CatByte
where are your pictures now?
Spyware / Malware / Virus Removal
husband was infected, now looks like I am
10 min read
wilma1313
C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000
CatByte
Please confirm for me that you have the following folder:
C:\Documents and Settings\your user name\My Documents\My Pictures
If you do, then let's move all your pictures back to that folder:
Navigate to the folder where your picture are located now
C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000
Once in the folder > go to Edit > select all
In the window pane on the left of the folder under "File and Folder Tasks" select > "Move the selected Items" > click on that once and a small box will pop up > navigate to the destination folder which should appear in this box > under your username you will see the folder name "Pictures" > select this folder >Press the Move button > that will move all your pictures back into the proper folder.
If you don't have that folder, then you will need to create it >
Do the following:
Click Start > Run to open a run box > copy and paste the following command into the open run box
rundll32 mydocs.dll,PerUserInit
Press {ENTER}
This creates a new My Pictures folder with the special icon.
Let me know how that goes
C:\Documents and Settings\your user name\My Documents\My Pictures
If you do, then let's move all your pictures back to that folder:
Navigate to the folder where your picture are located now
C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000
Once in the folder > go to Edit > select all
In the window pane on the left of the folder under "File and Folder Tasks" select > "Move the selected Items" > click on that once and a small box will pop up > navigate to the destination folder which should appear in this box > under your username you will see the folder name "Pictures" > select this folder >Press the Move button > that will move all your pictures back into the proper folder.
If you don't have that folder, then you will need to create it >
Do the following:
Click Start > Run to open a run box > copy and paste the following command into the open run box
rundll32 mydocs.dll,PerUserInit
Press {ENTER}
This creates a new My Pictures folder with the special icon.
Let me know how that goes
wilma1313
I know how to move them. The whole point of this was figuring out why they moved without me doing anything and to make sure I was not infected with anything that caused my stuff to disappear into a folder I did not create and could only access by using the find feature on the computer and then making a short cut to this mystery file that somehow was buried in the bowels of my computer with no reason as to why it happened.
As long as there is no infection I guess I don't need to know why. Its been round and round with the same questions and no answers.
CatByte
Windows will do unexplainable things sometimes in order to "save" and "protect" our files if there is corruption somewhere.
Do you have any outstanding issues?
wilma1313
No new issues thanks.
wilma1313
Anything special I need to doto clean up from scans and junk instructed to do previously?
CatByte
First could you please post a fresh OTL log so I can make certain that you are clean
wilma1313
Sorry this took so long, school started and have 2 jobs, so if I dont' specifically write stuff in on the calendar I lose track… I just hit scan without special instructions and here is the log.
OTL logfile created on: 8/29/2011 6:02:01 AM - Run 3
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1.99 Gb Total Physical Memory | 0.88 Gb Available Physical Memory | 43.99% Memory free
3.84 Gb Paging File | 2.51 Gb Available in Paging File | 65.39% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 224.23 Gb Total Space | 151.51 Gb Free Space | 67.57% Space Free | Partition Type: NTFS
Drive D: | 8.63 Gb Total Space | 0.40 Gb Free Space | 4.69% Space Free | Partition Type: FAT32
Computer Name: YOUR-4DACD0EA75 | User Name: HP_Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Program Files\PopCap Games\Plants vs. Zombies\popcapgame1.exe ()
PRC - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
PRC - C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\WINDOWS\system32\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Program Files\PopCap Games\Plants vs. Zombies\PlantsVsZombies.exe ()
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\WINDOWS\system32\msfeedssync.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Garmin\gStart.exe (GARMIN Corp.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\HPZipm12.exe (HP)
PRC - C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe (Hewlett-Packard)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\ELService.exe (Intel Corporation)
PRC - C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe (Sonic Solutions)
PRC - C:\Program Files\DISC\DISCover.exe (Digital Interactive Systems Corporation)
PRC - C:\Program Files\DISC\DISCUpdMgr.exe (Digital Interactive Systems Corporation, Inc.)
PRC - C:\Program Files\DISC\DiscStreamHub.exe (Digital Interactive Systems Corporation, Inc.)
========== Modules (SafeList) ==========
MOD - C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Local Settings\Temp\IadHide5.dll (BackWeb)
========== Win32 Services (SafeList) ==========
SRV - (HidServ) – File not found
SRV - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (mfevtp) – C:\WINDOWS\system32\mfevtps.exe (McAfee, Inc.)
SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe ()
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (McProxy) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (ELService) Intel® – C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\ELService.exe (Intel Corporation)
========== Driver Services (SafeList) ==========
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (mfehidk) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfefirek) – C:\WINDOWS\system32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\WINDOWS\system32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mfetdi2k) – C:\WINDOWS\system32\drivers\mfetdi2k.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\WINDOWS\system32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfendiskmp) – C:\WINDOWS\system32\drivers\mfendisk.sys (McAfee, Inc.)
DRV - (mfendisk) – C:\WINDOWS\system32\drivers\mfendisk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (cfwids) – C:\WINDOWS\system32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (ELacpi) – C:\WINDOWS\system32\drivers\ELacpi.sys (Intel Corporation)
DRV - (ELmon) – C:\WINDOWS\system32\drivers\Elmon.sys (Intel Corporation)
DRV - (ELkbd) – C:\WINDOWS\system32\drivers\Elkbd.sys (Intel Corporation)
DRV - (ELmou) – C:\WINDOWS\system32\drivers\Elmou.sys (Intel Corporation)
DRV - (ELhid) – C:\WINDOWS\system32\drivers\Elhid.sys (Intel Corporation)
DRV - (Ps2) – C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company)
DRV - (HSXHWBS2) – C:\WINDOWS\system32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.)
DRV - (HSX_DP) – C:\WINDOWS\system32\drivers\HSX_DP.sys (Conexant Systems, Inc.)
DRV - (ftsata2) – C:\WINDOWS\system32\DRIVERS\ftsata2.sys (Promise Technology, Inc.)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (bb-run) – C:\WINDOWS\system32\DRIVERS\bb-run.sys (Promise Technology, Inc.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~1\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.652: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.652: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/06/05 12:45:03 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Browser 8.0.4.0\Extensions\\Components: C:\Program Files\Netscape\Netscape Browser\Components [2011/08/04 17:26:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Browser 8.0.4.0\Extensions\\Plugins: C:\Program Files\Netscape\Netscape Browser\Plugins [2011/08/04 17:26:21 | 000,000,000 | —D | M]
[2011/07/10 21:32:17 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Application Data\Mozilla\Extensions
[2011/01/06 21:15:39 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/10/15 14:43:56 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/06 21:15:39 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2010/11/12 19:53:06 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
O1 HOSTS File: ([2011/01/25 21:03:09 | 000,428,637 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 14760 more lines…
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110619041032.dll (McAfee, Inc.)
O2 - BHO: (hpWebHelper Class) - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll (Hewlett-Packard)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [DMAScheduler] c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe (Sonic Solutions)
O4 - HKLM..\Run: [ftutil2] C:\WINDOWS\System32\ftutil2.dll (Promise Technology, Inc.)
O4 - HKLM..\Run: [HPBootOp] C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [PCDrProfiler] File not found
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [gStart] C:\Program Files\Garmin\gStart.exe (GARMIN Corp.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe (Hewlett-Packard)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Add to Wish List - {76c5fb99-dd0a-4186-9e75-65d1bf3da283} - C:\Program Files\Amazon\Add to Wish List IE Extension\run.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O9 - Extra 'Tools' menuitem : Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: trymedia.com ([]http in Trusted sites)
O15 - HKLM\..Trusted Domains: trymedia.com ([]https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/08/19 23:47:54 | 000,000,100 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/27 08:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O33 - MountPoints2\{9f12eee3-9a77-11e0-99ea-0018f330b671}\Shell - "" = AutoRun
O33 - MountPoints2\{9f12eee3-9a77-11e0-99ea-0018f330b671}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9f12eee3-9a77-11e0-99ea-0018f330b671}\Shell\AutoRun\command - "" = K:\iStudio.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011/08/26 18:18:35 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\McAfee
[2011/08/25 08:09:23 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/08/09 19:07:28 | 000,010,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndistapi.sys
[2011/08/05 09:45:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\!SASCORE
[3 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\*.tmp files -> C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011/08/29 06:04:27 | 000,000,308 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-855813861-3017274974-1318682258-1007.job
[2011/08/29 06:04:27 | 000,000,300 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-855813861-3017274974-1318682258-1007.job
[2011/08/29 06:04:00 | 000,000,906 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/08/29 06:02:13 | 000,000,444 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{E4E916C6-FDB9-42B8-954B-FC48BE0333BE}.job
[2011/08/28 20:18:37 | 002,100,441 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\dress SAM_0366_Converted.JPG
[2011/08/28 20:17:55 | 002,012,955 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\shorts SAM_0379_Converted.JPG
[2011/08/28 20:17:11 | 002,397,396 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\SAM_0375_Converted.JPG
[2011/08/28 20:16:26 | 002,153,036 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\SAM_0374_Converted_Converted.JPG
[2011/08/28 20:13:59 | 002,120,187 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\dress SAM_0367_Converted_Converted.JPG
[2011/08/28 20:13:11 | 002,616,928 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\dress SAM_0364_Converted.JPG
[2011/08/28 20:11:12 | 003,676,038 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\SAM_0361_Converted_Edited.JPG
[2011/08/28 17:38:14 | 000,018,978 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\pink bowls.jpg
[2011/08/28 13:04:00 | 000,000,902 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/08/26 08:46:19 | 000,000,246 | —- | M] () – C:\WINDOWS\System\hpsysdrv.dat
[2011/08/26 08:10:54 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/08/26 08:10:53 | 2137,473,024 | -HS- | M] () – C:\hiberfil.sys
[2011/08/25 08:09:23 | 000,001,553 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/08/25 07:57:01 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/08/24 18:31:57 | 000,021,604 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\dawg.gif
[2011/08/24 16:35:11 | 000,000,214 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\BookMooch Member Home.url
[2011/08/23 16:22:25 | 000,002,102 | —- | M] () – C:\WINDOWS\ERA.INI
[2011/08/23 15:58:47 | 000,014,496 | —- | M] () – C:\WINDOWS\ExercsDA.EQS
[2011/08/23 15:58:47 | 000,011,264 | —- | M] () – C:\WINDOWS\RecmndDA.EQS
[2011/08/23 15:57:35 | 000,008,870 | —- | M] () – C:\WINDOWS\MeasrsDA.EQS
[2011/08/22 22:24:25 | 000,015,136 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\ti84sepink.jpg
[2011/08/22 22:24:23 | 000,152,154 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\calc.bmp
[2011/08/22 19:23:31 | 000,000,325 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\Centennial Trail Map.url
[2011/08/21 18:34:07 | 000,016,199 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\scarp.jpg
[2011/08/21 09:11:16 | 000,038,336 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\wild.jpg
[2011/08/21 09:03:43 | 000,006,224 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\cork.jpg
[2011/08/20 12:39:08 | 006,702,314 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\Copy of Cypress Hill - Insane In The Membrane.mp3
[2011/08/16 14:18:22 | 000,095,232 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\Oct%202011
[2011/08/15 22:15:51 | 000,000,180 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\Study Metabolism Not Necessarily Related to Aging Nutritiously Happy.url
[2011/08/13 20:56:41 | 000,096,050 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\me.jpg
[2011/08/12 09:15:35 | 000,825,059 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\Full Moon 4 Miler Run-Walk Race.mht
[2011/08/10 03:06:56 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/08/05 21:43:16 | 000,001,606 | —- | M] () – C:\Documents and Settings\All Users\Desktop\McAfee AntiVirus Plus.lnk
[2011/08/04 17:26:15 | 000,001,615 | —- | M] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2011/07/31 19:01:28 | 000,011,760 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\11CUDAHY1_Results_TXT.mht
[3 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\*.tmp files -> C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011/08/28 20:21:52 | 001,994,490 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\hoochie SAM_0373.JPG
[2011/08/28 20:21:24 | 002,012,955 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\shorts SAM_0379_Converted.JPG
[2011/08/28 20:21:22 | 002,397,396 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\SAM_0375_Converted.JPG
[2011/08/28 20:21:19 | 002,153,036 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\SAM_0374_Converted_Converted.JPG
[2011/08/28 20:21:17 | 003,676,038 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\SAM_0361_Converted_Edited.JPG
[2011/08/28 20:21:13 | 002,120,187 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\dress SAM_0367_Converted_Converted.JPG
[2011/08/28 20:21:11 | 002,100,441 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\dress SAM_0366_Converted.JPG
[2011/08/28 20:21:09 | 002,616,928 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\dress SAM_0364_Converted.JPG
[2011/08/28 17:38:33 | 000,018,978 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\pink bowls.jpg
[2011/08/25 08:09:23 | 000,001,553 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/08/24 18:32:21 | 000,021,604 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\dawg.gif
[2011/08/22 22:24:35 | 000,015,136 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\ti84sepink.jpg
[2011/08/22 22:24:23 | 000,152,154 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\calc.bmp
[2011/08/22 19:23:31 | 000,000,325 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\Centennial Trail Map.url
[2011/08/21 20:33:53 | 001,975,780 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\SAM_0355.JPG
[2011/08/21 20:33:50 | 001,938,870 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\SAM_0356.JPG
[2011/08/21 20:33:48 | 001,973,641 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\SAM_0357.JPG
[2011/08/21 18:34:27 | 000,016,199 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\scarp.jpg
[2011/08/21 09:11:24 | 000,038,336 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\wild.jpg
[2011/08/21 09:04:52 | 000,006,224 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\cork.jpg
[2011/08/20 12:38:50 | 006,702,314 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\Copy of Cypress Hill - Insane In The Membrane.mp3
[2011/08/16 14:18:21 | 000,095,232 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\Oct%202011
[2011/08/15 22:15:51 | 000,000,180 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\Study Metabolism Not Necessarily Related to Aging Nutritiously Happy.url
[2011/08/13 21:05:38 | 000,096,050 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\me.jpg
[2011/08/12 09:15:32 | 000,825,059 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\Full Moon 4 Miler Run-Walk Race.mht
[2011/08/04 17:26:15 | 000,001,615 | —- | C] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2011/07/31 19:01:27 | 000,011,760 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\11CUDAHY1_Results_TXT.mht
[2011/03/13 12:49:11 | 000,000,025 | —- | C] () – C:\WINDOWS\popcinfot.dat
[2011/03/13 12:49:11 | 000,000,000 | —- | C] () – C:\WINDOWS\popcreg.dat
[2011/02/08 17:35:45 | 000,047,888 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011/02/08 17:28:06 | 000,003,584 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/25 10:47:05 | 000,077,824 | R— | C] () – C:\WINDOWS\System32\HPZIDS01.dll
[2011/01/24 14:41:58 | 000,000,159 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Local Settings\Application Data\fusioncache.dat
[2011/01/19 21:33:26 | 000,709,456 | —- | C] () – C:\WINDOWS\is-NVCSD.exe
[2009/03/23 19:42:34 | 000,000,062 | —- | C] () – C:\WINDOWS\dcmvwr.INI
[2008/06/28 18:46:39 | 000,118,669 | —- | C] () – C:\WINDOWS\hpoins09.dat
[2008/04/14 08:59:00 | 000,096,577 | —- | C] () – C:\WINDOWS\hpqins16.dat
[2008/02/01 09:01:27 | 000,118,704 | —- | C] () – C:\WINDOWS\hpoins09.dat.temp
[2008/02/01 09:01:27 | 000,011,645 | —- | C] () – C:\WINDOWS\hpomdl09.dat.temp
[2007/05/18 15:18:09 | 000,000,000 | —- | C] () – C:\WINDOWS\iPlayer.INI
[2006/11/29 21:14:10 | 000,000,214 | —- | C] () – C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2006/11/28 07:44:23 | 000,002,102 | —- | C] () – C:\WINDOWS\ERA.INI
[2006/11/25 08:07:58 | 000,003,217 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2006/11/22 19:58:38 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2006/11/22 08:00:52 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/11/21 22:13:59 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2006/08/20 00:14:25 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/08/19 23:55:51 | 000,028,848 | —- | C] () – C:\WINDOWS\System32\drivers\USBkey.sys
[2006/08/19 23:51:58 | 000,118,842 | R— | C] () – C:\WINDOWS\HPCPCUninstaller-6.3.2.116-9972322.exe
[2006/08/19 23:51:17 | 000,014,317 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2006/08/19 23:51:12 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2006/08/19 23:48:05 | 000,000,219 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2006/08/19 23:38:08 | 000,004,538 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/08/19 23:37:32 | 000,045,929 | —- | C] () – C:\WINDOWS\NSSetDefaultBrowser.EXE
[2006/08/19 23:37:32 | 000,000,698 | —- | C] () – C:\WINDOWS\NSSetDefaultBrowser.ini
[2006/08/19 23:33:20 | 000,095,822 | —- | C] () – C:\WINDOWS\hpqins69.dat
[2006/08/19 23:32:29 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2006/08/19 23:28:29 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2006/08/19 23:28:04 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\Elusetup.exe
[2006/08/19 23:24:46 | 000,348,880 | —- | C] () – C:\WINDOWS\System32\igmedkrn.dll
[2006/08/19 23:24:46 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4624.dll
[2006/08/19 23:06:42 | 000,323,584 | —- | C] () – C:\WINDOWS\System32\pythoncom22.dll
[2006/08/19 23:06:42 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\pywintypes22.dll
[2006/08/19 23:06:26 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2006/06/16 13:58:18 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2006/03/09 12:29:36 | 000,011,645 | —- | C] () – C:\WINDOWS\hpomdl09.dat
[2005/08/30 23:17:40 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2005/08/30 23:07:46 | 000,382,022 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2005/08/30 23:07:46 | 000,053,640 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2005/08/30 23:05:30 | 000,220,040 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2005/08/30 23:01:42 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2005/08/30 22:58:02 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2005/08/05 23:01:54 | 000,239,104 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/09/16 22:24:26 | 003,375,104 | —- | C] () – C:\WINDOWS\System32\qt-mt331.dll
[2004/08/10 06:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/09 23:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/09 23:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/09 23:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/09 23:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/09 23:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/09 23:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/09 23:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/07/26 09:51:38 | 000,000,560 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2001/08/23 10:12:28 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2001/08/23 10:11:02 | 000,004,490 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2001/07/07 04:00:00 | 000,003,399 | —- | C] () – C:\WINDOWS\System32\hptcpmon.ini
========== Alternate Data Streams ==========
@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B1FBBD09
< End of report >
OTL logfile created on: 8/29/2011 6:02:01 AM - Run 3
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1.99 Gb Total Physical Memory | 0.88 Gb Available Physical Memory | 43.99% Memory free
3.84 Gb Paging File | 2.51 Gb Available in Paging File | 65.39% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 224.23 Gb Total Space | 151.51 Gb Free Space | 67.57% Space Free | Partition Type: NTFS
Drive D: | 8.63 Gb Total Space | 0.40 Gb Free Space | 4.69% Space Free | Partition Type: FAT32
Computer Name: YOUR-4DACD0EA75 | User Name: HP_Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Program Files\PopCap Games\Plants vs. Zombies\popcapgame1.exe ()
PRC - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
PRC - C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\WINDOWS\system32\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Program Files\PopCap Games\Plants vs. Zombies\PlantsVsZombies.exe ()
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\WINDOWS\system32\msfeedssync.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Garmin\gStart.exe (GARMIN Corp.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\HPZipm12.exe (HP)
PRC - C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe (Hewlett-Packard)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\ELService.exe (Intel Corporation)
PRC - C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe (Sonic Solutions)
PRC - C:\Program Files\DISC\DISCover.exe (Digital Interactive Systems Corporation)
PRC - C:\Program Files\DISC\DISCUpdMgr.exe (Digital Interactive Systems Corporation, Inc.)
PRC - C:\Program Files\DISC\DiscStreamHub.exe (Digital Interactive Systems Corporation, Inc.)
========== Modules (SafeList) ==========
MOD - C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Local Settings\Temp\IadHide5.dll (BackWeb)
========== Win32 Services (SafeList) ==========
SRV - (HidServ) – File not found
SRV - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (mfevtp) – C:\WINDOWS\system32\mfevtps.exe (McAfee, Inc.)
SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe ()
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (McProxy) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (ELService) Intel® – C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\ELService.exe (Intel Corporation)
========== Driver Services (SafeList) ==========
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (mfehidk) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfefirek) – C:\WINDOWS\system32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\WINDOWS\system32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mfetdi2k) – C:\WINDOWS\system32\drivers\mfetdi2k.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\WINDOWS\system32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfendiskmp) – C:\WINDOWS\system32\drivers\mfendisk.sys (McAfee, Inc.)
DRV - (mfendisk) – C:\WINDOWS\system32\drivers\mfendisk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (cfwids) – C:\WINDOWS\system32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (ELacpi) – C:\WINDOWS\system32\drivers\ELacpi.sys (Intel Corporation)
DRV - (ELmon) – C:\WINDOWS\system32\drivers\Elmon.sys (Intel Corporation)
DRV - (ELkbd) – C:\WINDOWS\system32\drivers\Elkbd.sys (Intel Corporation)
DRV - (ELmou) – C:\WINDOWS\system32\drivers\Elmou.sys (Intel Corporation)
DRV - (ELhid) – C:\WINDOWS\system32\drivers\Elhid.sys (Intel Corporation)
DRV - (Ps2) – C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company)
DRV - (HSXHWBS2) – C:\WINDOWS\system32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.)
DRV - (HSX_DP) – C:\WINDOWS\system32\drivers\HSX_DP.sys (Conexant Systems, Inc.)
DRV - (ftsata2) – C:\WINDOWS\system32\DRIVERS\ftsata2.sys (Promise Technology, Inc.)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (bb-run) – C:\WINDOWS\system32\DRIVERS\bb-run.sys (Promise Technology, Inc.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~1\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.652: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.652: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/06/05 12:45:03 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Browser 8.0.4.0\Extensions\\Components: C:\Program Files\Netscape\Netscape Browser\Components [2011/08/04 17:26:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Browser 8.0.4.0\Extensions\\Plugins: C:\Program Files\Netscape\Netscape Browser\Plugins [2011/08/04 17:26:21 | 000,000,000 | —D | M]
[2011/07/10 21:32:17 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Application Data\Mozilla\Extensions
[2011/01/06 21:15:39 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/10/15 14:43:56 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/06 21:15:39 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2010/11/12 19:53:06 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
O1 HOSTS File: ([2011/01/25 21:03:09 | 000,428,637 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 14760 more lines…
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110619041032.dll (McAfee, Inc.)
O2 - BHO: (hpWebHelper Class) - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll (Hewlett-Packard)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [DMAScheduler] c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe (Sonic Solutions)
O4 - HKLM..\Run: [ftutil2] C:\WINDOWS\System32\ftutil2.dll (Promise Technology, Inc.)
O4 - HKLM..\Run: [HPBootOp] C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [PCDrProfiler] File not found
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [gStart] C:\Program Files\Garmin\gStart.exe (GARMIN Corp.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe (Hewlett-Packard)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Add to Wish List - {76c5fb99-dd0a-4186-9e75-65d1bf3da283} - C:\Program Files\Amazon\Add to Wish List IE Extension\run.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O9 - Extra 'Tools' menuitem : Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: trymedia.com ([]http in Trusted sites)
O15 - HKLM\..Trusted Domains: trymedia.com ([]https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/08/19 23:47:54 | 000,000,100 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/27 08:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O33 - MountPoints2\{9f12eee3-9a77-11e0-99ea-0018f330b671}\Shell - "" = AutoRun
O33 - MountPoints2\{9f12eee3-9a77-11e0-99ea-0018f330b671}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9f12eee3-9a77-11e0-99ea-0018f330b671}\Shell\AutoRun\command - "" = K:\iStudio.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011/08/26 18:18:35 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\McAfee
[2011/08/25 08:09:23 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/08/09 19:07:28 | 000,010,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndistapi.sys
[2011/08/05 09:45:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\!SASCORE
[3 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\*.tmp files -> C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011/08/29 06:04:27 | 000,000,308 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-855813861-3017274974-1318682258-1007.job
[2011/08/29 06:04:27 | 000,000,300 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-855813861-3017274974-1318682258-1007.job
[2011/08/29 06:04:00 | 000,000,906 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/08/29 06:02:13 | 000,000,444 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{E4E916C6-FDB9-42B8-954B-FC48BE0333BE}.job
[2011/08/28 20:18:37 | 002,100,441 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\dress SAM_0366_Converted.JPG
[2011/08/28 20:17:55 | 002,012,955 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\shorts SAM_0379_Converted.JPG
[2011/08/28 20:17:11 | 002,397,396 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\SAM_0375_Converted.JPG
[2011/08/28 20:16:26 | 002,153,036 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\SAM_0374_Converted_Converted.JPG
[2011/08/28 20:13:59 | 002,120,187 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\dress SAM_0367_Converted_Converted.JPG
[2011/08/28 20:13:11 | 002,616,928 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\dress SAM_0364_Converted.JPG
[2011/08/28 20:11:12 | 003,676,038 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\SAM_0361_Converted_Edited.JPG
[2011/08/28 17:38:14 | 000,018,978 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\pink bowls.jpg
[2011/08/28 13:04:00 | 000,000,902 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/08/26 08:46:19 | 000,000,246 | —- | M] () – C:\WINDOWS\System\hpsysdrv.dat
[2011/08/26 08:10:54 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/08/26 08:10:53 | 2137,473,024 | -HS- | M] () – C:\hiberfil.sys
[2011/08/25 08:09:23 | 000,001,553 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/08/25 07:57:01 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/08/24 18:31:57 | 000,021,604 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\dawg.gif
[2011/08/24 16:35:11 | 000,000,214 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\BookMooch Member Home.url
[2011/08/23 16:22:25 | 000,002,102 | —- | M] () – C:\WINDOWS\ERA.INI
[2011/08/23 15:58:47 | 000,014,496 | —- | M] () – C:\WINDOWS\ExercsDA.EQS
[2011/08/23 15:58:47 | 000,011,264 | —- | M] () – C:\WINDOWS\RecmndDA.EQS
[2011/08/23 15:57:35 | 000,008,870 | —- | M] () – C:\WINDOWS\MeasrsDA.EQS
[2011/08/22 22:24:25 | 000,015,136 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\ti84sepink.jpg
[2011/08/22 22:24:23 | 000,152,154 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\calc.bmp
[2011/08/22 19:23:31 | 000,000,325 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\Centennial Trail Map.url
[2011/08/21 18:34:07 | 000,016,199 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\scarp.jpg
[2011/08/21 09:11:16 | 000,038,336 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\wild.jpg
[2011/08/21 09:03:43 | 000,006,224 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\cork.jpg
[2011/08/20 12:39:08 | 006,702,314 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\Copy of Cypress Hill - Insane In The Membrane.mp3
[2011/08/16 14:18:22 | 000,095,232 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\Oct%202011
[2011/08/15 22:15:51 | 000,000,180 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\Study Metabolism Not Necessarily Related to Aging Nutritiously Happy.url
[2011/08/13 20:56:41 | 000,096,050 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\me.jpg
[2011/08/12 09:15:35 | 000,825,059 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\Full Moon 4 Miler Run-Walk Race.mht
[2011/08/10 03:06:56 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/08/05 21:43:16 | 000,001,606 | —- | M] () – C:\Documents and Settings\All Users\Desktop\McAfee AntiVirus Plus.lnk
[2011/08/04 17:26:15 | 000,001,615 | —- | M] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2011/07/31 19:01:28 | 000,011,760 | —- | M] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\11CUDAHY1_Results_TXT.mht
[3 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\*.tmp files -> C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011/08/28 20:21:52 | 001,994,490 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\hoochie SAM_0373.JPG
[2011/08/28 20:21:24 | 002,012,955 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\shorts SAM_0379_Converted.JPG
[2011/08/28 20:21:22 | 002,397,396 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\SAM_0375_Converted.JPG
[2011/08/28 20:21:19 | 002,153,036 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\SAM_0374_Converted_Converted.JPG
[2011/08/28 20:21:17 | 003,676,038 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\SAM_0361_Converted_Edited.JPG
[2011/08/28 20:21:13 | 002,120,187 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\dress SAM_0367_Converted_Converted.JPG
[2011/08/28 20:21:11 | 002,100,441 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\dress SAM_0366_Converted.JPG
[2011/08/28 20:21:09 | 002,616,928 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\dress SAM_0364_Converted.JPG
[2011/08/28 17:38:33 | 000,018,978 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\pink bowls.jpg
[2011/08/25 08:09:23 | 000,001,553 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/08/24 18:32:21 | 000,021,604 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\dawg.gif
[2011/08/22 22:24:35 | 000,015,136 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\ti84sepink.jpg
[2011/08/22 22:24:23 | 000,152,154 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\calc.bmp
[2011/08/22 19:23:31 | 000,000,325 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\Centennial Trail Map.url
[2011/08/21 20:33:53 | 001,975,780 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\SAM_0355.JPG
[2011/08/21 20:33:50 | 001,938,870 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\SAM_0356.JPG
[2011/08/21 20:33:48 | 001,973,641 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\SAM_0357.JPG
[2011/08/21 18:34:27 | 000,016,199 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\scarp.jpg
[2011/08/21 09:11:24 | 000,038,336 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\wild.jpg
[2011/08/21 09:04:52 | 000,006,224 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\cork.jpg
[2011/08/20 12:38:50 | 006,702,314 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\Copy of Cypress Hill - Insane In The Membrane.mp3
[2011/08/16 14:18:21 | 000,095,232 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\Oct%202011
[2011/08/15 22:15:51 | 000,000,180 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\Study Metabolism Not Necessarily Related to Aging Nutritiously Happy.url
[2011/08/13 21:05:38 | 000,096,050 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Desktop\me.jpg
[2011/08/12 09:15:32 | 000,825,059 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\Full Moon 4 Miler Run-Walk Race.mht
[2011/08/04 17:26:15 | 000,001,615 | —- | C] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2011/07/31 19:01:27 | 000,011,760 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\My Documents\11CUDAHY1_Results_TXT.mht
[2011/03/13 12:49:11 | 000,000,025 | —- | C] () – C:\WINDOWS\popcinfot.dat
[2011/03/13 12:49:11 | 000,000,000 | —- | C] () – C:\WINDOWS\popcreg.dat
[2011/02/08 17:35:45 | 000,047,888 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011/02/08 17:28:06 | 000,003,584 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/25 10:47:05 | 000,077,824 | R— | C] () – C:\WINDOWS\System32\HPZIDS01.dll
[2011/01/24 14:41:58 | 000,000,159 | —- | C] () – C:\Documents and Settings\HP_Administrator.YOUR-4DACD0EA75.000\Local Settings\Application Data\fusioncache.dat
[2011/01/19 21:33:26 | 000,709,456 | —- | C] () – C:\WINDOWS\is-NVCSD.exe
[2009/03/23 19:42:34 | 000,000,062 | —- | C] () – C:\WINDOWS\dcmvwr.INI
[2008/06/28 18:46:39 | 000,118,669 | —- | C] () – C:\WINDOWS\hpoins09.dat
[2008/04/14 08:59:00 | 000,096,577 | —- | C] () – C:\WINDOWS\hpqins16.dat
[2008/02/01 09:01:27 | 000,118,704 | —- | C] () – C:\WINDOWS\hpoins09.dat.temp
[2008/02/01 09:01:27 | 000,011,645 | —- | C] () – C:\WINDOWS\hpomdl09.dat.temp
[2007/05/18 15:18:09 | 000,000,000 | —- | C] () – C:\WINDOWS\iPlayer.INI
[2006/11/29 21:14:10 | 000,000,214 | —- | C] () – C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2006/11/28 07:44:23 | 000,002,102 | —- | C] () – C:\WINDOWS\ERA.INI
[2006/11/25 08:07:58 | 000,003,217 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2006/11/22 19:58:38 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2006/11/22 08:00:52 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/11/21 22:13:59 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2006/08/20 00:14:25 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/08/19 23:55:51 | 000,028,848 | —- | C] () – C:\WINDOWS\System32\drivers\USBkey.sys
[2006/08/19 23:51:58 | 000,118,842 | R— | C] () – C:\WINDOWS\HPCPCUninstaller-6.3.2.116-9972322.exe
[2006/08/19 23:51:17 | 000,014,317 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2006/08/19 23:51:12 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2006/08/19 23:48:05 | 000,000,219 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2006/08/19 23:38:08 | 000,004,538 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/08/19 23:37:32 | 000,045,929 | —- | C] () – C:\WINDOWS\NSSetDefaultBrowser.EXE
[2006/08/19 23:37:32 | 000,000,698 | —- | C] () – C:\WINDOWS\NSSetDefaultBrowser.ini
[2006/08/19 23:33:20 | 000,095,822 | —- | C] () – C:\WINDOWS\hpqins69.dat
[2006/08/19 23:32:29 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2006/08/19 23:28:29 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2006/08/19 23:28:04 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\Elusetup.exe
[2006/08/19 23:24:46 | 000,348,880 | —- | C] () – C:\WINDOWS\System32\igmedkrn.dll
[2006/08/19 23:24:46 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4624.dll
[2006/08/19 23:06:42 | 000,323,584 | —- | C] () – C:\WINDOWS\System32\pythoncom22.dll
[2006/08/19 23:06:42 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\pywintypes22.dll
[2006/08/19 23:06:26 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2006/06/16 13:58:18 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2006/03/09 12:29:36 | 000,011,645 | —- | C] () – C:\WINDOWS\hpomdl09.dat
[2005/08/30 23:17:40 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2005/08/30 23:07:46 | 000,382,022 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2005/08/30 23:07:46 | 000,053,640 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2005/08/30 23:05:30 | 000,220,040 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2005/08/30 23:01:42 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2005/08/30 22:58:02 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2005/08/05 23:01:54 | 000,239,104 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/09/16 22:24:26 | 003,375,104 | —- | C] () – C:\WINDOWS\System32\qt-mt331.dll
[2004/08/10 06:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/09 23:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/09 23:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/09 23:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/09 23:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/09 23:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/09 23:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/09 23:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/07/26 09:51:38 | 000,000,560 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2001/08/23 10:12:28 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2001/08/23 10:11:02 | 000,004,490 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2001/07/07 04:00:00 | 000,003,399 | —- | C] () – C:\WINDOWS\System32\hptcpmon.ini
========== Alternate Data Streams ==========
@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B1FBBD09
< End of report >
oldman960
Hi wilma1313,
The log looks good as does the security programs you have on your computer.
From your desktop, please delete
Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.
Take care
The log looks good as does the security programs you have on your computer.
From your desktop, please delete
- any notepads/logs that we created
- DDS.scr
- aswMBR.exe
Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.
Take care
wilma1313
thanks much, good to see you back. Take care and thanks for all of the help.
oldman960
Hi wilma1313,
You are more than welcome.
Keep safe.
oldman960
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI