Solved Hidden Icons Are Everywhere

raylyncorvette · 2010/08/12

[Resolved] Hidden Icons Are Everywhere

Last week I turned on my computer to find a thumbs icon and desktop ini icon sitting there. As I opened other files they too all had the same files showing. My music files not only showed these same icons but they showed the album cover art, the spine, inner page and back page. At first I tried rebooting and then System Restore but that didn't work because after an hour or so the icons re-appeared. But I noticed another icon on my desktop titled Spyware Detector and in the start menu it stated "new program installed ". It appears Max Seure was installig a new "update" but it was actually attacking my file system. So I tried another approach which was to use one of my backups and again after an hour or so all of the icons started showing up again. I worked with msconfig until I found out by shutting down Spyware Detector my problem was resolved. I have since dumped Max Secure Spyware Detector and have no interest in re-installing it again. I'm sure this was the problem from the beginning.

DDS (Ver_10-03-17.01) - NTFSx86
Run by Raymond at 17:47:18.45 on Thu 08/12/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2085 [GMT -5:00]

AV: Norton 360 *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton 360 *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Google\Update\1.2.183.29\GoogleCrashHandler.exe
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Documents and Settings\Raymond\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton 360\Engine\4.2.0.12\ccSvcHst.exe
C:\Program Files\Norton PC Checkup\Engine\2.0.4.131\SymcPCCULaunchSvc.exe
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Norton PC Checkup\Engine\2.0.4.131\ccSvcHst.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wwSecure.exe
C:\Program Files\Norton PC Checkup\Engine\2.0.4.131\ccSvcHst.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\Program Files\Norton 360\Engine\4.2.0.12\ccSvcHst.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
c:\program files\shoutcast radio toolbar\SHOUTcastTbServer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Raymond\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Bar =
uSearch Page =
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://www.bigseekpro.com/cdcovers/{482A09F5-7603-4E38-8BC5-0B96E1335396}
mSearchAssistant =
uURLSearchHooks: ToolbarURLSearchHook Class: {ca3eb689-8f09-4026-aa10-b9534c691ce0} - c:\program files\cdcovers toolbar\tbhelper.dll
mURLSearchHooks: ToolbarURLSearchHook Class: {ca3eb689-8f09-4026-aa10-b9534c691ce0} - c:\program files\cdcovers toolbar\tbhelper.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton 360\engine\4.2.0.12\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton 360\engine\4.2.0.12\IPSBHO.DLL
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.4723.1820\swg.dll
BHO: SHOUTcast Loader: {ccec60fc-2608-4e58-9659-3ffc159e8ea9} - c:\program files\shoutcast radio toolbar\shoutcasttb.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SMTTB2009 Class: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\program files\cdcovers toolbar\tbcore3.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton 360\engine\4.2.0.12\coIEPlg.dll
TB: CDCovers Toolbar: {338b4dfe-2e2c-4338-9e41-e176d497299e} - c:\program files\cdcovers toolbar\tbcore3.dll
TB: SHOUTcast Radio Toolbar: {0457331d-8ca6-4f97-9c26-6a9ef2b2dba8} - c:\program files\shoutcast radio toolbar\shoutcasttb.dll
uRun: [Google Update] "c:\documents and settings\raymond\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Search Protection] c:\program files\yahoo!\search protection\SearchProtection.exe
uRun: [YSearchProtection] c:\program files\yahoo!\search protection\SearchProtection.exe
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [AnyDVD] c:\program files\slysoft\anydvd\AnyDVDtray.exe
uRun: [RocketDock] "c:\program files\rocketdock\RocketDock.exe "
mRun: [Smapp] c:\program files\analog devices\soundmax\SMTray.exe
mRun: [TrueImageMonitor.exe] c:\program files\acronis\trueimage\TrueImageMonitor.exe
mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe "
mRun: [PDF3 Registry Controller] "c:\program files\scansoft\pdf professional 3.0\\RegistryController.exe "
mRun: [YSearchProtection] "c:\program files\yahoo!\search protection\SearchProtection.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [UpdateLBPShortCut] "c:\program files\cyberlink\labelprint\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\labelprint" updatewithcreateonce "software\cyberlink\labelprint\2.5 "
mRun: [MDS_Menu] "c:\program files\cyberlink\mediashow4\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\mediashow4" updatewithcreateonce "software\cyberlink\mediashow\4.1 "
mRun: [UpdateP2GoShortCut] "c:\program files\cyberlink\power2go\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\power2go" updatewithcreateonce "software\cyberlink\power2go\6.0 "
mRun: [UpdatePPShortCut] "c:\program files\cyberlink\powerproducer\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\powerproducer" updatewithcreateonce "software\cyberlink\powerproducer\5.0 "
mRun: [UpdatePSTShortCut] "c:\program files\cyberlink\dvd suite\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\dvd suite" updatewithcreateonce "software\cyberlink\PowerStarter "
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [RemoteControl8] "c:\program files\cyberlink\powerdvd8\PDVD8Serv.exe "
mRun: [PDVD8LanguageShortcut] "c:\program files\cyberlink\powerdvd8\language\Language.exe "
mRun: [itype] "c:\program files\microsoft intellitype pro\itype.exe "
mRun: [ControlCenter3] c:\program files\brother\controlcenter3\brctrcen.exe /autorun
mRun: [CloneCDTray] "c:\program files\slysoft\clonecd\CloneCDTray.exe" /s
mRun: [BrMfcWnd] c:\program files\brother\brmfcmon\BrMfcWnd.exe /AUTORUN
mRun: [YMailAdvisor] "c:\program files\yahoo!\common\YMailAdvisor.exe "
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
IE: &SHOUTcast Search - c:\documents and settings\all users\application data\shoutcast radio toolbar\ietoolbar\resources\en-us\local\search.html
IE: Open with Scansoft PDF Converter 3.0 - c:\program files\scansoft\pdf professional 3.0\IEShellExt.dll /100
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/static/m/cab/2.6.4/GarminAxControl.CAB
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
Notify: LMIinit - LMIinit.dll
Notify: SDNotify - c:\program files\max spyware detector\SDNotify.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Authentication Packages = msv1_0 relog_ap
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe "

============= SERVICES / DRIVERS ===============

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\n360\0402000.00c\symds.sys [2010-5-24 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0402000.00c\symefa.sys [2010-5-24 173104]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\bashdefs\20100719.001\BHDrvx86.sys [2010-8-9 692272]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360\0402000.00c\cchpx86.sys [2010-5-24 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\n360\0402000.00c\ironx86.sys [2010-5-24 116784]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};Power Control [2010/02/05 19:03:44];c:\program files\cyberlink\powerdvd8\000.fcl [2009-8-28 87536]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2008-9-16 10448]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-8-11 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-7-10 47640]
R2 N360;Norton 360;c:\program files\norton 360\engine\4.2.0.12\ccsvchst.exe [2010-5-24 126392]
R2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;c:\program files\norton pc checkup\engine\2.0.4.131\SymcPCCULaunchSvc.exe [2010-7-20 115056]
R2 PCCUJobMgr;Common Client Job Manager Service;c:\program files\norton pc checkup\engine\2.0.4.131\ccSvcHst.exe [2010-7-20 126392]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-6-19 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\ipsdefs\20100809.001\IDSXpx86.sys [2010-8-10 331640]
R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\virusdefs\20100812.002\NAVENG.SYS [2010-8-12 85424]
R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\virusdefs\20100812.002\NAVEX15.SYS [2010-8-12 1362608]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-11-8 133104]
S2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files\roxio\digital home 10\RoxioUpnpService10.exe [2007-8-24 362992]
S2 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxLiveShare10.exe [2007-8-24 309744]
S2 SessionLauncher;SessionLauncher;c:\docume~1\raymond\locals~1\temp\dx9\sessionlauncher.exe --> c:\docume~1\raymond\locals~1\temp\dx9\SessionLauncher.exe [?]
S3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files\roxio\digital home 10\RoxioUPnPRenderer10.exe [2007-8-24 72176]
S3 RoxMediaDB10;RoxMediaDB10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxMediaDB10.exe [2007-8-24 1083888]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
S4 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxWatch10.exe [2007-8-24 166384]

=============== Created Last 30 ================

2010-08-10 01:14:49 8136704 ---ha-w- c:\windows\system32\SecSigDB.BIN
2010-08-10 01:14:49 450000 ---ha-w- c:\windows\system32\NameDB.BIN
2010-07-22 11:37:29 108480 -c--a-w- c:\windows\system32\drivers\AnyDVD.sys
2010-07-20 22:08:24 0 d-----w- c:\windows\system32\drivers\NortonPCCheckup
2010-07-20 22:08:23 0 d-----w- c:\program files\Norton PC Checkup
2010-07-18 19:52:18 0 d-----w- c:\docume~1\raymond\applic~1\Tific
2010-07-18 16:35:06 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2010-07-18 16:35:06 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
2010-07-18 16:35:06 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
2010-07-17 16:12:20 73728 ----a-w- c:\windows\system32\javacpl.cpl

==================== Find3M ====================

2010-07-17 16:12:06 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-04 00:43:38 16400 -c--a-w- c:\windows\system32\drivers\LNonPnP.sys
2010-06-30 12:31:35 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-26 16:06:48 2560 ----a-w- c:\windows\_MSRSTRT.EXE
2010-06-24 12:22:03 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44:04 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27:11 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-20 04:57:31 249856 ------w- c:\windows\Setup1.exe
2010-06-20 04:57:30 73216 ----a-w- c:\windows\ST6UNST.EXE
2010-06-17 14:03:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 07:41:45 1172480 ----a-w- c:\windows\system32\msxml3.dll

============= FINISH: 17:47:47.56 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 9/16/2008 7:43:51 PM
System Uptime: 8/12/2010 6:57:47 AM (11 hours ago)

Motherboard: ASUSTeK Computer Inc. | | K8VSEDX
Processor: AMD Athlon(tm) 64 Processor 3200+ | Socket 754 | 2202/200mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 233 GiB total, 188.98 GiB free.
D: is FIXED (NTFS) - 234 GiB total, 139.71 GiB free.
F: is CDROM ()
G: is CDROM ()
H: is CDROM ()
I: is Removable

==== Disabled Device Manager Items =============

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: RAID Controller
Device ID: PCI\VEN_1106&DEV_3149&SUBSYS_80ED1043&REV_80\3&267A616A&0&78
Manufacturer:
Name: RAID Controller
PNP Device ID: PCI\VEN_1106&DEV_3149&SUBSYS_80ED1043&REV_80\3&267A616A&0&78
Service:

==== System Restore Points ===================

RP641: 6/20/2010 12:53:23 PM - System Checkpoint
RP642: 6/20/2010 6:27:45 PM - Installed Cool & Quiet
RP643: 6/21/2010 4:48:43 PM - Installed Spyware Detector
RP644: 6/21/2010 9:28:55 PM - Norton 360 Registry Clean
RP645: 6/22/2010 5:37:51 PM - Software Distribution Service 3.0
RP646: 6/22/2010 5:44:47 PM - Software Distribution Service 3.0
RP647: 6/22/2010 5:50:07 PM - Software Distribution Service 3.0
RP648: 6/22/2010 5:54:32 PM - Software Distribution Service 3.0
RP649: 6/22/2010 7:08:03 PM - Software Distribution Service 3.0
RP650: 6/23/2010 8:29:14 PM - System Checkpoint
RP651: 6/24/2010 8:40:33 PM - System Checkpoint
RP652: 6/25/2010 9:07:23 PM - System Checkpoint
RP653: 6/26/2010 9:13:13 PM - System Checkpoint
RP654: 6/27/2010 8:16:34 PM - Installed %1 %2.
RP655: 6/28/2010 9:14:54 PM - Norton 360 Registry Clean
RP656: 6/29/2010 5:41:40 PM - Removed Rapport
RP657: 6/30/2010 6:02:08 PM - System Checkpoint
RP658: 7/1/2010 6:36:47 PM - System Checkpoint
RP659: 7/2/2010 6:47:16 PM - System Checkpoint
RP660: 7/3/2010 7:32:39 PM - Installed Windows Media Player 11
RP661: 7/3/2010 7:33:12 PM - Installed Windows XP Wudf01000.
RP662: 7/3/2010 7:37:15 PM - Installed Windows XP MSCompPackV1.
RP663: 7/4/2010 8:01:27 PM - System Checkpoint
RP664: 7/5/2010 8:40:10 PM - System Checkpoint
RP665: 7/6/2010 8:48:07 PM - System Checkpoint
RP666: 7/7/2010 8:52:45 PM - System Checkpoint
RP667: 7/7/2010 11:29:48 PM - Norton 360 Registry Clean
RP668: 7/8/2010 11:59:35 PM - System Checkpoint
RP669: 7/10/2010 12:45:34 AM - System Checkpoint
RP670: 7/10/2010 10:46:06 AM - Paint.NET v3.5.5
RP671: 7/11/2010 2:34:53 AM - Norton 360 Registry Clean
RP672: 7/11/2010 1:24:52 PM - Installed WinZip 14.5
RP673: 7/11/2010 1:27:55 PM - Removed WinZip 14.5
RP674: 7/12/2010 1:41:01 PM - System Checkpoint
RP675: 7/13/2010 2:00:55 PM - System Checkpoint
RP676: 7/13/2010 9:51:12 PM - Software Distribution Service 3.0
RP677: 7/14/2010 9:56:05 PM - System Checkpoint
RP678: 7/16/2010 7:16:49 AM - System Checkpoint
RP679: 7/17/2010 11:05:39 AM - System Checkpoint
RP680: 7/17/2010 11:11:34 AM - Removed Java(TM) 6 Update 20
RP681: 7/18/2010 4:06:23 PM - System Checkpoint
RP682: 7/19/2010 4:40:14 PM - System Checkpoint
RP683: 7/20/2010 9:09:52 PM - System Checkpoint
RP684: 7/21/2010 9:59:27 PM - System Checkpoint
RP685: 7/22/2010 10:03:24 PM - System Checkpoint
RP686: 7/23/2010 10:04:22 PM - Configured SmartSound Quicktracks Plugin
RP687: 7/23/2010 10:09:04 PM - Installed SmartSound "New Standard 22k Library "
RP688: 8/9/2010 7:08:54 PM - Software Distribution Service 3.0
RP689: 8/10/2010 2:36:46 AM - Norton 360 Registry Clean
RP690: 8/11/2010 3:27:45 AM - System Checkpoint
RP691: 8/12/2010 4:00:20 AM - Software Distribution Service 3.0

==== Installed Programs ======================

Acoustica Audio Converter Pro
Acoustica CD/DVD Label Maker
Acoustica Effects Pack
Acoustica Mixcraft 5
Acoustica MP3 Audio Mixer
Acoustica MP3 CD Burner
Acoustica MP3 To Wave Converter PLUS
Acrobat.com
Acronis*True*Image
Active Disk
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Reader 9.3.3
Adobe Shockwave Player 11.5
AnyDVD
Apple Software Update
ASUS Probe V2.22.04
Brother MFL-Pro Suite
C5500n - C5800Ldn Series GDI Driver from OKI® Printing Solutions for Windows
CCleaner
CDCovers Toolbar
Chinese Simplified Fonts Support For Adobe Reader 9
CloneCD
CloneDVD2
Compatibility Pack for the 2007 Office system
Cool & Quiet
Critical Update for Windows Media Player 11 (KB959772)
CyberLink BD Advisor 2.0
CyberLink DVD Suite
CyberLink LabelPrint
CyberLink MediaShow
CyberLink PhotoNow
CyberLink Power2Go
CyberLink PowerBackup
CyberLink PowerDirector
CyberLink PowerDVD 8
CyberLink PowerDVD Copy
CyberLink PowerProducer
Defraggler
DirectXInstallService
DVD Shrink 3.2
EMC 10 Content
erLT
FileHippo.com Update Checker
Folder Marker Pro v 3.0
Garmin USB Drivers
Garmin WebUpdater
GearDrvs
Google Apps
Google Chrome
Google Update Helper
Google Updater
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB942288-v3)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Internet Explorer (Enable DEP)
IomegaWare 4.0.2
Java Auto Updater
Java(TM) 6 Update 21
Knoll Light Factory EZ Studio
LightScribe Applications
LightScribe System Software
LightScribe Template Designs - Architecture Pack 1
LightScribe Template Designs - Art Pack 1
LightScribe Template Designs - Bonus Pack 1
LightScribe Template Designs - Business Pack 1
LightScribe Template Designs - Fantasy Pack 1
LightScribe Template Designs - Floral Pack 1
LightScribe Template Designs - Food-n-Family Pack 1
LightScribe Template Designs - Grab Bag Pack 1
LightScribe Template Designs - Hobby Pack 1
LightScribe Template Designs - Holiday Pack 1
LightScribe Template Designs - Kickin It Pack 1
LightScribe Template Designs - Kids Korner Pack 1
LightScribe Template Designs - Music Pack 1
LightScribe Template Designs - Mythology Pack 1
LightScribe Template Designs - Quick and Simple Pack 1
LightScribe Template Designs - Special Occasion Pack 1
LightScribe Template Designs - Sports Pack 1
LightScribe Template Designs - Street Style Pack 1
LightScribe Template Designs - Tattoo Pack 1
LightScribe Template Designs - Tribal Pack 1
LightScribe Template Designs - Urban Pack 1
LightScribe Template Designs - Wedding Pack 1
LightScribeTemplateLabeler
Logitech SetPoint 6.1
Logitech Updater
LogMeIn
Magic Bullet Looks Studio
Malwarebytes' Anti-Malware
Marvell Miniport Driver
Max Registry Cleaner
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office Standard Edition 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Web Publishing Wizard 1.52
MSM32Installer
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Music Creator 4
MyDefrag v4.3.1
Nero 7 Ultra Edition
Nero PhotoShow Express 4
Nero Sipps
neroxml
Norton 360
Norton PC Checkup
NVIDIA Drivers
OGA Notifier 2.0.0048.0
OKI Color Swatch Utility
Paint.NET v3.5.5
PaperPort Image Printer
ParetoLogic Privacy Controls
Pinnacle Studio 14
Pinnacle Studio Ultimate Collection Plugins
Pinnacle Video Driver
Red Giant ToonIt Studio
RocketDock 1.3.5
Roxio Activation Module
Roxio BackOnTrack
Roxio Central Audio
Roxio Central Copy
Roxio Central Core
Roxio Central Data
Roxio Central Tools
Roxio CinePlayer
Roxio CinePlayer Decoder Pack
Roxio Disc Gallery
Roxio Easy Media Creator 10 Suite
Roxio File Backup
Roxio MediaShare
Roxio Update Manager
ScanSoft PDF Professional 3.0
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
SHOUTcast Radio Toolbar
SmartSound Quicktracks Plugin
SoundMAX
Speccy
Spelling Dictionaries Support For Adobe Reader 9
SureThing Express Labeler
The Print Shop 22
Trapcode 3DStroke Studio
Trapcode Particular Studio
Trapcode Shine Studio
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB982632)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VCRedistSetup
VSO Image Resizer 4.0.0.46
WebFldrs XP
Window Washer
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (03/08/2007 2.2.1.0)
Windows Genuine Advantage Notifications (KB905474)
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player Hotfix [See Q828026 for more information]
Windows PowerShell(TM) 1.0
Windows XP Service Pack 3
WinRAR archiver
Yahoo! Internet Mail
Yahoo! Mail Advisor
Yahoo! Search Protection

==== Event Viewer Messages From Past Week ========

8/9/2010 8:21:43 PM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the MaxWatchDogService service, but this action failed with the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
8/9/2010 8:21:40 PM, error: Service Control Manager [7034] - The MaxDSrv service terminated unexpectedly. It has done this 1 time(s).
8/9/2010 8:21:40 PM, error: Service Control Manager [7031] - The MaxWatchDogService service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 3000 milliseconds: Restart the service.
8/9/2010 8:20:15 PM, error: Service Control Manager [7000] - The SessionLauncher service failed to start due to the following error: The system cannot find the file specified.
8/9/2010 8:19:36 PM, error: NETLOGON [3095] - This computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration.
8/9/2010 8:19:29 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000243' while processing the file 'SrtETmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
8/12/2010 4:28:04 AM, error: Service Control Manager [7000] - The SessionLauncher service failed to start due to the following error: The system cannot find the path specified.
8/12/2010 12:10:49 PM, error: Removable Storage Service [111] - RSM could not load media in drive Drive 0 of library SanDisk Cruzer Micro USB Device.

==== End Of File ===========================

broni · 2010/08/12

What are the current issues?

STEP 1. Download Malwarebytes' Anti-Malware (aka MBAM): http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform Quick Scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

STEP 2. Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
Alternative downloads:
- http://majorgeeks.com/GMER_d5198.html
- http://www.softpedia.com/get/Interne...ers/GMER.shtml
Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
Do NOT use the computer while GMER is running!
When scan is completed, click Save button, and save the results as gmer.log
Warning ! Please, do not select the "Show all" checkbox during the scan.
Post the log to your next reply.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.

STEP 3. Download MBRCheck to your desktop

Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
It will show a black screen with some data on it.
A report called MBRcheckxxxx.txt will be on your desktop
Open this report and post its content in your next reply.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

raylyncorvette · 2010/08/12

Once I removed Spyware Detector and all of its componants my computer came alive again. All of the desktop ini files are staying hidden as before and the thumbs icon is also staying hidden. Music files are back to normal and working as they should. I've had Spyware Detector for a few years now but it seems lately that the program has cuased my system to run a bit slower than before and the last set of updates caused all of the problems. I don't think I'll be using Max Secure products any longer. I have attached all the logs you requested just in case there may still be a problem.

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-12 22:22:01
Windows 5.1.2600 Service Pack 3
Running: lwwy7x7n.exe; Driver: C:\DOCUME~1\Raymond\LOCALS~1\Temp\awrcqaod.sys

---- System - GMER 1.0.15 ----

SSDT 895A7E30 ZwAlertResumeThread
SSDT 8976BE40 ZwAlertThread
SSDT 8954B5D0 ZwAllocateVirtualMemory
SSDT 89652738 ZwAssignProcessToJobObject
SSDT 89635858 ZwConnectPort
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwCreateKey [0xB173D210]
SSDT 8953DBC8 ZwCreateMutant
SSDT 88CC31B8 ZwCreateSymbolicLinkObject
SSDT 8959A660 ZwCreateThread
SSDT 89652770 ZwDebugActiveProcess
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteKey [0xB173D490]
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xB173D9F0]
SSDT 89516BC8 ZwDuplicateObject
SSDT 89554580 ZwFreeVirtualMemory
SSDT 8958F178 ZwImpersonateAnonymousToken
SSDT 89661E00 ZwImpersonateThread
SSDT 89725658 ZwLoadDriver
SSDT 897383E0 ZwMapViewOfSection
SSDT 897D6268 ZwOpenEvent
SSDT 895188A0 ZwOpenProcess
SSDT 89512710 ZwOpenProcessToken
SSDT 897D3740 ZwOpenSection
SSDT 89748818 ZwOpenThread
SSDT 89544F28 ZwProtectVirtualMemory
SSDT 895F6898 ZwResumeThread
SSDT 89533ED0 ZwSetContextThread
SSDT 89542B60 ZwSetInformationProcess
SSDT 897D3708 ZwSetSystemInformation
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xB173DC40]
SSDT 897D6230 ZwSuspendProcess
SSDT 8975AC68 ZwSuspendThread
SSDT 895175D8 ZwTerminateProcess
SSDT 89513C40 ZwTerminateThread
SSDT 8951E950 ZwUnmapViewOfSection
SSDT 8951D448 ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 27B0 80501FE8 4 Bytes JMP 960CA93E
? SYMDS.SYS The system cannot find the file specified. !
? SYMEFA.SYS The system cannot find the file specified. !
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB7CF4360, 0x37388D, 0xE8000020]
.text C:\Program Files\CyberLink\PowerDVD8\000.fcl section is writeable [0xA952C000, 0x2892, 0xE8000020]
.vmp2 C:\Program Files\CyberLink\PowerDVD8\000.fcl entry point in ".vmp2" section [0xA954F050]

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1728] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215501 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1728] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9AD5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1728] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD135 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1728] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1728] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E254666 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1728] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E4B6F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1728] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4AA1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1728] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E4B0C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1728] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4972 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1728] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E49D4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1728] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E4BD2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1728] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4A36 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1728] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 3E2EDB80 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1728] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 3E3E4EF0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3524] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215501 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3524] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9AD5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3524] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD135 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3524] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3524] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E254666 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3524] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E4B6F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3524] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4AA1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3524] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E4B0C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3524] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4972 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3524] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E49D4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3524] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E4BD2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3524] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4A36 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3524] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 3E2EDB80 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3524] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 3E3E4EF0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7372] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215501 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7372] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7372] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E4B6F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7372] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4AA1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7372] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E4B0C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7372] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4972 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7372] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E49D4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7372] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E4BD2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7372] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4A36 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7388] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215501 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7388] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9AD5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7388] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD135 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7388] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7388] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E254666 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7388] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E4B6F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7388] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4AA1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7388] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E4B0C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7388] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4972 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7388] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E49D4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7388] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E4BD2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7388] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4A36 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7388] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 3E2EDB80 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[7388] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 3E3E4EF0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[1728] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[3524] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[7388] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs SiWinAcc.sys (Windows Accelerator Driver/Silicon Image, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device ACPI.sys (ACPI Driver for NT/Microsoft Corporation)
Device Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)

AttachedDevice fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device InCDFs.sys (InCD File System Driver/Nero AG)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls@C:\Documents and Settings\All Users\Documents\Pinnacle\Content\MotionTitles\-Looks\Standard\01 \x2013 Soft Shadow Looks.ixLook 1
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xE2 0x63 0x26 0xF1 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x6A 0x9C 0xD6 0x61 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0xFF 0x7C 0x85 0xE0 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x86 0x8C 0x21 0x01 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xF5 0x1D 0x4D 0x73 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xB0 0x18 0xED 0xA7 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0xFB 0xA7 0x78 0xE6 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x83 0x6C 0x56 0x8B ...
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0x51 0xFA 0x6E 0x91 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0x3D 0xCE 0xEA 0x26 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0xE3 0x0E 0x66 0xD5 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0xFA 0xEA 0x66 0x7F ...

---- EOF - GMER 1.0.15 ----

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x000001ed

Kernel Drivers (total 170):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806D0000 \WINDOWS\system32\hal.dll
0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
0xB9F79000 ACPI.sys
0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xB9F68000 pci.sys
0xBA0A8000 isapnp.sys
0xBA0B8000 ohci1394.sys
0xBA0C8000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xBA5AC000 viaide.sys
0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xBA0D8000 MountMgr.sys
0xB9F49000 ftdisk.sys
0xBA5AE000 dmload.sys
0xB9F23000 dmio.sys
0xBA330000 PartMgr.sys
0xBA0E8000 VolSnap.sys
0xB9F0B000 atapi.sys
0xB9EF5000 UlSata.sys
0xB9EDD000 \WINDOWS\system32\drivers\SCSIPORT.SYS
0xB9EA7000 Si3114r5.sys
0xBA0F8000 disk.sys
0xBA108000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xB9E87000 fltmgr.sys
0xB9E31000 SYMDS.SYS
0xB9E1F000 sr.sys
0xB9DF2000 SYMEFA.SYS
0xBA4BC000 SiWinAcc.sys
0xBA118000 PxHelp20.sys
0xB9DDB000 KSecDD.sys
0xB9D4E000 Ntfs.sys
0xB9D21000 NDIS.sys
0xB9CE4000 timntr.sys
0xBA338000 viaagp1.sys
0xB9CCC000 snapman.sys
0xBA5B0000 SiRemFil.sys
0xB9CB2000 Mup.sys
0xBA128000 gagp30kx.sys
0xBA340000 iomdisk.sys
0xB7CF4000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xB7CE0000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xB94AB000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xB949B000 \SystemRoot\system32\DRIVERS\imapi.sys
0xB7CC7000 \SystemRoot\System32\Drivers\AnyDVD.sys
0xBA3D8000 \SystemRoot\System32\Drivers\ElbyCDFL.sys
0xB948B000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xB947B000 \SystemRoot\system32\DRIVERS\redbook.sys
0xB7CA4000 \SystemRoot\system32\DRIVERS\ks.sys
0xBA3E0000 \SystemRoot\system32\drivers\InCDPass.sys
0xB946B000 \SystemRoot\system32\drivers\InCDRm.sys
0xBA3E8000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xB7C79000 \SystemRoot\system32\DRIVERS\yukonwxp.sys
0xBA3F0000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xB7C55000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xBA3F8000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xB945B000 \SystemRoot\system32\DRIVERS\serial.sys
0xBA400000 \SystemRoot\System32\Drivers\Modem.SYS
0xBA408000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xBA410000 \SystemRoot\system32\DRIVERS\fdc.sys
0xB7C41000 \SystemRoot\system32\DRIVERS\parport.sys
0xB9C42000 \SystemRoot\system32\DRIVERS\serenum.sys
0xB7BB3000 \SystemRoot\system32\drivers\smwdm.sys
0xB7B8F000 \SystemRoot\system32\drivers\portcls.sys
0xB944B000 \SystemRoot\system32\drivers\drmk.sys
0xBA5B2000 \SystemRoot\system32\drivers\aeaudio.sys
0xB943B000 \SystemRoot\system32\DRIVERS\processr.sys
0xBA762000 \SystemRoot\system32\DRIVERS\lmimirr.sys
0xBA763000 \SystemRoot\system32\DRIVERS\audstub.sys
0xBA2F8000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xB9C3E000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB7B78000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xBA308000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xBA318000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xBA418000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xB7B67000 \SystemRoot\system32\DRIVERS\psched.sys
0xBA168000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xBA368000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xB837D000 \SystemRoot\system32\DRIVERS\raspti.sys
0xB7B37000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xBA178000 \SystemRoot\system32\DRIVERS\termdd.sys
0xB8375000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xB836D000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xBA5B4000 \SystemRoot\system32\DRIVERS\swenum.sys
0xB7AD9000 \SystemRoot\system32\DRIVERS\update.sys
0xB9C22000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xB7AAB000 \SystemRoot\system32\DRIVERS\MarvinBus.sys
0xBA2E8000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xB98B8000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xBA5C4000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xBA488000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xB39EA000 \SystemRoot\System32\Drivers\N360\0402000.00C\SRTSP.SYS
0xB39CB000 \SystemRoot\system32\drivers\N360\0402000.00C\Ironx86.SYS
0xB4CCA000 \SystemRoot\system32\drivers\N360\0402000.00C\SRTSPX.SYS
0xB3B2B000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xB3B13000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xB1727000 \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
0xB4C1E000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xB3C0B000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xB34EF000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xB34E7000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
0xB3BFB000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
0xB159D000 \SystemRoot\system32\DRIVERS\Wdf01000.sys
0xB4C1A000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xB34DF000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
0xB1618000 \SystemRoot\system32\drivers\usbaudio.sys
0xB3E91000 \SystemRoot\system32\DRIVERS\BrScnUsb.sys
0xB3E8D000 \SystemRoot\System32\Drivers\BrUsbSer.sys
0xB13F1000 \SystemRoot\System32\Drivers\BrSerIf.sys
0xB2F88000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xB35AD000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xAC834000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xAA972000 \SystemRoot\System32\Drivers\Null.SYS
0xAC832000 \SystemRoot\System32\Drivers\Beep.SYS
0xAB207000 \SystemRoot\System32\drivers\vga.sys
0xBA5E6000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xBA5E8000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xAB02C000 \SystemRoot\System32\Drivers\InCDrec.SYS
0xAA472000 \SystemRoot\system32\drivers\InCDFs.sys
0xAB1FF000 \SystemRoot\System32\Drivers\Msfs.SYS
0xAB1F7000 \SystemRoot\System32\Drivers\Npfs.SYS
0xAB028000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xAA45F000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xAA406000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xAA3AF000 \SystemRoot\System32\Drivers\N360\0402000.00C\SYMTDI.SYS
0xAA389000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xAB151000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xAB141000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xAA334000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100809.001\IDSxpx86.sys
0xAA30C000 \SystemRoot\system32\DRIVERS\netbt.sys
0xAA2EA000 \SystemRoot\System32\drivers\afd.sys
0xBA1C8000 \SystemRoot\system32\DRIVERS\netbios.sys
0xAA2BF000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xAA24F000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA1F8000 \SystemRoot\System32\Drivers\Fips.SYS
0xBA490000 \SystemRoot\System32\Drivers\ElbyCDIO.sys
0xAA1F1000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
0xAA1D4000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
0xAA155000 \SystemRoot\system32\drivers\N360\0402000.00C\ccHPx86.sys
0xAA0A9000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20100719.001\BHDrvx86.sys
0xB16A8000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB4C26000 \SystemRoot\System32\Drivers\dump_diskdump.sys
0xAA093000 \SystemRoot\System32\Drivers\dump_UlSata.sys
0xBF800000 \SystemRoot\System32\win32k.sys
0xB3E9D000 \SystemRoot\System32\drivers\Dxapi.sys
0xB2F90000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xBA7BB000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xB0E32000 \SystemRoot\system32\DRIVERS\tifsfilt.sys
0xB9C66000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA9FAD000 \SystemRoot\system32\drivers\wdmaud.sys
0xB30AF000 \SystemRoot\system32\drivers\sysaudio.sys
0xA9F0A000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xBA648000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB0D15000 \??\C:\WINDOWS\system32\drivers\aslm75.sys
0xBA6F2000 \SystemRoot\System32\Drivers\LBeepKE.sys
0xA9CD3000 \SystemRoot\system32\DRIVERS\srv.sys
0xBA5F0000 \??\C:\Program Files\LogMeIn\x86\RaInfo.sys
0xA9B9B000 \??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
0xA998F000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xA952B000 \??\C:\Program Files\CyberLink\PowerDVD8\000.fcl
0xA9021000 \SystemRoot\System32\Drivers\HTTP.sys
0xAEF5A000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0xA7DF4000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100812.022\NAVEX15.SYS
0xA7DE0000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100812.022\NAVENG.SYS
0xA7CFE000 \??\C:\DOCUME~1\Raymond\LOCALS~1\Temp\awrcqaod.sys
0xA7CD3000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 62):
0 System Idle Process
4 System
800 C:\WINDOWS\system32\smss.exe
872 csrss.exe
900 C:\WINDOWS\system32\winlogon.exe
944 C:\WINDOWS\system32\services.exe
956 C:\WINDOWS\system32\lsass.exe
1120 C:\WINDOWS\system32\svchost.exe
1236 svchost.exe
1332 C:\WINDOWS\system32\svchost.exe
1492 svchost.exe
1656 svchost.exe
1768 C:\WINDOWS\system32\spoolsv.exe
2004 C:\WINDOWS\explorer.exe
316 svchost.exe
424 C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
524 C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
512 C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
604 C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
660 C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
740 C:\Program Files\Google\Update\GoogleUpdate.exe
836 C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
876 C:\Program Files\Google\Update\1.2.183.29\GoogleCrashHandler.exe
1064 C:\PROGRA~1\Iomega\System32\AppServices.exe

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4423

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

8/12/2010 10:36:33 PM
mbam-log-2010-08-12 (22-36-33).txt

Scan type: Quick scan
Objects scanned: 189711
Time elapsed: 7 minute(s), 11 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

broni · 2010/08/12

I'm glad to see, your computer is doing better, but it won't hurt, if we double check.

MBRCheck log is incomplete. Please, re-post/re-run.

raylyncorvette · 2010/08/13

I re-loaded the MBR program and ran a fresh scan. I hope this one is complete.

Thanks

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x000001ed

Kernel Drivers (total 170):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806D0000 \WINDOWS\system32\hal.dll
0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
0xB9F79000 ACPI.sys
0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xB9F68000 pci.sys
0xBA0A8000 isapnp.sys
0xBA0B8000 ohci1394.sys
0xBA0C8000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xBA5AC000 viaide.sys
0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xBA0D8000 MountMgr.sys
0xB9F49000 ftdisk.sys
0xBA5AE000 dmload.sys
0xB9F23000 dmio.sys
0xBA330000 PartMgr.sys
0xBA0E8000 VolSnap.sys
0xB9F0B000 atapi.sys
0xB9EF5000 UlSata.sys
0xB9EDD000 \WINDOWS\system32\drivers\SCSIPORT.SYS
0xB9EA7000 Si3114r5.sys
0xBA0F8000 disk.sys
0xBA108000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xB9E87000 fltmgr.sys
0xB9E31000 SYMDS.SYS
0xB9E1F000 sr.sys
0xB9DF2000 SYMEFA.SYS
0xBA4BC000 SiWinAcc.sys
0xBA118000 PxHelp20.sys
0xB9DDB000 KSecDD.sys
0xB9D4E000 Ntfs.sys
0xB9D21000 NDIS.sys
0xB9CE4000 timntr.sys
0xBA338000 viaagp1.sys
0xB9CCC000 snapman.sys
0xBA5B0000 SiRemFil.sys
0xB9CB2000 Mup.sys
0xBA128000 gagp30kx.sys
0xBA340000 iomdisk.sys
0xB7CF4000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xB7CE0000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xB94AB000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xB949B000 \SystemRoot\system32\DRIVERS\imapi.sys
0xB7CC7000 \SystemRoot\System32\Drivers\AnyDVD.sys
0xBA3D8000 \SystemRoot\System32\Drivers\ElbyCDFL.sys
0xB948B000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xB947B000 \SystemRoot\system32\DRIVERS\redbook.sys
0xB7CA4000 \SystemRoot\system32\DRIVERS\ks.sys
0xBA3E0000 \SystemRoot\system32\drivers\InCDPass.sys
0xB946B000 \SystemRoot\system32\drivers\InCDRm.sys
0xBA3E8000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xB7C79000 \SystemRoot\system32\DRIVERS\yukonwxp.sys
0xBA3F0000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xB7C55000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xBA3F8000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xB945B000 \SystemRoot\system32\DRIVERS\serial.sys
0xBA400000 \SystemRoot\System32\Drivers\Modem.SYS
0xBA408000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xBA410000 \SystemRoot\system32\DRIVERS\fdc.sys
0xB7C41000 \SystemRoot\system32\DRIVERS\parport.sys
0xB9C42000 \SystemRoot\system32\DRIVERS\serenum.sys
0xB7BB3000 \SystemRoot\system32\drivers\smwdm.sys
0xB7B8F000 \SystemRoot\system32\drivers\portcls.sys
0xB944B000 \SystemRoot\system32\drivers\drmk.sys
0xBA5B2000 \SystemRoot\system32\drivers\aeaudio.sys
0xB943B000 \SystemRoot\system32\DRIVERS\processr.sys
0xBA762000 \SystemRoot\system32\DRIVERS\lmimirr.sys
0xBA763000 \SystemRoot\system32\DRIVERS\audstub.sys
0xBA2F8000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xB9C3E000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB7B78000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xBA308000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xBA318000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xBA418000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xB7B67000 \SystemRoot\system32\DRIVERS\psched.sys
0xBA168000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xBA368000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xB837D000 \SystemRoot\system32\DRIVERS\raspti.sys
0xB7B37000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xBA178000 \SystemRoot\system32\DRIVERS\termdd.sys
0xB8375000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xB836D000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xBA5B4000 \SystemRoot\system32\DRIVERS\swenum.sys
0xB7AD9000 \SystemRoot\system32\DRIVERS\update.sys
0xB9C22000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xB7AAB000 \SystemRoot\system32\DRIVERS\MarvinBus.sys
0xBA2E8000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xB98B8000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xBA5C4000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xBA488000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xB39EA000 \SystemRoot\System32\Drivers\N360\0402000.00C\SRTSP.SYS
0xB39CB000 \SystemRoot\system32\drivers\N360\0402000.00C\Ironx86.SYS
0xB4CCA000 \SystemRoot\system32\drivers\N360\0402000.00C\SRTSPX.SYS
0xB3B2B000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xB3B13000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xB1727000 \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
0xB4C1E000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xB3C0B000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xB34EF000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xB34E7000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
0xB3BFB000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
0xB159D000 \SystemRoot\system32\DRIVERS\Wdf01000.sys
0xB4C1A000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xB34DF000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
0xB1618000 \SystemRoot\system32\drivers\usbaudio.sys
0xB3E91000 \SystemRoot\system32\DRIVERS\BrScnUsb.sys
0xB3E8D000 \SystemRoot\System32\Drivers\BrUsbSer.sys
0xB13F1000 \SystemRoot\System32\Drivers\BrSerIf.sys
0xB2F88000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xB35AD000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xAC834000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xAA972000 \SystemRoot\System32\Drivers\Null.SYS
0xAC832000 \SystemRoot\System32\Drivers\Beep.SYS
0xAB207000 \SystemRoot\System32\drivers\vga.sys
0xBA5E6000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xBA5E8000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xAB02C000 \SystemRoot\System32\Drivers\InCDrec.SYS
0xAA472000 \SystemRoot\system32\drivers\InCDFs.sys
0xAB1FF000 \SystemRoot\System32\Drivers\Msfs.SYS
0xAB1F7000 \SystemRoot\System32\Drivers\Npfs.SYS
0xAB028000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xAA45F000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xAA406000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xAA3AF000 \SystemRoot\System32\Drivers\N360\0402000.00C\SYMTDI.SYS
0xAA389000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xAB151000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xAB141000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xAA334000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100809.001\IDSxpx86.sys
0xAA30C000 \SystemRoot\system32\DRIVERS\netbt.sys
0xAA2EA000 \SystemRoot\System32\drivers\afd.sys
0xBA1C8000 \SystemRoot\system32\DRIVERS\netbios.sys
0xAA2BF000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xAA24F000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA1F8000 \SystemRoot\System32\Drivers\Fips.SYS
0xBA490000 \SystemRoot\System32\Drivers\ElbyCDIO.sys
0xAA1F1000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
0xAA1D4000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
0xAA155000 \SystemRoot\system32\drivers\N360\0402000.00C\ccHPx86.sys
0xAA0A9000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20100719.001\BHDrvx86.sys
0xB16A8000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB4C26000 \SystemRoot\System32\Drivers\dump_diskdump.sys
0xAA093000 \SystemRoot\System32\Drivers\dump_UlSata.sys
0xBF800000 \SystemRoot\System32\win32k.sys
0xB3E9D000 \SystemRoot\System32\drivers\Dxapi.sys
0xB2F90000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xBA7BB000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xB0E32000 \SystemRoot\system32\DRIVERS\tifsfilt.sys
0xB9C66000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA9FAD000 \SystemRoot\system32\drivers\wdmaud.sys
0xB30AF000 \SystemRoot\system32\drivers\sysaudio.sys
0xA9F0A000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xBA648000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB0D15000 \??\C:\WINDOWS\system32\drivers\aslm75.sys
0xBA6F2000 \SystemRoot\System32\Drivers\LBeepKE.sys
0xA9CD3000 \SystemRoot\system32\DRIVERS\srv.sys
0xBA5F0000 \??\C:\Program Files\LogMeIn\x86\RaInfo.sys
0xA9B9B000 \??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
0xA998F000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xA952B000 \??\C:\Program Files\CyberLink\PowerDVD8\000.fcl
0xA9021000 \SystemRoot\System32\Drivers\HTTP.sys
0xAEF5A000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0xA7CFE000 \??\C:\DOCUME~1\Raymond\LOCALS~1\Temp\awrcqaod.sys
0xA7BB2000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100813.009\NAVEX15.SYS
0xA7B9E000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100813.009\NAVENG.SYS
0xA7B73000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 63):
0 System Idle Process
4 System
800 C:\WINDOWS\system32\smss.exe
872 csrss.exe
900 C:\WINDOWS\system32\winlogon.exe
944 C:\WINDOWS\system32\services.exe
956 C:\WINDOWS\system32\lsass.exe
1120 C:\WINDOWS\system32\svchost.exe
1236 svchost.exe
1332 C:\WINDOWS\system32\svchost.exe
1492 svchost.exe
1656 svchost.exe
1768 C:\WINDOWS\system32\spoolsv.exe
2004 C:\WINDOWS\explorer.exe
316 svchost.exe
424 C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
524 C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
512 C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
604 C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
660 C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
740 C:\Program Files\Google\Update\GoogleUpdate.exe
836 C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
876 C:\Program Files\Google\Update\1.2.183.29\GoogleCrashHandler.exe
1064 C:\PROGRA~1\Iomega\System32\AppServices.exe
1152 C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
1008 C:\Program Files\Java\jre6\bin\jqs.exe
1276 C:\Program Files\Microsoft IntelliType Pro\itype.exe
1460 C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
1484 C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
1520 C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
1588 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
1676 C:\Program Files\Brother\ControlCenter3\BrccMCtl.exe
1772 C:\Program Files\Logitech\SetPointP\SetPoint.exe
1836 C:\Program Files\Common Files\Java\Java Update\jusched.exe
1852 C:\Documents and Settings\Raymond\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
1860 C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
1888 C:\WINDOWS\system32\ctfmon.exe
1944 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
1972 C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
2068 C:\Program Files\RocketDock\RocketDock.exe
2204 C:\Program Files\LogMeIn\x86\ramaint.exe
2216 C:\Program Files\Brother\Brmfcmon\BrMfcMon.exe
2384 C:\Program Files\LogMeIn\x86\LogMeIn.exe
2428 C:\Program Files\LogMeIn\x86\LMIGuardian.exe
2448 C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
2488 C:\Program Files\Norton 360\Engine\4.2.0.12\ccsvchst.exe
2560 C:\Program Files\Norton PC Checkup\Engine\2.0.4.131\SymcPCCULaunchSvc.exe
2604 C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
2956 C:\WINDOWS\system32\nvsvc32.exe
2988 C:\Program Files\Norton PC Checkup\Engine\2.0.4.131\ccSvcHst.exe
3296 C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
3400 C:\WINDOWS\system32\svchost.exe
3436 C:\WINDOWS\system32\wwSecure.exe
3632 C:\Program Files\Norton PC Checkup\Engine\2.0.4.131\ccSvcHst.exe
3744 C:\Program Files\Iomega\AutoDisk\ADService.exe
4060 C:\Program Files\Norton 360\Engine\4.2.0.12\ccsvchst.exe
3892 alg.exe
2780 C:\Program Files\Internet Explorer\iexplore.exe
5980 C:\Program Files\Internet Explorer\iexplore.exe
7808 C:\Program Files\SHOUTcast Radio Toolbar\shoutcasttbServer.exe
4400 C:\Program Files\Internet Explorer\iexplore.exe
1164 C:\Program Files\Internet Explorer\iexplore.exe
4812 C:\Documents and Settings\Raymond\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: DWCDW5200DJ0-H0BB0, Rev: 800.D280
PhysicalDrive1 Model Number: aMtxro72Y050M, Rev: AY5RE10W

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A
233 GB \\.\PhysicalDrive1 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A

Done!

broni · 2010/08/13

Looks good

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

[color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

Close any open browsers.

[color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

raylyncorvette · 2010/08/13

I just finished running COMBOFIX and I have inserted the C:\ComboFix.txt.

Thanks again

ComboFix 10-08-12.03 - Raymond 08/13/2010 20:32:44.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2346 [GMT -5:00]
Running from: c:\documents and settings\Raymond\Desktop\ComboFix.exe
AV: Norton 360 *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton 360 *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
ADS - WINDOWS: deleted 48 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\CDCovers Toolbar\tbHElper.dll
c:\program files\Internet Explorer\SET26A.tmp
c:\program files\Internet Explorer\SET26E.tmp
c:\program files\Internet Explorer\SET26F.tmp
c:\program files\Internet Explorer\SET6E.tmp
c:\program files\Internet Explorer\SET72.tmp
c:\program files\Internet Explorer\SET73.tmp
c:\program files\Internet Explorer\SET97.tmp
c:\program files\Internet Explorer\SET9B.tmp
c:\program files\Internet Explorer\SET9C.tmp
c:\program files\Internet Explorer\SETD5.tmp
c:\program files\Internet Explorer\SETD9.tmp
c:\program files\Internet Explorer\SETDA.tmp

.
((((((((((((((((((((((((( Files Created from 2010-07-14 to 2010-08-14 )))))))))))))))))))))))))))))))
.

2010-08-14 00:58 . 2010-08-14 00:58 862872 ----a-w- c:\documents and settings\Raymond\Application Data\Yahoo!\SearchProtection\fudogs_2.0.1.13_msgr_bts_setup.2010.04.01.01.exe
2010-08-10 01:14 . 2010-08-10 01:21 8136704 ---ha-w- c:\windows\system32\SecSigDB.BIN
2010-08-10 01:14 . 2010-08-10 01:21 450000 ---ha-w- c:\windows\system32\NameDB.BIN
2010-08-10 01:14 . 2010-06-27 11:47 131584 ----a-w- c:\documents and settings\LocalService\Application Data\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\update_checker.exe
2010-08-10 01:14 . 2010-08-10 01:14 -------- d-----w- c:\documents and settings\LocalService\Application Data\Toolbar4
2010-08-10 01:14 . 2010-07-11 23:17 65313 ----a-w- c:\documents and settings\LocalService\Application Data\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\UninstallToolbar.exe
2010-08-10 01:14 . 2010-02-16 16:57 197632 ----a-w- c:\documents and settings\LocalService\Application Data\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\TbHelper2.exe
2010-08-10 01:14 . 2009-11-25 16:12 56832 ----a-w- c:\documents and settings\LocalService\Application Data\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\update.exe
2010-08-10 01:14 . 2009-11-25 16:12 42496 ----a-w- c:\documents and settings\LocalService\Application Data\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\uninstall.exe
2010-08-10 01:14 . 2010-08-10 01:14 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\SHOUTcast Radio Toolbar
2010-08-09 23:54 . 2010-08-09 23:54 503808 ----a-w- c:\documents and settings\Raymond\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3d540773-n\msvcp71.dll
2010-08-09 23:54 . 2010-08-09 23:54 499712 ----a-w- c:\documents and settings\Raymond\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3d540773-n\jmc.dll
2010-08-09 23:54 . 2010-08-09 23:54 348160 ----a-w- c:\documents and settings\Raymond\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3d540773-n\msvcr71.dll
2010-08-09 23:54 . 2010-08-09 23:54 61440 ----a-w- c:\documents and settings\Raymond\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-54328669-n\decora-sse.dll
2010-08-09 23:54 . 2010-08-09 23:54 12800 ----a-w- c:\documents and settings\Raymond\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-54328669-n\decora-d3d.dll
2010-07-22 11:37 . 2010-07-22 11:37 108480 -c--a-w- c:\windows\system32\drivers\AnyDVD.sys
2010-07-20 22:08 . 2010-07-20 22:09 -------- d-----w- c:\documents and settings\Raymond\Local Settings\Application Data\Tific
2010-07-20 22:08 . 2010-07-20 22:08 -------- d-----w- c:\windows\system32\drivers\NortonPCCheckup
2010-07-20 22:08 . 2010-07-20 22:08 -------- d-----w- c:\program files\Norton PC Checkup
2010-07-18 19:52 . 2010-07-20 22:08 -------- d-----w- c:\documents and settings\Raymond\Application Data\Tific
2010-07-18 18:52 . 2010-07-18 18:52 763920 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-07-18 16:35 . 2007-03-13 04:34 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
2010-07-18 16:35 . 2007-03-13 04:34 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2010-07-18 16:35 . 2007-03-13 04:34 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
2010-07-17 16:12 . 2010-07-17 16:12 -------- d-----w- c:\program files\Common Files\Java
2010-07-17 16:12 . 2010-07-17 16:12 -------- d-----w- c:\program files\Java
2010-07-16 01:11 . 2010-07-16 01:11 -------- d-----w- c:\documents and settings\Raymond\Local Settings\Application Data\ACDPhotoEditor

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-14 01:36 . 2010-07-11 23:17 -------- d-----w- c:\program files\CDCovers Toolbar
2010-08-13 23:48 . 2010-06-02 02:28 -------- d-----w- c:\program files\LogMeIn
2010-08-13 03:27 . 2009-04-06 21:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-09 23:48 . 2010-02-06 05:25 123 -c--a-w- c:\documents and settings\All Users\Application Data\Max Secure\Max Spyware Detector\SysSD.dll
2010-07-24 03:57 . 2008-10-01 22:50 123 -c--a-w- c:\documents and settings\All Users\Application Data\Max Secure\Max Registry Cleaner\SYSRegC.dll
2010-07-24 02:56 . 2010-02-05 02:36 -------- d-----w- c:\program files\Roxio
2010-07-20 22:08 . 2009-08-12 22:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-07-20 22:08 . 2009-08-12 22:49 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-07-20 22:08 . 2010-01-25 17:21 -------- d-----w- c:\program files\NortonInstaller
2010-07-18 22:33 . 2008-09-17 05:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-07-18 22:33 . 2008-09-17 05:07 -------- d-----w- c:\program files\Yahoo!
2010-07-18 19:00 . 2009-10-01 19:21 -------- d-----w- c:\documents and settings\Raymond\Application Data\VSO
2010-07-18 18:54 . 2009-10-01 19:59 -------- d-----w- c:\program files\VSO
2010-07-17 16:13 . 2010-06-20 17:51 -------- d-----w- c:\program files\Speccy
2010-07-17 16:12 . 2010-04-24 18:44 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-12 16:32 . 2010-07-12 16:32 -------- d-----w- c:\documents and settings\Raymond\Application Data\PC-FAX TX
2010-07-12 00:24 . 2010-07-12 00:24 -------- d-----w- c:\program files\SHOUTcast Radio Toolbar
2010-07-12 00:24 . 2010-07-12 00:24 -------- d-----w- c:\documents and settings\All Users\Application Data\SHOUTcast Radio Toolbar
2010-07-11 23:17 . 2010-06-20 17:45 -------- d-----w- c:\documents and settings\Raymond\Application Data\Toolbar4
2010-07-11 18:27 . 2010-07-11 18:24 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
2010-07-10 15:46 . 2010-07-10 15:46 -------- d-----w- c:\program files\Paint.NET
2010-07-04 02:14 . 2010-07-04 00:30 -------- d-----w- c:\program files\MyDefrag v4.3.1
2010-07-04 00:43 . 2008-10-11 23:45 -------- d-----w- c:\program files\Common Files\Logishrd
2010-07-04 00:43 . 2010-03-21 21:30 16400 -c--a-w- c:\windows\system32\drivers\LNonPnP.sys
2010-07-04 00:43 . 2010-07-04 00:42 -------- d-----w- c:\program files\Logitech
2010-07-04 00:43 . 2010-03-21 21:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Logishrd
2010-07-04 00:35 . 2008-09-17 04:01 -------- d-----w- c:\program files\Windows Media Connect 2
2010-07-04 00:28 . 2009-07-11 04:03 -------- d-----w- c:\program files\Defraggler
2010-07-04 00:27 . 2010-06-02 11:44 -------- d-----w- c:\program files\CCleaner
2010-07-04 00:26 . 2009-11-26 13:54 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-07-04 00:24 . 2010-07-04 00:24 -------- d-----w- c:\program files\FileHippo.com
2010-07-03 23:31 . 2008-10-10 01:10 -------- d-----w- c:\program files\Google
2010-06-30 12:31 . 2004-08-04 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-29 23:35 . 2010-06-28 01:18 -------- d-----w- c:\documents and settings\Raymond\Application Data\ElevatedDiagnostics
2010-06-26 16:06 . 2010-06-26 16:06 2560 ----a-w- c:\windows\_MSRSTRT.EXE
2010-06-24 12:22 . 2004-08-04 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2004-08-04 12:00 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-04 12:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-20 23:30 . 2010-06-20 23:27 -------- d-----w- c:\program files\ASUS
2010-06-20 23:27 . 2008-09-17 01:15 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-20 23:27 . 2008-09-17 01:15 -------- d-----w- c:\program files\Common Files\InstallShield
2010-06-20 20:15 . 2008-09-17 15:57 -------- d-----w- c:\program files\Acoustica Mixcraft
2010-06-20 19:05 . 2010-04-03 00:20 -------- d-----w- c:\program files\Acoustica Mixcraft 5
2010-06-20 19:00 . 2008-09-17 15:57 -------- d-----w- c:\program files\Acoustica Shared Effects
2010-06-20 16:21 . 2010-06-20 16:17 -------- d-----w- c:\program files\SpeedFan
2010-06-20 05:06 . 2010-06-20 04:57 -------- d-----w- c:\program files\AsusTempster
2010-06-20 04:57 . 2010-06-20 04:56 249856 ------w- c:\windows\Setup1.exe
2010-06-20 04:57 . 2010-06-20 04:56 73216 ----a-w- c:\windows\ST6UNST.EXE
2010-06-17 14:03 . 2004-08-04 12:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2008-09-17 00:39 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2004-08-04 12:00 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-05-27 17:56 . 2010-05-27 17:56 434176 ------w- c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportMS\17053\RapportMS.dll
2010-05-24 20:55 . 2010-05-24 20:55 503808 ----a-w- c:\documents and settings\Raymond\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-69ff2092-n\msvcp71.dll
2010-05-24 20:55 . 2010-05-24 20:55 499712 ----a-w- c:\documents and settings\Raymond\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-69ff2092-n\jmc.dll
2010-05-24 20:55 . 2010-05-24 20:55 348160 ----a-w- c:\documents and settings\Raymond\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-69ff2092-n\msvcr71.dll
2010-05-24 20:55 . 2010-05-24 20:55 61440 ----a-w- c:\documents and settings\Raymond\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-6a4c4e5a-n\decora-sse.dll
2010-05-24 20:55 . 2010-05-24 20:55 12800 ----a-w- c:\documents and settings\Raymond\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-6a4c4e5a-n\decora-d3d.dll
2010-05-21 22:19 . 2010-06-02 02:30 53120 ----a-w- c:\documents and settings\LogMeInRemoteUser.RAYS-COMPUTER\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-05-21 21:49 . 2010-05-21 21:49 5025192 ----a-w- c:\documents and settings\Raymond\Application Data\Uniblue\Registry Booster2\RB_Setup_5_21_2010.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update "= "c:\documents and settings\Raymond\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-04-18 133104]
"Search Protection "= "c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"YSearchProtection "= "c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"LightScribe Control Panel "= "c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-01-22 2363392]
"AnyDVD "= "c:\program files\SlySoft\AnyDVD\AnyDVDtray.exe" [2010-07-27 4455360]
"RocketDock "= "c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Smapp "= "c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 143360]
"TrueImageMonitor.exe "= "c:\program files\Acronis\TrueImage\TrueImageMonitor.exe" [2005-11-28 988701]
"Acronis Scheduler2 Service "= "c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2005-11-28 118784]
"PDF3 Registry Controller "= "c:\program files\ScanSoft\PDF Professional 3.0\\RegistryController.exe" [2005-07-01 106496]
"YSearchProtection "= "c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"UpdateLBPShortCut "= "c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"MDS_Menu "= "c:\program files\CyberLink\MediaShow4\MUITransfer\MUIStartMenu.exe" [2009-02-25 218408]
"UpdateP2GoShortCut "= "c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"UpdatePPShortCut "= "c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"UpdatePSTShortCut "= "c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-09-08 210216]
"SSBkgdUpdate "= "c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-30 155648]
"RemoteControl8 "= "c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-07-17 91432]
"PDVD8LanguageShortcut "= "c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-16 50472]
"itype "= "c:\program files\Microsoft IntelliType Pro\itype.exe" [2009-11-12 1505144]
"ControlCenter3 "= "c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 65536]
"CloneCDTray "= "c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2009-01-29 57344]
"BrMfcWnd "= "c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-23 663552]
"YMailAdvisor "= "c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2009-05-08 174424]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"EvtMgr6 "= "c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-05-18 1311312]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-01-29 21:17 64592 ------w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-09-29 00:34 87352 ------w- c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=" "
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ADUserMon]
2002-09-24 21:39 147456 ----a-w- c:\program files\Iomega\AutoDisk\ADUserMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
2009-08-29 00:36 75048 -c--a-w- c:\program files\CyberLink\Shared files\brs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer]
2009-06-04 02:59 103720 -c--a-w- c:\program files\CyberLink\Power2Go\CLMLSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Deskup]
2002-07-16 15:55 32768 -c--a-w- c:\program files\Iomega\DriveIcons\deskup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
2007-08-14 09:44 113136 -c--a-w- c:\program files\Roxio\CinePlayer\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2006-07-25 20:55 1043968 ------w- c:\program files\Nero\Nero 7\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Iomega Drive Icons]
2002-08-13 19:30 86016 -c--a-w- c:\program files\Iomega\DriveIcons\Imgicon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
2008-08-11 17:41 63048 ----a-w- c:\program files\LogMeIn\x86\LogMeInSystray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nero PhotoShow Media Manager]
2006-05-10 19:52 249856 ----a-w- c:\progra~1\Nero\NERO7~1\NEROPH~2\data\Xtras\mssysmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Power2GoExpress]
2009-08-03 15:56 2684200 -c--a-w- c:\program files\CyberLink\Power2Go\Power2GoExpress.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PtiuPbmd]
2003-01-15 19:41 24576 -c--a-w- c:\windows\system32\ptipbm.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RCAutoLiveUpdate]
2010-02-12 03:47 761800 -c--a-w- c:\program files\Max Registry Cleaner\MaxLURC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RCSystemTray]
2010-02-12 03:47 651208 -c----w- c:\program files\Max Registry Cleaner\MaxRCSystemTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2007-08-24 21:52 240112 -c--a-w- c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDP]
2010-06-27 11:47 131584 ------w- c:\program files\CDCovers Toolbar\update_checker.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USBToolTip]
2007-02-20 16:07 199752 -c--a-w- c:\progra~1\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Window Washer]
2005-05-11 15:47 1138688 -c--a-w- c:\program files\Webroot\Washer\wwDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"RoxWatch10 "=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe "=
"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\RM.exe "=
"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\Studio.exe "=
"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\umi.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5910:TCP "= 5910:TCP:vnc5910

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0402000.00C\symds.sys [5/24/2010 7:35 PM 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0402000.00C\symefa.sys [5/24/2010 7:35 PM 173104]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20100719.001\BHDrvx86.sys [8/9/2010 7:03 PM 692272]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0402000.00C\cchpx86.sys [5/24/2010 7:35 PM 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0402000.00C\ironx86.sys [5/24/2010 7:35 PM 116784]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};Power Control [2010/02/05 19:03];c:\program files\CyberLink\PowerDVD8\000.fcl [8/28/2009 7:36 PM 87536]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [9/16/2008 11:16 PM 10448]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [8/11/2008 12:41 PM 12856]
R2 N360;Norton 360;c:\program files\Norton 360\Engine\4.2.0.12\ccsvchst.exe [5/24/2010 7:35 PM 126392]
R2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;c:\program files\Norton PC Checkup\Engine\2.0.4.131\SymcPCCULaunchSvc.exe [7/20/2010 5:08 PM 115056]
R2 PCCUJobMgr;Common Client Job Manager Service;c:\program files\Norton PC Checkup\Engine\2.0.4.131\ccSvcHst.exe [7/20/2010 5:08 PM 126392]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [6/19/2010 11:36 AM 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100809.001\IDSXpx86.sys [8/10/2010 10:10 PM 331640]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/8/2009 12:35 PM 133104]
S2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files\Roxio\Digital Home 10\RoxioUpnpService10.exe [8/24/2007 4:53 PM 362992]
S2 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [8/24/2007 4:52 PM 309744]
S2 SessionLauncher;SessionLauncher;c:\docume~1\Raymond\LOCALS~1\Temp\DX9\SessionLauncher.exe --> c:\docume~1\Raymond\LOCALS~1\Temp\DX9\SessionLauncher.exe [?]
S3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [8/24/2007 4:53 PM 72176]
S3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [8/24/2007 4:52 PM 1083888]
S4 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [8/24/2007 4:52 PM 166384]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - AWRCQAOD
*Deregistered* - awrcqaod

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-01-22 17:06 451872 -c--a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-08-13 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-11-08 17:34]

2010-07-24 c:\windows\Tasks\ParetoLogic Privacy Controls_{BFCF5380-96CA-11DF-BFBF-0011D82839F6}.job
- c:\program files\ParetoLogic\Privacy Controls\Pareto_PC.exe [2010-04-23 23:09]

2010-08-13 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2009-08-04 18:19]

2010-08-14 c:\windows\Tasks\User_Feed_Synchronization-{C0EA9736-D8AB-42EB-B129-F405E6D05038}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 09:31]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://www.bigseekpro.com/cdcovers/{482A09F5-7603-4E38-8BC5-0B96E1335396}
IE: &SHOUTcast Search - c:\documents and settings\All Users\Application Data\SHOUTcast Radio Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Open with Scansoft PDF Converter 3.0 - c:\program files\ScanSoft\PDF Professional 3.0\IEShellExt.dll /100
DPF: Garmin Communicator Plug-In - hxxps://my.garmin.com/static/m/cab/2.6.4/GarminAxControl.CAB
.
- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)
Notify-SDNotify - c:\program files\Max Spyware Detector\SDNotify.dll
SafeBoot-MaxDSrv
MSConfigStartUp-CTFMON - (no file)
MSConfigStartUp-SDActiveMonitor - c:\program files\Max Spyware Detector\MaxSDTray.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-13 20:37
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath "= "\ "c:\program files\Norton 360\Engine\4.2.0.12\ccSvcHst.exe\" /s \ "N360\" /m \ "c:\program files\Norton 360\Engine\4.2.0.12\diMaster.dll\" /prefetch:1 "
--

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PCCUJobMgr]
"ImagePath "= "\ "c:\program files\Norton PC Checkup\Engine\2.0.4.131\ccSvcHst.exe\" /s \ "PCCUJobMgr\" /m \ "c:\program files\Norton PC Checkup\Engine\2.0.4.131\diMaster.dll\" /prefetch:1 "

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath "= "\ "\" "

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath "= "\??\c:\program files\CyberLink\PowerDVD8\000.fcl "
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101 "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe "

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(900)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll

- - - - - - - > 'lsass.exe'(956)
c:\windows\system32\relog_ap.dll
.
Completion time: 2010-08-13 20:40:04
ComboFix-quarantined-files.txt 2010-08-14 01:40

Pre-Run: 202,892,972,032 bytes free
Post-Run: 202,900,365,312 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 7CD7B79A76AA6877FA7A45B2C17C4871

broni · 2010/08/13

Looks good now

Uninstall Combofix:
Go Start > Run [Vista users, go Start> "Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall "
Click OK (Vista users - press Enter).
Restart computer.

==============================================================

Download OTL to your Desktop.

* Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
* Under the Custom Scan box paste this in:

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\system32\spool\prtprocs\w32x86\*.tmp
%systemroot%\*. /mp /s
/md5start
/md5stop
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

* Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

raylyncorvette · 2010/08/13

OTL.txt is too large according to the prompt. I have divided it in two parts.

First part of OTL.txt

OTL logfile created on: 8/13/2010 10:42:13 PM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Raymond\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 79.00% Memory free
7.00 Gb Paging File | 7.00 Gb Available in Paging File | 94.00% Paging File free
Paging file location(s): C:\pagefile.sys 4605 4605 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 192.15 Gb Free Space | 82.51% Space Free | Partition Type: NTFS
Drive D: | 233.75 Gb Total Space | 139.73 Gb Free Space | 59.78% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: RAYS-COMPUTER
Current User Name: Raymond
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/08/13 22:40:04 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Raymond\Desktop\OTL.exe
PRC - [2010/07/27 10:26:45 | 004,455,360 | ---- | M] (SlySoft, Inc.) -- C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
PRC - [2010/07/01 18:10:13 | 000,115,056 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton PC Checkup\Engine\2.0.4.131\SymcPCCULaunchSvc.exe
PRC - [2010/06/14 19:32:19 | 000,134,808 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\1.2.183.29\GoogleCrashHandler.exe
PRC - [2010/05/18 15:41:50 | 001,311,312 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPointP\SetPoint.exe
PRC - [2010/05/06 04:32:28 | 000,112,208 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
PRC - [2010/02/25 19:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton 360\Engine\4.2.0.12\ccsvchst.exe
PRC - [2009/11/11 19:04:14 | 001,505,144 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft IntelliType Pro\itype.exe
PRC - [2009/11/11 19:04:12 | 000,444,280 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
PRC - [2009/09/28 19:34:22 | 000,116,032 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\ramaint.exe
PRC - [2009/09/28 19:34:16 | 000,378,176 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LMIGuardian.exe
PRC - [2009/08/24 17:49:41 | 000,126,392 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton PC Checkup\Engine\2.0.4.131\ccSvcHst.exe
PRC - [2009/07/16 21:08:20 | 000,091,432 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
PRC - [2009/05/08 05:53:34 | 000,174,424 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
PRC - [2009/02/03 08:15:18 | 000,111,856 | ---- | M] (Yahoo! Inc) -- C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
PRC - [2009/01/29 17:20:49 | 000,057,344 | ---- | M] (SlySoft, Inc.) -- C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
PRC - [2008/08/11 12:41:00 | 000,063,040 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LogMeIn.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/09/02 13:58:52 | 000,495,616 | ---- | M] () -- C:\Program Files\RocketDock\RocketDock.exe
PRC - [2007/03/23 13:14:52 | 000,663,552 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
PRC - [2007/03/06 19:20:00 | 000,536,576 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files\Brother\ControlCenter3\BrccMCtl.exe
PRC - [2007/03/02 16:48:00 | 000,098,304 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files\Brother\Brmfcmon\BrMfcMon.exe
PRC - [2006/07/25 15:54:54 | 000,849,408 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
PRC - [2005/11/28 15:02:56 | 000,988,701 | ---- | M] (Acronis) -- C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
PRC - [2005/11/28 15:02:54 | 000,172,032 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
PRC - [2005/11/28 15:02:54 | 000,118,784 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
PRC - [2005/05/04 10:15:14 | 000,487,936 | ---- | M] (Webroot Software, Inc.) -- C:\WINDOWS\system32\wwSecure.exe
PRC - [2003/05/05 09:57:30 | 000,143,360 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
PRC - [2002/09/24 16:39:48 | 000,151,552 | ---- | M] (Iomega Corporation) -- C:\Program Files\Iomega\AutoDisk\ADService.exe
PRC - [2002/09/20 17:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
PRC - [2002/09/04 14:11:04 | 000,073,728 | ---- | M] (Iomega Corporation) -- C:\Program Files\Iomega\System32\AppServices.exe

========== Modules (SafeList) ==========

MOD - [2010/08/13 22:40:04 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Raymond\Desktop\OTL.exe
MOD - [2010/05/14 00:35:01 | 000,415,088 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton 360\Engine\4.2.0.12\asoehook.dll
MOD - [2010/04/25 16:54:00 | 000,653,120 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll
MOD - [2010/04/25 16:54:00 | 000,569,664 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll
MOD - [2010/02/04 13:17:27 | 000,129,984 | ---- | M] (SlySoft, Inc.) -- C:\Program Files\SlySoft\AnyDVD\ADvdDiscHlp.dll
MOD - [2008/04/13 19:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
MOD - [2007/09/02 13:57:36 | 000,069,632 | ---- | M] () -- C:\Program Files\RocketDock\RocketDock.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\DOCUME~1\Raymond\LOCALS~1\Temp\DX9\SessionLauncher.exe -- (SessionLauncher)
SRV - File not found [Disabled | Stopped] -- -- (Iomega Activity Disk2)
SRV - [2010/07/01 18:10:13 | 000,115,056 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton PC Checkup\Engine\2.0.4.131\SymcPCCULaunchSvc.exe -- (Norton PC Checkup Application Launcher)
SRV - [2010/05/06 04:29:12 | 000,293,456 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2010/02/25 19:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files\Norton 360\Engine\4.2.0.12\ccSvcHst.exe -- (N360)
SRV - [2009/09/28 19:34:22 | 000,116,032 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files\LogMeIn\x86\RaMaint.exe -- (LMIMaint)
SRV - [2009/08/24 17:49:41 | 000,126,392 | ---- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files\Norton PC Checkup\Engine\2.0.4.131\ccSvcHst.exe -- (PCCUJobMgr)
SRV - [2008/08/11 12:41:00 | 000,063,040 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files\LogMeIn\x86\LogMeIn.exe -- (LogMeIn)
SRV - [2007/08/24 16:53:16 | 000,362,992 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files\Roxio\Digital Home 10\RoxioUpnpService10.exe -- (Roxio Upnp Server 10)
SRV - [2007/08/24 16:53:14 | 000,072,176 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe -- (Roxio UPnP Renderer 10)
SRV - [2007/08/24 16:52:48 | 000,309,744 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe -- (RoxLiveShare10)
SRV - [2007/08/24 16:52:46 | 000,166,384 | ---- | M] (Sonic Solutions) [Disabled | Stopped] -- C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe -- (RoxWatch10)
SRV - [2007/08/24 16:52:38 | 001,083,888 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe -- (RoxMediaDB10)
SRV - [2006/07/25 15:54:54 | 000,849,408 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe -- (InCDsrv)
SRV - [2005/11/28 15:02:54 | 000,172,032 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)
SRV - [2005/05/04 10:15:14 | 000,487,936 | ---- | M] (Webroot Software, Inc.) [Auto | Running] -- C:\WINDOWS\system32\wwSecure.exe -- (wwSecSvc)
SRV - [2002/09/24 16:39:48 | 000,151,552 | ---- | M] (Iomega Corporation) [Auto | Running] -- C:\Program Files\Iomega\AutoDisk\ADService.exe -- (_IOMEGA_ACTIVE_DISK_SERVICE_)
SRV - [2002/09/20 17:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default))
SRV - [2002/09/04 14:11:04 | 000,073,728 | ---- | M] (Iomega Corporation) [Auto | Running] -- C:\Program Files\Iomega\System32\AppServices.exe -- (Iomega App Services)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMNDIS.SYS -- (SYMNDIS)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMIDS.SYS -- (SYMIDS)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMFW.SYS -- (SYMFW)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\Raymond\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - [2010/08/09 19:02:32 | 001,362,608 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100813.009\NAVEX15.SYS -- (NAVEX15)
DRV - [2010/08/09 19:02:32 | 000,085,424 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20100813.009\NAVENG.SYS -- (NAVENG)
DRV - [2010/07/22 06:37:29 | 000,108,480 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2010/07/19 18:28:05 | 000,692,272 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20100719.001\BHDrvx86.sys -- (BHDrvx86)
DRV - [2010/05/28 14:33:19 | 000,331,640 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100813.004\IDSXpx86.sys -- (IDSxpx86)
DRV - [2010/05/26 23:08:10 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010/05/26 23:08:10 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2010/05/05 23:01:59 | 000,361,904 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\N360\0402000.00C\SYMTDI.SYS -- (SYMTDI)
DRV - [2010/04/29 00:03:51 | 000,116,784 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\N360\0402000.00C\Ironx86.SYS -- (SymIRON)
DRV - [2010/04/21 22:02:20 | 000,173,104 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\N360\0402000.00C\SYMEFA.SYS -- (SymEFA)
DRV - [2010/04/21 21:29:50 | 000,325,680 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\WINDOWS\System32\Drivers\N360\0402000.00C\SRTSP.SYS -- (SRTSP)
DRV - [2010/04/21 21:29:50 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\N360\0402000.00C\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2010/03/28 18:31:32 | 000,124,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2010/03/18 04:02:08 | 000,037,328 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2010/03/18 04:01:52 | 000,038,864 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2010/03/18 04:01:12 | 000,010,448 | ---- | M] (Logitech, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE)
DRV - [2010/02/25 19:22:57 | 000,501,888 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\N360\0402000.00C\ccHPx86.sys -- (ccHP)
DRV - [2010/01/01 12:20:34 | 000,026,024 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV - [2009/10/14 22:50:05 | 000,328,752 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\N360\0402000.00C\SYMDS.SYS -- (SymDS)
DRV - [2009/09/28 19:34:48 | 000,083,288 | ---- | M] (LogMeIn, Inc.) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\LMIRfsClientNP.dll -- (LMIRfsClientNP)
DRV - [2009/08/28 19:36:24 | 000,087,536 | ---- | M] (CyberLink Corp.) [2010/02/05 19:03:44] [Kernel | Auto | Running] -- C:\Program Files\CyberLink\PowerDVD8\000.fcl -- ({FE4C91E7-22C2-4D0C-9F6B-82F1B7742054})
DRV - [2009/01/01 18:13:47 | 000,249,152 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\timntr.sys -- (timounter)
DRV - [2009/01/01 18:13:47 | 000,030,688 | ---- | M] (Acronis) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\tifsfilt.sys -- (tifsfilter)
DRV - [2009/01/01 18:13:45 | 000,096,320 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\snapman.sys -- (snapman)
DRV - [2008/11/25 01:35:54 | 000,211,496 | ---- | M] (Silicon Image, Inc) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Si3114r5.sys -- (Si3114r5)
DRV - [2008/11/25 01:35:54 | 000,017,064 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\SiWinAcc.sys -- (SiFilter)
DRV - [2008/11/25 01:35:54 | 000,012,200 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\SiRemFil.sys -- (SiRemFil)
DRV - [2008/08/11 12:41:00 | 000,047,640 | ---- | M] (LogMeIn, Inc.) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\LMIRfsDriver.sys -- (LMIRfsDriver)
DRV - [2008/08/11 12:41:00 | 000,012,856 | ---- | M] (LogMeIn, Inc.) [Kernel | Auto | Running] -- C:\Program Files\LogMeIn\x86\rainfo.sys -- (LMIInfo)
DRV - [2008/05/16 14:01:00 | 006,557,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2008/04/13 13:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2007/08/18 04:09:04 | 000,057,328 | ---- | M] (Sonic Solutions) [File_System | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\RxFilter.sys -- (RxFilter)
DRV - [2007/02/15 19:57:04 | 000,034,760 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ElbyCDFL.sys -- (ElbyCDFL)
DRV - [2006/12/12 11:28:26 | 000,052,224 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BrSerIf.sys -- (BrSerIf)
DRV - [2006/09/03 09:53:54 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BrUsbSer.sys -- (BrUsbSer)
DRV - [2006/07/25 15:54:02 | 000,033,792 | ---- | M] (Nero AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\InCDRm.sys -- (incdrm)
DRV - [2006/07/25 15:52:46 | 000,031,488 | ---- | M] (Nero AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\InCDPass.sys -- (InCDPass)
DRV - [2006/07/25 15:51:56 | 000,102,912 | ---- | M] (Nero AG) [File_System | Disabled | Running] -- C:\WINDOWS\system32\drivers\InCDfs.sys -- (InCDfs)
DRV - [2006/05/10 09:56:54 | 000,027,264 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LHidKE.Sys -- (LHidKe)
DRV - [2006/05/10 09:56:50 | 000,071,680 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE)
DRV - [2005/09/23 22:18:32 | 000,171,520 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\MarvinBus.sys -- (MarvinBus)
DRV - [2004/10/15 12:50:20 | 000,015,295 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BrScnUsb.sys -- (BrScnUsb)
DRV - [2003/11/10 06:30:00 | 000,174,464 | ---- | M] (Marvell Semiconductor Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yukonwxp.sys -- (yukonwxp)
DRV - [2003/07/02 04:42:00 | 000,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys -- (viaagp1)
DRV - [2003/06/03 06:03:00 | 000,055,808 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\UlSata.sys -- (UlSata)
DRV - [2002/09/04 14:11:08 | 000,030,258 | ---- | M] (Iomega Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\iomdisk.sys -- (iomdisk)
DRV - [1997/04/22 10:16:00 | 000,006,272 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\ASLM75.SYS -- (aslm75)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/cdcovers/{482A09F5-7603-4E38-8BC5-0B96E1335396}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://red.clientapps.yahoo.com/cus.../sbcydsl/*http://www.yahoo.com/search/ie.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 98 8B 24 63 9F 10 CB 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://red.clientapps.yahoo.com/cus.../sbcydsl/*http://www.yahoo.com/search/ie.html
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\IPSFFPlgn\ [2010/05/26 20:05:32 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\coFFPlgn\ [2010/03/28 18:36:37 | 000,000,000 | ---D | M]

O1 HOSTS File: ([2010/08/13 20:37:34 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\4.2.0.12\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.)
O2 - BHO: (SHOUTcast Loader) - {ccec60fc-2608-4e58-9659-3ffc159e8ea9} - C:\Program Files\SHOUTcast Radio Toolbar\shoutcasttb.dll (AOL LLC)
O2 - BHO: (SMTTB2009 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\CDCovers Toolbar\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (SHOUTcast Radio Toolbar) - {0457331d-8ca6-4f97-9c26-6a9ef2b2dba8} - C:\Program Files\SHOUTcast Radio Toolbar\shoutcasttb.dll (AOL LLC)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (SHOUTcast Radio Toolbar) - {0457331D-8CA6-4F97-9C26-6A9EF2B2DBA8} - C:\Program Files\SHOUTcast Radio Toolbar\shoutcasttb.dll (AOL LLC)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\4.2.0.12\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [CloneCDTray] C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe (SlySoft, Inc.)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [itype] c:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4 - HKLM..\Run: [MDS_Menu] C:\Program Files\CyberLink\MediaShow4\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PDF3 Registry Controller] C:\Program Files\ScanSoft\PDF Professional 3.0\RegistryController.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Scansoft, Inc.)
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe (Acronis)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePPShortCut] C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [YMailAdvisor] C:\Program Files\Yahoo!\Common\YMailAdvisor.exe (Yahoo! Inc.)
O4 - HKLM..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
O4 - HKCU..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)
O4 - HKCU..\Run: [RocketDock] C:\Program Files\RocketDock\RocketDock.exe ()
O4 - HKCU..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
O4 - HKCU..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &SHOUTcast Search - C:\Documents and Settings\All Users\Application Data\SHOUTcast Radio Toolbar\ieToolbar\resources\en-US\local\search.html ()
O8 - Extra context menu item: Open with Scansoft PDF Converter 3.0 - C:\Program Files\ScanSoft\PDF Professional 3.0\IEShellExt.dll (ScanSoft, Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: Garmin Communicator Plug-In https://my.garmin.com/static/m/cab/2.6.4/GarminAxControl.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O20 - Winlogon\Notify\LMIinit: DllName - LMIinit.dll - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Raymond\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Raymond\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O30 - LSA: Authentication Packages - (relog_ap) - C:\WINDOWS\System32\relog_ap.dll (Acronis)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/09/16 19:41:36 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: aux - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: MIDI2 - C:\WINDOWS\System32\Syncor11.dll (SoundMAX)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\WINDOWS\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.iyuv - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.LEAD - LCODCCMP.DLL File not found
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.mjpg - pvmjpg30.dll File not found
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: vidc.uyvy - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yuy2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvu9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvyu - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)
Unable to start service SrService!

========== Files/Folders - Created Within 90 Days ==========

[2010/08/13 22:40:02 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Raymond\Desktop\OTL.exe
[2010/08/13 20:45:18 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/08/13 20:29:58 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/08/13 20:27:53 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/08/12 23:03:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\Desktop\Log Files
[2010/08/09 20:14:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Toolbar4
[2010/08/09 20:14:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\SHOUTcast Radio Toolbar
[2010/07/23 22:21:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\My Documents\Rocket Dock Icons
[2010/07/22 06:37:29 | 000,108,480 | ---- | C] (SlySoft, Inc.) -- C:\WINDOWS\System32\drivers\AnyDVD.sys
[2010/07/20 17:08:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\Local Settings\Application Data\Tific
[2010/07/20 17:08:24 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\NortonPCCheckup
[2010/07/20 17:08:24 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\NortonPCCheckup\0200040.083
[2010/07/20 17:08:23 | 000,000,000 | ---D | C] -- C:\Program Files\Norton PC Checkup
[2010/07/18 14:52:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\Application Data\Tific
[2010/07/17 11:12:44 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/07/17 11:12:20 | 000,153,376 | ---- | C] (Oracle) -- C:\WINDOWS\System32\javaws.exe
[2010/07/17 11:12:20 | 000,145,184 | ---- | C] (Oracle) -- C:\WINDOWS\System32\javaw.exe
[2010/07/17 11:12:20 | 000,073,728 | ---- | C] (Oracle) -- C:\WINDOWS\System32\javacpl.cpl
[2010/07/17 11:12:19 | 000,145,184 | ---- | C] (Oracle) -- C:\WINDOWS\System32\java.exe
[2010/07/17 11:12:05 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2010/07/15 20:11:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\Local Settings\Application Data\ACDPhotoEditor
[2010/07/12 11:32:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\Application Data\PC-FAX TX
[2010/07/11 19:24:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\Local Settings\Application Data\SHOUTcast Radio Toolbar
[2010/07/11 19:24:41 | 000,000,000 | ---D | C] -- C:\Program Files\SHOUTcast Radio Toolbar
[2010/07/11 19:24:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SHOUTcast Radio Toolbar
[2010/07/11 18:17:04 | 000,000,000 | ---D | C] -- C:\Program Files\CDCovers Toolbar
[2010/07/11 13:24:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2010/07/10 10:46:07 | 000,000,000 | ---D | C] -- C:\Program Files\Paint.NET
[2010/07/10 10:46:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\Local Settings\Application Data\Paint.NET
[2010/07/03 19:42:54 | 000,000,000 | ---D | C] -- C:\Program Files\Logitech
[2010/07/03 19:30:16 | 000,000,000 | ---D | C] -- C:\Program Files\MyDefrag v4.3.1
[2010/07/03 19:24:37 | 000,000,000 | ---D | C] -- C:\Program Files\FileHippo.com
[2010/06/28 07:02:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\Application Data\WinRAR
[2010/06/28 06:59:25 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2010/06/27 20:54:17 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Raymond\Desktop\TOOLS
[2010/06/27 20:18:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\Application Data\ElevatedDiagnostics
[2010/06/27 20:16:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\windowspowershell
[2010/06/26 08:14:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\My Documents\Computer Issues
[2010/06/26 08:11:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\My Documents\Movie Lists
[2010/06/26 08:11:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\My Documents\Ejecting DVD
[2010/06/26 08:09:47 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Raymond\My Documents\Texas Military Museum
[2010/06/22 19:10:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\Local Settings\Application Data\PCHealth
[2010/06/22 17:37:56 | 000,000,000 | ---D | C] -- C:\b28898ec0ff76c65785466
[2010/06/21 16:16:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\Local Settings\Application Data\Max Secure Software
[2010/06/20 18:30:30 | 000,299,008 | ---- | C] (InstallShield Corporation, Inc.) -- C:\WINDOWS\uninst.exe
[2010/06/20 18:30:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\WINDOWS
[2010/06/20 18:27:45 | 000,000,000 | ---D | C] -- C:\Program Files\ASUS
[2010/06/20 12:51:31 | 000,000,000 | ---D | C] -- C:\Program Files\Speccy
[2010/06/20 12:45:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\Application Data\Toolbar4
[2010/06/20 11:17:58 | 000,000,000 | ---D | C] -- C:\Program Files\SpeedFan
[2010/06/19 23:57:44 | 000,000,000 | ---D | C] -- C:\Program Files\AsusTempster
[2010/06/13 13:32:44 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Raymond\Recent
[2010/06/12 10:34:40 | 000,000,000 | ---D | C] -- C:\Program Files\RocketDock
[2010/06/02 06:44:14 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2010/06/02 00:15:23 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2010/06/02 00:02:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\Application Data\GlarySoft
[2010/06/02 00:00:53 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Raymond\My Documents\My pictures
[2010/06/01 23:41:34 | 000,116,224 | ---- | C] (Xerox) -- C:\WINDOWS\System32\dllcache\xrxwiadr.dll
[2010/06/01 23:41:30 | 000,023,040 | ---- | C] (Xerox Corporation) -- C:\WINDOWS\System32\dllcache\xrxwbtmp.dll
[2010/06/01 23:40:54 | 000,099,865 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\xlog.exe
[2010/06/01 23:40:49 | 000,016,970 | ---- | C] (US Robotics MCD (Megahertz)) -- C:\WINDOWS\System32\dllcache\xem336n5.sys
[2010/06/01 23:40:22 | 000,154,624 | ---- | C] (Lucent Technologies) -- C:\WINDOWS\System32\dllcache\wlluc48.sys
[2010/06/01 23:40:18 | 000,034,890 | ---- | C] (Raytheon Corp.) -- C:\WINDOWS\System32\dllcache\wlandrv2.sys
[2010/06/01 23:40:09 | 000,771,581 | ---- | C] (Rockwell) -- C:\WINDOWS\System32\dllcache\winacisa.sys
[2010/06/01 23:39:49 | 000,035,871 | ---- | C] (Winbond Electronics Corp.) -- C:\WINDOWS\System32\dllcache\wbfirdma.sys
[2010/06/01 23:39:34 | 000,016,925 | ---- | C] (Winbond Electronics Corporation) -- C:\WINDOWS\System32\dllcache\w940nd.sys
[2010/06/01 23:39:30 | 000,019,016 | ---- | C] (Winbond Electronics Corporation) -- C:\WINDOWS\System32\dllcache\w926nd.sys
[2010/06/01 23:39:26 | 000,019,528 | ---- | C] (Winbond Electronics Corporation) -- C:\WINDOWS\System32\dllcache\w840nd.sys
[2010/06/01 23:39:20 | 000,064,605 | ---- | C] (PCtel, Inc.) -- C:\WINDOWS\System32\dllcache\vvoice.sys
[2010/06/01 23:39:16 | 000,397,502 | ---- | C] (PCtel, Inc.) -- C:\WINDOWS\System32\dllcache\vpctcom.sys
[2010/06/01 23:39:11 | 000,604,253 | ---- | C] (PCTEL, INC.) -- C:\WINDOWS\System32\dllcache\vmodem.sys
[2010/06/01 23:39:07 | 000,249,402 | ---- | C] (Xircom) -- C:\WINDOWS\System32\dllcache\vinwm.sys
[2010/06/01 23:38:49 | 000,765,884 | ---- | C] (U.S. Robotics, Inc.) -- C:\WINDOWS\System32\dllcache\usrti.sys
[2010/06/01 23:38:33 | 000,794,399 | ---- | C] (U.S. Robotics, Inc.) -- C:\WINDOWS\System32\dllcache\usr1806v.sys
[2010/06/01 23:38:30 | 000,793,598 | ---- | C] (U.S. Robotics, Inc.) -- C:\WINDOWS\System32\dllcache\usr1806.sys
[2010/06/01 23:38:26 | 000,794,654 | ---- | C] (U.S. Robotics, Inc.) -- C:\WINDOWS\System32\dllcache\usr1801.sys
[2010/06/01 23:38:21 | 000,032,384 | ---- | C] (KLSI USA, Inc.) -- C:\WINDOWS\System32\dllcache\usb101et.sys
[2010/06/01 23:38:00 | 000,050,688 | ---- | C] (UMAX DATA SYSTEMS INC.) -- C:\WINDOWS\System32\dllcache\umaxscan.dll
[2010/06/01 23:37:46 | 000,211,968 | ---- | C] (UMAX Data Systems Inc.) -- C:\WINDOWS\System32\dllcache\um54scan.dll
[2010/06/01 23:37:43 | 000,216,064 | ---- | C] (UMAX Data Systems Inc.) -- C:\WINDOWS\System32\dllcache\um34scan.dll
[2010/06/01 23:37:28 | 000,166,784 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tridxpm.sys
[2010/06/01 23:37:24 | 000,525,568 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tridxp.dll
[2010/06/01 23:37:20 | 000,159,232 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tridkbm.sys
[2010/06/01 23:37:17 | 000,440,576 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tridkb.dll
[2010/06/01 23:37:13 | 000,222,336 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\trid3dm.sys
[2010/06/01 23:37:10 | 000,315,520 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\trid3d.dll
[2010/06/01 23:36:36 | 000,123,995 | ---- | C] (Tiger Jet Network) -- C:\WINDOWS\System32\dllcache\tjisdn.sys
[2010/06/01 23:36:30 | 000,138,528 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tgiulnt5.sys
[2010/06/01 23:36:27 | 000,081,408 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\tgiul50.dll
[2010/06/01 23:36:26 | 000,149,376 | ---- | C] (M-Systems) -- C:\WINDOWS\System32\dllcache\tffsport.sys
[2010/06/01 23:36:21 | 000,017,129 | ---- | C] (TDK Corporation) -- C:\WINDOWS\System32\dllcache\tdkcd31.sys
[2010/06/01 23:36:18 | 000,037,961 | ---- | C] (TDK Corporation) -- C:\WINDOWS\System32\dllcache\tdk100b.sys
[2010/06/01 23:36:05 | 000,036,640 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\t2r4mini.sys
[2010/06/01 23:36:02 | 000,172,768 | ---- | C] (Number Nine Visual Technology) -- C:\WINDOWS\System32\dllcache\t2r4disp.dll
[2010/06/01 23:35:17 | 000,155,648 | ---- | C] (Stallion Technologies) -- C:\WINDOWS\System32\dllcache\stlnprop.dll
[2010/06/01 23:35:14 | 000,053,248 | ---- | C] (Stallion Technologies) -- C:\WINDOWS\System32\dllcache\stlncoin.dll
[2010/06/01 23:35:11 | 000,285,760 | ---- | C] (Stallion Technologies) -- C:\WINDOWS\System32\dllcache\stlnata.sys
[2010/06/01 23:35:07 | 000,016,896 | ---- | C] (SCM Microsystems, Inc.) -- C:\WINDOWS\System32\dllcache\stcusb.sys
[2010/06/01 23:35:00 | 000,048,736 | ---- | C] (3Com) -- C:\WINDOWS\System32\dllcache\srwlnd5.sys
[2010/06/01 23:34:39 | 000,019,072 | ---- | C] (Adaptec, Inc.) -- C:\WINDOWS\System32\dllcache\sparrow.sys
[2010/06/01 23:33:13 | 000,058,368 | ---- | C] (Silicon Motion Inc.) -- C:\WINDOWS\System32\dllcache\smiminib.sys
[2010/06/01 23:33:09 | 000,147,200 | ---- | C] (Silicon Motion Inc.) -- C:\WINDOWS\System32\dllcache\smidispb.dll
[2010/06/01 23:33:06 | 000,025,034 | ---- | C] (SMC Networks, Inc.) -- C:\WINDOWS\System32\dllcache\smcpwr2n.sys
[2010/06/01 23:33:03 | 000,035,913 | ---- | C] (SMC) -- C:\WINDOWS\System32\dllcache\smcirda.sys
[2010/06/01 23:32:59 | 000,024,576 | ---- | C] (SMC Networks, Inc.) -- C:\WINDOWS\System32\dllcache\smc8000n.sys
[2010/06/01 23:32:32 | 000,063,547 | ---- | C] (Symbol Technologies) -- C:\WINDOWS\System32\dllcache\sla30nd5.sys
[2010/06/01 23:32:29 | 000,091,294 | ---- | C] (SysKonnect, a business unit of Schneider & Koch & Co. Datensysteme GmbH.) -- C:\WINDOWS\System32\dllcache\skfpwin.sys
[2010/06/01 23:32:26 | 000,094,698 | ---- | C] (SysKonnect GmbH.) -- C:\WINDOWS\System32\dllcache\sk98xwin.sys
[2010/06/01 23:32:19 | 000,032,768 | ---- | C] (SiS Corporation) -- C:\WINDOWS\System32\dllcache\sisnic.sys
[2010/06/01 23:31:52 | 000,161,568 | ---- | C] (Micro Systemation) -- C:\WINDOWS\System32\dllcache\sgsmusb.sys
[2010/06/01 23:31:49 | 000,018,400 | ---- | C] (Micro Systemation) -- C:\WINDOWS\System32\dllcache\sgsmld.sys
[2010/06/01 23:31:45 | 000,098,080 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\sgiulnt5.sys
[2010/06/01 23:31:42 | 000,386,560 | ---- | C] (Trident Microsystems Inc.) -- C:\WINDOWS\System32\dllcache\sgiul50.dll
[2010/06/01 23:30:55 | 000,017,280 | ---- | C] (SCM Microsystems) -- C:\WINDOWS\System32\dllcache\scr111.sys
[2010/06/01 23:30:48 | 000,023,936 | ---- | C] (OMNIKEY AG) -- C:\WINDOWS\System32\dllcache\sccmusbm.sys

raylyncorvette · 2010/08/13

Second part of OTL.txt

[2010/06/01 23:30:45 | 000,023,936 | ---- | C] (OMNIKEY AG) -- C:\WINDOWS\System32\dllcache\sccmn50m.sys
[2010/06/01 23:30:29 | 000,077,824 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3sav4m.sys
[2010/06/01 23:30:26 | 000,198,400 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3sav4.dll
[2010/06/01 23:30:23 | 000,061,504 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3sav3dm.sys
[2010/06/01 23:30:20 | 000,179,264 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3sav3d.dll
[2010/06/01 23:30:17 | 000,210,496 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3mvirge.dll
[2010/06/01 23:30:14 | 000,062,496 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3mtrio.dll
[2010/06/01 23:30:11 | 000,041,216 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3mt3d.sys
[2010/06/01 23:30:08 | 000,182,272 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3mt3d.dll
[2010/06/01 23:30:04 | 000,166,720 | ---- | C] (S3 Incorporated) -- C:\WINDOWS\System32\dllcache\s3m.sys
[2010/06/01 23:29:57 | 000,082,432 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia450.dll
[2010/06/01 23:29:54 | 000,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia430.dll
[2010/06/01 23:29:53 | 000,029,696 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rw450ext.dll
[2010/06/01 23:29:52 | 000,027,648 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rw430ext.dll
[2010/06/01 23:29:49 | 000,020,992 | ---- | C] (Realtek Semiconductor Corporation) -- C:\WINDOWS\System32\dllcache\rtl8139.sys
[2010/06/01 23:29:46 | 000,019,017 | ---- | C] (Realtek Semiconductor Corporation) -- C:\WINDOWS\System32\dllcache\rtl8029.sys
[2010/06/01 23:29:39 | 000,009,216 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\rsmgrstr.dll
[2010/06/01 23:29:33 | 000,079,104 | ---- | C] (Comtrol Corporation) -- C:\WINDOWS\System32\dllcache\rocket.sys
[2010/06/01 23:29:29 | 000,037,563 | ---- | C] (RadioLAN) -- C:\WINDOWS\System32\dllcache\rlnet5.sys
[2010/06/01 23:29:26 | 000,086,097 | ---- | C] (Xircom) -- C:\WINDOWS\System32\dllcache\reslog32.dll
[2010/06/01 23:29:09 | 000,714,762 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\r2mdmkxx.sys
[2010/06/01 23:29:06 | 000,899,146 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\r2mdkxga.sys
[2010/06/01 23:28:34 | 000,130,942 | ---- | C] (PCTEL, INC.) -- C:\WINDOWS\System32\dllcache\ptserlv.sys
[2010/06/01 23:28:31 | 000,112,574 | ---- | C] (PCTEL, INC.) -- C:\WINDOWS\System32\dllcache\ptserlp.sys
[2010/06/01 23:28:28 | 000,128,286 | ---- | C] (PCTEL, INC.) -- C:\WINDOWS\System32\dllcache\ptserli.sys
[2010/06/01 23:28:16 | 000,016,128 | ---- | C] (SCM Microsystems, Inc.) -- C:\WINDOWS\System32\dllcache\pscr.sys
[2010/06/01 23:27:25 | 000,169,984 | ---- | C] (Cisco Systems) -- C:\WINDOWS\System32\dllcache\pcx500.sys
[2010/06/01 23:27:22 | 000,086,016 | ---- | C] (PCtel, Inc.) -- C:\WINDOWS\System32\dllcache\pctspk.exe
[2010/06/01 23:27:10 | 000,026,153 | ---- | C] (Linksys) -- C:\WINDOWS\System32\dllcache\pcmlm56.sys
[2010/06/01 23:27:05 | 000,029,502 | ---- | C] (Marconi Communications, Inc.) -- C:\WINDOWS\System32\dllcache\pca200e.sys
[2010/06/01 23:27:03 | 000,030,495 | ---- | C] (Linksys) -- C:\WINDOWS\System32\dllcache\pc100nds.sys
[2010/06/01 23:26:23 | 000,054,186 | ---- | C] (Ositech Communications, Inc.) -- C:\WINDOWS\System32\dllcache\otcsercb.sys
[2010/06/01 23:26:20 | 000,043,689 | ---- | C] (Ositech Communications, Inc.) -- C:\WINDOWS\System32\dllcache\otceth5.sys
[2010/06/01 23:26:17 | 000,027,209 | ---- | C] (Ositech Communications, Inc.) -- C:\WINDOWS\System32\dllcache\otc06x5.sys
[2010/06/01 23:26:13 | 000,054,528 | ---- | C] (Yamaha Corp.) -- C:\WINDOWS\System32\dllcache\opl3sax.sys
[2010/06/01 23:25:53 | 000,051,552 | ---- | C] (Kensington Technology Group) -- C:\WINDOWS\System32\dllcache\ntgrip.sys
[2010/06/01 23:25:24 | 000,087,040 | ---- | C] (NeoMagic Corporation) -- C:\WINDOWS\System32\dllcache\nm6wdm.sys
[2010/06/01 23:25:21 | 000,126,080 | ---- | C] (NeoMagic Corporation) -- C:\WINDOWS\System32\dllcache\nm5a2wdm.sys
[2010/06/01 23:25:17 | 000,032,840 | ---- | C] (NETGEAR Corporation.) -- C:\WINDOWS\System32\dllcache\ngrpci.sys
[2010/06/01 23:25:16 | 000,132,695 | ---- | C] (802.11b) -- C:\WINDOWS\System32\dllcache\netwlan5.sys
[2010/06/01 23:25:07 | 000,039,264 | ---- | C] (NeoMagic Corporation) -- C:\WINDOWS\System32\dllcache\neo20xx.sys
[2010/06/01 23:25:04 | 000,060,480 | ---- | C] (NeoMagic Corporation) -- C:\WINDOWS\System32\dllcache\neo20xx.dll
[2010/06/01 23:24:55 | 000,091,488 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i3disp.dll
[2010/06/01 23:24:53 | 000,027,936 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i3d.sys
[2010/06/01 23:24:50 | 000,033,088 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i128v2.sys
[2010/06/01 23:24:47 | 000,059,104 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i128v2.dll
[2010/06/01 23:24:44 | 000,013,664 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i128.sys
[2010/06/01 23:24:41 | 000,035,392 | ---- | C] (Number Nine Visual Technology Corp.) -- C:\WINDOWS\System32\dllcache\n9i128.dll
[2010/06/01 23:24:33 | 000,075,520 | ---- | C] (Moxa Technologies Co., Ltd.) -- C:\WINDOWS\System32\dllcache\mxport.sys
[2010/06/01 23:24:30 | 000,007,168 | ---- | C] (Moxa Technologies Co., Ltd) -- C:\WINDOWS\System32\dllcache\mxport.dll
[2010/06/01 23:24:27 | 000,019,968 | ---- | C] (Macronix International Co., Ltd. ) -- C:\WINDOWS\System32\dllcache\mxnic.sys
[2010/06/01 23:24:24 | 000,019,968 | ---- | C] (Moxa Technologies Co., Ltd) -- C:\WINDOWS\System32\dllcache\mxicfg.dll
[2010/06/01 23:24:21 | 000,021,888 | ---- | C] (Moxa Technologies Co., Ltd.) -- C:\WINDOWS\System32\dllcache\mxcard.sys
[2010/06/01 23:24:18 | 000,103,296 | ---- | C] (Matrox Graphics Inc) -- C:\WINDOWS\System32\dllcache\mtxvideo.sys
[2010/06/01 23:23:30 | 000,017,280 | ---- | C] (American Megatrends Inc.) -- C:\WINDOWS\System32\dllcache\mraid35x.sys
[2010/06/01 23:22:54 | 000,164,586 | ---- | C] (Madge Networks Ltd) -- C:\WINDOWS\System32\dllcache\mdgndis5.sys
[2010/06/01 23:21:33 | 000,797,500 | ---- | C] (LT) -- C:\WINDOWS\System32\dllcache\ltsmt.sys
[2010/06/01 23:21:30 | 000,802,683 | ---- | C] (Lucent Technologies) -- C:\WINDOWS\System32\dllcache\ltsm.sys
[2010/06/01 23:21:29 | 000,420,992 | ---- | C] (LT) -- C:\WINDOWS\System32\dllcache\ltmdmntt.sys
[2010/06/01 23:21:26 | 000,606,684 | ---- | C] (LT) -- C:\WINDOWS\System32\dllcache\ltmdmnt.sys
[2010/06/01 23:21:26 | 000,576,746 | ---- | C] (LT) -- C:\WINDOWS\System32\dllcache\ltmdmntl.sys
[2010/06/01 23:21:23 | 000,727,786 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\ltck000c.sys
[2010/06/01 23:21:14 | 000,070,730 | ---- | C] (Linksys Group, Inc.) -- C:\WINDOWS\System32\dllcache\lne100tx.sys
[2010/06/01 23:21:12 | 000,020,573 | ---- | C] (The Linksts Group ) -- C:\WINDOWS\System32\dllcache\lne100.sys
[2010/06/01 23:21:09 | 000,025,065 | ---- | C] (D-Link) -- C:\WINDOWS\System32\dllcache\lmndis3.sys
[2010/06/01 23:21:06 | 000,015,744 | ---- | C] (Litronic Industries) -- C:\WINDOWS\System32\dllcache\lit220p.sys
[2010/06/01 23:21:02 | 000,026,442 | ---- | C] (SMSC) -- C:\WINDOWS\System32\dllcache\lanepic5.sys
[2010/06/01 23:20:59 | 000,019,016 | ---- | C] (Kingston Technology Company ) -- C:\WINDOWS\System32\dllcache\ktc111.sys
[2010/06/01 23:20:07 | 000,023,552 | ---- | C] (MKNet Corporation) -- C:\WINDOWS\System32\dllcache\irmk7.sys
[2010/06/01 23:20:00 | 000,045,632 | ---- | C] (Interphase (R) Corporation a Windows (R) 2000 DDK Driver Provider) -- C:\WINDOWS\System32\dllcache\ip5515.sys
[2010/06/01 23:19:24 | 000,372,824 | ---- | C] (Xircom) -- C:\WINDOWS\System32\dllcache\iconf32.dll
[2010/06/01 23:17:41 | 000,068,608 | ---- | C] (Avisioin) -- C:\WINDOWS\System32\dllcache\hpgt53tk.dll
[2010/06/01 23:17:32 | 000,126,976 | ---- | C] (Hewlett Packard) -- C:\WINDOWS\System32\dllcache\hpgt34tk.dll
[2010/06/01 23:17:05 | 000,028,288 | ---- | C] (Gemplus) -- C:\WINDOWS\System32\dllcache\grserial.sys
[2010/06/01 23:17:03 | 000,082,304 | ---- | C] (Gemplus) -- C:\WINDOWS\System32\dllcache\grclass.sys
[2010/06/01 23:17:01 | 000,017,408 | ---- | C] (Gemplus) -- C:\WINDOWS\System32\dllcache\gpr400.sys
[2010/06/01 23:16:48 | 000,454,912 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\fxusbase.sys
[2010/06/01 23:16:36 | 000,455,296 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\fusbbase.sys
[2010/06/01 23:16:34 | 000,455,680 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\fus2base.sys
[2010/06/01 23:16:30 | 000,442,240 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\fpnpbase.sys
[2010/06/01 23:16:28 | 000,441,728 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\fpcmbase.sys
[2010/06/01 23:16:26 | 000,444,416 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\fpcibase.sys
[2010/06/01 23:16:23 | 000,034,173 | ---- | C] (Marconi Communications, Inc.) -- C:\WINDOWS\System32\dllcache\forehe.sys
[2010/06/01 23:11:56 | 000,024,618 | ---- | C] (NETGEAR) -- C:\WINDOWS\System32\dllcache\fa410nd5.sys
[2010/06/01 23:11:52 | 000,011,850 | ---- | C] (FUJITSU LIMITED) -- C:\WINDOWS\System32\dllcache\f3ab18xj.sys
[2010/06/01 23:11:50 | 000,012,362 | ---- | C] (FUJITSU LIMITED) -- C:\WINDOWS\System32\dllcache\f3ab18xi.sys
[2010/06/01 23:11:23 | 000,072,192 | ---- | C] (ESS Technology Inc.) -- C:\WINDOWS\System32\dllcache\es1969.sys
[2010/06/01 23:10:22 | 000,334,208 | ---- | C] (Yamaha Corp.) -- C:\WINDOWS\System32\dllcache\ds1wdm.sys
[2010/06/01 23:10:16 | 000,028,062 | ---- | C] (National Semiconductor Coproration) -- C:\WINDOWS\System32\dllcache\dp83820.sys
[2010/06/01 23:10:07 | 000,029,696 | ---- | C] (CNet Technology, Inc. ) -- C:\WINDOWS\System32\dllcache\dm9pci5.sys
[2010/06/01 23:10:05 | 000,026,698 | ---- | C] (D-Link Corporation) -- C:\WINDOWS\System32\dllcache\dlh5xnd5.sys
[2010/06/01 23:10:04 | 000,952,007 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\diwan.sys
[2010/06/01 23:10:00 | 000,236,060 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\ditrace.exe
[2010/06/01 23:09:58 | 000,038,985 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\disrvsu.dll
[2010/06/01 23:09:57 | 000,031,305 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\disrvpp.dll
[2010/06/01 23:09:56 | 000,006,729 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\disrvci.dll
[2010/06/01 23:09:53 | 000,091,305 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\dimaint.sys
[2010/06/01 23:09:32 | 000,024,649 | ---- | C] (D-Link) -- C:\WINDOWS\System32\dllcache\dfe650d.sys
[2010/06/01 23:09:31 | 000,024,648 | ---- | C] (D-Link) -- C:\WINDOWS\System32\dllcache\dfe650.sys
[2010/06/01 23:09:27 | 000,020,928 | ---- | C] (Digital Networks, LLC) -- C:\WINDOWS\System32\dllcache\defpa.sys
[2010/06/01 23:09:02 | 000,048,640 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwrwdm.sys
[2010/06/01 23:09:01 | 000,093,952 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwcwdm.sys
[2010/06/01 23:09:00 | 000,111,872 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwcspud.sys
[2010/06/01 23:08:59 | 000,003,584 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwcosnt5.sys
[2010/06/01 23:08:58 | 000,072,832 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwbwdm.sys
[2010/06/01 23:08:56 | 000,003,072 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwbmidi.sys
[2010/06/01 23:08:55 | 000,003,072 | ---- | C] (Crystal Semiconductor Corp.) -- C:\WINDOWS\System32\dllcache\cwbase.sys
[2010/06/01 23:08:54 | 000,249,856 | ---- | C] (Comtrol® Corporation) -- C:\WINDOWS\System32\dllcache\ctmasetp.dll
[2010/06/01 23:08:46 | 000,216,064 | ---- | C] (COMPAQ Inc.) -- C:\WINDOWS\System32\dllcache\cpscan.dll
[2010/06/01 23:08:45 | 000,060,970 | ---- | C] (Compaq Computer Corp.) -- C:\WINDOWS\System32\dllcache\cpqtrnd5.sys
[2010/06/01 23:08:29 | 000,020,736 | ---- | C] (OMNIKEY AG) -- C:\WINDOWS\System32\dllcache\cmbp0wdm.sys
[2010/06/01 23:08:21 | 000,980,034 | ---- | C] (Xircom) -- C:\WINDOWS\System32\dllcache\cicap.sys
[2010/06/01 23:08:13 | 000,049,182 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\cem56n5.sys
[2010/06/01 23:08:13 | 000,022,044 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\cem33n5.sys
[2010/06/01 23:08:12 | 000,022,044 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\cem28n5.sys
[2010/06/01 23:08:11 | 000,027,164 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\ce3n5.sys
[2010/06/01 23:08:11 | 000,021,530 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\ce2n5.sys
[2010/06/01 23:08:08 | 000,714,698 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\cbmdmkxx.sys
[2010/06/01 23:08:07 | 000,046,108 | ---- | C] (Xircom, Inc.) -- C:\WINDOWS\System32\dllcache\cben5.sys
[2010/06/01 23:08:06 | 000,039,680 | ---- | C] (Silicom Ltd.) -- C:\WINDOWS\System32\dllcache\cb325.sys
[2010/06/01 23:08:05 | 000,037,916 | ---- | C] (Fast Ethernet Controller Provider) -- C:\WINDOWS\System32\dllcache\cb102.sys
[2010/06/01 23:08:04 | 000,032,256 | ---- | C] (Eicon Technology Corporation) -- C:\WINDOWS\System32\dllcache\diapi2NT.dll
[2010/06/01 23:08:03 | 000,164,923 | ---- | C] (Eicon Technology) -- C:\WINDOWS\System32\dllcache\diapi2.sys
[2010/06/01 23:07:31 | 000,031,529 | ---- | C] (BreezeCOM) -- C:\WINDOWS\System32\dllcache\brzwlan.sys
[2010/06/01 23:07:30 | 000,011,008 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brusbmdm.sys
[2010/06/01 23:07:30 | 000,010,368 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brusbscn.sys
[2010/06/01 23:07:29 | 000,060,416 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brserwdm.sys
[2010/06/01 23:07:29 | 000,009,728 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brserif.dll
[2010/06/01 23:07:28 | 000,005,120 | ---- | C] (Brother Industries,Ltd.) -- C:\WINDOWS\System32\dllcache\brscnrsm.dll
[2010/06/01 23:07:27 | 000,039,552 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brparwdm.sys
[2010/06/01 23:07:27 | 000,003,168 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brparimg.sys
[2010/06/01 23:07:25 | 000,041,472 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brmfusb.dll
[2010/06/01 23:07:25 | 000,032,256 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brmfrsmg.exe
[2010/06/01 23:07:24 | 000,029,696 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brmflpt.dll
[2010/06/01 23:07:23 | 000,015,360 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brmfbidi.dll
[2010/06/01 23:07:22 | 000,003,968 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brfiltup.sys
[2010/06/01 23:07:21 | 000,012,160 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brfiltlo.sys
[2010/06/01 23:07:21 | 000,002,944 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brfilt.sys
[2010/06/01 23:07:20 | 000,012,800 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brevif.dll
[2010/06/01 23:07:19 | 000,019,456 | ---- | C] (Brother Industries, Ltd.) -- C:\WINDOWS\System32\dllcache\brbidiif.dll
[2010/06/01 23:07:19 | 000,009,728 | ---- | C] (Brother Industries Ltd.) -- C:\WINDOWS\System32\dllcache\brcoinst.dll
[2010/06/01 23:07:15 | 000,871,388 | ---- | C] (BCM) -- C:\WINDOWS\System32\dllcache\bcmdm.sys
[2010/06/01 23:07:11 | 000,342,336 | ---- | C] (3Dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\banshee.dll
[2010/06/01 23:07:11 | 000,036,128 | ---- | C] (3Dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\banshee.sys
[2010/06/01 23:07:10 | 000,089,952 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\b1cbase.sys
[2010/06/01 23:07:09 | 000,037,568 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\avmwan.sys
[2010/06/01 23:07:09 | 000,036,992 | ---- | C] (Aztech Systems Ltd) -- C:\WINDOWS\System32\dllcache\aztw2320.sys
[2010/06/01 23:07:08 | 000,144,384 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\avmenum.dll
[2010/06/01 23:07:08 | 000,087,552 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\dllcache\avmcoxp.dll
[2010/06/01 23:06:46 | 000,077,568 | ---- | C] (ATI Technologies, Inc.) -- C:\WINDOWS\System32\dllcache\ati.sys
[2010/06/01 23:06:41 | 000,097,354 | ---- | C] (Bay Networks, Inc.) -- C:\WINDOWS\System32\dllcache\aspndis3.sys
[2010/06/01 22:35:42 | 000,016,969 | ---- | C] (AmbiCom, Inc.) -- C:\WINDOWS\System32\dllcache\amb8002.sys
[2010/06/01 22:35:19 | 000,046,112 | ---- | C] (Adaptec, Inc ) -- C:\WINDOWS\System32\dllcache\adptsf50.sys
[2010/06/01 22:35:18 | 000,010,880 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\admjoy.sys
[2010/06/01 22:35:17 | 000,747,392 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\adm8830.sys
[2010/06/01 22:35:16 | 000,553,984 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\adm8820.sys
[2010/06/01 22:35:15 | 000,584,448 | ---- | C] (Aureal, Inc.) -- C:\WINDOWS\System32\dllcache\adm8810.sys
[2010/06/01 22:35:15 | 000,020,160 | ---- | C] (ADMtek Incorporated) -- C:\WINDOWS\System32\dllcache\adm8511.sys
[2010/06/01 22:35:13 | 000,061,440 | ---- | C] (Color Flatbed Scanner) -- C:\WINDOWS\System32\dllcache\acerscad.dll
[2010/06/01 22:35:11 | 000,297,728 | ---- | C] (Silicon Integrated Systems Corp.) -- C:\WINDOWS\System32\dllcache\ac97sis.sys
[2010/06/01 22:35:09 | 000,462,848 | ---- | C] (Aureal Inc.) -- C:\WINDOWS\System32\dllcache\a3dapi.dll
[2010/06/01 22:35:07 | 000,689,216 | ---- | C] (3dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\3dfxvs.dll
[2010/06/01 22:35:07 | 000,148,352 | ---- | C] (3dfx Interactive, Inc.) -- C:\WINDOWS\System32\dllcache\3dfxvsm.sys
[2010/06/01 22:35:06 | 000,762,780 | ---- | C] (3Com, Inc.) -- C:\WINDOWS\System32\dllcache\3cwmcru.sys
[2010/06/01 21:29:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ICS
[2010/06/01 21:28:55 | 000,000,000 | ---D | C] -- C:\Program Files\LogMeIn
[2010/06/01 21:27:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\Local Settings\Application Data\Deployment
[2010/06/01 20:49:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\Local Settings\Application Data\CrossLoop
[2010/05/23 15:08:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\My Documents\Battlefield Series
[2010/05/22 07:25:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\Performance
[2010/05/22 07:25:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\Local Settings\Application Data\Microsoft Corporation
[2010/05/18 19:29:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond\My Documents\Cakewalk
[2010/05/18 18:42:05 | 000,233,472 | ---- | C] (Propellerhead Software AB) -- C:\WINDOWS\System32\REX Shared Library.dll
[2010/05/18 18:42:02 | 000,368,640 | ---- | C] (Propellerhead Software AB) -- C:\WINDOWS\System32\ReWire.dll
[2010/05/18 18:40:47 | 000,000,000 | ---D | C] -- C:\Cakewalk Projects
[2010/05/18 18:40:47 | 000,000,000 | ---D | C] -- C:\Program Files\Cakewalk
[2010/05/18 18:40:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Cakewalk
[2010/05/18 16:28:28 | 000,000,000 | ---D | C] -- C:\Program Files\ParetoLogic
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[200 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\Documents and Settings\Raymond\My Documents\*.tmp files -> C:\Documents and Settings\Raymond\My Documents\*.tmp -> ]
[189 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/08/13 22:40:04 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Raymond\Desktop\OTL.exe
[2010/08/13 22:35:10 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/08/13 22:34:35 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/08/13 22:34:17 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/08/13 22:34:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/08/13 22:32:34 | 013,369,344 | ---- | M] () -- C:\Documents and Settings\Raymond\NTUSER.DAT
[2010/08/13 22:32:34 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\Raymond\ntuser.ini
[2010/08/13 21:37:46 | 000,000,426 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{C0EA9736-D8AB-42EB-B129-F405E6D05038}.job
[2010/08/13 21:28:25 | 000,019,968 | ---- | M] () -- C:\Documents and Settings\Raymond\My Documents\HELL THIS MAN IS COLORED.doc
[2010/08/13 20:38:12 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/08/13 20:37:34 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/08/13 20:30:04 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2010/08/13 20:07:17 | 000,000,104 | ---- | M] () -- C:\Documents and Settings\Raymond\Desktop\Yahoo! Mail.lnk
[2010/08/13 18:00:00 | 000,000,448 | ---- | M] () -- C:\WINDOWS\tasks\ParetoLogic Registration3.job
[2010/08/12 04:27:26 | 001,363,096 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/08/12 04:10:26 | 000,713,298 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0402000.00C\Cat.DB
[2010/08/12 04:10:18 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/08/12 04:09:51 | 000,000,685 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/08/12 04:08:02 | 000,505,234 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/08/12 04:08:02 | 000,444,028 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/08/12 04:08:02 | 000,071,904 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/08/09 20:21:40 | 008,136,704 | -H-- | M] () -- C:\WINDOWS\System32\SecSigDB.BIN
[2010/08/09 20:21:40 | 000,450,000 | -H-- | M] () -- C:\WINDOWS\System32\NameDB.BIN
[2010/08/09 20:17:34 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/07/23 22:52:44 | 000,000,349 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\PCLECHAL.INI
[2010/07/23 21:52:34 | 000,002,278 | ---- | M] () -- C:\Documents and Settings\Raymond\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/07/23 21:52:33 | 000,002,300 | ---- | M] () -- C:\Documents and Settings\Raymond\Desktop\Google Chrome.lnk
[2010/07/23 21:25:40 | 000,000,402 | ---- | M] () -- C:\WINDOWS\tasks\ParetoLogic Privacy Controls_{BFCF5380-96CA-11DF-BFBF-0011D82839F6}.job
[2010/07/23 16:23:46 | 004,154,923 | ---- | M] () -- C:\Documents and Settings\Raymond\My Documents\C2000 CPT-A-.pdf
[2010/07/22 06:37:29 | 000,108,480 | ---- | M] (SlySoft, Inc.) -- C:\WINDOWS\System32\drivers\AnyDVD.sys
[2010/07/20 20:37:30 | 000,019,968 | ---- | M] () -- C:\Documents and Settings\Raymond\My Documents\Why do blacks always have sex on their minds.doc
[2010/07/20 20:27:35 | 000,223,744 | ---- | M] () -- C:\Documents and Settings\Raymond\My Documents\Blonde at Starbucks.doc
[2010/07/20 19:11:48 | 000,041,472 | ---- | M] () -- C:\Documents and Settings\Raymond\My Documents\LOGINS and PASSWORDS.doc
[2010/07/20 18:56:15 | 000,020,480 | ---- | M] () -- C:\Documents and Settings\Raymond\My Documents\SYNOPSIS for GOD IS MY CO.doc
[2010/07/20 17:34:47 | 000,053,248 | ---- | M] () -- C:\Documents and Settings\Raymond\My Documents\S DIY NortonLive PC Power Boost for Windows XP.doc
[2010/07/20 17:08:30 | 000,001,969 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Norton PC Checkup.LNK
[2010/07/18 14:00:16 | 000,105,956 | ---- | M] () -- C:\Documents and Settings\Raymond\Desktop\White Persian [1600x1200].jpg
[2010/07/18 13:49:32 | 000,000,793 | ---- | M] () -- C:\Documents and Settings\Raymond\Desktop\VSO Image Resizer 4.lnk
[2010/07/18 13:27:44 | 000,052,224 | ---- | M] () -- C:\Documents and Settings\Raymond\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/17 11:12:07 | 000,153,376 | ---- | M] (Oracle) -- C:\WINDOWS\System32\javaws.exe
[2010/07/17 11:12:07 | 000,145,184 | ---- | M] (Oracle) -- C:\WINDOWS\System32\javaw.exe
[2010/07/17 11:12:07 | 000,145,184 | ---- | M] (Oracle) -- C:\WINDOWS\System32\java.exe
[2010/07/17 11:12:07 | 000,073,728 | ---- | M] (Oracle) -- C:\WINDOWS\System32\javacpl.cpl
[2010/07/17 11:12:06 | 000,423,656 | ---- | M] (Oracle) -- C:\WINDOWS\System32\deployJava1.dll
[2010/07/15 20:30:42 | 000,080,673 | ---- | M] () -- C:\Documents and Settings\Raymond\Desktop\White Persian.jpg
[2010/07/15 09:49:33 | 000,000,418 | ---- | M] () -- C:\Documents and Settings\Raymond\Desktop\Google.url
[2010/07/14 19:21:13 | 000,000,083 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\.zreglib
[2010/07/12 11:33:30 | 000,000,810 | ---- | M] () -- C:\WINDOWS\Brpfx04a.ini
[2010/07/11 18:39:16 | 000,000,115 | ---- | M] () -- C:\Documents and Settings\Raymond\Desktop\CDCovers.cc.url
[2010/07/10 18:54:23 | 000,096,768 | ---- | M] () -- C:\Documents and Settings\Raymond\My Documents\Confirmation Receipt.doc
[2010/07/10 18:05:25 | 000,048,065 | ---- | M] () -- C:\Documents and Settings\Raymond\Desktop\perfect-angel.jpg
[2010/07/04 10:35:18 | 000,007,589 | ---- | M] () -- C:\Documents and Settings\Raymond\Desktop\att.net.url
[2010/07/03 19:43:38 | 000,016,400 | ---- | M] (Logitech, Inc.) -- C:\WINDOWS\System32\drivers\LNonPnP.sys
[2010/07/03 19:37:57 | 000,000,800 | ---- | M] () -- C:\Documents and Settings\Raymond\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2010/07/03 19:36:28 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2010/07/03 19:36:28 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2010/07/01 18:22:16 | 000,000,172 | ---- | M] () -- C:\WINDOWS\System32\drivers\NortonPCCheckup\0200040.083\isolate.ini
[2010/07/01 07:10:50 | 000,062,976 | ---- | M] () -- C:\Documents and Settings\Raymond\Desktop\The Top 8 Reasons Why Your Kitty Won.doc
[2010/06/26 11:06:48 | 000,002,560 | ---- | M] () -- C:\WINDOWS\_MSRSTRT.EXE
[2010/06/26 09:46:44 | 000,000,332 | ---- | M] () -- C:\ACScnLog.ini
[2010/06/26 08:09:24 | 000,021,504 | ---- | M] () -- C:\Documents and Settings\Raymond\My Documents\MEXICO.doc
[2010/06/20 18:26:07 | 000,004,201 | ---- | M] () -- C:\WINDOWS\Ascd_tmp.ini
[2010/06/20 14:00:50 | 000,000,707 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mixcraft 5.lnk
[2010/06/20 11:17:58 | 000,000,045 | ---- | M] () -- C:\WINDOWS\System32\initdebug.nfo
[2010/06/18 16:08:02 | 000,027,136 | ---- | M] () -- C:\Documents and Settings\Raymond\My Documents\Joe Legal and Jose Illegal.doc
[2010/06/14 19:57:40 | 000,908,800 | ---- | M] () -- C:\Documents and Settings\Raymond\My Documents\Removing Logos.doc
[2010/06/05 20:11:56 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/06/05 14:05:17 | 000,021,504 | ---- | M] () -- C:\Documents and Settings\Raymond\My Documents\Disclaimer.doc
[2010/06/02 00:23:34 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\Raymond\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/06/01 21:29:06 | 000,001,024 | ---- | M] () -- C:\.rnd
[2010/06/01 18:21:34 | 000,019,456 | ---- | M] () -- C:\Documents and Settings\Raymond\Application Data\DMX.bmk
[2010/05/31 18:02:00 | 000,026,112 | ---- | M] () -- C:\Documents and Settings\Raymond\My Documents\Pilots - Mechanics.doc
[2010/05/18 18:44:33 | 000,001,712 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Music Creator 4.lnk
[2010/05/18 16:28:29 | 000,000,983 | ---- | M] () -- C:\Documents and Settings\Raymond\Application Data\Microsoft\Internet Explorer\Quick Launch\ParetoLogic Privacy Controls.lnk
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[200 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\Documents and Settings\Raymond\My Documents\*.tmp files -> C:\Documents and Settings\Raymond\My Documents\*.tmp -> ]
[189 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/08/13 21:28:22 | 000,019,968 | ---- | C] () -- C:\Documents and Settings\Raymond\My Documents\HELL THIS MAN IS COLORED.doc
[2010/08/13 20:30:04 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/08/13 20:30:03 | 000,260,272 | ---- | C] () -- C:\cmldr
[2010/08/13 20:07:17 | 000,000,104 | ---- | C] () -- C:\Documents and Settings\Raymond\Desktop\Yahoo! Mail.lnk
[2010/08/09 20:14:49 | 008,136,704 | -H-- | C] () -- C:\WINDOWS\System32\SecSigDB.BIN
[2010/08/09 20:14:49 | 000,450,000 | -H-- | C] () -- C:\WINDOWS\System32\NameDB.BIN
[2010/07/23 21:25:41 | 000,000,448 | ---- | C] () -- C:\WINDOWS\tasks\ParetoLogic Registration3.job
[2010/07/23 21:25:40 | 000,000,402 | ---- | C] () -- C:\WINDOWS\tasks\ParetoLogic Privacy Controls_{BFCF5380-96CA-11DF-BFBF-0011D82839F6}.job
[2010/07/23 16:23:39 | 004,154,923 | ---- | C] () -- C:\Documents and Settings\Raymond\My Documents\C2000 CPT-A-.pdf
[2010/07/20 19:34:08 | 000,019,968 | ---- | C] () -- C:\Documents and Settings\Raymond\My Documents\Why do blacks always have sex on their minds.doc
[2010/07/20 18:56:12 | 000,020,480 | ---- | C] () -- C:\Documents and Settings\Raymond\My Documents\SYNOPSIS for GOD IS MY CO.doc
[2010/07/20 17:34:44 | 000,053,248 | ---- | C] () -- C:\Documents and Settings\Raymond\My Documents\S DIY NortonLive PC Power Boost for Windows XP.doc
[2010/07/20 17:08:30 | 000,001,969 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Norton PC Checkup.LNK
[2010/07/20 17:08:24 | 000,000,172 | ---- | C] () -- C:\WINDOWS\System32\drivers\NortonPCCheckup\0200040.083\isolate.ini
[2010/07/18 14:00:16 | 000,105,956 | ---- | C] () -- C:\Documents and Settings\Raymond\Desktop\White Persian [1600x1200].jpg
[2010/07/18 13:52:48 | 000,763,920 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/07/18 13:49:32 | 000,000,793 | ---- | C] () -- C:\Documents and Settings\Raymond\Desktop\VSO Image Resizer 4.lnk
[2010/07/18 11:35:06 | 000,162,304 | ---- | C] () -- C:\WINDOWS\System32\ztvunrar36.dll
[2010/07/18 11:35:06 | 000,077,312 | ---- | C] () -- C:\WINDOWS\System32\ztvunace26.dll
[2010/07/11 18:17:06 | 000,000,115 | ---- | C] () -- C:\Documents and Settings\Raymond\Desktop\CDCovers.cc.url
[2010/07/10 18:54:23 | 000,096,768 | ---- | C] () -- C:\Documents and Settings\Raymond\My Documents\Confirmation Receipt.doc
[2010/07/10 17:59:11 | 000,048,065 | ---- | C] () -- C:\Documents and Settings\Raymond\Desktop\perfect-angel.jpg
[2010/07/10 11:16:55 | 000,080,673 | ---- | C] () -- C:\Documents and Settings\Raymond\Desktop\White Persian.jpg
[2010/07/04 11:37:10 | 000,223,744 | ---- | C] () -- C:\Documents and Settings\Raymond\My Documents\Blonde at Starbucks.doc
[2010/07/01 10:31:56 | 000,000,868 | ---- | C] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/07/01 07:10:50 | 000,062,976 | ---- | C] () -- C:\Documents and Settings\Raymond\Desktop\The Top 8 Reasons Why Your Kitty Won.doc
[2010/06/27 20:17:03 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2010/06/26 11:06:47 | 000,002,560 | ---- | C] () -- C:\WINDOWS\_MSRSTRT.EXE
[2010/06/20 18:31:44 | 000,187,392 | ---- | C] () -- C:\WINDOWS\System\BCBSMP35.BPL
[2010/06/20 18:30:39 | 000,006,272 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASLM75.SYS
[2010/06/20 11:17:56 | 000,000,045 | ---- | C] () -- C:\WINDOWS\System32\initdebug.nfo
[2010/06/19 23:12:51 | 000,021,504 | ---- | C] () -- C:\Documents and Settings\Raymond\My Documents\MEXICO.doc
[2010/06/18 16:08:01 | 000,027,136 | ---- | C] () -- C:\Documents and Settings\Raymond\My Documents\Joe Legal and Jose Illegal.doc
[2010/06/14 19:57:40 | 000,908,800 | ---- | C] () -- C:\Documents and Settings\Raymond\My Documents\Removing Logos.doc
[2010/06/12 18:11:08 | 000,000,332 | ---- | C] () -- C:\ACScnLog.ini
[2010/06/05 14:05:14 | 000,021,504 | ---- | C] () -- C:\Documents and Settings\Raymond\My Documents\Disclaimer.doc
[2010/06/02 00:25:36 | 000,000,426 | -H-- | C] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{C0EA9736-D8AB-42EB-B129-F405E6D05038}.job
[2010/06/01 23:41:29 | 000,018,944 | ---- | C] () -- C:\WINDOWS\System32\dllcache\xrxscnui.dll
[2010/06/01 23:41:26 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\dllcache\xrxftplt.exe
[2010/06/01 23:28:23 | 000,033,280 | ---- | C] () -- C:\WINDOWS\System32\dllcache\psisrndr.ax
[2010/06/01 23:28:19 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\dllcache\psisdecd.dll
[2010/06/01 23:23:38 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msdvbnp.ax
[2010/06/01 23:17:39 | 000,165,888 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt53.dll
[2010/06/01 23:17:34 | 000,093,696 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt42.dll
[2010/06/01 23:17:30 | 000,101,376 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt34.dll
[2010/06/01 23:17:25 | 000,089,088 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt33.dll
[2010/06/01 23:17:20 | 000,083,968 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hpgt21.dll
[2010/06/01 23:10:03 | 000,029,768 | ---- | C] () -- C:\WINDOWS\System32\dllcache\divasu.dll
[2010/06/01 23:10:02 | 000,037,962 | ---- | C] () -- C:\WINDOWS\System32\dllcache\divaprop.dll
[2010/06/01 23:10:01 | 000,006,216 | ---- | C] () -- C:\WINDOWS\System32\dllcache\divaci.dll
[2010/06/01 23:07:01 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ativxbar.sys
[2010/06/01 23:07:01 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atixbar.sys
[2010/06/01 23:07:00 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ativttxx.sys
[2010/06/01 23:06:59 | 000,017,152 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atitvsnd.sys
[2010/06/01 23:06:59 | 000,009,472 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ativmdcd.sys
[2010/06/01 23:06:58 | 000,026,880 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atirtsnd.sys
[2010/06/01 23:06:58 | 000,017,152 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atitunep.sys
[2010/06/01 23:06:57 | 000,049,920 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atirtcap.sys
[2010/06/01 23:06:56 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atipcxxx.sys
[2010/06/01 23:06:49 | 000,046,464 | ---- | C] () -- C:\WINDOWS\System32\dllcache\atibt829.sys
[2010/06/01 21:29:04 | 000,001,024 | ---- | C] () -- C:\.rnd
[2010/05/31 18:02:00 | 000,026,112 | ---- | C] () -- C:\Documents and Settings\Raymond\My Documents\Pilots - Mechanics.doc
[2010/05/18 18:44:33 | 000,001,712 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Music Creator 4.lnk
[2010/05/18 16:04:57 | 000,000,983 | ---- | C] () -- C:\Documents and Settings\Raymond\Application Data\Microsoft\Internet Explorer\Quick Launch\ParetoLogic Privacy Controls.lnk
[2009/10/08 18:25:40 | 000,000,185 | ---- | C] () -- C:\WINDOWS\System32\msblcd32.dll
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/04/08 17:43:50 | 000,000,023 | ---- | C] () -- C:\WINDOWS\ZDPLUSSEARCH.INI
[2008/11/21 17:19:04 | 000,000,104 | ---- | C] () -- C:\WINDOWS\System32\ProxySettings.ini
[2008/10/30 18:22:38 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PhotoNow.INI
[2008/10/14 21:01:49 | 000,000,196 | ---- | C] () -- C:\WINDOWS\OPHD.ini
[2008/09/21 12:10:05 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008/09/20 19:40:17 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2008/09/20 19:40:16 | 000,000,419 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2008/09/20 19:39:28 | 000,000,810 | ---- | C] () -- C:\WINDOWS\Brpfx04a.ini
[2008/09/20 19:39:28 | 000,000,093 | ---- | C] () -- C:\WINDOWS\brpcfx.ini
[2008/09/20 19:38:50 | 000,000,086 | ---- | C] () -- C:\WINDOWS\Brfaxrx.ini
[2008/09/20 19:38:49 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\BrMuSNMP.dll
[2008/09/17 16:46:47 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Irremote.ini
[2008/09/16 21:10:54 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008/09/16 20:15:46 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\msssc.dll
[2008/09/16 20:11:44 | 000,004,201 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2008/09/16 20:11:39 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2008/05/16 14:01:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2008/05/16 14:01:00 | 001,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2008/05/16 14:01:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2008/05/16 14:01:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008/05/16 14:01:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2007/08/21 14:22:58 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2004/01/30 16:07:46 | 000,245,408 | ---- | C] () -- C:\WINDOWS\System32\unicows.dll
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2000/10/31 19:00:00 | 000,132,096 | ---- | C] () -- C:\WINDOWS\System32\ZipDll.dll
[2000/10/31 19:00:00 | 000,117,760 | ---- | C] () -- C:\WINDOWS\System32\UnzDll.dll
[1996/04/03 14:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys

========== LOP Check ==========

[2008/09/17 11:11:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Acoustica
[2009/01/01 18:19:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Acronis
[2008/10/03 21:27:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Broderbund Software
[2010/05/18 18:44:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Cakewalk
[2008/12/10 21:40:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Downloaded Installations
[2010/05/21 16:57:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DriverScanner
[2008/09/16 22:33:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Elaborate Bytes
[2008/10/08 19:24:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LightScribe
[2009/07/10 22:54:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LogMeIn
[2010/02/06 00:25:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Max Secure
[2010/05/18 16:28:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2009/08/12 17:49:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PCSettings
[2010/04/03 20:06:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Pinnacle
[2010/04/03 20:01:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Pinnacle Studio Plus
[2010/04/03 20:07:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Pinnacle Studio Ultimate Collection
[2009/04/08 17:40:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2010/07/11 19:24:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SHOUTcast Radio Toolbar
[2008/09/17 16:13:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Simple Star Shared
[2008/09/16 22:32:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SlySoft
[2010/02/04 21:42:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
[2010/04/03 20:01:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Studio 14
[2008/10/30 18:09:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Temp
[2010/04/14 07:05:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Trusteer
[2010/07/11 13:27:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2009/04/08 17:40:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\zeon
[2008/10/06 16:38:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2009/08/21 00:00:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{7B6BA59A-FB0E-4499-8536-A7420338BF3B}
[2010/05/21 16:49:50 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{81D4BDA8-1F33-4633-B176-8A7E942ABDE1}
[2010/05/23 11:44:24 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\~0
[2010/06/01 21:38:09 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\~1
[2008/11/10 19:13:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Raymond\Application Data\Acoustica
[2010/02/09 18:25:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Raymond\Application Data\Active Disk
[2008/12/15 13:51:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Raymond\Application Data\ArcticLine
[2009/12/13 14:24:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Raymond\Application Data\Cakewalk
[2009/09/20 09:58:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Raymond\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/06/29 18:35:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Raymond\Application Data\ElevatedDiagnostics
[2009/06/30 16:50:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Raymond\Application Data\GARMIN
[2010/06/02 00:02:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Raymond\Application Data\GlarySoft
[2009/04/25 13:58:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Raymond\Application Data\Leadertech
[2008/11/21 18:26:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Raymond\Application Data\OfficeUpdate12
[2008/11/10 20:19:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Raymond\Application Data\ParetoLogic
[2010/07/12 11:32:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Raymond\Application Data\PC-FAX TX
[2008/11/29 10:09:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Raymond\Application Data\SlySoft
[2010/07/20 17:08:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Raymond\Application Data\Tific
[2010/07/11 18:17:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Raymond\Application Data\Toolbar4
[2010/04/14 07:06:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Raymond\Application Data\Trusteer
[2010/05/21 16:57:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Raymond\Application Data\Uniblue
[2010/07/18 14:00:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Raymond\Application Data\VSO
[2009/04/08 17:40:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Raymond\Application Data\Zeon
[2010/07/23 21:25:40 | 000,000,402 | ---- | M] () -- C:\WINDOWS\Tasks\ParetoLogic Privacy Controls_{BFCF5380-96CA-11DF-BFBF-0011D82839F6}.job
[2010/08/13 18:00:00 | 000,000,448 | ---- | M] () -- C:\WINDOWS\Tasks\ParetoLogic Registration3.job
[2010/08/13 21:37:46 | 000,000,426 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{C0EA9736-D8AB-42EB-B129-F405E6D05038}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/06/01 21:29:06 | 000,001,024 | ---- | M] () -- C:\.rnd
[2010/06/26 09:46:44 | 000,000,332 | ---- | M] () -- C:\ACScnLog.ini
[2008/09/16 19:41:36 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010/08/09 20:17:34 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/08/13 20:30:04 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | ---- | M] () -- C:\cmldr
[2010/08/13 20:40:05 | 000,027,248 | ---- | M] () -- C:\ComboFix.txt
[2008/09/16 19:41:36 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2009/07/14 04:00:47 | 003,271,850 | RHS- | M] () -- C:\ExecSignature.txt
[2008/09/16 19:41:36 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009/12/19 04:01:15 | 002,213,056 | RHS- | M] () -- C:\MaxSignature.txt
[2009/12/19 04:01:14 | 004,641,416 | RHS- | M] () -- C:\MaxVirus.txt
[2008/09/16 19:41:36 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2010/08/09 19:12:06 | 000,008,010 | ---- | M] () -- C:\MxVirScn.log
[2004/08/04 07:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/09/16 21:57:27 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2009/11/08 23:38:00 | 000,262,144 | ---- | M] () -- C:\ntuser.dat
[2009/11/08 23:38:00 | 000,001,024 | -H-- | M] () -- C:\ntuser.dat.LOG
[2010/08/13 22:33:58 | 533,725,183 | -HS- | M] () -- C:\pagefile.sys
[2009/07/14 04:02:06 | 003,150,750 | RHS- | M] () -- C:\SDSignature.txt
[2009/04/06 07:18:45 | 008,256,445 | RHS- | M] () -- C:\SDVirus.txt

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2008/07/06 07:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2009/09/28 19:34:40 | 000,047,416 | ---- | M] (LogMeIn, Inc.) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\LMIproc.dll
[2007/04/09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2006/01/04 23:01:42 | 000,042,578 | ---- | M] (Oki Data Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\OPHDPP3.DLL

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[200 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008/09/16 14:23:38 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2008/09/16 14:23:38 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2008/09/16 14:23:38 | 000,954,368 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\user32.dll /md5 >
[2008/04/13 19:12:08 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\system32\user32.dll
[200 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/04/13 19:12:10 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\system32\ws2_32.dll
[200 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2help.dll /md5 >
[2008/04/13 19:12:10 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 -- C:\WINDOWS\system32\ws2help.dll
[200 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Raymond\My Documents\aha_help_music_video.wmv:Roxio EMC Stream
< End of report >

raylyncorvette · 2010/08/13

Extras.txt

OTL Extras logfile created on: 8/13/2010 10:42:13 PM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Raymond\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 79.00% Memory free
7.00 Gb Paging File | 7.00 Gb Available in Paging File | 94.00% Paging File free
Paging file location(s): C:\pagefile.sys 4605 4605 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 192.15 Gb Free Space | 82.51% Space Free | Partition Type: NTFS
Drive D: | 233.75 Gb Total Space | 139.73 Gb Free Space | 59.78% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: RAYS-COMPUTER
Current User Name: Raymond
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5910:TCP" = 5910:TCP:*:Enabled:vnc5910
"1900:UDP" = 1900:UDP:LocalSubNetisabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNetisabledxpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe" = C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe:*:Enabled:CyberLink PowerDVD 8.0 -- (CyberLink Corp.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe" = C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe:*:Enabled:CyberLink PowerDVD 8.0 -- (CyberLink Corp.)
"C:\Program Files\Pinnacle\Studio 14\Programs\RM.exe" = C:\Program Files\Pinnacle\Studio 14\Programs\RM.exe:*:Enabled:Render Manager -- (Pinnacle Systems)
"C:\Program Files\Pinnacle\Studio 14\Programs\Studio.exe" = C:\Program Files\Pinnacle\Studio 14\Programs\Studio.exe:*:Enabled:Studio -- (Pinnacle Systems)
"C:\Program Files\Pinnacle\Studio 14\Programs\umi.exe" = C:\Program Files\Pinnacle\Studio 14\Programs\umi.exe:*:Enabled:umi -- (Pinnacle Systems)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0345CF70-FA00-4F4E-A218-0FA494F465A4}" = LightScribe Template Designs - Business Pack 1
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Central Data
"{098122AB-C605-4853-B441-C0A4EB359B75}" = DirectXInstallService
"{14A023A2-3B5C-467A-A6C4-8583AE0BDF0E}" = LightScribe Template Designs - Kickin It Pack 1
"{15B6EAD9-E83D-458F-AF6F-B8F865FA4F28}" = LightScribe Template Designs - Wedding Pack 1
"{18143CE1-430E-4FF3-A44F-811FD2910929}" = LightScribe Template Designs - Mythology Pack 1
"{1ADE1AA0-7F82-4BB1-B1BD-727DE438057B}" = Cool & Quiet
"{1B683082-8791-4D00-8ADE-6C8986FCCC68}" = Roxio CinePlayer
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Central Tools
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"{206FD69B-F9FE-4164-81BD-D52552BC9C23}" = GearDrvs
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21
"{272F534A-29A8-40D4-8E0C-2A9A596F808D}" = LightScribe Template Designs - Tribal Pack 1
"{27F00C63-449B-2FAB-CBE8-24AB80E17449}" = Acrobat.com
"{29ACDA07-0CAD-4751-B3A4-3E03C5F74673}" = ParetoLogic Privacy Controls
"{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"{2C52D6EB-EE7E-45C4-AFB8-1242164A4A44}" = C5500n - C5800Ldn Series GDI Driver from OKI® Printing Solutions for Windows
"{2CDB2DCD-1153-4ED4-9D0A-606231CEFE9A}" = LightScribe Template Designs - Art Pack 1
"{2D2D8FE2-605C-4D3C-B706-36E981E7EEF0}" = CyberLink BD Advisor 2.0
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{305D4B08-5807-4475-B1C8-D54685534864}" = LightScribeTemplateLabeler
"{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}" = PaperPort Image Printer
"{34F93E31-E1A0-421C-8E86-BCF7C4193A91}" = LogMeIn
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3E67A8DA-FE7B-4160-8465-F5571EA18753}" = Roxio Disc Gallery
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"{4ECA4128-8B48-44A0-90E8-B93C6A69CE4B}" = LightScribe Template Designs - Music Pack 1
"{53735ECE-E461-4FD0-B742-23A352436D3A}" = Logitech Updater
"{55A75679-02D1-4C8C-85CA-B4E4DF4D775F}" = MSM32Installer
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5A06423A-210C-49FB-950E-CB0EB8C5CEC7}" = Roxio BackOnTrack
"{5DBD3F5B-B4DD-4C89-8436-A9391C471033}" = Nero 7 Ultra Edition
"{605C0E57-BBB8-458F-9020-B17DCF0D5DEA}" = LightScribe Template Designs - Floral Pack 1
"{60B2315F-680F-4EB3-B8DD-CCDC86A7CCAB}" = Roxio File Backup
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6DE721A5-5E89-4D74-994C-652BB3C0672E}" = Pinnacle Video Driver
"{725F0ABA-808A-4256-885C-1E60245521D0}" = LightScribe Template Designs - Sports Pack 1
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7373184D-8E8F-4308-912A-3901071FA1AD}" = LightScribe Applications
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Central Audio
"{742F1560-893C-457B-A47A-DBC62A1302FB}" = LightScribe Template Designs - Kids Korner Pack 1
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{79D16FEF-F66A-4DF3-AE01-DF0AE3E3BA45}" = LightScribe Template Designs - Hobby Pack 1
"{80E158EA-7181-40FE-A701-301CE6BE64AB}" = CyberLink MediaShow
"{81A28748-46BA-4010-A877-E9808993C214}" = LightScribe Template Designs - Architecture Pack 1
"{826FBE05-4D09-401A-BF2D-DDA85F590688}" = ScanSoft PDF Professional 3.0
"{85548764-32DC-43ED-BAA5-5386FDB2500A}" = LightScribe Template Designs - Urban Pack 1
"{8969CD6F-5B75-40B9-8701-86ECA4C1F263}_is1" = VSO Image Resizer 4.0.0.46
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Roxio CinePlayer Decoder Pack
"{8D815D9B-4DD9-437E-BFE2-E7374D3E7025}_is1" = Max Registry Cleaner
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A9A1828-31D1-4590-A99F-022B7237AFAE}" = Roxio MediaShare
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A344F95E-E51A-450C-8F84-C940BF61903E}" = OKI Color Swatch Utility
"{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}" = Brother MFL-Pro Suite
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{a9264802-8a7a-40fe-a135-5c6d204aed7a}.sdb" = Internet Explorer (Enable DEP)
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AADD1C8F-D59F-4D55-A726-768C71A205A8}" = Pinnacle Studio 14
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.3
"{AC76BA86-7AD7-2447-0000-900000000003}" = Chinese Simplified Fonts Support For Adobe Reader 9
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{ADD5DB49-72CF-11D8-9D75-000129760D75}" = CyberLink PowerBackup
"{B06EFB5F-FDDC-4DA3-BE5C-3E2A72D5BEAE}" = LightScribe Template Designs - Food-n-Family Pack 1
"{B1102A25-3AA3-446B-AA0F-A699B07A02FD}" = Garmin USB Drivers
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B5ECA6E5-C943-4A40-936B-8E16D5B233ED}" = LightScribe Template Designs - Grab Bag Pack 1
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Central Copy
"{B6C766E9-B26D-4D54-A22B-A52B069C6C14}" = LightScribe Template Designs - Special Occasion Pack 1
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer
"{BF83EFE2-C9F0-40D4-841C-2066668C1D7A}" = Roxio Easy Media Creator 10 Suite
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"{C8E95BF5-C07F-4D98-BB42-F58FC98BC03E}" = Google Apps
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{CA83357B-931E-44DC-AD43-9996FEEB8116}" = Acronis*True*Image
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CB84F0F2-927B-458D-9DC5-87832E3DC653}" = GearDrvs
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEF736FF-8133-42F3-8E18-BDFE293B87FF}" = LightScribe Template Designs - Holiday Pack 1
"{D1C70CF7-F2F3-4A15-ADE5-5DF1BA0739E1}" = LightScribe Template Designs - Bonus Pack 1
"{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"{D761BBA0-FBDD-4E81-96E1-43B957D91BD8}" = LightScribe Template Designs - Quick and Simple Pack 1
"{DE72186D-A4A5-4504-839C-B14FC3432DA1}" = LightScribe Template Designs - Fantasy Pack 1
"{E0783143-EAE2-4047-A8D6-E155523C594C}" = Garmin WebUpdater
"{E35A1183-F6D8-4DCA-A111-296AFFA00A5C}" = LightScribe Template Designs - Tattoo Pack 1
"{E3D04529-6EDB-11D8-A372-0050BAE317E1}" = CyberLink PowerDVD Copy
"{EC877639-07AB-495C-BFD1-D63AF9140810}" = Roxio Activation Module
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Central Core
"{F06802C4-C45A-4B56-B05A-4C8F3E963431}" = The Print Shop 22
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0E2B312-D7FD-4349-A9B6-E90B36DB1BD0}" = Paint.NET v3.5.5
"{F5C372A1-40F3-49DA-A049-F75CDE9177DC}" = Pinnacle Studio Ultimate Collection Plugins
"{F82E9B29-EE4B-418F-9CA4-A70DA610553D}" = LightScribe Template Designs - Street Style Pack 1
"{FA8BFB25-BF48-4F8B-8859-B30810745190}" = LightScribe System Software
"{FDB46DE7-9045-47BB-970A-3E4ED5369E03}" = EMC 10 Content
"45A7283175C62FAC673F913C1F532C5361F97841" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (03/08/2007 2.2.1.0)
"Acoustica Audio Converter Pro" = Acoustica Audio Converter Pro
"Acoustica CD/DVD Label Maker" = Acoustica CD/DVD Label Maker
"Acoustica Effects Pack" = Acoustica Effects Pack
"Acoustica Mixcraft 5" = Acoustica Mixcraft 5
"Acoustica MP3 Audio Mixer" = Acoustica MP3 Audio Mixer
"Acoustica MP3 CD Burner" = Acoustica MP3 CD Burner
"Acoustica MP3 To Wave Converter PLUS" = Acoustica MP3 To Wave Converter PLUS
"Active Disk" = Active Disk
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AnyDVD" = AnyDVD
"ASUS Probe V2.22.04" = ASUS Probe V2.22.04
"CCleaner" = CCleaner
"CDCovers Toolbar" = CDCovers Toolbar
"CloneCD" = CloneCD
"CloneDVD2" = CloneDVD2
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Defraggler" = Defraggler
"DVD Shrink_is1" = DVD Shrink 3.2
"FileHippo.com" = FileHippo.com Update Checker
"Folder Marker_is1" = Folder Marker Pro v 3.0
"Google Updater" = Google Updater
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}" = CyberLink MediaShow
"InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"IomegaWare" = IomegaWare 4.0.2
"Knoll Light Factory EZ Studio" = Knoll Light Factory EZ Studio
"Magic Bullet Looks Studio" = Magic Bullet Looks Studio
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Music Creator_is1" = Music Creator 4
"MyDefrag v4.3.1_is1" = MyDefrag v4.3.1
"N360" = Norton 360
"Nero PhotoShow Express 4" = Nero PhotoShow Express 4
"Nero Sipps!UninstallKey" = Nero Sipps
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NortonPCCheckup" = Norton PC Checkup
"NVIDIA Drivers" = NVIDIA Drivers
"Q828026" = Windows Media Player Hotfix [See Q828026 for more information]
"Red Giant ToonIt Studio" = Red Giant ToonIt Studio
"RocketDock_is1" = RocketDock 1.3.5
"SHOUTcast Radio Toolbar" = SHOUTcast Radio Toolbar
"SP6" = Logitech SetPoint 6.1
"Speccy" = Speccy
"stax-Pinnacle_is1" = SureThing Express Labeler
"Trapcode 3DStroke Studio" = Trapcode 3DStroke Studio
"Trapcode Particular Studio" = Trapcode Particular Studio
"Trapcode Shine Studio" = Trapcode Shine Studio
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WebPost" = Microsoft Web Publishing Wizard 1.52
"Window Washer" = Window Washer
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Mail" = Yahoo! Internet Mail
"Yahoo! Mail Advisor" = Yahoo! Mail Advisor
"Yahoo! Search Defender" = Yahoo! Search Protection

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 8/12/2010 9:04:16 AM | Computer Name = RAYS-COMPUTER | Source = Google Update | ID = 20
Description =

Error - 8/12/2010 9:11:19 AM | Computer Name = RAYS-COMPUTER | Source = Google Update | ID = 20
Description =

Error - 8/12/2010 10:04:17 AM | Computer Name = RAYS-COMPUTER | Source = Google Update | ID = 20
Description =

Error - 8/12/2010 10:11:18 AM | Computer Name = RAYS-COMPUTER | Source = Google Update | ID = 20
Description =

Error - 8/12/2010 11:04:15 AM | Computer Name = RAYS-COMPUTER | Source = Google Update | ID = 20
Description =

Error - 8/12/2010 11:11:18 AM | Computer Name = RAYS-COMPUTER | Source = Google Update | ID = 20
Description =

[ System Events ]
Error - 8/12/2010 7:58:39 AM | Computer Name = RAYS-COMPUTER | Source = NETLOGON | ID = 3095
Description = This computer is configured as a member of a workgroup, not as a member
of a domain. The Netlogon service does not need to run in this configuration.

Error - 8/12/2010 7:59:08 AM | Computer Name = RAYS-COMPUTER | Source = Service Control Manager | ID = 7000
Description = The SessionLauncher service failed to start due to the following error:
%%3

Error - 8/12/2010 1:10:49 PM | Computer Name = RAYS-COMPUTER | Source = Removable Storage Service | ID = 262255
Description = RSM could not load media in drive Drive 0 of library SanDisk Cruzer
Micro USB Device.

Error - 8/12/2010 1:10:51 PM | Computer Name = RAYS-COMPUTER | Source = Removable Storage Service | ID = 262255
Description = RSM could not load media in drive Drive 0 of library SanDisk Cruzer
Micro USB Device.

Error - 8/13/2010 10:00:06 PM | Computer Name = RAYS-COMPUTER | Source = NETLOGON | ID = 3095
Description = This computer is configured as a member of a workgroup, not as a member
of a domain. The Netlogon service does not need to run in this configuration.

Error - 8/13/2010 10:00:16 PM | Computer Name = RAYS-COMPUTER | Source = Service Control Manager | ID = 7000
Description = The SessionLauncher service failed to start due to the following error:
%%3

Error - 8/13/2010 11:34:24 PM | Computer Name = RAYS-COMPUTER | Source = NETLOGON | ID = 3095
Description = This computer is configured as a member of a workgroup, not as a member
of a domain. The Netlogon service does not need to run in this configuration.

Error - 8/13/2010 11:34:34 PM | Computer Name = RAYS-COMPUTER | Source = Service Control Manager | ID = 7000
Description = The SessionLauncher service failed to start due to the following error:
%%3

Error - 8/13/2010 11:42:28 PM | Computer Name = RAYS-COMPUTER | Source = SRService | ID = 104
Description = The System Restore initialization process failed.

Error - 8/13/2010 11:42:28 PM | Computer Name = RAYS-COMPUTER | Source = Service Control Manager | ID = 7023
Description = The System Restore Service service terminated with the following error:
%%2

< End of report >

broni · 2010/08/13

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: Garmin Communicator Plug-In https://my.garmin.com/static/m/cab/2...nAxControl.CAB (Reg Error: Key error.)
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[200 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\Documents and Settings\Raymond\My Documents\*.tmp files -> C:\Documents and Settings\Raymond\My Documents\*.tmp -> ]
[189 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\Raymond\My Documents\aha_help_music_video.wmv:Roxio EMC Stream


:Services

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 "DisableMonitoring" =-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 "DisableMonitoring" =-

:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.
==============================================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

2. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.

Click on Start button to begin cleaning process.

TFC will close all running programs, and it may ask you to restart computer.

3. Go to Kaspersky website and perform an online antivirus scan.

Disable your active antivirus program.

Read through the requirements and privacy statement and click on Accept button.

It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.

When the downloads have finished, click on Settings.

Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

Spyware, Adware, Dialers, and other potentially dangerous programs

Archives

Mail databases

Click on My Computer under Scan.

Once the scan is complete, it will display the results. Click on View Scan Report.

You will see a list of infected items there. Click on Save Report As....

Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

raylyncorvette · 2010/08/13

After the last scan I noticed the "hidden" files and "thumbs" started re-appearing. Why is this happening again?

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Starting removal of ActiveX control Garmin Communicator Plug-In
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Garmin Communicator Plug-In\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Garmin Communicator Plug-In\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Garmin Communicator Plug-In\ not found.
C:\WINDOWS\002893_.tmp deleted successfully.
C:\WINDOWS\SET3.tmp deleted successfully.
C:\WINDOWS\SET4.tmp deleted successfully.
C:\WINDOWS\SET8.tmp deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\System32\SET100.tmp deleted successfully.
C:\WINDOWS\System32\SET101.tmp deleted successfully.
C:\WINDOWS\System32\SET102.tmp deleted successfully.
C:\WINDOWS\System32\SET103.tmp deleted successfully.
C:\WINDOWS\System32\SET104.tmp deleted successfully.
C:\WINDOWS\System32\SET105.tmp deleted successfully.
C:\WINDOWS\System32\SET106.tmp deleted successfully.
C:\WINDOWS\System32\SET107.tmp deleted successfully.
C:\WINDOWS\System32\SET108.tmp deleted successfully.
C:\WINDOWS\System32\SET109.tmp deleted successfully.
C:\WINDOWS\System32\SET10A.tmp deleted successfully.
C:\WINDOWS\System32\SET10B.tmp deleted successfully.
C:\WINDOWS\System32\SET10C.tmp deleted successfully.
C:\WINDOWS\System32\SET10D.tmp deleted successfully.
C:\WINDOWS\System32\SET10E.tmp deleted successfully.
C:\WINDOWS\System32\SET10F.tmp deleted successfully.
C:\WINDOWS\System32\SET110.tmp deleted successfully.
C:\WINDOWS\System32\SET111.tmp deleted successfully.
C:\WINDOWS\System32\SET112.tmp deleted successfully.
C:\WINDOWS\System32\SET113.tmp deleted successfully.
C:\WINDOWS\System32\SET114.tmp deleted successfully.
C:\WINDOWS\System32\SET115.tmp deleted successfully.
C:\WINDOWS\System32\SET116.tmp deleted successfully.
C:\WINDOWS\System32\SET117.tmp deleted successfully.
C:\WINDOWS\System32\SET118.tmp deleted successfully.
C:\WINDOWS\System32\SET119.tmp deleted successfully.
C:\WINDOWS\System32\SET11A.tmp deleted successfully.
C:\WINDOWS\System32\SET11C.tmp deleted successfully.
C:\WINDOWS\System32\SET11D.tmp deleted successfully.
C:\WINDOWS\System32\SET11E.tmp deleted successfully.
C:\WINDOWS\System32\SET11F.tmp deleted successfully.
C:\WINDOWS\System32\SET120.tmp deleted successfully.
C:\WINDOWS\System32\SET121.tmp deleted successfully.
C:\WINDOWS\System32\SET122.tmp deleted successfully.
C:\WINDOWS\System32\SET123.tmp deleted successfully.
C:\WINDOWS\System32\SET124.tmp deleted successfully.
C:\WINDOWS\System32\SET125.tmp deleted successfully.
C:\WINDOWS\System32\SET150.tmp deleted successfully.
C:\WINDOWS\System32\SET152.tmp deleted successfully.
C:\WINDOWS\System32\SET160.tmp deleted successfully.
C:\WINDOWS\System32\SET285.tmp deleted successfully.
C:\WINDOWS\System32\SET286.tmp deleted successfully.
C:\WINDOWS\System32\SET287.tmp deleted successfully.
C:\WINDOWS\System32\SET288.tmp deleted successfully.
C:\WINDOWS\System32\SET289.tmp deleted successfully.
C:\WINDOWS\System32\SET28A.tmp deleted successfully.
C:\WINDOWS\System32\SET28B.tmp deleted successfully.
C:\WINDOWS\System32\SET28C.tmp deleted successfully.
C:\WINDOWS\System32\SET28D.tmp deleted successfully.
C:\WINDOWS\System32\SET290.tmp deleted successfully.
C:\WINDOWS\System32\SET291.tmp deleted successfully.
C:\WINDOWS\System32\SET292.tmp deleted successfully.
C:\WINDOWS\System32\SET293.tmp deleted successfully.
C:\WINDOWS\System32\SET294.tmp deleted successfully.
C:\WINDOWS\System32\SET295.tmp deleted successfully.
C:\WINDOWS\System32\SET297.tmp deleted successfully.
C:\WINDOWS\System32\SET298.tmp deleted successfully.
C:\WINDOWS\System32\SET299.tmp deleted successfully.
C:\WINDOWS\System32\SET29A.tmp deleted successfully.
C:\WINDOWS\System32\SET29B.tmp deleted successfully.
C:\WINDOWS\System32\SET29C.tmp deleted successfully.
C:\WINDOWS\System32\SET29D.tmp deleted successfully.
C:\WINDOWS\System32\SET29E.tmp deleted successfully.
C:\WINDOWS\System32\SET29F.tmp deleted successfully.
C:\WINDOWS\System32\SET2A0.tmp deleted successfully.
C:\WINDOWS\System32\SET2A1.tmp deleted successfully.
C:\WINDOWS\System32\SET2A2.tmp deleted successfully.
C:\WINDOWS\System32\SET2A3.tmp deleted successfully.
C:\WINDOWS\System32\SET2A4.tmp deleted successfully.
C:\WINDOWS\System32\SET2A5.tmp deleted successfully.
C:\WINDOWS\System32\SET2A6.tmp deleted successfully.
C:\WINDOWS\System32\SET2A7.tmp deleted successfully.
C:\WINDOWS\System32\SET2A8.tmp deleted successfully.
C:\WINDOWS\System32\SET2AA.tmp deleted successfully.
C:\WINDOWS\System32\SET2AB.tmp deleted successfully.
C:\WINDOWS\System32\SET2AC.tmp deleted successfully.
C:\WINDOWS\System32\SET2AD.tmp deleted successfully.
C:\WINDOWS\System32\SET2AE.tmp deleted successfully.
C:\WINDOWS\System32\SET2AF.tmp deleted successfully.
C:\WINDOWS\System32\SET2B1.tmp deleted successfully.
C:\WINDOWS\System32\SET2B2.tmp deleted successfully.
C:\WINDOWS\System32\SET2B3.tmp deleted successfully.
C:\WINDOWS\System32\SET2B4.tmp deleted successfully.
C:\WINDOWS\System32\SET2B5.tmp deleted successfully.
C:\WINDOWS\System32\SET2B6.tmp deleted successfully.
C:\WINDOWS\System32\SET2B7.tmp deleted successfully.
C:\WINDOWS\System32\SET2B8.tmp deleted successfully.
C:\WINDOWS\System32\SET2B9.tmp deleted successfully.
C:\WINDOWS\System32\SET2BA.tmp deleted successfully.
C:\WINDOWS\System32\SET89.tmp deleted successfully.
C:\WINDOWS\System32\SET8A.tmp deleted successfully.
C:\WINDOWS\System32\SET8B.tmp deleted successfully.
C:\WINDOWS\System32\SET8C.tmp deleted successfully.
C:\WINDOWS\System32\SET8D.tmp deleted successfully.
C:\WINDOWS\System32\SET8E.tmp deleted successfully.
C:\WINDOWS\System32\SET8F.tmp deleted successfully.
C:\WINDOWS\System32\SET90.tmp deleted successfully.
C:\WINDOWS\System32\SET91.tmp deleted successfully.
C:\WINDOWS\System32\SET94.tmp deleted successfully.
C:\WINDOWS\System32\SET95.tmp deleted successfully.
C:\WINDOWS\System32\SET96.tmp deleted successfully.
C:\WINDOWS\System32\SET97.tmp deleted successfully.
C:\WINDOWS\System32\SET98.tmp deleted successfully.
C:\WINDOWS\System32\SET99.tmp deleted successfully.
C:\WINDOWS\System32\SET9B.tmp deleted successfully.
C:\WINDOWS\System32\SET9C.tmp deleted successfully.
C:\WINDOWS\System32\SET9D.tmp deleted successfully.
C:\WINDOWS\System32\SET9E.tmp deleted successfully.
C:\WINDOWS\System32\SET9F.tmp deleted successfully.
C:\WINDOWS\System32\SETA0.tmp deleted successfully.
C:\WINDOWS\System32\SETA1.tmp deleted successfully.
C:\WINDOWS\System32\SETA2.tmp deleted successfully.
C:\WINDOWS\System32\SETA3.tmp deleted successfully.
C:\WINDOWS\System32\SETA4.tmp deleted successfully.
C:\WINDOWS\System32\SETA5.tmp deleted successfully.
C:\WINDOWS\System32\SETA6.tmp deleted successfully.
C:\WINDOWS\System32\SETA7.tmp deleted successfully.
C:\WINDOWS\System32\SETA8.tmp deleted successfully.
C:\WINDOWS\System32\SETA9.tmp deleted successfully.
C:\WINDOWS\System32\SETAA.tmp deleted successfully.
C:\WINDOWS\System32\SETAB.tmp deleted successfully.
C:\WINDOWS\System32\SETAC.tmp deleted successfully.
C:\WINDOWS\System32\SETAE.tmp deleted successfully.
C:\WINDOWS\System32\SETAF.tmp deleted successfully.
C:\WINDOWS\System32\SETB0.tmp deleted successfully.
C:\WINDOWS\System32\SETB1.tmp deleted successfully.
C:\WINDOWS\System32\SETB2.tmp deleted successfully.
C:\WINDOWS\System32\SETB3.tmp deleted successfully.
C:\WINDOWS\System32\SETB4.tmp deleted successfully.
C:\WINDOWS\System32\SETB5.tmp deleted successfully.
C:\WINDOWS\System32\SETB6.tmp deleted successfully.
C:\WINDOWS\System32\SETB7.tmp deleted successfully.
C:\WINDOWS\System32\SETB8.tmp deleted successfully.
C:\WINDOWS\System32\SETB9.tmp deleted successfully.
C:\WINDOWS\System32\SETBA.tmp deleted successfully.
C:\WINDOWS\System32\SETBB.tmp deleted successfully.
C:\WINDOWS\System32\SETBC.tmp deleted successfully.
C:\WINDOWS\System32\SETBD.tmp deleted successfully.
C:\WINDOWS\System32\SETBE.tmp deleted successfully.
C:\WINDOWS\System32\SETBF.tmp deleted successfully.
C:\WINDOWS\System32\SETC0.tmp deleted successfully.
C:\WINDOWS\System32\SETC1.tmp deleted successfully.
C:\WINDOWS\System32\SETC2.tmp deleted successfully.
C:\WINDOWS\System32\SETC3.tmp deleted successfully.
C:\WINDOWS\System32\SETC4.tmp deleted successfully.
C:\WINDOWS\System32\SETC5.tmp deleted successfully.
C:\WINDOWS\System32\SETC6.tmp deleted successfully.
C:\WINDOWS\System32\SETC9.tmp deleted successfully.
C:\WINDOWS\System32\SETCA.tmp deleted successfully.
C:\WINDOWS\System32\SETCB.tmp deleted successfully.
C:\WINDOWS\System32\SETCC.tmp deleted successfully.
C:\WINDOWS\System32\SETCD.tmp deleted successfully.
C:\WINDOWS\System32\SETCE.tmp deleted successfully.
C:\WINDOWS\System32\SETD0.tmp deleted successfully.
C:\WINDOWS\System32\SETD1.tmp deleted successfully.
C:\WINDOWS\System32\SETD2.tmp deleted successfully.
C:\WINDOWS\System32\SETD3.tmp deleted successfully.
C:\WINDOWS\System32\SETD4.tmp deleted successfully.
C:\WINDOWS\System32\SETD5.tmp deleted successfully.
C:\WINDOWS\System32\SETD6.tmp deleted successfully.
C:\WINDOWS\System32\SETD7.tmp deleted successfully.
C:\WINDOWS\System32\SETD8.tmp deleted successfully.
C:\WINDOWS\System32\SETD9.tmp deleted successfully.
C:\WINDOWS\System32\SETDA.tmp deleted successfully.
C:\WINDOWS\System32\SETDB.tmp deleted successfully.
C:\WINDOWS\System32\SETDC.tmp deleted successfully.
C:\WINDOWS\System32\SETDD.tmp deleted successfully.
C:\WINDOWS\System32\SETDE.tmp deleted successfully.
C:\WINDOWS\System32\SETDF.tmp deleted successfully.
C:\WINDOWS\System32\SETE0.tmp deleted successfully.
C:\WINDOWS\System32\SETE1.tmp deleted successfully.
C:\WINDOWS\System32\SETE3.tmp deleted successfully.
C:\WINDOWS\System32\SETE4.tmp deleted successfully.
C:\WINDOWS\System32\SETE5.tmp deleted successfully.
C:\WINDOWS\System32\SETE6.tmp deleted successfully.
C:\WINDOWS\System32\SETE7.tmp deleted successfully.
C:\WINDOWS\System32\SETE8.tmp deleted successfully.
C:\WINDOWS\System32\SETEA.tmp deleted successfully.
C:\WINDOWS\System32\SETEB.tmp deleted successfully.
C:\WINDOWS\System32\SETEC.tmp deleted successfully.
C:\WINDOWS\System32\SETED.tmp deleted successfully.
C:\WINDOWS\System32\SETEE.tmp deleted successfully.
C:\WINDOWS\System32\SETEF.tmp deleted successfully.
C:\WINDOWS\System32\SETF0.tmp deleted successfully.
C:\WINDOWS\System32\SETF1.tmp deleted successfully.
C:\WINDOWS\System32\SETF2.tmp deleted successfully.
C:\WINDOWS\System32\SETF3.tmp deleted successfully.
C:\WINDOWS\System32\SETF4.tmp deleted successfully.
C:\WINDOWS\System32\SETF5.tmp deleted successfully.
C:\WINDOWS\System32\SETF6.tmp deleted successfully.
C:\WINDOWS\System32\SETF7.tmp deleted successfully.
C:\WINDOWS\System32\SETF8.tmp deleted successfully.
C:\WINDOWS\System32\SETF9.tmp deleted successfully.
C:\WINDOWS\System32\SETFA.tmp deleted successfully.
C:\WINDOWS\System32\SETFB.tmp deleted successfully.
C:\WINDOWS\System32\SETFC.tmp deleted successfully.
C:\WINDOWS\System32\SETFD.tmp deleted successfully.
C:\WINDOWS\System32\SETFE.tmp deleted successfully.
C:\WINDOWS\System32\SETFF.tmp deleted successfully.
C:\Documents and Settings\Raymond\My Documents\PP_MOTION.TMP folder deleted successfully.
C:\Documents and Settings\Raymond\My Documents\PP_ROTATE_SLIDE.TMP folder deleted successfully.
C:\WINDOWS\System32\dllcache\cryptdlg.dll.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\dispex.dll.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\dosapp.fon.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\drvmain.sdb.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\dssenh.dll.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\fastfat.sys.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET231.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET232.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET233.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET234.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET235.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET236.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET237.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET238.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET239.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET23A.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET23D.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET23E.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET23F.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET240.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET241.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET242.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET243.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET244.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET245.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET246.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET247.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET248.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET249.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET24A.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET24B.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET24C.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET24D.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET24E.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET24F.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET250.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET251.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET252.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET253.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET254.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET255.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET256.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET257.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET258.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET25C.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET25D.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET25E.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET25F.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET260.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET261.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET262.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET31.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET32.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET33.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET34.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET35.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET36.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET37.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET38.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET39.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET3A.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET3B.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET3C.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET3D.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET3E.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET3F.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET40.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET41.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET42.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET43.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET44.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET45.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET46.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET47.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET48.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET49.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET4A.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET4B.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET4C.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET4D.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET4E.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET4F.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET50.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET51.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET52.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET53.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET54.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET55.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET56.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET57.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET58.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET59.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET5A.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET5B.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET5C.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET5D.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET5E.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET5F.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET60.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET61.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET62.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET63.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET64.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET65.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET66.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET67.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET68.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET6A.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET6B.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET6C.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET6D.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET6E.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET6F.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET70.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET71.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET72.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET73.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET74.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET75.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET76.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET77.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET78.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET79.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET7A.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET7B.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET7C.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET7D.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET7E.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET7F.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET80.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET81.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET82.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET83.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET84.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET85.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET86.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET89.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET8A.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET8B.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET8C.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET8D.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET8E.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET8F.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET9D.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET9E.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SET9F.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETA0.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETA1.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETA2.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETA3.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETA4.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETA5.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETA6.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETA8.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETA9.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETAA.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETAB.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETAC.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETAD.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETAE.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETAF.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETB0.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETB1.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETB2.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETB3.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETB4.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETB5.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETB6.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETB7.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETB8.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETB9.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETBA.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETBB.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETBC.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETBD.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETBE.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETBF.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETC0.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETC1.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETC2.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETC3.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETC4.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETC7.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETC8.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETC9.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETCA.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETCB.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETCC.tmp deleted successfully.
C:\WINDOWS\System32\dllcache\SETCD.tmp deleted successfully.
ADS C:\Documents and Settings\Raymond\My Documents\aha_help_music_video.wmv:Roxio EMC Stream deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus\\DisableMonitoring deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall\\DisableMonitoring deleted successfully.
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56504 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 344090 bytes

User: LogMeInRemoteUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes

User: LogMeInRemoteUser.RAYS-COMPUTER
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes
->Flash cache emptied: 55961 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Ray Ellis
->Temp folder emptied: 400809 bytes
->Temporary Internet Files folder emptied: 13327976 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 4017 bytes

User: Raymond
->Temp folder emptied: 10271 bytes
->Temporary Internet Files folder emptied: 31307145 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 14156 bytes

User: TEMP
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes

User: TEMP.RAYS-COMPUTER
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16867 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 43.00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: LogMeInRemoteUser

User: LogMeInRemoteUser.RAYS-COMPUTER
->Flash cache emptied: 0 bytes

User: NetworkService

User: Ray Ellis
->Flash cache emptied: 0 bytes

User: Raymond
->Flash cache emptied: 0 bytes

User: TEMP

User: TEMP.RAYS-COMPUTER

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.9.1 log created on 08132010_231940

Files\Folders moved on Reboot...
C:\Documents and Settings\Raymond\Local Settings\Temporary Internet Files\Content.IE5\RHREN806\adTag[2].htm moved successfully.
C:\Documents and Settings\Raymond\Local Settings\Temporary Internet Files\Content.IE5\RHREN806\blank[2].html moved successfully.
C:\Documents and Settings\Raymond\Local Settings\Temporary Internet Files\Content.IE5\RHREN806\fc[6].htm moved successfully.
C:\Documents and Settings\Raymond\Local Settings\Temporary Internet Files\Content.IE5\RHREN806\launch[1].htm moved successfully.
C:\Documents and Settings\Raymond\Local Settings\Temporary Internet Files\Content.IE5\RHREN806\st[1] moved successfully.
C:\Documents and Settings\Raymond\Local Settings\Temporary Internet Files\Content.IE5\8BB09GFP\blank[1].html moved successfully.
C:\Documents and Settings\Raymond\Local Settings\Temporary Internet Files\Content.IE5\8BB09GFP\iframe3[1].htm moved successfully.
C:\Documents and Settings\Raymond\Local Settings\Temporary Internet Files\Content.IE5\8BB09GFP\track_click[1].htm moved successfully.
C:\Documents and Settings\Raymond\Local Settings\Temporary Internet Files\Content.IE5\44L9IP6Q\113ce987-2b1b-469e-b639-39b1d3dac068_3rd_party_BBS[2].htm moved successfully.
C:\Documents and Settings\Raymond\Local Settings\Temporary Internet Files\Content.IE5\44L9IP6Q\94583-active-hidden-icons-everywhere[1].html moved successfully.
C:\Documents and Settings\Raymond\Local Settings\Temporary Internet Files\Content.IE5\44L9IP6Q\;ord=88122758255343980[1].htm moved successfully.
C:\Documents and Settings\Raymond\Local Settings\Temporary Internet Files\Content.IE5\44L9IP6Q\data_sync[1].htm moved successfully.
C:\Documents and Settings\Raymond\Local Settings\Temporary Internet Files\Content.IE5\326VGL3Q\ads[6].htm moved successfully.
C:\Documents and Settings\Raymond\Local Settings\Temporary Internet Files\Content.IE5\326VGL3Q\p-01-0VIaSjnOLg[1].gif moved successfully.
C:\Documents and Settings\Raymond\Local Settings\Temporary Internet Files\Content.IE5\326VGL3Q\p-01-0VIaSjnOLg[2].gif moved successfully.
File move failed. C:\Documents and Settings\Raymond\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\Raymond\Local Settings\Temporary Internet Files\SuggestedSites.dat scheduled to be moved on reboot.
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_2f0.dat not found!

Registry entries deleted on Reboot...

raylyncorvette · 2010/08/13

Results of screen317's Security Check version 0.99.5
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
Norton 360
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Max Registry Cleaner
Java(TM) 6 Update 21
Adobe Flash Player
Adobe Reader 9.3.3
Chinese Simplified Fonts Support For Adobe Reader 9
````````````````````````````````
Process Check:
objlist.exe by Laurent
Norton ccSvcHst.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

broni · 2010/08/13

Why is this happening again?
Click to expand...

Restart computer.

SecurityCheck log looks good

raylyncorvette · 2010/08/14

Sorry for the delay. It was very late and Kaspersky was still running. I've inserted the log as requested.

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Saturday, August 14, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Saturday, August 14, 2010 03:16:25
Records in database: 4132424
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
F:\
G:\
H:\
I:\

Scan statistics:
Objects scanned: 130486
Threats found: 2
Infected objects found: 2
Suspicious objects found: 0
Scan duration: 03:40:38

File name / Threat / Threats count
C:\Documents and Settings\Raymond\Desktop\ICONS Not Needed\spywaredetectorb Setup.exe Infected: not-a-virus:FraudTool.Win32.SpywareDetector.g 1
C:\Program Files\Acoustica Mixcraft 5\VST\3rdParty\Messiah\CK_MIDI_NOTE_DELAY.SEP Infected: Trojan-PSW.Win32.QQPass.vgu 1

Selected area has been scanned.

raylyncorvette · 2010/08/14

I just received an e-mail from MaxSecure telling me they have a solution for my problem and have asked me to download their product and install something from a zip file. If I'm not mistaken, this program was the start of my problems. Any comments?

Here is the e-mail...

Sat, August 14, 2010 5:39:25 AMSolution from Max Secure Software regarding your issue.
From: Pankaj <pankaj.b@maxpcsecure.biz>Add to Contacts
To: raylyncorvette@yahoo.com

maxs.zip (1KB)

--------------------------------------------------------------------------------

Dear Raymond,

Please find the attachment.

Please do the following steps to resolve your issue:

1) Save attachment to desktop.
2) Extract the zip file.
3) Double Click and run the maxs.bat file.
4) Download Spyware Detector and install on your PC.

broni · 2010/08/14

That's a rogue program. Stay away.
See WOT ratings: http://www.mywot.com/en/scorecard/spywaredetector.net

==================================================================

OTL Clean-Up
Clean up with OTL:

* Double-click OTL.exe to start the program.
* Close all other programs apart from OTL as this step will require a reboot
* On the OTL main screen, press the CLEANUP button
* Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

=================================================================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point.

Turn off System Restore:

- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore ".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista and 7:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C: ")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK

2. Restart computer.

3. Turn System Restore on.

4. Make sure, Windows Updates are current.

5. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

8. Run Temporary File Cleaner (TFC) weekly.

9. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

10. Run defrag at your convenience.

11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

12. Please, let me know, how is your computer doing.

raylyncorvette · 2010/08/14

Everything seems to be working perfect. No more hidden icons appearing on the desktop or in the folders. I just finished loading secunia to the sytem. When I click on to the icon I see a flash screen and then just the desktop. Is this normal? Does it run in the background? As for my System Restore I did as instructed however I never use it anyway because it doesn't work. I've reloaded windows several times in the past and SR just quits working. One last question...should I dump my backups and perform a fresh one for future use if needed? And should I dump Max Registry Cleaner too? It seems I installed a program that isn't as it appears (Max Secure Spyware Detector and Registry Cleaner).

broni · 2010/08/14

Good news

When I click on to the icon I see a flash screen and then just the desktop. Is this normal? Does it run in the background?
Click to expand...

Check taskbar and systray. It may be visible there.

should I dump my backups and perform a fresh one for future use if needed?
Click to expand...

That would be very good idea.

Registry tools are not recommended and here is why: http://miekiemoes.blogspot.com/2008/02/registry-cleaners-and-system-tweaking_13.html
Uninstall it.

Good luck and stay safe

Log in or Sign up

Solved Hidden Icons Are Everywhere

raylyncorvette Well-Known Member Thread Starter

broni Moderator Malware Analyst

raylyncorvette Well-Known Member Thread Starter

broni Moderator Malware Analyst

raylyncorvette Well-Known Member Thread Starter

broni Moderator Malware Analyst

raylyncorvette Well-Known Member Thread Starter

broni Moderator Malware Analyst

raylyncorvette Well-Known Member Thread Starter

raylyncorvette Well-Known Member Thread Starter

raylyncorvette Well-Known Member Thread Starter

broni Moderator Malware Analyst

raylyncorvette Well-Known Member Thread Starter

raylyncorvette Well-Known Member Thread Starter

broni Moderator Malware Analyst

raylyncorvette Well-Known Member Thread Starter

raylyncorvette Well-Known Member Thread Starter

broni Moderator Malware Analyst

raylyncorvette Well-Known Member Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved Hidden Icons Are Everywhere

raylyncorvette Well-Known Member Thread Starter

broni Moderator Malware Analyst

raylyncorvette Well-Known Member Thread Starter

broni Moderator Malware Analyst

raylyncorvette Well-Known Member Thread Starter

broni Moderator Malware Analyst

raylyncorvette Well-Known Member Thread Starter

broni Moderator Malware Analyst

raylyncorvette Well-Known Member Thread Starter

raylyncorvette Well-Known Member Thread Starter

raylyncorvette Well-Known Member Thread Starter

broni Moderator Malware Analyst

raylyncorvette Well-Known Member Thread Starter

raylyncorvette Well-Known Member Thread Starter

broni Moderator Malware Analyst

raylyncorvette Well-Known Member Thread Starter

raylyncorvette Well-Known Member Thread Starter

broni Moderator Malware Analyst

raylyncorvette Well-Known Member Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches