What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

What a mess

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello WTT,I'm sadly yet back again. :o But as the title states,with a bigger problem than before.

Step 1. Please tell us what issues you're having with your computer.
This is the family computer. I don't use this computer,but my mother/family has been telling me that it's been acting strange.

* System Tool.
-One of the biggest problems so far. I'm pretty sure it's a fake anti-virus program that has taken over the computer. It's changed the desktop background to a image with a warning on it. It stops .exe and other files from running(claims they're "infected"),and it keeps demanding that we pay for a "full version" before it removes any infections or allows us to change any of it's options.
I cannot remove the program,as it doesn't show up in the Control Panel program list.
I now have to boot the computer into safe mode with networking,as I cannot do anything in Normal Boot with it running.

*Viruses
-Second problem. I have no idea what goes on with this computer. But my family thinks there might be multiple viruses and other horrible things on the computer.
They don't give me any good descriptions on how the computer behaves though. So far it seems to be very laggy and hangs-up often.

What have you tried to fix it?
Tried to system restore and put a real anti-virus/firewall program onto the computer. I was successful,but days later my mother comes back telling me what I posted above.

Here are the OTL/Extra scan files. Hopefully this isn't too much of a mess to deal with.
OTL logfile created on: 3/15/2011 11:27:29 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

446.00 Mb Total Physical Memory | 285.00 Mb Available Physical Memory | 64.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 94.00% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 86.32 Gb Total Space | 2.06 Gb Free Space | 2.39% Space Free | Partition Type: NTFS
Drive D: | 6.81 Gb Total Space | 0.35 Gb Free Space | 5.19% Space Free | Partition Type: FAT32
Drive E: | 650.22 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: YOUR-D0F670B45A | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (AppMgmt) – File not found
SRV - (Symantec Core LC) – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (Symantec Corporation)
SRV - (comHost) – c:\Program Files\Norton Internet Security\comHost.exe (Symantec Corporation)
SRV - (ccISPwdSvc) – c:\Program Files\Norton Internet Security\ccPwdSvc.exe (Symantec Corporation)
SRV - (navapsvc) – c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe (Symantec Corporation)
SRV - (NSCService) – c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE (Symantec Corporation)
SRV - (SNDSrvc) – c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (Symantec Corporation)
SRV - (ccSetMgr) – c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
SRV - (ccProxy) – c:\Program Files\Common Files\Symantec Shared\ccProxy.exe (Symantec Corporation)
SRV - (ccEvtMgr) – c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
SRV - (SPBBCSvc) – c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (Symantec Corporation)
SRV - (SAVScan) – c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe (Symantec Corporation)


========== Driver Services (SafeList) ==========

DRV - (symlcbrd) – C:\WINDOWS\system32\drivers\symlcbrd.sys (Symantec Corporation)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (RTL8023xp) – C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )
DRV - (SymEvent) – C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Corporation)
DRV - (SPBBCDrv) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (SYMIDSCO) – C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20050901.036\SymIDSCo.sys (Symantec Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (SAVRTPEL) – c:\Program Files\Norton Internet Security\Norton AntiVirus\Savrtpel.sys (Symantec Corporation)
DRV - (SAVRT) – c:\Program Files\Norton Internet Security\Norton AntiVirus\savrt.sys (Symantec Corporation)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ftsata2) – C:\WINDOWS\system32\DRIVERS\ftsata2.sys (Promise Technology, Inc.)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (bb-run) – C:\WINDOWS\system32\DRIVERS\bb-run.sys (Promise Technology, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/15 11:14:35 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/09 17:48:32 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.0.3.4\Extensions\\Components: C:\Program Files\Netscape\Netscape Browser\Components [2006/02/18 17:31:48 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.0.3.4\Extensions\\Plugins: C:\Program Files\Netscape\Netscape Browser\Plugins [2011/02/13 03:04:37 | 000,000,000 | —D | M]

[2011/03/12 21:59:13 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/07/27 16:13:46 | 000,027,136 | —- | M] (NHN USA Inc.) – C:\Program Files\Mozilla Firefox\plugins\npijjiautoinstallpluginff.dll
[2009/09/24 23:02:40 | 000,098,304 | —- | M] (OGPlanet Inc.) – C:\Program Files\Mozilla Firefox\plugins\npOGPPlugin.dll
[2009/11/01 17:56:01 | 000,238,776 | —- | M] (Pando Networks) – C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll
[2007/04/16 10:07:12 | 000,180,293 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll
[2010/08/12 01:21:14 | 000,002,486 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\iMeshWebSearch.xml

O1 HOSTS File: ([2004/08/04 04:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Hot MP3 Toolbar) - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\prxtbHot2.dll (Conduit Ltd.)
O2 - BHO: (CNavExtBho Class) - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (Symantec Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (hpWebHelper Class) - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll (TODO: )
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Hot MP3 Toolbar) - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\prxtbHot2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Norton AntiVirus) - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ccApp] c:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [HPBootOp] C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IS CfgWiz] c:\Program Files\Norton Internet Security\cfgwiz.exe (Symantec Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [PCDrProfiler] File not found
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [Reminder] C:\Windows\Creator\Remind_XP.exe (SoftThinks)
O4 - Startup: C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Startup\Pin.lnk = C:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe (Hewlett-Packard)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Google Search - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: &Translate English Word - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Backward Links - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Cached Snapshot of Page - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Similar Pages - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Translate Page into English - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found
O9 - Extra Button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O9 - Extra 'Tools' menuitem : Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1297021462671 (MUWebControl Class)
O16 - DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\welcome.htm
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\welcome.htm
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/12/04 23:50:26 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/27 15:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2004/04/30 07:01:14 | 000,000,053 | -HS- | M] () - D:\AUTORUN.FCB – [ FAT32 ]
O32 - AutoRun File - [2005/05/23 23:50:31 | 000,191,610 | R— | M] () - E:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax ()
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll ()
Drivers32: vidc.LEAD - LCODCCMP.DLL File not found

CREATERESTOREPOINT
Error starting restore point: The function was called in safe mode.
Error closing restore point: The sequence number is invalid.

========== Files/Folders - Created Within 30 Days ==========

[2011/03/15 11:25:51 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\OTL.exe
[2011/03/15 11:18:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Macromedia
[2011/03/15 11:17:58 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Adobe
[2011/03/15 11:14:25 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Mozilla
[2011/03/15 11:14:24 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Mozilla
[2011/03/15 11:12:40 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\IECompatCache
[2011/03/15 11:11:51 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\PrivacIE
[2011/03/15 11:11:23 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\IETldCache
[2011/03/15 11:09:31 | 000,000,000 | –SD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft
[2011/03/15 11:09:31 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data
[2011/03/15 11:09:31 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Favorites
[2011/03/15 11:09:31 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Cookies
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Symantec
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Real
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Intuit
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Identities
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\ApplicationHistory
[2011/03/15 11:09:30 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\SendTo
[2011/03/15 11:09:30 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Recent
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Startup
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\My Documents\My Videos
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\My Documents\My Music
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\My Documents
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Accessories
[2011/03/15 11:09:30 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Templates
[2011/03/15 11:09:30 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\PrintHood
[2011/03/15 11:09:30 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\NetHood
[2011/03/15 11:09:30 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\WINDOWS
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Wildtangent
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Online Services
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\My Documents\My Pictures
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Microsoft Help
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Microsoft
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Google
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150050}
[2011/03/13 19:52:06 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\jGlKhLf06320
[2011/03/06 19:01:25 | 000,000,000 | —D | C] – C:\WINDOWS\System32\LogFiles
[2011/03/06 18:20:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Norton Internet Security
[2011/03/06 18:18:11 | 000,000,000 | —D | C] – C:\Program Files\Norton Internet Security
[2011/03/06 17:48:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\mFdDdGe06300
[2011/03/03 13:43:44 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Security Client
[2011/03/03 13:42:01 | 000,534,160 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\SymNeti.dll
[2011/03/03 06:45:14 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\mPkIbOl06308
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/03/15 11:25:54 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\OTL.exe
[2011/03/15 11:17:03 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/03/15 11:15:53 | 000,000,894 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cbc9a247bcb328.job
[2011/03/15 11:15:49 | 000,000,438 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{B8FDD6AE-531A-4008-BF8B-21E9E86CCE76}.job
[2011/03/15 11:05:52 | 000,000,390 | -H– | M] () – C:\WINDOWS\tasks\MpIdleTask.job
[2011/03/15 11:05:15 | 000,003,649 | —- | M] () – C:\WINDOWS\viassary-hp.reg
[2011/03/15 11:05:00 | 000,000,444 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{8119F42E-2697-4617-9A1E-13D0D89280FB}.job
[2011/03/15 11:00:00 | 000,000,296 | —- | M] () – C:\WINDOWS\tasks\vttqmvoy.job
[2011/03/14 02:20:00 | 000,000,898 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA1cbc9a249271898.job
[2011/03/14 02:19:00 | 000,001,006 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4244926684-2125597925-878420289-1009UA.job
[2011/03/14 02:13:47 | 001,228,854 | —- | M] () – C:\fsqwr.bmp
[2011/03/14 01:33:00 | 000,001,006 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1247128046-2491470071-81438129-1009UA.job
[2011/03/13 19:59:02 | 000,000,249 | —- | M] () – C:\WINDOWS\System\hpsysdrv.dat
[2011/03/13 19:19:00 | 000,000,954 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4244926684-2125597925-878420289-1009Core.job
[2011/03/13 19:00:00 | 000,000,268 | —- | M] () – C:\WINDOWS\tasks\RMSchedule.job
[2011/03/13 17:15:03 | 000,000,488 | -H– | M] () – C:\WINDOWS\tasks\Norton Security Scan for Compaq_Owner.job
[2011/03/13 14:33:00 | 000,000,954 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1247128046-2491470071-81438129-1009Core.job
[2011/03/11 22:11:23 | 000,001,799 | —- | M] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/03/11 22:11:20 | 000,001,821 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2011/03/06 18:33:35 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/03/06 17:31:39 | 000,000,424 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/03/03 13:57:20 | 000,001,945 | —- | M] () – C:\WINDOWS\epplauncher.mif
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/03/15 11:12:35 | 000,000,438 | -H– | C] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{B8FDD6AE-531A-4008-BF8B-21E9E86CCE76}.job
[2011/03/15 11:10:11 | 000,001,799 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/03/15 11:10:11 | 000,000,779 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/03/15 11:10:11 | 000,000,671 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\HP Rhapsody.lnk
[2011/03/15 11:10:06 | 000,001,773 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Netscape Browser.lnk
[2011/03/15 11:10:06 | 000,000,923 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\RealPlayer.lnk
[2011/03/15 11:10:05 | 000,000,079 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/03/15 11:10:03 | 000,001,640 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\3 Month Trial AOL Music Now.lnk
[2011/03/15 11:09:31 | 000,001,599 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Remote Assistance.lnk
[2011/03/15 11:09:31 | 000,000,800 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Windows Media Player.lnk
[2011/03/15 11:09:31 | 000,000,767 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Internet Explorer.lnk
[2011/03/15 11:09:31 | 000,000,738 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Outlook Express.lnk
[2011/03/15 11:09:31 | 000,000,572 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Startup\Pin.lnk
[2011/03/15 11:09:31 | 000,000,231 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Multi-channel Sound Manager.lnk
[2011/03/06 17:26:26 | 000,000,390 | -H– | C] () – C:\WINDOWS\tasks\MpIdleTask.job
[2011/03/03 13:49:31 | 000,000,424 | -H– | C] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/03/03 13:12:02 | 000,001,945 | —- | C] () – C:\WINDOWS\epplauncher.mif
[2011/03/03 07:22:24 | 001,228,854 | —- | C] () – C:\fsqwr.bmp
[2011/02/10 21:17:24 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2011/01/15 08:07:05 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/12/16 19:13:12 | 000,102,236 | —- | C] () – C:\WINDOWS\hpoins05.dat
[2010/10/23 19:38:12 | 000,000,262 | —- | C] () – C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2010/05/27 17:50:08 | 000,112,924 | —- | C] () – C:\WINDOWS\hpoins07.dat.temp
[2010/05/27 17:50:07 | 000,017,505 | —- | C] () – C:\WINDOWS\hpomdl07.dat.temp
[2010/05/11 17:44:11 | 000,000,324 | —- | C] () – C:\WINDOWS\game.ini
[2010/04/16 16:07:33 | 000,015,850 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\1199162320
[2010/04/16 16:03:51 | 000,016,016 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\1909121372
[2010/04/16 08:35:27 | 000,016,004 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\6wSh45NI7b7
[2010/04/16 08:35:27 | 000,015,854 | -HS- | C] () – C:\Documents and Settings\NetworkService\Local Settings\Application Data\6wSh45NI7b7
[2010/02/13 21:44:18 | 000,000,120 | —- | C] () – C:\WINDOWS\Ywalanuvazij.dat
[2010/02/13 21:44:18 | 000,000,000 | —- | C] () – C:\WINDOWS\Tgucivufepovaxes.bin
[2010/02/13 00:05:25 | 000,000,074 | —- | C] () – C:\WINDOWS\EPSONC88.ini
[2008/11/17 17:54:00 | 000,002,516 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2008/11/17 17:54:00 | 000,000,168 | RHS- | C] () – C:\Documents and Settings\All Users\Application Data\4A5ACC17E9.sys
[2008/10/12 17:41:17 | 000,002,508 | —- | C] () – C:\Documents and Settings\NetworkService\Application Data\$_hpcst$.hpc
[2008/09/14 19:54:43 | 000,000,313 | —- | C] () – C:\WINDOWS\wldtlk5.ini
[2008/01/08 19:04:52 | 000,000,000 | —- | C] () – C:\WINDOWS\hpqEmlSz.INI
[2008/01/08 18:58:50 | 000,000,221 | —- | C] () – C:\WINDOWS\NCLogConfig.ini
[2007/09/11 20:21:15 | 000,000,227 | —- | C] () – C:\WINDOWS\HP_CounterReport_Update_HPSU.ini
[2007/09/11 20:20:29 | 000,000,214 | —- | C] () – C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2007/09/11 19:35:45 | 000,000,221 | —- | C] () – C:\WINDOWS\HP_RedboxHprblog_HPSU.ini
[2007/09/06 19:49:14 | 000,000,798 | —- | C] () – C:\WINDOWS\unins002.dat
[2007/09/06 19:48:56 | 000,000,798 | —- | C] () – C:\WINDOWS\unins001.dat
[2007/08/17 20:27:49 | 000,000,453 | —- | C] () – C:\WINDOWS\LEXSTAT.INI
[2007/06/01 20:12:09 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2007/06/01 18:30:00 | 000,000,000 | —- | C] () – C:\WINDOWS\lgfwup.ini
[2007/06/01 18:21:27 | 000,040,960 | —- | C] () – C:\Program Files\Uninstall_CDS.exe
[2007/05/29 14:16:04 | 000,000,000 | —- | C] () – C:\WINDOWS\ka.ini
[2007/02/18 23:44:23 | 000,000,025 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2007/02/18 12:16:45 | 000,001,759 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/02/02 16:28:41 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2006/02/18 18:19:27 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/02/18 17:56:23 | 000,028,848 | —- | C] () – C:\WINDOWS\System32\drivers\USBkey.sys
[2006/02/18 17:51:59 | 000,118,842 | R— | C] () – C:\WINDOWS\HPCPCUninstaller-6.3.2.116-5577497.exe
[2006/02/18 17:50:50 | 000,667,896 | —- | C] () – C:\WINDOWS\unins000.exe
[2006/02/18 17:50:50 | 000,001,227 | —- | C] () – C:\WINDOWS\unins000.dat
[2006/02/18 17:50:42 | 000,012,993 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2006/02/18 17:50:36 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2006/02/18 17:48:38 | 000,000,054 | —- | C] () – C:\WINDOWS\Quicken.ini
[2006/02/18 17:46:57 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/02/18 17:33:45 | 000,000,056 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/02/18 17:31:57 | 000,045,929 | —- | C] () – C:\WINDOWS\NSSetDefaultBrowser.EXE
[2006/02/18 17:31:57 | 000,000,698 | —- | C] () – C:\WINDOWS\NSSetDefaultBrowser.ini
[2006/02/18 17:27:02 | 000,087,275 | —- | C] () – C:\WINDOWS\hpqins69.dat
[2006/02/18 17:25:41 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2006/02/18 17:22:07 | 000,104,361 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2006/02/18 17:07:17 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2006/02/18 17:03:55 | 000,323,584 | —- | C] () – C:\WINDOWS\System32\pythoncom22.dll
[2006/02/18 17:03:55 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\pywintypes22.dll
[2006/02/18 17:03:27 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2006/01/09 16:28:18 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/12/05 00:05:38 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2005/12/04 23:55:08 | 000,382,022 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2005/12/04 23:55:08 | 000,053,640 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2005/12/04 23:53:22 | 000,191,384 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2005/12/04 23:50:02 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2005/12/04 23:48:22 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/04 04:00:00 | 000,755,200 | —- | C] () – C:\WINDOWS\System32\ir50_32.dll
[2004/08/04 04:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 04:00:00 | 000,338,432 | —- | C] () – C:\WINDOWS\System32\ir41_qcx.dll
[2004/08/04 04:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 04:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 04:00:00 | 000,200,192 | —- | C] () – C:\WINDOWS\System32\ir50_qc.dll
[2004/08/04 04:00:00 | 000,183,808 | —- | C] () – C:\WINDOWS\System32\ir50_qcx.dll
[2004/08/04 04:00:00 | 000,120,320 | —- | C] () – C:\WINDOWS\System32\ir41_qc.dll
[2004/08/04 04:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 04:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 04:00:00 | 000,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys
[2004/08/04 04:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 04:00:00 | 000,001,788 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2004/08/04 04:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/06/15 14:38:00 | 000,000,592 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2003/01/07 23:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/04/24 11:17:18 | 000,000,132 | —- | C] () – C:\WINDOWS\http–www.picturebuzz.com-.url
[2001/08/23 15:12:28 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2001/08/23 15:11:02 | 000,004,490 | —- | C] () – C:\WINDOWS\System32\oembios.dat

========== LOP Check ==========

[2010/11/29 19:09:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\38177
[2009/03/17 18:03:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\acccore
[2009/12/03 18:28:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM
[2009/03/17 18:03:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM Toolbar
[2010/03/20 20:39:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/04/16 18:58:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avG
[2010/05/06 18:24:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2010/11/21 23:00:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EasyMP3Downloader
[2007/05/23 07:11:57 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GameHouse
[2010/10/26 14:51:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iMesh
[2010/01/29 15:36:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iolo
[2011/03/13 19:52:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\jGlKhLf06320
[2011/03/06 18:15:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\mFdDdGe06300
[2011/03/06 18:27:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\mPkIbOl06308
[2010/08/23 18:18:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2009/11/01 20:43:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nexon
[2009/11/01 19:21:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NexonUS
[2010/04/25 18:08:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCSettings
[2007/09/17 07:23:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PlayFirst
[2011/02/03 19:02:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PMB Files
[2010/01/27 08:23:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SITEguard
[2010/01/29 16:17:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2010/10/26 14:45:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/08/27 20:40:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2007/09/06 19:56:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WhiteCap (Holiday Edition)
[2007/03/30 21:28:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2009/03/17 08:44:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2010/10/26 14:53:03 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{0A63553F-CD47-45A0-BC8E-48CB7D13EB53}
[2010/11/27 15:40:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/03/26 14:38:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/05/16 17:09:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2011/03/06 17:31:39 | 000,000,424 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2011/03/15 11:05:52 | 000,000,390 | -H– | M] () – C:\WINDOWS\Tasks\MpIdleTask.job
[2011/03/13 19:00:00 | 000,000,268 | —- | M] () – C:\WINDOWS\Tasks\RMSchedule.job
[2011/03/15 11:05:00 | 000,000,444 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{8119F42E-2697-4617-9A1E-13D0D89280FB}.job
[2011/03/15 11:15:49 | 000,000,438 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{B8FDD6AE-531A-4008-BF8B-21E9E86CCE76}.job
[2011/03/15 11:00:00 | 000,000,296 | —- | M] () – C:\WINDOWS\Tasks\vttqmvoy.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2005/12/04 23:50:26 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010/12/26 20:08:11 | 000,000,211 | RHS- | M] () – C:\BOOT.BAK
[2010/12/27 10:28:37 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2007/03/31 14:41:40 | 000,037,552 | —- | M] () – C:\CHOPS___.TTF
[2004/08/03 21:00:00 | 000,260,272 | RHS- | M] () – C:\cmldr
[2005/12/04 23:50:26 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2009/03/13 06:43:29 | 000,012,949 | —- | M] () – C:\COOL.docx
[2011/03/14 02:13:47 | 001,228,854 | —- | M] () – C:\fsqwr.bmp
[2011/03/13 19:58:09 | 006,224,207 | —- | M] () – C:\hpWebHelper.log
[2005/12/04 23:50:26 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/04/11 19:24:42 | 000,001,811 | -H– | M] () – C:\IPH.PH
[2007/09/10 20:39:59 | 000,000,459 | —- | M] () – C:\lxbs.log
[2005/12/04 23:50:26 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2007/07/17 16:47:58 | 000,000,000 | —- | M] () – C:\network.log
[2004/08/03 21:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2004/08/03 21:00:00 | 000,250,032 | RHS- | M] () – C:\ntldr
[2011/03/15 11:16:51 | 704,643,072 | -HS- | M] () – C:\pagefile.sys
[2011/03/14 02:25:49 | 000,011,786 | —- | M] () – C:\report.txt
[2010/01/26 19:23:13 | 000,000,001 | —- | M] () – C:\s
[2009/03/20 23:57:40 | 000,000,268 | -H– | M] () – C:\sqmdata00.sqm
[2009/03/22 15:14:24 | 000,000,268 | -H– | M] () – C:\sqmdata01.sqm
[2009/03/24 20:44:12 | 000,000,268 | -H– | M] () – C:\sqmdata02.sqm
[2009/03/24 21:12:59 | 000,000,268 | -H– | M] () – C:\sqmdata03.sqm
[2009/03/26 20:15:28 | 000,000,268 | -H– | M] () – C:\sqmdata04.sqm
[2009/03/30 21:12:53 | 000,000,268 | -H– | M] () – C:\sqmdata05.sqm
[2009/04/02 19:49:12 | 000,000,268 | -H– | M] () – C:\sqmdata06.sqm
[2009/04/03 16:30:01 | 000,000,268 | -H– | M] () – C:\sqmdata07.sqm
[2009/04/06 20:56:13 | 000,000,268 | -H– | M] () – C:\sqmdata08.sqm
[2009/04/09 15:37:45 | 000,000,268 | -H– | M] () – C:\sqmdata09.sqm
[2009/04/12 17:01:10 | 000,000,268 | -H– | M] () – C:\sqmdata10.sqm
[2009/04/15 14:55:03 | 000,000,268 | -H– | M] () – C:\sqmdata11.sqm
[2009/05/07 21:14:32 | 000,000,268 | -H– | M] () – C:\sqmdata12.sqm
[2009/05/08 18:57:14 | 000,000,268 | -H– | M] () – C:\sqmdata13.sqm
[2009/05/10 22:48:13 | 000,000,268 | -H– | M] () – C:\sqmdata14.sqm
[2009/05/12 22:14:36 | 000,000,268 | -H– | M] () – C:\sqmdata15.sqm
[2009/03/08 17:32:37 | 000,000,268 | -H– | M] () – C:\sqmdata16.sqm
[2009/03/13 15:10:21 | 000,000,268 | -H– | M] () – C:\sqmdata17.sqm
[2009/03/16 00:39:35 | 000,000,268 | -H– | M] () – C:\sqmdata18.sqm
[2009/03/18 21:01:22 | 000,000,268 | -H– | M] () – C:\sqmdata19.sqm
[2009/03/20 23:57:39 | 000,000,244 | -H– | M] () – C:\sqmnoopt00.sqm
[2009/03/22 15:14:24 | 000,000,244 | -H– | M] () – C:\sqmnoopt01.sqm
[2009/03/24 20:44:12 | 000,000,244 | -H– | M] () – C:\sqmnoopt02.sqm
[2009/03/24 21:12:58 | 000,000,244 | -H– | M] () – C:\sqmnoopt03.sqm
[2009/03/26 20:15:28 | 000,000,244 | -H– | M] () – C:\sqmnoopt04.sqm
[2009/03/30 21:12:53 | 000,000,244 | -H– | M] () – C:\sqmnoopt05.sqm
[2009/04/02 19:49:12 | 000,000,244 | -H– | M] () – C:\sqmnoopt06.sqm
[2009/04/03 16:30:00 | 000,000,244 | -H– | M] () – C:\sqmnoopt07.sqm
[2009/04/06 20:56:13 | 000,000,244 | -H– | M] () – C:\sqmnoopt08.sqm
[2009/04/09 15:37:45 | 000,000,244 | -H– | M] () – C:\sqmnoopt09.sqm
[2009/04/12 17:01:09 | 000,000,244 | -H– | M] () – C:\sqmnoopt10.sqm
[2009/04/15 14:55:02 | 000,000,244 | -H– | M] () – C:\sqmnoopt11.sqm
[2009/05/07 21:14:32 | 000,000,244 | -H– | M] () – C:\sqmnoopt12.sqm
[2009/05/08 18:57:14 | 000,000,244 | -H– | M] () – C:\sqmnoopt13.sqm
[2009/05/10 22:48:13 | 000,000,244 | -H– | M] () – C:\sqmnoopt14.sqm
[2009/05/12 22:14:35 | 000,000,244 | -H– | M] () – C:\sqmnoopt15.sqm
[2009/03/08 17:32:37 | 000,000,244 | -H– | M] () – C:\sqmnoopt16.sqm
[2009/03/13 15:10:21 | 000,000,244 | -H– | M] () – C:\sqmnoopt17.sqm
[2009/03/16 00:39:34 | 000,000,244 | -H– | M] () – C:\sqmnoopt18.sqm
[2009/03/18 21:01:22 | 000,000,244 | -H– | M] () – C:\sqmnoopt19.sqm

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >
[2005/09/24 08:49:16 | 000,012,288 | —- | M] (Hewlett-Packard Development Company, L.P.) – C:\WINDOWS\Fonts\RandFont.dll

< %systemroot%\Fonts\*.ini >
[2005/12/04 23:49:52 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2007/04/09 13:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/09/07 08:12:17 | 000,038,848 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2004/12/14 15:36:32 | 001,904,640 | —- | M] () – C:\WINDOWS\Santa.scr
[2010/04/17 00:04:40 | 000,306,032 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WLXPGSS.SCR
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2004/10/01 15:00:16 | 000,040,960 | —- | M] () – C:\Program Files\Uninstall_CDS.exe

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2005/12/04 15:42:42 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2005/12/04 15:42:42 | 000,634,880 | —- | M] () – C:\WINDOWS\system32\config\software.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2005/12/04 23:50:32 | 000,000,294 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2005/12/04 23:54:04 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2005/12/04 23:54:04 | 000,000,079 | —- | M] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/03/15 11:25:54 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-03-09 04:41:10

========== Alternate Data Streams ==========

@Alternate Data Stream - 162 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F3F95A98
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8B90426A
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B9252F22
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:053BAE56
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:399509A6
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >

OTL Extras logfile created on: 3/15/2011 11:27:29 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

446.00 Mb Total Physical Memory | 285.00 Mb Available Physical Memory | 64.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 94.00% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 86.32 Gb Total Space | 2.06 Gb Free Space | 2.39% Space Free | Partition Type: NTFS
Drive D: | 6.81 Gb Total Space | 0.35 Gb Free Space | 5.19% Space Free | Partition Type: FAT32
Drive E: | 650.22 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: YOUR-D0F670B45A | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = ChromeHTML] – C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
http [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"56462:TCP" = 56462:TCP:*:Enabled:Pando Media Booster
"56462:UDP" = 56462:UDP:*:Enabled:Pando Media Booster

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"56462:TCP" = 56462:TCP:*:Enabled:Pando Media Booster
"56462:UDP" = 56462:UDP:*:Enabled:Pando Media Booster

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe" = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe:*:Enabled:Compaq Connections – (Hewlett-Packard)
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster – ()

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe" = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe:*:Enabled:Compaq Connections – (Hewlett-Packard)
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink
"C:\Program Files\OGPlanet\LostSaga\autoupgrade.exe" = C:\Program Files\OGPlanet\LostSaga\autoupgrade.exe:*:Enabled:Lost Saga – (IO Entertainment Co., Ltd.)
"C:\Program Files\OGPlanet\LostSaga\lostsaga.exe" = C:\Program Files\OGPlanet\LostSaga\lostsaga.exe:*:Enabled:LostSaga(client) – (IO Entertainment Co., Ltd.)
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster – ()
"C:\SG Interactive\Project Blackout\PBlackout.exe" = C:\SG Interactive\Project Blackout\PBlackout.exe:*:Enabled:Project Blackout – (Zepetto)
"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{1248C09A-BD6B-47F5-BF3F-CD2B700D9FCB}" = ccCommon
"{12E2B9E9-05B1-407d-B0FD-B5F350535125}" = Norton Internet Security
"{1CB34CE9-0E6B-493F-BB66-3425E5DF76E5}" = CP_CalendarTemplates1
"{23012310-3E05-46A5-88A9-C6CBCABCAC79}" = Customer Experience Enhancement
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23B35809-5E4A-4F14-8332-1CDEDDFAC089}" = CP_Package_Variety2
"{24BEBF2E-73F3-4599-840B-EDC612CCDD0D}" = Destinations
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 23
"{2818095F-FB6C-42C8-827E-0A406CC9AFF5}" = Quicken 2006
"{2A548002-9042-4083-A270-B67473DE1073}" = SkinsHP1
"{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}" = SymNet
"{2EBF25F1-F8A2-40EA-92BE-931C142A44E2}" = CC_ccProxyExt
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{30738666-9805-4926-A78F-91DA33B6C437}" = ccPxyCore
"{3248F0A8-6813-11D6-A77B-00B0D0150050}" = J2SE Runtime Environment 5.0 Update 5
"{34F3FCF1-817B-4D61-B6AF-19D9486AFEA0}" = Unload
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36D620AD-EEBA-4973-BA86-0C9AE6396620}" = OptionalContentQFolder
"{3BA95526-6AE0-4B87-A62D-17187EF565FC}" = HP Boot Optimizer
"{3FE0CFAB-584A-4AA5-B8CD-C32284CFA308}" = RandMap
"{4041C245-7099-4C96-9738-5EBC23827B3C}" = BufferChm
"{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works
"{449F3A9E-9903-4a0d-A209-08030D45A935}" = Norton Internet Security
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP DVD Play 1.0
"{48185814-A224-447a-81DA-71BD20580E1B}" = Norton Internet Security
"{494D17B5-3369-4905-8C4B-80C972C5E0FF}" = CP_Panorama1Config
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4DA4012B-39AF-48c2-B23B-A4D570D233A6}" = cp_LightScribeConfig
"{522D1D79-9C0A-4361-91F8-2AFF8EC6C2E1}" = CP_Package_Variety1
"{53EE9E42-CECB-4C92-BF76-9CA65DAF8F1C}" = FullDPAppQFolder
"{54F0998F-73C8-4b51-8286-FE903C231BED}" = cp_PosterPrintConfig
"{5677563D-0CB1-485F-9E18-C5025306BB3F}" = Norton AntiSpam
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler
"{766633B3-1AFA-44B6-A3FC-1DE991CD9C52}" = CP_Package_Basic1
"{77772678-817F-4401-9301-ED1D01A8DA56}" = SPBBC
"{79F8E1D4-36C1-439C-95FA-F695050B5B07}" = Sonic_PrimoSDK
"{80AE27BA-B0ED-4288-A8B9-D8194BCF4115}" = cp_UpdateProjectsConfig
"{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Easy Internet Sign-up
"{82A5BF38-8461-4A5C-B2C9-24F5256D92A6}" = Norton Protection Center
"{869C3062-4745-4949-B6C9-98AF24D89030}" = PhotoGallery
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9D4ABB0C-F60B-44A6-956C-A4A63D5495C9}" = CueTour
"{A01FC76F-CC09-4658-9E37-5C2F635EE708}" = Microsoft Office 2003 Edition 60 Days Trial Welcome Tour
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A93C9E60-29B6-49da-BA21-F70AC6AADE20}" = Norton Internet Security
"{AADFE0B9-F905-4d5f-A144-0ADB2EFA747B}" = Norton Internet Security
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic RecordNow Audio
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0
"{B11E71BA-498C-42D4-9F1A-9D7A89D9DA61}" = CP_AtenaShokunin1Config
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic RecordNow Copy
"{B57F2FF0-5A25-4332-B503-4592B370C02F}" = CP_Package_Variety3
"{B7C61755-DB48-4003-948F-3D34DB8EAF69}" = MSRedist
"{BBD3BF67-5B89-4CBB-BA58-5818ED5F3290}" = cp_OnlineProjectsConfig
"{C6F5B6CF-609C-428E-876F-CA83176C021B}" = Norton AntiVirus 2006
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D0122362-6333-4DE4-93F6-A5A2F3CC101A}" = Compaq Organize
"{D7DBA21A-CDE5-42EC-BB1C-AE4B3E616B9A}_is1" = HP Support Overview
"{DAAD5187-62C5-4AD6-A526-803C18C4944D}" = HP Web Helper
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}" = Norton Internet Security
"{E5EE9939-259F-4DE2-8023-5C49E16A4F43}" = Norton Internet Security
"{E85FA9A1-C241-4698-893B-DD99509B8DB0}" = Norton WMI Update
"{ECFDD6BD-E0C0-41CC-A171-E6D6AF4C0E93}" = HP Software Update
"{F64306A5-4C32-41bb-B153-53986527FAB4}" = Norton WMI Update
"{FC8D25A7-FF1B-41BB-BB3B-9A06C0A60AE0}" = InstantShareDevices
"{FFB4DD53-28B7-4981-BFF0-9BD801F61095}" = Norton Internet Security
"045C89A0-CA37-443C-8826-F750227DE69C" = Shooting Stars Pool from Compaq (remove only)
"05E21449-3BA3-42BF-BBDA-95205F4EA40A" = Polar Bowler from Compaq (remove only)
"0BD36D37-C5D7-4B96-B64A-CB2C3A82EC4D" = Zuma Deluxe from Compaq (remove only)
"29FF6D07-4A15-41F1-9D5E-E0F3A58012C6" = Bounce Symphony from Compaq (remove only)
"3330A279-CC39-4A17-AE19-DA464B26AD9A" = Polar Golfer from Compaq (remove only)
"3B3B73D1-DC4A-4780-B0E4-E823D08B3397" = 5 Card Slingo from Compaq (remove only)
"422C7575-C10D-4795-87FA-9972765379E6" = Mah Jong Quest from Compaq (remove only)
"52AEBC18-F252-4B0C-B3E1-724537D9F873" = Ricochet Lost Worlds from Compaq (remove only)
"53474592-01BC-4338-8647-FE350957D912" = Barnyard Invasion from Compaq (remove only)
"5AF1DD17-7B06-45EF-8592-2E524E458BAB" = Insaniquarium Deluxe from Compaq (remove only)
"63E4EC24-7173-4E1F-9C77-B4403CBCF91F" = Lemonade Tycoon 2 from Compaq (remove only)
"66195170-D19D-46C5-8FB7-8A4630071ADC" = Tradewinds from Compaq (remove only)
"75528D5F-DD82-402E-BA7C-045B7DC6A712" = Blasterball 2 from Compaq (remove only)
"85CF9BF3-1057-468C-962D-31BAABC6AC72" = FATE from Compaq (remove only)
"8D11F98B-4931-44F6-8FC6-971CCBBBB131" = Snowboard SuperJam from Compaq (remove only)
"9448DE42-C017-4A3E-A0BB-C50BF673E9E0" = Chuzzle Deluxe from Compaq (remove only)
"997DD523-B925-4C73-970B-C201E8F781AD" = AstroPop Deluxe from Compaq (remove only)
"9D7E7CDA-051E-4B0D-8CEE-58F41F449CF9" = Blasterball 2 Remix from Compaq (remove only)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Agere Systems Soft Modem" = Agere Systems PCI Soft Modem
"ATI Display Driver" = ATI Display Driver
"BBCBAA5D-AC5A-4098-A53E-EC60A68F38F9" = Shrek 2 Ogre Bowler from Compaq (remove only)
"BBE9E0F3-11F7-4424-9905-8E0153E872C1" = Family Feud
"BFAF1EEC-E987-415B-BCB8-80CDB0BC6CDF" = Blackhawk Striker 2 from Compaq (remove only)
"C43D84CD-EBFC-48D3-A330-7868C8AD415A" = Crystal Maze from Compaq (remove only)
"C6D35CCA-3F9E-4B6E-A17F-409EE7379D6B" = Boggle Supreme from Compaq (remove only)
"conduitEngine" = Conduit Engine
"D84AC71A-75E8-4709-8BA5-4B46EAC00C5E" = Bejeweled 2 Deluxe from Compaq (remove only)
"DE87FA96-7840-420C-86F9-33F3B7B3CED1" = Super Granny from Compaq (remove only)
"E1A0F769-A43A-4DDB-9F73-12791E453557" = Puzzle Express from Compaq (remove only)
"E618FC78-EE4F-4243-8409-078EB5E0B1F6" = Bookworm Deluxe from Compaq (remove only)
"EasyMP3Downloader" = Easy MP3 Downloader
"F05A08BF-E600-4FBD-A53A-3D47296B1275" = Lexibox Deluxe from Compaq (remove only)
"F19E8CDF-5EFD-45E0-9FAF-66CBAE84B1D9" = Slingo Deluxe from Compaq (remove only)
"FA6A73EB-40AB-4B58-851D-3892B3C10EF6" = SCRABBLE from Compaq (remove only)
"Google Chrome" = Google Chrome
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"Hot_MP3 Toolbar" = Hot_MP3 Toolbar
"HP Game Console" = HP Game Console and games
"HP Imaging Device Functions" = HP Imaging Device Functions 6.0
"HP Officejet 5600 series_Driver" = HP Officejet 5600 series
"HP Photo & Imaging" = HP Photosmart Premier Software 6.0
"HP Rhapsody" = HP Rhapsody
"HPOOVClient-5577497 Uninstaller" = Compaq Connections (remove only)
"ie8" = Windows Internet Explorer 8
"Install WeatherBug" = Remove WeatherBug Installer
"InstallShield_{23012310-3E05-46A5-88A9-C6CBCABCAC79}" = Customer Experience Enhancement
"InstallShield_{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Easy Internet Sign-up
"LiveUpdate" = LiveUpdate 2.7 (Symantec Corporation)
"LostSagaUS" = Lost Saga
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Money2006b" = Microsoft Money 2006
"Mozilla Firefox (3.6.15)" = Mozilla Firefox (3.6.15)
"Netscape Browser" = Netscape Browser (remove only)
"OGPlanet Game Launcher US" = OGPlanet Game Launcher
"PC-Doctor 5 for Windows" = PC-Doctor 5 for Windows
"Project Blackout" = Project Blackout
"Python 2.2.3" = Python 2.2.3
"pywin32-py2.2" = Python 2.2 pywin32 extensions (build 203)
"RealPlayer 6.0" = RealPlayer
"RumbleFighter" = Rumble Fighter
"SymSetup.{A93C9E60-29B6-49da-BA21-F70AC6AADE20}" = Norton Internet Security 2006 (Symantec Corporation)
"WildTangent CDA" = WildTangent Web Driver
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"WinGimp-2.0_is1" = GIMP 2.6.11

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/6/2011 9:54:22 PM | Computer Name = YOUR-D0F670B45A | Source = Application Hang | ID = 1002
Description = Hanging application rundll32.exe, version 5.1.2600.2180, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 3/6/2011 9:54:22 PM | Computer Name = YOUR-D0F670B45A | Source = Application Hang | ID = 1002
Description = Hanging application rundll32.exe, version 5.1.2600.2180, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 3/6/2011 9:54:32 PM | Computer Name = YOUR-D0F670B45A | Source = Application Hang | ID = 1001
Description = Fault bucket 126648864.

Error - 3/6/2011 9:54:52 PM | Computer Name = YOUR-D0F670B45A | Source = Application Hang | ID = 1001
Description = Fault bucket 126648864.

Error - 3/10/2011 8:49:36 AM | Computer Name = YOUR-D0F670B45A | Source = MsiInstaller | ID = 10005
Description = Product: Norton AntiVirus 2006 – Norton AntiVirus 2006 does not support
the Repair feature, please uninstall and reinstall.

Error - 3/10/2011 8:50:26 AM | Computer Name = YOUR-D0F670B45A | Source = MsiInstaller | ID = 10005
Description = Product: Norton AntiVirus 2006 – Norton AntiVirus 2006 does not support
the Repair feature, please uninstall and reinstall.

Error - 3/10/2011 8:50:27 AM | Computer Name = YOUR-D0F670B45A | Source = MsiInstaller | ID = 10005
Description = Product: Norton AntiVirus 2006 – Norton AntiVirus 2006 does not support
the Repair feature, please uninstall and reinstall.

Error - 3/10/2011 6:16:12 PM | Computer Name = YOUR-D0F670B45A | Source = Application Error | ID = 1000
Description = Faulting application rumblefighter.exe, version 0.9.0.0, faulting
module , version 0.0.0.0, fault address 0x00000000.

Error - 3/11/2011 8:14:36 PM | Computer Name = YOUR-D0F670B45A | Source = Application Error | ID = 1000
Description = Faulting application rumblefighter.exe, version 0.9.0.0, faulting
module , version 0.0.0.0, fault address 0x00000000.

Error - 3/13/2011 10:39:08 PM | Computer Name = YOUR-D0F670B45A | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module unknown, version 0.0.0.0, fault address 0x61416ee0.

[ System Events ]
Error - 3/15/2011 2:10:34 PM | Computer Name = YOUR-D0F670B45A | Source = Service Control Manager | ID = 7001
Description = The IPSEC Services service depends on the IPSEC driver service which
failed to start because of the following error: %%31

Error - 3/15/2011 2:10:34 PM | Computer Name = YOUR-D0F670B45A | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AFD AmdK8 Fips IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip

Error - 3/15/2011 2:10:46 PM | Computer Name = YOUR-D0F670B45A | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 3/15/2011 2:11:08 PM | Computer Name = YOUR-D0F670B45A | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 3/15/2011 2:13:43 PM | Computer Name = YOUR-D0F670B45A | Source = SideBySide | ID = 16842784
Description = Dependent Assembly Microsoft.VC90.CRT could not be found and Last
Error was The referenced assembly is not installed on your system.

Error - 3/15/2011 2:13:43 PM | Computer Name = YOUR-D0F670B45A | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error
message: The referenced assembly is not installed on your system. .

Error - 3/15/2011 2:13:43 PM | Computer Name = YOUR-D0F670B45A | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\Alwil Software\Avast5\AvastUI.exe.
Reference
error message: The operation completed successfully. .

Error - 3/15/2011 2:14:37 PM | Computer Name = YOUR-D0F670B45A | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 3/15/2011 2:17:35 PM | Computer Name = YOUR-D0F670B45A | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 3/15/2011 2:18:39 PM | Computer Name = YOUR-D0F670B45A | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AmdK8 Fips


< End of report >
Post #2
Hi lets see if we can resolve this. When you re-run OTL please select all users this time

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL
    [2011/03/13 19:52:06 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\jGlKhLf06320
    [2011/03/06 17:48:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\mFdDdGe06300
    [2011/03/03 06:45:14 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\mPkIbOl06308
    [2011/03/15 11:00:00 | 000,000,296 | —- | M] () – C:\WINDOWS\tasks\vttqmvoy.job
    [2010/04/16 16:07:33 | 000,015,850 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\1199162320
    [2010/04/16 16:03:51 | 000,016,016 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\1909121372
    [2010/04/16 08:35:27 | 000,016,004 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\6wSh45NI7b7
    [2010/04/16 08:35:27 | 000,015,854 | -HS- | C] () – C:\Documents and Settings\NetworkService\Local Settings\Application Data\6wSh45NI7b7
    [2010/02/13 21:44:18 | 000,000,120 | —- | C] () – C:\WINDOWS\Ywalanuvazij.dat
    [2010/02/13 21:44:18 | 000,000,000 | —- | C] () – C:\WINDOWS\Tgucivufepovaxes.bin
    [2010/11/29 19:09:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\38177
    [2011/03/13 19:52:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\jGlKhLf06320
    [2011/03/06 18:15:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\mFdDdGe06300
    [2011/03/06 18:27:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\mPkIbOl06308

    :Files
    ipconfig /flushdns /c

    :Commands
    [purity]
    [resethosts]
    [emptytemp]
    [EMPTYFLASH]
    [CREATERESTOREPOINT]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

[external image: Posted Image]
Click the "Scan" button to start scan


[external image: Posted Image]
On completion of the scan click save log, save it to your desktop and post in your next reply
Post #3 last edited
Ran into a problem
I forgot to check "All users" on the fix scan,and the .txt file was saved onto the Admin Desktop in Normal Mode,so System Tool isn't letting me access it.
ALSO: There's a file named "MBR.dat" on my desktop,is that supposed to be there?

Here is the "all users" quick scan though,if it's still helpful.
OTL logfile created on: 3/15/2011 3:06:18 PM - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

446.00 Mb Total Physical Memory | 290.00 Mb Available Physical Memory | 65.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 94.00% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 86.32 Gb Total Space | 12.28 Gb Free Space | 14.23% Space Free | Partition Type: NTFS
Drive D: | 6.81 Gb Total Space | 0.35 Gb Free Space | 5.19% Space Free | Partition Type: FAT32
Drive E: | 650.22 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: YOUR-D0F670B45A | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (AppMgmt) – File not found
SRV - (Symantec Core LC) – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (Symantec Corporation)
SRV - (comHost) – c:\Program Files\Norton Internet Security\comHost.exe (Symantec Corporation)
SRV - (ccISPwdSvc) – c:\Program Files\Norton Internet Security\ccPwdSvc.exe (Symantec Corporation)
SRV - (navapsvc) – c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe (Symantec Corporation)
SRV - (NSCService) – c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE (Symantec Corporation)
SRV - (SNDSrvc) – c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (Symantec Corporation)
SRV - (ccSetMgr) – c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
SRV - (ccProxy) – c:\Program Files\Common Files\Symantec Shared\ccProxy.exe (Symantec Corporation)
SRV - (ccEvtMgr) – c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
SRV - (SPBBCSvc) – c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (Symantec Corporation)
SRV - (SAVScan) – c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe (Symantec Corporation)


========== Driver Services (SafeList) ==========

DRV - (symlcbrd) – C:\WINDOWS\system32\drivers\symlcbrd.sys (Symantec Corporation)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (RTL8023xp) – C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )
DRV - (SymEvent) – C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Corporation)
DRV - (SPBBCDrv) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (SYMIDSCO) – C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20050901.036\SymIDSCo.sys (Symantec Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (SAVRTPEL) – c:\Program Files\Norton Internet Security\Norton AntiVirus\Savrtpel.sys (Symantec Corporation)
DRV - (SAVRT) – c:\Program Files\Norton Internet Security\Norton AntiVirus\savrt.sys (Symantec Corporation)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ftsata2) – C:\WINDOWS\system32\DRIVERS\ftsata2.sys (Promise Technology, Inc.)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (bb-run) – C:\WINDOWS\system32\DRIVERS\bb-run.sys (Promise Technology, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/15 11:14:35 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/09 17:48:32 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.0.3.4\Extensions\\Components: C:\Program Files\Netscape\Netscape Browser\Components [2006/02/18 17:31:48 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.0.3.4\Extensions\\Plugins: C:\Program Files\Netscape\Netscape Browser\Plugins [2011/02/13 03:04:37 | 000,000,000 | —D | M]

[2011/03/12 21:59:13 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/07/27 16:13:46 | 000,027,136 | —- | M] (NHN USA Inc.) – C:\Program Files\Mozilla Firefox\plugins\npijjiautoinstallpluginff.dll
[2009/09/24 23:02:40 | 000,098,304 | —- | M] (OGPlanet Inc.) – C:\Program Files\Mozilla Firefox\plugins\npOGPPlugin.dll
[2009/11/01 17:56:01 | 000,238,776 | —- | M] (Pando Networks) – C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll
[2007/04/16 10:07:12 | 000,180,293 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll
[2010/08/12 01:21:14 | 000,002,486 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\iMeshWebSearch.xml

O1 HOSTS File: ([2011/03/15 14:39:27 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Hot MP3 Toolbar) - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\prxtbHot2.dll (Conduit Ltd.)
O2 - BHO: (CNavExtBho Class) - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (Symantec Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (hpWebHelper Class) - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll (TODO: )
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Hot MP3 Toolbar) - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\prxtbHot2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Norton AntiVirus) - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (Symantec Corporation)
O3 - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ccApp] c:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [HPBootOp] C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IS CfgWiz] c:\Program Files\Norton Internet Security\cfgwiz.exe (Symantec Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [PCDrProfiler] File not found
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [Reminder] C:\Windows\Creator\Remind_XP.exe (SoftThinks)
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Pin.lnk = C:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Startup\Pin.lnk = C:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe (Hewlett-Packard)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup\Compaq Organize.lnk = C:\Program Files\Hewlett-Packard\Compaq Organize\bin\displayAgent.exe (NeoPlanet)
O4 - Startup: C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup\Xfire.lnk = C:\Program Files\Xfire\xfire.exe (Xfire Inc.)
O4 - Startup: C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A\Start Menu\Programs\Startup\Compaq Organize.lnk = C:\Program Files\Hewlett-Packard\Compaq Organize\bin\displayAgent.exe (NeoPlanet)
O4 - Startup: C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.000\Start Menu\Programs\Startup\Compaq Organize.lnk = C:\Program Files\Hewlett-Packard\Compaq Organize\bin\displayAgent.exe (NeoPlanet)
O4 - Startup: C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Start Menu\Programs\Startup\Compaq Organize.lnk = C:\Program Files\Hewlett-Packard\Compaq Organize\bin\displayAgent.exe (NeoPlanet)
O4 - Startup: C:\Documents and Settings\Default User\Start Menu\Programs\Startup\Pin.lnk = C:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\Karrems games\Start Menu\Programs\Startup\LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (Lime Wire, LLC)
O4 - Startup: C:\Documents and Settings\Karrems games\Start Menu\Programs\Startup\Xfire.lnk = C:\Program Files\Xfire\xfire.exe (Xfire Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Google Search - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: &Translate English Word - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Backward Links - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Cached Snapshot of Page - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Similar Pages - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Translate Page into English - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found
O9 - Extra Button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O9 - Extra 'Tools' menuitem : Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1297021462671 (MUWebControl Class)
O16 - DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\welcome.htm
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\welcome.htm
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/12/04 23:50:26 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/27 15:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2004/04/30 07:01:14 | 000,000,053 | -HS- | M] () - D:\AUTORUN.FCB – [ FAT32 ]
O32 - AutoRun File - [2005/05/23 23:50:31 | 000,191,610 | R— | M] () - E:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/03/15 14:39:25 | 000,000,000 | —D | C] – C:\_OTL
[2011/03/15 11:25:51 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\OTL.exe
[2011/03/15 11:18:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Macromedia
[2011/03/15 11:17:58 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Adobe
[2011/03/15 11:14:25 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Mozilla
[2011/03/15 11:14:24 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Mozilla
[2011/03/15 11:12:40 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\IECompatCache
[2011/03/15 11:11:51 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\PrivacIE
[2011/03/15 11:11:23 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\IETldCache
[2011/03/15 11:09:31 | 000,000,000 | –SD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft
[2011/03/15 11:09:31 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data
[2011/03/15 11:09:31 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Favorites
[2011/03/15 11:09:31 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Cookies
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Symantec
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Real
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Intuit
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Identities
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\ApplicationHistory
[2011/03/15 11:09:30 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\SendTo
[2011/03/15 11:09:30 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Recent
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Startup
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\My Documents\My Videos
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\My Documents\My Music
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\My Documents
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Accessories
[2011/03/15 11:09:30 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Templates
[2011/03/15 11:09:30 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\PrintHood
[2011/03/15 11:09:30 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\NetHood
[2011/03/15 11:09:30 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\WINDOWS
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Wildtangent
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Online Services
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\My Documents\My Pictures
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Microsoft Help
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Microsoft
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Google
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150050}
[2011/03/13 19:52:06 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\jGlKhLf06320
[2011/03/06 19:01:25 | 000,000,000 | —D | C] – C:\WINDOWS\System32\LogFiles
[2011/03/06 18:20:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Norton Internet Security
[2011/03/06 18:18:11 | 000,000,000 | —D | C] – C:\Program Files\Norton Internet Security
[2011/03/06 17:48:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\mFdDdGe06300
[2011/03/03 13:43:44 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Security Client
[2011/03/03 13:42:01 | 000,534,160 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\SymNeti.dll
[2011/03/03 06:45:14 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\mPkIbOl06308

========== Files - Modified Within 30 Days ==========

[2011/03/15 15:04:38 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/03/15 15:02:33 | 000,000,894 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cbc9a247bcb328.job
[2011/03/15 15:02:10 | 000,003,649 | —- | M] () – C:\WINDOWS\viassary-hp.reg
[2011/03/15 14:39:27 | 000,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2011/03/15 11:25:54 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\OTL.exe
[2011/03/15 11:15:49 | 000,000,438 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{B8FDD6AE-531A-4008-BF8B-21E9E86CCE76}.job
[2011/03/15 11:05:52 | 000,000,390 | -H– | M] () – C:\WINDOWS\tasks\MpIdleTask.job
[2011/03/15 11:05:00 | 000,000,444 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{8119F42E-2697-4617-9A1E-13D0D89280FB}.job
[2011/03/14 02:20:00 | 000,000,898 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA1cbc9a249271898.job
[2011/03/14 02:19:00 | 000,001,006 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4244926684-2125597925-878420289-1009UA.job
[2011/03/14 02:13:47 | 001,228,854 | —- | M] () – C:\fsqwr.bmp
[2011/03/14 01:33:00 | 000,001,006 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1247128046-2491470071-81438129-1009UA.job
[2011/03/13 19:59:02 | 000,000,249 | —- | M] () – C:\WINDOWS\System\hpsysdrv.dat
[2011/03/13 19:19:00 | 000,000,954 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4244926684-2125597925-878420289-1009Core.job
[2011/03/13 19:00:00 | 000,000,268 | —- | M] () – C:\WINDOWS\tasks\RMSchedule.job
[2011/03/13 17:15:03 | 000,000,488 | -H– | M] () – C:\WINDOWS\tasks\Norton Security Scan for Compaq_Owner.job
[2011/03/13 14:33:00 | 000,000,954 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1247128046-2491470071-81438129-1009Core.job
[2011/03/11 22:11:23 | 000,001,799 | —- | M] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/03/11 22:11:20 | 000,001,821 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2011/03/06 18:33:35 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/03/06 17:31:39 | 000,000,424 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/03/03 13:57:20 | 000,001,945 | —- | M] () – C:\WINDOWS\epplauncher.mif

========== Files Created - No Company Name ==========

[2011/03/15 11:12:35 | 000,000,438 | -H– | C] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{B8FDD6AE-531A-4008-BF8B-21E9E86CCE76}.job
[2011/03/15 11:10:11 | 000,001,799 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/03/15 11:10:11 | 000,000,779 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/03/15 11:10:11 | 000,000,671 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\HP Rhapsody.lnk
[2011/03/15 11:10:06 | 000,001,773 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Netscape Browser.lnk
[2011/03/15 11:10:06 | 000,000,923 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\RealPlayer.lnk
[2011/03/15 11:10:05 | 000,000,079 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/03/15 11:10:03 | 000,001,640 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\3 Month Trial AOL Music Now.lnk
[2011/03/15 11:09:31 | 000,001,599 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Remote Assistance.lnk
[2011/03/15 11:09:31 | 000,000,800 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Windows Media Player.lnk
[2011/03/15 11:09:31 | 000,000,767 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Internet Explorer.lnk
[2011/03/15 11:09:31 | 000,000,738 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Outlook Express.lnk
[2011/03/15 11:09:31 | 000,000,572 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Startup\Pin.lnk
[2011/03/15 11:09:31 | 000,000,231 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Multi-channel Sound Manager.lnk
[2011/03/06 17:26:26 | 000,000,390 | -H– | C] () – C:\WINDOWS\tasks\MpIdleTask.job
[2011/03/03 13:49:31 | 000,000,424 | -H– | C] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/03/03 13:12:02 | 000,001,945 | —- | C] () – C:\WINDOWS\epplauncher.mif
[2011/03/03 07:22:24 | 001,228,854 | —- | C] () – C:\fsqwr.bmp
[2011/02/10 21:17:24 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2011/01/15 08:07:05 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/12/16 19:13:12 | 000,102,236 | —- | C] () – C:\WINDOWS\hpoins05.dat
[2010/10/23 19:38:12 | 000,000,262 | —- | C] () – C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2010/05/27 17:50:08 | 000,112,924 | —- | C] () – C:\WINDOWS\hpoins07.dat.temp
[2010/05/27 17:50:07 | 000,017,505 | —- | C] () – C:\WINDOWS\hpomdl07.dat.temp
[2010/05/11 17:44:11 | 000,000,324 | —- | C] () – C:\WINDOWS\game.ini
[2010/02/13 00:05:25 | 000,000,074 | —- | C] () – C:\WINDOWS\EPSONC88.ini
[2008/11/17 17:54:00 | 000,002,516 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2008/11/17 17:54:00 | 000,000,168 | RHS- | C] () – C:\Documents and Settings\All Users\Application Data\4A5ACC17E9.sys
[2008/10/12 17:41:17 | 000,002,508 | —- | C] () – C:\Documents and Settings\NetworkService\Application Data\$_hpcst$.hpc
[2008/09/14 19:54:43 | 000,000,313 | —- | C] () – C:\WINDOWS\wldtlk5.ini
[2008/01/08 19:04:52 | 000,000,000 | —- | C] () – C:\WINDOWS\hpqEmlSz.INI
[2008/01/08 18:58:50 | 000,000,221 | —- | C] () – C:\WINDOWS\NCLogConfig.ini
[2007/09/11 20:21:15 | 000,000,227 | —- | C] () – C:\WINDOWS\HP_CounterReport_Update_HPSU.ini
[2007/09/11 20:20:29 | 000,000,214 | —- | C] () – C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2007/09/11 19:35:45 | 000,000,221 | —- | C] () – C:\WINDOWS\HP_RedboxHprblog_HPSU.ini
[2007/09/06 19:49:14 | 000,000,798 | —- | C] () – C:\WINDOWS\unins002.dat
[2007/09/06 19:48:56 | 000,000,798 | —- | C] () – C:\WINDOWS\unins001.dat
[2007/08/17 20:27:49 | 000,000,453 | —- | C] () – C:\WINDOWS\LEXSTAT.INI
[2007/06/01 20:12:09 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2007/06/01 18:30:00 | 000,000,000 | —- | C] () – C:\WINDOWS\lgfwup.ini
[2007/06/01 18:21:27 | 000,040,960 | —- | C] () – C:\Program Files\Uninstall_CDS.exe
[2007/05/29 14:16:04 | 000,000,000 | —- | C] () – C:\WINDOWS\ka.ini
[2007/02/18 23:44:23 | 000,000,025 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2007/02/18 12:16:45 | 000,001,759 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/02/02 16:28:41 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2006/02/18 18:19:27 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/02/18 17:56:23 | 000,028,848 | —- | C] () – C:\WINDOWS\System32\drivers\USBkey.sys
[2006/02/18 17:51:59 | 000,118,842 | R— | C] () – C:\WINDOWS\HPCPCUninstaller-6.3.2.116-5577497.exe
[2006/02/18 17:50:50 | 000,667,896 | —- | C] () – C:\WINDOWS\unins000.exe
[2006/02/18 17:50:50 | 000,001,227 | —- | C] () – C:\WINDOWS\unins000.dat
[2006/02/18 17:50:42 | 000,012,993 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2006/02/18 17:50:36 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2006/02/18 17:48:38 | 000,000,054 | —- | C] () – C:\WINDOWS\Quicken.ini
[2006/02/18 17:46:57 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/02/18 17:33:45 | 000,000,056 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/02/18 17:31:57 | 000,045,929 | —- | C] () – C:\WINDOWS\NSSetDefaultBrowser.EXE
[2006/02/18 17:31:57 | 000,000,698 | —- | C] () – C:\WINDOWS\NSSetDefaultBrowser.ini
[2006/02/18 17:27:02 | 000,087,275 | —- | C] () – C:\WINDOWS\hpqins69.dat
[2006/02/18 17:25:41 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2006/02/18 17:22:07 | 000,104,361 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2006/02/18 17:07:17 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2006/02/18 17:03:55 | 000,323,584 | —- | C] () – C:\WINDOWS\System32\pythoncom22.dll
[2006/02/18 17:03:55 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\pywintypes22.dll
[2006/02/18 17:03:27 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2006/01/09 16:28:18 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/12/05 00:05:38 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2005/12/04 23:55:08 | 000,382,022 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2005/12/04 23:55:08 | 000,053,640 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2005/12/04 23:53:22 | 000,191,384 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2005/12/04 23:50:02 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2005/12/04 23:48:22 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/04 04:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 04:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 04:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 04:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 04:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 04:00:00 | 000,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys
[2004/08/04 04:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 04:00:00 | 000,001,788 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2004/08/04 04:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/06/15 14:38:00 | 000,000,592 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2003/01/07 23:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/04/24 11:17:18 | 000,000,132 | —- | C] () – C:\WINDOWS\http–www.picturebuzz.com-.url
[2001/08/23 15:12:28 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2001/08/23 15:11:02 | 000,004,490 | —- | C] () – C:\WINDOWS\System32\oembios.dat

========== LOP Check ==========

[2009/03/17 18:03:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\acccore
[2009/12/03 18:28:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM
[2009/03/17 18:03:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM Toolbar
[2010/03/20 20:39:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/04/16 18:58:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avG
[2010/05/06 18:24:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2010/11/21 23:00:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EasyMP3Downloader
[2007/05/23 07:11:57 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GameHouse
[2010/10/26 14:51:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iMesh
[2010/01/29 15:36:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iolo
[2011/03/13 19:52:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\jGlKhLf06320
[2011/03/06 18:15:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\mFdDdGe06300
[2011/03/06 18:27:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\mPkIbOl06308
[2010/08/23 18:18:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2009/11/01 20:43:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nexon
[2009/11/01 19:21:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NexonUS
[2010/04/25 18:08:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCSettings
[2007/09/17 07:23:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PlayFirst
[2011/02/03 19:02:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PMB Files
[2010/01/27 08:23:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SITEguard
[2010/01/29 16:17:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2010/10/26 14:45:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/08/27 20:40:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2007/09/06 19:56:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WhiteCap (Holiday Edition)
[2007/03/30 21:28:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2009/03/17 08:44:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2010/10/26 14:53:03 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{0A63553F-CD47-45A0-BC8E-48CB7D13EB53}
[2010/11/27 15:40:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/03/26 14:38:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/05/16 17:09:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/02/28 22:39:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\acccore
[2010/09/20 15:55:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\gtk-2.0
[2010/09/16 19:35:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\Image Zone Express
[2010/05/22 21:31:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\IObit
[2010/08/12 22:21:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\Leadertech
[2010/08/05 01:52:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\MSNInstaller
[2010/05/25 19:52:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\NavNet Solutions
[2010/04/18 18:42:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\Netscape
[2010/04/10 19:38:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\Unity
[2010/02/15 07:30:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\WinBatch
[2010/05/06 21:03:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A\Application Data\AntiVirus Plus
[2010/02/13 00:18:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A\Application Data\Leadertech
[2010/02/13 07:14:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A\Application Data\WinBatch
[2010/11/21 20:22:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.000\Application Data\EasyMP3Downloader
[2010/12/16 13:40:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.000\Application Data\Image Zone Express
[2010/11/13 19:21:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.000\Application Data\imeshmediabartb
[2010/12/17 21:24:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.000\Application Data\Netscape
[2010/12/27 11:43:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Application Data\EasyMP3Downloader
[2011/02/07 20:02:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Application Data\gtk-2.0
[2011/01/09 15:52:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Application Data\Image Zone Express
[2011/02/13 09:07:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Application Data\Leadertech
[2011/01/14 18:50:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Application Data\Netscape
[2011/02/03 19:34:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Application Data\PBlackout
[2008/09/15 17:06:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Guest\Application Data\Netscape
[2009/08/27 20:42:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\acccore
[2009/08/11 20:07:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\Image Zone Express
[2009/07/29 02:31:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\iolo
[2009/11/19 17:54:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\Leadertech
[2010/02/07 09:24:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\LimeWire
[2009/08/05 00:08:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\NavNet Solutions
[2009/08/11 20:07:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\Printer Info Cache
[2009/11/04 18:47:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\Unity
[2009/07/27 18:05:19 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\iolo
[2007/02/15 19:27:39 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Neopets Toolbar
[2008/09/18 14:08:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Other\Application Data\Netscape
[2008/11/13 06:43:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Other\Application Data\Nexon
[2007/02/26 19:35:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Tim\Application Data\Neopets Toolbar
[2008/12/16 19:26:04 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee\Application Data\LimeWire
[2008/09/28 17:24:25 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee\Application Data\Netscape
[2009/12/03 18:29:27 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee.FAMILY\Application Data\acccore
[2009/11/28 11:34:47 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee.FAMILY\Application Data\Image Zone Express
[2009/08/01 15:39:19 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee.FAMILY\Application Data\iolo
[2009/08/14 22:41:19 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee.FAMILY\Application Data\LimeWire
[2009/11/25 19:10:50 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee.FAMILY\Application Data\mjusbsp
[2009/11/19 15:00:15 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee.FAMILY\Application Data\Printer Info Cache
[2007/08/25 13:13:08 | 000,000,000 | —D | M] – C:\Documents and Settings\TJ's\Application Data\Neopets Toolbar
[2011/03/06 17:31:39 | 000,000,424 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2011/03/15 11:05:52 | 000,000,390 | -H– | M] () – C:\WINDOWS\Tasks\MpIdleTask.job
[2011/03/13 19:00:00 | 000,000,268 | —- | M] () – C:\WINDOWS\Tasks\RMSchedule.job
[2011/03/15 11:05:00 | 000,000,444 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{8119F42E-2697-4617-9A1E-13D0D89280FB}.job
[2011/03/15 11:15:49 | 000,000,438 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{B8FDD6AE-531A-4008-BF8B-21E9E86CCE76}.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 162 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F3F95A98
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8B90426A
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B9252F22
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:053BAE56
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:399509A6
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >

aswMBR's scan

aswMBR version 0.9.4 Copyright© 2011 AVAST Software
Run date: 2011-03-15 15:17:19
—————————–
15:17:19.703 OS Version: Windows 5.1.2600 Service Pack 2
15:17:19.703 Number of processors: 1 586 0x2F02
15:17:19.703 ComputerName: YOUR-D0F670B45A UserName: Administrator
15:17:22.406 Initialize success
15:17:32.609 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-12
15:17:32.625 Disk 0 Vendor: Maxtor_6L100P0 BAJ41G10 Size: 95396MB BusType: 3
15:17:34.656 Disk 0 MBR read successfully
15:17:34.671 Disk 0 MBR scan
15:17:36.703 Disk 0 scanning sectors +195365520
15:17:36.750 Disk 0 malicious Win32:MBRoot code @ sector 195365523 !
15:17:36.765 Disk 0 PE file @ sector 195365545 !
15:17:36.796 Disk 0 scanning C:\WINDOWS\system32\drivers
15:17:40.421 Service scanning
15:17:43.765 Disk 0 trace - called modules:
15:17:43.781 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
15:17:43.781 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84325030]
15:17:43.781 3 CLASSPNP.SYS[f759005b] -> nt!IofCallDriver -> \Device\00000065[0x84389360]
15:17:43.781 5 ACPI.sys[f7506620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-12[0x84389570]
15:17:43.796 Scan finished successfully
Post #4
OK before I run the MBR fix I would like to run another two programmes. MBR.dat is a backup of your MBR

Please run in this order

Download RogueKiller to your desktop

  • Quit all running programs
  • For Vista/Seven, right click -> run as administrator, for XP simply run RogueKiller.exe
  • When prompted, type 1 and validate
  • The RKreport.txt shall be generated next to the executable.
  • If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe
Please post the contents of the RKreport.txt in your next Reply.

Do not reboot

Download ComboFix from one of these locations:


Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Post #5
Here's the RougeKiller .txt file
RogueKiller V4.3.1 by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRKgmailcom
Feedback: http://www.sur-la-toile.com/discussion-193…-Remontees.html

Operating System: Windows XP (5.1.2600 Service Pack 2) 32 bits version
Started in : Safe mode with network support
User: Administrator [Admin rights]
Mode: Scan – Date : 03/15/2011 15:52:43

Bad processes: 0

Registry Entries: 0

HOSTS File:
ÿþ1

Finished : << RKreport[1].txt >>
RKreport[1].txt


I cannot run Combofix,it keeps telling me that AVG is installed on this computer,and that continuing would be "dangerous".
I don't see it anywhere on my Program's list. We used to have it installed but we got rid of it years ago.
Post #6
I can only see two elements - lets remove them and try Combofix again

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL
    [2010/04/16 18:58:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avG
    [2010/05/06 18:24:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9

    :Files
    ipconfig /flushdns /c

    :Commands
    [purity]
    [resethosts]
    [emptytemp]
    [EMPTYFLASH]
    [CREATERESTOREPOINT]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
Post #7 last edited
OTL logfile created on: 3/16/2011 11:53:00 AM - Run 3
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

446.00 Mb Total Physical Memory | 220.00 Mb Available Physical Memory | 49.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 86.32 Gb Total Space | 12.27 Gb Free Space | 14.22% Space Free | Partition Type: NTFS
Drive D: | 6.81 Gb Total Space | 0.35 Gb Free Space | 5.19% Space Free | Partition Type: FAT32
Drive E: | 650.22 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: YOUR-D0F670B45A | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (AppMgmt) – File not found
SRV - (Symantec Core LC) – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (Symantec Corporation)
SRV - (comHost) – c:\Program Files\Norton Internet Security\comHost.exe (Symantec Corporation)
SRV - (ccISPwdSvc) – c:\Program Files\Norton Internet Security\ccPwdSvc.exe (Symantec Corporation)
SRV - (navapsvc) – c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe (Symantec Corporation)
SRV - (NSCService) – c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE (Symantec Corporation)
SRV - (SNDSrvc) – c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (Symantec Corporation)
SRV - (ccSetMgr) – c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
SRV - (ccProxy) – c:\Program Files\Common Files\Symantec Shared\ccProxy.exe (Symantec Corporation)
SRV - (ccEvtMgr) – c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
SRV - (SPBBCSvc) – c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (Symantec Corporation)
SRV - (SAVScan) – c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe (Symantec Corporation)


========== Driver Services (SafeList) ==========

DRV - (symlcbrd) – C:\WINDOWS\system32\drivers\symlcbrd.sys (Symantec Corporation)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (RTL8023xp) – C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )
DRV - (SymEvent) – C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Corporation)
DRV - (SPBBCDrv) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (SYMIDSCO) – C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20050901.036\SymIDSCo.sys (Symantec Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (SAVRTPEL) – c:\Program Files\Norton Internet Security\Norton AntiVirus\Savrtpel.sys (Symantec Corporation)
DRV - (SAVRT) – c:\Program Files\Norton Internet Security\Norton AntiVirus\savrt.sys (Symantec Corporation)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ftsata2) – C:\WINDOWS\system32\DRIVERS\ftsata2.sys (Promise Technology, Inc.)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (bb-run) – C:\WINDOWS\system32\DRIVERS\bb-run.sys (Promise Technology, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
IE - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/15 11:14:35 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/09 17:48:32 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.0.3.4\Extensions\\Components: C:\Program Files\Netscape\Netscape Browser\Components [2006/02/18 17:31:48 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.0.3.4\Extensions\\Plugins: C:\Program Files\Netscape\Netscape Browser\Plugins [2011/02/13 03:04:37 | 000,000,000 | —D | M]

[2011/03/12 21:59:13 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/07/27 16:13:46 | 000,027,136 | —- | M] (NHN USA Inc.) – C:\Program Files\Mozilla Firefox\plugins\npijjiautoinstallpluginff.dll
[2009/09/24 23:02:40 | 000,098,304 | —- | M] (OGPlanet Inc.) – C:\Program Files\Mozilla Firefox\plugins\npOGPPlugin.dll
[2009/11/01 17:56:01 | 000,238,776 | —- | M] (Pando Networks) – C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll
[2007/04/16 10:07:12 | 000,180,293 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll
[2010/08/12 01:21:14 | 000,002,486 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\iMeshWebSearch.xml

O1 HOSTS File: ([2011/03/16 11:49:17 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Hot MP3 Toolbar) - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\prxtbHot2.dll (Conduit Ltd.)
O2 - BHO: (CNavExtBho Class) - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (Symantec Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (hpWebHelper Class) - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll (TODO: )
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Hot MP3 Toolbar) - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\prxtbHot2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Norton AntiVirus) - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (Symantec Corporation)
O3 - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ccApp] c:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [HPBootOp] C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IS CfgWiz] c:\Program Files\Norton Internet Security\cfgwiz.exe (Symantec Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [PCDrProfiler] File not found
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [Reminder] C:\Windows\Creator\Remind_XP.exe (SoftThinks)
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Pin.lnk = C:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Startup\Pin.lnk = C:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe (Hewlett-Packard)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup\Compaq Organize.lnk = C:\Program Files\Hewlett-Packard\Compaq Organize\bin\displayAgent.exe (NeoPlanet)
O4 - Startup: C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup\Xfire.lnk = C:\Program Files\Xfire\xfire.exe (Xfire Inc.)
O4 - Startup: C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A\Start Menu\Programs\Startup\Compaq Organize.lnk = C:\Program Files\Hewlett-Packard\Compaq Organize\bin\displayAgent.exe (NeoPlanet)
O4 - Startup: C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.000\Start Menu\Programs\Startup\Compaq Organize.lnk = C:\Program Files\Hewlett-Packard\Compaq Organize\bin\displayAgent.exe (NeoPlanet)
O4 - Startup: C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Start Menu\Programs\Startup\Compaq Organize.lnk = C:\Program Files\Hewlett-Packard\Compaq Organize\bin\displayAgent.exe (NeoPlanet)
O4 - Startup: C:\Documents and Settings\Default User\Start Menu\Programs\Startup\Pin.lnk = C:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\Karrems games\Start Menu\Programs\Startup\LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (Lime Wire, LLC)
O4 - Startup: C:\Documents and Settings\Karrems games\Start Menu\Programs\Startup\Xfire.lnk = C:\Program Files\Xfire\xfire.exe (Xfire Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Google Search - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: &Translate English Word - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Backward Links - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Cached Snapshot of Page - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Similar Pages - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Translate Page into English - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found
O9 - Extra Button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O9 - Extra 'Tools' menuitem : Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1297021462671 (MUWebControl Class)
O16 - DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\welcome.htm
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\welcome.htm
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/12/04 23:50:26 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/27 15:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2004/04/30 07:01:14 | 000,000,053 | -HS- | M] () - D:\AUTORUN.FCB – [ FAT32 ]
O32 - AutoRun File - [2005/05/23 23:50:31 | 000,191,610 | R— | M] () - E:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/03/15 15:55:03 | 000,000,000 | —D | C] – C:\Qoobox
[2011/03/15 15:52:43 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\RK_Quarantine
[2011/03/15 15:17:12 | 000,566,272 | —- | C] (AVAST Software) – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\aswMBR.exe
[2011/03/15 14:39:25 | 000,000,000 | —D | C] – C:\_OTL
[2011/03/15 11:25:51 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\OTL.exe
[2011/03/15 11:18:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Macromedia
[2011/03/15 11:17:58 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Adobe
[2011/03/15 11:14:25 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Mozilla
[2011/03/15 11:14:24 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Mozilla
[2011/03/15 11:12:40 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\IECompatCache
[2011/03/15 11:11:51 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\PrivacIE
[2011/03/15 11:11:23 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\IETldCache
[2011/03/15 11:09:31 | 000,000,000 | –SD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft
[2011/03/15 11:09:31 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data
[2011/03/15 11:09:31 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Favorites
[2011/03/15 11:09:31 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Cookies
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Symantec
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Real
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Intuit
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Identities
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\ApplicationHistory
[2011/03/15 11:09:30 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\SendTo
[2011/03/15 11:09:30 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Recent
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Startup
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\My Documents\My Videos
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\My Documents\My Music
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\My Documents
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Accessories
[2011/03/15 11:09:30 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Templates
[2011/03/15 11:09:30 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\PrintHood
[2011/03/15 11:09:30 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\NetHood
[2011/03/15 11:09:30 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\WINDOWS
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Wildtangent
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Online Services
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\My Documents\My Pictures
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Microsoft Help
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Microsoft
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Google
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150050}
[2011/03/13 19:52:06 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\jGlKhLf06320
[2011/03/06 19:01:25 | 000,000,000 | —D | C] – C:\WINDOWS\System32\LogFiles
[2011/03/06 18:20:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Norton Internet Security
[2011/03/06 18:18:11 | 000,000,000 | —D | C] – C:\Program Files\Norton Internet Security
[2011/03/06 17:48:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\mFdDdGe06300
[2011/03/03 13:43:44 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Security Client
[2011/03/03 13:42:01 | 000,534,160 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\SymNeti.dll
[2011/03/03 06:45:14 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\mPkIbOl06308

========== Files - Modified Within 30 Days ==========

[2011/03/16 11:50:22 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/03/16 11:49:17 | 000,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2011/03/15 15:54:45 | 004,281,003 | R— | M] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\ComboFix.exe
[2011/03/15 15:52:29 | 000,997,888 | —- | M] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\RogueKiller.exe
[2011/03/15 15:18:10 | 000,000,512 | —- | M] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\MBR.dat
[2011/03/15 15:17:19 | 000,566,272 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\aswMBR.exe
[2011/03/15 15:02:33 | 000,000,894 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cbc9a247bcb328.job
[2011/03/15 15:02:10 | 000,003,649 | —- | M] () – C:\WINDOWS\viassary-hp.reg
[2011/03/15 11:25:54 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\OTL.exe
[2011/03/15 11:15:49 | 000,000,438 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{B8FDD6AE-531A-4008-BF8B-21E9E86CCE76}.job
[2011/03/15 11:05:52 | 000,000,390 | -H– | M] () – C:\WINDOWS\tasks\MpIdleTask.job
[2011/03/15 11:05:00 | 000,000,444 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{8119F42E-2697-4617-9A1E-13D0D89280FB}.job
[2011/03/14 02:20:00 | 000,000,898 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA1cbc9a249271898.job
[2011/03/14 02:19:00 | 000,001,006 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4244926684-2125597925-878420289-1009UA.job
[2011/03/14 02:13:47 | 001,228,854 | —- | M] () – C:\fsqwr.bmp
[2011/03/14 01:33:00 | 000,001,006 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1247128046-2491470071-81438129-1009UA.job
[2011/03/13 19:59:02 | 000,000,249 | —- | M] () – C:\WINDOWS\System\hpsysdrv.dat
[2011/03/13 19:19:00 | 000,000,954 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4244926684-2125597925-878420289-1009Core.job
[2011/03/13 19:00:00 | 000,000,268 | —- | M] () – C:\WINDOWS\tasks\RMSchedule.job
[2011/03/13 17:15:03 | 000,000,488 | -H– | M] () – C:\WINDOWS\tasks\Norton Security Scan for Compaq_Owner.job
[2011/03/13 14:33:00 | 000,000,954 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1247128046-2491470071-81438129-1009Core.job
[2011/03/11 22:11:23 | 000,001,799 | —- | M] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/03/11 22:11:20 | 000,001,821 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2011/03/06 18:33:35 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/03/06 17:31:39 | 000,000,424 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/03/03 13:57:20 | 000,001,945 | —- | M] () – C:\WINDOWS\epplauncher.mif

========== Files Created - No Company Name ==========

[2011/03/15 15:54:20 | 004,281,003 | R— | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\ComboFix.exe
[2011/03/15 15:52:00 | 000,997,888 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\RogueKiller.exe
[2011/03/15 15:18:10 | 000,000,512 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\MBR.dat
[2011/03/15 11:12:35 | 000,000,438 | -H– | C] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{B8FDD6AE-531A-4008-BF8B-21E9E86CCE76}.job
[2011/03/15 11:10:11 | 000,001,799 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/03/15 11:10:11 | 000,000,779 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/03/15 11:10:11 | 000,000,671 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\HP Rhapsody.lnk
[2011/03/15 11:10:06 | 000,001,773 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Netscape Browser.lnk
[2011/03/15 11:10:06 | 000,000,923 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\RealPlayer.lnk
[2011/03/15 11:10:05 | 000,000,079 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/03/15 11:10:03 | 000,001,640 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\3 Month Trial AOL Music Now.lnk
[2011/03/15 11:09:31 | 000,001,599 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Remote Assistance.lnk
[2011/03/15 11:09:31 | 000,000,800 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Windows Media Player.lnk
[2011/03/15 11:09:31 | 000,000,767 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Internet Explorer.lnk
[2011/03/15 11:09:31 | 000,000,738 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Outlook Express.lnk
[2011/03/15 11:09:31 | 000,000,572 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Startup\Pin.lnk
[2011/03/15 11:09:31 | 000,000,231 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Multi-channel Sound Manager.lnk
[2011/03/06 17:26:26 | 000,000,390 | -H– | C] () – C:\WINDOWS\tasks\MpIdleTask.job
[2011/03/03 13:49:31 | 000,000,424 | -H– | C] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/03/03 13:12:02 | 000,001,945 | —- | C] () – C:\WINDOWS\epplauncher.mif
[2011/03/03 07:22:24 | 001,228,854 | —- | C] () – C:\fsqwr.bmp
[2011/02/10 21:17:24 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2011/01/15 08:07:05 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/12/16 19:13:12 | 000,102,236 | —- | C] () – C:\WINDOWS\hpoins05.dat
[2010/10/23 19:38:12 | 000,000,262 | —- | C] () – C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2010/05/27 17:50:08 | 000,112,924 | —- | C] () – C:\WINDOWS\hpoins07.dat.temp
[2010/05/27 17:50:07 | 000,017,505 | —- | C] () – C:\WINDOWS\hpomdl07.dat.temp
[2010/05/11 17:44:11 | 000,000,324 | —- | C] () – C:\WINDOWS\game.ini
[2010/02/13 00:05:25 | 000,000,074 | —- | C] () – C:\WINDOWS\EPSONC88.ini
[2008/11/17 17:54:00 | 000,002,516 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2008/11/17 17:54:00 | 000,000,168 | RHS- | C] () – C:\Documents and Settings\All Users\Application Data\4A5ACC17E9.sys
[2008/10/12 17:41:17 | 000,002,508 | —- | C] () – C:\Documents and Settings\NetworkService\Application Data\$_hpcst$.hpc
[2008/09/14 19:54:43 | 000,000,313 | —- | C] () – C:\WINDOWS\wldtlk5.ini
[2008/01/08 19:04:52 | 000,000,000 | —- | C] () – C:\WINDOWS\hpqEmlSz.INI
[2008/01/08 18:58:50 | 000,000,221 | —- | C] () – C:\WINDOWS\NCLogConfig.ini
[2007/09/11 20:21:15 | 000,000,227 | —- | C] () – C:\WINDOWS\HP_CounterReport_Update_HPSU.ini
[2007/09/11 20:20:29 | 000,000,214 | —- | C] () – C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2007/09/11 19:35:45 | 000,000,221 | —- | C] () – C:\WINDOWS\HP_RedboxHprblog_HPSU.ini
[2007/09/06 19:49:14 | 000,000,798 | —- | C] () – C:\WINDOWS\unins002.dat
[2007/09/06 19:48:56 | 000,000,798 | —- | C] () – C:\WINDOWS\unins001.dat
[2007/08/17 20:27:49 | 000,000,453 | —- | C] () – C:\WINDOWS\LEXSTAT.INI
[2007/06/01 20:12:09 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2007/06/01 18:30:00 | 000,000,000 | —- | C] () – C:\WINDOWS\lgfwup.ini
[2007/06/01 18:21:27 | 000,040,960 | —- | C] () – C:\Program Files\Uninstall_CDS.exe
[2007/05/29 14:16:04 | 000,000,000 | —- | C] () – C:\WINDOWS\ka.ini
[2007/02/18 23:44:23 | 000,000,025 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2007/02/18 12:16:45 | 000,001,759 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/02/02 16:28:41 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2006/02/18 18:19:27 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/02/18 17:56:23 | 000,028,848 | —- | C] () – C:\WINDOWS\System32\drivers\USBkey.sys
[2006/02/18 17:51:59 | 000,118,842 | R— | C] () – C:\WINDOWS\HPCPCUninstaller-6.3.2.116-5577497.exe
[2006/02/18 17:50:50 | 000,667,896 | —- | C] () – C:\WINDOWS\unins000.exe
[2006/02/18 17:50:50 | 000,001,227 | —- | C] () – C:\WINDOWS\unins000.dat
[2006/02/18 17:50:42 | 000,012,993 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2006/02/18 17:50:36 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2006/02/18 17:48:38 | 000,000,054 | —- | C] () – C:\WINDOWS\Quicken.ini
[2006/02/18 17:46:57 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/02/18 17:33:45 | 000,000,056 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/02/18 17:31:57 | 000,045,929 | —- | C] () – C:\WINDOWS\NSSetDefaultBrowser.EXE
[2006/02/18 17:31:57 | 000,000,698 | —- | C] () – C:\WINDOWS\NSSetDefaultBrowser.ini
[2006/02/18 17:27:02 | 000,087,275 | —- | C] () – C:\WINDOWS\hpqins69.dat
[2006/02/18 17:25:41 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2006/02/18 17:22:07 | 000,104,361 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2006/02/18 17:07:17 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2006/02/18 17:03:55 | 000,323,584 | —- | C] () – C:\WINDOWS\System32\pythoncom22.dll
[2006/02/18 17:03:55 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\pywintypes22.dll
[2006/02/18 17:03:27 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2006/01/09 16:28:18 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/12/05 00:05:38 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2005/12/04 23:55:08 | 000,382,022 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2005/12/04 23:55:08 | 000,053,640 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2005/12/04 23:53:22 | 000,191,384 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2005/12/04 23:50:02 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2005/12/04 23:48:22 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/04 04:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 04:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 04:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 04:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 04:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 04:00:00 | 000,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys
[2004/08/04 04:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 04:00:00 | 000,001,788 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2004/08/04 04:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/06/15 14:38:00 | 000,000,592 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2003/01/07 23:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/04/24 11:17:18 | 000,000,132 | —- | C] () – C:\WINDOWS\http–www.picturebuzz.com-.url
[2001/08/23 15:12:28 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2001/08/23 15:11:02 | 000,004,490 | —- | C] () – C:\WINDOWS\System32\oembios.dat

========== LOP Check ==========

[2009/03/17 18:03:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\acccore
[2009/12/03 18:28:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM
[2009/03/17 18:03:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM Toolbar
[2010/03/20 20:39:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/11/21 23:00:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EasyMP3Downloader
[2007/05/23 07:11:57 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GameHouse
[2010/10/26 14:51:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iMesh
[2010/01/29 15:36:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iolo
[2011/03/13 19:52:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\jGlKhLf06320
[2011/03/06 18:15:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\mFdDdGe06300
[2011/03/06 18:27:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\mPkIbOl06308
[2010/08/23 18:18:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2009/11/01 20:43:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nexon
[2009/11/01 19:21:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NexonUS
[2010/04/25 18:08:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCSettings
[2007/09/17 07:23:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PlayFirst
[2011/02/03 19:02:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PMB Files
[2010/01/27 08:23:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SITEguard
[2010/01/29 16:17:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2010/10/26 14:45:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/08/27 20:40:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2007/09/06 19:56:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WhiteCap (Holiday Edition)
[2007/03/30 21:28:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2009/03/17 08:44:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2010/10/26 14:53:03 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{0A63553F-CD47-45A0-BC8E-48CB7D13EB53}
[2010/11/27 15:40:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/03/26 14:38:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/05/16 17:09:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/02/28 22:39:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\acccore
[2010/09/20 15:55:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\gtk-2.0
[2010/09/16 19:35:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\Image Zone Express
[2010/05/22 21:31:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\IObit
[2010/08/12 22:21:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\Leadertech
[2010/08/05 01:52:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\MSNInstaller
[2010/05/25 19:52:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\NavNet Solutions
[2010/04/18 18:42:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\Netscape
[2010/04/10 19:38:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\Unity
[2010/02/15 07:30:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\WinBatch
[2010/05/06 21:03:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A\Application Data\AntiVirus Plus
[2010/02/13 00:18:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A\Application Data\Leadertech
[2010/02/13 07:14:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A\Application Data\WinBatch
[2010/11/21 20:22:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.000\Application Data\EasyMP3Downloader
[2010/12/16 13:40:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.000\Application Data\Image Zone Express
[2010/11/13 19:21:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.000\Application Data\imeshmediabartb
[2010/12/17 21:24:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.000\Application Data\Netscape
[2010/12/27 11:43:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Application Data\EasyMP3Downloader
[2011/02/07 20:02:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Application Data\gtk-2.0
[2011/01/09 15:52:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Application Data\Image Zone Express
[2011/02/13 09:07:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Application Data\Leadertech
[2011/01/14 18:50:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Application Data\Netscape
[2011/02/03 19:34:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Application Data\PBlackout
[2008/09/15 17:06:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Guest\Application Data\Netscape
[2009/08/27 20:42:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\acccore
[2009/08/11 20:07:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\Image Zone Express
[2009/07/29 02:31:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\iolo
[2009/11/19 17:54:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\Leadertech
[2010/02/07 09:24:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\LimeWire
[2009/08/05 00:08:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\NavNet Solutions
[2009/08/11 20:07:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\Printer Info Cache
[2009/11/04 18:47:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\Unity
[2009/07/27 18:05:19 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\iolo
[2007/02/15 19:27:39 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Neopets Toolbar
[2008/09/18 14:08:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Other\Application Data\Netscape
[2008/11/13 06:43:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Other\Application Data\Nexon
[2007/02/26 19:35:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Tim\Application Data\Neopets Toolbar
[2008/12/16 19:26:04 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee\Application Data\LimeWire
[2008/09/28 17:24:25 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee\Application Data\Netscape
[2009/12/03 18:29:27 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee.FAMILY\Application Data\acccore
[2009/11/28 11:34:47 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee.FAMILY\Application Data\Image Zone Express
[2009/08/01 15:39:19 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee.FAMILY\Application Data\iolo
[2009/08/14 22:41:19 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee.FAMILY\Application Data\LimeWire
[2009/11/25 19:10:50 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee.FAMILY\Application Data\mjusbsp
[2009/11/19 15:00:15 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee.FAMILY\Application Data\Printer Info Cache
[2007/08/25 13:13:08 | 000,000,000 | —D | M] – C:\Documents and Settings\TJ's\Application Data\Neopets Toolbar
[2011/03/06 17:31:39 | 000,000,424 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2011/03/15 11:05:52 | 000,000,390 | -H– | M] () – C:\WINDOWS\Tasks\MpIdleTask.job
[2011/03/13 19:00:00 | 000,000,268 | —- | M] () – C:\WINDOWS\Tasks\RMSchedule.job
[2011/03/15 11:05:00 | 000,000,444 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{8119F42E-2697-4617-9A1E-13D0D89280FB}.job
[2011/03/15 11:15:49 | 000,000,438 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{B8FDD6AE-531A-4008-BF8B-21E9E86CCE76}.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 162 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F3F95A98
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8B90426A
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B9252F22
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:053BAE56
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:399509A6
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >

It created a log when it rebooted,do you want me to post that also?
Post #10
OK more than one way to skin a cat - lets do it manually

Download AVPTool from Here to your desktop

Run the programme you have just downloaded to your desktop (it will be randomly named )

First we will run a virus scan

On the first tab select all elements down to Computer and then select start scan
Once it has finished select report and post that.

[external image: Posted Image]

Do not close AVPTool or it will self uninstall, if it does uninstall - then just rerun the setup file on your desktop

Now an analysis scan

Select the Manual Disinfection tab
Press the Gather System Information button
Once done Open the last report saved folder then attach the zip file to your next post zip
The file is located at C:\Users\your name\Desktop\Virus Removal Tool\setup_9.0.0.722_05.01.2011_20-34\LOG\avptool_sysinfo.zip

[external image: Posted Image]
Post #11
Ok then,just wanted to ask if it was normal for scans to take a really long time to complete? The virus scan has been running for 22 hours and is currently at 99%. I just checked it and it's been stuck on the file E:\util\ccc\ptb\WindowsXP-KB822603-x86-ptb.exe//PE_Patch for the last 5minutes.
Post #12
OK stop the scan as it is that far in - on my system it takes about 1 hour Once the scan is complete then run part two - this is a lot faster maybe 10 minutes
Post #13
Autoscan: completed 1 hour ago (events: 105, objects: 1021247, time: 1 day 03:39:42) 3/16/2011 12:53:50 PM Task started 3/16/2011 12:55:39 PM Detected: Trojan.Win32.FakeAV.bikv C:\Documents and Settings\All Users\Application Data\jGlKhLf06320\jGlKhLf06320.exe 3/16/2011 12:56:37 PM Untreated: Trojan.Win32.FakeAV.bikv C:\Documents and Settings\All Users\Application Data\jGlKhLf06320\jGlKhLf06320.exe Skipped by user 3/16/2011 1:05:03 PM Detected: Trojan.Win32.FakeAV.bikv C:\Documents and Settings\All Users\Application Data\jGlKhLf06320\jGlKhLf06320.exe 3/16/2011 1:09:48 PM Untreated: Trojan.Win32.FakeAV.bikv C:\Documents and Settings\All Users\Application Data\jGlKhLf06320\jGlKhLf06320.exe Skipped by user 3/16/2011 1:14:23 PM Detected: Trojan.Win32.FakeAV.bikv C:\Documents and Settings\All Users\Application Data\jGlKhLf06320\jGlKhLf06320.exe 3/16/2011 1:20:22 PM Untreated: Trojan.Win32.FakeAV.bikv C:\Documents and Settings\All Users\Application Data\jGlKhLf06320\jGlKhLf06320.exe Skipped by user 3/16/2011 3:48:24 PM Detected: not-a-virus:AdWare.Win32.WeatherBug.a C:\hp\bin\wbug\CompaqPresario_Spring06.exe/WiseSFXDropper/WISE0015.BIN 3/16/2011 3:51:02 PM Untreated: not-a-virus:AdWare.Win32.WeatherBug.a C:\hp\bin\wbug\CompaqPresario_Spring06.exe/WiseSFXDropper/WISE0015.BIN Write not supported 3/16/2011 4:34:27 PM Detected: Trojan-Clicker.Win32.VBiframe.ack C:\Program Files\FPB\fpb.exe/Molebox 3/16/2011 4:43:35 PM Deleted: Trojan-Clicker.Win32.VBiframe.ack C:\Program Files\FPB\fpb.exe 3/16/2011 6:49:56 PM Detected: HEUR:Trojan.Win32.Generic C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP60\A0088040.exe 3/16/2011 6:53:06 PM Detected: Trojan.Win32.FraudPack.cpze C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP67\A0100356.exe 3/16/2011 6:55:40 PM Untreated: HEUR:Trojan.Win32.Generic C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP60\A0088040.exe Skipped by user 3/16/2011 7:01:46 PM Deleted: Trojan.Win32.FraudPack.cpze C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP67\A0100356.exe 3/16/2011 7:25:03 PM Detected: Trojan-Clicker.Win32.VBiframe.ack C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP74\A0118826.exe/Molebox 3/16/2011 7:31:38 PM Deleted: Trojan-Clicker.Win32.VBiframe.ack C:\System Volume Information\_restore{00EFF98B-5705-4D9A-BA78-7681A60AFB54}\RP74\A0118826.exe 3/16/2011 8:19:41 PM Detected: not-a-virus:AdWare.Win32.WeatherBug.a D:\I386\APPS\APP00195\src\HPPavillion_Spring06.exe/WiseSFXDropper/WISE0015.BIN 3/16/2011 8:19:44 PM Detected: not-a-virus:AdWare.Win32.WeatherBug.a D:\I386\APPS\APP00195\src\CompaqPresario_Spring06.exe/WiseSFXDropper/WISE0015.BIN 3/16/2011 8:59:10 PM Untreated: not-a-virus:AdWare.Win32.WeatherBug.a D:\I386\APPS\APP00195\src\HPPavillion_Spring06.exe/WiseSFXDropper/WISE0015.BIN Write not supported 3/16/2011 8:59:13 PM Untreated: not-a-virus:AdWare.Win32.WeatherBug.a D:\I386\APPS\APP00195\src\CompaqPresario_Spring06.exe/WiseSFXDropper/WISE0015.BIN Write not supported 3/16/2011 9:13:03 PM Processing error E:\slk\drivers\com_lang\hpzrm312.dl_ Read error 3/16/2011 9:13:38 PM Processing error E:\slk\drivers\win9x_me\hpzrm112.dl_ Read error 3/16/2011 9:16:36 PM Processing error E:\svc\drivers\win9x_me\hpzrm112.dl_ Read error 3/16/2011 9:18:18 PM Processing error E:\sve\drivers\com_lang\hpqish09.dat Read error 3/16/2011 9:18:57 PM Processing error E:\tha\drivers\com_lang\hpzl3212.dl_ Read error 3/16/2011 9:24:21 PM Processing error E:\tha\drivers\com_lang\hpzr3212.dl_ Read error 3/16/2011 9:24:36 PM Processing error E:\tha\drivers\win9x_me\hpoupdrm.inf Read error 3/16/2011 9:24:50 PM Processing error E:\tha\drivers\com_lang\hpzrm312.dl_ Read error 3/16/2011 9:29:10 PM Processing error E:\tha\drivers\win9x_me\hpzrm112.dl_ Read error 3/16/2011 9:33:52 PM Processing error E:\trk\drivers\com_lang\hpqish09.dat Read error 3/16/2011 9:36:16 PM Processing error E:\tha\drivers\win9x_me\usbprint.sys Read error 3/16/2011 9:38:27 PM Processing error E:\tur\drivers\com_lang\hpfmom12.hl_ Read error 3/16/2011 9:38:45 PM Processing error E:\tur\drivers\com_lang\hpqish09.dat Read error 3/16/2011 9:39:03 PM Processing error E:\tur\drivers\com_lang\hpofax08.dll Read error 3/16/2011 9:45:33 PM Processing error E:\tur\drivers\com_lang\hpzr3212.dl_ Read error 3/16/2011 9:47:18 PM Processing error E:\tur\drivers\com_lang\hpzrm312.dl_ Read error 3/16/2011 9:47:43 PM Processing error E:\tur\drivers\com_lang\hpzl3212.dl_ Read error 3/16/2011 9:48:11 PM Processing error E:\tur\drivers\win9x_me\hpoupdrm.inf Read error 3/16/2011 9:52:32 PM Processing error E:\tur\drivers\win9x_me\usbmon.dll Read error 3/16/2011 9:52:52 PM Processing error E:\tur\drivers\win9x_me\usbprint.sys Read error 3/16/2011 9:55:53 PM Processing error E:\tur\drivers\win9x_me\hpzrm112.dl_ Read error 3/16/2011 10:02:23 PM Processing error E:\util\cfgmgr32.dll Read error 3/16/2011 10:03:56 PM Processing error E:\util\aio\hpopdi05.exe Read error 3/16/2011 10:07:02 PM Processing error E:\util\ccc\1606fix.reg Read error 3/16/2011 10:08:21 PM Processing error E:\util\aio\hpopin05.exe Read error 3/16/2011 10:13:09 PM Processing error E:\util\ccc\270615USAM.EXE Read error 3/16/2011 11:38:25 PM Processing error E:\util\setupapi.dll Read error 3/16/2011 11:44:16 PM Processing error E:\util\ccc\FixErr1714.exe Read error 3/17/2011 12:34:08 AM Processing error E:\setup\solutioncenter\SolutionCenter.cab Read error 3/17/2011 12:49:12 AM Processing error E:\util\ccc\AccessDeniedUtility.exe Read error 3/17/2011 1:00:02 AM Processing error E:\util\ccc\HPZprs01.exe Read error 3/17/2011 1:41:29 AM Processing error E:\util\ccc\HPZlgc01.exe Read error 3/17/2011 2:19:00 AM Processing error E:\util\ccc\MediaSizeSettings.exe Read error 3/17/2011 3:59:51 AM Processing error E:\util\ccc\240075.exe Read error 3/17/2011 4:00:30 AM Processing error E:\setup\unloadintent\Data1.cab Read error 3/17/2011 4:07:26 AM Processing error E:\util\ccc\Uninstall_L4.bat Read error 3/17/2011 4:12:57 AM Processing error E:\util\ccc\afs2k_install.bat Read error 3/17/2011 4:16:32 AM Processing error E:\util\ccc\afs2k_remove.bat Read error 3/17/2011 4:55:02 AM Processing error E:\util\ccc\Q256858_W2K_SP1_x86.EXE Read error 3/17/2011 4:58:17 AM Processing error E:\util\ccc\collect.bat Read error 3/17/2011 5:04:28 AM Processing error E:\util\ccc\hpzlgc01.dat Read error 3/17/2011 5:29:11 AM Processing error E:\util\ccc\Q283787_W2K_SP3_x86_en.EXE Read error 3/17/2011 5:37:48 AM Processing error E:\util\ccc\diagnostics\HPSysDig.exe Read error 3/17/2011 5:48:39 AM Processing error E:\util\ccc\diagnostics\HpAppEgn.dll Read error 3/17/2011 5:59:43 AM Processing error E:\util\ccc\diagnostics\HpSdUi.dll Read error 3/17/2011 6:03:40 AM Processing error E:\util\ccc\diagnostics\appdata.src Read error 3/17/2011 6:25:53 AM Processing error E:\util\ccc\diagnostics\DeviceInfo.dll Read error 3/17/2011 6:36:24 AM Processing error E:\util\ccc\diagnostics\systeminfo.dll Read error 3/17/2011 6:43:35 AM Processing error E:\util\ccc\diagnostics\zlib.dll Read error 3/17/2011 6:53:18 AM Processing error E:\util\ccc\diagnostics\loc\cz\HpSdRes.dll Read error 3/17/2011 7:03:34 AM Processing error E:\util\ccc\diagnostics\loc\da\HpSdRes.dll Read error 3/17/2011 7:12:18 AM Processing error E:\util\ccc\diagnostics\loc\du\HpSdRes.dll Read error 3/17/2011 7:20:20 AM Processing error E:\util\ccc\diagnostics\logging.dll Read error 3/17/2011 7:26:58 AM Processing error E:\util\ccc\diagnostics\loc\fi\HpSdRes.dll Read error 3/17/2011 7:39:07 AM Processing error E:\util\ccc\diagnostics\loc\fr\HpSdRes.dll Read error 3/17/2011 7:40:01 AM Processing error E:\util\ccc\afsinst.exe Read error 3/17/2011 7:53:04 AM Processing error E:\util\ccc\diagnostics\loc\en\HpSdRes.dll Read error 3/17/2011 7:54:21 AM Processing error E:\util\ccc\diagnostics\loc\hu\HpSdRes.dll Read error 3/17/2011 7:58:57 AM Processing error E:\util\ccc\diagnostics\loc\it\HpSdRes.dll Read error 3/17/2011 8:02:07 AM Processing error E:\util\ccc\diagnostics\loc\ko\HpSdRes.dll Read error 3/17/2011 8:04:27 AM Processing error E:\util\ccc\diagnostics\loc\no\HpSdRes.dll Read error 3/17/2011 8:07:30 AM Processing error E:\util\ccc\diagnostics\loc\po\HpSdRes.dll Read error 3/17/2011 8:11:25 AM Processing error E:\util\ccc\diagnostics\loc\pol\HpSdRes.dll Read error 3/17/2011 8:15:18 AM Processing error E:\util\ccc\diagnostics\loc\ge\HpSdRes.dll Read error 3/17/2011 8:19:47 AM Processing error E:\util\ccc\diagnostics\loc\sw\HpSdRes.dll Read error 3/17/2011 8:19:47 AM Processing error E:\util\ccc\diagnostics\loc\ru\HpSdRes.dll Read error 3/17/2011 8:21:25 AM Processing error E:\util\ccc\diagnostics\loc\sp\HpSdRes.dll Read error 3/17/2011 8:24:50 AM Processing error E:\util\ccc\diagnostics\loc\tc\HpSdRes.dll Read error 3/17/2011 8:29:51 AM Processing error E:\util\ccc\enu\WindowsXP-KB822603-x86-enu.exe Read error 3/17/2011 8:38:56 AM Processing error E:\util\ccc\esn\Q283787_W2K_SP3_x86.EXE Read error 3/17/2011 8:47:47 AM Processing error E:\util\ccc\esn\WindowsXP-KB822603-x86-esn.exe Read error 3/17/2011 8:57:12 AM Processing error E:\util\ccc\fra\Q283787_W2K_SP3_x86.EXE Read error 3/17/2011 8:58:58 AM Processing error E:\util\ccc\diagnostics\loc\tu\HpSdRes.dll Read error 3/17/2011 9:02:41 AM Processing error E:\util\ccc\fra\WindowsXP-KB822603-x86-fra.exe Read error 3/17/2011 11:20:57 AM Processing error E:\util\ccc\enu\Q283787_W2K_SP3_x86.EXE Read error 3/17/2011 11:30:14 AM Processing error E:\util\common\hpfpdi12.exe Read error 3/17/2011 11:39:23 AM Processing error E:\util\common\hpqisc09.exe Read error 3/17/2011 11:50:28 AM Processing error E:\util\common\hpzghl12.exe Read error 3/17/2011 12:00:29 PM Processing error E:\util\common\hpzpin12.exe Read error 3/17/2011 12:19:43 PM Processing error E:\util\ccc\ptb\Q283787_W2K_SP3_x86.EXE Read error 3/17/2011 1:31:00 PM Processing error E:\util\ccc\ptb\WindowsXP-KB822603-x86-ptb.exe Read error 3/17/2011 4:26:53 PM Processing error E:\util\support_tools\msi_install_cleanup\win2000\msicuu.exe Read error 3/17/2011 4:33:31 PM Processing error E:\util\support_tools\msi_install_cleanup\win9x\msicu.exe Read error 3/17/2011 4:33:32 PM Task completed

Attachments:

Post #14
What problems are you currently experiencing ?

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :Files
    ipconfig /flushdns /c
    C:\Documents and Settings\All Users\Application Data\jGlKhLf06320

    :Commands
    [emptytemp]
    [EMPTYFLASH]
    [CREATERESTOREPOINT]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
Post #15
Here's the OTL log
logfile created on: 3/18/2011 11:46:14 AM - Run 4
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

446.00 Mb Total Physical Memory | 290.00 Mb Available Physical Memory | 65.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 94.00% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 86.32 Gb Total Space | 11.61 Gb Free Space | 13.45% Space Free | Partition Type: NTFS
Drive D: | 6.81 Gb Total Space | 0.35 Gb Free Space | 5.19% Space Free | Partition Type: FAT32
Drive E: | 650.22 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: YOUR-D0F670B45A | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (AppMgmt) – File not found
SRV - (Symantec Core LC) – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (Symantec Corporation)
SRV - (comHost) – c:\Program Files\Norton Internet Security\comHost.exe (Symantec Corporation)
SRV - (ccISPwdSvc) – c:\Program Files\Norton Internet Security\ccPwdSvc.exe (Symantec Corporation)
SRV - (navapsvc) – c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe (Symantec Corporation)
SRV - (NSCService) – c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE (Symantec Corporation)
SRV - (SNDSrvc) – c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (Symantec Corporation)
SRV - (ccSetMgr) – c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
SRV - (ccProxy) – c:\Program Files\Common Files\Symantec Shared\ccProxy.exe (Symantec Corporation)
SRV - (ccEvtMgr) – c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
SRV - (SPBBCSvc) – c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (Symantec Corporation)
SRV - (SAVScan) – c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe (Symantec Corporation)


========== Driver Services (SafeList) ==========

DRV - (11115802) – C:\WINDOWS\system32\DRIVERS\11115802.sys (Kaspersky Lab)
DRV - (setup_9.0.0.722_15.03.2011_11-34drv) – C:\WINDOWS\system32\drivers\1111580.sys (Kaspersky Lab)
DRV - (11115801) – C:\WINDOWS\system32\drivers\11115801.sys (Kaspersky Lab)
DRV - (symlcbrd) – C:\WINDOWS\system32\drivers\symlcbrd.sys (Symantec Corporation)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (RTL8023xp) – C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )
DRV - (SymEvent) – C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Corporation)
DRV - (SPBBCDrv) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (SYMIDSCO) – C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20050901.036\SymIDSCo.sys (Symantec Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (SAVRTPEL) – c:\Program Files\Norton Internet Security\Norton AntiVirus\Savrtpel.sys (Symantec Corporation)
DRV - (SAVRT) – c:\Program Files\Norton Internet Security\Norton AntiVirus\savrt.sys (Symantec Corporation)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ftsata2) – C:\WINDOWS\system32\DRIVERS\ftsata2.sys (Promise Technology, Inc.)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (bb-run) – C:\WINDOWS\system32\DRIVERS\bb-run.sys (Promise Technology, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {1FD91A9C-410C-4090-BBCC-55D3450EF433}:2.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/15 11:14:35 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/09 17:48:32 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.0.3.4\Extensions\\Components: C:\Program Files\Netscape\Netscape Browser\Components [2006/02/18 17:31:48 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Netscape Browser 8.0.3.4\Extensions\\Plugins: C:\Program Files\Netscape\Netscape Browser\Plugins [2011/02/13 03:04:37 | 000,000,000 | —D | M]

[2011/03/16 16:33:32 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Mozilla\Extensions
[2011/03/16 16:33:32 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Mozilla\Firefox\Profiles\isac0e1e.default\extensions
[2011/03/12 21:59:13 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/10/26 14:52:43 | 000,000,000 | —D | M] (DataMngr) – C:\PROGRAM FILES\IMESH APPLICATIONS\MEDIABAR\DATAMNGR\FIREFOXEXTENSION
[2011/01/14 19:13:48 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010/07/27 16:13:46 | 000,027,136 | —- | M] (NHN USA Inc.) – C:\Program Files\Mozilla Firefox\plugins\npijjiautoinstallpluginff.dll
[2009/09/24 23:02:40 | 000,098,304 | —- | M] (OGPlanet Inc.) – C:\Program Files\Mozilla Firefox\plugins\npOGPPlugin.dll
[2009/11/01 17:56:01 | 000,238,776 | —- | M] (Pando Networks) – C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll
[2007/04/16 10:07:12 | 000,180,293 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll
[2010/08/12 01:21:14 | 000,002,486 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\iMeshWebSearch.xml

O1 HOSTS File: ([2011/03/16 11:49:17 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Hot MP3 Toolbar) - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\prxtbHot2.dll (Conduit Ltd.)
O2 - BHO: (CNavExtBho Class) - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (Symantec Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (hpWebHelper Class) - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll (TODO: )
O3 - HKLM\..\Toolbar: (&Google;) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Hot MP3 Toolbar) - {9384bd4c-dd14-4be9-80f7-f6277511e4f5} - C:\Program Files\Hot_MP3\prxtbHot2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Norton AntiVirus) - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (Symantec Corporation)
O3 - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\..\Toolbar\WebBrowser: (&Google;) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ccApp] c:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [HPBootOp] C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IS CfgWiz] c:\Program Files\Norton Internet Security\cfgwiz.exe (Symantec Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [PCDrProfiler] File not found
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [Reminder] C:\Windows\Creator\Remind_XP.exe (SoftThinks)
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Pin.lnk = C:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Startup\Pin.lnk = C:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Startup\setup_9.0.0.722_15.03.2011_11-34.lnk = C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\Virus Removal Tool\setup_9.0.0.722_15.03.2011_11-34\startup.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe (Hewlett-Packard)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup\Compaq Organize.lnk = C:\Program Files\Hewlett-Packard\Compaq Organize\bin\displayAgent.exe (NeoPlanet)
O4 - Startup: C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup\Xfire.lnk = C:\Program Files\Xfire\xfire.exe (Xfire Inc.)
O4 - Startup: C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A\Start Menu\Programs\Startup\Compaq Organize.lnk = C:\Program Files\Hewlett-Packard\Compaq Organize\bin\displayAgent.exe (NeoPlanet)
O4 - Startup: C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.000\Start Menu\Programs\Startup\Compaq Organize.lnk = C:\Program Files\Hewlett-Packard\Compaq Organize\bin\displayAgent.exe (NeoPlanet)
O4 - Startup: C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Start Menu\Programs\Startup\Compaq Organize.lnk = C:\Program Files\Hewlett-Packard\Compaq Organize\bin\displayAgent.exe (NeoPlanet)
O4 - Startup: C:\Documents and Settings\Default User\Start Menu\Programs\Startup\Pin.lnk = C:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\Karrems games\Start Menu\Programs\Startup\LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (Lime Wire, LLC)
O4 - Startup: C:\Documents and Settings\Karrems games\Start Menu\Programs\Startup\Xfire.lnk = C:\Program Files\Xfire\xfire.exe (Xfire Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1207958070-1573732809-3716294632-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Google; Search - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: &Translate; English Word - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Backward Links - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Cached Snapshot of Page - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Similar Pages - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Translate Page into English - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found
O9 - Extra Button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O9 - Extra 'Tools' menuitem : Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1297021462671 (MUWebControl Class)
O16 - DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\welcome.htm
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\welcome.htm
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/12/04 23:50:26 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/27 15:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2004/04/30 07:01:14 | 000,000,053 | -HS- | M] () - D:\AUTORUN.FCB – [ FAT32 ]
O32 - AutoRun File - [2005/05/23 23:50:31 | 000,191,610 | R— | M] () - E:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/03/16 12:50:52 | 000,037,392 | —- | C] (Kaspersky Lab) – C:\WINDOWS\System32\drivers\11115802.sys
[2011/03/16 12:50:51 | 000,315,408 | —- | C] (Kaspersky Lab) – C:\WINDOWS\System32\drivers\1111580.sys
[2011/03/16 12:50:51 | 000,128,016 | —- | C] (Kaspersky Lab) – C:\WINDOWS\System32\drivers\11115801.sys
[2011/03/16 12:50:51 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\Virus Removal Tool
[2011/03/16 12:49:39 | 095,310,224 | —- | C] ( ) – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\setup_9.0.0.722_15.03.2011_11-34.exe
[2011/03/15 15:55:03 | 000,000,000 | —D | C] – C:\Qoobox
[2011/03/15 15:52:43 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\RK_Quarantine
[2011/03/15 15:17:12 | 000,566,272 | —- | C] (AVAST Software) – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\aswMBR.exe
[2011/03/15 14:39:25 | 000,000,000 | —D | C] – C:\_OTL
[2011/03/15 11:25:51 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\OTL.exe
[2011/03/15 11:18:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Macromedia
[2011/03/15 11:17:58 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Adobe
[2011/03/15 11:14:25 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Mozilla
[2011/03/15 11:14:24 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Mozilla
[2011/03/15 11:12:40 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\IECompatCache
[2011/03/15 11:11:51 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\PrivacIE
[2011/03/15 11:11:23 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\IETldCache
[2011/03/15 11:09:31 | 000,000,000 | –SD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft
[2011/03/15 11:09:31 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data
[2011/03/15 11:09:31 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Favorites
[2011/03/15 11:09:31 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Cookies
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Symantec
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Real
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Intuit
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Identities
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop
[2011/03/15 11:09:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\ApplicationHistory
[2011/03/15 11:09:30 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\SendTo
[2011/03/15 11:09:30 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Recent
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Startup
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\My Documents\My Videos
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\My Documents\My Music
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\My Documents
[2011/03/15 11:09:30 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Accessories
[2011/03/15 11:09:30 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Templates
[2011/03/15 11:09:30 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\PrintHood
[2011/03/15 11:09:30 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\NetHood
[2011/03/15 11:09:30 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\WINDOWS
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Wildtangent
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Online Services
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\My Documents\My Pictures
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Microsoft Help
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Microsoft
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\Google
[2011/03/15 11:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150050}
[2011/03/06 19:01:25 | 000,000,000 | —D | C] – C:\WINDOWS\System32\LogFiles
[2011/03/06 18:20:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Norton Internet Security
[2011/03/06 18:18:11 | 000,000,000 | —D | C] – C:\Program Files\Norton Internet Security
[2011/03/06 17:48:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\mFdDdGe06300
[2011/03/03 13:43:44 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Security Client
[2011/03/03 13:42:01 | 000,534,160 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\SymNeti.dll
[2011/03/03 06:45:14 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\mPkIbOl06308

========== Files - Modified Within 30 Days ==========

[2011/03/18 11:44:55 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/03/17 23:49:58 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/03/16 16:58:48 | 079,121,848 | —- | M] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\Best_Day_Ever-(DatPiff.com).zip
[2011/03/16 14:31:36 | 120,591,227 | —- | M] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\sir-michael-rocks-the-rocks-report2.zip
[2011/03/16 14:30:46 | 041,930,934 | —- | M] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\International Jones - The Sweetest Hangover (Mixtape) [WWW.JETSFOOL.BLOGSPOT.COM].zip
[2011/03/16 12:52:12 | 000,002,422 | —- | M] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Startup\setup_9.0.0.722_15.03.2011_11-34.lnk
[2011/03/16 12:49:54 | 095,310,224 | —- | M] ( ) – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\setup_9.0.0.722_15.03.2011_11-34.exe
[2011/03/16 11:49:17 | 000,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2011/03/15 15:54:45 | 004,281,003 | R— | M] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\ComboFix.exe
[2011/03/15 15:52:29 | 000,997,888 | —- | M] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\RogueKiller.exe
[2011/03/15 15:18:10 | 000,000,512 | —- | M] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\MBR.dat
[2011/03/15 15:17:19 | 000,566,272 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\aswMBR.exe
[2011/03/15 15:02:33 | 000,000,894 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cbc9a247bcb328.job
[2011/03/15 15:02:10 | 000,003,649 | —- | M] () – C:\WINDOWS\viassary-hp.reg
[2011/03/15 11:25:54 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\OTL.exe
[2011/03/15 11:15:49 | 000,000,438 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{B8FDD6AE-531A-4008-BF8B-21E9E86CCE76}.job
[2011/03/15 11:05:52 | 000,000,390 | -H– | M] () – C:\WINDOWS\tasks\MpIdleTask.job
[2011/03/15 11:05:00 | 000,000,444 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{8119F42E-2697-4617-9A1E-13D0D89280FB}.job
[2011/03/14 02:20:00 | 000,000,898 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA1cbc9a249271898.job
[2011/03/14 02:19:00 | 000,001,006 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4244926684-2125597925-878420289-1009UA.job
[2011/03/14 02:13:47 | 001,228,854 | —- | M] () – C:\fsqwr.bmp
[2011/03/14 01:33:00 | 000,001,006 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1247128046-2491470071-81438129-1009UA.job
[2011/03/13 19:59:02 | 000,000,249 | —- | M] () – C:\WINDOWS\System\hpsysdrv.dat
[2011/03/13 19:19:00 | 000,000,954 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4244926684-2125597925-878420289-1009Core.job
[2011/03/13 19:00:00 | 000,000,268 | —- | M] () – C:\WINDOWS\tasks\RMSchedule.job
[2011/03/13 17:15:03 | 000,000,488 | -H– | M] () – C:\WINDOWS\tasks\Norton Security Scan for Compaq_Owner.job
[2011/03/13 14:33:00 | 000,000,954 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1247128046-2491470071-81438129-1009Core.job
[2011/03/11 22:11:23 | 000,001,799 | —- | M] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/03/11 22:11:20 | 000,001,821 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2011/03/06 18:33:35 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/03/06 17:31:39 | 000,000,424 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/03/03 13:57:20 | 000,001,945 | —- | M] () – C:\WINDOWS\epplauncher.mif

========== Files Created - No Company Name ==========

[2011/03/16 16:58:15 | 079,121,848 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\Best_Day_Ever-(DatPiff.com).zip
[2011/03/16 14:30:14 | 120,591,227 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\sir-michael-rocks-the-rocks-report2.zip
[2011/03/16 14:29:38 | 041,930,934 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\International Jones - The Sweetest Hangover (Mixtape) [WWW.JETSFOOL.BLOGSPOT.COM].zip
[2011/03/16 12:52:12 | 000,002,422 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Startup\setup_9.0.0.722_15.03.2011_11-34.lnk
[2011/03/15 15:54:20 | 004,281,003 | R— | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\ComboFix.exe
[2011/03/15 15:52:00 | 000,997,888 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\RogueKiller.exe
[2011/03/15 15:18:10 | 000,000,512 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\MBR.dat
[2011/03/15 11:12:35 | 000,000,438 | -H– | C] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{B8FDD6AE-531A-4008-BF8B-21E9E86CCE76}.job
[2011/03/15 11:10:11 | 000,001,799 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/03/15 11:10:11 | 000,000,779 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/03/15 11:10:11 | 000,000,671 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\HP Rhapsody.lnk
[2011/03/15 11:10:06 | 000,001,773 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Netscape Browser.lnk
[2011/03/15 11:10:06 | 000,000,923 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\RealPlayer.lnk
[2011/03/15 11:10:05 | 000,000,079 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/03/15 11:10:03 | 000,001,640 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Desktop\3 Month Trial AOL Music Now.lnk
[2011/03/15 11:09:31 | 000,001,599 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Remote Assistance.lnk
[2011/03/15 11:09:31 | 000,000,800 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Windows Media Player.lnk
[2011/03/15 11:09:31 | 000,000,767 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Internet Explorer.lnk
[2011/03/15 11:09:31 | 000,000,738 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Outlook Express.lnk
[2011/03/15 11:09:31 | 000,000,572 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Startup\Pin.lnk
[2011/03/15 11:09:31 | 000,000,231 | —- | C] () – C:\Documents and Settings\Administrator.YOUR-D0F670B45A.001\Start Menu\Programs\Multi-channel Sound Manager.lnk
[2011/03/06 17:26:26 | 000,000,390 | -H– | C] () – C:\WINDOWS\tasks\MpIdleTask.job
[2011/03/03 13:49:31 | 000,000,424 | -H– | C] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/03/03 13:12:02 | 000,001,945 | —- | C] () – C:\WINDOWS\epplauncher.mif
[2011/03/03 07:22:24 | 001,228,854 | —- | C] () – C:\fsqwr.bmp
[2011/02/10 21:17:24 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2011/01/15 08:07:05 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/12/16 19:13:12 | 000,102,236 | —- | C] () – C:\WINDOWS\hpoins05.dat
[2010/10/23 19:38:12 | 000,000,262 | —- | C] () – C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2010/05/27 17:50:08 | 000,112,924 | —- | C] () – C:\WINDOWS\hpoins07.dat.temp
[2010/05/27 17:50:07 | 000,017,505 | —- | C] () – C:\WINDOWS\hpomdl07.dat.temp
[2010/05/11 17:44:11 | 000,000,324 | —- | C] () – C:\WINDOWS\game.ini
[2010/02/13 00:05:25 | 000,000,074 | —- | C] () – C:\WINDOWS\EPSONC88.ini
[2008/11/17 17:54:00 | 000,002,516 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2008/11/17 17:54:00 | 000,000,168 | RHS- | C] () – C:\Documents and Settings\All Users\Application Data\4A5ACC17E9.sys
[2008/10/12 17:41:17 | 000,002,508 | —- | C] () – C:\Documents and Settings\NetworkService\Application Data\$_hpcst$.hpc
[2008/09/14 19:54:43 | 000,000,313 | —- | C] () – C:\WINDOWS\wldtlk5.ini
[2008/01/08 19:04:52 | 000,000,000 | —- | C] () – C:\WINDOWS\hpqEmlSz.INI
[2008/01/08 18:58:50 | 000,000,221 | —- | C] () – C:\WINDOWS\NCLogConfig.ini
[2007/09/11 20:21:15 | 000,000,227 | —- | C] () – C:\WINDOWS\HP_CounterReport_Update_HPSU.ini
[2007/09/11 20:20:29 | 000,000,214 | —- | C] () – C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2007/09/11 19:35:45 | 000,000,221 | —- | C] () – C:\WINDOWS\HP_RedboxHprblog_HPSU.ini
[2007/09/06 19:49:14 | 000,000,798 | —- | C] () – C:\WINDOWS\unins002.dat
[2007/09/06 19:48:56 | 000,000,798 | —- | C] () – C:\WINDOWS\unins001.dat
[2007/08/17 20:27:49 | 000,000,453 | —- | C] () – C:\WINDOWS\LEXSTAT.INI
[2007/06/01 20:12:09 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2007/06/01 18:30:00 | 000,000,000 | —- | C] () – C:\WINDOWS\lgfwup.ini
[2007/06/01 18:21:27 | 000,040,960 | —- | C] () – C:\Program Files\Uninstall_CDS.exe
[2007/05/29 14:16:04 | 000,000,000 | —- | C] () – C:\WINDOWS\ka.ini
[2007/02/18 23:44:23 | 000,000,025 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2007/02/18 12:16:45 | 000,001,759 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/02/02 16:28:41 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2006/02/18 18:19:27 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/02/18 17:56:23 | 000,028,848 | —- | C] () – C:\WINDOWS\System32\drivers\USBkey.sys
[2006/02/18 17:51:59 | 000,118,842 | R— | C] () – C:\WINDOWS\HPCPCUninstaller-6.3.2.116-5577497.exe
[2006/02/18 17:50:50 | 000,667,896 | —- | C] () – C:\WINDOWS\unins000.exe
[2006/02/18 17:50:50 | 000,001,227 | —- | C] () – C:\WINDOWS\unins000.dat
[2006/02/18 17:50:42 | 000,012,993 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2006/02/18 17:50:36 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2006/02/18 17:48:38 | 000,000,054 | —- | C] () – C:\WINDOWS\Quicken.ini
[2006/02/18 17:46:57 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/02/18 17:33:45 | 000,000,056 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/02/18 17:31:57 | 000,045,929 | —- | C] () – C:\WINDOWS\NSSetDefaultBrowser.EXE
[2006/02/18 17:31:57 | 000,000,698 | —- | C] () – C:\WINDOWS\NSSetDefaultBrowser.ini
[2006/02/18 17:27:02 | 000,087,275 | —- | C] () – C:\WINDOWS\hpqins69.dat
[2006/02/18 17:25:41 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2006/02/18 17:22:07 | 000,104,361 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2006/02/18 17:07:17 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2006/02/18 17:03:55 | 000,323,584 | —- | C] () – C:\WINDOWS\System32\pythoncom22.dll
[2006/02/18 17:03:55 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\pywintypes22.dll
[2006/02/18 17:03:27 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2006/01/09 16:28:18 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/12/05 00:05:38 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2005/12/04 23:55:08 | 000,382,022 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2005/12/04 23:55:08 | 000,053,640 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2005/12/04 23:53:22 | 000,191,384 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2005/12/04 23:50:02 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2005/12/04 23:48:22 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/04 04:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 04:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 04:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 04:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 04:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 04:00:00 | 000,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys
[2004/08/04 04:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 04:00:00 | 000,001,788 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2004/08/04 04:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/06/15 14:38:00 | 000,000,592 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2003/01/07 23:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/04/24 11:17:18 | 000,000,132 | —- | C] () – C:\WINDOWS\http–www.picturebuzz.com-.url
[2001/08/23 15:12:28 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2001/08/23 15:11:02 | 000,004,490 | —- | C] () – C:\WINDOWS\System32\oembios.dat

========== LOP Check ==========

[2009/03/17 18:03:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\acccore
[2009/12/03 18:28:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM
[2009/03/17 18:03:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM Toolbar
[2010/03/20 20:39:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/11/21 23:00:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EasyMP3Downloader
[2007/05/23 07:11:57 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GameHouse
[2010/10/26 14:51:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iMesh
[2010/01/29 15:36:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iolo
[2011/03/06 18:15:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\mFdDdGe06300
[2011/03/06 18:27:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\mPkIbOl06308
[2010/08/23 18:18:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2009/11/01 20:43:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nexon
[2009/11/01 19:21:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NexonUS
[2010/04/25 18:08:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCSettings
[2007/09/17 07:23:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PlayFirst
[2011/02/03 19:02:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PMB Files
[2010/01/27 08:23:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SITEguard
[2010/01/29 16:17:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2010/10/26 14:45:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/08/27 20:40:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2007/09/06 19:56:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WhiteCap (Holiday Edition)
[2007/03/30 21:28:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2009/03/17 08:44:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2010/10/26 14:53:03 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{0A63553F-CD47-45A0-BC8E-48CB7D13EB53}
[2010/11/27 15:40:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/03/26 14:38:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/05/16 17:09:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/02/28 22:39:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\acccore
[2010/09/20 15:55:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\gtk-2.0
[2010/09/16 19:35:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\Image Zone Express
[2010/05/22 21:31:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\IObit
[2010/08/12 22:21:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\Leadertech
[2010/08/05 01:52:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\MSNInstaller
[2010/05/25 19:52:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\NavNet Solutions
[2010/04/18 18:42:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\Netscape
[2010/04/10 19:38:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\Unity
[2010/02/15 07:30:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\WinBatch
[2010/05/06 21:03:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A\Application Data\AntiVirus Plus
[2010/02/13 00:18:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A\Application Data\Leadertech
[2010/02/13 07:14:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A\Application Data\WinBatch
[2010/11/21 20:22:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.000\Application Data\EasyMP3Downloader
[2010/12/16 13:40:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.000\Application Data\Image Zone Express
[2010/11/13 19:21:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.000\Application Data\imeshmediabartb
[2010/12/17 21:24:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.000\Application Data\Netscape
[2010/12/27 11:43:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Application Data\EasyMP3Downloader
[2011/02/07 20:02:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Application Data\gtk-2.0
[2011/01/09 15:52:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Application Data\Image Zone Express
[2011/02/13 09:07:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Application Data\Leadertech
[2011/01/14 18:50:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Application Data\Netscape
[2011/02/03 19:34:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-D0F670B45A.001\Application Data\PBlackout
[2008/09/15 17:06:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Guest\Application Data\Netscape
[2009/08/27 20:42:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\acccore
[2009/08/11 20:07:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\Image Zone Express
[2009/07/29 02:31:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\iolo
[2009/11/19 17:54:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\Leadertech
[2010/02/07 09:24:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\LimeWire
[2009/08/05 00:08:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\NavNet Solutions
[2009/08/11 20:07:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\Printer Info Cache
[2009/11/04 18:47:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Karrems games\Application Data\Unity
[2009/07/27 18:05:19 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\iolo
[2007/02/15 19:27:39 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Neopets Toolbar
[2008/09/18 14:08:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Other\Application Data\Netscape
[2008/11/13 06:43:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Other\Application Data\Nexon
[2007/02/26 19:35:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Tim\Application Data\Neopets Toolbar
[2008/12/16 19:26:04 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee\Application Data\LimeWire
[2008/09/28 17:24:25 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee\Application Data\Netscape
[2009/12/03 18:29:27 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee.FAMILY\Application Data\acccore
[2009/11/28 11:34:47 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee.FAMILY\Application Data\Image Zone Express
[2009/08/01 15:39:19 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee.FAMILY\Application Data\iolo
[2009/08/14 22:41:19 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee.FAMILY\Application Data\LimeWire
[2009/11/25 19:10:50 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee.FAMILY\Application Data\mjusbsp
[2009/11/19 15:00:15 | 000,000,000 | —D | M] – C:\Documents and Settings\timmygee.FAMILY\Application Data\Printer Info Cache
[2007/08/25 13:13:08 | 000,000,000 | —D | M] – C:\Documents and Settings\TJ's\Application Data\Neopets Toolbar
[2011/03/06 17:31:39 | 000,000,424 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2011/03/15 11:05:52 | 000,000,390 | -H– | M] () – C:\WINDOWS\Tasks\MpIdleTask.job
[2011/03/13 19:00:00 | 000,000,268 | —- | M] () – C:\WINDOWS\Tasks\RMSchedule.job
[2011/03/15 11:05:00 | 000,000,444 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{8119F42E-2697-4617-9A1E-13D0D89280FB}.job
[2011/03/15 11:15:49 | 000,000,438 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{B8FDD6AE-531A-4008-BF8B-21E9E86CCE76}.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 162 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F3F95A98
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8B90426A
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B9252F22
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:053BAE56
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:399509A6
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >

I'll try starting up the computer into Normal Mode now.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI