Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Latest News: Firefox Targeting Competing VPN Sites With ProtonVPN Offer in New Test

Featured Deal: Get 95% Off the Certified Information Systems Security Professional Training Course

Helpassistant virus

Started by BennetLang , Feb 28 2010 10:56 AM

This topic is locked

13 replies to this topic

#1 BennetLang

Members
8 posts
OFFLINE

Local time:04:43 PM

Posted 28 February 2010 - 10:56 AM

I am trying to help with a relative's computer. She had a trojan a few weeks ago and we thought we had cleaned things up and we did eventually get a clean ESET scan. It found trojans in her email inbox, which we deleted and moved her to new email program.

Help assistant shows up in the documents and settings directory, along with the 4 other regular users. It does not appear in control panel/user accounts. It copies all the files from the main user of the computer into its directory. If I delete the directory it reappears within about 10-15 minutes when we reboot, even in safe mode. Once it's deleted it doesn't come back that session.

The computer is also slow especially at startup, with services.exe and system having very high CPU use. The problem a few weeks ago started when the computer had McAfee which had expired, it now has Norton AV and Firewall from Comcast. Malwarebytes and a full system scan in Norton has not found anything.

It's a Dell 4600, Pentium 4, Windows XP Home, 2.66GHZ, 1.5 GB of RAM.

It has had 3 BSODs in the last week or so, BAD_POOL_CALLER, IRQ_NOT_EQUAL_OR_LESS and something else about driver verifier. Firefox has also started crashing regularly even after reinstalling and creating a new profile, these may not be related.

Thank you very much for any help you can offer, from reading other posts I know this is complicated. Below is the DDS log, with the other DDS file and GMER files attached. I won't run any other cleanup program.

DDS (Ver_09-12-01.01) - NTFSx86
Run by at 20:53:14.01 on Sat 02/27/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1535.884 [GMT -8:00]

AV: Norton Security Suite *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\svchost.exe -k HPService
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Documents and Settings\Cindy Peterson\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Bar = hxxp://www.comcast.net/toolbar2.0/search/
uStart Page = hxxp://www.google.com/
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {243b17de-77c7-46bf-b94b-0b5f309a0e64} - c:\program files\microsoft money\system\mnyside.dll
BHO: Comcast Toolbar: {4e7bd74f-2b8d-469e-93be-be2df4d9ae29} - c:\progra~1\comcas~1\COMCAS~1.DLL
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton security suite\engine\3.8.0.41\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton security suite\engine\3.8.0.41\IPSBHO.DLL
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Comcast Toolbar: {4e7bd74f-2b8d-469e-93be-be2df4d9ae29} - c:\progra~1\comcas~1\COMCAS~1.DLL
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton security suite\engine\3.8.0.41\coIEPlg.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
uRun: [Sonic RecordNow!]
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Auto Run Software for Photo Frame]
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [StorageGuard] "c:\program files\common files\sonic\update manager\sgtray.exe" /r
mRun: [itype] "c:\program files\microsoft intellitype pro\itype.exe"
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"
mRun: [Auto Run Software for Photo Frame]
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [UpdReg] c:\windows\UpdReg.EXE
mRun: [diagent] "c:\program files\creative\sblive\diagnostics\diagent.exe" startup
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\acroba~1.lnk - c:\program files\adobe\acrobat 6.0\distillr\acrotray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\nkbmon~1.lnk - c:\program files\nikon\pictureproject\NkbMonitor.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
IE: {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - {DD6687B5-CB43-4211-BFC9-2942CCBDCB3E} - c:\program files\microsoft money\system\mnyside.dll
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6087.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton security suite\engine\3.8.0.41\CoIEPlg.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\cindyp~1\applic~1\mozilla\firefox\profiles\7fj2fqyz.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\coffplgn\components\coFFPlgn.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPMGWRAP.DLL
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\musicnotes\npmusicn.dll
FF - plugin: c:\program files\musicnotes\NPSibelius.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0308000.029\SymEFA.sys [2010-2-6 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\n360\0308000.029\BHDrvx86.sys [2010-2-6 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360\0308000.029\cchpx86.sys [2010-2-6 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20100224.002\IDSXpx86.sys [2010-2-26 329592]
R2 N360;Norton Security Suite;c:\program files\norton security suite\engine\3.8.0.41\ccSvcHst.exe [2010-2-6 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-2-5 102448]
R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20100227.007\NAVENG.SYS [2010-2-27 84912]
R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20100227.007\NAVEX15.SYS [2010-2-27 1324720]

=============== Created Last 30 ================

2010-02-28 04:52:11 0 ----a-w- c:\documents and settings\cindy peterson\defogger_reenable
2010-02-28 01:09:00 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-28 01:08:56 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-28 01:08:56 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-27 18:56:04 82375 ----a-w- c:\documents and settings\cindy peterson\bookmarks.html
2010-02-27 03:21:05 0 d-----w- c:\program files\CCleaner
2010-02-27 03:16:49 0 d-----w- c:\windows\system32\Adobe
2010-02-27 02:56:48 186097 ----a-w- c:\windows\system32\nvapps.xml
2010-02-27 02:56:46 18070 ----a-w- c:\windows\system32\nvdisp.nvu
2010-02-27 02:56:46 0 d-----w- c:\windows\nview
2010-02-27 02:56:40 446464 ----a-w- c:\windows\system32\nvudisp.exe
2010-02-27 02:55:43 446464 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-02-27 02:55:22 0 d-----w- C:\NVIDIA
2010-02-27 02:51:18 0 d-----w- c:\program files\SystemRequirementsLab
2010-02-27 02:34:28 991232 ----a-w- c:\windows\system32\virtear.dll
2010-02-27 02:34:28 65536 ----a-w- c:\windows\system32\Audio3d.dll
2010-02-27 02:34:28 49152 ----a-w- c:\windows\system32\DSndUp.exe
2010-02-27 02:34:28 45056 ----a-w- c:\windows\system32\CleanUp.exe
2010-02-27 02:34:28 0 d-----w- c:\windows\VirtualEar
2010-02-27 02:34:28 0 d-----w- c:\program files\Analog Devices
2010-02-27 02:33:38 732928 ----a-w- c:\windows\system32\drivers\senfilt.sys
2010-02-27 02:33:38 311296 ----a-w- c:\windows\system32\Edcrypt.dll
2010-02-27 02:33:38 260352 ----a-w- c:\windows\system32\drivers\smwdm.sys
2010-02-27 02:33:38 23040 ----a-w- c:\windows\system32\PostProc.dll
2010-02-27 02:33:37 765952 ----a-w- c:\windows\system\crlds3d.dll
2010-02-25 15:59:26 0 d-----w- C:\N360_BACKUP
2010-02-16 02:50:20 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-02-16 02:50:20 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-02-15 05:36:23 0 d-----w- c:\program files\Microsoft
2010-02-15 05:34:48 0 d-----w- c:\program files\Windows Live SkyDrive
2010-02-15 05:29:12 0 d-----w- c:\program files\common files\Windows Live
2010-02-14 22:12:52 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-02-14 03:57:38 0 d-----w- c:\program files\ACW
2010-02-13 20:21:12 0 d-----w- c:\docume~1\cindyp~1\applic~1\Windows Search
2010-02-13 19:16:21 26 ----a-w- c:\windows\system32\ctzapxx.ini
2010-02-13 19:16:21 2516 ----a-w- c:\windows\system32\P16X.ini
2010-02-13 19:16:21 0 d-----w- c:\windows\system32\Data
2010-02-13 19:16:20 20480 ----a-w- c:\windows\INRES.DLL
2010-02-13 19:16:19 61440 ----a-w- c:\windows\MIDIDEF.EXE
2010-02-13 19:16:19 59 ----a-w- c:\windows\system32\default8.sfm
2010-02-13 19:16:19 59 ----a-w- c:\windows\system32\default4.sfm
2010-02-13 19:16:19 59 ----a-w- c:\windows\system32\Default.sfm
2010-02-13 19:16:19 2696 ----a-w- c:\windows\MIXDEF.INI
2010-02-13 19:16:19 24576 ----a-w- c:\windows\MIXERDEF.EXE
2010-02-13 19:16:19 1048576 ----a-w- c:\windows\system32\Ct1mgm.rom
2010-02-13 19:15:16 6752 ------w- c:\windows\system32\PFMODNT.SYS
2010-02-13 19:15:06 15840 ------w- c:\windows\system32\drivers\PFMODNT.SYS
2010-02-13 19:15:06 0 d-----w- c:\program files\Creative
2010-02-12 17:17:14 0 d-sh--w- c:\documents and settings\cindy peterson\IECompatCache
2010-02-12 16:56:58 0 d-sh--w- c:\documents and settings\cindy peterson\IETldCache
2010-02-12 07:52:38 69120 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-02-12 07:52:00 0 d-----w- c:\windows\ie8updates
2010-02-12 07:51:05 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-02-12 07:51:00 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-02-12 07:44:47 0 dc-h--w- c:\windows\ie8
2010-02-12 07:29:33 0 d-----w- c:\program files\Windows Desktop Search
2010-02-12 07:29:32 0 d-----w- c:\windows\system32\GroupPolicy
2010-02-12 07:26:41 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
2010-02-12 07:26:41 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
2010-02-12 07:26:41 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
2010-02-11 02:35:35 0 d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2010-02-11 02:35:12 0 d-----w- c:\program files\SUPERAntiSpyware
2010-02-11 02:35:12 0 d-----w- c:\docume~1\cindyp~1\applic~1\SUPERAntiSpyware.com
2010-02-10 05:43:34 0 d-----w- c:\program files\Trend Micro
2010-02-10 04:29:30 0 d-----w- c:\program files\Windows Media Connect 2
2010-02-10 04:26:43 0 d-----w- c:\windows\system32\LogFiles
2010-02-07 23:19:39 0 ----a-w- c:\documents and settings\cindy peterson\Ÿ9Ÿ9
2010-02-07 21:53:06 118272 ----a-w- c:\windows\system32\hpz3l692.dll
2010-02-07 21:50:41 309760 ----a-r- c:\windows\system32\difxapi.dll
2010-02-07 21:50:40 372736 ----a-r- c:\windows\system32\hppldcoi.dll
2010-02-07 21:50:40 303104 ----a-r- c:\windows\system32\hposc_p01a.dll
2010-02-07 21:50:37 974848 ----a-r- c:\windows\system32\hpost_p01a.dll
2010-02-07 21:50:34 729088 ----a-r- c:\windows\system32\hposwia_p01a.dll
2010-02-07 21:09:43 0 d-----w- c:\program files\common files\HP
2010-02-07 20:53:53 166112 ----a-w- c:\windows\hpoins30.dat
2010-02-07 20:53:52 844 ------w- c:\windows\hpomdl30.dat
2010-02-07 18:02:52 0 d-----w- c:\docume~1\alluse~1\applic~1\Symantec
2010-02-07 04:17:18 0 d-----r- c:\program files\Norton Support
2010-02-06 23:43:04 0 d-----w- c:\windows\system32\URTTEMP
2010-02-06 23:42:02 0 d-----w- c:\program files\Symantec
2010-02-06 21:06:40 36400 ----a-r- c:\windows\system32\drivers\SymIM.sys
2010-02-06 21:06:22 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2010-02-06 21:06:22 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2010-02-06 21:06:22 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2010-02-06 21:06:22 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-02-06 21:06:22 0 d-----w- c:\program files\common files\Symantec Shared
2010-02-06 21:04:07 0 d-----w- c:\windows\system32\drivers\N360
2010-02-06 21:04:02 0 d-----w- c:\program files\Norton Security Suite
2010-02-06 21:04:00 0 d-----w- c:\docume~1\alluse~1\applic~1\Norton
2010-02-06 21:01:32 0 d-----w- c:\program files\NortonInstaller
2010-02-06 20:45:16 0 d-----w- c:\docume~1\alluse~1\applic~1\NortonInstaller
2010-02-06 20:22:25 73728 ----a-w- c:\windows\system32\javacpl.cpl

==================== Find3M ====================

2010-02-06 21:06:01 26600 ----a-r- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-02-06 21:05:33 107368 ----a-r- c:\windows\system32\GEARAspi.dll
2010-02-06 20:21:30 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-03 01:46:00 114065 ----a-w- c:\windows\fonts\AdobeFnt07.lst
2009-12-31 16:50:03 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14:05 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-16 18:43:27 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08:23 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:27:51 2189184 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43:50 2066048 ----a-w- c:\windows\system32\ntkrnlpa.exe
2008-10-02 16:37:02 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008100220081003\index.dat

============= FINISH: 20:54:23.46 ===============

Attached Files

Attach.txt 16.77KB 3 downloads
ark.txt 7.61KB 1 downloads

BC AdBot (Login to Remove)

BleepingComputer.com
Register to remove ads

#2 thcbytes

Malware Response Team
14,790 posts
OFFLINE

Gender:Male
Local time:04:43 PM

Posted 04 March 2010 - 10:11 PM

Hi and welcome to the Virus/Trojan/Spyware/Malware Removal forum,

I am thcbytes and I am here to help you!

I ask that you refrain from running tools other than those I suggest to you while I am cleaning up your computer. The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.

Please perform all steps in the order received and do not proceed if you need clarification.

Please copy and paste all logs into your post unless directed otherwise. Please do not re-run any programs I suggest. If you encounter problems please stop and tell me about it. When your computer is clean I will alert you of such. I will also provide you with detailed suggestions for prevention.

In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. By doing this and then choosing Immediate E-Mail notification and then clicking on Proceed you will be advised when we respond to your topic and facilitate the cleaning of your machine.

After 5 days if your topic is not replied I we assume it has been abandoned and I will close it.

I would also like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please be courteous and appreciative for the assistance provided!

Again I would like to remind you to make no further changes to your computer unless I direct you to do so. Your computer fix will be based on the current condition of your computer! Any changes might delay my ability to help you.

==========

RKill by Grinler

Link #1
Link #2
Link #3
Link #4

Before we begin, you should disable your anti-malware softwares you have installed so they do not interfere RKill running as some anti-malware softwares detect RKill as malicious. Please refer to this page if you are not sure how.
Download Link #1.
Save it to your Desktop.
Double click the RKill desktop icon.
If you are using Vista please right click and run as Admin!
A black screen will briefly flash indicating a successful run.
If this does not occur please delete that application and download Link #2.
Continue process until the tool runs.
If the tool does not run from any of the links tell me about it.
It shall produce a log located at C:\RKill. Please copy and paste it into your next reply.

==========

Download and Run ComboFix (by sUBs)

You must rename it before saving it.

Please download ComboFix from one of these locations:

Link 1
Link 2

Save thcbytes.exe to your Desktop <-- Important!!!

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Please refer to this link for instructions.
Double click on thcbytes.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

==========

Please download this program to your desktop.
http://noahdfear.net/downloads/HelpAsst_mebroot_fix.exe
Double click and run it.

Next...

1. Go to Start -> Run, and type "notepad" into the box without the "".
2. Press ok.
3. Copy and paste the following code into notepad without the word "code":

CODE

mbr -f

4. Go to File -> Save
5. To the right of "Save as Type:" in the bottom of the window, change the ComboBox to "All Files"
6. Enter fix.bat into the "File name:" box just above the "Save as Type" box.
7. Double click fix.bat on your desktop.

A new MBR log will be created. Please post this.

==========

Open Notepad.
Copy contents in the code box into Notepad:

CODE

@echo off
net user HelpAssistant>"%userprofile%\desktop\log.txt"
start notepad "%userprofile%\desktop\log.txt"
cls

Go to File - Save as...
Fill in the next values:
Location: Desktop
File name: Help.bat
File type: All files (*.*).
Now, click Save.

Doubleclick Help.bat.
Post the contents of the logfile that opens in your next reply.

==========

Please download this program to your desktop.
http://noahdfear.net/downloads/profiles.exe
Double click and run it.
Post the log

==========

With your next post please provide:

* RKill log
* Combofix.txt
* Mbr log
* Help log
* Profiles log
* How is your computer running?

Thanks,
~ t

Proud member - Unified Network of Instructors and Trained Eliminators
Posted Image

I do not accept personal donations for assistance provided. I would ask that you instead consider donating the greatest gift - Organ Donation. Your organs are of no use to you when your gone. You will save a life that would otherwise be lost!

http://donatelife.net/register-now/

#3 BennetLang

Topic Starter

Members
8 posts
OFFLINE

Local time:04:43 PM

Posted 04 March 2010 - 11:50 PM

Hi, thcbytes

Thank you very much for your reply. After I posted I unplugged it from the internet and it crashed and so I just left it off and unplugged. When I put it back on line I saw that it wasn't creating the helpassistant account right away. I ran everything, I hope I've got the logs all below, but the helpassistant..exe didn't find a helpassistant account. I don't want to re-run anything in case that causes a problem. I had some problem downloading profiles.exe and had to download and copy it from another computer. I think the other logs are below. Firefox opened without crashing, so that seems like progress. I'll be able to tell better when it restarts, and if it doesn't crash. The hourglass keeps coming on and off though.

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Ran as Cindy Peterson on 03/04/2010 at 19:56:04.

Processes terminated by Rkill or while it was running:

C:\WINDOWS\system32\nvsvc32.exe
C:\Documents and Settings\Cindy Peterson\Desktop\rkill.pif

Rkill completed on 03/04/2010 at 19:56:08.

ComboFix 10-03-04.02 - Cindy Peterson 03/04/2010 20:03:49.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1535.875 [GMT -8:00]
Running from: c:\documents and settings\Cindy Peterson\Desktop\thcbytes.exe
AV: Norton Security Suite *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\jestertb.dll
c:\windows\system32\Data

.
original MBR restored successfully !
.
((((((((((((((((((((((((( Files Created from 2010-02-05 to 2010-03-05 )))))))))))))))))))))))))))))))
.

2010-03-05 03:47 . 2010-02-06 03:02 84912 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\NAVENG.SYS
2010-03-05 03:47 . 2010-02-06 03:02 371248 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\EECTRL.SYS
2010-03-05 03:47 . 2010-02-06 03:02 2747440 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\CCERASER.DLL
2010-03-05 03:47 . 2010-02-06 03:02 259440 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\ECMSVR32.DLL
2010-03-05 03:47 . 2010-02-06 03:02 177520 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\NAVENG32.DLL
2010-03-05 03:47 . 2010-02-06 03:02 1647984 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\NAVEX32A.DLL
2010-03-05 03:47 . 2010-02-06 03:02 1324720 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\NAVEX15.SYS
2010-03-05 03:47 . 2010-02-06 03:02 102448 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\ERASER.SYS
2010-03-05 03:34 . 2010-02-13 01:41 558448 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
2010-02-28 03:20 . 2010-02-02 03:20 165240 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
2010-02-28 01:09 . 2010-01-08 00:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-28 01:08 . 2010-02-28 01:09 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-28 01:08 . 2010-01-08 00:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-27 18:35 . 2010-02-27 18:37 -------- d-----w- c:\program files\QuickTime
2010-02-27 03:21 . 2010-02-27 03:22 -------- d-----w- c:\program files\CCleaner
2010-02-27 03:16 . 2010-02-27 03:16 -------- d-----w- c:\windows\system32\Adobe
2010-02-27 02:56 . 2010-02-27 02:56 -------- d-----w- c:\windows\nview
2010-02-27 02:56 . 2008-05-16 22:01 446464 ----a-w- c:\windows\system32\nvudisp.exe
2010-02-27 02:55 . 2008-05-16 19:48 446464 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-02-27 02:55 . 2010-02-27 02:55 -------- d-----w- C:\NVIDIA
2010-02-27 02:51 . 2010-02-27 02:51 -------- d-----w- c:\program files\SystemRequirementsLab
2010-02-27 02:34 . 2010-02-27 02:34 -------- d-----w- c:\program files\Analog Devices
2010-02-27 02:34 . 2010-02-27 02:34 -------- d-----w- c:\windows\VirtualEar
2010-02-27 02:34 . 2004-11-19 18:00 49152 ----a-w- c:\windows\system32\DSndUp.exe
2010-02-27 02:34 . 2003-08-20 02:36 65536 ----a-w- c:\windows\system32\Audio3d.dll
2010-02-27 02:34 . 2002-04-17 22:05 45056 ----a-w- c:\windows\system32\CleanUp.exe
2010-02-27 02:34 . 2001-10-04 22:50 991232 ----a-w- c:\windows\system32\virtear.dll
2010-02-27 02:33 . 2005-01-27 23:31 260352 ----a-w- c:\windows\system32\drivers\smwdm.sys
2010-02-27 02:33 . 2004-10-06 00:10 23040 ----a-w- c:\windows\system32\PostProc.dll
2010-02-27 02:33 . 2004-09-23 15:55 311296 ----a-w- c:\windows\system32\Edcrypt.dll
2010-02-27 02:33 . 2004-09-17 17:02 732928 ----a-w- c:\windows\system32\drivers\senfilt.sys
2010-02-27 02:33 . 2001-09-19 20:47 765952 ----a-w- c:\windows\system\crlds3d.dll
2010-02-27 01:18 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\Scxpx86.dll
2010-02-27 01:18 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\IDSvix86.sys
2010-02-27 01:18 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\IDSXpx86.sys
2010-02-27 01:18 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\IDSxpx86.dll
2010-02-27 01:18 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\IDSviA64.sys
2010-02-25 15:59 . 2010-02-25 15:59 -------- d-----w- C:\N360_BACKUP
2010-02-19 21:41 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100218.001\Scxpx86.dll
2010-02-19 21:41 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100218.001\IDSvix86.sys
2010-02-19 21:41 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100218.001\IDSXpx86.sys
2010-02-19 21:41 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100218.001\IDSxpx86.dll
2010-02-19 21:41 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100218.001\IDSviA64.sys
2010-02-15 10:27 . 2010-02-15 10:27 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2010-02-15 05:36 . 2010-02-15 05:36 -------- d-----w- c:\program files\Microsoft
2010-02-15 05:34 . 2010-02-15 05:34 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-02-15 05:34 . 2010-02-15 05:35 -------- d-----w- c:\program files\Windows Live
2010-02-15 05:29 . 2010-02-15 05:29 -------- d-----w- c:\program files\Common Files\Windows Live
2010-02-15 04:42 . 2010-02-15 04:57 -------- d-----w- c:\documents and settings\Cindy Peterson\Local Settings\Application Data\Thunderbird
2010-02-15 04:42 . 2010-02-15 04:42 -------- d-----w- c:\documents and settings\Cindy Peterson\Application Data\Thunderbird
2010-02-15 04:41 . 2010-02-25 15:45 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-02-15 01:01 . 2010-02-15 01:04 -------- d-----w- c:\program files\Windows Live Safety Center
2010-02-14 22:12 . 2010-01-14 19:12 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-02-14 03:57 . 2010-02-14 04:32 -------- d-----w- c:\program files\ACW
2010-02-13 20:21 . 2010-02-13 20:21 -------- d-----w- c:\documents and settings\Cindy Peterson\Application Data\Windows Search
2010-02-13 19:17 . 2002-02-15 17:00 24576 ----a-w- c:\windows\system32\CTDevCRes.dll
2010-02-13 19:17 . 2000-05-11 09:00 90112 ------w- c:\windows\Updreg.EXE
2010-02-13 19:17 . 2008-04-13 19:45 10624 -c--a-w- c:\windows\system32\dllcache\gameenum.sys
2010-02-13 19:17 . 2008-04-13 19:45 10624 ----a-w- c:\windows\system32\drivers\gameenum.sys
2010-02-13 19:16 . 2002-03-21 11:39 20480 ----a-w- c:\windows\INRES.DLL
2010-02-13 19:16 . 2003-08-28 22:25 24576 ----a-w- c:\windows\MIXERDEF.EXE
2010-02-13 19:16 . 2002-02-28 16:45 61440 ----a-w- c:\windows\MIDIDEF.EXE
2010-02-13 19:15 . 1999-12-17 09:00 6752 ------w- c:\windows\system32\PFMODNT.SYS
2010-02-13 19:15 . 2010-02-13 19:17 -------- d-----w- c:\program files\Creative
2010-02-13 19:15 . 2003-03-05 20:19 15840 ------w- c:\windows\system32\drivers\PFMODNT.SYS
2010-02-12 17:17 . 2010-02-12 17:17 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-02-12 17:17 . 2010-02-12 17:17 -------- d-sh--w- c:\documents and settings\Cindy Peterson\IECompatCache
2010-02-12 16:59 . 2010-02-12 16:59 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-02-12 16:56 . 2010-02-12 16:56 -------- d-sh--w- c:\documents and settings\Cindy Peterson\IETldCache
2010-02-12 07:52 . 2009-12-11 08:38 69120 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-02-12 07:52 . 2010-02-12 17:23 -------- d-----w- c:\windows\ie8updates
2010-02-12 07:51 . 2009-12-21 19:14 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-02-12 07:51 . 2009-12-21 19:14 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-02-12 07:44 . 2010-02-12 07:50 -------- dc-h--w- c:\windows\ie8
2010-02-12 07:29 . 2010-02-13 20:31 -------- d-----w- c:\program files\Windows Desktop Search
2010-02-12 07:29 . 2010-02-12 07:29 -------- d-----w- c:\windows\system32\GroupPolicy
2010-02-12 07:26 . 2008-03-07 17:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
2010-02-12 07:26 . 2008-03-07 17:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
2010-02-12 07:26 . 2008-03-07 17:02 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
2010-02-11 02:47 . 2010-02-11 02:47 52224 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-02-11 02:47 . 2010-02-11 02:47 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-02-11 02:47 . 2010-02-11 02:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2010-02-11 02:35 . 2010-02-11 02:35 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-02-11 02:35 . 2010-02-11 04:47 -------- d-----w- c:\documents and settings\Cindy Peterson\Application Data\SUPERAntiSpyware.com
2010-02-11 02:35 . 2010-02-11 04:47 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-02-10 05:43 . 2010-02-10 05:43 -------- d-----w- c:\program files\Trend Micro
2010-02-10 04:29 . 2010-02-10 04:29 -------- d-----w- c:\program files\Windows Media Connect 2
2010-02-10 04:26 . 2010-02-10 04:27 -------- d-----w- c:\windows\system32\drivers\UMDF
2010-02-10 04:26 . 2010-02-10 04:26 -------- d-----w- c:\windows\system32\LogFiles
2010-02-07 21:53 . 2008-06-07 04:49 302592 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzpp692.dll
2010-02-07 21:53 . 2008-06-07 04:49 118272 ----a-w- c:\windows\system32\hpz3l692.dll
2010-02-07 21:50 . 2008-04-16 04:05 309760 ----a-r- c:\windows\system32\difxapi.dll
2010-02-07 21:50 . 2008-04-16 04:05 372736 ----a-r- c:\windows\system32\hppldcoi.dll
2010-02-07 21:50 . 2008-02-28 10:08 303104 ----a-r- c:\windows\system32\hposc_p01a.dll
2010-02-07 21:50 . 2008-04-16 04:05 974848 ----a-r- c:\windows\system32\hpost_p01a.dll
2010-02-07 21:50 . 2008-04-16 04:05 729088 ----a-r- c:\windows\system32\hposwia_p01a.dll
2010-02-07 21:11 . 2010-02-07 21:11 -------- d-----w- c:\program files\Hewlett-Packard
2010-02-07 21:09 . 2010-02-07 21:09 -------- d-----w- c:\program files\Common Files\HP
2010-02-07 20:53 . 2010-02-07 23:20 166112 ----a-w- c:\windows\hpoins30.dat
2010-02-07 20:53 . 2008-06-18 06:22 844 ------w- c:\windows\hpomdl30.dat
2010-02-07 18:02 . 2010-02-07 18:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2010-02-07 04:17 . 2010-02-07 04:17 -------- d-----r- c:\program files\Norton Support
2010-02-07 04:16 . 2010-02-07 04:16 -------- d-----w- c:\documents and settings\Cindy Peterson\Local Settings\Application Data\Symantec
2010-02-06 23:43 . 2010-02-06 23:43 -------- d-----w- c:\windows\system32\URTTEMP
2010-02-06 23:42 . 2010-02-06 23:42 -------- d-----w- c:\program files\Symantec
2010-02-06 23:37 . 2010-02-06 23:37 -------- d-----w- c:\documents and settings\Cindy Peterson\Application Data\U3
2010-02-06 23:37 . 2010-02-06 23:37 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-02-06 21:06 . 2010-02-06 21:06 36400 ----a-r- c:\windows\system32\drivers\SymIM.sys
2010-02-06 21:06 . 2010-02-06 23:22 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-02-06 21:06 . 2010-02-06 21:06 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2010-02-06 21:06 . 2010-02-06 21:06 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-02-06 21:05 . 2010-02-06 21:05 1291104 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\SyKnAppS.dll
2010-02-06 21:05 . 2010-02-06 21:05 136840 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\patch25.dll
2010-02-06 21:05 . 2010-02-06 21:05 776952 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CLT\cltLMSx.dll
2010-02-06 21:04 . 2010-02-07 20:47 -------- d-----w- c:\windows\system32\drivers\N360
2010-02-06 21:04 . 2010-02-06 23:23 -------- d-----w- c:\program files\Norton Security Suite
2010-02-06 21:04 . 2010-02-06 21:04 -------- d-----w- c:\program files\Windows Sidebar
2010-02-06 21:04 . 2010-02-06 21:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-02-06 21:01 . 2010-02-06 23:40 -------- d-----w- c:\program files\NortonInstaller
2010-02-06 20:45 . 2010-02-06 20:45 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-02-06 20:22 . 2010-02-06 20:22 61440 ----a-w- c:\documents and settings\Cindy Peterson\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-5a5c8d8b-n\decora-sse.dll
2010-02-06 20:22 . 2010-02-06 20:22 503808 ----a-w- c:\documents and settings\Cindy Peterson\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1f494cdd-n\msvcp71.dll
2010-02-06 20:22 . 2010-02-06 20:22 499712 ----a-w- c:\documents and settings\Cindy Peterson\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1f494cdd-n\jmc.dll
2010-02-06 20:22 . 2010-02-06 20:22 348160 ----a-w- c:\documents and settings\Cindy Peterson\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1f494cdd-n\msvcr71.dll
2010-02-06 20:22 . 2010-02-06 20:22 12800 ----a-w- c:\documents and settings\Cindy Peterson\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-5a5c8d8b-n\decora-d3d.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-27 21:30 . 2009-11-16 04:01 -------- d-----w- c:\program files\HP
2010-02-27 21:28 . 2009-11-16 04:04 -------- d-----w- c:\documents and settings\All Users\Application Data\HP
2010-02-27 18:33 . 2007-11-03 17:55 -------- d-----w- c:\program files\Common Files\Apple
2010-02-27 02:34 . 2006-08-03 00:26 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-22 22:25 . 2006-08-03 02:04 91064 ----a-w- c:\documents and settings\Cindy Peterson\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-22 21:55 . 2006-08-04 01:10 -------- d-----w- c:\documents and settings\Cindy Peterson\Application Data\AdobeUM
2010-02-11 02:20 . 2006-08-04 01:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-10 01:54 . 2009-11-29 23:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak
2010-02-10 01:52 . 2009-11-29 23:33 -------- d-----w- c:\program files\Kodak
2010-02-10 01:43 . 2006-08-04 01:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2010-02-10 01:43 . 2006-08-05 04:17 -------- d-----w- c:\program files\Viewpoint
2010-02-10 01:42 . 2009-10-25 06:29 -------- d-----w- c:\program files\Google
2010-02-06 23:40 . 2006-08-15 20:19 -------- d-----w- c:\program files\Java
2010-02-06 23:35 . 2008-08-15 17:55 -------- d-----w- c:\program files\Microsoft Silverlight
2010-02-06 21:06 . 2010-02-06 21:06 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2010-02-06 21:06 . 2010-02-06 21:06 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2010-02-06 21:06 . 2006-09-19 23:44 26600 ----a-r- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-02-06 21:05 . 2006-10-04 02:47 107368 ----a-r- c:\windows\system32\GEARAspi.dll
2010-02-06 20:21 . 2009-07-11 18:26 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-31 16:50 . 2003-07-16 20:46 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2006-04-28 17:58 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2006-08-02 03:57 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2003-07-16 20:26 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:27 . 2003-07-16 20:39 2189184 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 2002-08-29 01:04 2066048 ----a-w- c:\windows\system32\ntkrnlpa.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2003-08-06 114741]
"StorageGuard"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 155648]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2006-07-07 576320]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 600896]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-13 342312]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-02-21 366400]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 135264]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"nwiz"="nwiz.exe" [2008-05-16 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-02-16 417792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-8-2 24576]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2007-1-2 118784]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"3246:TCP"= 3246:TCP:Services
"2479:TCP"= 2479:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
"427:UDP"= 427:UDP:SLP_Port(427)
"5202:TCP"= 5202:TCP:Services
"7709:TCP"= 7709:TCP:Services
"7382:TCP"= 7382:TCP:Services
"6209:TCP"= 6209:TCP:Services

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0308000.029\SymEFA.sys [2/6/2010 11:22 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\N360\0308000.029\BHDrvx86.sys [2/6/2010 11:22 PM 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0308000.029\cchpx86.sys [2/6/2010 11:22 PM 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\IDSXpx86.sys [2/26/2010 5:18 PM 329592]
R2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe [2/6/2010 11:19 PM 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/5/2010 7:02 PM 102448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2010-02-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
FF - ProfilePath - c:\documents and settings\Cindy Peterson\Application Data\Mozilla\Firefox\Profiles\7fj2fqyz.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMGWRAP.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Musicnotes\npmusicn.dll
FF - plugin: c:\program files\Musicnotes\NPSibelius.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Sonic RecordNow! - (no file)
HKCU-Run-Auto Run Software for Photo Frame - (no file)
HKLM-Run-Auto Run Software for Photo Frame - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-04 20:11
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x88AE4250]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf763bf28
\Driver\ACPI -> ACPI.sys @ 0xf75aecb8
\Driver\atapi -> 0x88ae4250
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0598
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0598
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
NDIS: Intel® PRO/100 VE Network Connection -> SendCompleteHandler -> 0x88b63330
PacketIndicateHandler -> NDIS.sys @ 0xf788ca21
SendHandler -> NDIS.sys @ 0xf786a87b
Warning: possible MBR rootkit infection !
copy of MBR has been found in sector 0x0950E4C1
malicious code @ sector 0x0950E4C4 !
PE file found in sector at 0x0950E4DA !
MBR rootkit infection detected ! Use: "mbr.exe -f" to fix.

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\N360]
"ImagePath"="\"c:\program files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\3.8.0.41\diMaster.dll\" /prefetch:1"
.
Completion time: 2010-03-04 20:15:24
ComboFix-quarantined-files.txt 2010-03-05 04:15

Pre-Run: 16,174,317,568 bytes free
Post-Run: 16,920,858,624 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - 859F21DE111613E2D95BE3C2A37C5BCF

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\atapi -> 0x88ae4250
NDIS: Intel® PRO/100 VE Network Connection -> SendCompleteHandler -> 0x88b63330
Warning: possible MBR rootkit infection !
copy of MBR has been found in sector 0x0950E4C1
malicious code @ sector 0x0950E4C4 !
PE file found in sector at 0x0950E4DA !
MBR rootkit infection detected ! Use: "mbr.exe -f" to fix.
original MBR restored successfully !

User name HelpAssistant
Full Name Remote Desktop Help Assistant Account
Comment Account for Providing Remote Assistance
User's comment
Country code 000 (System Default)
Account active No
Account expires Never

Password last set 2/27/2010 8:57 PM
Password expires Never
Password changeable 2/27/2010 8:57 PM
Password required Yes
User may change password Yes

Workstations allowed All
Logon script
User profile
Home directory
Last logon 2/27/2010 8:57 PM

Logon hours allowed All

Local Group Memberships
Global Group memberships *None
The command completed successfully.

#4 BennetLang

Topic Starter

Members
8 posts
OFFLINE

Local time:04:43 PM

Posted 05 March 2010 - 12:57 AM

I just tried restarting and it started much faster, all those processes that had high CPU didn't seem to be there (we'll see what it's like when Norton comes back, but that's OK). I'm hopeful. Thanks again.

#5 thcbytes

Malware Response Team
14,790 posts
OFFLINE

Gender:Male
Local time:04:43 PM

Posted 05 March 2010 - 03:56 PM

Well done.

Were not done yet.

Warning: This script was specifically written and designed for this user only. Unsupervised use of this tool could render your computer unbootable permanently!!

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

QUOTE

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"=-

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

==========

Please download Malwarebytes Anti-Malware and save it to your desktop.

alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

Make sure you are connected to the Internet.
Double-click on mbam-setup.exe to install the application.
When the installation begins, follow the prompts and do not make any changes to default settings.
When installation has finished, make sure you leave both of these checked:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

Make sure the "Perform Quick Scan" option is selected.
Then click on the Scan button.
If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

Click on the Show Results button to see a list of any malware that was found.
Make sure that everything is checked, and click Remove Selected.
When removal is completed, a log report will open in Notepad.
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

==========

I'd like us to scan your machine with ESET OnlineScan

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
1. Click on to download the ESET Smart Installer. Save it to your desktop.
2. Double click on the icon on your desktop.
Check
Click the button.
Accept any security warnings from your browser.
Check
Push the Start button.
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, push
Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Push the button.
Push

===========

We need to create an OTL Report

Please download OTL from one of the following mirrors:
- This is THE Mirror
Save it to your desktop.
Double click on the icon on your desktop.
Click the "Scan All Users" checkbox.
Under "Extra Registry" please check "Use Safelist" and also check "LOP Check" and "Purity Check" as pictured.
Copy and Paste the following code into the textbox. Do not include the word "Code"

CODE
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
Push
A report will open. Copy and Paste that report in your next reply.
Two reports will open, copy and paste them in a reply here:
- OTListIt.txt <-- Will be opened
- Extra.txt <-- Will be minimized

==========

With your next post please provide:

* Combofix.txt
* MBAM log
* ESET log
* OTL.txt
* Extra.txt
* How is your computer running?

Kind regards,
~t

Proud member - Unified Network of Instructors and Trained Eliminators
Posted Image

#6 BennetLang

Topic Starter

Members
8 posts
OFFLINE

Local time:04:43 PM

Posted 06 March 2010 - 01:32 AM

Hi again,

Mostly the computer has been doing very well. I just tried twice to post this reply in IE and both times I had to close the browser, the CPU was at 99% for iexplore.exe and wouldn't change and I couldn't type. It also didn't come out of standby this morning, but then it did later on today.

So I'm going to try again in firefox, and hope it's just that IE doesn't have a big clipboard. In fact I just copied it all below and no hour glasses and minutes of not being able to type. Maybe it's just IE.

I think everything is below, I ran the ESET scanner for about 3 hours and it said no threats were found, no infected files, no cleaned files, so I couldn't get a log there. The OTL log says the computer has 1.0 GB of physical memory, the system properties here says it has 1.5 GB.

Thanks again for all your help.

ComboFix 10-03-04.02 - Cindy Peterson 03/05/2010 17:50:20.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1535.956 [GMT -8:00]
Running from: c:\documents and settings\Cindy Peterson\Desktop\thcbytes.exe
Command switches used :: c:\documents and settings\Cindy Peterson\Desktop\CFScript.txt
AV: Norton Security Suite *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((( Files Created from 2010-02-06 to 2010-03-06 )))))))))))))))))))))))))))))))
.

2010-03-05 14:23 . 2010-02-13 01:41 558448 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
2010-03-05 05:42 . 2010-02-02 03:20 165240 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
2010-03-05 03:47 . 2010-02-06 03:02 84912 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\NAVENG.SYS
2010-03-05 03:47 . 2010-02-06 03:02 371248 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\EECTRL.SYS
2010-03-05 03:47 . 2010-02-06 03:02 2747440 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\CCERASER.DLL
2010-03-05 03:47 . 2010-02-06 03:02 259440 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\ECMSVR32.DLL
2010-03-05 03:47 . 2010-02-06 03:02 177520 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\NAVENG32.DLL
2010-03-05 03:47 . 2010-02-06 03:02 1647984 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\NAVEX32A.DLL
2010-03-05 03:47 . 2010-02-06 03:02 1324720 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\NAVEX15.SYS
2010-03-05 03:47 . 2010-02-06 03:02 102448 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\ERASER.SYS
2010-02-28 01:09 . 2010-01-08 00:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-28 01:08 . 2010-02-28 01:09 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-28 01:08 . 2010-01-08 00:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-27 18:35 . 2010-02-27 18:37 -------- d-----w- c:\program files\QuickTime
2010-02-27 03:21 . 2010-02-27 03:22 -------- d-----w- c:\program files\CCleaner
2010-02-27 03:16 . 2010-02-27 03:16 -------- d-----w- c:\windows\system32\Adobe
2010-02-27 02:56 . 2010-02-27 02:56 -------- d-----w- c:\windows\nview
2010-02-27 02:56 . 2008-05-16 22:01 446464 ----a-w- c:\windows\system32\nvudisp.exe
2010-02-27 02:55 . 2008-05-16 19:48 446464 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-02-27 02:55 . 2010-02-27 02:55 -------- d-----w- C:\NVIDIA
2010-02-27 02:51 . 2010-02-27 02:51 -------- d-----w- c:\program files\SystemRequirementsLab
2010-02-27 02:34 . 2010-02-27 02:34 -------- d-----w- c:\program files\Analog Devices
2010-02-27 02:34 . 2010-02-27 02:34 -------- d-----w- c:\windows\VirtualEar
2010-02-27 02:34 . 2004-11-19 18:00 49152 ----a-w- c:\windows\system32\DSndUp.exe
2010-02-27 02:34 . 2003-08-20 02:36 65536 ----a-w- c:\windows\system32\Audio3d.dll
2010-02-27 02:34 . 2002-04-17 22:05 45056 ----a-w- c:\windows\system32\CleanUp.exe
2010-02-27 02:34 . 2001-10-04 22:50 991232 ----a-w- c:\windows\system32\virtear.dll
2010-02-27 02:33 . 2005-01-27 23:31 260352 ----a-w- c:\windows\system32\drivers\smwdm.sys
2010-02-27 02:33 . 2004-10-06 00:10 23040 ----a-w- c:\windows\system32\PostProc.dll
2010-02-27 02:33 . 2004-09-23 15:55 311296 ----a-w- c:\windows\system32\Edcrypt.dll
2010-02-27 02:33 . 2004-09-17 17:02 732928 ----a-w- c:\windows\system32\drivers\senfilt.sys
2010-02-27 02:33 . 2001-09-19 20:47 765952 ----a-w- c:\windows\system\crlds3d.dll
2010-02-27 01:18 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\Scxpx86.dll
2010-02-27 01:18 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\IDSvix86.sys
2010-02-27 01:18 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\IDSXpx86.sys
2010-02-27 01:18 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\IDSxpx86.dll
2010-02-27 01:18 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\IDSviA64.sys
2010-02-25 15:59 . 2010-02-25 15:59 -------- d-----w- C:\N360_BACKUP
2010-02-19 21:41 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100218.001\Scxpx86.dll
2010-02-19 21:41 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100218.001\IDSvix86.sys
2010-02-19 21:41 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100218.001\IDSXpx86.sys
2010-02-19 21:41 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100218.001\IDSxpx86.dll
2010-02-19 21:41 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100218.001\IDSviA64.sys
2010-02-15 10:27 . 2010-02-15 10:27 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2010-02-15 05:36 . 2010-02-15 05:36 -------- d-----w- c:\program files\Microsoft
2010-02-15 05:34 . 2010-02-15 05:34 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-02-15 05:34 . 2010-02-15 05:35 -------- d-----w- c:\program files\Windows Live
2010-02-15 05:29 . 2010-02-15 05:29 -------- d-----w- c:\program files\Common Files\Windows Live
2010-02-15 04:42 . 2010-02-15 04:57 -------- d-----w- c:\documents and settings\Cindy Peterson\Local Settings\Application Data\Thunderbird
2010-02-15 04:42 . 2010-02-15 04:42 -------- d-----w- c:\documents and settings\Cindy Peterson\Application Data\Thunderbird
2010-02-15 04:41 . 2010-02-25 15:45 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-02-15 01:01 . 2010-02-15 01:04 -------- d-----w- c:\program files\Windows Live Safety Center
2010-02-14 22:12 . 2010-01-14 19:12 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-02-14 03:57 . 2010-02-14 04:32 -------- d-----w- c:\program files\ACW
2010-02-13 20:21 . 2010-02-13 20:21 -------- d-----w- c:\documents and settings\Cindy Peterson\Application Data\Windows Search
2010-02-13 19:17 . 2002-02-15 17:00 24576 ----a-w- c:\windows\system32\CTDevCRes.dll
2010-02-13 19:17 . 2000-05-11 09:00 90112 ------w- c:\windows\Updreg.EXE
2010-02-13 19:17 . 2008-04-13 19:45 10624 -c--a-w- c:\windows\system32\dllcache\gameenum.sys
2010-02-13 19:17 . 2008-04-13 19:45 10624 ----a-w- c:\windows\system32\drivers\gameenum.sys
2010-02-13 19:16 . 2002-03-21 11:39 20480 ----a-w- c:\windows\INRES.DLL
2010-02-13 19:16 . 2003-08-28 22:25 24576 ----a-w- c:\windows\MIXERDEF.EXE
2010-02-13 19:16 . 2002-02-28 16:45 61440 ----a-w- c:\windows\MIDIDEF.EXE
2010-02-13 19:15 . 1999-12-17 09:00 6752 ------w- c:\windows\system32\PFMODNT.SYS
2010-02-13 19:15 . 2010-02-13 19:17 -------- d-----w- c:\program files\Creative
2010-02-13 19:15 . 2003-03-05 20:19 15840 ------w- c:\windows\system32\drivers\PFMODNT.SYS
2010-02-12 17:17 . 2010-02-12 17:17 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-02-12 17:17 . 2010-02-12 17:17 -------- d-sh--w- c:\documents and settings\Cindy Peterson\IECompatCache
2010-02-12 16:59 . 2010-02-12 16:59 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-02-12 16:56 . 2010-02-12 16:56 -------- d-sh--w- c:\documents and settings\Cindy Peterson\IETldCache
2010-02-12 07:52 . 2009-12-11 08:38 69120 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-02-12 07:52 . 2010-02-12 17:23 -------- d-----w- c:\windows\ie8updates
2010-02-12 07:51 . 2009-12-21 19:14 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-02-12 07:51 . 2009-12-21 19:14 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-02-12 07:44 . 2010-02-12 07:50 -------- dc-h--w- c:\windows\ie8
2010-02-12 07:29 . 2010-02-13 20:31 -------- d-----w- c:\program files\Windows Desktop Search
2010-02-12 07:29 . 2010-02-12 07:29 -------- d-----w- c:\windows\system32\GroupPolicy
2010-02-12 07:26 . 2008-03-07 17:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
2010-02-12 07:26 . 2008-03-07 17:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
2010-02-12 07:26 . 2008-03-07 17:02 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
2010-02-11 02:47 . 2010-02-11 02:47 52224 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-02-11 02:47 . 2010-02-11 02:47 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-02-11 02:47 . 2010-02-11 02:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2010-02-11 02:35 . 2010-02-11 02:35 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-02-11 02:35 . 2010-02-11 04:47 -------- d-----w- c:\documents and settings\Cindy Peterson\Application Data\SUPERAntiSpyware.com
2010-02-11 02:35 . 2010-02-11 04:47 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-02-10 05:43 . 2010-02-10 05:43 -------- d-----w- c:\program files\Trend Micro
2010-02-10 04:29 . 2010-02-10 04:29 -------- d-----w- c:\program files\Windows Media Connect 2
2010-02-10 04:26 . 2010-02-10 04:27 -------- d-----w- c:\windows\system32\drivers\UMDF
2010-02-10 04:26 . 2010-02-10 04:26 -------- d-----w- c:\windows\system32\LogFiles
2010-02-07 21:53 . 2008-06-07 04:49 302592 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzpp692.dll
2010-02-07 21:53 . 2008-06-07 04:49 118272 ----a-w- c:\windows\system32\hpz3l692.dll
2010-02-07 21:50 . 2008-04-16 04:05 309760 ----a-r- c:\windows\system32\difxapi.dll
2010-02-07 21:50 . 2008-04-16 04:05 372736 ----a-r- c:\windows\system32\hppldcoi.dll
2010-02-07 21:50 . 2008-02-28 10:08 303104 ----a-r- c:\windows\system32\hposc_p01a.dll
2010-02-07 21:50 . 2008-04-16 04:05 974848 ----a-r- c:\windows\system32\hpost_p01a.dll
2010-02-07 21:50 . 2008-04-16 04:05 729088 ----a-r- c:\windows\system32\hposwia_p01a.dll
2010-02-07 21:11 . 2010-02-07 21:11 -------- d-----w- c:\program files\Hewlett-Packard
2010-02-07 21:09 . 2010-02-07 21:09 -------- d-----w- c:\program files\Common Files\HP
2010-02-07 20:53 . 2010-02-07 23:20 166112 ----a-w- c:\windows\hpoins30.dat
2010-02-07 20:53 . 2008-06-18 06:22 844 ------w- c:\windows\hpomdl30.dat
2010-02-07 18:02 . 2010-02-07 18:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2010-02-07 04:17 . 2010-02-07 04:17 -------- d-----r- c:\program files\Norton Support
2010-02-07 04:16 . 2010-02-07 04:16 -------- d-----w- c:\documents and settings\Cindy Peterson\Local Settings\Application Data\Symantec
2010-02-06 23:43 . 2010-02-06 23:43 -------- d-----w- c:\windows\system32\URTTEMP
2010-02-06 23:42 . 2010-02-06 23:42 -------- d-----w- c:\program files\Symantec
2010-02-06 23:37 . 2010-02-06 23:37 -------- d-----w- c:\documents and settings\Cindy Peterson\Application Data\U3
2010-02-06 23:37 . 2010-02-06 23:37 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-02-06 21:06 . 2010-02-06 21:06 36400 ----a-r- c:\windows\system32\drivers\SymIM.sys
2010-02-06 21:06 . 2010-02-06 23:22 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-02-06 21:06 . 2010-02-06 21:06 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2010-02-06 21:06 . 2010-02-06 21:06 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-02-06 21:05 . 2010-02-06 21:05 1291104 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\SyKnAppS.dll
2010-02-06 21:05 . 2010-02-06 21:05 136840 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\SyKnAppS\patch25.dll
2010-02-06 21:05 . 2010-02-06 21:05 776952 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\CLT\cltLMSx.dll
2010-02-06 21:04 . 2010-02-07 20:47 -------- d-----w- c:\windows\system32\drivers\N360
2010-02-06 21:04 . 2010-02-06 23:23 -------- d-----w- c:\program files\Norton Security Suite
2010-02-06 21:04 . 2010-02-06 21:04 -------- d-----w- c:\program files\Windows Sidebar
2010-02-06 21:04 . 2010-02-06 21:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-02-06 21:01 . 2010-02-06 23:40 -------- d-----w- c:\program files\NortonInstaller
2010-02-06 20:45 . 2010-02-06 20:45 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-02-06 20:22 . 2010-02-06 20:22 61440 ----a-w- c:\documents and settings\Cindy Peterson\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-5a5c8d8b-n\decora-sse.dll
2010-02-06 20:22 . 2010-02-06 20:22 503808 ----a-w- c:\documents and settings\Cindy Peterson\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1f494cdd-n\msvcp71.dll
2010-02-06 20:22 . 2010-02-06 20:22 499712 ----a-w- c:\documents and settings\Cindy Peterson\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1f494cdd-n\jmc.dll
2010-02-06 20:22 . 2010-02-06 20:22 348160 ----a-w- c:\documents and settings\Cindy Peterson\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1f494cdd-n\msvcr71.dll
2010-02-06 20:22 . 2010-02-06 20:22 12800 ----a-w- c:\documents and settings\Cindy Peterson\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-5a5c8d8b-n\decora-d3d.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-27 21:30 . 2009-11-16 04:01 -------- d-----w- c:\program files\HP
2010-02-27 21:28 . 2009-11-16 04:04 -------- d-----w- c:\documents and settings\All Users\Application Data\HP
2010-02-27 18:33 . 2007-11-03 17:55 -------- d-----w- c:\program files\Common Files\Apple
2010-02-27 02:34 . 2006-08-03 00:26 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-22 22:25 . 2006-08-03 02:04 91064 ----a-w- c:\documents and settings\Cindy Peterson\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-22 21:55 . 2006-08-04 01:10 -------- d-----w- c:\documents and settings\Cindy Peterson\Application Data\AdobeUM
2010-02-11 02:20 . 2006-08-04 01:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-10 01:54 . 2009-11-29 23:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak
2010-02-10 01:52 . 2009-11-29 23:33 -------- d-----w- c:\program files\Kodak
2010-02-10 01:43 . 2006-08-04 01:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2010-02-10 01:43 . 2006-08-05 04:17 -------- d-----w- c:\program files\Viewpoint
2010-02-10 01:42 . 2009-10-25 06:29 -------- d-----w- c:\program files\Google
2010-02-06 23:40 . 2006-08-15 20:19 -------- d-----w- c:\program files\Java
2010-02-06 23:35 . 2008-08-15 17:55 -------- d-----w- c:\program files\Microsoft Silverlight
2010-02-06 21:06 . 2010-02-06 21:06 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2010-02-06 21:06 . 2010-02-06 21:06 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2010-02-06 21:06 . 2006-09-19 23:44 26600 ----a-r- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-02-06 21:05 . 2006-10-04 02:47 107368 ----a-r- c:\windows\system32\GEARAspi.dll
2010-02-06 20:21 . 2009-07-11 18:26 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-31 16:50 . 2003-07-16 20:46 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2006-04-28 17:58 916480 ------w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2006-08-02 03:57 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2003-07-16 20:26 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:27 . 2003-07-16 20:39 2189184 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 2002-08-29 01:04 2066048 ------w- c:\windows\system32\ntkrnlpa.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-03-05_04.11.18 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-05 14:23 . 2010-03-05 14:23 16384 c:\windows\Temp\Perflib_Perfdata_368.dat
+ 2010-03-05 14:22 . 2010-03-05 14:22 16384 c:\windows\Temp\Perflib_Perfdata_340.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2003-08-06 114741]
"StorageGuard"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 155648]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2006-07-07 576320]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 600896]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-13 342312]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-02-21 366400]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 135264]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"nwiz"="nwiz.exe" [2008-05-16 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-02-16 417792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-8-2 24576]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2007-1-2 118784]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"3246:TCP"= 3246:TCP:Services
"2479:TCP"= 2479:TCP:Services
"427:UDP"= 427:UDP:SLP_Port(427)
"5202:TCP"= 5202:TCP:Services
"7709:TCP"= 7709:TCP:Services
"7382:TCP"= 7382:TCP:Services
"6209:TCP"= 6209:TCP:Services

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0308000.029\SymEFA.sys [2/6/2010 11:22 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\N360\0308000.029\BHDrvx86.sys [2/6/2010 11:22 PM 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0308000.029\cchpx86.sys [2/6/2010 11:22 PM 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\IDSXpx86.sys [2/26/2010 5:18 PM 329592]
R2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe [2/6/2010 11:19 PM 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/5/2010 7:02 PM 102448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2010-02-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
FF - ProfilePath - c:\documents and settings\Cindy Peterson\Application Data\Mozilla\Firefox\Profiles\7fj2fqyz.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMGWRAP.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Musicnotes\npmusicn.dll
FF - plugin: c:\program files\Musicnotes\NPSibelius.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-05 17:56
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\N360]
"ImagePath"="\"c:\program files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\3.8.0.41\diMaster.dll\" /prefetch:1"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3932)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-03-05 18:00:11
ComboFix-quarantined-files.txt 2010-03-06 02:00
ComboFix2.txt 2010-03-05 04:15

Pre-Run: 16,900,849,664 bytes free
Post-Run: 16,857,714,688 bytes free

- - End Of File - - CF0A5122EFE5FA6BCEE537DA8D2DED9D

Malwarebytes' Anti-Malware 1.44
Database version: 3827
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

3/5/2010 6:19:34 PM
mbam-log-2010-03-05 (18-19-34).txt

Scan type: Quick Scan
Objects scanned: 186829
Time elapsed: 7 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

OTL logfile created on: 3/5/2010 9:26:42 PM - Run 1
OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\Cindy Peterson\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 59.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 1536F:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 15.63 Gb Free Space | 20.97% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 74.46 Gb Total Space | 25.61 Gb Free Space | 34.39% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: CINDY-86UR58919
Current User Name: Cindy Peterson
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/03/05 21:24:35 | 000,553,984 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Cindy Peterson\Desktop\OTL.exe
PRC - [2010/02/06 13:05:54 | 000,117,640 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe
PRC - [2008/04/13 16:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/02/20 17:18:32 | 000,366,400 | ---- | M] (Google Inc.) -- C:\Program Files\Picasa2\PicasaMediaDetector.exe
PRC - [2006/07/07 15:14:38 | 000,576,320 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft IntelliType Pro\itype.exe
PRC - [2004/10/14 14:42:54 | 001,404,928 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe
PRC - [2003/06/20 02:43:00 | 000,024,576 | ---- | M] (BVRP Software) -- C:\Program Files\Digital Line Detect\DLG.exe
PRC - [2003/05/15 01:19:50 | 000,217,193 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
PRC - [2002/04/03 01:01:00 | 000,135,264 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe

========== Modules (SafeList) ==========

MOD - [2010/03/05 21:24:35 | 000,553,984 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Cindy Peterson\Desktop\OTL.exe
MOD - [2010/02/06 13:05:13 | 000,419,696 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Security Suite\Engine\3.8.0.41\asOEHook.dll

========== Win32 Services (SafeList) ==========

SRV - [2010/02/06 13:05:54 | 000,117,640 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe -- (N360)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme)
DRV - [2010/02/06 13:06:22 | 000,124,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2010/02/06 13:06:04 | 000,310,320 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\N360\0308000.029\SYMEFA.SYS -- (SymEFA)
DRV - [2010/02/06 13:06:04 | 000,217,136 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMTDI.SYS -- (SYMTDI)
DRV - [2010/02/06 13:06:04 | 000,089,904 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMFW.SYS -- (SYMFW)
DRV - [2010/02/06 13:06:04 | 000,036,400 | R--- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SymIM.sys -- (SymIMMP)
DRV - [2010/02/06 13:06:04 | 000,036,400 | R--- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SymIM.sys -- (SymIM)
DRV - [2010/02/06 13:06:04 | 000,036,400 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMNDIS.SYS -- (SYMNDIS)
DRV - [2010/02/06 13:06:04 | 000,033,072 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMIDS.SYS -- (SYMIDS)
DRV - [2010/02/06 13:06:03 | 000,308,272 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\N360\0308000.029\SRTSP.SYS -- (SRTSP)
DRV - [2010/02/06 13:06:03 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\N360\0308000.029\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2010/02/06 13:06:01 | 000,482,432 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\N360\0308000.029\ccHPx86.sys -- (ccHP)
DRV - [2010/02/06 13:06:00 | 000,259,632 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\N360\0308000.029\BHDrvx86.sys -- (BHDrvx86)
DRV - [2010/02/05 19:02:28 | 001,324,720 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\NAVEX15.SYS -- (NAVEX15)
DRV - [2010/02/05 19:02:28 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010/02/05 19:02:28 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2010/02/05 19:02:28 | 000,084,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\NAVENG.SYS -- (NAVENG)
DRV - [2009/10/28 14:37:22 | 000,329,592 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\IDSXpx86.sys -- (IDSxpx86)
DRV - [2008/05/16 14:01:00 | 006,557,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2008/04/13 11:45:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2006/08/05 13:55:59 | 000,008,413 | ---- | M] (RealNetworks, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\mcstrm.sys -- (MCSTRM)
DRV - [2004/09/17 09:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)
DRV - [2003/12/09 01:02:46 | 000,014,336 | R--- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NetMotCM.sys -- (ndiscm)
DRV - [2003/09/22 12:43:06 | 001,330,048 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\P16X.sys -- (P16X) Creative SB Live! Series (WDM)
DRV - [2003/09/22 08:48:06 | 000,130,192 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV - [2003/09/22 08:47:38 | 000,178,672 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctoss2k.sys -- (ossrv)
DRV - [2003/09/19 15:47:24 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc)
DRV - [2003/08/28 15:58:00 | 000,004,272 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\bvrp_pci.sys -- (bvrp_pci)
DRV - [2003/08/06 00:04:00 | 000,100,373 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsnudfa.sys -- (tfsnudfa)
DRV - [2003/08/06 00:04:00 | 000,098,068 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsnudf.sys -- (tfsnudf)
DRV - [2003/08/06 00:04:00 | 000,083,284 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsnifs.sys -- (tfsnifs)
DRV - [2003/08/06 00:04:00 | 000,034,837 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsncofs.sys -- (tfsncofs)
DRV - [2003/08/06 00:04:00 | 000,025,685 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsnboio.sys -- (tfsnboio)
DRV - [2003/08/06 00:04:00 | 000,014,229 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsnopio.sys -- (tfsnopio)
DRV - [2003/08/06 00:04:00 | 000,006,357 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsnpool.sys -- (tfsnpool)
DRV - [2003/08/06 00:04:00 | 000,004,117 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsndrct.sys -- (tfsndrct)
DRV - [2003/08/06 00:04:00 | 000,002,233 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsndres.sys -- (tfsndres)
DRV - [2003/07/31 02:21:00 | 000,084,576 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\drvmcdb.sys -- (drvmcdb)
DRV - [2003/07/14 10:28:40 | 000,005,621 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\sscdbhk5.sys -- (sscdbhk5)
DRV - [2003/07/14 10:28:22 | 000,023,219 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\ssrtln.sys -- (ssrtln)
DRV - [2003/07/02 07:26:20 | 000,202,368 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2003/07/02 07:25:24 | 000,631,680 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2003/07/02 07:24:16 | 001,063,936 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2003/06/20 01:56:00 | 000,040,448 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\drvnddm.sys -- (drvnddm)
DRV - [2003/03/05 12:19:28 | 000,015,840 | ---- | M] (Creative Technology Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\PFMODNT.SYS -- (PfModNT)
DRV - [2001/08/22 08:42:58 | 000,013,632 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS -- (OMCI)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-343818398-1647877149-725345543-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-343818398-1647877149-725345543-1004\S-1-5-21-343818398-1647877149-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-343818398-1647877149-725345543-1004\S-1-5-21-343818398-1647877149-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0

IE - HKU\S-1-5-21-343818398-1647877149-725345543-1005\S-1-5-21-343818398-1647877149-725345543-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-343818398-1647877149-725345543-1005\S-1-5-21-343818398-1647877149-725345543-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKU\S-1-5-21-343818398-1647877149-725345543-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net
IE - HKU\S-1-5-21-343818398-1647877149-725345543-1006\S-1-5-21-343818398-1647877149-725345543-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-343818398-1647877149-725345543-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net
IE - HKU\S-1-5-21-343818398-1647877149-725345543-1008\S-1-5-21-343818398-1647877149-725345543-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-343818398-1647877149-725345543-500\S-1-5-21-343818398-1647877149-725345543-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - HKLM\software\mozilla\Firefox\extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
FF - HKLM\software\mozilla\Firefox\extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2010/03/05 06:23:10 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/27 16:32:40 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/02/27 16:32:38 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010/02/27 10:37:21 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/02/27 11:02:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Mozilla\Extensions
[2010/02/14 20:42:45 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Cindy Peterson\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2006/08/03 17:12:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Mozilla\Firefox\Profiles\51gpuy9x.default\extensions
[2010/02/27 11:51:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Mozilla\Firefox\Profiles\7fj2fqyz.default\extensions
[2010/03/05 06:26:44 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2003/07/16 12:29:34 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll File not found
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll (Microsoft Corporation)
O2 - BHO: (Comcast Toolbar) - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\Program Files\ComcastToolbar\comcasttoolbar.dll ()
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll File not found
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKLM\..\Toolbar: (Comcast Toolbar) - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\Program Files\ComcastToolbar\comcasttoolbar.dll ()
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O3 - HKU\S-1-5-21-343818398-1647877149-725345543-1004\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKU\S-1-5-21-343818398-1647877149-725345543-1004\..\Toolbar\WebBrowser: (Comcast Toolbar) - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\Program Files\ComcastToolbar\comcasttoolbar.dll ()
O3 - HKU\S-1-5-21-343818398-1647877149-725345543-1004\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O3 - HKU\S-1-5-21-343818398-1647877149-725345543-1006\..\Toolbar\WebBrowser: (Comcast Toolbar) - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\Program Files\ComcastToolbar\comcasttoolbar.dll ()
O3 - HKU\S-1-5-21-343818398-1647877149-725345543-1008\..\Toolbar\WebBrowser: (Comcast Toolbar) - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\Program Files\ComcastToolbar\comcasttoolbar.dll ()
O4 - HKLM..\Run: [diagent] C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (Google Inc.)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [StorageGuard] C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe (Sonic Solutions)
O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
O4 - HKU\.DEFAULT..\Run: [DWQueuedReporting] C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKU\S-1-5-18..\Run: [DWQueuedReporting] C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKU\S-1-5-21-343818398-1647877149-725345543-1005..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl File not found
O4 - HKU\S-1-5-21-343818398-1647877149-725345543-1005..\Run: [Aim6] C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe File not found
O4 - HKU\S-1-5-21-343818398-1647877149-725345543-1006..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl File not found
O4 - HKU\S-1-5-21-343818398-1647877149-725345543-1006..\Run: [Aim6] File not found
O4 - HKU\S-1-5-21-343818398-1647877149-725345543-1008..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-343818398-1647877149-725345543-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-343818398-1647877149-725345543-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-343818398-1647877149-725345543-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-343818398-1647877149-725345543-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-343818398-1647877149-725345543-1004_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-343818398-1647877149-725345543-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-343818398-1647877149-725345543-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-343818398-1647877149-725345543-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-343818398-1647877149-725345543-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-343818398-1647877149-725345543-1008\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-343818398-1647877149-725345543-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-343818398-1647877149-725345543-500\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-343818398-1647877149-725345543-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll File not found
O9 - Extra Button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownlo...sreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/...can8/oscan8.cab (Reg Error: Key error.)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/...lscbase6087.cab (Windows Live Safety Center Base Module)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 207.217.126.81 207.217.77.82
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:1 () - http://www.northseattle.edu/services/runstart/faq.htm
O24 - Desktop WallPaper: C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/08/01 20:00:44 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2002/09/03 06:59:58 | 000,000,000 | ---- | M] () - F:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2006/08/01 20:00:21 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: SymEFA.sys - C:\WINDOWS\system32\drivers\N360\0308000.029\SYMEFA.SYS (Symantec Corporation)
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: SymEFA.sys - C:\WINDOWS\system32\drivers\N360\0308000.029\SYMEFA.SYS (Symantec Corporation)
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: vsmon - Service
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {1325db73-d9f1-48f8-8895-6d814ec58889} - Security Update for Windows XP (KB913433)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 8.5.1
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.1.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.1.4
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5b7bf89d-d196-4c32-a303-a57b8ab7f18d} - KB918439
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Reg Error: Value error.
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate
ActiveX: {f15ee071-deb7-4cbb-951f-431c98338d8e} - KB911567
ActiveX: {f54910c7-a2f3-4ca4-81b2-4a43a5e2680a} - KB916281
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.iac2 - C:\WINDOWS\System32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.dmb1 - m3jpeg32.dll File not found
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.MJPG - m3jpeg32.dll File not found
Drivers32: vidc.VP60 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16891891626803200)

========== Files/Folders - Created Within 30 Days ==========

[2010/03/05 21:24:33 | 000,553,984 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Cindy Peterson\Desktop\OTL.exe
[2010/03/05 18:23:40 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2010/03/05 18:23:37 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2010/03/05 17:49:24 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/03/05 17:49:24 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/03/05 17:49:24 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/03/05 17:49:24 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/03/04 19:59:47 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/03/04 19:58:32 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/03/04 19:58:18 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/02/27 20:55:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\Desktop\gmer
[2010/02/27 17:09:00 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/02/27 17:08:56 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/02/27 17:08:56 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/02/27 11:17:16 | 008,327,264 | ---- | C] (Mozilla) -- C:\Documents and Settings\Cindy Peterson\My Documents\Firefox Setup 3.6.exe
[2010/02/27 11:02:48 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Cindy Peterson\Recent
[2010/02/27 10:35:28 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010/02/26 19:21:05 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2010/02/26 19:16:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Adobe
[2010/02/26 18:56:46 | 000,000,000 | ---D | C] -- C:\WINDOWS\nview
[2010/02/26 18:56:40 | 000,446,464 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvudisp.exe
[2010/02/26 18:55:43 | 000,446,464 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\NVUNINST.EXE
[2010/02/26 18:55:22 | 000,000,000 | ---D | C] -- C:\NVIDIA
[2010/02/26 18:51:18 | 000,000,000 | ---D | C] -- C:\Program Files\SystemRequirementsLab
[2010/02/26 18:34:28 | 000,991,232 | ---- | C] (Sensaura) -- C:\WINDOWS\System32\virtear.dll
[2010/02/26 18:34:28 | 000,065,536 | ---- | C] (Sensaura Ltd) -- C:\WINDOWS\System32\Audio3d.dll
[2010/02/26 18:34:28 | 000,049,152 | ---- | C] (Analog Devices Inc.) -- C:\WINDOWS\System32\DSndUp.exe
[2010/02/26 18:34:28 | 000,045,056 | ---- | C] (adi) -- C:\WINDOWS\System32\CleanUp.exe
[2010/02/26 18:34:28 | 000,000,000 | ---D | C] -- C:\WINDOWS\VirtualEar
[2010/02/26 18:34:28 | 000,000,000 | ---D | C] -- C:\Program Files\Analog Devices
[2010/02/26 18:33:38 | 000,732,928 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\System32\drivers\senfilt.sys
[2010/02/26 18:33:38 | 000,311,296 | ---- | C] (Analog Devices Incorporated) -- C:\WINDOWS\System32\Edcrypt.dll
[2010/02/26 18:33:38 | 000,023,040 | ---- | C] (Windows ® 2000 DDK provider) -- C:\WINDOWS\System32\PostProc.dll
[2010/02/26 18:33:37 | 000,765,952 | ---- | C] (Sensaura Ltd) -- C:\WINDOWS\System\crlds3d.dll
[2010/02/25 07:59:26 | 000,000,000 | ---D | C] -- C:\N360_BACKUP
[2010/02/15 18:50:20 | 000,094,208 | ---- | C] (Apple Inc.) -- C:\WINDOWS\System32\QuickTimeVR.qtx
[2010/02/15 18:50:20 | 000,069,632 | ---- | C] (Apple Inc.) -- C:\WINDOWS\System32\QuickTime.qts
[2010/02/15 18:49:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\My Documents\stepintoadream
[2010/02/15 15:00:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\My Documents\old outlook
[2010/02/15 02:27:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth
[2010/02/14 21:41:22 | 000,000,000 | R-SD | C] -- C:\Documents and Settings\Cindy Peterson\My Documents\My Stationery
[2010/02/14 21:36:23 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft
[2010/02/14 21:35:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\microsoft
[2010/02/14 21:34:48 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live SkyDrive
[2010/02/14 21:34:00 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live
[2010/02/14 21:29:12 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Windows Live
[2010/02/14 20:42:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\Thunderbird
[2010/02/14 20:42:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\Application Data\Thunderbird
[2010/02/14 20:41:56 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird
[2010/02/14 17:01:55 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live Safety Center
[2010/02/14 14:32:15 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2010/02/14 14:12:52 | 000,181,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MpSigStub.exe
[2010/02/13 19:57:38 | 000,000,000 | ---D | C] -- C:\Program Files\ACW
[2010/02/13 12:21:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\Application Data\Windows Search
[2010/02/13 11:17:39 | 000,212,992 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\System32\CTDevCtrl.cpl
[2010/02/13 11:17:39 | 000,090,112 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\Updreg.EXE
[2010/02/13 11:17:39 | 000,024,576 | ---- | C] (Creative Technology Ltd) -- C:\WINDOWS\System32\CTDevCRes.dll
[2010/02/13 11:17:20 | 000,010,624 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\gameenum.sys
[2010/02/13 11:17:20 | 000,010,624 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\gameenum.sys
[2010/02/13 11:16:20 | 000,020,480 | ---- | C] (Creative Technology Ltd) -- C:\WINDOWS\INRES.DLL
[2010/02/13 11:16:19 | 000,061,440 | ---- | C] (Creative Technology Ltd) -- C:\WINDOWS\MIDIDEF.EXE
[2010/02/13 11:16:19 | 000,024,576 | ---- | C] (Creative Technology Ltd) -- C:\WINDOWS\MIXERDEF.EXE
[2010/02/13 11:15:16 | 000,006,752 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\System32\PFMODNT.SYS
[2010/02/13 11:15:06 | 000,015,840 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\System32\drivers\PFMODNT.SYS
[2010/02/13 11:15:06 | 000,000,000 | ---D | C] -- C:\Program Files\Creative
[2010/02/12 09:17:14 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Cindy Peterson\IECompatCache
[2010/02/12 08:56:58 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Cindy Peterson\IETldCache
[2010/02/11 23:52:00 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
[2010/02/11 23:44:47 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2010/02/11 23:29:33 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Desktop Search
[2010/02/11 23:29:32 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\GroupPolicy
[2010/02/11 23:26:41 | 000,192,000 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\offfilt.dll
[2010/02/11 23:26:41 | 000,098,304 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nlhtml.dll
[2010/02/11 23:26:41 | 000,029,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mimefilt.dll
[2010/02/10 18:35:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010/02/10 18:35:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\Application Data\SUPERAntiSpyware.com
[2010/02/10 18:35:12 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2010/02/09 21:43:34 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2010/02/09 20:30:01 | 000,016,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsg.dll
[2010/02/09 20:29:30 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Media Connect 2
[2010/02/09 20:26:43 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\UMDF
[2010/02/09 20:26:43 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles
[2010/02/07 13:53:06 | 000,118,272 | ---- | C] (Hewlett-Packard Company) -- C:\WINDOWS\System32\hpz3l692.dll
[2010/02/07 13:50:41 | 000,309,760 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\difxapi.dll
[2010/02/07 13:50:40 | 000,372,736 | R--- | C] (Hewlett-Packard) -- C:\WINDOWS\System32\hppldcoi.dll
[2010/02/07 13:50:40 | 000,303,104 | R--- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hposc_p01a.dll
[2010/02/07 13:50:37 | 000,974,848 | R--- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpost_p01a.dll
[2010/02/07 13:50:34 | 000,729,088 | R--- | C] (Hewlett-Packard) -- C:\WINDOWS\System32\hposwia_p01a.dll
[2010/02/07 13:11:56 | 000,000,000 | ---D | C] -- C:\Program Files\Hewlett-Packard
[2010/02/07 13:09:43 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\HP
[2010/02/07 10:02:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Symantec
[2010/02/06 23:22:47 | 000,217,136 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symtdi.sys
[2010/02/06 23:22:46 | 000,048,688 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symndisv.sys
[2010/02/06 23:22:45 | 000,036,400 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symndis.sys
[2010/02/06 23:22:45 | 000,033,072 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symids.sys
[2010/02/06 23:22:44 | 000,089,904 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symfw.sys
[2010/02/06 23:22:42 | 000,310,320 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.sys
[2010/02/06 23:22:42 | 000,043,696 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.sys
[2010/02/06 23:22:41 | 000,308,272 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.sys
[2010/02/06 23:22:40 | 000,482,432 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\cchpx86.sys
[2010/02/06 23:22:39 | 000,259,632 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.sys
[2010/02/06 23:18:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\N360\0308000.029
[2010/02/06 20:17:18 | 000,000,000 | R--D | C] -- C:\Program Files\Norton Support
[2010/02/06 20:16:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\Symantec
[2010/02/06 15:43:04 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\URTTEMP
[2010/02/06 15:42:02 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec
[2010/02/06 15:38:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/02/06 15:37:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\Application Data\U3
[2010/02/06 15:37:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2010/02/06 13:06:40 | 000,036,400 | R--- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SymIM.sys
[2010/02/06 13:06:22 | 000,124,976 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/02/06 13:06:22 | 000,060,808 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\S32EVNT1.DLL
[2010/02/06 13:06:22 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Symantec Shared
[2010/02/06 13:04:07 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\N360
[2010/02/06 13:04:02 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Sidebar
[2010/02/06 13:04:02 | 000,000,000 | ---D | C] -- C:\Program Files\Norton Security Suite
[2010/02/06 13:04:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Norton
[2010/02/06 13:01:32 | 000,000,000 | ---D | C] -- C:\Program Files\NortonInstaller
[2010/02/06 12:45:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NortonInstaller
[2010/02/06 12:45:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\My Documents\Symantec
[2010/02/06 12:22:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2010/02/06 12:22:51 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/02/06 12:22:25 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/02/06 12:22:24 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/02/06 12:22:24 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/02/06 12:22:24 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2009/07/24 07:59:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2009/07/24 07:59:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2009/05/01 12:02:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Mozilla
[2008/09/20 16:46:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[2007/11/05 20:00:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2007/03/10 16:50:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2006/10/27 09:28:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Talkback
[2006/10/27 09:27:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Mozilla
[2006/08/01 20:00:24 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2002/04/10 23:41:00 | 000,065,536 | ---- | C] ( ) -- C:\WINDOWS\System32\A3d.dll
[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\Documents and Settings\Cindy Peterson\My Documents\*.tmp files -> C:\Documents and Settings\Cindy Peterson\My Documents\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/03/05 21:24:35 | 000,553,984 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Cindy Peterson\Desktop\OTL.exe
[2010/03/05 18:00:11 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/03/05 17:57:02 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/03/05 06:23:05 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/03/05 06:22:56 | 000,186,097 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010/03/05 06:22:27 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/03/04 20:52:41 | 006,029,312 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\ntuser.dat
[2010/03/04 20:52:18 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\Cindy Peterson\ntuser.ini
[2010/03/04 20:27:19 | 000,000,117 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\help.bat
[2010/03/04 20:25:53 | 000,000,006 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\fix.bat
[2010/03/04 20:24:28 | 000,412,056 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\HelpAsst_mebroot_fix.exe
[2010/03/04 20:22:54 | 000,147,832 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\profiles.exe
[2010/03/04 19:59:57 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2010/03/04 19:57:19 | 004,120,159 | R--- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\thcbytes.exe
[2010/03/04 19:51:31 | 000,363,008 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\rkill.pif
[2010/02/27 23:54:30 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/02/27 20:52:11 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\defogger_reenable
[2010/02/27 18:27:50 | 000,284,915 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\gmer.zip
[2010/02/27 18:26:19 | 000,524,288 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\dds.scr
[2010/02/27 18:26:07 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\Defogger.exe
[2010/02/27 17:09:03 | 000,000,705 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/27 16:32:53 | 000,001,611 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/02/27 13:21:06 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Ÿ9Ÿ9
[2010/02/27 11:17:16 | 008,327,264 | ---- | M] (Mozilla) -- C:\Documents and Settings\Cindy Peterson\My Documents\Firefox Setup 3.6.exe
[2010/02/27 11:03:46 | 000,012,876 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\My Documents\cc_20100227_110341.reg
[2010/02/27 10:58:42 | 000,082,375 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\bookmarksfeb10.html
[2010/02/27 10:56:04 | 000,082,375 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\bookmarks.html
[2010/02/26 19:26:17 | 000,166,858 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\My Documents\cc_20100226_192557.reg
[2010/02/26 19:22:26 | 000,001,557 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\CCleaner.lnk
[2010/02/26 18:37:02 | 000,711,038 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\Cat.DB
[2010/02/26 18:15:11 | 000,000,847 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\Shortcut to procexp.lnk
[2010/02/25 07:44:27 | 000,002,497 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\Word 2003.lnk
[2010/02/25 07:42:32 | 015,425,536 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\My Documents\Money.mny
[2010/02/25 07:40:11 | 000,002,379 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\Money 2003.lnk
[2010/02/22 14:25:03 | 000,091,064 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/02/22 14:22:14 | 000,313,176 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/02/22 13:56:39 | 000,001,833 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
[2010/02/22 13:56:39 | 000,001,749 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 6.0 Professional.lnk
[2010/02/16 12:54:46 | 000,079,872 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\BHS PTSA February 11, 2010 BOard Meeting.doc
[2010/02/15 18:52:26 | 000,870,128 | ---- | M] () -- C:\WINDOWS\System32\mcs.rma
[2010/02/15 18:52:26 | 000,000,004 | ---- | M] () -- C:\WINDOWS\System32\EFA81C
[2010/02/15 18:50:20 | 000,094,208 | ---- | M] (Apple Inc.) -- C:\WINDOWS\System32\QuickTimeVR.qtx
[2010/02/15 18:50:20 | 000,069,632 | ---- | M] (Apple Inc.) -- C:\WINDOWS\System32\QuickTime.qts
[2010/02/15 11:22:45 | 000,001,940 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\Windows Live Mail.lnk
[2010/02/14 20:42:12 | 000,001,677 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Thunderbird.lnk
[2010/02/13 12:25:55 | 000,443,588 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/02/13 12:25:55 | 000,071,846 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/02/13 11:18:53 | 000,000,066 | ---- | M] () -- C:\WINDOWS\SBWIN.INI
[2010/02/13 11:17:02 | 000,000,588 | ---- | M] () -- C:\WINDOWS\System32\settingsbkup.sfm
[2010/02/13 11:17:02 | 000,000,588 | ---- | M] () -- C:\WINDOWS\System32\settings.sfm
[2010/02/11 23:29:51 | 000,546,796 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/02/09 22:13:20 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2010/02/09 22:13:19 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2010/02/09 20:29:43 | 000,000,677 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/02/09 20:26:47 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2010/02/09 17:45:39 | 000,029,067 | ---- | M] () -- C:\logfile
[2010/02/07 15:20:56 | 000,166,112 | ---- | M] () -- C:\WINDOWS\hpoins30.dat
[2010/02/07 13:58:35 | 000,000,136 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2010/02/07 13:25:59 | 000,001,817 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2010/02/07 09:50:39 | 000,002,030 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Norton Security Suite.LNK
[2010/02/06 23:18:35 | 000,000,172 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\isolate.ini
[2010/02/06 13:06:22 | 000,124,976 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/02/06 13:06:22 | 000,060,808 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\S32EVNT1.DLL
[2010/02/06 13:06:22 | 000,007,456 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/02/06 13:06:22 | 000,000,806 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/02/06 13:06:04 | 000,310,320 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.sys
[2010/02/06 13:06:04 | 000,217,136 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symtdi.sys
[2010/02/06 13:06:04 | 000,089,904 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symfw.sys
[2010/02/06 13:06:04 | 000,048,688 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symndisv.sys
[2010/02/06 13:06:04 | 000,036,400 | R--- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SymIM.sys
[2010/02/06 13:06:04 | 000,036,400 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symndis.sys
[2010/02/06 13:06:04 | 000,033,072 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symids.sys
[2010/02/06 13:06:03 | 000,308,272 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.sys
[2010/02/06 13:06:03 | 000,043,696 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.sys
[2010/02/06 13:06:01 | 000,482,432 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\cchpx86.sys
[2010/02/06 13:06:00 | 000,259,632 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.sys
[2010/02/06 13:05:33 | 000,107,368 | R--- | M] (GEAR Software Inc.) -- C:\WINDOWS\System32\GEARAspi.dll
[2010/02/06 13:05:07 | 000,001,562 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymNetV.inf
[2010/02/06 13:05:06 | 000,003,373 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.inf
[2010/02/06 13:05:06 | 000,001,752 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.inf
[2010/02/06 13:05:06 | 000,001,561 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.inf
[2010/02/06 13:05:06 | 000,001,388 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.inf
[2010/02/06 13:05:06 | 000,001,382 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.inf
[2010/02/06 13:05:06 | 000,000,640 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.inf
[2010/02/06 13:04:07 | 000,009,412 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\symnetv.cat
[2010/02/06 13:04:07 | 000,009,402 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.cat
[2010/02/06 13:04:07 | 000,007,431 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.cat
[2010/02/06 13:04:07 | 000,007,429 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.cat
[2010/02/06 13:04:07 | 000,007,425 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.cat
[2010/02/06 13:04:07 | 000,007,400 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.CAT
[2010/02/06 13:04:07 | 000,007,383 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.cat
[2010/02/06 12:21:33 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/02/06 12:21:33 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/02/06 12:21:32 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/02/06 12:21:32 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/02/06 12:21:30 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deploytk.dll
[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\Documents and Settings\Cindy Peterson\My Documents\*.tmp files -> C:\Documents and Settings\Cindy Peterson\My Documents\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/03/05 17:49:24 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/03/05 17:49:24 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/03/05 17:49:24 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/03/05 17:49:24 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/03/05 17:49:24 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/03/04 20:30:38 | 000,147,832 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\profiles.exe
[2010/03/04 20:27:19 | 000,000,117 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\help.bat
[2010/03/04 20:25:53 | 000,000,006 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\fix.bat
[2010/03/04 20:24:28 | 000,412,056 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\HelpAsst_mebroot_fix.exe
[2010/03/04 19:59:57 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/03/04 19:59:52 | 000,260,272 | ---- | C] () -- C:\cmldr
[2010/03/04 19:57:11 | 004,120,159 | R--- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\thcbytes.exe
[2010/03/04 19:51:30 | 000,363,008 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\rkill.pif
[2010/02/27 20:52:11 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\defogger_reenable
[2010/02/27 18:27:49 | 000,284,915 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\gmer.zip
[2010/02/27 18:26:19 | 000,524,288 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\dds.scr
[2010/02/27 18:26:06 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\Defogger.exe
[2010/02/27 17:09:03 | 000,000,705 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/27 11:20:28 | 000,001,611 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/02/27 11:03:44 | 000,012,876 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\My Documents\cc_20100227_110341.reg
[2010/02/27 10:58:42 | 000,082,375 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\bookmarksfeb10.html
[2010/02/27 10:56:04 | 000,082,375 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\bookmarks.html
[2010/02/26 19:26:05 | 000,166,858 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\My Documents\cc_20100226_192557.reg
[2010/02/26 19:22:25 | 000,001,557 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\CCleaner.lnk
[2010/02/26 18:56:48 | 000,186,097 | ---- | C] () -- C:\WINDOWS\System32\nvapps.xml
[2010/02/26 18:56:46 | 000,018,070 | ---- | C] () -- C:\WINDOWS\System32\nvdisp.nvu
[2010/02/26 18:15:10 | 000,000,847 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\Shortcut to procexp.lnk
[2010/02/22 13:56:39 | 000,001,833 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
[2010/02/22 13:56:39 | 000,001,749 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 6.0 Professional.lnk
[2010/02/16 10:04:37 | 000,079,872 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\BHS PTSA February 11, 2010 BOard Meeting.doc
[2010/02/15 11:22:45 | 000,001,940 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\Windows Live Mail.lnk
[2010/02/14 20:42:11 | 000,001,677 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Thunderbird.lnk
[2010/02/13 11:17:39 | 000,014,273 | ---- | C] () -- C:\WINDOWS\System32\CTDEVCTRL.HLP
[2010/02/13 11:17:39 | 000,000,274 | ---- | C] () -- C:\WINDOWS\System32\ctdevctrl.CNT
[2010/02/13 11:17:39 | 000,000,066 | ---- | C] () -- C:\WINDOWS\SBWIN.INI
[2010/02/13 11:17:39 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\CTDevctrl.gid
[2010/02/13 11:17:39 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\CTDevctrl.fts
[2010/02/13 11:17:39 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\CTDevctrl.ftg
[2010/02/13 11:17:02 | 000,000,588 | ---- | C] () -- C:\WINDOWS\System32\settingsbkup.sfm
[2010/02/13 11:17:02 | 000,000,588 | ---- | C] () -- C:\WINDOWS\System32\settings.sfm
[2010/02/13 11:16:21 | 000,002,516 | ---- | C] () -- C:\WINDOWS\System32\P16X.ini
[2010/02/13 11:16:21 | 000,000,026 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
[2010/02/13 11:16:19 | 001,048,576 | ---- | C] () -- C:\WINDOWS\System32\Ct1mgm.rom
[2010/02/13 11:16:19 | 000,002,696 | ---- | C] () -- C:\WINDOWS\MIXDEF.INI
[2010/02/13 11:16:19 | 000,000,059 | ---- | C] () -- C:\WINDOWS\System32\default8.sfm
[2010/02/13 11:16:19 | 000,000,059 | ---- | C] () -- C:\WINDOWS\System32\default4.sfm
[2010/02/13 11:16:19 | 000,000,059 | ---- | C] () -- C:\WINDOWS\System32\Default.sfm
[2010/02/09 20:26:47 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2010/02/07 15:19:39 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Ÿ9Ÿ9
[2010/02/07 13:25:59 | 000,001,817 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2010/02/07 12:53:53 | 000,166,112 | ---- | C] () -- C:\WINDOWS\hpoins30.dat
[2010/02/07 12:53:52 | 000,000,844 | ---- | C] () -- C:\WINDOWS\hpomdl30.dat
[2010/02/07 09:50:42 | 000,711,038 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\Cat.DB
[2010/02/06 23:22:47 | 000,009,412 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\symnetv.cat
[2010/02/06 23:22:47 | 000,001,562 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymNetV.inf
[2010/02/06 23:22:46 | 000,009,402 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.cat
[2010/02/06 23:22:46 | 000,001,561 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.inf
[2010/02/06 23:22:42 | 000,007,431 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.cat
[2010/02/06 23:22:42 | 000,003,373 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.inf
[2010/02/06 23:22:41 | 000,007,429 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.cat
[2010/02/06 23:22:41 | 000,001,388 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.inf
[2010/02/06 23:22:41 | 000,001,382 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.inf
[2010/02/06 23:22:40 | 000,007,425 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.cat
[2010/02/06 23:22:39 | 000,007,383 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.cat
[2010/02/06 23:22:39 | 000,001,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.inf
[2010/02/06 23:22:38 | 000,007,400 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.CAT
[2010/02/06 23:22:38 | 000,000,640 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.inf
[2010/02/06 23:18:35 | 000,000,172 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\isolate.ini
[2010/02/06 13:06:22 | 000,007,456 | ---- | C] () -- C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/02/06 13:06:22 | 000,000,806 | ---- | C] () -- C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/02/06 13:06:07 | 000,002,030 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Norton Security Suite.LNK
[2009/11/15 20:00:47 | 000,013,195 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2009/01/05 15:44:10 | 000,000,453 | ---- | C] () -- C:\WINDOWS\bdoscandellang.ini
[2008/05/16 14:01:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2008/05/16 14:01:00 | 001,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2008/05/16 14:01:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2008/05/16 14:01:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008/05/16 14:01:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2007/12/30 22:33:18 | 000,000,268 | RH-- | C] () -- C:\Documents and Settings\All Users\Application Data\Standard
[2007/12/30 22:33:18 | 000,000,020 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2007/12/30 22:33:18 | 000,000,012 | RH-- | C] () -- C:\Documents and Settings\All Users\Application Data\String Comparison
[2007/01/02 16:23:09 | 000,000,021 | ---- | C] () -- C:\WINDOWS\CS_SETUP.ini
[2006/12/03 15:27:46 | 000,000,051 | ---- | C] () -- C:\WINDOWS\WWWBATCH.INI
[2006/11/14 17:38:02 | 000,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini
[2006/09/05 09:47:20 | 000,000,416 | ---- | C] () -- C:\WINDOWS\hegames.ini
[2006/09/02 12:30:47 | 000,000,050 | ---- | C] () -- C:\WINDOWS\lexstat.ini
[2006/08/06 15:41:31 | 000,002,061 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006/08/04 16:27:06 | 000,000,494 | ---- | C] () -- C:\WINDOWS\dellstat.ini
[2006/08/03 18:31:52 | 000,003,790 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\FASTWiz.html
[2006/08/03 16:55:04 | 000,032,676 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\FASTWiz.log
[2006/08/02 18:36:47 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/08/02 18:13:59 | 000,000,136 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/08/02 16:34:47 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
[2006/08/02 16:20:11 | 000,004,272 | R--- | C] () -- C:\WINDOWS\System32\drivers\bvrp_pci.sys
[2005/12/30 23:54:38 | 000,002,586 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2004/12/04 12:57:35 | 000,000,137 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\fusioncache.dat
[2003/12/14 16:18:04 | 000,047,104 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2003/12/02 18:26:04 | 000,000,478 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Application Data\dm.ini
[2003/11/19 18:39:50 | 000,141,896 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\GDIPFONTCACHEV1(1).DAT
[2003/11/19 18:39:49 | 001,581,754 | -H-- | C] () -- C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\IconCache(1).db
[2003/08/13 22:54:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2003/07/08 12:41:48 | 000,047,616 | ---- | C] () -- C:\WINDOWS\System32\P16X.dll
[2003/01/07 14:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2009/02/24 20:31:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ableton
[2006/08/02 18:16:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BVRP Software
[2007/12/30 22:33:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2008/09/27 13:20:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MailFrontier
[2009/11/28 15:22:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Musicnotes
[2006/08/03 17:02:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Napster
[2007/12/30 22:33:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nikon
[2009/11/22 16:09:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2007/12/30 22:33:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2010/02/09 17:43:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/03/15 23:07:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/07/21 00:24:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Ableton
[2003/10/08 00:30:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Aim
[2006/08/03 17:12:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\alta
[2009/08/02 08:30:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2006/08/03 17:12:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\FotoWire
[2009/08/22 11:45:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\GARMIN
[2006/08/03 17:13:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Leadertech
[2006/08/03 17:12:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Learn2.com
[2006/08/03 17:14:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Musicmatch
[2008/01/20 23:51:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Nikon
[2006/08/03 17:12:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Snapfish
[2010/02/14 20:42:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Thunderbird
[2010/02/13 12:21:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Windows Search
[2006/08/03 17:42:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Don Peterson\Application Data\Aim
[2006/08/03 17:42:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Don Peterson\Application Data\FotoWire
[2007/04/07 13:06:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Don Peterson.CINDY-86UR58919\Application Data\acccore
[2006/12/26 14:45:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Don Peterson.CINDY-86UR58919\Application Data\Aim
[2007/11/03 14:10:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Don Peterson.CINDY-86UR58919\Application Data\Nikon
[2006/08/03 17:49:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hayley Peterson\Application Data\acccore
[2006/08/03 17:49:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hayley Peterson\Application Data\Aim
[2006/08/03 17:51:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hayley Peterson\Application Data\IMVU
[2006/08/03 17:52:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hayley Peterson\Application Data\Nikon
[2006/11/18 23:32:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sam\Application Data\Aim
[2007/08/29 13:49:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sam\Application Data\Viewpoint
[2006/08/03 18:18:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sam Peterson\Application Data\Aim

========== Purity Check ==========

========== Custom Scans ==========

< %ALLUSERSPROFILE%\Application Data\*. >
[2009/02/24 20:31:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ableton
[2009/12/30 14:17:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2009/06/15 15:25:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AOL
[2007/12/02 12:25:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AOL Downloads
[2007/08/06 14:30:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AOL OCP
[2007/11/03 09:55:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Apple
[2006/12/29 13:37:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Apple Computer
[2009/10/01 13:04:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ArcSoft
[2006/08/02 18:16:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BVRP Software
[2006/08/03 17:01:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Creative
[2006/08/03 17:01:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Dell
[2007/12/30 22:33:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2006/08/03 17:01:53 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\GTek
[2010/02/27 13:28:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HP
[2010/02/09 17:54:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kodak
[2008/09/27 13:20:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MailFrontier
[2008/09/27 10:12:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/02/14 21:35:11 | 000,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2009/11/28 15:22:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Musicnotes
[2006/08/03 17:02:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Napster
[2007/12/30 22:33:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nikon
[2010/02/06 13:09:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Norton
[2010/02/06 12:45:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NortonInstaller
[2006/08/03 17:03:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\QuickTime
[2006/08/03 17:02:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SBSI
[2010/02/10 18:20:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2010/02/06 12:22:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sun
[2010/02/10 18:35:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2006/08/03 17:02:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Support.com
[2010/02/07 10:02:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Symantec
[2009/11/22 16:09:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2007/12/30 22:33:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2010/02/09 17:43:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/11/15 20:11:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WEBREG
[2006/08/02 17:09:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2009/03/15 23:07:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}

< %ALLUSERSPROFILE%\Application Data\*.exe /s >
[2009/02/04 12:56:14 | 000,075,112 | ---- | M] (GEAR Software, Inc.) -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}\x86\DifXInstall32.exe
[2005/11/23 18:35:38 | 000,804,960 | ---- | M] (America Online Inc) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\AIMinst.exe
[2005/11/23 18:35:04 | 000,456,408 | ---- | M] (America Online Inc) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\AIMLang.exe
[2005/11/23 18:36:17 | 000,081,200 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\alsetup.exe
[2005/11/23 18:35:48 | 000,601,176 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\ampx.exe
[2005/11/23 18:35:42 | 000,100,456 | ---- | M] (Gteko Ltd.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\aod.exe
[2005/11/23 18:36:00 | 000,044,448 | ---- | M] (America Online) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\instopts.exe
[2005/11/23 18:35:53 | 000,163,136 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\iphinst.exe
[2005/11/23 18:36:12 | 000,651,952 | ---- | M] (America Online) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\muinst.exe
[2005/11/23 18:37:05 | 004,982,584 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\ocpinst.exe
[2005/11/23 18:36:42 | 002,925,152 | ---- | M] (Plaxo, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\plxoinst.exe
[2005/11/23 18:36:19 | 000,033,896 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\postproc.exe
[2005/11/23 18:35:16 | 000,308,840 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\prodpckr.exe
[2005/11/23 18:34:58 | 000,010,344 | ---- | M] (America Online Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\rmb1.exe
[2005/11/23 18:35:31 | 000,187,496 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\setup.exe
[2005/11/23 18:36:32 | 000,568,304 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\SLinst.exe
[2005/11/23 18:35:55 | 000,185,960 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\SLinstLP.exe
[2005/11/23 18:37:08 | 000,310,288 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\tbsetup.exe
[2005/11/23 18:36:36 | 001,073,480 | ---- | M] (America Online) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\toolbar.exe
[2005/11/23 18:35:24 | 000,410,056 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.1.3\vwpt.exe
[2006/01/30 15:09:43 | 000,806,912 | ---- | M] (America Online Inc) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\AIMinst.exe
[2006/01/30 15:09:25 | 000,456,240 | ---- | M] (America Online Inc) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\AIMLang.exe
[2006/01/30 15:10:05 | 000,081,200 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\alsetup.exe
[2006/01/30 15:10:08 | 000,601,176 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\ampx.exe
[2006/01/30 15:10:11 | 000,100,456 | ---- | M] (Gteko Ltd.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\aod.exe
[2006/01/30 15:10:25 | 000,044,448 | ---- | M] (America Online) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\instopts.exe
[2006/01/30 15:09:51 | 000,163,136 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\iphinst.exe
[2006/01/30 15:10:22 | 000,651,952 | ---- | M] (America Online) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\muinst.exe
[2006/01/30 15:11:12 | 004,982,584 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\ocpinst.exe
[2006/01/30 15:10:52 | 002,938,312 | ---- | M] (Plaxo, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\plxoinst.exe
[2006/01/30 15:10:27 | 000,033,896 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\postproc.exe
[2006/01/30 15:09:49 | 000,308,840 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\prodpckr.exe
[2006/01/30 15:09:33 | 000,010,344 | ---- | M] (America Online Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\rmb1.exe
[2006/01/30 15:09:21 | 000,187,496 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\setup.exe
[2006/01/30 15:10:33 | 000,568,304 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\SLinst.exe
[2006/01/30 15:10:16 | 000,185,960 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\SLinstLP.exe
[2006/01/30 15:11:15 | 000,310,288 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\tbsetup.exe
[2006/01/30 15:10:39 | 001,073,120 | ---- | M] (America Online) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\toolbar.exe
[2006/01/30 15:09:47 | 000,410,056 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.0.6.1\vwpt.exe
[2006/11/14 17:38:33 | 000,874,808 | ---- | M] (AOL LLC) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.3.30.1\AIMinst.exe
[2006/11/14 17:39:06 | 000,430,168 | ---- | M] (AOL LLC) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.3.30.1\AIMLang.exe
[2006/11/14 17:38:49 | 000,081,176 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.3.30.1\alsetup.exe
[2006/11/14 17:39:00 | 000,601,176 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.3.30.1\ampx.exe
[2006/11/14 17:38:47 | 000,104,528 | ---- | M] (Gteko Ltd.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.3.30.1\aod.exe
[2006/11/14 17:38:15 | 000,160,336 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.3.30.1\inst.exe
[2006/11/14 17:38:45 | 000,044,448 | ---- | M] (AOL LLC.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.3.30.1\instopts.exe
[2006/11/14 17:39:13 | 000,163,888 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.3.30.1\iphinst.exe
[2006/11/14 17:39:17 | 000,555,736 | ---- | M] (America Online) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.3.30.1\muinst.exe
[2006/11/14 17:39:42 | 005,269,312 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.3.30.1\ocpinst.exe
[2006/11/14 17:38:38 | 000,034,896 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.3.30.1\postproc.exe
[2006/11/14 17:39:10 | 000,312,912 | ---- | M] (AOL LLC) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.3.30.1\setup.exe
[2006/11/14 17:39:47 | 000,357,768 | ---- | M] (AOL LLC) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.3.30.1\tbsetup.exe
[2006/11/14 17:38:28 | 001,144,760 | ---- | M] (America Online) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.3.30.1\toolbar.exe
[2006/11/14 17:38:21 | 000,409,640 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_2.3.30.1\vwpt.exe
[2007/12/02 11:21:41 | 001,178,096 | ---- | M] (AOL LLC) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\AIMinst.exe
[2007/12/02 11:22:31 | 000,560,784 | ---- | M] (AOL LLC) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\AIMLang.exe
[2007/12/02 11:21:57 | 000,141,944 | ---- | M] (AOL LLC) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\alsetup.exe
[2007/12/02 11:22:43 | 000,631,624 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\ampx.exe
[2007/12/02 11:21:52 | 000,164,912 | ---- | M] (AOL LLC.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\inst.exe
[2007/12/02 11:22:36 | 000,055,200 | ---- | M] (AOL LLC.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\instopts.exe
[2007/12/02 12:25:32 | 000,228,912 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\migrator.exe
[2007/12/02 11:22:03 | 000,579,248 | ---- | M] (AOL LLC.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\muinst.exe
[2007/12/02 11:22:16 | 005,358,864 | ---- | M] (AOL LLC) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\ocpinst.exe
[2007/12/02 11:22:39 | 000,035,888 | ---- | M] (AOL LLC.) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\postproc.exe
[2007/12/02 11:22:28 | 000,312,880 | ---- | M] (AOL LLC) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\setup.exe
[2007/12/02 11:22:21 | 000,357,776 | ---- | M] (AOL LLC) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\tbsetup.exe
[2007/12/02 11:21:47 | 001,082,064 | ---- | M] (AOL) -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\toolbar.exe
[2007/12/02 11:22:36 | 000,409,640 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install_6.0.28.3\vwpt.exe
[2007/09/17 09:34:06 | 000,136,528 | ---- | M] (AOL LLC.) -- C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4397.2.4\radioupd.exe
[2004/12/14 15:51:34 | 000,005,632 | ---- | M] (America Online, Inc.) -- C:\Documents and Settings\All Users\Application Data\AOL\C_America Online 9.0\OptScan.exe
[2009/03/12 20:18:00 | 000,075,048 | ---- | M] (Apple Inc.) -- C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.0.52\SetupAdmin.exe
[2005/11/01 06:52:47 | 000,056,320 | ---- | M] (Gteko Ltd.) -- C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\HTML\item_templ\coach\RunGdp.exe
[2005/11/22 07:07:07 | 000,097,280 | ---- | M] (Dell Inc) -- C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch2\CIP\DellSupportUtil.exe
[2005/06/17 18:53:10 | 000,119,030 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch2\CIP\UpdateAkamaiURL2s.EXE
[2005/11/01 06:44:49 | 000,036,864 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch2\HTML\DellSommelierFix.exe
[2005/10/25 06:15:36 | 000,123,138 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch2\HTML\MakeDesktopShortcut.EXE
[2005/10/02 09:27:01 | 000,056,320 | ---- | M] (Gteko Ltd.) -- C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch2\HTML\item_templ\coach\RunGdp.exe
[2006/01/17 08:21:21 | 000,068,608 | ---- | M] (Dell Inc) -- C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch3\HTML\fix\DellSupportLauncher.exe
[2005/10/02 09:28:01 | 000,056,320 | ---- | M] (Gteko Ltd.) -- C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch3\HTML\item_templ\coach\RunGdp.exe
[2004/11/10 16:43:20 | 000,082,824 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\AlertSWF\contents\Exec.exe
[2004/11/11 17:03:55 | 000,204,760 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\ViewpointManager\contents\Exec.exe

< %APPDATA%\*. >
[2009/07/21 00:24:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Ableton
[2009/10/14 06:03:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Adobe
[2010/02/22 13:55:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\AdobeUM
[2003/10/08 00:30:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Aim
[2006/08/03 17:12:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\alta
[2006/08/03 17:12:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\AOL
[2006/08/03 17:13:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Apple Computer
[2008/04/29 22:03:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\ArcSoft
[2009/08/02 08:30:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2006/08/02 18:50:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\CyberLink
[2006/08/03 17:12:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\FotoWire
[2009/08/22 11:45:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\GARMIN
[2003/10/08 00:39:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Google
[2006/08/03 17:12:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\GTek
[2006/08/03 17:12:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Help
[2009/11/15 20:11:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\HP
[2006/08/03 17:13:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Identities
[2003/10/08 00:38:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Lavasoft
[2006/08/03 17:13:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Leadertech
[2006/08/03 17:12:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Learn2.com
[2006/12/10 11:40:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Macromedia
[2008/09/27 10:12:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Malwarebytes
[2006/08/03 17:12:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\McAfee.com
[2010/02/14 21:35:11 | 000,000,000 | --SD | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Microsoft
[2008/09/15 15:15:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Mozilla
[2006/08/03 17:14:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Musicmatch
[2008/01/20 23:51:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Nikon
[2006/08/03 17:12:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Real
[2006/08/03 17:12:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Roxio
[2009/11/28 15:11:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Sibelius Software
[2006/08/03 17:12:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Snapfish
[2006/08/03 17:12:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Sonic
[2006/08/03 17:12:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Sun
[2010/02/10 20:47:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\SUPERAntiSpyware.com
[2006/08/02 18:52:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Talkback
[2010/02/14 20:42:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Thunderbird
[2010/02/06 15:37:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\U3
[2010/02/13 12:21:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Windows Search

< %APPDATA%\*.exe /s >
[2008/06/12 02:09:06 | 000,033,088 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2008/08/05 17:44:26 | 001,526,544 | ---- | M] (Adobe Systems Incorporated) -- C:\Documents and Settings\Cindy Peterson\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe

< %SYSTEMDRIVE%\*.exe >
[2002/07/09 09:29:20 | 000,450,560 | ---- | M] (Jasc Software) -- C:\Player.exe

< MD5 for: AGP440.SYS >
[2006/08/02 17:40:58 | 022,245,337 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/10/02 07:07:48 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2006/08/02 17:40:58 | 022,245,337 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2008/10/02 07:07:48 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 10:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ERDNT\cache\agp440.sys
[2008/04/13 10:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 10:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/03 22:07:41 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: ATAPI.SYS >
[2003/07/16 12:46:14 | 010,158,890 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys
[2006/08/02 17:40:58 | 022,245,337 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/10/02 07:07:48 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2006/08/02 17:40:58 | 022,245,337 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2008/10/02 07:07:48 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2003/07/16 12:24:25 | 000,086,912 | ---- | M] (Microsoft Corporation) MD5=95B858761A00E1D4F81F79A0DA019ACA -- C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys
[2002/08/29 00:27:50 | 000,086,912 | ---- | M] (Microsoft Corporation) MD5=95B858761A00E1D4F81F79A0DA019ACA -- C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys
[2008/04/13 10:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/04/13 10:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 10:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 21:59:42 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 16:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/13 16:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 16:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
[2004/08/03 23:56:42 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/13 16:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/13 16:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 16:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2004/08/03 23:56:44 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/03 23:56:44 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 16:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/13 16:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 16:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/03/08 04:31:44 | 000,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll
[2009/03/08 04:31:38 | 000,216,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtrans.dll
[2009/12/21 11:14:03 | 000,184,320 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\iepeers.dll
[3 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

========== Alternate Data Streams ==========

@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:02C77207
< End of report >

OTL Extras logfile created on: 3/5/2010 9:26:42 PM - Run 1
OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\Cindy Peterson\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 59.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 1536F:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 15.63 Gb Free Space | 20.97% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 74.46 Gb Total Space | 25.61 Gb Free Space | 34.39% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: CINDY-86UR58919
Current User Name: Cindy Peterson
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_USERS\S-1-5-21-343818398-1647877149-725345543-1004\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"65533:TCP" = 65533:TCP:*:Enabled:Services
"52344:TCP" = 52344:TCP:*:Enabled:Services
"3246:TCP" = 3246:TCP:*:Enabled:Services
"2479:TCP" = 2479:TCP:*:Enabled:Services
"3389:TCP" = 3389:TCP:*:Enabled:Remote Desktop
"427:UDP" = 427:UDP:*:Enabled:SLP_Port(427)
"5202:TCP" = 5202:TCP:*:Enabled:Services
"7709:TCP" = 7709:TCP:*:Enabled:Services
"7382:TCP" = 7382:TCP:*:Enabled:Services
"6209:TCP" = 6209:TCP:*:Enabled:Services

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"65533:TCP" = 65533:TCP:*:Enabled:Services
"52344:TCP" = 52344:TCP:*:Enabled:Services
"3246:TCP" = 3246:TCP:*:Enabled:Services
"2479:TCP" = 2479:TCP:*:Enabled:Services
"427:UDP" = 427:UDP:*:Enabled:SLP_Port(427)
"5202:TCP" = 5202:TCP:*:Enabled:Services
"7709:TCP" = 7709:TCP:*:Enabled:Services
"7382:TCP" = 7382:TCP:*:Enabled:Services
"6209:TCP" = 6209:TCP:*:Enabled:Services

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe -- File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe:*:Enabled:hpqcopy2.exe -- File not found
"E:\setup\HPZnui01.exe" = E:\setup\HPZnui01.exe:*:Enabled:hpznui01.exe -- File not found
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard)
"C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe:*:Enabled:hpqgpc01.exe -- File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard)
"C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe -- (Hewlett-Packard Development Co. L.P.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01F9D88C-3C86-4E82-840A-101A3221F67A}" = Microsoft Money 2003
"{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
"{02B42D23-10F2-4862-ADA4-3DF1EA0021B2}" = Microsoft Money 2003 System Pack
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{03410014-3975-4267-9F39-1DC4745090B7}" = Microsoft Encarta Encyclopedia Standard 2003
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{12BDDF23-B1DB-49C8-92D3-3E6841CCED61}" = Microsoft Streets and Trips 2002
"{151C555A-A9E7-4A2E-B6D7-165D04A3C956}" = Dell Picture Studio - Dell Image Expert
"{162B71B8-8464-4680-A086-601D555B331D}" = Apple Mobile Device Support
"{1CB92574-96F2-467B-B793-5CEB35C40C29}" = Image Resizer Powertoy for Windows XP
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java™ 6 Update 18
"{2EAF8AB7-2B78-4072-960B-00D412D9BBB4}" = PrintingPress
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{369B36BE-3D64-4641-9AEA-808D436FE132}" = Microsoft Picture It! Photo 7.0
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{43C0C354-A185-4D2D-A057-67C9160460E1}" = PS_AIO_04_C4580_Software_Min
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{47ECCB1F-2811-49C0-B6A7-26778639ABA0}" = 32 Bit HP CIO Components Installer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A3D0CF8-60FF-4CEF-91A4-A1F001424602}" = DocProc
"{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}" = UnloadSupport
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{64116298-93C5-401D-B06C-39D8E3338508}" = DAO
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{68D5CEF9-0DA8-47FE-B0EB-4CBFB5AAF662}" = ArcSoft PhotoImpression 4
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6C117F31-28A8-4477-BE91-64AC0A2204AD}" = Microsoft IntelliPoint 6.01
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{70E1E357-E57C-4284-B04E-58196DC27BC1}" = PanoStandAlone
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7641710F-A4AD-4EAE-889C-4958BE3F169C}" = C4580
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B7917E0-AF55-4E8A-9473-017F0AA03AC8}" = QuickTime
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{91110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{96E16100-A77F-4B31-B9AD-FFBA040EE1BD}" = Sound Blaster Live!
"{9A00D1BA-D03A-44E5-AF28-86A1F377DF61}" = The Sims Makin' Magic
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A6A195F5-BCAB-4F38-8459-DF693303CD8D}" = PS_AIO_04_C4580_ProductContext
"{A7DEBAA4-B211-4D1A-A6B3-E52BFAAA1D0C}" = Garmin Communicator Plugin
"{AA2E8A46-B45E-4aea-8A23-88AB57D04523}" = WebReg
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-1033-0000-7760-000000000001}" = Adobe Acrobat 6.0 Professional
"{AC76BA86-7AD7-1033-7B44-A92000000001}" = Adobe Reader 9.2
"{B1102A25-3AA3-446B-AA0F-A699B07A02FD}" = Garmin USB Drivers
"{BED1705F-7558-40f7-9F52-6C6FBD58EA2E}" = HP Photosmart C4500 All-In-One Driver Software 11.0 Rel .4
"{BF08AB1C-3357-4f20-A200-8EBB8EF27C59}" = BufferChm
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C26B06A9-27BB-45B0-9873-9C623EC2BA38}" = iTunes
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{C89B5E3A-690F-4CEE-909A-BF869E198B0A}" = Scan
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D23E2520-0EAA-4AC3-A47E-A551C70D4FED}" = C4580_Help
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{D4278897-1541-493E-9D39-59CC6AB0FC09}" = PS_AIO_04_C4580_Software
"{D45E8C45-B601-4A80-AFD8-E16338744DE1}" = ArcSoft Panorama Maker 4
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{D75915D3-6CFF-445F-A346-18ED6EF2F618}" = Microsoft IntelliType Pro 6.01
"{D78653C3-A8FF-415F-92E6-D774E634FF2D}" = Dell ResourceCD
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E96B0085-6659-486b-A221-5042A042728D}" = Toolbox
"{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EE7C3A14-1D20-49F6-B903-491561076F0F}" = ArcSoft Software Suite
"{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
"{EF9E56EE-0243-4BAD-88F4-5E7508AA7D96}" = Destination Component
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F45298E5-0083-426F-A668-1A2C5F04B8A0}" = FaxTools
"{F95F178B-56AD-4fab-87F8-FA81E66C7D68}" = Network
"{FF3999BE-1A7B-4738-88AA-97BF14094A4A}" = PictureProject
"45A7283175C62FAC673F913C1F532C5361F97841" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (03/08/2007 2.2.1.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"CCleaner" = CCleaner
"CNXT_MODEM_PCI_VEN_14F1&DEV_2702" = Conexant SmartHSFi V.9x 56K DF PCI Modem
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"ComcastToolbar" = Comcast Toolbar
"ESET Online Scanner" = ESET Online Scanner v3
"HP Imaging Device Functions" = HP Imaging Device Functions 11.0
"HPOCR" = OCR Software by I.R.I.S. 11.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"Mozilla Thunderbird (3.0.1)" = Mozilla Thunderbird (3.0.1)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Musicnotes Combined Installer_is1" = Musicnotes Software Suite 1.2
"N360" = Norton Security Suite
"Network Play System (Patching)" = Network Play System (Patching)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"Picasa2" = Picasa 2
"PROSet" = Intel® PRO Network Adapters and Drivers
"Shockwave" = Shockwave
"SystemRequirementsLab" = System Requirements Lab
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== Last 10 Event Log Errors ==========

[ System Events ]
Error - 2/27/2010 10:11:55 PM | Computer Name = CINDY-86UR58919 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 2/27/2010 10:13:20 PM | Computer Name = CINDY-86UR58919 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 2/27/2010 10:29:11 PM | Computer Name = CINDY-86UR58919 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 2/27/2010 10:30:26 PM | Computer Name = CINDY-86UR58919 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 2/27/2010 10:31:26 PM | Computer Name = CINDY-86UR58919 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 2/28/2010 12:46:34 AM | Computer Name = CINDY-86UR58919 | Source = System Error | ID = 1003
Description = Error code 000000c2, parameter1 00000007, parameter2 00000cd4, parameter3
00000000, parameter4 87fa8230.

Error - 3/3/2010 9:13:46 AM | Computer Name = CINDY-86UR58919 | Source = Windows Update Agent | ID = 16
Description = Unable to Connect: Windows is unable to connect to the automatic updates
service and therefore cannot download and install updates according to the set
schedule. Windows will continue to try to establish a connection.

Error - 3/4/2010 11:39:33 PM | Computer Name = CINDY-86UR58919 | Source = System Error | ID = 1003
Description = Error code 1000000a, parameter1 00000000, parameter2 00000002, parameter3
00000000, parameter4 804fd603.

Error - 3/4/2010 11:56:05 PM | Computer Name = CINDY-86UR58919 | Source = Service Control Manager | ID = 7034
Description = The NVIDIA Display Driver Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 3/5/2010 6:49:37 PM | Computer Name = CINDY-86UR58919 | Source = Ntfs | ID = 262199
Description = The file system structure on the disk is corrupt and unusable. Please
run the chkdsk utility on the volume C:.

< End of report >

#7 thcbytes

Malware Response Team
14,790 posts
OFFLINE

Gender:Male
Local time:04:43 PM

Posted 06 March 2010 - 09:23 AM

Hi,

QUOTE

The OTL log says the computer has 1.0 GB of physical memory, the system properties here says it has 1.5 GB.

That's ok.

Please uninstall IE 8 by way of add/remove. It will roll it back. Then reinstall IE 8 from here.
http://www.microsoft.com/hk/windows/intern...worldwide-sites.

I really do not like IE as much as FF. It is less secure than FF and slower. I will make some recommendations in this regard when were done.

Next...

We need to run an OTL Fix

Please reopen on your desktop.
Copy and Paste the following code into the textbox. Do not include the word "Code"
CODE
:OTL
[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\Documents and Settings\Cindy Peterson\My Documents\*.tmp files -> C:\Documents and Settings\Cindy Peterson\My Documents\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2007/08/29 13:49:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sam\Application Data\Viewpoint
[2010/02/09 17:43:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint

:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"3389:TCP" =-

:Commands
[resethosts]
[emptytemp]
[Reboot]
Push
OTL may ask to reboot the machine. Please do so if asked.
Click .
A report will open. Copy and Paste that report in your next reply.

==========

Please re-run help.bat and profiles.exe and post the logs

==========

With your next post please provide:

* IE problems still?
* OTL fix log
* Help log
* Profiles log
* How is it running now?

Kind regards,
~t

Proud member - Unified Network of Instructors and Trained Eliminators
Posted Image

#8 BennetLang

Topic Starter

Members
8 posts
OFFLINE

Local time:04:43 PM

Posted 06 March 2010 - 01:56 PM

Hi,

Thank you for the quick reply and all your help. It's going pretty well.

This morning it had to go through chkdsk before it would start up, but that went through successfully and it's since restarted several times fine. It's also woken up from standby and nothing has crashed. Everything is working much much faster than it was while helpassistant kept coming back.

I uninstalled IE8 and reinstalled (the link you gave me doesn't work here, but I did download it from Microsoft rather than go through windows update). It also did 2 windows updates right afterwards. She had FF as her default browser when this started, then it started crashing so she had to go back to IE.

I included both the OTL log and the extras log, then the help and profiles.

OTL logfile created on: 3/6/2010 10:34:15 AM - Run 2
OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\Cindy Peterson\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 62.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 90.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 1536F:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 15.66 Gb Free Space | 21.01% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 74.46 Gb Total Space | 25.61 Gb Free Space | 34.39% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: CINDY-86UR58919
Current User Name: Cindy Peterson
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/03/05 21:24:35 | 000,553,984 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Cindy Peterson\Desktop\OTL.exe
PRC - [2010/02/06 13:05:54 | 000,117,640 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe
PRC - [2008/04/13 16:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/02/20 17:18:32 | 000,366,400 | ---- | M] (Google Inc.) -- C:\Program Files\Picasa2\PicasaMediaDetector.exe
PRC - [2006/07/07 15:14:38 | 000,576,320 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft IntelliType Pro\itype.exe
PRC - [2004/10/14 14:42:54 | 001,404,928 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe
PRC - [2003/06/20 02:43:00 | 000,024,576 | ---- | M] (BVRP Software) -- C:\Program Files\Digital Line Detect\DLG.exe
PRC - [2003/05/15 01:19:50 | 000,217,193 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
PRC - [2002/04/03 01:01:00 | 000,135,264 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe

========== Modules (SafeList) ==========

MOD - [2010/03/05 21:24:35 | 000,553,984 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Cindy Peterson\Desktop\OTL.exe
MOD - [2010/02/06 13:05:13 | 000,419,696 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Security Suite\Engine\3.8.0.41\asOEHook.dll

========== Win32 Services (SafeList) ==========

SRV - [2010/02/06 13:05:54 | 000,117,640 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe -- (N360)

========== Driver Services (SafeList) ==========

DRV - [2010/02/06 13:06:22 | 000,124,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2010/02/06 13:06:04 | 000,310,320 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\N360\0308000.029\SYMEFA.SYS -- (SymEFA)
DRV - [2010/02/06 13:06:04 | 000,217,136 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMTDI.SYS -- (SYMTDI)
DRV - [2010/02/06 13:06:04 | 000,089,904 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMFW.SYS -- (SYMFW)
DRV - [2010/02/06 13:06:04 | 000,036,400 | R--- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SymIM.sys -- (SymIMMP)
DRV - [2010/02/06 13:06:04 | 000,036,400 | R--- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SymIM.sys -- (SymIM)
DRV - [2010/02/06 13:06:04 | 000,036,400 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMNDIS.SYS -- (SYMNDIS)
DRV - [2010/02/06 13:06:04 | 000,033,072 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMIDS.SYS -- (SYMIDS)
DRV - [2010/02/06 13:06:03 | 000,308,272 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\N360\0308000.029\SRTSP.SYS -- (SRTSP)
DRV - [2010/02/06 13:06:03 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\N360\0308000.029\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2010/02/06 13:06:01 | 000,482,432 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\N360\0308000.029\ccHPx86.sys -- (ccHP)
DRV - [2010/02/06 13:06:00 | 000,259,632 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\N360\0308000.029\BHDrvx86.sys -- (BHDrvx86)
DRV - [2010/02/05 19:02:28 | 001,324,720 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\NAVEX15.SYS -- (NAVEX15)
DRV - [2010/02/05 19:02:28 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010/02/05 19:02:28 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2010/02/05 19:02:28 | 000,084,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100304.032\NAVENG.SYS -- (NAVENG)
DRV - [2009/10/28 14:37:22 | 000,329,592 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100224.002\IDSXpx86.sys -- (IDSxpx86)
DRV - [2008/05/16 14:01:00 | 006,557,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2008/04/13 11:45:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2006/08/05 13:55:59 | 000,008,413 | ---- | M] (RealNetworks, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\mcstrm.sys -- (MCSTRM)
DRV - [2004/09/17 09:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)
DRV - [2003/12/09 01:02:46 | 000,014,336 | R--- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NetMotCM.sys -- (ndiscm)
DRV - [2003/09/22 12:43:06 | 001,330,048 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\P16X.sys -- (P16X) Creative SB Live! Series (WDM)
DRV - [2003/09/22 08:48:06 | 000,130,192 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV - [2003/09/22 08:47:38 | 000,178,672 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctoss2k.sys -- (ossrv)
DRV - [2003/09/19 15:47:24 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc)
DRV - [2003/08/28 15:58:00 | 000,004,272 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\bvrp_pci.sys -- (bvrp_pci)
DRV - [2003/08/06 00:04:00 | 000,100,373 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsnudfa.sys -- (tfsnudfa)
DRV - [2003/08/06 00:04:00 | 000,098,068 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsnudf.sys -- (tfsnudf)
DRV - [2003/08/06 00:04:00 | 000,083,284 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsnifs.sys -- (tfsnifs)
DRV - [2003/08/06 00:04:00 | 000,034,837 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsncofs.sys -- (tfsncofs)
DRV - [2003/08/06 00:04:00 | 000,025,685 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsnboio.sys -- (tfsnboio)
DRV - [2003/08/06 00:04:00 | 000,014,229 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsnopio.sys -- (tfsnopio)
DRV - [2003/08/06 00:04:00 | 000,006,357 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsnpool.sys -- (tfsnpool)
DRV - [2003/08/06 00:04:00 | 000,004,117 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsndrct.sys -- (tfsndrct)
DRV - [2003/08/06 00:04:00 | 000,002,233 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsndres.sys -- (tfsndres)
DRV - [2003/07/31 02:21:00 | 000,084,576 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\drvmcdb.sys -- (drvmcdb)
DRV - [2003/07/14 10:28:40 | 000,005,621 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\sscdbhk5.sys -- (sscdbhk5)
DRV - [2003/07/14 10:28:22 | 000,023,219 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\ssrtln.sys -- (ssrtln)
DRV - [2003/07/02 07:26:20 | 000,202,368 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2003/07/02 07:25:24 | 000,631,680 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2003/07/02 07:24:16 | 001,063,936 | R--- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2003/06/20 01:56:00 | 000,040,448 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\drvnddm.sys -- (drvnddm)
DRV - [2003/03/05 12:19:28 | 000,015,840 | ---- | M] (Creative Technology Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\PFMODNT.SYS -- (PfModNT)
DRV - [2001/08/22 08:42:58 | 000,013,632 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS -- (OMCI)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-343818398-1647877149-725345543-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-343818398-1647877149-725345543-1004\S-1-5-21-343818398-1647877149-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-343818398-1647877149-725345543-1004\S-1-5-21-343818398-1647877149-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - HKLM\software\mozilla\Firefox\extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
FF - HKLM\software\mozilla\Firefox\extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2010/03/06 10:24:58 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/27 16:32:40 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/02/27 16:32:38 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010/02/27 10:37:21 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/02/27 11:02:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Mozilla\Extensions
[2010/02/14 20:42:45 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Cindy Peterson\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2006/08/03 17:12:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Mozilla\Firefox\Profiles\51gpuy9x.default\extensions
[2010/02/27 11:51:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Mozilla\Firefox\Profiles\7fj2fqyz.default\extensions
[2010/03/06 10:24:50 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2003/07/16 12:29:34 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll File not found
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll (Microsoft Corporation)
O2 - BHO: (Comcast Toolbar) - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\Program Files\ComcastToolbar\comcasttoolbar.dll ()
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll File not found
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKLM\..\Toolbar: (Comcast Toolbar) - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\Program Files\ComcastToolbar\comcasttoolbar.dll ()
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O3 - HKU\S-1-5-21-343818398-1647877149-725345543-1004\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKU\S-1-5-21-343818398-1647877149-725345543-1004\..\Toolbar\WebBrowser: (Comcast Toolbar) - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\Program Files\ComcastToolbar\comcasttoolbar.dll ()
O3 - HKU\S-1-5-21-343818398-1647877149-725345543-1004\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [diagent] C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (Google Inc.)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [StorageGuard] C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe (Sonic Solutions)
O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
O4 - HKU\.DEFAULT..\Run: [DWQueuedReporting] C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKU\S-1-5-18..\Run: [DWQueuedReporting] C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-343818398-1647877149-725345543-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-343818398-1647877149-725345543-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-343818398-1647877149-725345543-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-343818398-1647877149-725345543-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-343818398-1647877149-725345543-1004_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra Button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll File not found
O9 - Extra Button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownlo...sreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/...can8/oscan8.cab (Reg Error: Key error.)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/...lscbase6087.cab (Windows Live Safety Center Base Module)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 207.217.126.81 207.217.77.82
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files\Norton Security Suite\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:1 () - http://www.northseattle.edu/services/runstart/faq.htm
O24 - Desktop WallPaper: C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/08/01 20:00:44 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2002/09/03 06:59:58 | 000,000,000 | ---- | M] () - F:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/03/06 10:29:26 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2010/03/06 10:16:51 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2010/03/05 21:24:33 | 000,553,984 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Cindy Peterson\Desktop\OTL.exe
[2010/03/05 18:23:37 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2010/03/05 17:49:24 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/03/05 17:49:24 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/03/05 17:49:24 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/03/05 17:49:24 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/03/04 19:59:47 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/03/04 19:58:32 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/03/04 19:58:18 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/02/27 20:55:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\Desktop\gmer
[2010/02/27 17:09:00 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/02/27 17:08:56 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/02/27 17:08:56 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/02/27 11:17:16 | 008,327,264 | ---- | C] (Mozilla) -- C:\Documents and Settings\Cindy Peterson\My Documents\Firefox Setup 3.6.exe
[2010/02/27 11:02:48 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Cindy Peterson\Recent
[2010/02/27 10:35:28 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010/02/26 19:21:05 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2010/02/26 19:16:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Adobe
[2010/02/26 18:56:46 | 000,000,000 | ---D | C] -- C:\WINDOWS\nview
[2010/02/26 18:56:40 | 000,446,464 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvudisp.exe
[2010/02/26 18:55:43 | 000,446,464 | ---- | C] (NVIDIA Corporation) -- C:\WINDOWS\System32\NVUNINST.EXE
[2010/02/26 18:55:22 | 000,000,000 | ---D | C] -- C:\NVIDIA
[2010/02/26 18:51:18 | 000,000,000 | ---D | C] -- C:\Program Files\SystemRequirementsLab
[2010/02/26 18:34:28 | 000,991,232 | ---- | C] (Sensaura) -- C:\WINDOWS\System32\virtear.dll
[2010/02/26 18:34:28 | 000,065,536 | ---- | C] (Sensaura Ltd) -- C:\WINDOWS\System32\Audio3d.dll
[2010/02/26 18:34:28 | 000,049,152 | ---- | C] (Analog Devices Inc.) -- C:\WINDOWS\System32\DSndUp.exe
[2010/02/26 18:34:28 | 000,045,056 | ---- | C] (adi) -- C:\WINDOWS\System32\CleanUp.exe
[2010/02/26 18:34:28 | 000,000,000 | ---D | C] -- C:\WINDOWS\VirtualEar
[2010/02/26 18:34:28 | 000,000,000 | ---D | C] -- C:\Program Files\Analog Devices
[2010/02/26 18:33:38 | 000,732,928 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\System32\drivers\senfilt.sys
[2010/02/26 18:33:38 | 000,311,296 | ---- | C] (Analog Devices Incorporated) -- C:\WINDOWS\System32\Edcrypt.dll
[2010/02/26 18:33:38 | 000,023,040 | ---- | C] (Windows ® 2000 DDK provider) -- C:\WINDOWS\System32\PostProc.dll
[2010/02/26 18:33:37 | 000,765,952 | ---- | C] (Sensaura Ltd) -- C:\WINDOWS\System\crlds3d.dll
[2010/02/25 07:59:26 | 000,000,000 | ---D | C] -- C:\N360_BACKUP
[2010/02/15 18:50:20 | 000,094,208 | ---- | C] (Apple Inc.) -- C:\WINDOWS\System32\QuickTimeVR.qtx
[2010/02/15 18:50:20 | 000,069,632 | ---- | C] (Apple Inc.) -- C:\WINDOWS\System32\QuickTime.qts
[2010/02/15 18:49:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\My Documents\stepintoadream
[2010/02/15 15:00:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\My Documents\old outlook
[2010/02/15 02:27:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth
[2010/02/14 21:41:22 | 000,000,000 | R-SD | C] -- C:\Documents and Settings\Cindy Peterson\My Documents\My Stationery
[2010/02/14 21:36:23 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft
[2010/02/14 21:35:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\microsoft
[2010/02/14 21:34:48 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live SkyDrive
[2010/02/14 21:34:00 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live
[2010/02/14 21:29:12 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Windows Live
[2010/02/14 20:42:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\Thunderbird
[2010/02/14 20:42:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\Application Data\Thunderbird
[2010/02/14 20:41:56 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird
[2010/02/14 17:01:55 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live Safety Center
[2010/02/14 14:32:15 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2010/02/14 14:12:52 | 000,181,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MpSigStub.exe
[2010/02/13 19:57:38 | 000,000,000 | ---D | C] -- C:\Program Files\ACW
[2010/02/13 12:21:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\Application Data\Windows Search
[2010/02/13 11:17:39 | 000,212,992 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\System32\CTDevCtrl.cpl
[2010/02/13 11:17:39 | 000,090,112 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\Updreg.EXE
[2010/02/13 11:17:39 | 000,024,576 | ---- | C] (Creative Technology Ltd) -- C:\WINDOWS\System32\CTDevCRes.dll
[2010/02/13 11:17:20 | 000,010,624 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\gameenum.sys
[2010/02/13 11:17:20 | 000,010,624 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\gameenum.sys
[2010/02/13 11:16:20 | 000,020,480 | ---- | C] (Creative Technology Ltd) -- C:\WINDOWS\INRES.DLL
[2010/02/13 11:16:19 | 000,061,440 | ---- | C] (Creative Technology Ltd) -- C:\WINDOWS\MIDIDEF.EXE
[2010/02/13 11:16:19 | 000,024,576 | ---- | C] (Creative Technology Ltd) -- C:\WINDOWS\MIXERDEF.EXE
[2010/02/13 11:15:16 | 000,006,752 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\System32\PFMODNT.SYS
[2010/02/13 11:15:06 | 000,015,840 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\System32\drivers\PFMODNT.SYS
[2010/02/13 11:15:06 | 000,000,000 | ---D | C] -- C:\Program Files\Creative
[2010/02/12 09:17:14 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Cindy Peterson\IECompatCache
[2010/02/12 08:56:58 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Cindy Peterson\IETldCache
[2010/02/11 23:52:00 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
[2010/02/11 23:29:33 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Desktop Search
[2010/02/11 23:29:32 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\GroupPolicy
[2010/02/11 23:26:41 | 000,192,000 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\offfilt.dll
[2010/02/11 23:26:41 | 000,098,304 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nlhtml.dll
[2010/02/11 23:26:41 | 000,029,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mimefilt.dll
[2010/02/10 18:35:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010/02/10 18:35:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\Application Data\SUPERAntiSpyware.com
[2010/02/10 18:35:12 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2010/02/09 21:43:34 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2010/02/09 20:30:01 | 000,016,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsg.dll
[2010/02/09 20:29:30 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Media Connect 2
[2010/02/09 20:26:43 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\UMDF
[2010/02/09 20:26:43 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles
[2010/02/07 13:53:06 | 000,118,272 | ---- | C] (Hewlett-Packard Company) -- C:\WINDOWS\System32\hpz3l692.dll
[2010/02/07 13:50:41 | 000,309,760 | R--- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\difxapi.dll
[2010/02/07 13:50:40 | 000,372,736 | R--- | C] (Hewlett-Packard) -- C:\WINDOWS\System32\hppldcoi.dll
[2010/02/07 13:50:40 | 000,303,104 | R--- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hposc_p01a.dll
[2010/02/07 13:50:37 | 000,974,848 | R--- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\System32\hpost_p01a.dll
[2010/02/07 13:50:34 | 000,729,088 | R--- | C] (Hewlett-Packard) -- C:\WINDOWS\System32\hposwia_p01a.dll
[2010/02/07 13:11:56 | 000,000,000 | ---D | C] -- C:\Program Files\Hewlett-Packard
[2010/02/07 13:09:43 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\HP
[2010/02/07 10:02:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Symantec
[2010/02/06 23:22:47 | 000,217,136 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symtdi.sys
[2010/02/06 23:22:46 | 000,048,688 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symndisv.sys
[2010/02/06 23:22:45 | 000,036,400 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symndis.sys
[2010/02/06 23:22:45 | 000,033,072 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symids.sys
[2010/02/06 23:22:44 | 000,089,904 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symfw.sys
[2010/02/06 23:22:42 | 000,310,320 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.sys
[2010/02/06 23:22:42 | 000,043,696 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.sys
[2010/02/06 23:22:41 | 000,308,272 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.sys
[2010/02/06 23:22:40 | 000,482,432 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\cchpx86.sys
[2010/02/06 23:22:39 | 000,259,632 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.sys
[2010/02/06 23:18:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\N360\0308000.029
[2010/02/06 20:17:18 | 000,000,000 | R--D | C] -- C:\Program Files\Norton Support
[2010/02/06 20:16:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\Symantec
[2010/02/06 15:43:04 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\URTTEMP
[2010/02/06 15:42:02 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec
[2010/02/06 15:38:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/02/06 15:37:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\Application Data\U3
[2010/02/06 15:37:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2010/02/06 13:06:40 | 000,036,400 | R--- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SymIM.sys
[2010/02/06 13:06:22 | 000,124,976 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/02/06 13:06:22 | 000,060,808 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\S32EVNT1.DLL
[2010/02/06 13:06:22 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Symantec Shared
[2010/02/06 13:04:07 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\N360
[2010/02/06 13:04:02 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Sidebar
[2010/02/06 13:04:02 | 000,000,000 | ---D | C] -- C:\Program Files\Norton Security Suite
[2010/02/06 13:04:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Norton
[2010/02/06 13:01:32 | 000,000,000 | ---D | C] -- C:\Program Files\NortonInstaller
[2010/02/06 12:45:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NortonInstaller
[2010/02/06 12:45:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cindy Peterson\My Documents\Symantec
[2010/02/06 12:22:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2010/02/06 12:22:51 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/02/06 12:22:25 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/02/06 12:22:24 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/02/06 12:22:24 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/02/06 12:22:24 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2009/07/24 07:59:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2009/07/24 07:59:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2009/05/01 12:02:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Mozilla
[2008/09/20 16:46:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[2007/11/05 20:00:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2007/03/10 16:50:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2006/10/27 09:28:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Talkback
[2006/10/27 09:27:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Mozilla
[2006/08/01 20:00:24 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2002/04/10 23:41:00 | 000,065,536 | ---- | C] ( ) -- C:\WINDOWS\System32\A3d.dll
[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\Documents and Settings\Cindy Peterson\My Documents\*.tmp files -> C:\Documents and Settings\Cindy Peterson\My Documents\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/03/06 10:30:59 | 000,720,758 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\Cat.DB
[2010/03/06 10:30:33 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/03/06 10:25:16 | 000,186,097 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010/03/06 10:24:51 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/03/06 10:24:35 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/03/06 10:24:32 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/03/06 10:23:21 | 006,029,312 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\ntuser.dat
[2010/03/06 10:23:21 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\Cindy Peterson\ntuser.ini
[2010/03/05 21:24:35 | 000,553,984 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Cindy Peterson\Desktop\OTL.exe
[2010/03/05 17:57:02 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/03/04 20:27:19 | 000,000,117 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\help.bat
[2010/03/04 20:25:53 | 000,000,006 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\fix.bat
[2010/03/04 20:24:28 | 000,412,056 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\HelpAsst_mebroot_fix.exe
[2010/03/04 20:22:54 | 000,147,832 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\profiles.exe
[2010/03/04 19:59:57 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2010/03/04 19:57:19 | 004,120,159 | R--- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\thcbytes.exe
[2010/03/04 19:51:31 | 000,363,008 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\rkill.pif
[2010/02/27 23:54:30 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/02/27 20:52:11 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\defogger_reenable
[2010/02/27 18:27:50 | 000,284,915 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\gmer.zip
[2010/02/27 18:26:19 | 000,524,288 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\dds.scr
[2010/02/27 18:26:07 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\Defogger.exe
[2010/02/27 17:09:03 | 000,000,705 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/27 16:32:53 | 000,001,611 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/02/27 13:21:06 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Ÿ9Ÿ9
[2010/02/27 11:17:16 | 008,327,264 | ---- | M] (Mozilla) -- C:\Documents and Settings\Cindy Peterson\My Documents\Firefox Setup 3.6.exe
[2010/02/27 11:03:46 | 000,012,876 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\My Documents\cc_20100227_110341.reg
[2010/02/27 10:58:42 | 000,082,375 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\bookmarksfeb10.html
[2010/02/27 10:56:04 | 000,082,375 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\bookmarks.html
[2010/02/26 19:26:17 | 000,166,858 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\My Documents\cc_20100226_192557.reg
[2010/02/26 19:22:26 | 000,001,557 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\CCleaner.lnk
[2010/02/26 18:15:11 | 000,000,847 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\Shortcut to procexp.lnk
[2010/02/25 07:44:27 | 000,002,497 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\Word 2003.lnk
[2010/02/25 07:42:32 | 015,425,536 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\My Documents\Money.mny
[2010/02/25 07:40:11 | 000,002,379 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\Money 2003.lnk
[2010/02/22 14:25:03 | 000,091,064 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/02/22 14:22:14 | 000,313,176 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/02/22 13:56:39 | 000,001,833 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
[2010/02/22 13:56:39 | 000,001,749 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 6.0 Professional.lnk
[2010/02/16 12:54:46 | 000,079,872 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\BHS PTSA February 11, 2010 BOard Meeting.doc
[2010/02/15 18:52:26 | 000,870,128 | ---- | M] () -- C:\WINDOWS\System32\mcs.rma
[2010/02/15 18:52:26 | 000,000,004 | ---- | M] () -- C:\WINDOWS\System32\EFA81C
[2010/02/15 18:50:20 | 000,094,208 | ---- | M] (Apple Inc.) -- C:\WINDOWS\System32\QuickTimeVR.qtx
[2010/02/15 18:50:20 | 000,069,632 | ---- | M] (Apple Inc.) -- C:\WINDOWS\System32\QuickTime.qts
[2010/02/15 11:22:45 | 000,001,940 | ---- | M] () -- C:\Documents and Settings\Cindy Peterson\Desktop\Windows Live Mail.lnk
[2010/02/14 20:42:12 | 000,001,677 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Thunderbird.lnk
[2010/02/13 12:25:55 | 000,443,588 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/02/13 12:25:55 | 000,071,846 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/02/13 11:18:53 | 000,000,066 | ---- | M] () -- C:\WINDOWS\SBWIN.INI
[2010/02/13 11:17:02 | 000,000,588 | ---- | M] () -- C:\WINDOWS\System32\settingsbkup.sfm
[2010/02/13 11:17:02 | 000,000,588 | ---- | M] () -- C:\WINDOWS\System32\settings.sfm
[2010/02/11 23:29:51 | 000,546,796 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/02/09 22:13:20 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2010/02/09 22:13:19 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2010/02/09 20:29:43 | 000,000,677 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/02/09 20:26:47 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2010/02/09 17:45:39 | 000,029,067 | ---- | M] () -- C:\logfile
[2010/02/07 15:20:56 | 000,166,112 | ---- | M] () -- C:\WINDOWS\hpoins30.dat
[2010/02/07 13:58:35 | 000,000,136 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2010/02/07 13:25:59 | 000,001,817 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2010/02/07 09:50:39 | 000,002,030 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Norton Security Suite.LNK
[2010/02/06 23:18:35 | 000,000,172 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\isolate.ini
[2010/02/06 13:06:22 | 000,124,976 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/02/06 13:06:22 | 000,060,808 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\S32EVNT1.DLL
[2010/02/06 13:06:22 | 000,007,456 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/02/06 13:06:22 | 000,000,806 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/02/06 13:06:04 | 000,310,320 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.sys
[2010/02/06 13:06:04 | 000,217,136 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symtdi.sys
[2010/02/06 13:06:04 | 000,089,904 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symfw.sys
[2010/02/06 13:06:04 | 000,048,688 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symndisv.sys
[2010/02/06 13:06:04 | 000,036,400 | R--- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SymIM.sys
[2010/02/06 13:06:04 | 000,036,400 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symndis.sys
[2010/02/06 13:06:04 | 000,033,072 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\symids.sys
[2010/02/06 13:06:03 | 000,308,272 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.sys
[2010/02/06 13:06:03 | 000,043,696 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.sys
[2010/02/06 13:06:01 | 000,482,432 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\cchpx86.sys
[2010/02/06 13:06:00 | 000,259,632 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.sys
[2010/02/06 13:05:33 | 000,107,368 | R--- | M] (GEAR Software Inc.) -- C:\WINDOWS\System32\GEARAspi.dll
[2010/02/06 13:05:07 | 000,001,562 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymNetV.inf
[2010/02/06 13:05:06 | 000,003,373 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.inf
[2010/02/06 13:05:06 | 000,001,752 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.inf
[2010/02/06 13:05:06 | 000,001,561 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.inf
[2010/02/06 13:05:06 | 000,001,388 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.inf
[2010/02/06 13:05:06 | 000,001,382 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.inf
[2010/02/06 13:05:06 | 000,000,640 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.inf
[2010/02/06 13:04:07 | 000,009,412 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\symnetv.cat
[2010/02/06 13:04:07 | 000,009,402 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.cat
[2010/02/06 13:04:07 | 000,007,431 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.cat
[2010/02/06 13:04:07 | 000,007,429 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.cat
[2010/02/06 13:04:07 | 000,007,425 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.cat
[2010/02/06 13:04:07 | 000,007,400 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.CAT
[2010/02/06 13:04:07 | 000,007,383 | ---- | M] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.cat
[2010/02/06 12:21:33 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/02/06 12:21:33 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/02/06 12:21:32 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/02/06 12:21:32 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/02/06 12:21:30 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deploytk.dll
[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\Documents and Settings\Cindy Peterson\My Documents\*.tmp files -> C:\Documents and Settings\Cindy Peterson\My Documents\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/03/06 10:01:21 | 000,001,355 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2010/03/05 17:49:24 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/03/05 17:49:24 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/03/05 17:49:24 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/03/05 17:49:24 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/03/05 17:49:24 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/03/04 20:30:38 | 000,147,832 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\profiles.exe
[2010/03/04 20:27:19 | 000,000,117 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\help.bat
[2010/03/04 20:25:53 | 000,000,006 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\fix.bat
[2010/03/04 20:24:28 | 000,412,056 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\HelpAsst_mebroot_fix.exe
[2010/03/04 19:59:57 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/03/04 19:59:52 | 000,260,272 | ---- | C] () -- C:\cmldr
[2010/03/04 19:57:11 | 004,120,159 | R--- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\thcbytes.exe
[2010/03/04 19:51:30 | 000,363,008 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\rkill.pif
[2010/02/27 20:52:11 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\defogger_reenable
[2010/02/27 18:27:49 | 000,284,915 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\gmer.zip
[2010/02/27 18:26:19 | 000,524,288 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\dds.scr
[2010/02/27 18:26:06 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\Defogger.exe
[2010/02/27 17:09:03 | 000,000,705 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/27 11:20:28 | 000,001,611 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/02/27 11:03:44 | 000,012,876 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\My Documents\cc_20100227_110341.reg
[2010/02/27 10:58:42 | 000,082,375 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\bookmarksfeb10.html
[2010/02/27 10:56:04 | 000,082,375 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\bookmarks.html
[2010/02/26 19:26:05 | 000,166,858 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\My Documents\cc_20100226_192557.reg
[2010/02/26 19:22:25 | 000,001,557 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\CCleaner.lnk
[2010/02/26 18:56:48 | 000,186,097 | ---- | C] () -- C:\WINDOWS\System32\nvapps.xml
[2010/02/26 18:56:46 | 000,018,070 | ---- | C] () -- C:\WINDOWS\System32\nvdisp.nvu
[2010/02/26 18:15:10 | 000,000,847 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\Shortcut to procexp.lnk
[2010/02/22 13:56:39 | 000,001,833 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
[2010/02/22 13:56:39 | 000,001,749 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 6.0 Professional.lnk
[2010/02/16 10:04:37 | 000,079,872 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\BHS PTSA February 11, 2010 BOard Meeting.doc
[2010/02/15 11:22:45 | 000,001,940 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Desktop\Windows Live Mail.lnk
[2010/02/14 20:42:11 | 000,001,677 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Thunderbird.lnk
[2010/02/13 11:17:39 | 000,014,273 | ---- | C] () -- C:\WINDOWS\System32\CTDEVCTRL.HLP
[2010/02/13 11:17:39 | 000,000,274 | ---- | C] () -- C:\WINDOWS\System32\ctdevctrl.CNT
[2010/02/13 11:17:39 | 000,000,066 | ---- | C] () -- C:\WINDOWS\SBWIN.INI
[2010/02/13 11:17:39 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\CTDevctrl.gid
[2010/02/13 11:17:39 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\CTDevctrl.fts
[2010/02/13 11:17:39 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\CTDevctrl.ftg
[2010/02/13 11:17:02 | 000,000,588 | ---- | C] () -- C:\WINDOWS\System32\settingsbkup.sfm
[2010/02/13 11:17:02 | 000,000,588 | ---- | C] () -- C:\WINDOWS\System32\settings.sfm
[2010/02/13 11:16:21 | 000,002,516 | ---- | C] () -- C:\WINDOWS\System32\P16X.ini
[2010/02/13 11:16:21 | 000,000,026 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
[2010/02/13 11:16:19 | 001,048,576 | ---- | C] () -- C:\WINDOWS\System32\Ct1mgm.rom
[2010/02/13 11:16:19 | 000,002,696 | ---- | C] () -- C:\WINDOWS\MIXDEF.INI
[2010/02/13 11:16:19 | 000,000,059 | ---- | C] () -- C:\WINDOWS\System32\default8.sfm
[2010/02/13 11:16:19 | 000,000,059 | ---- | C] () -- C:\WINDOWS\System32\default4.sfm
[2010/02/13 11:16:19 | 000,000,059 | ---- | C] () -- C:\WINDOWS\System32\Default.sfm
[2010/02/09 20:26:47 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2010/02/07 15:19:39 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Ÿ9Ÿ9
[2010/02/07 13:25:59 | 000,001,817 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2010/02/07 12:53:53 | 000,166,112 | ---- | C] () -- C:\WINDOWS\hpoins30.dat
[2010/02/07 12:53:52 | 000,000,844 | ---- | C] () -- C:\WINDOWS\hpomdl30.dat
[2010/02/07 09:50:42 | 000,720,758 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\Cat.DB
[2010/02/06 23:22:47 | 000,009,412 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\symnetv.cat
[2010/02/06 23:22:47 | 000,001,562 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymNetV.inf
[2010/02/06 23:22:46 | 000,009,402 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.cat
[2010/02/06 23:22:46 | 000,001,561 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymNet.inf
[2010/02/06 23:22:42 | 000,007,431 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.cat
[2010/02/06 23:22:42 | 000,003,373 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\SymEFA.inf
[2010/02/06 23:22:41 | 000,007,429 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.cat
[2010/02/06 23:22:41 | 000,001,388 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtspx.inf
[2010/02/06 23:22:41 | 000,001,382 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.inf
[2010/02/06 23:22:40 | 000,007,425 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\srtsp.cat
[2010/02/06 23:22:39 | 000,007,383 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.cat
[2010/02/06 23:22:39 | 000,001,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\ccHPx86.inf
[2010/02/06 23:22:38 | 000,007,400 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.CAT
[2010/02/06 23:22:38 | 000,000,640 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\BHDrvx86.inf
[2010/02/06 23:18:35 | 000,000,172 | ---- | C] () -- C:\WINDOWS\System32\drivers\N360\0308000.029\isolate.ini
[2010/02/06 13:06:22 | 000,007,456 | ---- | C] () -- C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/02/06 13:06:22 | 000,000,806 | ---- | C] () -- C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/02/06 13:06:07 | 000,002,030 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Norton Security Suite.LNK
[2009/11/15 20:00:47 | 000,013,195 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2009/01/05 15:44:10 | 000,000,453 | ---- | C] () -- C:\WINDOWS\bdoscandellang.ini
[2008/05/16 14:01:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2008/05/16 14:01:00 | 001,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2008/05/16 14:01:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2008/05/16 14:01:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008/05/16 14:01:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2007/12/30 22:33:18 | 000,000,268 | RH-- | C] () -- C:\Documents and Settings\All Users\Application Data\Standard
[2007/12/30 22:33:18 | 000,000,020 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2007/12/30 22:33:18 | 000,000,012 | RH-- | C] () -- C:\Documents and Settings\All Users\Application Data\String Comparison
[2007/01/02 16:23:09 | 000,000,021 | ---- | C] () -- C:\WINDOWS\CS_SETUP.ini
[2006/12/03 15:27:46 | 000,000,051 | ---- | C] () -- C:\WINDOWS\WWWBATCH.INI
[2006/11/14 17:38:02 | 000,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini
[2006/09/05 09:47:20 | 000,000,416 | ---- | C] () -- C:\WINDOWS\hegames.ini
[2006/09/02 12:30:47 | 000,000,050 | ---- | C] () -- C:\WINDOWS\lexstat.ini
[2006/08/06 15:41:31 | 000,002,061 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006/08/04 16:27:06 | 000,000,494 | ---- | C] () -- C:\WINDOWS\dellstat.ini
[2006/08/03 18:31:52 | 000,003,790 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\FASTWiz.html
[2006/08/03 16:55:04 | 000,032,676 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\FASTWiz.log
[2006/08/02 18:36:47 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/08/02 18:13:59 | 000,000,136 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/08/02 16:34:47 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
[2006/08/02 16:20:11 | 000,004,272 | R--- | C] () -- C:\WINDOWS\System32\drivers\bvrp_pci.sys
[2005/12/30 23:54:38 | 000,002,586 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2004/12/04 12:57:35 | 000,000,137 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\fusioncache.dat
[2003/12/14 16:18:04 | 000,047,104 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2003/12/02 18:26:04 | 000,000,478 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Application Data\dm.ini
[2003/11/19 18:39:50 | 000,141,896 | ---- | C] () -- C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\GDIPFONTCACHEV1(1).DAT
[2003/11/19 18:39:49 | 001,581,754 | -H-- | C] () -- C:\Documents and Settings\Cindy Peterson\Local Settings\Application Data\IconCache(1).db
[2003/08/13 22:54:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2003/07/08 12:41:48 | 000,047,616 | ---- | C] () -- C:\WINDOWS\System32\P16X.dll
[2003/01/07 14:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2009/02/24 20:31:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ableton
[2006/08/02 18:16:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BVRP Software
[2007/12/30 22:33:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2008/09/27 13:20:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MailFrontier
[2009/11/28 15:22:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Musicnotes
[2006/08/03 17:02:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Napster
[2007/12/30 22:33:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nikon
[2009/11/22 16:09:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2007/12/30 22:33:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2010/02/09 17:43:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/03/15 23:07:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/07/21 00:24:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Ableton
[2003/10/08 00:30:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Aim
[2006/08/03 17:12:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\alta
[2009/08/02 08:30:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2006/08/03 17:12:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\FotoWire
[2009/08/22 11:45:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\GARMIN
[2006/08/03 17:13:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Leadertech
[2006/08/03 17:12:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Learn2.com
[2006/08/03 17:14:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Musicmatch
[2008/01/20 23:51:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Nikon
[2006/08/03 17:12:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Snapfish
[2010/02/14 20:42:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Thunderbird
[2010/02/13 12:21:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Cindy Peterson\Application Data\Windows Search
[2006/08/03 17:42:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Don Peterson\Application Data\Aim
[2006/08/03 17:42:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Don Peterson\Application Data\FotoWire
[2007/04/07 13:06:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Don Peterson.CINDY-86UR58919\Application Data\acccore
[2006/12/26 14:45:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Don Peterson.CINDY-86UR58919\Application Data\Aim
[2007/11/03 14:10:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Don Peterson.CINDY-86UR58919\Application Data\Nikon
[2006/08/03 17:49:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hayley Peterson\Application Data\acccore
[2006/08/03 17:49:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hayley Peterson\Application Data\Aim
[2006/08/03 17:51:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hayley Peterson\Application Data\IMVU
[2006/08/03 17:52:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hayley Peterson\Application Data\Nikon
[2006/11/18 23:32:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sam\Application Data\Aim
[2007/08/29 13:49:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sam\Application Data\Viewpoint
[2006/08/03 18:18:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sam Peterson\Application Data\Aim

========== Purity Check ==========

========== Custom Scans ==========

< :OTL >

< [8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] >

< [4 C:\Documents and Settings\Cindy Peterson\My Documents\*.tmp files -> C:\Documents and Settings\Cindy Peterson\My Documents\*.tmp -> ] >

< [3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] >

< [2007/08/29 13:49:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sam\Application Data\Viewpoint >
Invalid Switch: 29 13:49:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sam\Application Data\Viewpoint

< [2010/02/09 17:43:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint >
Invalid Switch: 09 17:43:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint

< >

< :Reg >

< [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] >

< "3389:TCP" =- >

< >

< :Commands >

< [resethosts] >

< [emptytemp] >

< [Reboot] >

========== Alternate Data Streams ==========

@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:02C77207

< End of report >

OTL Extras logfile created on: 3/6/2010 10:34:15 AM - Run 2
OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\Cindy Peterson\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 62.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 90.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 1536F:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 15.66 Gb Free Space | 21.01% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 74.46 Gb Total Space | 25.61 Gb Free Space | 34.39% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: CINDY-86UR58919
Current User Name: Cindy Peterson
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_USERS\S-1-5-21-343818398-1647877149-725345543-1004\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"65533:TCP" = 65533:TCP:*:Enabled:Services
"52344:TCP" = 52344:TCP:*:Enabled:Services
"3246:TCP" = 3246:TCP:*:Enabled:Services
"2479:TCP" = 2479:TCP:*:Enabled:Services
"3389:TCP" = 3389:TCP:*:Enabled:Remote Desktop
"427:UDP" = 427:UDP:*:Enabled:SLP_Port(427)
"5202:TCP" = 5202:TCP:*:Enabled:Services
"7709:TCP" = 7709:TCP:*:Enabled:Services
"7382:TCP" = 7382:TCP:*:Enabled:Services
"6209:TCP" = 6209:TCP:*:Enabled:Services

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"65533:TCP" = 65533:TCP:*:Enabled:Services
"52344:TCP" = 52344:TCP:*:Enabled:Services
"3246:TCP" = 3246:TCP:*:Enabled:Services
"2479:TCP" = 2479:TCP:*:Enabled:Services
"427:UDP" = 427:UDP:*:Enabled:SLP_Port(427)
"5202:TCP" = 5202:TCP:*:Enabled:Services
"7709:TCP" = 7709:TCP:*:Enabled:Services
"7382:TCP" = 7382:TCP:*:Enabled:Services
"6209:TCP" = 6209:TCP:*:Enabled:Services

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe -- File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe:*:Enabled:hpqcopy2.exe -- File not found
"E:\setup\HPZnui01.exe" = E:\setup\HPZnui01.exe:*:Enabled:hpznui01.exe -- File not found
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard)
"C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- File not found
"C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe:*:Enabled:hpqgpc01.exe -- File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard)
"C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe -- (Hewlett-Packard Development Co. L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe -- (Hewlett-Packard Development Co. L.P.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01F9D88C-3C86-4E82-840A-101A3221F67A}" = Microsoft Money 2003
"{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
"{02B42D23-10F2-4862-ADA4-3DF1EA0021B2}" = Microsoft Money 2003 System Pack
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{03410014-3975-4267-9F39-1DC4745090B7}" = Microsoft Encarta Encyclopedia Standard 2003
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{12BDDF23-B1DB-49C8-92D3-3E6841CCED61}" = Microsoft Streets and Trips 2002
"{151C555A-A9E7-4A2E-B6D7-165D04A3C956}" = Dell Picture Studio - Dell Image Expert
"{162B71B8-8464-4680-A086-601D555B331D}" = Apple Mobile Device Support
"{1CB92574-96F2-467B-B793-5CEB35C40C29}" = Image Resizer Powertoy for Windows XP
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java™ 6 Update 18
"{2EAF8AB7-2B78-4072-960B-00D412D9BBB4}" = PrintingPress
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{369B36BE-3D64-4641-9AEA-808D436FE132}" = Microsoft Picture It! Photo 7.0
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{43C0C354-A185-4D2D-A057-67C9160460E1}" = PS_AIO_04_C4580_Software_Min
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{47ECCB1F-2811-49C0-B6A7-26778639ABA0}" = 32 Bit HP CIO Components Installer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A3D0CF8-60FF-4CEF-91A4-A1F001424602}" = DocProc
"{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}" = UnloadSupport
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{64116298-93C5-401D-B06C-39D8E3338508}" = DAO
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{68D5CEF9-0DA8-47FE-B0EB-4CBFB5AAF662}" = ArcSoft PhotoImpression 4
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6C117F31-28A8-4477-BE91-64AC0A2204AD}" = Microsoft IntelliPoint 6.01
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{70E1E357-E57C-4284-B04E-58196DC27BC1}" = PanoStandAlone
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7641710F-A4AD-4EAE-889C-4958BE3F169C}" = C4580
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B7917E0-AF55-4E8A-9473-017F0AA03AC8}" = QuickTime
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{91110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{96E16100-A77F-4B31-B9AD-FFBA040EE1BD}" = Sound Blaster Live!
"{9A00D1BA-D03A-44E5-AF28-86A1F377DF61}" = The Sims Makin' Magic
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A6A195F5-BCAB-4F38-8459-DF693303CD8D}" = PS_AIO_04_C4580_ProductContext
"{A7DEBAA4-B211-4D1A-A6B3-E52BFAAA1D0C}" = Garmin Communicator Plugin
"{AA2E8A46-B45E-4aea-8A23-88AB57D04523}" = WebReg
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-1033-0000-7760-000000000001}" = Adobe Acrobat 6.0 Professional
"{AC76BA86-7AD7-1033-7B44-A92000000001}" = Adobe Reader 9.2
"{B1102A25-3AA3-446B-AA0F-A699B07A02FD}" = Garmin USB Drivers
"{BED1705F-7558-40f7-9F52-6C6FBD58EA2E}" = HP Photosmart C4500 All-In-One Driver Software 11.0 Rel .4
"{BF08AB1C-3357-4f20-A200-8EBB8EF27C59}" = BufferChm
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C26B06A9-27BB-45B0-9873-9C623EC2BA38}" = iTunes
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{C89B5E3A-690F-4CEE-909A-BF869E198B0A}" = Scan
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D23E2520-0EAA-4AC3-A47E-A551C70D4FED}" = C4580_Help
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{D4278897-1541-493E-9D39-59CC6AB0FC09}" = PS_AIO_04_C4580_Software
"{D45E8C45-B601-4A80-AFD8-E16338744DE1}" = ArcSoft Panorama Maker 4
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{D75915D3-6CFF-445F-A346-18ED6EF2F618}" = Microsoft IntelliType Pro 6.01
"{D78653C3-A8FF-415F-92E6-D774E634FF2D}" = Dell ResourceCD
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E96B0085-6659-486b-A221-5042A042728D}" = Toolbox
"{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EE7C3A14-1D20-49F6-B903-491561076F0F}" = ArcSoft Software Suite
"{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
"{EF9E56EE-0243-4BAD-88F4-5E7508AA7D96}" = Destination Component
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F45298E5-0083-426F-A668-1A2C5F04B8A0}" = FaxTools
"{F95F178B-56AD-4fab-87F8-FA81E66C7D68}" = Network
"{FF3999BE-1A7B-4738-88AA-97BF14094A4A}" = PictureProject
"45A7283175C62FAC673F913C1F532C5361F97841" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (03/08/2007 2.2.1.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"CCleaner" = CCleaner
"CNXT_MODEM_PCI_VEN_14F1&DEV_2702" = Conexant SmartHSFi V.9x 56K DF PCI Modem
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"ComcastToolbar" = Comcast Toolbar
"ESET Online Scanner" = ESET Online Scanner v3
"HP Imaging Device Functions" = HP Imaging Device Functions 11.0
"HPOCR" = OCR Software by I.R.I.S. 11.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"Mozilla Thunderbird (3.0.1)" = Mozilla Thunderbird (3.0.1)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Musicnotes Combined Installer_is1" = Musicnotes Software Suite 1.2
"N360" = Norton Security Suite
"Network Play System (Patching)" = Network Play System (Patching)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"Picasa2" = Picasa 2
"PROSet" = Intel® PRO Network Adapters and Drivers
"Shockwave" = Shockwave
"SystemRequirementsLab" = System Requirements Lab
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== Last 10 Event Log Errors ==========

[ System Events ]
Error - 2/27/2010 10:11:55 PM | Computer Name = CINDY-86UR58919 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 2/27/2010 10:13:20 PM | Computer Name = CINDY-86UR58919 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 2/27/2010 10:29:11 PM | Computer Name = CINDY-86UR58919 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 2/27/2010 10:30:26 PM | Computer Name = CINDY-86UR58919 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 2/27/2010 10:31:26 PM | Computer Name = CINDY-86UR58919 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 2/28/2010 12:46:34 AM | Computer Name = CINDY-86UR58919 | Source = System Error | ID = 1003
Description = Error code 000000c2, parameter1 00000007, parameter2 00000cd4, parameter3
00000000, parameter4 87fa8230.

Error - 3/3/2010 9:13:46 AM | Computer Name = CINDY-86UR58919 | Source = Windows Update Agent | ID = 16
Description = Unable to Connect: Windows is unable to connect to the automatic updates
service and therefore cannot download and install updates according to the set
schedule. Windows will continue to try to establish a connection.

Error - 3/4/2010 11:39:33 PM | Computer Name = CINDY-86UR58919 | Source = System Error | ID = 1003
Description = Error code 1000000a, parameter1 00000000, parameter2 00000002, parameter3
00000000, parameter4 804fd603.

Error - 3/4/2010 11:56:05 PM | Computer Name = CINDY-86UR58919 | Source = Service Control Manager | ID = 7034
Description = The NVIDIA Display Driver Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 3/5/2010 6:49:37 PM | Computer Name = CINDY-86UR58919 | Source = Ntfs | ID = 262199
Description = The file system structure on the disk is corrupt and unusable. Please
run the chkdsk utility on the volume C:.

< End of report >

User name HelpAssistant
Full Name Remote Desktop Help Assistant Account
Comment Account for Providing Remote Assistance
User's comment
Country code 000 (System Default)
Account active No
Account expires Never

Password last set 2/27/2010 8:57 PM
Password expires Never
Password changeable 2/27/2010 8:57 PM
Password required Yes
User may change password Yes

Workstations allowed All
Logon script
User profile
Home directory
Last logon 2/27/2010 8:57 PM

Logon hours allowed All

Local Group Memberships
Global Group memberships *None
The command completed successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
DefaultUserProfile REG_SZ Default User
AllUsersProfile REG_SZ All Users

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
ProfileImagePath REG_EXPAND_SZ %systemroot%\system32\config\systemprofile

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\LocalService

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\NetworkService

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-343818398-1647877149-725345543-1004
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\Cindy Peterson

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-343818398-1647877149-725345543-1005
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\Don Peterson.CINDY-86UR58919

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-343818398-1647877149-725345543-1006
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\Hayley Peterson.CINDY-86UR58919

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-343818398-1647877149-725345543-1008
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\Sam

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-343818398-1647877149-725345543-500
ProfileImagePath REG_EXPAND_SZ %SystemDrive%\Documents and Settings\Administrator

SystemRoot REG_SZ C:\WINDOWS

#9 BennetLang

Topic Starter

Members
8 posts
OFFLINE

Local time:04:43 PM

Posted 06 March 2010 - 03:03 PM

Just a note to say I've tried most of her programs and no crashes, everything seems to be in really good order. iTunes had to install itself again, but her music all seems to be there. I'm not sure what to look for as far as warning signs that there's still a problem.

Thanks again.

#10 thcbytes

Malware Response Team
14,790 posts
OFFLINE

Gender:Male
Local time:04:43 PM

Posted 07 March 2010 - 07:54 AM

Hi.

We need to re-run the OTL fix. You pressed "Run Scan" but should have pressed "Run Fix". Please do it again...

We need to run an OTL Fix

Please reopen on your desktop.
Copy and Paste the following code into the textbox. Do not include the word "Code"
CODE
:OTL
[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\Documents and Settings\Cindy Peterson\My Documents\*.tmp files -> C:\Documents and Settings\Cindy Peterson\My Documents\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2007/08/29 13:49:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sam\Application Data\Viewpoint
[2010/02/09 17:43:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint

:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"3389:TCP" =-

:Commands
[resethosts]
[emptytemp]
[Reboot]
Push
OTL may ask to reboot the machine. Please do so if asked.
Click .
A report will open. Copy and Paste that report in your next reply.

Thanks,
~ t

Proud member - Unified Network of Instructors and Trained Eliminators
Posted Image

#11 BennetLang

Topic Starter

Members
8 posts
OFFLINE

Local time:04:43 PM

Posted 07 March 2010 - 11:51 AM

Hi,

I'm sorry for messing up that last step. I just ran the OTL fix, here it is below. Everything working well, it had a runtime error and did another chkdsk yesterday, but has come back fine. It happened while I was sorting out some of her picture files into folders.

Thanks again for all your time and help.

All processes killed
========== OTL ==========
C:\WINDOWS\002160_.tmp deleted successfully.
C:\WINDOWS\005296_.tmp deleted successfully.
C:\WINDOWS\DUMP3940.tmp deleted successfully.
C:\WINDOWS\DUMP51c9.tmp deleted successfully.
C:\WINDOWS\DUMP729f.tmp deleted successfully.
C:\WINDOWS\SET3.tmp deleted successfully.
C:\WINDOWS\SET7.tmp deleted successfully.
C:\WINDOWS\SETD.tmp deleted successfully.
C:\Documents and Settings\Cindy Peterson\My Documents\~of65C.tmp deleted successfully.
C:\Documents and Settings\Cindy Peterson\My Documents\~ofD17.tmp deleted successfully.
C:\Documents and Settings\Cindy Peterson\My Documents\~WRL0057.tmp deleted successfully.
C:\Documents and Settings\Cindy Peterson\My Documents\~WRL1183.tmp deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\System32\setb0.tmp deleted successfully.
C:\WINDOWS\System32\setb1.tmp deleted successfully.
C:\Documents and Settings\Sam\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03 folder moved successfully.
C:\Documents and Settings\Sam\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02 folder moved successfully.
C:\Documents and Settings\Sam\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01 folder moved successfully.
C:\Documents and Settings\Sam\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00 folder moved successfully.
C:\Documents and Settings\Sam\Application Data\Viewpoint\Viewpoint Media Player\Resources folder moved successfully.
C:\Documents and Settings\Sam\Application Data\Viewpoint\Viewpoint Media Player folder moved successfully.
C:\Documents and Settings\Sam\Application Data\Viewpoint folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\ViewpointManager\contents folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\ViewpointManager folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\Cache folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\AlertSWF\contents folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\AlertSWF folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9Plus folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\Welcome\BH00 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\Welcome folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\AxMetaStream_Win folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint folder moved successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List\\3389:TCP deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->FireFox cache emptied: 2638497 bytes

User: Administrator.CINDY-86UR58919
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Cindy Peterson
->Temp folder emptied: 233803 bytes
->Temporary Internet Files folder emptied: 19722363 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 63319673 bytes
->Flash cache emptied: 1592518 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Don Peterson
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 65175 bytes
->Flash cache emptied: 348 bytes

User: Don Peterson.CINDY-86UR58919
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 13425511 bytes
->FireFox cache emptied: 32397432 bytes
->Flash cache emptied: 4574 bytes

User: Hayley Peterson
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 1408942 bytes
->Flash cache emptied: 45611 bytes

User: Hayley Peterson.CINDY-86UR58919

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 735314 bytes
->FireFox cache emptied: 42843193 bytes
->Flash cache emptied: 580 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 82054 bytes

User: Owner

User: Sam
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 407265 bytes
->FireFox cache emptied: 66855124 bytes
->Flash cache emptied: 8219 bytes

User: Sam Peterson
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 845437 bytes
->Flash cache emptied: 300 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 68078 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33728 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 235.00 mb

OTL by OldTimer - Version 3.1.34.0 log created on 03072010_084051

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\JET13F0.tmp not found!
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_368.dat not found!

Registry entries deleted on Reboot...

#12 thcbytes

Malware Response Team
14,790 posts
OFFLINE

Gender:Male
Local time:04:43 PM

Posted 07 March 2010 - 01:09 PM

Hello,

Congratulations! You now appear clean!

**********

Please pay particularly close attention to the instructions that follow. To neglect these steps risk needless reinfection!!

**********

Are things running okay? Do you have any more questions?

**********

Uninstall Combofix

Press the Windows Key + R on your keyboard.
Now copy & paste the green bolded text in the run-box and click OK.

ComboFix /Uninstall

<Notice the space between the "x" and "/".>
The following will implement some very important cleanup procedures as well as reset System Restore points.

**********

Please reopen on your desktop.
Copy and Paste the following code into the textbox. Do not include the word "Code"
CODE
:OTL
:Commands
[CLEARALLRESTOREPOINTS]
[resethosts]
[emptytemp]
[Reboot]
Push
OTL may ask to reboot the machine. Please do so if asked.
Click .

**********

Run OTL again

We will now remove the tools we used during this fix using OTL.

Double click the OTL icon to start the program.
Then Click the big button.
You will get a prompt saying "Being Cleanup Process". Please select Yes.
Restart your computer when prompted.

**********

Recommendations

Below are some recommendations to lower your chances of (re)infection.

Install an Anti-Spyware program, and update it regularly
Malwarebytes' Anti-Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates.

SUPERAntiSpyware is another good scanner with high detection and removal rates.
Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions.
Prevention article : To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections please read the Prevention artice by Miekiemoes.
Keep Windows (and your other Microsoft software) up to date!
I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holes will allow an attacker unrestricted access to your computer.

Windows XP

Visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!!
Keep your other software up to date as well. Software does not need to be made by Microsoft to be insecure. Download Secunia Software Inspector to keep all your software up to date.
Consider Firefox as your primary browser. Its safer, fast and secure!
Install WOT. Never inadvertently surf to a dangerous website again.
Consider running your browser Sandboxed with Sandboxie. You decide what actually get's into your OS!!
Install NoScript. Pre-emptively blocks malicious scripts and allows JavaScript, Java and other potentially dangerous content only from sites you trust.
Stay up to date!
The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variants every single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing .

**********

System Slow?
You may wish to try StartupLite. Simply download this tool to your desktop and run it. It will explain any optional auto-start programs on your system, and offer the option to stop these programs from starting at startup. This will result in fewer programs running when you boot your system, and should improve performance.

If that does not work, you can try the steps mentioned in Slow Computer/browser? Check Here First; It May Not Be Malware.

**********

Good luck & safe surfing,
Kind Regards,
~ t

Proud member - Unified Network of Instructors and Trained Eliminators
Posted Image

#13 BennetLang

Topic Starter

Members
8 posts
OFFLINE

Local time:04:43 PM

Posted 07 March 2010 - 02:25 PM

Thank you a thousand times. Even with Norton back on the computer is running like it was new, I called and told her she could come get it and she is so happy. I was going to say you have no idea what it's like to see a computer that a few days ago they were ready to use as a boat anchor now behave as if it's never had a virus. But you probably do know what that's like.

She wishes she knew how she got it, but with her old McAfee out of date there were lots of updating problems. I've uninstalled combofix and run the OTL clean up and restarted. Windows updates have always been on but we'll run the others now and then to double check.

Thank you too for the list of suggestions, it's hard to know who to trust.

Take care.

#14 thcbytes

Malware Response Team
14,790 posts
OFFLINE

Gender:Male
Local time:04:43 PM

Posted 07 March 2010 - 05:47 PM

Your very welcome. I enjoyed assisting you.

Since this topic appears to be resolved, I will now close it.
If you need this topic re-opened please send me a PM.

Everyone else, please start a new topic.

Proud member - Unified Network of Instructors and Trained Eliminators
Posted Image