Computer doing much better but then again I am only using it for the most minimal of functions until this is completed. I have yet to be redirected and can now turn it off again, but I continue to receive blue screen restarts. Sorry so late with the scan, it has been a long one today and image verification seems to be using a keyboard from another country. Thanks again for all your help in this.
--------
OTL logfile created on: 3/14/2011 10:23:16 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\USER\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 85.00% Memory free
7.00 Gb Paging File | 6.00 Gb Available in Paging File | 95.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 102.18 Gb Free Space | 68.56% Space Free | Partition Type: NTFS
Computer Name: removed | User Name: removed | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2011/03/14 22:22:12 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\USER\Desktop\OTL.exe
PRC - [2011/01/10 14:23:41 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011/01/10 14:23:30 | 000,267,944 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/01/10 14:23:29 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010/01/14 21:11:00 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2008/04/13 20:12:33 | 000,013,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\savedump.exe
PRC - [2008/04/13 20:12:22 | 000,015,360 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\inetsrv\inetinfo.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
========== Modules (SafeList) ==========
MOD - [2011/03/14 22:22:12 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\USER\Desktop\OTL.exe
MOD - [2010/08/23 12:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Disabled | Stopped] -- -- (NMIndexingService)
SRV - [2011/01/10 14:23:41 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/01/10 14:23:30 | 000,267,944 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/01/05 21:56:01 | 003,129,432 | ---- | M] () [Auto | Running] -- c:\Program Files\Common Files\Akamai\netsession_win_dbc0250.dll -- (Akamai)
SRV - [2010/09/01 16:52:56 | 000,066,112 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper_3004.dll -- (nosGetPlusHelper) getPlus(R)
SRV - [2010/03/29 08:53:22 | 000,068,000 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2009/10/07 01:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2009/09/29 10:17:50 | 000,013,088 | ---- | M] (Intuit Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)
SRV - [2009/09/06 13:38:06 | 000,071,096 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)
SRV - [2008/08/25 09:02:58 | 000,076,800 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\VentSrv\ventrilo_svc.exe -- (Ventrilo)
SRV - [2008/04/13 20:12:22 | 000,015,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (W3SVC)
SRV - [2008/04/13 20:12:22 | 000,015,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (SMTPSVC) Simple Mail Transfer Protocol (SMTP)
SRV - [2008/04/13 20:12:22 | 000,015,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (MSFtpsvc)
SRV - [2008/04/13 20:12:22 | 000,015,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (IISADMIN)
SRV - [2008/03/19 13:30:46 | 002,558,464 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Disabled | Stopped] -- C:\windows\System32\hasplms.exe -- (hasplms)
SRV - [2007/12/16 23:00:00 | 000,143,872 | ---- | M] (SEIKO EPSON CORPORATION) [Disabled | Stopped] -- C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE -- (EPSON_EB_RPCV4_01) EPSON V5 Service4(01)
SRV - [2007/09/04 20:25:44 | 000,131,072 | ---- | M] (NVIDIA) [Disabled | Stopped] -- C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe -- (nTuneService)
SRV - [2007/01/10 23:02:00 | 000,113,664 | ---- | M] (SEIKO EPSON CORPORATION) [Disabled | Stopped] -- C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE -- (EPSON_PM_RPCV4_01) EPSON V3 Service4(01)
SRV - [2006/12/02 07:17:54 | 002,805,000 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe -- (msvsmon80)
SRV - [2006/04/21 21:06:14 | 000,069,632 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\Microsoft Private Folder 1.0\PrfldSvc.exe -- (prfldsvc)
========== Driver Services (SafeList) ==========
DRV - [2011/01/10 14:23:53 | 000,135,096 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/01/10 14:23:53 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/07/31 13:08:55 | 000,016,512 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\gdrv.sys -- (gdrv)
DRV - [2010/06/17 14:27:22 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010/06/17 14:27:12 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2010/02/17 10:25:50 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2010/02/17 10:15:58 | 000,066,632 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/02/17 10:15:58 | 000,012,872 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)
DRV - [2010/02/11 08:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
DRV - [2009/11/30 13:27:34 | 000,100,048 | ---- | M] (Sun Microsystems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV - [2009/11/13 19:00:10 | 000,047,616 | ---- | M] (Aladdin Knowledge Systems) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Haspnt.sys -- (Haspnt)
DRV - [2009/10/07 01:46:36 | 000,025,752 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2009/09/28 21:57:28 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\windows\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2009/04/30 22:55:58 | 002,687,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2008/10/23 22:39:00 | 000,031,824 | ---- | M] (Sun Microsystems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VBoxUSB.sys -- (VBoxUSB)
DRV - [2008/05/22 06:34:10 | 000,082,432 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PciPPorts.sys -- (PciPPorts)
DRV - [2008/05/22 06:32:14 | 000,119,808 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PciSPorts.sys -- (PciSPorts)
DRV - [2008/04/13 14:56:06 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2008/03/18 16:09:16 | 000,350,720 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\aksfridge.sys -- (aksfridge)
DRV - [2008/02/11 16:55:04 | 000,586,240 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (Hardlock)
DRV - [2007/09/04 20:26:32 | 000,029,696 | ---- | M] (NVidia Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\nvoclock.sys -- (NVR0Dev)
DRV - [2007/08/28 04:55:10 | 004,609,024 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007/07/27 08:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)
DRV - [2007/07/27 08:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)
DRV - [2007/05/31 03:19:22 | 000,096,896 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2007/04/16 17:46:34 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM)
DRV - [2006/04/21 08:22:24 | 000,070,912 | ---- | M] (Windows (R) 2000 DDK provider) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\prvflder.sys -- (Prvflder)
DRV - [2003/12/17 09:50:00 | 000,070,801 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFlt2.Sys -- (LMouFlt2)
DRV - [2003/12/17 09:50:00 | 000,051,729 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\L8042PR2.SYS -- (L8042PR2)
DRV - [2003/12/17 09:50:00 | 000,037,887 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidUsb.sys -- (LHidUsb)
DRV - [2003/12/17 09:50:00 | 000,025,505 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFlt2.Sys -- (LHidFlt2)
DRV - [2003/12/17 09:50:00 | 000,014,095 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LCcfltr.sys -- (LCcfltr)
DRV - [2002/08/14 16:03:36 | 000,017,005 | ---- | M] (Adaptec) [Kernel | Auto | Running] -- C:\windows\System32\drivers\ASPI32.SYS -- (Aspi32)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://www.msn.com/
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore =
http://www.bing.com/?pc=Z007&form=ZGAPHP
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore =
http://www.bing.com/?pc=Z007&form=ZGAPHP
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1229272821-884357618-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-1229272821-884357618-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/18 19:25:16 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/10/29 06:44:57 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/02/11 15:46:52 | 000,000,000 | ---D | M]
[2009/10/03 21:23:07 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\USER\Application Data\Mozilla\Extensions
[2009/06/27 13:52:32 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\USER\Application Data\Mozilla\Extensions\mozswing@mozswing.org
[2011/03/06 21:22:12 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\USER\Application Data\Mozilla\Firefox\Profiles\tsah6skg.default\extensions
[2009/09/07 10:48:27 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\USER\Application Data\Mozilla\Firefox\Profiles\tsah6skg.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/10/03 21:24:28 | 000,000,000 | ---D | M] (Aero Fox) -- C:\Documents and Settings\USER\Application Data\Mozilla\Firefox\Profiles\tsah6skg.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}
[2010/04/24 19:26:05 | 000,000,000 | ---D | M] (XfireXO Toolbar) -- C:\Documents and Settings\USER\Application Data\Mozilla\Firefox\Profiles\tsah6skg.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}
[2009/12/13 13:24:15 | 000,000,000 | ---D | M] (PitchDark) -- C:\Documents and Settings\USER\Application Data\Mozilla\Firefox\Profiles\tsah6skg.default\extensions\{c1dffba0-628e-11d9-9669-0800200c9a66}
[2009/06/27 19:11:23 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\USER\Application Data\Mozilla\Firefox\Profiles\tsah6skg.default\extensions\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}
[2009/12/13 13:24:17 | 000,000,000 | ---D | M] (United States English Dictionary) -- C:\Documents and Settings\USER\Application Data\Mozilla\Firefox\Profiles\tsah6skg.default\extensions\en-US@dictionaries.addons.mozilla.org
[2008/02/24 22:15:01 | 000,000,000 | ---D | M] (Opaque + ClearTabs) -- C:\Documents and Settings\USER\Application Data\Mozilla\Firefox\Profiles\tsah6skg.default\extensions\ffe_opaque_clrtabs@game-point.net
[2009/12/13 13:24:17 | 000,000,000 | ---D | M] (RedShift V3) -- C:\Documents and Settings\USER\Application Data\Mozilla\Firefox\Profiles\tsah6skg.default\extensions\redshift_V2@shift-themes.com
[2010/11/27 22:29:04 | 000,000,000 | ---D | M] (Search Toolbar) -- C:\Documents and Settings\USER\Application Data\Mozilla\Firefox\Profiles\tsah6skg.default\extensions\searchtoolbar@zugo.com
[2010/10/31 14:26:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/07/18 12:08:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\talkback@mozilla.org
[2011/03/13 16:01:26 | 000,001,919 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing-zugo.xml
O1 HOSTS File: ([2011/03/14 01:44:47 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {28AED1AF-B164-44CD-B435-CF04AA955015} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - No CLSID value found.
O2 - BHO: (no name) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - No CLSID value found.
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers Client\YontooIEClient.dll (Yontoo Technology, Inc.)
O3 - HKU\S-1-5-21-1229272821-884357618-725345543-1003\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1229272821-884357618-725345543-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1229272821-884357618-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1229272821-884357618-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKU\S-1-5-21-1229272821-884357618-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1229272821-884357618-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}
http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8}
http://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000}
http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Reg Error: Key error.)
O16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967}
http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab (DLM Control)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166}
http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6886.cab (Windows Live Safety Center Base Module)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616}
http://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C}
http://www.facebook.com/controls/contactx.dll (ContactExtractor Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3}
http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1203109022828 (MUWebControl Class)
O16 - DPF: {86A88967-7A20-11D2-8EDA-00600818EDB1}
http://www.parallelgraphics.com/l2/bin/cortvrml.cab (ParallelGraphics Cortona Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {AF14429C-D85A-40F3-AE1C-ADC75429A472}
http://www.groupworld.net/groupworld_no3d.cab (Cgroupworld_control Object)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072}
http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7}
http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {FC686D83-E465-46AE-A315-7D1BD14F8163}
http://www.groupboard.com/groupconf/groupconf.cab (Cgroupconf_control Object)
O16 - DPF: CabBuilder Reg Error: Value error. (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop Components:0 () - file:///C:/DOCUME~1/USER/LOCALS~1/Temp/msohtmlclip1/01/clip_image002.jpg
O24 - Desktop Components:2 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\USER\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\USER\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/02/14 12:29:17 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: WmdmPmSp - File not found
Drivers32: msacm.ac3filter - C:\windows\System32\ac3filter.acm ()
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\windows\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\windows\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\windows\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\windows\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\windows\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\windows\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.XFR1 - C:\windows\System32\xfcodec.dll ()
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)
========== Files/Folders - Created Within 30 Days ==========
[2011/03/14 22:22:07 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\USER\Desktop\OTL.exe
[2011/03/14 01:59:08 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\USER\Recent
[2011/03/14 01:36:22 | 000,031,232 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe
[2011/03/13 23:49:13 | 000,212,480 | ---- | C] (SteelWerX) -- C:\windows\SWXCACLS.exe
[2011/03/13 23:49:13 | 000,161,792 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe
[2011/03/13 23:49:13 | 000,136,704 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe
[2011/03/13 23:49:05 | 000,000,000 | ---D | C] -- C:\windows\ERDNT
[2011/03/13 22:52:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\USER\Desktop\tdsskiller
[2011/03/13 13:39:48 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\USER\Desktop\TFC.exe
[2011/03/13 13:37:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\USER\Application Data\Avira
[2011/03/13 13:28:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Avira
[2011/03/13 13:28:43 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\ssmdrv.sys
[2011/03/13 13:28:41 | 000,135,096 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avipbb.sys
[2011/03/13 13:28:41 | 000,061,960 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avgntflt.sys
[2011/03/13 13:28:41 | 000,045,416 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avgntdd.sys
[2011/03/13 13:28:41 | 000,022,360 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avgntmgr.sys
[2011/03/13 13:28:40 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2011/03/13 13:28:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Avira
[2011/03/13 13:12:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2011/03/13 09:48:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2011/03/13 06:14:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Mozilla
[2011/03/13 02:40:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/03/13 02:14:04 | 000,000,000 | ---D | C] -- C:\Program Files\Yontoo Layers Client
[2011/03/12 22:17:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/03/12 22:17:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/03/01 23:13:13 | 000,000,000 | ---D | C] -- C:\Program Files\InterActual
========== Files - Modified Within 30 Days ==========
[2011/03/14 22:22:12 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\USER\Desktop\OTL.exe
[2011/03/14 22:21:08 | 000,000,552 | ---- | M] () -- C:\windows\zipgenius.xml
[2011/03/14 22:21:07 | 000,013,646 | ---- | M] () -- C:\windows\System32\wpa.dbl
[2011/03/14 22:20:02 | 000,000,292 | ---- | M] () -- C:\windows\tasks\RealUpgradeLogonTaskS-1-5-21-1229272821-884357618-725345543-1003.job
[2011/03/14 22:19:58 | 000,002,048 | --S- | M] () -- C:\windows\bootstat.dat
[2011/03/14 01:52:02 | 000,002,533 | ---- | M] () -- C:\Documents and Settings\USER\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2007 (2).lnk
[2011/03/14 01:44:47 | 000,000,027 | ---- | M] () -- C:\windows\System32\drivers\etc\hosts
[2011/03/13 23:44:42 | 004,286,145 | R--- | M] () -- C:\Documents and Settings\USER\Desktop\ComboFix.exe
[2011/03/13 23:43:51 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\USER\Desktop\MBRCheck.exe
[2011/03/13 22:52:01 | 000,000,235 | ---- | M] () -- C:\Documents and Settings\USER\Application Data\mainhst.zgh
[2011/03/13 22:20:14 | 001,263,721 | ---- | M] () -- C:\Documents and Settings\USER\Desktop\tdsskiller.zip
[2011/03/13 16:21:08 | 000,625,664 | ---- | M] () -- C:\Documents and Settings\USER\Desktop\dds.scr
[2011/03/13 16:04:26 | 000,001,324 | ---- | M] () -- C:\windows\System32\d3d9caps.dat
[2011/03/13 15:59:54 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\USER\Desktop\poi9f4sn.exe
[2011/03/13 13:39:52 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\USER\Desktop\TFC.exe
[2011/03/13 13:28:55 | 000,001,714 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Avira AntiVir Control Center.lnk
[2011/03/13 09:42:33 | 000,683,744 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2011/03/13 09:42:33 | 000,158,092 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2011/03/13 08:54:00 | 000,000,027 | -HS- | M] () -- C:\boot.ini
[2011/03/12 22:59:48 | 000,002,052 | ---- | M] () -- C:\windows\epplauncher.mif
[2011/03/12 22:47:28 | 000,054,156 | -H-- | M] () -- C:\windows\QTFont.qfn
[2011/03/10 15:03:08 | 000,000,300 | ---- | M] () -- C:\windows\tasks\RealUpgradeScheduledTaskS-1-5-21-1229272821-884357618-725345543-1003.job
[2011/03/09 04:03:06 | 000,001,355 | ---- | M] () -- C:\windows\imsins.BAK
[2011/03/06 21:03:02 | 001,006,747 | ---- | M] () -- C:\Documents and Settings\USER\Desktop\rkill.com
[2011/03/01 23:15:24 | 000,000,000 | ---- | M] () -- C:\windows\iPlayer.INI
[2011/02/19 12:04:24 | 000,015,592 | -HS- | M] () -- C:\Documents and Settings\USER\Local Settings\Application Data\m8vi0xb7s6a7oayasu67dcm6rw3l2ey1ta275
[2011/02/19 12:04:24 | 000,015,592 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\m8vi0xb7s6a7oayasu67dcm6rw3l2ey1ta275
========== Files Created - No Company Name ==========
[2011/03/13 23:49:13 | 000,256,512 | ---- | C] () -- C:\windows\PEV.exe
[2011/03/13 23:49:13 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe
[2011/03/13 23:49:13 | 000,089,088 | ---- | C] () -- C:\windows\MBR.exe
[2011/03/13 23:49:13 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe
[2011/03/13 23:49:13 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe
[2011/03/13 23:44:43 | 004,286,145 | R--- | C] () -- C:\Documents and Settings\USER\Desktop\ComboFix.exe
[2011/03/13 23:43:51 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\USER\Desktop\MBRCheck.exe
[2011/03/13 22:20:09 | 001,263,721 | ---- | C] () -- C:\Documents and Settings\USER\Desktop\tdsskiller.zip
[2011/03/13 16:21:06 | 000,625,664 | ---- | C] () -- C:\Documents and Settings\USER\Desktop\dds.scr
[2011/03/13 15:59:52 | 000,296,448 | ---- | C] () -- C:\Documents and Settings\USER\Desktop\poi9f4sn.exe
[2011/03/13 13:28:55 | 000,001,714 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Avira AntiVir Control Center.lnk
[2011/03/12 22:59:48 | 000,002,052 | ---- | C] () -- C:\windows\epplauncher.mif
[2011/03/10 14:55:29 | 000,000,300 | ---- | C] () -- C:\windows\tasks\RealUpgradeScheduledTaskS-1-5-21-1229272821-884357618-725345543-1003.job
[2011/03/10 14:55:29 | 000,000,292 | ---- | C] () -- C:\windows\tasks\RealUpgradeLogonTaskS-1-5-21-1229272821-884357618-725345543-1003.job
[2011/03/06 21:08:43 | 000,001,324 | ---- | C] () -- C:\windows\System32\d3d9caps.dat
[2011/03/06 21:02:58 | 001,006,747 | ---- | C] () -- C:\Documents and Settings\USER\Desktop\rkill.com
[2011/03/01 23:15:24 | 000,000,000 | ---- | C] () -- C:\windows\iPlayer.INI
[2011/02/19 02:29:28 | 000,015,592 | -HS- | C] () -- C:\Documents and Settings\USER\Local Settings\Application Data\m8vi0xb7s6a7oayasu67dcm6rw3l2ey1ta275
[2011/02/19 02:29:28 | 000,015,592 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\m8vi0xb7s6a7oayasu67dcm6rw3l2ey1ta275
[2010/12/19 05:05:27 | 000,000,118 | ---- | C] () -- C:\windows\System32\MRT.INI
[2010/11/02 00:35:28 | 001,075,336 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/08/26 17:28:14 | 000,000,235 | ---- | C] () -- C:\Documents and Settings\USER\Application Data\mainhst.zgh
[2010/07/31 12:47:35 | 000,049,152 | R--- | C] () -- C:\windows\System32\ChCfg.exe
[2010/07/22 12:31:10 | 000,000,262 | ---- | C] () -- C:\windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2010/07/09 15:04:40 | 000,041,872 | ---- | C] () -- C:\windows\System32\xfcodec.dll
[2010/06/13 13:53:54 | 000,000,056 | -H-- | C] () -- C:\windows\System32\ezsidmv.dat
[2010/02/19 23:13:23 | 000,000,000 | ---- | C] () -- C:\windows\EEventManager.INI
[2010/02/15 22:04:02 | 000,073,220 | ---- | C] () -- C:\windows\System32\EPPICPrinterDB.dat
[2010/02/15 22:04:02 | 000,031,053 | ---- | C] () -- C:\windows\System32\EPPICPattern131.dat
[2010/02/15 22:04:02 | 000,029,114 | ---- | C] () -- C:\windows\System32\EPPICPattern1.dat
[2010/02/15 22:04:02 | 000,027,417 | ---- | C] () -- C:\windows\System32\EPPICPattern121.dat
[2010/02/15 22:04:02 | 000,021,021 | ---- | C] () -- C:\windows\System32\EPPICPattern3.dat
[2010/02/15 22:04:02 | 000,015,670 | ---- | C] () -- C:\windows\System32\EPPICPattern5.dat
[2010/02/15 22:04:02 | 000,013,280 | ---- | C] () -- C:\windows\System32\EPPICPattern2.dat
[2010/02/15 22:04:02 | 000,010,673 | ---- | C] () -- C:\windows\System32\EPPICPattern4.dat
[2010/02/15 22:04:02 | 000,004,943 | ---- | C] () -- C:\windows\System32\EPPICPattern6.dat
[2010/02/15 22:04:02 | 000,001,140 | ---- | C] () -- C:\windows\System32\EPPICPresetData_PT.dat
[2010/02/15 22:04:02 | 000,001,140 | ---- | C] () -- C:\windows\System32\EPPICPresetData_BP.dat
[2010/02/15 22:04:02 | 000,001,137 | ---- | C] () -- C:\windows\System32\EPPICPresetData_ES.dat
[2010/02/15 22:04:02 | 000,001,130 | ---- | C] () -- C:\windows\System32\EPPICPresetData_FR.dat
[2010/02/15 22:04:02 | 000,001,130 | ---- | C] () -- C:\windows\System32\EPPICPresetData_CF.dat
[2010/02/15 22:04:02 | 000,001,104 | ---- | C] () -- C:\windows\System32\EPPICPresetData_EN.dat
[2010/02/15 22:04:02 | 000,000,097 | ---- | C] () -- C:\windows\System32\PICSDK.ini
[2010/02/15 22:00:14 | 000,000,060 | ---- | C] () -- C:\windows\EPART810.ini
[2010/02/07 11:11:21 | 000,021,791 | ---- | C] () -- C:\windows\System32\smtpctrs.ini
[2010/02/07 11:11:21 | 000,001,037 | ---- | C] () -- C:\windows\System32\ntfsdrct.ini
[2010/02/07 11:11:06 | 000,007,909 | ---- | C] () -- C:\windows\System32\ftpctrs.ini
[2010/02/07 11:10:56 | 000,038,576 | ---- | C] () -- C:\windows\System32\w3ctrs.ini
[2010/02/07 11:10:56 | 000,010,225 | ---- | C] () -- C:\windows\System32\axperf.ini
[2010/02/07 11:10:53 | 000,011,435 | ---- | C] () -- C:\windows\System32\infoctrs.ini
[2010/02/04 14:19:29 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\USER\Local Settings\Application Data\fusioncache.dat
[2010/01/22 00:45:01 | 000,000,232 | ---- | C] () -- C:\windows\reimage.ini
[2009/12/25 20:32:50 | 000,004,096 | -H-- | C] () -- C:\Documents and Settings\USER\Local Settings\Application Data\keyfile3.drm
[2009/11/13 19:00:10 | 000,000,383 | ---- | C] () -- C:\windows\System32\haspdos.sys
[2009/11/11 19:19:58 | 000,007,168 | ---- | C] () -- C:\windows\System32\drivers\StarOpen.sys
[2009/10/07 01:46:36 | 000,025,752 | ---- | C] () -- C:\windows\System32\drivers\LVPr2Mon.sys
[2009/10/07 01:23:08 | 000,013,584 | ---- | C] () -- C:\windows\System32\drivers\iKeyLFT2.dll
[2009/09/23 20:10:12 | 000,339,968 | ---- | C] () -- C:\windows\System32\pythoncom25.dll
[2009/09/23 20:10:12 | 000,114,688 | ---- | C] () -- C:\windows\System32\pywintypes25.dll
[2009/09/04 04:38:00 | 000,020,594 | ---- | C] () -- C:\windows\System32\DELS3L3.DLL
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\windows\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | ---- | C] () -- C:\windows\System32\OGAEXEC.exe
[2009/04/30 22:39:36 | 000,082,289 | ---- | C] () -- C:\windows\System32\lvcoinst.ini
[2009/01/25 19:16:51 | 000,091,520 | ---- | C] () -- C:\windows\System32\WebIQEngineSetup.exe
[2009/01/05 20:25:20 | 000,000,482 | ---- | C] () -- C:\windows\eReg.dat
[2008/09/09 10:09:30 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\USER\Local Settings\Application Data\PUTTY.RND
[2008/08/07 03:38:36 | 000,073,728 | ---- | C] () -- C:\windows\System32\RtNicProp32.dll
[2008/07/30 16:02:05 | 000,000,086 | ---- | C] () -- C:\windows\wininit.ini
[2008/05/26 21:59:42 | 000,018,904 | ---- | C] () -- C:\windows\System32\structuredqueryschematrivial.bin
[2008/05/26 21:59:40 | 000,106,605 | ---- | C] () -- C:\windows\System32\structuredqueryschema.bin
[2008/05/22 19:38:09 | 000,000,043 | ---- | C] () -- C:\windows\gswin32.ini
[2008/05/22 14:04:10 | 000,082,432 | R--- | C] () -- C:\windows\System32\drivers\PciPPorts.sys
[2008/05/22 14:02:14 | 000,119,808 | R--- | C] () -- C:\windows\System32\drivers\PciSPorts.sys
[2008/05/13 19:48:48 | 000,000,259 | ---- | C] () -- C:\windows\lexstat.ini
[2008/05/05 02:15:01 | 000,000,151 | ---- | C] () -- C:\windows\cdplayer.ini
[2008/04/22 01:13:00 | 000,118,784 | ---- | C] () -- C:\windows\GREUninstall.exe
[2008/04/22 01:12:58 | 000,008,618 | ---- | C] () -- C:\windows\mozver.dat
[2008/04/14 22:40:26 | 000,056,312 | -H-- | C] () -- C:\windows\System32\mlfcache.dat
[2008/03/31 01:39:08 | 000,070,656 | ---- | C] () -- C:\Documents and Settings\USER\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/03/10 23:04:02 | 000,000,151 | ---- | C] () -- C:\windows\PhotoSnapViewer.INI
[2008/02/15 20:00:58 | 000,000,335 | ---- | C] () -- C:\windows\nsreg.dat
[2008/02/15 16:56:08 | 000,000,520 | ---- | C] () -- C:\windows\ODBC.INI
[2008/02/15 10:54:24 | 000,003,972 | ---- | C] () -- C:\windows\System32\drivers\PciBus.sys
[2008/02/15 10:27:22 | 000,000,116 | ---- | C] () -- C:\windows\NeroDigital.ini
[2008/02/14 12:42:14 | 000,000,552 | ---- | C] () -- C:\windows\System32\d3d8caps.dat
[2008/02/14 12:31:14 | 000,002,048 | --S- | C] () -- C:\windows\bootstat.dat
[2008/02/14 12:26:55 | 000,021,640 | ---- | C] () -- C:\windows\System32\emptyregdb.dat
[2008/02/14 07:10:49 | 000,004,161 | ---- | C] () -- C:\windows\ODBCINST.INI
[2008/02/14 07:09:51 | 002,169,328 | ---- | C] () -- C:\windows\System32\FNTCACHE.DAT
[2007/12/05 02:41:00 | 001,724,416 | ---- | C] () -- C:\windows\System32\nvwdmcpl.dll
[2007/12/05 02:41:00 | 001,657,376 | ---- | C] () -- C:\windows\System32\nwiz.exe
[2007/12/05 02:41:00 | 001,503,232 | ---- | C] () -- C:\windows\System32\nview.dll
[2007/12/05 02:41:00 | 001,346,080 | ---- | C] () -- C:\windows\System32\nvdspsch.exe
[2007/12/05 02:41:00 | 001,101,824 | ---- | C] () -- C:\windows\System32\nvwimg.dll
[2007/12/05 02:41:00 | 000,466,944 | ---- | C] () -- C:\windows\System32\nvshell.dll
[2007/12/05 02:41:00 | 000,449,056 | ---- | C] () -- C:\windows\System32\nvappbar.exe
[2007/12/05 02:41:00 | 000,436,768 | ---- | C] () -- C:\windows\System32\keystone.exe
[2007/12/05 02:41:00 | 000,286,720 | ---- | C] () -- C:\windows\System32\nvnt4cpl.dll
[2007/09/27 10:51:02 | 000,020,698 | ---- | C] () -- C:\windows\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | ---- | C] () -- C:\windows\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | ---- | C] () -- C:\windows\System32\gthrctr.ini
[2007/07/27 08:00:00 | 013,107,200 | ---- | C] () -- C:\windows\System32\oembios.bin
[2007/07/27 08:00:00 | 000,683,744 | ---- | C] () -- C:\windows\System32\perfh009.dat
[2007/07/27 08:00:00 | 000,673,088 | ---- | C] () -- C:\windows\System32\mlang.dat
[2007/07/27 08:00:00 | 000,272,128 | ---- | C] () -- C:\windows\System32\perfi009.dat
[2007/07/27 08:00:00 | 000,218,003 | ---- | C] () -- C:\windows\System32\dssec.dat
[2007/07/27 08:00:00 | 000,158,092 | ---- | C] () -- C:\windows\System32\perfc009.dat
[2007/07/27 08:00:00 | 000,046,258 | ---- | C] () -- C:\windows\System32\mib.bin
[2007/07/27 08:00:00 | 000,028,626 | ---- | C] () -- C:\windows\System32\perfd009.dat
[2007/07/27 08:00:00 | 000,004,569 | ---- | C] () -- C:\windows\System32\secupd.dat
[2007/07/27 08:00:00 | 000,004,461 | ---- | C] () -- C:\windows\System32\oembios.dat
[2007/07/27 08:00:00 | 000,001,804 | ---- | C] () -- C:\windows\System32\dcache.bin
[2007/07/27 08:00:00 | 000,000,741 | ---- | C] () -- C:\windows\System32\noise.dat
[2007/03/12 13:01:30 | 000,217,088 | ---- | C] () -- C:\windows\NVGfxOgl.dll
[2002/03/19 17:30:00 | 000,216,576 | ---- | C] () -- C:\windows\System32\PowerCalc.exe
[2002/02/27 18:50:00 | 000,197,120 | ---- | C] () -- C:\windows\System32\patchw32.dll
[2002/02/27 10:41:28 | 000,024,576 | ---- | C] () -- C:\windows\System32\nsldappr32v50.dll
[2002/02/27 10:41:26 | 000,139,264 | ---- | C] () -- C:\windows\System32\nsldap32v50.dll
[2002/02/27 10:41:26 | 000,040,960 | ---- | C] () -- C:\windows\System32\nsldapssl32v50.dll
[2000/02/16 01:00:00 | 000,016,384 | ---- | C] () -- C:\windows\System32\UniClear.exe
[1996/04/03 15:33:26 | 000,005,248 | ---- | C] () -- C:\windows\System32\giveio.sys
========== LOP Check ==========
[2010/01/30 18:50:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Avanquest
[2010/01/31 12:08:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Azureus
[2010/11/27 22:29:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\boost_interprocess
[2009/11/11 19:20:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Canneverbe Limited
[2009/11/20 23:16:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DriverScanner
[2010/02/15 22:08:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EPSON
[2010/01/31 12:08:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\espionServerData
[2008/02/14 12:57:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Grisoft
[2008/09/06 14:00:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LightScribe
[2010/01/31 12:11:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2008/08/27 01:57:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2008/03/11 23:49:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Office-Kit.com
[2010/01/31 12:11:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PCPitstop
[2011/01/01 20:49:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PMB Files
[2008/07/03 13:33:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PreEmptive Solutions
[2010/02/28 19:55:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RegCure
[2010/03/27 19:28:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2009/09/06 20:18:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2008/11/20 16:55:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Vonage
[2009/03/14 10:48:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Winferno
[2010/02/14 11:54:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Zeon
[2009/12/15 20:03:38 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{C4C0E335-EDDF-46A0-A57D-F3802AE44275}
[2009/09/23 20:10:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\agi
[2010/02/06 16:17:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\Avanquest
[2010/02/06 16:48:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\Azureus
[2009/11/11 19:20:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\Canneverbe_Limited
[2008/10/26 12:23:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/10/18 12:54:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\Convivea
[2008/05/09 11:57:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\CoreFTP
[2008/08/27 01:37:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\DeepBurner
[2008/05/21 23:37:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\Design Science
[2010/02/17 22:05:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\Epson
[2008/11/10 14:19:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\ESET
[2008/08/27 01:48:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\FinalBurner Video DVD
[2010/10/17 09:59:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\FOG Downloader
[2008/05/28 04:29:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\Groupworld
[2010/05/06 00:06:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\gtk-2.0
[2008/04/05 21:54:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\HAPedit
[2008/06/17 10:36:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\ICAClient
[2008/03/03 16:30:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\ieSpell
[2008/02/16 19:38:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\ImgBurn
[2009/05/05 20:15:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\InfraRecorder
[2010/03/07 14:31:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\Inkscape
[2010/03/25 22:27:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\KompoZer
[2010/07/02 20:28:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\Leadertech
[2008/04/11 01:39:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\Netscape
[2008/03/11 23:49:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\Office-Kit.com
[2008/02/26 21:34:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\Opera
[2008/10/02 12:22:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\scriptocean
[2010/03/01 22:26:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\System Tweaker
[2008/10/17 16:22:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\Thinking Minds Budiling Bytes
[2011/01/14 16:36:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\TS3Client
[2010/03/01 22:03:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\Uniblue
[2010/10/18 13:28:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\uTorrent
[2008/09/03 02:48:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\Windows Desktop Search
[2008/09/03 18:14:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\Windows Search
[2010/02/14 11:54:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\Zeon
[2010/02/23 00:30:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\USER\Application Data\ZipGenius
========== Purity Check ==========