- | C] () – C:Documents and SettingsJStart MenuProgramsInternet Explorer.lnk
[2011/02/25 01:10:43 | 000,000,792 | —- | C] () – C:Documents and SettingsJStart MenuProgramsWindows Media Player.lnk
[2011/02/25 01:10:43 | 000,000,738 | —- | C] () – C:Documents and SettingsJStart MenuProgramsOutlook Express.lnk
[2011/02/25 00:43:30 | 000,008,192 | —- | C] () – C:WINDOWSREGLOCS.OLD
[2011/02/25 00:41:49 | 000,000,000 | —- | C] () – C:WINDOWSSystem32Gateway_GT5242E_Versionxx_CCH6AD1001094.MRK
[2011/02/25 00:41:44 | 000,000,333 | —- | C] () – C:WINDOWSSystem32$ncsp$.inf
[2011/02/24 23:57:03 | 000,002,238 | —- | C] () – C:WINDOWSSystem3232-aol.ico
[2011/02/24 23:57:03 | 000,001,406 | —- | C] () – C:WINDOWSSystem3216-aol.ico
[2011/02/24 23:54:59 | 000,000,376 | —- | C] () – C:WINDOWSODBC.INI
[2011/02/24 23:52:44 | 000,051,656 | —- | C] () – C:WINDOWSSystem32OEMLOGO.bmp
[2011/02/24 23:52:44 | 000,000,579 | —- | C] () – C:RebootLog.ini
[2011/02/24 23:52:31 | 000,000,002 | —- | C] () – C:AUDIT_INSTALL_IN_PROGRESS
[2011/02/24 23:51:07 | 000,000,002 | RHS- | C] () – C:USER
[2011/02/24 23:51:07 | 000,000,000 | —- | C] () – C:REQUEST_OEMRESET_ENDUSER
[2011/02/24 23:29:24 | 000,000,060 | —- | C] () – C:WINDOWSSystem32SYSDRV.DAT
[2011/02/24 23:28:23 | 000,144,201 | —- | C] () – C:WINDOWSSystem32driversHSFProf.cty
[2011/02/24 23:26:26 | 000,055,296 | —- | C] () – C:WINDOWSSystem32dvdplay.exe
[2007/02/08 23:27:56 | 000,027,440 | —- | C] () – C:WINDOWSSystem32driverssecdrv.sys
[2006/06/21 04:48:15 | 000,000,061 | —- | C] () – C:WINDOWSsmscfg.ini
[2006/06/17 04:24:58 | 000,000,538 | —- | C] () – C:WINDOWSSystem32oeminfo.ini
[2006/06/17 04:24:57 | 000,000,469 | —- | C] () – C:WINDOWSSystem32emver.ini
[2006/06/16 21:31:45 | 000,004,161 | —- | C] () – C:WINDOWSODBCINST.INI
[2005/08/05 23:01:54 | 000,235,008 | —- | C] () – C:WINDOWSSystem32psisdecd.dll
[2003/01/07 18:05:08 | 000,002,695 | —- | C] () – C:WINDOWSSystem32OUTLPERF.INI

========== LOP Check ==========

[2011/02/25 13:19:01 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataInstallMate
[2011/02/25 23:17:50 | 000,000,000 | —D | M] – C:Documents and SettingsAll UsersApplication DataTarma Installer
[2011/02/25 13:24:43 | 000,000,000 | —D | M] – C:Documents and SettingsJApplication DataWinPatrol

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%*.* >
[2011/02/25 12:59:08 | 000,000,206 | —- | M] () – C:audio.log
[2011/02/24 23:52:31 | 000,000,002 | —- | M] () – C:AUDIT_INSTALL_IN_PROGRESS
[2006/06/17 04:41:16 | 000,000,000 | —- | M] () – C:AUTOEXEC.BAT
[2011/02/26 00:11:32 | 000,000,197 | RHS- | M] () – C:boot.ini
[2006/06/17 04:41:16 | 000,000,000 | —- | M] () – C:CONFIG.SYS
[2011/02/25 23:44:38 | 2145,898,496 | -HS- | M] () – C:hiberfil.sys
[2006/06/17 04:41:16 | 000,000,000 | RHS- | M] () – C:IO.SYS
[2011/02/25 16:57:47 | 000,000,086 | —- | M] () – C:lan.log
[2006/06/17 04:41:16 | 000,000,000 | RHS- | M] () – C:MSDOS.SYS
[2004/08/10 14:00:00 | 000,047,564 | RHS- | M] () – C:NTDETECT.COM
[2004/08/10 14:00:00 | 000,250,032 | RHS- | M] () – C:ntldr
[2011/02/25 23:44:37 | 2145,386,496 | -HS- | M] () – C:pagefile.sys
[2011/02/24 23:53:28 | 000,000,090 | —- | M] () – C:powerdvd.log
[2011/02/24 23:57:40 | 000,000,579 | —- | M] () – C:RebootLog.ini
[2011/02/24 23:56:14 | 000,000,000 | —- | M] () – C:REQUEST_OEMRESET_ENDUSER
[2011/02/24 23:51:07 | 000,000,002 | RHS- | M] () – C:USER

< %systemroot%Fonts*.com >

< %systemroot%Fonts*.dll >

< %systemroot%Fonts*.ini >
[2004/08/10 14:00:00 | 000,000,067 | —- | M] () – C:WINDOWSFontsdesktop.ini

< %systemroot%Fonts*.ini2 >

< %systemroot%Fonts*.exe >

< %systemroot%system32spoolprtprocsw32x86*.* >
[2003/06/18 20:31:48 | 000,018,944 | —- | M] (Microsoft Corporation) – C:WINDOWSsystem32spoolprtprocsw32x86mdippr.dll

< %systemroot%REPAIR*.bak1 >

< %systemroot%REPAIR*.ini >

< %systemroot%system32*.jpg >

< %systemroot%*.jpg >

< %systemroot%*.png >

< %systemroot%*.scr >

< %systemroot%*._sy >

< %APPDATA%AdobeUpdate*.* >

< %ALLUSERSPROFILE%Favorites*.* >

< %APPDATA%Microsoft*.* >

< %PROGRAMFILES%*.* >

< %APPDATA%Update*.* >

< %systemroot%*. /mp /s >

< %systemroot%System32config*.sav >
[2006/06/16 21:30:11 | 000,094,208 | —- | M] () – C:WINDOWSsystem32configdefault.sav
[2006/06/16 21:30:11 | 000,659,456 | —- | M] () – C:WINDOWSsystem32configsoftware.sav
[2006/06/16 21:30:11 | 000,897,024 | —- | M] () – C:WINDOWSsystem32configsystem.sav

< %PROGRAMFILES%bak. /s >

< %systemroot%system32bak. /s >

< %ALLUSERSPROFILE%Start Menu*.lnk /x >
[2006/06/17 04:41:25 | 000,000,294 | -HS- | M] () – C:Documents and SettingsAll UsersStart Menudesktop.ini

< %systemroot%system32configsystemprofile*.dat /x >

< %systemroot%*.config >

< %systemroot%system32*.db >

< %PROGRAMFILES%Internet Explorer*.dat >

< %APPDATA%MicrosoftInternet ExplorerQuick Launch*.lnk /x >
[2011/02/25 01:10:56 | 000,000,170 | -HS- | M] () – C:Documents and SettingsJApplication DataMicrosoftInternet ExplorerQuick Launchdesktop.ini
[2006/06/17 04:46:25 | 000,000,079 | —- | M] () – C:Documents and SettingsJApplication DataMicrosoftInternet ExplorerQuick LaunchShow Desktop.scf

< %USERPROFILE%Desktop*.exe >
[2011/02/24 08:44:16 | 004,274,226 | —- | M] () – C:Documents and SettingsJDesktopComboFix.exe
[2011/02/25 13:12:47 | 007,866,472 | —- | M] (Microsoft Corporation) – C:Documents and SettingsJDesktopmseinstall.exe
[2011/02/24 10:13:32 | 000,577,024 | —- | M] (OldTimer Tools) – C:Documents and SettingsJDesktopOTL.exe
[2009/08/13 11:14:18 | 000,472,064 | —- | M] ( ) – C:Documents and SettingsJDesktopRootRepeal.exe

< %PROGRAMFILES%Common Files*.* >

< %systemroot%*.src >

< %systemroot%install*.* >

< %systemroot%system32DLL*.* >

< %systemroot%system32HelpFiles*.* >

< %systemroot%system32rundll*.* >

< %systemroot%winn32*.* >

< %systemroot%Java*.* >

< %systemroot%system32test*.* >

< %systemroot%system32Rundll32*.* >

< %systemroot%AppPatchCustom*.* >

< HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU >

< HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto UpdateResultsInstall|LastSuccessTime /rs >
< End of report >
OTL Extras logfile created on: 2/26/2011 12:33:17 AM - Run 1
OTL by OldTimer - Version 3.2.21.0 Folder = C:Documents and SettingsJDesktop
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 52.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 83.00% Paging File free
Paging file location(s): C:pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:WINDOWS | %ProgramFiles% = C:Program Files
Drive C: | 143.72 Gb Total Space | 134.22 Gb Free Space | 93.39% Space Free | Partition Type: NTFS
Drive D: | 5.31 Gb Total Space | 2.24 Gb Free Space | 42.13% Space Free | Partition Type: FAT32
Drive J: | 1.88 Gb Total Space | 1.40 Gb Free Space | 74.41% Space Free | Partition Type: FAT32

Computer Name: CARROLLS_PC | User Name: J | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINESOFTWAREClasses]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINESOFTWAREClassesshell[command]command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%system32rundll32.exe %SystemRoot%system32shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoring]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringAhnlabAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringKasperskyAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringMcAfeeAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringMcAfeeFirewall]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringPandaAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringPandaFirewall]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSophosAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSymantecAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringSymantecFirewall]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTinyFirewall]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTrendAntiVirus]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringTrendFirewall]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterMonitoringZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSr]
"Start" = 0

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFi
rewallPolicyDomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFi
rewallPolicyStandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFi
rewallPolicyStandardProfileGloballyOpenPortsList]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFi
rewallPolicyDomainProfileAuthorizedApplicationsList]

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFi
rewallPolicyStandardProfileAuthorizedApplicationsList]


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall]
"{007811BF-E310-4285-BFC6-55DB29B3EDDE}" = WinPatrol
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = DVD Solution
"{3248F0A8-6813-11D6-A77B-00B0D0150020}" = J2SE Runtime Environment 5.0 Update 2
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go 4.0
"{4AC55A61-BA20-4DF5-ABFF-8F4819E0C875}" = Digital Media Reader
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 266.58
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 266.58
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 135.50
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"CNXT_MODEM_PCI_VEN_14F1&DEV;_2F40&SUBSYS;_200014F1" = Soft Data Fax Modem with SmartCP
"ie8" = Windows Internet Explorer 8
"InstallShield_{4AC55A61-BA20-4DF5-ABFF-8F4819E0C875}" = Digital Media Reader
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"N360" = Norton Security Suite
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"WGA" = Windows Genuine Advantage Validation Tool
"Windows Media Format Runtime" = Windows Media Format Runtime

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2/26/2011 1:23:17 AM | Computer Name = CARROLLS_PC | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/2796BAE63F1801E277261BA0D77770028F20EEE4.crt>
with error: This network connection does not exist.

Error - 2/26/2011 1:23:17 AM | Computer Name = CARROLLS_PC | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/2796BAE63F1801E277261BA0D77770028F20EEE4.crt>
with error: This network connection does not exist.

Error - 2/26/2011 1:23:49 AM | Computer Name = CARROLLS_PC | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/2796BAE63F1801E277261BA0D77770028F20EEE4.crt>
with error: This network connection does not exist.

Error - 2/26/2011 1:23:49 AM | Computer Name = CARROLLS_PC | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/2796BAE63F1801E277261BA0D77770028F20EEE4.crt>
with error: This network connection does not exist.

Error - 2/26/2011 1:24:41 AM | Computer Name = CARROLLS_PC | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/2796BAE63F1801E277261BA0D77770028F20EEE4.crt>
with error: This network connection does not exist.

Error - 2/26/2011 1:24:41 AM | Computer Name = CARROLLS_PC | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/2796BAE63F1801E277261BA0D77770028F20EEE4.crt>
with error: This network connection does not exist.

Error - 2/26/2011 1:25:00 AM | Computer Name = CARROLLS_PC | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/2796BAE63F1801E277261BA0D77770028F20EEE4.crt>
with error: This network connection does not exist.

Error - 2/26/2011 1:25:00 AM | Computer Name = CARROLLS_PC | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/2796BAE63F1801E277261BA0D77770028F20EEE4.crt>
with error: This network connection does not exist.

Error - 2/26/2011 1:25:06 AM | Computer Name = CARROLLS_PC | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/2796BAE63F1801E277261BA0D77770028F20EEE4.crt>
with error: This network connection does not exist.

Error - 2/26/2011 1:25:06 AM | Computer Name = CARROLLS_PC | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/2796BAE63F1801E277261BA0D77770028F20EEE4.crt>
with error: This network connection does not exist.

[ System Events ]
Error - 2/25/2011 8:17:48 PM | Computer Name = CARROLLS_PC | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 2/25/2011 8:17:48 PM | Computer Name = CARROLLS_PC | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 2/25/2011 8:17:49 PM | Computer Name = CARROLLS_PC | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 2/25/2011 8:17:50 PM | Computer Name = CARROLLS_PC | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 2/26/2011 12:12:35 AM | Computer Name = CARROLLS_PC | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 2/26/2011 12:15:00 AM | Computer Name = CARROLLS_PC | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 2/26/2011 12:16:14 AM | Computer Name = CARROLLS_PC | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
BHDrvx86 ccHP eeCtrl Fips Processor SRTSPX SymIRON SYMTDI

Error - 2/26/2011 12:21:16 AM | Computer Name = CARROLLS_PC | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 2/26/2011 12:27:22 AM | Computer Name = CARROLLS_PC | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 2/26/2011 12:28:04 AM | Computer Name = CARROLLS_PC | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}


< End of report >
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:44:24 AM, on 2/26/2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSehomeehtray.exe
C:Program FilesDigital Media Readerreadericon45G.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:WINDOWSRTHDCPL.EXE
C:Program FilesBillP StudiosWinPatrolwinpatrol.exe
C:WINDOWSsystem32ctfmon.exe
C:WINDOWSeHomeehRecvr.exe
C:WINDOWSeHomeehSched.exe
C:Program FilesNorton Security SuiteEngine4.0.0.127ccSvcHst.exe
C:Program FilesCommon FilesNew BoundaryPrismXLPRISMXL.SYS
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32dllhost.exe
C:WINDOWSeHomeehmsas.exe
C:Program FilesNorton Security SuiteEngine4.0.0.127ccSvcHst.exe
C:WINDOWSsystem32msiexec.exe
C:Program FilesTrend MicroHiJackThisHiJackThis.exe
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://www.gateway.com/g/sidepanel.html?Ch…d&M;=GT5242E
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.ask.com/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.gateway.com/g/sidepanel.html?Ch…d&M;=GT5242E
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:Program FilesNorton Security SuiteEngine4.0.0.127coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:Program FilesNorton Security SuiteEngine4.0.0.127IPSBHO.DLL
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:Program FilesNorton Security SuiteEngine4.0.0.127coIEPlg.dll
O4 - HKLM..Run: [ehTray] C:WINDOWSehomeehtray.exe
O4 - HKLM..Run: [readericon] C:Program FilesDigital Media Readerreadericon45G.exe
O4 - HKLM..Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] C:Program FilesNVIDIA CorporationnViewnwiz.exe /installquiet
O4 - HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM..Run: [WinPatrol] C:Program FilesBillP StudiosWinPatrolwinpatrol.exe -expressboot
O4 - HKCU..Run: [Power2GoExpress] NA
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1298664894125
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:WINDOWSsystem32browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:WINDOWSsystem32browseui.dll
O23 - Service: Norton Security Suite (N360) - Symantec Corporation - C:Program FilesNorton Security SuiteEngine4.0.0.127ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32nvsvc32.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:Program FilesCommon FilesNew BoundaryPrismXLPRISMXL.SYS
–
End of file - 4722 bytes

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:44:24 AM, on 2/26/2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Any reason you haven't updated to SP3?
Support for SP2 ending long ago



DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.


Note: Close all browsers before running ATF Cleaner: IE, FireFox, etc.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.


It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.


Next:


Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2

• Ensure all Firefox windows are closed.
• To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
• When prompted to run the scan, click Yes.
• It doesn't take long to run, once it is finished move onto the next step

Next:

Note: if the Cure option is not there, please select 'Skip'.

Please read carefully and follow these steps.

• Download TDSSKiller and save it to your Desktop.
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Also please describe how your computer behaves at the moment.

First off thank you guys for your help and for this forum. Man, this has really been a serious pain.

To answer you question about why I was only on Windows SP2 is that this rootkit had blocked any outbound transmissions to Microsoft via auto update. I mean I even tried to ping microsoft.com from the command promt and nothing would leave my pc. Since I reformatted the system and this pc is from 2005 I couldnt auto update due to the infection.

Before running the steps you provided above my pc would be running at normal paces until an IE browser would open by user. As soon as anyone initialized it a small stall would happen and then my Nortons AV would go nuts with intrusion attempts ( I have an exported .mcf log of these if you would like to take a look ) full of blocked acceses to unused ports and regedit attempts. Anytime I tried to either google search or even when I tried replying to this forum last night (I had to email my post to a friend and have him login and post it for me) my browser would redirect everytime. All of these things had an effect on performance until I would open my task manager or winpatrol and end task on an unknown svchost.exe task that would be killing my CPU usage.

Since taking the steps you provided, I have just not had none of the above issues and have just updated to SP3 via my updater. I am still recieving intrusion attempts being blocked by Norton. All sorts of things like previously and I just hope it catches them all. If this happens again I am going to lose it. Do you happen to know if I can get a new modem or something that can change any link to my pc to stop this? I hope that the rootkit found by TDSSKiller and anything that was dumped by the other two apps will prevent any further issues. Thanks again for all your help.

Here is the log you requested.

2011/02/26 14:20:13.0562 0432 TDSS rootkit removing tool 2.4.18.0 Feb 21 2011 11:08:08
2011/02/26 14:20:14.0937 0432 ================================================================================
2011/02/26 14:20:14.0937 0432 SystemInfo:
2011/02/26 14:20:14.0937 0432
2011/02/26 14:20:14.0937 0432 OS Version: 5.1.2600 ServicePack: 2.0
2011/02/26 14:20:14.0937 0432 Product type: Workstation
2011/02/26 14:20:14.0937 0432 ComputerName: CARROLLS_PC
2011/02/26 14:20:14.0937 0432 UserName: J
2011/02/26 14:20:14.0937 0432 Windows directory: C:\WINDOWS
2011/02/26 14:20:14.0937 0432 System windows directory: C:\WINDOWS
2011/02/26 14:20:14.0937 0432 Processor architecture: Intel x86
2011/02/26 14:20:14.0937 0432 Number of processors: 1
2011/02/26 14:20:14.0937 0432 Page size: 0x1000
2011/02/26 14:20:14.0937 0432 Boot type: Normal boot
2011/02/26 14:20:14.0937 0432 ================================================================================
2011/02/26 14:20:15.0453 0432 Initialize success
2011/02/26 14:20:23.0546 2848 ================================================================================
2011/02/26 14:20:23.0546 2848 Scan started
2011/02/26 14:20:23.0546 2848 Mode: Manual;
2011/02/26 14:20:23.0546 2848 ================================================================================
2011/02/26 14:20:24.0437 2848 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
2011/02/26 14:20:24.0812 2848 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/02/26 14:20:25.0156 2848 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2011/02/26 14:20:25.0546 2848 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
2011/02/26 14:20:25.0921 2848 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
2011/02/26 14:20:26.0343 2848 AFD (5ac495f4cb807b2b98ad2ad591e6d92e) C:\WINDOWS\System32\drivers\afd.sys
2011/02/26 14:20:26.0750 2848 agp440 (2c428fa0c3e3a01ed93c9b2a27d8d4bb) C:\WINDOWS\system32\DRIVERS\agp440.sys
2011/02/26 14:20:27.0125 2848 agpCPQ (67288b07d6aba6c1267b626e67bc56fd) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
2011/02/26 14:20:27.0531 2848 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
2011/02/26 14:20:27.0937 2848 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
2011/02/26 14:20:28.0312 2848 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
2011/02/26 14:20:28.0734 2848 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
2011/02/26 14:20:29.0125 2848 alim1541 (f312b7cef21eff52fa23056b9d815fad) C:\WINDOWS\system32\DRIVERS\alim1541.sys
2011/02/26 14:20:29.0515 2848 amdagp (675c16a3c1f8482f85ee4a97fc0dde3d) C:\WINDOWS\system32\DRIVERS\amdagp.sys
2011/02/26 14:20:29.0921 2848 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
2011/02/26 14:20:30.0312 2848 Arp1394 (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/02/26 14:20:30.0718 2848 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
2011/02/26 14:20:31.0109 2848 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
2011/02/26 14:20:31.0515 2848 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
2011/02/26 14:20:31.0968 2848 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/02/26 14:20:32.0343 2848 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/02/26 14:20:33.0062 2848 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/02/26 14:20:33.0484 2848 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/02/26 14:20:33.0906 2848 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/02/26 14:20:34.0156 2848 BHDrvx86 (83a2fec59a0a0fc73bf6598e901b2fbd) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20110114.001\BHDrvx86.sys
2011/02/26 14:20:34.0562 2848 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
2011/02/26 14:20:34.0953 2848 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/02/26 14:20:35.0406 2848 ccHP (e941e709847fa00e0dd6d58d2b8fb5e1) C:\WINDOWS\system32\drivers\N360\0402000.00C\ccHPx86.sys
2011/02/26 14:20:35.0828 2848 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
2011/02/26 14:20:36.0218 2848 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/02/26 14:20:36.0640 2848 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/02/26 14:20:37.0078 2848 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/02/26 14:20:37.0843 2848 CmBatt (4266be808f85826aedf3c64c1e240203) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/02/26 14:20:38.0218 2848 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
2011/02/26 14:20:38.0609 2848 Compbatt (df1b1a24bf52d0ebc01ed4ece8979f50) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/02/26 14:20:39.0015 2848 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
2011/02/26 14:20:39.0406 2848 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
2011/02/26 14:20:39.0812 2848 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
2011/02/26 14:20:40.0203 2848 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/02/26 14:20:40.0593 2848 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys
2011/02/26 14:20:41.0046 2848 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys
2011/02/26 14:20:41.0421 2848 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/02/26 14:20:41.0796 2848 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
2011/02/26 14:20:42.0234 2848 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
2011/02/26 14:20:42.0656 2848 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/02/26 14:20:42.0781 2848 eeCtrl (089296aedb9b72b4916ac959752bdc89) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
2011/02/26 14:20:43.0203 2848 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/02/26 14:20:43.0625 2848 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\drivers\Fdc.sys
2011/02/26 14:20:44.0015 2848 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys
2011/02/26 14:20:44.0421 2848 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/02/26 14:20:44.0828 2848 FltMgr (358db977c3247038eb58a81fddd2b58f) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2011/02/26 14:20:45.0281 2848 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/02/26 14:20:45.0703 2848 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/02/26 14:20:46.0140 2848 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2011/02/26 14:20:46.0593 2848 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/02/26 14:20:46.0984 2848 HdAudAddService (2a013e7530beab6e569faa83f517e836) C:\WINDOWS\system32\drivers\HdAudio.sys
2011/02/26 14:20:47.0375 2848 HDAudBus (3fcc124b6e08ee0e9351f717dd136939) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/02/26 14:20:47.0796 2848 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/02/26 14:20:48.0203 2848 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
2011/02/26 14:20:48.0671 2848 HSFHWBS2 (f3e718604c5a8a28003280d861d96c19) C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys
2011/02/26 14:20:49.0140 2848 HSF_DPV (4290713b7c3289ef87ee5ca474b21221) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
2011/02/26 14:20:49.0593 2848 HTTP (c19b522a9ae0bbc3293397f3055e80a1) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/02/26 14:20:50.0031 2848 i2omgmt (8f09f91b5c91363b77bcd15599570f2c) C:\WINDOWS\system32\drivers\i2omgmt.sys
2011/02/26 14:20:50.0421 2848 i2omp (ed6bf9e441fdea13292a6d30a64a24c3) C:\WINDOWS\system32\DRIVERS\i2omp.sys
2011/02/26 14:20:50.0812 2848 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/02/26 14:20:51.0250 2848 iaStor (309c4d86d989fb1fcf64bd30dc81c51b) C:\WINDOWS\system32\DRIVERS\IASTOR.SYS
2011/02/26 14:20:51.0531 2848 IDSxpx86 (0308238c582a55d83d34feee39542793) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20110225.001\IDSxpx86.sys
2011/02/26 14:20:51.0937 2848 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/02/26 14:20:52.0359 2848 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
2011/02/26 14:20:52.0906 2848 IntcAzAudAddService (98b7fab86755a42fe8eb04538a4cd6c8) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2011/02/26 14:20:53.0328 2848 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) C:\WINDOWS\system32\DRIVERS\intelide.sys
2011/02/26 14:20:53.0703 2848 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2011/02/26 14:20:54.0125 2848 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/02/26 14:20:54.0515 2848 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/02/26 14:20:54.0921 2848 IpNat (b5a8e215ac29d24d60b4d1250ef05ace) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/02/26 14:20:55.0343 2848 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/02/26 14:20:55.0750 2848 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/02/26 14:20:56.0171 2848 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/02/26 14:20:56.0562 2848 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/02/26 14:20:56.0953 2848 kbdhid (e182fa8e49e8ee41b4adc53093f3c7e6) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/02/26 14:20:57.0343 2848 kmixer (d93cad07c5683db066b0b2d2d3790ead) C:\WINDOWS\system32\drivers\kmixer.sys
2011/02/26 14:20:57.0750 2848 KSecDD (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/02/26 14:20:58.0578 2848 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
2011/02/26 14:20:59.0000 2848 MHNDRV (7f2f1d2815a6449d346fcccbc569fbd6) C:\WINDOWS\system32\DRIVERS\mhndrv.sys
2011/02/26 14:20:59.0406 2848 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/02/26 14:20:59.0796 2848 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys
2011/02/26 14:21:00.0218 2848 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/02/26 14:21:00.0609 2848 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/02/26 14:21:01.0031 2848 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/02/26 14:21:01.0453 2848 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
2011/02/26 14:21:01.0843 2848 MRxDAV (46edcc8f2db2f322c24f48785cb46366) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/02/26 14:21:02.0234 2848 MRxSmb (025af03ce51645c62f3b6907a7e2be5e) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/02/26 14:21:02.0703 2848 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
2011/02/26 14:21:03.0093 2848 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/02/26 14:21:03.0515 2848 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/02/26 14:21:03.0890 2848 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/02/26 14:21:04.0281 2848 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/02/26 14:21:04.0687 2848 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
2011/02/26 14:21:04.0921 2848 NAVENG (c8ef74e4d8105b1d02d58ea4734cf616) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20110226.003\NAVENG.SYS
2011/02/26 14:21:05.0171 2848 NAVEX15 (94b3164055d821a62944d9fe84036470) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20110226.003\NAVEX15.SYS
2011/02/26 14:21:05.0562 2848 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
2011/02/26 14:21:05.0953 2848 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/02/26 14:21:06.0343 2848 Ndisuio (eefa1ce63805d2145978621be5c6d955) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/02/26 14:21:06.0734 2848 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/02/26 14:21:07.0109 2848 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/02/26 14:21:07.0500 2848 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/02/26 14:21:07.0906 2848 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/02/26 14:21:08.0328 2848 NIC1394 (5c5c53db4fef16cf87b9911c7e8c6fbc) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/02/26 14:21:08.0703 2848 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
2011/02/26 14:21:09.0078 2848 Ntfs (b78be402c3f63dd55521f73876951cdd) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/02/26 14:21:09.0515 2848 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/02/26 14:21:10.0203 2848 nv (18c9b152da7bea76b2f9e4b6412e0aaf) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/02/26 14:21:10.0921 2848 NVENETFD (2a7a2c6ab9631028b6e3a4159aa65705) C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
2011/02/26 14:21:11.0328 2848 nvnetbus (20526a8827dc0956b5526aebcb6751a0) C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
2011/02/26 14:21:11.0718 2848 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/02/26 14:21:12.0093 2848 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/02/26 14:21:12.0500 2848 ohci1394 (0951db8e5823ea366b0e408d71e1ba2a) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/02/26 14:21:12.0921 2848 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/02/26 14:21:13.0312 2848 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/02/26 14:21:13.0718 2848 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/02/26 14:21:14.0125 2848 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/02/26 14:21:14.0859 2848 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/02/26 14:21:15.0265 2848 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2011/02/26 14:21:17.0046 2848 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
2011/02/26 14:21:17.0421 2848 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
2011/02/26 14:21:17.0812 2848 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/02/26 14:21:18.0203 2848 Processor (0d97d88720a4087ec93af7dbb303b30a) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/02/26 14:21:18.0625 2848 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/02/26 14:21:19.0015 2848 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/02/26 14:21:19.0390 2848 PxHelp20 (617accada2e0a0f43ec6030bbac49513) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/02/26 14:21:19.0796 2848 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
2011/02/26 14:21:20.0328 2848 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
2011/02/26 14:21:20.0875 2848 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
2011/02/26 14:21:21.0250 2848 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
2011/02/26 14:21:21.0640 2848 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
2011/02/26 14:21:22.0015 2848 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/02/26 14:21:23.0203 2848 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/02/26 14:21:23.0859 2848 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/02/26 14:21:24.0234 2848 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/02/26 14:21:24.0609 2848 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/02/26 14:21:25.0031 2848 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/02/26 14:21:25.0421 2848 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/02/26 14:21:25.0812 2848 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/02/26 14:21:26.0218 2848 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/02/26 14:21:26.0625 2848 sdbus (02fc71b020ec8700ee8a46c58bc6f276) C:\WINDOWS\system32\DRIVERS\sdbus.sys
2011/02/26 14:21:27.0000 2848 Secdrv (d26e26ea516450af9d072635c60387f4) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/02/26 14:21:27.0390 2848 Serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/02/26 14:21:27.0812 2848 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/02/26 14:21:28.0203 2848 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/02/26 14:21:28.0921 2848 sisagp (732d859b286da692119f286b21a2a114) C:\WINDOWS\system32\DRIVERS\sisagp.sys
2011/02/26 14:21:29.0296 2848 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
2011/02/26 14:21:29.0703 2848 splitter (8e186b8f23295d1e42c573b82b80d548) C:\WINDOWS\system32\drivers\splitter.sys
2011/02/26 14:21:30.0109 2848 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/02/26 14:21:30.0500 2848 SRTSP (f68cfec40f2800aacc1d4bf33eb79f9a) C:\WINDOWS\system32\drivers\N360\0400000.07F\SRTSP.SYS
2011/02/26 14:21:30.0937 2848 SRTSPX (55d5c37ed41231e3ac2063d16df50840) C:\WINDOWS\system32\drivers\N360\0402000.00C\SRTSPX.SYS
2011/02/26 14:21:31.0343 2848 Srv (553007ecce7f6565bbe645beb66d3b69) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/02/26 14:21:31.0781 2848 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/02/26 14:21:32.0156 2848 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
2011/02/26 14:21:32.0531 2848 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
2011/02/26 14:21:32.0953 2848 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
2011/02/26 14:21:33.0359 2848 SymDS (56890bf9d9204b93042089d4b45ae671) C:\WINDOWS\system32\drivers\N360\0402000.00C\SYMDS.SYS
2011/02/26 14:21:33.0781 2848 SymEFA (1c91df5188150510a6f0cf78f7d94b69) C:\WINDOWS\system32\drivers\N360\0402000.00C\SYMEFA.SYS
2011/02/26 14:21:34.0156 2848 SymEvent (961b48b86f94d4cc8ceb483f8aa89374) C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
2011/02/26 14:21:34.0593 2848 SymIRON (dc80fbf0a348e54853ef82eed4e11e35) C:\WINDOWS\system32\drivers\N360\0402000.00C\Ironx86.SYS
2011/02/26 14:21:35.0031 2848 SYMTDI (2d60a37fee3d6f763cd3cf4509dcdd43) C:\WINDOWS\system32\drivers\N360\0400000.07F\SYMTDI.SYS
2011/02/26 14:21:35.0421 2848 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
2011/02/26 14:21:35.0843 2848 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
2011/02/26 14:21:36.0234 2848 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/02/26 14:21:36.0625 2848 Tcpip (1dbf125862891817f374f407626967f4) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/02/26 14:21:37.0046 2848 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/02/26 14:21:37.0421 2848 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/02/26 14:21:37.0875 2848 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/02/26 14:21:38.0281 2848 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
2011/02/26 14:21:38.0671 2848 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
2011/02/26 14:21:39.0093 2848 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
2011/02/26 14:21:39.0500 2848 Update (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys
2011/02/26 14:21:39.0937 2848 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/02/26 14:21:40.0312 2848 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/02/26 14:21:40.0718 2848 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/02/26 14:21:41.0125 2848 usbohci (bdfe799a8531bad8a5a985821fe78760) C:\WINDOWS\system32\DRIVERS\usbohci.sys
2011/02/26 14:21:41.0531 2848 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/02/26 14:21:41.0921 2848 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/02/26 14:21:42.0328 2848 usbstor (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/02/26 14:21:42.0718 2848 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/02/26 14:21:43.0125 2848 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
2011/02/26 14:21:43.0546 2848 viaagp (d92e7c8a30cfd14d8e15b5f7f032151b) C:\WINDOWS\system32\DRIVERS\viaagp.sys
2011/02/26 14:21:43.0968 2848 ViaIde (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\system32\DRIVERS\viaide.sys
2011/02/26 14:21:44.0343 2848 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/02/26 14:21:44.0718 2848 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/02/26 14:21:45.0500 2848 wdmaud (2797f33ebf50466020c430ee4f037933) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/02/26 14:21:45.0906 2848 winachsf (cb2dc26de2c815fc2309566f92d22ed4) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
2011/02/26 14:21:46.0156 2848 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/02/26 14:21:46.0187 2848 ================================================================================
2011/02/26 14:21:46.0187 2848 Scan finished
2011/02/26 14:21:46.0187 2848 ================================================================================
2011/02/26 14:21:46.0187 3784 Detected object count: 1
2011/02/26 14:22:06.0046 3784 \HardDisk0 - will be cured after reboot
2011/02/26 14:22:06.0046 3784 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
2011/02/26 14:22:59.0218 1064 Deinitialize success


If this actually gets posted I guess we know things are looking up.

Please run TDSSKiller again so we can be sure the RootKit is gone.

After that:

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
  [external image: Posted Image]
• When the scan is complete, click OK, then Show Results to view the results.
• [external image: Posted Image]
• Then click Remove Selected .
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Also please describe how your computer behaves at the moment.


Please don't attach the scans / logs, use "copy/paste".

Thanks for such a quick response. I re-ran the TDSSKiller again and nothing was found. Here is the mbam-log… Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5888 Windows 5.1.2600 Service Pack 2 Internet Explorer 8.0.6001.18702 2/26/2011 6:15:16 PM mbam-log-2011-02-26 (18-15-05).txt Scan type: Quick scan Objects scanned: 146041 Time elapsed: 14 minute(s), 2 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 4 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 64 Files Infected: 579 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{52794457-af6c-4c50-9def-f2e24f4c8889} (PUP.WhiteSmoke) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{52794457-AF6C-4C50-9DEF-F2E24F4C8889} (PUP.WhiteSmoke) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{52794457-AF6C-4C50-9DEF-F2E24F4C8889} (PUP.WhiteSmoke) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{52794457-AF6C-4C50-9DEF-F2E24F4C8889} (PUP.WhiteSmoke) -> No action taken. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: c:\program files\whitesmoketoolbar (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\lib (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\modules (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\newtab (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\newtab\images (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\skin (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\skin\css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\skin\images (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\skin\scripts (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\js (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\skin (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\skin\css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\skin\images (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\skin\scripts (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\skin (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\skin\css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\skin\images (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\skin\scripts (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\js (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\skin (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\skin\css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\skin\images (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\skin\scripts (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\data (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\data\dynamicelements (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\data\rss (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\data\search (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\data\weather (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\dtxwizard (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\dtxwizard\skin (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\dtxwizard\skin\icon_library (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\dtxwizard\skin\icon_library\Basics (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\scripts (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\icons (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\options (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\searchbar (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\components (PUP.WhiteSmoke) -> No action taken. c:\documents and settings\networkservice\application data\whitesmoketoolbar (PUP.WhiteSmoke) -> No action taken. Files Infected: c:\program files\whitesmoketoolbar\whitesmoketoolbarx.dll (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\manifest.xml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\toolbar.xml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\uninstall.exe (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\whitesmoketoolbar.dll (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\neterror.xhtml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\preferences.xml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\toolbar.htm (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\toolbar.xul (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\vmncode.js (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\vmnrsswin.xml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\lib\about.xml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\lib\dtxpanel.xul (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\lib\dtxpanelwin.xul (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\lib\dtxprefwin.xul (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\lib\dtxwin.xul (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\lib\emailnotifierproviders.xml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\lib\external.js (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\lib\neterror.xhtml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\lib\rsspreview.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\lib\rsswin.xml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\lib\rsswin.xsl (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\lib\vmncode.js (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\lib\wmpstreamer.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\modules\datastore.jsm (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\newtab\newtab.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\newtab\images\btn_search.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\newtab\images\bullet.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\newtab\images\field_bg.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\newtab\images\powered_by_yahoo.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\tb_icon.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\widget.jsw (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\widget.xml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\widget_version.txt (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\skin\main.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\skin\css\dialog.css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\skin\images\bg.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\skin\images\btn-wide-close-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\skin\images\btn-wide-close.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\skin\images\default.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\skin\images\transparent.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\skin\images\win-btm-left.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\skin\images\win-btm-mdl.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\skin\images\win-btm-right-resize.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\skin\images\win-btm-right.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.facebook\skin\scripts\defscript.js (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\tb_icon.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\Thumbs.db (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\widget.jsw (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\widget.xml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\widget_version.txt (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\css\twitter.css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\scrollbottom.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\btn-login-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\btn-login.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\btn-submit.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\loginbg.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\refresh-over.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\refresh.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\scrollbottom-disable.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\scrollbottom-down.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\scrollbottom-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\scrolltop-disable.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\scrolltop-down.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\scrolltop-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\scrolltop.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\tab-off-l.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\tab-off-r.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\tab-on-l.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\tab-on-r.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\throbber.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\Thumbs.db (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\twitter-logo48.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\images\twitter_top.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\js\jquery.js (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\js\scripts.js (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\skin\main.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\skin\css\dialog.css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\skin\images\bg.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\skin\images\btn-wide-close-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\skin\images\btn-wide-close.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\skin\images\default.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\skin\images\transparent.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\skin\images\win-btm-left.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\skin\images\win-btm-mdl.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\skin\images\win-btm-right-resize.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\skin\images\win-btm-right.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.twitter\skin\scripts\defscript.js (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\tb_icon.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\widget.jsw (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\widget.xml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\widget_version.txt (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\skin\main.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\skin\css\dialog.css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\skin\images\bg.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\skin\images\btn-search.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\skin\images\btn-wide-close-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\skin\images\btn-wide-close.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\skin\images\default.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\skin\images\Thumbs.db (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\skin\images\transparent.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\skin\images\win-btm-left.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\skin\images\win-btm-mdl.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\skin\images\win-btm-right-resize.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\skin\images\win-btm-right.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.webtv\skin\scripts\defscript.js (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\index.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\tb_icon.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\widget.jsw (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\widget.xml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\widget_version.txt (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\css\dialog.css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\scrollt.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\arrow-grey.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\arrows_grey-left.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\arrows_grey-right.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\btn-search-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\btn-search.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\powered-by-youtube.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\scrollb-disable.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\scrollb-down.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\scrollb.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\scrollt-disable.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\scrollt-down.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\tab-off-l.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\tab-off-r.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\tab-on-l.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\tab-on-r.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\tab-over-l.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\tab-over-r.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\tab-red-left.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\tab-red-mdl.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\tab-red-right.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\tab-white-left.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\tab-white-mdl.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\tab-white-right.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\throbber.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\Thumbs.db (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\vid-bg.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\images\youtube.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\js\jquery-1.3.2.min.js (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\js\jquery.autocomplete.min.js (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\skin\main.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\skin\css\dialog.css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\skin\images\bg.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\skin\images\btn-search.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\skin\images\btn-wide-close-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\skin\images\btn-wide-close.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\skin\images\default.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\skin\images\Thumbs.db (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\skin\images\transparent.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\skin\images\win-btm-left.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\skin\images\win-btm-mdl.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\skin\images\win-btm-right-resize.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\skin\images\win-btm-right.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\content\widgets\net.vmn.www.youtube\skin\scripts\defscript.js (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\data\dynamicelements\vmntoolbar.xsl (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\data\rss\rss.xml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\data\search\engines.xml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\data\search\search.xsl (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\data\weather\icons.xml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\634017460871087500_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\about.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\babylon_logo.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\bing_16x16.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\bing_searchicon_20x22_spaced_hover_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\bing_searchicon_20x22_spaced_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\blank_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\bluelite.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\bluesky.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\btn-search-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\btn-search.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\btn-settings.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\btn-widgets-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\btn-widgets.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\btn_settings.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\ca.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\checkmytext_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\checkmytext_png_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\dictionary.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\dictionary_png_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\divider.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\downloadcom.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\dtxlogo.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\email.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\email_on.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\eteacher_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\facebook.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\feed_icon2_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\feed_icon_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\france_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\games.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\gamesicon_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\games_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\graphred0.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\graphred0_5.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\graphred1.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\graphred1_5.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\graphred2.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\graphred2_5.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\graphred3.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\graphred3_5.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\graphred4.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\graphred4_5.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\graphred5.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\graphredna.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\grey.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\ico-shield.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\images.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\italy_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lichen.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\logo-about.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\logo-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\logo-separator.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\logo.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\mail.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\menuseparatorback.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\modify-save.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\modify.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\modifyhot.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\music.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\namespacetoolbar.css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\networkicons_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\btn-settings-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\dictionary_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\rss-found.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\shopping.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\vmn.css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\news.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\orange.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\pixsy.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\protect-id.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\relatedlinks.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\rss-collapse.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\rss-delete.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\rss-expand.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\rss-feed.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\rss-folder-remove.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\rss-folder-rename.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\rss-folder.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\rss-reload.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\rss-subscribe.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\rss.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\rssback.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\rsstopback.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\rss_feed_icon_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\search-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\search.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\settings.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\siteinfo.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\skin-bluelite.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\skin-bluesky.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\skin-grey.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\skin-lichen.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\skin-orange.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\skin-yellow.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\skin.xml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\spain_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\technorati.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\throbber.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\toolbarsplitter.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\translate.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\translate_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\translate_png_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\truste_about.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\tvicons_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\tvicon_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\tv_icon3_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\usa_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\vmn.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\web.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\whtsmke_logo_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\whtsmke_logo_png2_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\whtsmke_logo_png3_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\whtsmke_logo_png4_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\whtsmke_logo_png5_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\whtsmke_logo_png_png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\wikipedia.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\yahoosearch.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\yellow.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\youtube.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\zoom.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\dtxwizard\skin\icon_library\Basics\folder.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\add.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\aol.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\arrow-dn.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\arrow-right-disabled.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\arrow-right.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\arrow-up.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btn-divider.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btn-end.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btn-mdl.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btn-mdl_ff.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btn-start.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btnover-divider.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btnover-end.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btnover-mdl.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btnover-mdl_ff.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\blank.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\btn-widgets-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\btn-widgets.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\btnback-down-vista.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\btnback-vista.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\btnleft-down-vista.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\btnleft-vista.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\btnright-down-vista.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\btnright-vista.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\btn_slider.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\button-splitter-down-vista.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\button-splitter-vista.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\checkmark.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\chevron.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\collapse.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\comcast.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\dtx.css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\edit-back-hot.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\edit-back.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\expand.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\found.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\gmail.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\highlight.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\highlight_blue.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\highlight_cyan.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\highlight_lime.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\highlight_yellow.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\hotmail.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\ico-check.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\imap.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\lastsearch-thumb-back.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\loadingmid.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\lock.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\logo-separator.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\mailcom.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\menuitem-splitter.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\menuitemback-down-vista.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\menuitemback-vista.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\menuitemleft-down-vista.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\menuitemleft-vista.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\menuitemright-down-vista.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\menuitemright-vista.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\menu_bg-basic.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\menu_separator_bar.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\bg-btnover-start.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\highlight_magenta.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\menu_separator_white.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\modify.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\move.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\movetarget.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\pop.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\reload.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\remove.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\rename.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\resize-box.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\rss.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\rsschannelback.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\RSSLogo.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\rsstabdivider.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\scroll-left.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\scroll-right.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\search-go.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\search.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\text-ellipsis.xml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\throbber.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\toolbarsplitter.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\transparent_1px.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\yahoo.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\footer.htm (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\gamecategory.xsl (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\gameData.js (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\gameList.xsl (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\games.xsl (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\gametype.xsl (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\inithtml.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\popupgames.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\popuphtml.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\popuprss.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\popupwidgets.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\scroll.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\css\panels.css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\css\popupabout.css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\css\popupgames.css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\css\popupRSS.css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\css\popupwidgets.css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\main.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\css\dialog.css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\bg.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\btn-search.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\btn-wide-close-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\btn-wide-close.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\default.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\tab-off-l.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\tab-off-r.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\tab-on-l.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\tab-on-r.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\transparent.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\ttlbar-left.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\ttlbar-mdl.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\ttlbar-right.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\win-btm-left.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\win-btm-mdl.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\win-btm-right-resize.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\win-btm-right.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\win-left.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\images\win-right.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\default\scripts\defscript.js (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\gamethumb-on.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scroll-topwin.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\arrow-dn.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\arrow-sml-drop.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\arrow-sml.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\arrow-up.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\arrowr-bluew5.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\bg-aboutbox.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\bg-btnover.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\bg-pnl520x390.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-back.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-close-grey.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-close-greyover.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-drag.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-moredetails.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-next-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-next.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-previous-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-previous.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-search-pnlbtm-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\btn-search-pnlbtm.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\bullet-orange.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\gamethumb2-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\ico-calendar.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\ico-download.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\ico-joystick24.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\ico-news24.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\ico-play.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\ico-tags.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\icon-Add.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\icon-download.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\icon-info.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\icon-play.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\icon-shop.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\menul-bgon.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\menul-bgover.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\panel-botm-noscroll.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scroll-bg-206.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scroll-bg.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scrollb-disable.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scrollb-down.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scrollb-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scrollb.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scrollt-disable.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scrollt-down.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scrollt-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\scrollt.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\searchbox-pnlbtm.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\star_x_grey.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\star_x_orange.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\truste_about.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\view-detailed-on.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\view-detailed-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\view-thumb-on.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\view-thumb-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\widgets-square-16px.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\widgets-square-24px.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\panels\images\widgets.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\managerpanel.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\volumeslider.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\css\manager.css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\css\slider.css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-eq-off.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\bg-pnl.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\btn-close-grey.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\btn-close-greyover.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\collapsed_button.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\expanded_button.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\ico-playstation-down.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\ico-playstation-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\ico-playstation.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\ico-radio.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\music-note.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-btn-pause-on.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-btn-pause.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-btn-play-on.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-btn-play.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-eq-bg.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-eq-buffer.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-eq-busy.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-eq-on.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-eq-warning.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-options-design-on.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-options-design.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-options-on.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-options.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-volume-0.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-volume-1.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-volume-2.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-volume-3.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\radio-volume-mute.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\scrollbar-handle.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\scrollbar-track.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\slider.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\slideron.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\radio\images\track.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_07.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_02.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_03.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_04.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_06.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_08.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_09.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_10.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_11.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_12.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_13.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_14.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_15.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_16.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_18.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_19.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_20.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\border_21.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\btn-close-grey.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\btn-close-greyover.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\close-hot.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\close-normal.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\loadingmid.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\proxy.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\template.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\template.xml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\templateff.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\uwa\throbber.gif (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\icons\cond999.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\icons\icons.xml (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\icons\na-s.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\icons\na-t.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\icons\na.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\icons\weather.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\popupweather.css (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\popupweather.html (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\ico-hotandhumid-s.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\add.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\arrowr-bluew5.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\bg-pnl.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350blue-whitebg.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\bg-pnl520x350blue.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\box-check.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\box-uncheck.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\btn-close-grey.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\btn-close-greyover.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\btn-delete.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\btn-search-pnlbtm-over.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\btn-search-pnlbtm.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\btnarrow-next-off.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\btnarrow-next.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\btnarrow-previous-off.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\btnarrow-previous.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\ico-check.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\ico-hotandhumid.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\options-weather.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\over-blue.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\over-orange.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\powered-by-weatherbug.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\powered-by-weatherbug2.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\radio-checked.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\radio-unchecked.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\searchbox-pnlbtm.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\lib\weatherbutton\panels\images\weather-contour.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\options\options-main.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\options\options-search.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\options\options-weather.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\options\options-widgets.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\searchbar\searchbar-background-left.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\searchbar\searchbar-background-middle.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\chrome\skin\searchbar\searchbar-background-right.png (PUP.WhiteSmoke) -> No action taken. c:\program files\whitesmoketoolbar\components\windowmediator.js (PUP.WhiteSmoke) -> No action taken. c:\documents and settings\networkservice\application data\whitesmoketoolbar\dtx.ini (PUP.WhiteSmoke) -> No action taken. c:\documents and settings\networkservice\application data\whitesmoketoolbar\exeArgs.xml (PUP.WhiteSmoke) -> No action taken. c:\documents and settings\networkservice\application data\whitesmoketoolbar\guid.dat (PUP.WhiteSmoke) -> No action taken. c:\documents and settings\networkservice\application data\whitesmoketoolbar\setupCfg.xml (PUP.WhiteSmoke) -> No action taken. Since rebooting I haven't had any performance issues. I am still getting security alerts from Norton about blocking unused port traffic but so far that is all and boot times are pretty much back to normal.

Thanks again for such a quick response. About the TDSSKiller.log, yes I did select all of the objects found and removed them.

I ran Combofix and here is the log.

ComboFix 11-02-25.02 - J 02/26/2011 19:35:22.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1504 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Norton Security Suite *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *Enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2011-01-27 to 2011-02-27 )))))))))))))))))))))))))))))))
.

2011-02-26 22:45 . 2010-12-20 23:09 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-26 22:45 . 2011-02-26 22:45 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-02-26 22:45 . 2011-02-26 22:45 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-02-26 22:45 . 2010-12-20 23:08 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-02-26 22:20 . 2011-02-26 22:20 ——– d—–w- c:\windows\system32\XPSViewer
2011-02-26 22:20 . 2011-02-26 22:20 ——– d—–w- c:\program files\MSBuild
2011-02-26 22:20 . 2011-02-26 22:20 ——– d—–w- c:\program files\Reference Assemblies
2011-02-26 22:20 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2011-02-26 22:19 . 2008-07-06 12:06 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2011-02-26 22:19 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2011-02-26 22:19 . 2011-02-26 22:20 ——– d—–w- C:\1f014c3e2acf7f143f55397b16269931
2011-02-26 22:19 . 2008-07-06 12:06 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2011-02-26 22:19 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2011-02-26 22:19 . 2008-07-06 12:06 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2011-02-26 22:19 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2011-02-26 22:19 . 2008-07-06 10:50 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2011-02-26 22:19 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2011-02-26 22:17 . 2011-02-26 22:17 ——– d—–w- c:\program files\MSXML 6.0
2011-02-26 20:43 . 2006-08-21 12:26 16896 -c—-w- c:\windows\system32\dllcache\fltlib.dll
2011-02-26 20:43 . 2006-08-21 09:43 23040 -c—-w- c:\windows\system32\dllcache\fltmc.exe
2011-02-26 20:43 . 2006-08-21 09:43 128768 -c—-w- c:\windows\system32\dllcache\fltmgr.sys
2011-02-26 20:40 . 2011-02-26 20:40 ——– d—–w- c:\windows\ServicePackFiles
2011-02-26 20:32 . 2010-02-24 12:31 454016 -c—-w- c:\windows\system32\dllcache\mrxsmb.sys
2011-02-26 20:32 . 2010-06-14 14:30 743936 -c—-w- c:\windows\system32\dllcache\helpsvc.exe
2011-02-26 20:32 . 2009-10-15 17:21 82432 -c—-w- c:\windows\system32\dllcache\fontsub.dll
2011-02-26 20:31 . 2010-05-06 10:41 599040 -c—-w- c:\windows\system32\dllcache\msfeeds.dll
2011-02-26 20:31 . 2010-05-06 10:41 55296 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll
2011-02-26 20:31 . 2010-05-06 10:41 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2011-02-26 20:31 . 2010-05-06 10:41 743424 -c—-w- c:\windows\system32\dllcache\iedvtool.dll
2011-02-26 20:31 . 2010-05-06 10:41 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2011-02-26 20:31 . 2010-05-06 10:41 1985536 -c—-w- c:\windows\system32\dllcache\iertutil.dll
2011-02-26 20:31 . 2010-05-06 10:41 11076096 -c—-w- c:\windows\system32\dllcache\ieframe.dll
2011-02-26 20:31 . 2008-05-01 14:30 331776 -c—-w- c:\windows\system32\dllcache\msadce.dll
2011-02-26 20:24 . 2009-06-05 07:42 655872 -c—-w- c:\windows\system32\dllcache\mstscax.dll
2011-02-26 20:24 . 2008-10-15 16:57 332800 -c—-w- c:\windows\system32\dllcache\netapi32.dll
2011-02-26 20:24 . 2008-06-13 13:10 272128 -c—-w- c:\windows\system32\dllcache\bthport.sys
2011-02-26 20:24 . 2008-06-13 13:10 272128 ——w- c:\windows\system32\drivers\bthport.sys
2011-02-26 20:23 . 2008-08-14 09:51 138368 -c—-w- c:\windows\system32\dllcache\afd.sys
2011-02-26 20:23 . 2009-12-31 16:14 352640 -c—-w- c:\windows\system32\dllcache\srv.sys
2011-02-26 20:23 . 2009-11-21 16:36 470528 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2011-02-26 20:22 . 2009-06-21 22:04 153088 -c—-w- c:\windows\system32\dllcache\triedit.dll
2011-02-26 20:22 . 2009-10-23 14:27 3555328 -c—-w- c:\windows\system32\dllcache\moviemk.exe
2011-02-26 20:22 . 2008-05-08 12:28 202752 -c—-w- c:\windows\system32\dllcache\rmcast.sys
2011-02-26 20:19 . 2009-07-31 04:57 1172480 -c—-w- c:\windows\system32\dllcache\msxml3.dll
2011-02-26 20:18 . 2008-04-21 10:02 215552 -c—-w- c:\windows\system32\dllcache\wordpad.exe
2011-02-26 06:04 . 2011-02-26 06:04 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2011-02-26 05:44 . 2011-02-26 05:44 ——– d—–w- c:\program files\Trend Micro
2011-02-26 04:18 . 2011-02-26 04:18 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2011-02-26 04:17 . 2011-02-26 04:17 ——– d—–w- c:\program files\Drop Down Deals
2011-02-26 04:17 . 2011-02-26 04:17 ——– d—–w- c:\documents and settings\All Users\Application Data\Tarma Installer
2011-02-25 21:57 . 2005-09-09 18:51 176128 —-a-w- c:\windows\system32\nvunrm.exe
2011-02-25 21:57 . 2005-07-29 22:10 100480 —-a-w- c:\windows\system32\drivers\nvtcp.sys
2011-02-25 21:57 . 2005-09-09 18:51 176128 —-a-w- c:\windows\system32\nvusmb.exe
2011-02-25 21:53 . 2011-02-25 18:04 ——– d—–w- c:\windows\nview
2011-02-25 21:53 . 2006-07-06 15:39 208896 —-a-w- c:\windows\system32\nvudisp.exe
2011-02-25 21:53 . 2006-07-06 15:39 208896 —-a-w- c:\windows\system32\NVUNINST.EXE
2011-02-25 20:42 . 2011-02-25 20:42 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2011-02-25 19:58 . 2011-02-25 19:58 ——– d–h–w- c:\windows\system32\GroupPolicy
2011-02-25 19:47 . 2011-02-25 19:47 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2011-02-25 19:45 . 2008-04-17 21:12 107368 —-a-r- c:\windows\system32\GEARAspi.dll
2011-02-25 19:45 . 2009-05-18 22:17 26600 —-a-r- c:\windows\system32\drivers\GEARAspiWDM.sys
2011-02-25 19:45 . 2011-02-25 19:45 ——– dc—-w- c:\windows\system32\DRVSTORE
2011-02-25 19:45 . 2011-02-25 20:24 ——– d—–w- c:\program files\Common Files\Symantec Shared
2011-02-25 19:45 . 2011-02-25 19:45 ——– d—–w- c:\program files\Symantec
2011-02-25 19:45 . 2011-02-25 19:45 60808 —-a-w- c:\windows\system32\S32EVNT1.DLL
2011-02-25 19:45 . 2011-02-25 19:45 124976 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2011-02-25 19:44 . 2011-02-26 19:25 ——– d—–w- c:\windows\system32\drivers\N360
2011-02-25 19:44 . 2011-02-25 19:44 ——– d—–w- c:\program files\Norton Security Suite
2011-02-25 19:44 . 2011-02-25 19:44 ——– d—–w- c:\program files\Windows Sidebar
2011-02-25 19:44 . 2011-02-25 19:44 ——– d—–w- c:\program files\NortonInstaller
2011-02-25 19:42 . 2011-02-25 19:44 ——– d—–w- c:\documents and settings\All Users\Application Data\Norton
2011-02-25 19:35 . 2011-02-25 19:36 ——– dc-h–w- c:\windows\ie8
2011-02-25 18:24 . 2011-02-26 23:18 ——– d—–w- c:\windows\system32\Lang
2011-02-25 18:19 . 2011-02-25 18:19 ——– d—–w- c:\program files\BillP Studios
2011-02-25 18:19 . 2011-02-25 18:19 ——– d—–w- c:\documents and settings\All Users\Application Data\InstallMate
2011-02-25 18:18 . 2011-02-02 22:11 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-02-25 18:08 . 2011-02-25 18:08 ——– d—–w- c:\documents and settings\All Users\Application Data\nView_Profiles
2011-02-25 18:00 . 2011-02-25 18:00 ——– d—–w- C:\NVIDIA
2011-02-25 14:34 . 2007-01-19 19:43 1519616 —-a-w- c:\windows\system32\nwiz.exe
2011-02-25 14:33 . 2007-01-19 19:43 69632 —-a-w- c:\windows\system32\nvcpl.cpl
2011-02-25 14:33 . 2011-01-08 03:27 1958400 —-a-w- c:\windows\system32\nvapi.dll
2011-02-25 14:33 . 2007-01-19 19:43 442368 —-a-w- c:\windows\system32\nvappbar.exe
2011-02-25 14:33 . 2007-01-19 19:43 35840 —-a-w- c:\windows\system32\nvcodins.dll
2011-02-25 14:33 . 2007-01-19 19:43 35840 —-a-w- c:\windows\system32\nvcod.dll
2011-02-25 14:33 . 2011-01-08 03:27 9888672 -c–a-w- c:\windows\system32\dllcache\nv4_mini.sys
2011-02-25 14:33 . 2011-01-08 03:27 9888672 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2011-02-25 14:33 . 2011-01-08 03:27 6397824 —-a-w- c:\windows\system32\nv4_disp.dll
2011-02-25 14:33 . 2007-01-19 19:43 4493568 -c–a-w- c:\windows\system32\dllcache\nv4_disp.dll
2011-02-25 14:33 . 2007-01-19 19:43 425984 —-a-w- c:\windows\system32\keystone.exe
2011-02-25 06:10 . 2011-02-25 19:40 ——– d—–w- c:\documents and settings\J
2011-02-25 06:10 . 2011-02-25 04:24 ——– d—–w- c:\windows\system32\config\systemprofile\WINDOWS
2011-02-25 04:57 . 2004-09-04 00:07 20480 —-a-w- c:\windows\system32\Marker32.exe
2011-02-25 04:57 . 2005-03-04 11:36 49265 —-a-w- c:\windows\system32\jpicpl32.cpl
2011-02-25 04:57 . 2011-02-25 04:57 ——– d—–w- c:\program files\Java
2011-02-25 04:57 . 2011-02-25 04:57 ——– d—–w- c:\program files\Common Files\Java
2011-02-25 04:57 . 2011-02-25 04:57 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150020}
2011-02-25 04:57 . 2006-02-01 11:54 94208 —-a-w- c:\windows\system32\bae.dll
2011-02-25 04:56 . 2005-10-11 20:48 13352 —-a-w- c:\windows\BigFixClientOverride.dll
2011-02-25 04:56 . 2011-02-25 18:06 ——– d—–w- c:\program files\BigFix
2011-02-25 04:56 . 2011-02-25 04:56 ——– d—–w- c:\program files\Digital Media Reader
2011-02-25 04:55 . 2011-02-25 04:55 ——– d—–w- c:\windows\Downloaded Installations
2011-02-25 04:54 . 2007-04-09 18:23 28552 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2011-02-25 04:54 . 2007-04-09 18:23 28040 —-a-w- c:\windows\system32\mdimon.dll
2011-02-25 04:54 . 2011-02-25 04:54 ——– d—–w- c:\program files\Microsoft ActiveSync
2011-02-25 04:54 . 2011-02-25 04:54 ——– d—–w- c:\windows\SHELLNEW
2011-02-25 04:54 . 2011-02-25 04:54 ——– d—–w- c:\program files\Microsoft.NET
2011-02-25 04:53 . 2011-02-25 04:53 ——– d—–r- C:\MSOCache
2011-02-25 04:52 . 2011-02-25 17:58 ——– d–h–w- c:\program files\InstallShield Installation Information
2011-02-25 04:52 . 2011-02-25 04:53 ——– d—–w- c:\program files\CyberLink
2011-02-25 04:52 . 2011-02-25 21:53 ——– d—–w- c:\program files\Common Files\InstallShield
2011-02-25 04:51 . 2011-02-25 04:24 ——– d—–w- c:\documents and settings\Default User\WINDOWS
2011-02-25 04:50 . 2001-08-18 06:36 5632 —-a-w- c:\windows\system32\ptpusb.dll
2011-02-25 04:50 . 2004-08-04 08:56 159232 —-a-w- c:\windows\system32\ptpusd.dll
2011-02-25 04:50 . 2004-08-04 06:58 15104 —-a-w- c:\windows\system32\drivers\usbscan.sys
2011-02-25 04:50 . 2004-08-04 07:01 25856 —-a-w- c:\windows\system32\drivers\usbprint.sys
2011-02-25 04:50 . 2011-02-25 04:50 ——– d—–w- c:\program files\CONEXANT
2011-02-25 04:50 . 2004-08-04 07:08 17024 —-a-w- c:\windows\system32\drivers\usbohci.sys
2011-02-25 04:29 . 2011-02-25 04:29 ——– d—–w- c:\windows\creator
2011-02-25 04:28 . 2011-02-25 04:28 ——– d—–w- c:\windows\SMINST
2011-02-25 04:28 . 2006-07-18 22:16 990592 —-a-w- c:\windows\system32\drivers\HSF_DPV.sys
2011-02-25 04:28 . 2006-07-18 22:15 256128 —-a-w- c:\windows\system32\drivers\HSFHWBS2.sys
2011-02-25 04:28 . 2006-07-18 22:15 728192 —-a-w- c:\windows\system32\drivers\HSF_CNXT.sys
2011-02-25 04:28 . 2006-06-27 22:28 122880 —-a-w- c:\windows\system32\Uci32107.dll
2011-02-25 04:28 . 2006-06-19 21:26 12672 —-a-w- c:\windows\system32\drivers\mdmxsdk.sys
2011-02-25 04:28 . 2006-06-19 21:26 94208 —-a-w- c:\windows\system32\mdmxsdk.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-08 00:56 . 2011-01-08 00:56 81920 —-a-w- c:\windows\system32\nvwddi.dll
2011-01-08 00:56 . 2011-01-08 00:56 580200 —-a-w- c:\windows\system32\easyUpdatusAPIU.dll
2011-01-08 00:56 . 2011-01-08 00:56 277608 —-a-w- c:\windows\system32\nvmccs.dll
2011-01-08 00:56 . 2011-01-08 00:56 156776 —-a-w- c:\windows\system32\nvsvc32.exe
2011-01-08 00:56 . 2011-01-08 00:56 13880424 —-a-w- c:\windows\system32\nvcpl.dll
2011-01-08 00:56 . 2011-01-08 00:56 111208 —-a-w- c:\windows\system32\nvmctray.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="NA" [X]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
"readericon"="c:\program files\Digital Media Reader\readericon45G.exe" [2005-12-10 139264]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 61952]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2011-01-08 111208]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-01-08 13880424]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-11-04 1753192]
"RTHDCPL"="RTHDCPL.EXE" [2005-09-14 14820864]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2010-11-17 329096]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0402000.00C\symds.sys [2/26/2011 1:37 PM 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0402000.00C\symefa.sys [2/26/2011 1:37 PM 173104]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20110114.001\BHDrvx86.sys [1/14/2011 3:02 AM 691248]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0402000.00C\cchpx86.sys [2/26/2011 1:37 PM 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0402000.00C\ironx86.sys [2/26/2011 1:37 PM 116784]
R2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\4.2.0.12\ccsvchst.exe [2/26/2011 1:37 PM 126392]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/26/2011 1:37 PM 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20110225.001\IDSXpx86.sys [2/25/2011 11:56 PM 341944]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.ask.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-26 19:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton Security Suite\Engine\4.2.0.12\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\4.2.0.12\diMaster.dll\" /prefetch:1"
.
Completion time: 2011-02-26 19:41:53
ComboFix-quarantined-files.txt 2011-02-27 00:41

Pre-Run: 140,958,404,608 bytes free
Post-Run: 140,961,452,032 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

- - End Of File - - 7CD180D3D087427476C094BAE0493B33


PC seems to be running faster than before I ran Combofix. Things seem to be returning to normal, though I am still getting popups from Norton about the same things. Thanks again for all your help.