Solved New to this

Status
Not open for further replies.

LittleBigNDN

Posts: 46   +0
Hello im a little new this and i was wondering if someone could tell me if antimalware also removes spyware and if not what is a good spyware remover or help fix my problems with my computer, It runs slow, programs takes long time to load, Sometimes I open IE browser and three windows open,also the blue bar atop of the browser blinks, And i've seen files on my computer that I removed. I have anti-malware and avira so please if someone can help its much appreicated.
 
Welcome aboard
yahooo.gif


Please, complete all steps listed here: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/
Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
Attached logs won't be reviewed.
 
Alright I do beleive that im done with the 8 step info. that i was suppose to load up and run and post the logs on here. If i forgot something or did something wrong please let me know cuz like i said before im new to this and every little bit of help is more then helpful and once again apprecated also. Thank you very much for your time you have spent in helping me with my problems.
 
1. Please, do NOT bump your topic. It won't speed anything up.
2. Follow instructions and PASTE all logs.
 
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4878

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10/22/2010 8:06:37 AM
mbam-log-2010-10-22 (08-06-37).txt

Scan type: Quick scan
Objects scanned: 149309
Time elapsed: 11 minute(s), 48 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
 
GMER 1.0.15.15477 - http://www.gmer.net
Rootkit scan 2010-10-22 11:04:46
Windows 5.1.2600 Service Pack 3
Running: jqmfexyt.exe; Driver: C:\DOCUME~1\DAYLEN~1\LOCALS~1\Temp\kwaiypod.sys


---- System - GMER 1.0.15 ----

SSDT FA0562C6 ZwCreateKey
SSDT FA0562BC ZwCreateThread
SSDT FA0562CB ZwDeleteKey
SSDT FA0562D5 ZwDeleteValueKey
SSDT IPVNMon.sys (IPVNMon/Visual Networks) ZwDeviceIoControlFile [0xF985C803]
SSDT FA0562DA ZwLoadKey
SSDT FA0562A8 ZwOpenProcess
SSDT FA0562AD ZwOpenThread
SSDT FA0562E4 ZwReplaceKey
SSDT FA0562DF ZwRestoreKey
SSDT FA0562D0 ZwSetValueKey

---- Kernel code sections - GMER 1.0.15 ----

? C:\DOCUME~1\DAYLEN~1\LOCALS~1\Temp\kwaiypog.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\SearchIndexer.exe[560] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\System32\DRIVERS\rasl2tp.sys[NDIS.SYS!NdisMSetAttributesEx] [F985C744] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\rasl2tp.sys[NDIS.SYS!NdisMRegisterMiniport] [F985C51E] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisCloseAdapter] [F985C71A] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisOpenAdapter] [F985C6A7] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisMSetAttributesEx] [F985C744] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] [F985C380] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisMRegisterMiniport] [F985C51E] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [F985C380] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [F985C6A7] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [F985C71A] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisMSetAttributesEx] [F985C744] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisMRegisterMiniport] [F985C51E] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\raspptp.sys[NDIS.SYS!NdisMSetAttributesEx] [F985C744] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\raspptp.sys[NDIS.SYS!NdisMRegisterMiniport] [F985C51E] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisIMRegisterLayeredMiniport] [F985C48B] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [F985C380] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [F985C6A7] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisMSetAttributesEx] [F985C744] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [F985C71A] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\raspti.sys[NDIS.SYS!NdisMSetAttributesEx] [F985C744] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\raspti.sys[NDIS.SYS!NdisMRegisterMiniport] [F985C51E] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [F985C380] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [F985C71A] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [F985C6A7] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [F985C71A] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [F985C6A7] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [F985C380] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [F985C380] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [F985C6A7] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [F985C71A] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [F985C380] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [F985C71A] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [F985C6A7] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\asyncmac.sys[NDIS.SYS!NdisMRegisterMiniport] [F985C51E] IPVNMon.sys (IPVNMon/Visual Networks)
IAT \SystemRoot\System32\DRIVERS\asyncmac.sys[NDIS.SYS!NdisMSetAttributesEx] [F985C744] IPVNMon.sys (IPVNMon/Visual Networks)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----
 
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-10-21.02)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 3/25/2005 11:24:23 AM
System Uptime: 10/22/2010 3:22:03 PM (14 hours ago)

Motherboard: Dell Computer Corp. | |
Processor: Intel(R) Pentium(R) 4 CPU 2.00GHz | Microprocessor | 1993/400mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 56 GiB total, 36.647 GiB free.
D: is CDROM ()
E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP596: 8/22/2010 3:02:44 PM - Software Distribution Service 3.0
RP597: 8/23/2010 4:19:55 PM - Software Distribution Service 3.0
RP598: 8/24/2010 4:53:39 PM - System Checkpoint
RP599: 8/25/2010 11:38:18 PM - Software Distribution Service 3.0
RP600: 8/27/2010 1:42:02 AM - Software Distribution Service 3.0
RP601: 8/27/2010 2:38:27 AM - Installed Java(TM) 6 Update 21
RP602: 8/29/2010 3:53:54 PM - Software Distribution Service 3.0
RP603: 8/30/2010 6:09:20 PM - Software Distribution Service 3.0
RP604: 8/31/2010 10:59:21 PM - System Checkpoint
RP605: 9/1/2010 8:36:09 PM - Software Distribution Service 3.0
RP606: 9/2/2010 9:21:02 PM - System Checkpoint
RP607: 9/3/2010 7:27:55 AM - Software Distribution Service 3.0
RP608: 9/5/2010 12:47:24 AM - Software Distribution Service 3.0
RP609: 9/6/2010 11:30:30 AM - Software Distribution Service 3.0
RP610: 9/7/2010 3:25:17 PM - Software Distribution Service 3.0
RP611: 9/8/2010 3:29:39 PM - System Checkpoint
RP612: 9/10/2010 9:20:22 AM - Software Distribution Service 3.0
RP613: 9/12/2010 6:41:15 PM - System Checkpoint
RP614: 9/15/2010 12:10:42 AM - System Checkpoint
RP615: 9/18/2010 9:32:27 PM - Software Distribution Service 3.0
RP616: 9/20/2010 12:03:44 AM - Software Distribution Service 3.0
RP617: 9/22/2010 10:43:48 PM - Software Distribution Service 3.0
RP618: 9/23/2010 10:03:42 PM - Software Distribution Service 3.0
RP619: 9/24/2010 2:55:15 PM - Cleaned registry with Windows Live OneCare safety scanner
RP620: 9/24/2010 3:31:02 PM - Cleaned registry with Windows Live OneCare safety scanner
RP621: 9/25/2010 2:55:53 AM - Software Distribution Service 3.0
RP622: 9/25/2010 5:14:13 AM - Software Distribution Service 3.0
RP623: 9/25/2010 10:03:31 AM - Software Distribution Service 3.0
RP624: 9/25/2010 11:08:52 PM - Software Distribution Service 3.0
RP625: 9/26/2010 8:05:48 AM - Software Distribution Service 3.0
RP626: 9/27/2010 9:08:06 PM - System Checkpoint
RP627: 9/29/2010 1:27:46 AM - System Checkpoint
RP628: 9/29/2010 5:46:11 AM - Software Distribution Service 3.0
RP629: 9/29/2010 11:06:43 PM - Software Distribution Service 3.0
RP630: 9/29/2010 11:53:54 PM - Software Distribution Service 3.0
RP631: 10/1/2010 4:33:40 AM - System Checkpoint
RP632: 10/2/2010 6:52:40 AM - Software Distribution Service 3.0
RP633: 10/3/2010 7:09:05 PM - System Checkpoint
RP634: 10/4/2010 7:18:39 PM - System Checkpoint
RP635: 10/5/2010 8:46:20 PM - System Checkpoint
RP636: 10/5/2010 11:58:28 PM - Software Distribution Service 3.0
RP637: 10/6/2010 5:40:34 AM - Cleaned registry with Windows Live OneCare safety scanner
RP638: 10/7/2010 8:47:24 AM - Software Distribution Service 3.0
RP639: 10/7/2010 10:38:41 PM - Software Distribution Service 3.0
RP640: 10/8/2010 11:41:59 AM - Cleaned registry with Windows Live OneCare safety scanner
RP641: 10/8/2010 11:50:47 AM - Software Distribution Service 3.0
RP642: 10/9/2010 11:32:13 PM - Restore Operation
RP643: 10/9/2010 11:38:27 PM - Restore Operation
RP644: 10/9/2010 11:45:26 PM - Restore Operation
RP645: 10/9/2010 11:52:23 PM - Restore Operation
RP646: 10/9/2010 11:58:49 PM - Restore Operation
RP647: 10/10/2010 12:11:37 AM - Restore Operation
RP648: 10/10/2010 12:41:09 AM - Software Distribution Service 3.0
RP649: 10/10/2010 3:41:50 PM - Removed Ask Toolbar.
RP650: 10/10/2010 3:46:08 PM - Removed AT&T Yahoo! Dial Connection Manager
RP651: 10/10/2010 3:49:07 PM - Removed Microsoft Silverlight
RP652: 10/11/2010 9:44:31 PM - System Checkpoint
RP653: 10/12/2010 10:08:38 PM - System Checkpoint
RP654: 10/13/2010 2:41:13 PM - Software Distribution Service 3.0
RP655: 10/14/2010 1:19:10 AM - Restore Operation
RP656: 10/14/2010 1:36:38 AM - Restore Operation
RP657: 10/14/2010 2:11:43 AM - Restore Operation
RP658: 10/14/2010 2:36:55 AM - Restore Operation
RP659: 10/14/2010 2:53:14 AM - Restore Operation
RP660: 10/14/2010 3:58:20 AM - Software Distribution Service 3.0
RP661: 10/14/2010 7:20:19 AM - Removed Ask Toolbar.
RP662: 10/14/2010 7:22:21 AM - Removed AT&T Yahoo! Dial Connection Manager
RP663: 10/14/2010 10:47:40 AM - Removed AT&T Yahoo! Dial Connection Manager
RP664: 10/14/2010 11:41:11 PM - Software Distribution Service 3.0
RP665: 10/15/2010 5:19:07 AM - Removed QuickTime
RP666: 10/15/2010 5:56:36 AM - Removed Ask Toolbar.
RP667: 10/15/2010 8:22:21 AM - Restore Operation
RP668: 10/15/2010 8:32:33 AM - Removed QuickTime
RP669: 10/15/2010 9:08:10 AM - Installed Microsoft Fix it 50416
RP670: 10/15/2010 10:15:30 AM - Software Distribution Service 3.0
RP671: 10/15/2010 12:57:39 PM - Restore Operation
RP672: 10/15/2010 4:48:02 PM - Software Distribution Service 3.0
RP673: 10/15/2010 7:12:52 PM - Revo Uninstaller's restore point - Microsoft Silverlight
RP674: 10/15/2010 7:22:15 PM - Revo Uninstaller's restore point - Microsoft Silverlight
RP675: 10/16/2010 7:27:45 PM - System Checkpoint
RP676: 10/16/2010 9:27:42 PM - Software Distribution Service 3.0
RP677: 10/18/2010 2:34:36 PM - Restore Operation
RP678: 10/18/2010 2:38:17 PM - Restore Operation
RP679: 10/18/2010 5:02:13 PM - Installed QuickTime
RP680: 10/19/2010 5:08:45 PM - System Checkpoint
RP681: 10/20/2010 5:30:56 PM - System Checkpoint
RP682: 10/21/2010 6:33:02 PM - System Checkpoint
RP683: 10/22/2010 7:29:16 PM - System Checkpoint

==== Installed Programs ======================

Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.4
Apple Application Support
Apple Software Update
ArcSoft PhotoImpression 5
ArcSoft VideoImpression 2
AT&T Yahoo! Applications
Avira AntiVir Personal - Free Antivirus
Critical Update for Windows Media Player 11 (KB959772)
Dell AIO Printer A940
Glary Utilities 2.28.0.1011
Google Earth
Google Update Helper
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB981793)
Intel(R) PRO Ethernet Adapter and Software
iTunes
J2SE Runtime Environment 5.0 Update 11
Java Auto Updater
Java(TM) 6 Update 21
LimeWire 5.5.16
LSI PCI Soft Modem
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
MSVCRT
OpenOffice.org Installer 1.0
QuickTime
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Segoe UI
Sound Blaster Live!
SweetIM for Messenger 2.7
SweetIM Toolbar for Internet Explorer 3.4
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Windows (KB971513)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB982664)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
URGE
WebFldrs XP
Windows Genuine Advantage v1.3.0254.0
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Management Framework Core
Windows Media Format 11 runtime
Windows Media Player 11
Windows Search 4.0
Windows XP Service Pack 3
Yahoo! Software Update

==== Event Viewer Messages From Past Week ========

10/22/2010 8:18:23 AM, error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0.
10/22/2010 8:18:08 AM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
10/22/2010 7:39:13 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
10/22/2010 7:39:13 AM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
10/22/2010 7:16:01 AM, error: Service Control Manager [7034] - The Yahoo! Updater service terminated unexpectedly. It has done this 1 time(s).
10/22/2010 7:16:01 AM, error: Service Control Manager [7034] - The LexBce Server service terminated unexpectedly. It has done this 1 time(s).
10/22/2010 7:16:01 AM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
10/22/2010 7:16:01 AM, error: Service Control Manager [7034] - The Agere Modem Call Progress Audio service terminated unexpectedly. It has done this 1 time(s).
10/22/2010 3:30:42 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
10/22/2010 3:26:41 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Search service to connect.
10/22/2010 3:26:41 PM, error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
10/22/2010 2:31:15 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Net.Tcp Port Sharing Service service to connect.
10/22/2010 2:31:15 AM, error: Service Control Manager [7000] - The Net.Tcp Port Sharing Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
10/19/2010 8:08:54 PM, error: atapi [9] - The device, \Device\Ide\IdePort1, did not respond within the timeout period.
10/19/2010 7:38:47 AM, error: Service Control Manager [7024] - The Distributed Transaction Coordinator service terminated with service-specific error 3221229584 (0xC0001010).
10/19/2010 6:25:23 AM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
10/19/2010 6:25:23 AM, error: SideBySide [59] - Generate Activation Context failed for C:\DOCUME~1\DAYLEN~1\LOCALS~1\Temp\RarSFX0\redist.dll. Reference error message: The operation completed successfully. .
10/19/2010 6:25:23 AM, error: SideBySide [32] - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
10/19/2010 4:25:44 PM, error: Service Control Manager [7022] - The Avira AntiVir Guard service hung on starting.
10/18/2010 2:34:24 PM, error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23).
10/17/2010 1:59:25 AM, error: Microsoft Antimalware [2001] -
10/16/2010 9:02:27 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Yahoo! Updater service to connect.
10/16/2010 9:02:27 PM, error: Service Control Manager [7000] - The Yahoo! Updater service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
10/16/2010 9:02:12 PM, error: SideBySide [59] - Generate Activation Context failed for C:\WINDOWS\system32\SHELL32.dll. Reference error message: The operation completed successfully. .
10/16/2010 9:02:12 PM, error: SideBySide [58] - Syntax error in manifest or policy file "C:\WINDOWS\system32\SHELL32.dll" on line 0.
10/16/2010 9:02:11 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service YahooAUService with arguments "" in order to run the server: {90AFF435-B544-4F94-A0C2-CC020EACA4E3}

==== End Of File ===========================
 
DDS (Ver_10-10-21.02) - NTFSx86
Run by Daylene Croy at 5:49:31.79 on Sat 10/23/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.255.54 [GMT -7:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\WINDOWS\system32\netdde.exe
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Yahoo!\Companion\att\ToolbarSvr.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Documents and Settings\Daylene Croy\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://att.yahoo.com/
uSearch Page = hxxp://search.yahoo.com
uSearch Bar = hxxp://www.yahoo.com/ext/search/search.html
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mDefault_Search_URL = hxxp://search.yahoo.com
mSearch Page = hxxp://search.yahoo.com
mSearch Bar = hxxp://www.yahoo.com/ext/search/search.html
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://search.yahoo.com
mSearchAssistant = hxxp://home.peoplepc.com/search
uURLSearchHooks: att.net Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
uURLSearchHooks: SweetIM ToolbarURLSearchHook Class: {eee6c35d-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgHelper.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: {656ec4b7-072b-4698-b504-2a414c1f0037} - Accelerator Plugin
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SweetIM Toolbar Helper: {eee6c35c-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn1\YTSingleInstance.dll
TB: SweetIM Toolbar for Internet Explorer: {eee6c35b-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll
TB: att.net Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [msnmsgr] ~"c:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [UpdReg] c:\windows\UpdReg.EXE
mRun: [IPInSightMonitor 01] "c:\program files\sbc yahoo!\connection manager\ip insight\IPMon32.exe"
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [SweetIM] c:\program files\sweetim\messenger\SweetIM.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\daylen~1\startm~1\programs\startup\limewi~1.lnk - c:\program files\limewire\LimeWire.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
IE: &Yahoo! Search - file:///c:\program files\yahoo!\Common/ycsrch.htm
IE: Yahoo! &Dictionary - file:///c:\program files\yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\yahoo!\Common/ycsms.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
Trusted Zone: marlboro.com\www
DPF: Bingo Luau by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/freebingo/freebingo-en_US.cab
DPF: Blackjack Carnival by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/vbjack2/vbjack2-en_US.cab
DPF: Bowling by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/bowling/bowling-en_US.cab
DPF: Cribbage by pogo - hxxp://game3.pogo.com/v/9.1.6.34/applet/cribbage/cribbage-en_US.cab
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: First Class Solitaire by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/firstclass2/firstclass2-en_US.cab
DPF: Greenback Bayou by pogo - hxxp://game3.pogo.com/v/9.1.6.34/applet/greenback/greenback-en_US.cab
DPF: Hog Heaven Slots by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/fancy/fancy-en_US.cab
DPF: Lottso by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/lottso/lottso-en_US.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: Payday Freecell Solitaire by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/freecell2/freecell2-en_US.cab
DPF: Phlinx by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/flinger/flinger-en_US.cab
DPF: Pinochle by pogo - hxxp://game3.pogo.com/v/9.1.7.22/applet/pinochle/pinochle-en_US.cab
DPF: Poppit by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/poppit2/poppit2-en_US.cab
DPF: Scrabble by pogo - hxxp://game3.pogo.com/v/9.1.7.22/applet/scrabble/scrabble-en_US.cab
DPF: Showbiz Slots 2 by pogo - hxxp://game3.pogo.com/v/9.1.6.34/applet/slots/showbiz2-en_US.cab
DPF: SockHop Slots by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/showbiz3/showbiz3-en_US.cab
DPF: Spades 2 by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/spades2/spades2-en_US.cab
DPF: Spider Solitaire by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/spider/spider-en_US.cab
DPF: Team Bingo by Pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/teambingo/teambingo-en_US.cab
DPF: Thousand Island Solitaire by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/millbrae/millbrae-en_US.cab
DPF: Turbo 21 v2 by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/turbo22/turbo22-en_US.cab
DPF: Word Whomp Whackdown by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/whackdown/whackdown-en_US.cab
DPF: Yahtzee Party by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/yahtzee/yahtzee-en_US.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1238600905125
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1238600842687
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {8D83D301-E841-11D1-B155-00600823BCF9} - hxxps://www.sbcwebsupport.com/webline/applets/msie40x.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
TCP: {7FA5B984-BABD-4062-8DEE-FECD06D8562B} = 209.244.0.3 209.244.0.4
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-10-19 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-10-19 135336]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-10-19 267432]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-10-19 60936]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-8-31 136176]
S3 USB-100;SMC Compact USB to Ethernet converter;c:\windows\system32\drivers\SMC2208.SYS [2005-9-15 27519]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2002-9-3 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

=============== Created Last 30 ================

2010-10-19 14:35:13 -------- d-----w- c:\docume~1\daylen~1\applic~1\Avira
2010-10-19 13:27:14 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-10-19 13:27:09 -------- d-----w- c:\program files\Avira
2010-10-18 21:42:50 -------- d-----w- c:\windows\system32\wbem\repository\FS
2010-10-18 21:42:50 -------- d-----w- c:\windows\system32\wbem\Repository
2010-10-18 21:41:57 -------- d-----w- c:\program files\Microsoft Security Essentials(2)
2010-10-18 21:41:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware(2)
2010-10-18 21:41:55 -------- d-----w- c:\program files\Glary Utilities
2010-10-16 02:08:45 -------- d-----w- c:\program files\VS Revo Group
2010-10-15 19:59:15 -------- d-----w- C:\RECYCLER(3)
2010-10-15 19:56:20 -------- d-sh--w- C:\RECYCLER(2)
2010-10-15 18:50:18 -------- d-----w- c:\docume~1\daylen~1\locals~1\applic~1\FixItCenter
2010-10-15 18:29:33 -------- d-----w- c:\windows\MATS
2010-10-15 18:29:28 -------- d-----w- c:\program files\Microsoft Fix it Center
2010-10-15 16:57:30 -------- d-----w- c:\program files\Microsoft Security Essentials
2010-10-14 12:12:37 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-14 12:11:49 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-14 12:11:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-10 12:28:18 -------- d-----w- c:\docume~1\daylen~1\applic~1\Malwarebytes
2010-10-10 10:10:53 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-09-29 18:58:20 -------- d-----w- c:\docume~1\daylen~1\applic~1\Windows Search
2010-09-25 17:15:35 -------- d-----w- c:\windows\system32\winrm
2010-09-25 17:15:27 -------- dc-h--w- c:\windows\$968930Uinstall_KB968930$
2010-09-25 17:08:30 -------- d-----w- c:\docume~1\daylen~1\applic~1\Windows Desktop Search
2010-09-25 17:06:46 -------- d-----w- c:\windows\system32\GroupPolicy
2010-09-25 17:06:46 -------- d-----w- c:\program files\Windows Desktop Search
2010-09-25 17:04:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
2010-09-25 17:04:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
2010-09-25 17:04:01 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
2010-09-25 13:36:36 16896 -c----w- c:\windows\system32\dllcache\iecompat.dll

==================== Find3M ====================

2010-10-10 08:31:26 22154 ----a-w- c:\windows\msvideo.dll
2010-09-18 19:23:26 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53:25 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53:25 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53:25 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-10 05:58:08 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:58:06 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:58:06 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-09-08 18:17:46 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-09-08 18:17:46 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-09-01 11:51:14 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-08-31 13:42:52 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:02:29 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:57:43 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-26 12:52:45 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2010-08-23 16:12:04 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17:06 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:45:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll

============= FINISH: 5:51:46.28 ===============
 
Download MBRCheck to your desktop

Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
It will show a black screen with some data on it.
Enter N to exit.
A report called MBRcheckxxxx.txt will be on your desktop
Open this report and post its content in your next reply.

====================================================================

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  1. Please, never rename Combofix unless instructed.
  2. Close any open browsers.
  3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    NOTE1. If Combofix asks you to install Recovery Console, please allow it.
    NOTE 2. If Combofix asks you to update the program, always do so.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  4. Double click on combofix.exe & follow the prompts.
  5. When finished, it will produce a report for you.
  6. Please post the "C:\ComboFix.txt"
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
 
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000001d

Kernel Drivers (total 119):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0xF9F32000 \WINDOWS\system32\KDCOM.DLL
0xF9E42000 \WINDOWS\system32\BOOTVID.dll
0xF99E3000 ACPI.sys
0xF9F34000 \WINDOWS\System32\DRIVERS\WMILIB.SYS
0xF99D2000 pci.sys
0xF9A32000 isapnp.sys
0xF9FFA000 PCIIde.sys
0xF9CB2000 \WINDOWS\System32\Drivers\PCIIDEX.SYS
0xF9F36000 intelide.sys
0xF9A42000 MountMgr.sys
0xF99B3000 ftdisk.sys
0xF9CBA000 PartMgr.sys
0xF9A52000 VolSnap.sys
0xF999B000 atapi.sys
0xF9A62000 disk.sys
0xF9A72000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
0xF997B000 fltmgr.sys
0xF9969000 sr.sys
0xF9952000 KSecDD.sys
0xF993F000 WudfPf.sys
0xF98B2000 Ntfs.sys
0xF9885000 NDIS.sys
0xF986B000 Mup.sys
0xF9853000 IPVNMon.sys
0xF9A82000 agp440.sys
0xF9C52000 \SystemRoot\System32\DRIVERS\intelppm.sys
0xF9431000 \SystemRoot\System32\DRIVERS\nv4_mini.sys
0xF941D000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
0xF9D82000 \SystemRoot\System32\DRIVERS\usbuhci.sys
0xF93F9000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
0xF9D8A000 \SystemRoot\System32\DRIVERS\usbehci.sys
0xF92B4000 \SystemRoot\system32\drivers\P16X.sys
0xF9291000 \SystemRoot\system32\drivers\ks.sys
0xF926D000 \SystemRoot\system32\drivers\portcls.sys
0xF9C62000 \SystemRoot\system32\drivers\drmk.sys
0xF9241000 \SystemRoot\system32\DRIVERS\ctoss2k.sys
0xF9221000 \SystemRoot\system32\DRIVERS\ctsfm2k.sys
0xF9802000 \SystemRoot\system32\DRIVERS\gameenum.sys
0xF9104000 \SystemRoot\System32\DRIVERS\AGRSM.sys
0xF9F70000 \SystemRoot\System32\DRIVERS\USBD.SYS
0xF9D92000 \SystemRoot\System32\Drivers\Modem.SYS
0xF90E1000 \SystemRoot\system32\DRIVERS\e100b325.sys
0xF9D9A000 \SystemRoot\System32\DRIVERS\fdc.sys
0xF9C72000 \SystemRoot\System32\DRIVERS\i8042prt.sys
0xF9DA2000 \SystemRoot\System32\DRIVERS\kbdclass.sys
0xF9DAA000 \SystemRoot\System32\DRIVERS\mouclass.sys
0xF9C82000 \SystemRoot\System32\DRIVERS\serial.sys
0xF9625000 \SystemRoot\System32\DRIVERS\serenum.sys
0xF90CD000 \SystemRoot\System32\DRIVERS\parport.sys
0xF9DB2000 \SystemRoot\system32\drivers\Afc.sys
0xF9C92000 \SystemRoot\System32\DRIVERS\cdrom.sys
0xF9CA2000 \SystemRoot\System32\DRIVERS\redbook.sys
0xF9AA2000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xF9B52000 \SystemRoot\System32\DRIVERS\imapi.sys
0xFA115000 \SystemRoot\System32\DRIVERS\audstub.sys
0xF9B62000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
0xF960D000 \SystemRoot\System32\DRIVERS\ndistapi.sys
0xF8D62000 \SystemRoot\System32\DRIVERS\ndiswan.sys
0xF9B72000 \SystemRoot\System32\DRIVERS\raspppoe.sys
0xF9B82000 \SystemRoot\System32\DRIVERS\raspptp.sys
0xF9DFA000 \SystemRoot\System32\DRIVERS\TDI.SYS
0xF8D51000 \SystemRoot\System32\DRIVERS\psched.sys
0xF9B92000 \SystemRoot\System32\DRIVERS\msgpc.sys
0xF9E02000 \SystemRoot\System32\DRIVERS\ptilink.sys
0xF9E0A000 \SystemRoot\System32\DRIVERS\raspti.sys
0xF9BA2000 \SystemRoot\System32\DRIVERS\termdd.sys
0xF9F84000 \SystemRoot\System32\DRIVERS\swenum.sys
0xF8CF3000 \SystemRoot\System32\DRIVERS\update.sys
0xF9605000 \SystemRoot\System32\DRIVERS\mssmbios.sys
0xF9BC2000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF9C12000 \SystemRoot\System32\DRIVERS\usbhub.sys
0xF9F1A000 \SystemRoot\system32\drivers\MODEMCSA.sys
0xF9D2A000 \SystemRoot\System32\DRIVERS\flpydisk.sys
0xF9FBC000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xFA085000 \SystemRoot\System32\Drivers\Null.SYS
0xF9FBE000 \SystemRoot\System32\Drivers\Beep.SYS
0xF9CEA000 \SystemRoot\System32\DRIVERS\HIDPARSE.SYS
0xF9D3A000 \SystemRoot\System32\drivers\vga.sys
0xF9FC0000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF9FC2000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF9D42000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF9D4A000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF581B000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xF4521000 \SystemRoot\System32\DRIVERS\ipsec.sys
0xF44C8000 \SystemRoot\System32\DRIVERS\tcpip.sys
0xF44A0000 \SystemRoot\System32\DRIVERS\netbt.sys
0xF447E000 \SystemRoot\System32\drivers\afd.sys
0xF8F99000 \SystemRoot\System32\DRIVERS\netbios.sys
0xF9D52000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0xF4453000 \SystemRoot\System32\DRIVERS\rdbss.sys
0xF43BB000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
0xF57E7000 \SystemRoot\System32\Drivers\Fips.SYS
0xF4395000 \SystemRoot\System32\DRIVERS\ipnat.sys
0xF57D7000 \SystemRoot\System32\DRIVERS\wanarp.sys
0xF41E6000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xF9FD0000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
0xF0D21000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF444B000 \SystemRoot\System32\drivers\Dxapi.sys
0xF9D12000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xFA17F000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xF0840000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0xF4437000 \SystemRoot\System32\DRIVERS\ndisuio.sys
0xF0723000 \SystemRoot\System32\DRIVERS\mrxdav.sys
0xF06D7000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xF06C2000 \SystemRoot\system32\drivers\wdmaud.sys
0xF8FE9000 \SystemRoot\system32\drivers\sysaudio.sys
0xF9F6A000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xF044B000 \SystemRoot\System32\Drivers\HTTP.sys
0xF0303000 \SystemRoot\System32\DRIVERS\srv.sys
0xF035B000 \??\C:\WINDOWS\system32\drivers\PfModNT.sys
0xF0167000 \SystemRoot\System32\DRIVERS\asyncmac.sys
0xEF204000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 40):
0 System Idle Process
4 System
2024 C:\WINDOWS\system32\smss.exe
564 csrss.exe
592 C:\WINDOWS\system32\winlogon.exe
656 C:\WINDOWS\system32\services.exe
668 C:\WINDOWS\system32\lsass.exe
856 C:\WINDOWS\system32\svchost.exe
972 svchost.exe
1036 C:\WINDOWS\system32\svchost.exe
1136 C:\WINDOWS\system32\svchost.exe
1348 C:\WINDOWS\explorer.exe
1416 svchost.exe
1608 C:\WINDOWS\system32\LEXBCES.EXE
1636 C:\WINDOWS\system32\spoolsv.exe
1648 C:\WINDOWS\system32\LEXPPS.EXE
1736 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1792 svchost.exe
1932 C:\WINDOWS\system32\netdde.exe
204 C:\Program Files\LSI SoftModem\agrsmsvc.exe
232 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
416 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
524 C:\WINDOWS\system32\svchost.exe
556 C:\Program Files\Java\jre6\bin\jqs.exe
1368 C:\WINDOWS\AGRSMMSG.exe
1428 C:\Program Files\SweetIM\Messenger\SweetIM.exe
1436 C:\Program Files\Common Files\Java\Java Update\jusched.exe
1452 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
1476 C:\WINDOWS\system32\ctfmon.exe
1680 C:\Program Files\Windows Media Player\wmpnscfg.exe
436 C:\WINDOWS\system32\svchost.exe
2240 C:\WINDOWS\system32\searchindexer.exe
2812 wmpnetwk.exe
2752 alg.exe
1204 C:\Program Files\Internet Explorer\iexplore.exe
2412 C:\Program Files\Internet Explorer\iexplore.exe
540 C:\Program Files\Yahoo!\Companion\att\ToolbarSvr.exe
3200 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
2616 C:\PROGRA~1\Yahoo!\browser\ycommon.exe
2700 C:\Documents and Settings\Daylene Croy\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`01f60800 (NTFS)

PhysicalDrive0 Model Number: WDCWD600BB-75CAA0, Rev: 16.06V16

Size Device Name MBR Status
--------------------------------------------
55 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!
 
If you have a free version, there is nothing to disable. It's not active in real time.
 
ComboFix 10-10-23.02 - Daylene Croy 10/24/2010 18:43:58.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.255.109 [GMT -7:00]
Running from: c:\documents and settings\Daylene Croy\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Data

.
((((((((((((((((((((((((( Files Created from 2010-09-25 to 2010-10-25 )))))))))))))))))))))))))))))))
.

2010-10-19 14:35 . 2010-10-19 14:35 -------- d-----w- c:\documents and settings\Daylene Croy\Application Data\Avira
2010-10-19 13:27 . 2010-03-01 17:05 124784 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-10-19 13:27 . 2010-02-16 21:24 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-10-19 13:27 . 2009-05-11 19:49 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-10-19 13:27 . 2009-05-11 19:49 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-10-19 13:27 . 2010-10-19 13:27 -------- d-----w- c:\program files\Avira
2010-10-18 21:42 . 2010-10-18 21:42 -------- d-----w- c:\windows\system32\wbem\Repository
2010-10-18 21:41 . 2010-10-19 00:04 -------- d-----w- c:\program files\QuickTime
2010-10-18 21:41 . 2010-10-18 21:41 -------- d-----w- c:\program files\Glary Utilities
2010-10-18 21:41 . 2010-10-18 21:41 -------- d-----w- c:\program files\Microsoft Silverlight
2010-10-16 02:08 . 2010-10-16 02:08 -------- d-----w- c:\program files\VS Revo Group
2010-10-15 19:59 . 2010-10-18 21:41 -------- d-----w- C:\RECYCLER(3)
2010-10-15 19:56 . 2010-10-18 21:41 -------- d-----w- C:\RECYCLER(2)
2010-10-15 18:50 . 2010-10-15 18:50 -------- d-----w- c:\documents and settings\Daylene Croy\Local Settings\Application Data\FixItCenter
2010-10-15 18:29 . 2010-10-18 21:42 -------- d-----w- c:\windows\MATS
2010-10-15 18:29 . 2010-10-18 21:42 -------- d-----w- c:\program files\Microsoft Fix it Center
2010-10-15 16:57 . 2010-10-18 21:42 -------- d-----w- c:\program files\Microsoft Security Essentials
2010-10-14 12:12 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-14 12:11 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-14 12:11 . 2010-10-14 12:13 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-14 09:50 . 2010-10-14 09:50 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-10-14 01:36 . 2010-10-14 01:36 -------- d-----w- c:\documents and settings\Administrator\IETldCache
2010-10-13 15:35 . 2010-10-13 15:35 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\PCHealth
2010-10-10 12:28 . 2010-10-10 12:28 -------- d-----w- c:\documents and settings\Daylene Croy\Application Data\Malwarebytes
2010-10-10 10:10 . 2010-10-10 10:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-29 18:58 . 2010-09-29 18:58 -------- d-----w- c:\documents and settings\Daylene Croy\Application Data\Windows Search
2010-09-25 17:33 . 2010-09-25 17:33 -------- d-----w- c:\program files\Microsoft.NET
2010-09-25 17:15 . 2010-09-25 17:15 -------- d-----w- c:\windows\system32\winrm
2010-09-25 17:15 . 2010-09-25 17:15 -------- dc-h--w- c:\windows\$968930Uinstall_KB968930$
2010-09-25 17:09 . 2010-09-25 17:09 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-09-25 17:08 . 2010-09-25 17:08 -------- d-----w- c:\documents and settings\Daylene Croy\Application Data\Windows Desktop Search
2010-09-25 17:06 . 2010-09-26 06:10 -------- d-----w- c:\program files\Windows Desktop Search
2010-09-25 17:06 . 2010-09-25 17:06 -------- d-----w- c:\windows\system32\GroupPolicy
2010-09-25 17:04 . 2008-03-07 17:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
2010-09-25 17:04 . 2008-03-07 17:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
2010-09-25 17:04 . 2008-03-07 17:02 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
2010-09-25 13:36 . 2010-06-18 11:39 16896 -c----w- c:\windows\system32\dllcache\iecompat.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-10 08:31 . 2002-09-03 16:49 22154 ----a-w- c:\windows\msvideo.dll
2010-09-18 19:23 . 2002-09-03 16:41 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2002-09-03 16:41 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2002-09-03 16:41 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2002-09-03 16:41 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-15 11:50 . 2010-08-27 09:40 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-15 09:29 . 2009-01-04 03:30 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-09-10 05:58 . 2002-09-03 17:12 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:58 . 2002-09-03 16:39 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:58 . 2002-09-03 16:35 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-09-08 18:17 . 2010-09-08 18:17 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-09-08 18:17 . 2010-09-08 18:17 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-09-01 11:51 . 2002-09-03 16:27 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-08-31 13:42 . 2002-09-03 17:11 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:02 . 2002-09-03 17:06 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:57 . 2002-09-03 17:04 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-26 13:39 . 2002-09-03 17:04 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-26 12:52 . 2009-04-18 04:32 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2010-08-23 16:12 . 2002-09-03 16:29 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2002-09-03 17:04 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:45 . 2002-09-03 16:56 590848 ----a-w- c:\windows\system32\rpcrt4.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2009-05-20 177464]

[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2009-05-20 21:36 1258808 ----a-w- c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2009-05-20 1258808]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2009-05-20 1258808]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"IPInSightMonitor 01"="c:\program files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe" [2003-07-14 98304]
"AGRSMMSG"="AGRSMMSG.exe" [2004-10-08 88363]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2009-05-20 111928]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

c:\documents and settings\Daylene Croy\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2010-9-30 503808]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\PROGRA~1\\Yahoo!\\MESSEN~1\\yserver.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-09-01 136176]
R3 USB-100;SMC Compact USB to Ethernet converter;c:\windows\system32\DRIVERS\SMC2208.SYS [2001-09-25 27519]
R3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe [2008-04-14 14336]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]


--- Other Services/Drivers In Memory ---

*Deregistered* - IPVNMon

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder

2010-10-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-01 00:19]

2010-10-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-01 00:19]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://att.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://www.yahoo.com/ext/search/search.html
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://search.yahoo.com
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
Trusted Zone: marlboro.com\www
TCP: {7FA5B984-BABD-4062-8DEE-FECD06D8562B} = 209.244.0.3 209.244.0.4
DPF: Bingo Luau by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/freebingo/freebingo-en_US.cab
DPF: Blackjack Carnival by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/vbjack2/vbjack2-en_US.cab
DPF: Bowling by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/bowling/bowling-en_US.cab
DPF: Cribbage by pogo - hxxp://game3.pogo.com/v/9.1.6.34/applet/cribbage/cribbage-en_US.cab
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: First Class Solitaire by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/firstclass2/firstclass2-en_US.cab
DPF: Greenback Bayou by pogo - hxxp://game3.pogo.com/v/9.1.6.34/applet/greenback/greenback-en_US.cab
DPF: Hog Heaven Slots by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/fancy/fancy-en_US.cab
DPF: Lottso by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/lottso/lottso-en_US.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: Payday Freecell Solitaire by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/freecell2/freecell2-en_US.cab
DPF: Phlinx by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/flinger/flinger-en_US.cab
DPF: Pinochle by pogo - hxxp://game3.pogo.com/v/9.1.7.22/applet/pinochle/pinochle-en_US.cab
DPF: Poppit by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/poppit2/poppit2-en_US.cab
DPF: Scrabble by pogo - hxxp://game3.pogo.com/v/9.1.7.22/applet/scrabble/scrabble-en_US.cab
DPF: Showbiz Slots 2 by pogo - hxxp://game3.pogo.com/v/9.1.6.34/applet/slots/showbiz2-en_US.cab
DPF: SockHop Slots by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/showbiz3/showbiz3-en_US.cab
DPF: Spades 2 by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/spades2/spades2-en_US.cab
DPF: Spider Solitaire by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/spider/spider-en_US.cab
DPF: Team Bingo by Pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/teambingo/teambingo-en_US.cab
DPF: Thousand Island Solitaire by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/millbrae/millbrae-en_US.cab
DPF: Turbo 21 v2 by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/turbo22/turbo22-en_US.cab
DPF: Word Whomp Whackdown by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/whackdown/whackdown-en_US.cab
DPF: Yahtzee Party by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/yahtzee/yahtzee-en_US.cab
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-msnmsgr - ~c:\program files\Windows Live\Messenger\msnmsgr.exe
AddRemove-LSI Soft Modem - c:\windows\agrsmdel



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-24 18:58
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
msnmsgr = ~"c:\program files\Windows Live\Messenger\msnmsgr.exe" /background?

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2748)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-10-24 19:06:24
ComboFix-quarantined-files.txt 2010-10-25 02:06

Pre-Run: 39,040,114,688 bytes free
Post-Run: 39,023,349,760 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - F18EED6E41856F3F284F8469DD8A500F
 
That looks good as well....

Download OTL to your Desktop.

  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Under the Custom Scan box paste this in:


netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop


  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
 
with all theses logs and this combofix on my desktop is it ok if i remove them or do i keep them cuz the DDS program and the GMER program and there was one more you had me put on my desktop anyways there no longer on desktop
 
Don't do anything else, than I tell you to do.
Everything has to be done in certain order.
 
OTL logfile created on: 10/24/2010 7:33:08 PM - Run 1
OTL by OldTimer - Version 3.2.17.1 Folder = C:\Documents and Settings\Daylene Croy\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

255.00 Mb Total Physical Memory | 77.00 Mb Available Physical Memory | 30.00% Memory free
618.00 Mb Paging File | 240.00 Mb Available in Paging File | 39.00% Paging File free
Paging file location(s): C:\pagefile.sys 384 768 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.84 Gb Total Space | 36.36 Gb Free Space | 65.12% Space Free | Partition Type: NTFS

Computer Name: ELDA-PZICIO1813 | User Name: Daylene Croy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/10/24 19:30:48 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Daylene Croy\Desktop\OTL.exe
PRC - [2010/04/01 13:33:19 | 000,267,432 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2010/03/02 11:28:31 | 000,282,792 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010/02/24 10:28:09 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2010/01/14 22:11:00 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009/05/20 15:11:40 | 000,111,928 | R--- | M] (SweetIM Technologies Ltd.) -- C:\Program Files\SweetIM\Messenger\SweetIM.exe
PRC - [2009/03/27 22:10:56 | 000,014,336 | ---- | M] (LSI Corporation) -- C:\Program Files\LSI SoftModem\agrsmsvc.exe
PRC - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/03/03 13:18:10 | 000,200,704 | ---- | M] (Yahoo!, Inc.) -- C:\Program Files\Yahoo!\browser\ycommon.exe


========== Modules (SafeList) ==========

MOD - [2010/10/24 19:30:48 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Daylene Croy\Desktop\OTL.exe
MOD - [2010/08/23 09:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/04/01 13:33:19 | 000,267,432 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010/03/18 16:47:22 | 000,035,160 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe -- (aspnet_state)
SRV - [2010/03/18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/18 13:16:28 | 000,124,240 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2010/02/24 10:28:09 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2009/03/27 22:10:56 | 000,014,336 | ---- | M] (LSI Corporation) [Auto | Running] -- C:\Program Files\LSI SoftModem\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [On_Demand | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2003/05/19 16:07:38 | 000,086,016 | ---- | M] (Yahoo! Inc.) [On_Demand | Stopped] -- C:\WINDOWS\system32\YPcservice.exe -- (YPCService)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\usbaapl.sys -- (USBAAPL)
DRV - [2010/03/01 10:05:24 | 000,124,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2010/02/16 14:24:01 | 000,060,936 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009/08/13 15:07:12 | 001,163,328 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2009/05/11 12:49:19 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009/05/11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008/04/13 11:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2005/02/23 14:58:56 | 000,011,776 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afc.sys -- (Afc)
DRV - [2004/08/03 22:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2003/09/22 12:43:06 | 001,330,048 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\P16X.sys -- (P16X) Creative SB Live! Series (WDM)
DRV - [2003/09/22 08:48:06 | 000,130,192 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV - [2003/09/22 08:47:38 | 000,178,672 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctoss2k.sys -- (ossrv)
DRV - [2003/03/05 12:19:28 | 000,015,840 | ---- | M] (Creative Technology Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\PFMODNT.SYS -- (PfModNT)
DRV - [2001/09/25 14:02:18 | 000,027,519 | R--- | M] (SMC2208USB/ETH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SMC2208.SYS -- (USB-100)
DRV - [2001/08/17 06:28:00 | 000,871,388 | ---- | M] (BCM) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BCMDM.sys -- (BCMModem)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://www.yahoo.com/ext/search/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


[2009/05/11 20:35:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Daylene Croy\Application Data\Mozilla\Extensions
[2009/05/11 20:35:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Daylene Croy\Application Data\Mozilla\Extensions\mozswing@mozswing.org

O1 HOSTS File: ([2002/09/03 09:34:19 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Accelerator Plugin) - {656EC4B7-072B-4698-B504-2A414C1F0037} - Reg Error: Value error. File not found
O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (att.net Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (att.net Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [IPInSightMonitor 01] C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe (Visual Networks)
O4 - HKLM..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
O4 - Startup: C:\Documents and Settings\Daylene Croy\Start Menu\Programs\StartUp\LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (Lime Wire, LLC)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Yahoo! Search - C:\Program Files\Yahoo!\Common [2010/04/28 11:50:44 | 000,000,000 | ---D | M]
O8 - Extra context menu item: Yahoo! &Dictionary - C:\Program Files\Yahoo!\Common [2010/04/28 11:50:44 | 000,000,000 | ---D | M]
O8 - Extra context menu item: Yahoo! &Maps - C:\Program Files\Yahoo!\Common [2010/04/28 11:50:44 | 000,000,000 | ---D | M]
O8 - Extra context menu item: Yahoo! &SMS - C:\Program Files\Yahoo!\Common [2010/04/28 11:50:44 | 000,000,000 | ---D | M]
O9 - Extra Button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: marlboro.com ([www] https in Trusted sites)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1238600905125 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1238600842687 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8D83D301-E841-11D1-B155-00600823BCF9} https://www.sbcwebsupport.com/webline/applets/msie40x.cab (WebLine Browser Integration Classes)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O16 - DPF: Bingo Luau by pogo http://game3.pogo.com/v/9.1.7.20/applet/freebingo/freebingo-en_US.cab (Reg Error: Key error.)
O16 - DPF: Blackjack Carnival by pogo http://game3.pogo.com/v/9.1.7.20/applet/vbjack2/vbjack2-en_US.cab (Reg Error: Key error.)
O16 - DPF: Bowling by pogo http://game3.pogo.com/v/9.1.7.20/applet/bowling/bowling-en_US.cab (Reg Error: Key error.)
O16 - DPF: Cribbage by pogo http://game3.pogo.com/v/9.1.6.34/applet/cribbage/cribbage-en_US.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: First Class Solitaire by pogo http://game3.pogo.com/v/9.1.7.20/applet/firstclass2/firstclass2-en_US.cab (Reg Error: Key error.)
O16 - DPF: Greenback Bayou by pogo http://game3.pogo.com/v/9.1.6.34/applet/greenback/greenback-en_US.cab (Reg Error: Key error.)
O16 - DPF: Hog Heaven Slots by pogo http://game3.pogo.com/v/9.1.7.20/applet/fancy/fancy-en_US.cab (Reg Error: Key error.)
O16 - DPF: Lottso by pogo http://game3.pogo.com/v/9.1.7.20/applet/lottso/lottso-en_US.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O16 - DPF: Payday Freecell Solitaire by pogo http://game3.pogo.com/v/9.1.7.20/applet/freecell2/freecell2-en_US.cab (Reg Error: Key error.)
O16 - DPF: Phlinx by pogo http://game3.pogo.com/v/9.1.7.20/applet/flinger/flinger-en_US.cab (Reg Error: Key error.)
O16 - DPF: Pinochle by pogo http://game3.pogo.com/v/9.1.7.22/applet/pinochle/pinochle-en_US.cab (Reg Error: Key error.)
O16 - DPF: Poppit by pogo http://game3.pogo.com/v/9.1.7.20/applet/poppit2/poppit2-en_US.cab (Reg Error: Key error.)
O16 - DPF: Scrabble by pogo http://game3.pogo.com/v/9.1.7.22/applet/scrabble/scrabble-en_US.cab (Reg Error: Key error.)
O16 - DPF: Showbiz Slots 2 by pogo http://game3.pogo.com/v/9.1.6.34/applet/slots/showbiz2-en_US.cab (Reg Error: Key error.)
O16 - DPF: SockHop Slots by pogo http://game3.pogo.com/v/9.1.7.20/applet/showbiz3/showbiz3-en_US.cab (Reg Error: Key error.)
O16 - DPF: Spades 2 by pogo http://game3.pogo.com/v/9.1.7.20/applet/spades2/spades2-en_US.cab (Reg Error: Key error.)
O16 - DPF: Spider Solitaire by pogo http://game3.pogo.com/v/9.1.7.20/applet/spider/spider-en_US.cab (Reg Error: Key error.)
O16 - DPF: Team Bingo by Pogo http://game3.pogo.com/v/9.1.7.20/applet/teambingo/teambingo-en_US.cab (Reg Error: Key error.)
O16 - DPF: Thousand Island Solitaire by pogo http://game3.pogo.com/v/9.1.7.20/applet/millbrae/millbrae-en_US.cab (Reg Error: Key error.)
O16 - DPF: Turbo 21 v2 by pogo http://game3.pogo.com/v/9.1.7.20/applet/turbo22/turbo22-en_US.cab (Reg Error: Key error.)
O16 - DPF: Word Whomp Whackdown by pogo http://game3.pogo.com/v/9.1.7.20/applet/whackdown/whackdown-en_US.cab (Reg Error: Key error.)
O16 - DPF: Yahtzee Party by pogo http://game3.pogo.com/v/9.1.7.20/applet/yahtzee/yahtzee-en_US.cab (Reg Error: Key error.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: wave - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
Drivers32: wave1 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
Drivers32: wave4 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
Drivers32: wave5 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
Drivers32: wave6 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2010/10/24 19:30:46 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Daylene Croy\Desktop\OTL.exe
[2010/10/24 18:40:30 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/10/24 18:18:24 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/10/24 18:18:24 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/10/24 18:18:24 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/10/24 18:18:24 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/10/24 18:18:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/10/24 18:16:55 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/10/24 11:48:17 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/10/24 11:48:17 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/10/24 11:48:17 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/10/19 07:35:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Daylene Croy\Application Data\Avira
[2010/10/19 06:27:19 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2010/10/19 06:27:14 | 000,124,784 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2010/10/19 06:27:14 | 000,060,936 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2010/10/19 06:27:14 | 000,045,416 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys
[2010/10/19 06:27:14 | 000,022,360 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys
[2010/10/19 06:27:09 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2010/10/18 14:41:57 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Essentials(2)
[2010/10/18 14:41:57 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware(2)
[2010/10/18 14:41:55 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010/10/18 14:41:55 | 000,000,000 | ---D | C] -- C:\Program Files\Glary Utilities
[2010/10/18 14:41:17 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2010/10/15 19:08:45 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2010/10/15 12:59:15 | 000,000,000 | ---D | C] -- C:\RECYCLER(3)
[2010/10/15 12:56:20 | 000,000,000 | ---D | C] -- C:\RECYCLER(2)
[2010/10/15 11:50:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Daylene Croy\Local Settings\Application Data\FixItCenter
[2010/10/15 11:29:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\MATS
[2010/10/15 11:29:28 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Fix it Center
[2010/10/15 09:57:30 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Essentials
[2010/10/14 05:12:37 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/10/14 05:11:49 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/10/14 05:11:47 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/10/14 02:50:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NOS
[2010/10/13 08:35:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\PCHealth
[2010/10/10 05:28:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Daylene Croy\Application Data\Malwarebytes
[2010/10/10 03:10:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/09/29 11:58:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Daylene Croy\Application Data\Windows Search
[2010/09/25 10:33:49 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2010/09/25 10:15:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\WindowsPowerShell
[2010/09/25 10:15:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\winrm
[2010/09/25 10:15:27 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$968930Uinstall_KB968930$
[2010/09/25 10:08:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Daylene Croy\Application Data\Windows Desktop Search
[2010/09/25 10:06:46 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Desktop Search
[2010/09/25 10:06:46 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\GroupPolicy
[2010/09/25 10:04:02 | 000,098,304 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nlhtml.dll
[2010/09/25 10:04:02 | 000,029,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mimefilt.dll
[2010/09/25 10:04:01 | 000,192,000 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\offfilt.dll
[2002/04/11 00:41:00 | 000,065,536 | ---- | C] ( ) -- C:\WINDOWS\System32\A3d.dll

========== Files - Modified Within 30 Days ==========

[2010/10/24 19:35:08 | 000,000,898 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/10/24 19:30:48 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Daylene Croy\Desktop\OTL.exe
[2010/10/24 18:40:43 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2010/10/24 18:02:25 | 003,883,109 | R--- | M] () -- C:\Documents and Settings\Daylene Croy\Desktop\ComboFix.exe
[2010/10/24 17:44:41 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Daylene Croy\Desktop\MBRCheck.exe
[2010/10/24 16:48:42 | 000,001,744 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/10/24 16:40:08 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/10/24 16:36:47 | 000,000,894 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/10/24 16:36:37 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/10/24 16:36:35 | 267,460,608 | -HS- | M] () -- C:\hiberfil.sys
[2010/10/19 06:27:53 | 000,001,707 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Avira AntiVir Control Center.lnk
[2010/10/18 17:03:49 | 000,001,604 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010/10/16 02:11:48 | 000,001,632 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
[2010/10/15 08:12:16 | 000,000,446 | ---- | M] () -- C:\Documents and Settings\Daylene Croy\My Documents\uninstall.reg
[2010/10/15 04:20:31 | 000,116,560 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/10/14 23:51:25 | 000,586,276 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/10/14 23:51:25 | 000,120,904 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/10/14 23:44:44 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/10/14 05:13:11 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/10/10 01:31:26 | 000,022,154 | ---- | M] () -- C:\WINDOWS\msvideo.dll
[2010/10/09 03:31:38 | 000,000,000 | -H-- | M] () -- C:\Documents and Settings\Daylene Croy\My Documents\Default.rdp
[2010/10/03 20:55:27 | 000,001,538 | ---- | M] () -- C:\Documents and Settings\Daylene Croy\Start Menu\Programs\StartUp\LimeWire On Startup.lnk
[2010/10/03 20:52:22 | 000,001,580 | ---- | M] () -- C:\Documents and Settings\Daylene Croy\Desktop\LimeWire 5.5.16.lnk
[2010/09/25 10:07:33 | 000,001,787 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
[2010/09/25 04:56:05 | 000,000,562 | ---- | M] () -- C:\Documents and Settings\Daylene Croy\Desktop\Internet Connection.lnk
[2010/09/25 04:16:44 | 000,001,915 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk

========== Files Created - No Company Name ==========

[2010/10/24 18:40:43 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/10/24 18:40:36 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2010/10/24 18:18:24 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/10/24 18:18:24 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/10/24 18:18:24 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/10/24 18:18:24 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/10/24 18:18:24 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/10/24 18:02:23 | 003,883,109 | R--- | C] () -- C:\Documents and Settings\Daylene Croy\Desktop\ComboFix.exe
[2010/10/24 17:44:32 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\Daylene Croy\Desktop\MBRCheck.exe
[2010/10/19 06:27:53 | 000,001,707 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Avira AntiVir Control Center.lnk
[2010/10/18 17:03:48 | 000,001,604 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010/10/15 08:12:16 | 000,000,446 | ---- | C] () -- C:\Documents and Settings\Daylene Croy\My Documents\uninstall.reg
[2010/10/14 05:13:11 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/10/13 19:03:07 | 267,460,608 | -HS- | C] () -- C:\hiberfil.sys
[2010/10/09 03:31:38 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\Daylene Croy\My Documents\Default.rdp
[2010/10/03 20:55:27 | 000,001,538 | ---- | C] () -- C:\Documents and Settings\Daylene Croy\Start Menu\Programs\StartUp\LimeWire On Startup.lnk
[2010/10/03 20:52:21 | 000,001,580 | ---- | C] () -- C:\Documents and Settings\Daylene Croy\Desktop\LimeWire 5.5.16.lnk
[2010/09/25 10:07:33 | 000,001,787 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
[2010/09/25 04:56:05 | 000,000,562 | ---- | C] () -- C:\Documents and Settings\Daylene Croy\Desktop\Internet Connection.lnk
[2010/09/25 04:16:44 | 000,001,915 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/08/11 19:07:18 | 000,069,320 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2007/09/27 10:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2007/07/21 17:41:11 | 000,000,593 | ---- | C] () -- C:\WINDOWS\SysMech6.INI
[2006/12/27 23:06:18 | 000,001,359 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/07/17 19:05:24 | 000,000,084 | ---- | C] () -- C:\WINDOWS\encore_launcher.ini
[2006/03/27 12:31:58 | 000,007,168 | ---- | C] () -- C:\Documents and Settings\Daylene Croy\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/09/17 01:51:24 | 000,000,490 | ---- | C] () -- C:\WINDOWS\DELLSTAT.INI
[2005/09/17 01:50:58 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlbavs.dll
[2005/09/17 01:50:36 | 000,000,177 | ---- | C] () -- C:\WINDOWS\System32\dlbacoin.ini
[2005/09/17 01:31:37 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\YCRWin32.dll
[2005/09/15 11:06:36 | 000,000,066 | ---- | C] () -- C:\WINDOWS\SBWIN.INI
[2005/09/15 11:06:17 | 000,002,516 | ---- | C] () -- C:\WINDOWS\System32\P16X.ini
[2005/09/15 11:06:17 | 000,000,026 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
[2005/03/25 03:14:01 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2003/09/01 10:06:14 | 000,002,696 | ---- | C] () -- C:\WINDOWS\MIXDEF.INI
[2003/07/08 13:41:48 | 000,047,616 | ---- | C] () -- C:\WINDOWS\System32\P16X.dll
[2002/09/03 09:49:58 | 000,022,154 | ---- | C] () -- C:\WINDOWS\msvideo.dll

========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/04/07 03:04:24 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/10/24 18:40:43 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2010/10/24 19:06:26 | 000,017,660 | ---- | M] () -- C:\ComboFix.txt
[2005/03/25 11:22:06 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010/04/30 00:02:47 | 000,000,372 | ---- | M] () -- C:\content_update_notification.xml
[2010/10/24 16:36:35 | 267,460,608 | -HS- | M] () -- C:\hiberfil.sys
[2005/03/25 11:22:06 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2005/03/25 11:22:06 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2005/09/15 09:50:59 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2009/04/11 04:49:04 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/10/24 16:36:23 | 402,653,184 | -HS- | M] () -- C:\pagefile.sys
[2009/08/28 00:07:35 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
[2009/08/28 20:05:37 | 000,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
[2009/08/29 23:45:26 | 000,000,268 | -H-- | M] () -- C:\sqmdata02.sqm
[2009/08/30 22:08:36 | 000,000,268 | -H-- | M] () -- C:\sqmdata03.sqm
[2009/08/31 12:43:45 | 000,000,268 | -H-- | M] () -- C:\sqmdata04.sqm
[2009/08/31 15:00:07 | 000,000,268 | -H-- | M] () -- C:\sqmdata05.sqm
[2009/08/31 23:45:25 | 000,000,268 | -H-- | M] () -- C:\sqmdata06.sqm
[2009/10/08 04:46:34 | 000,000,232 | -H-- | M] () -- C:\sqmdata07.sqm
[2009/10/08 04:46:44 | 000,000,232 | -H-- | M] () -- C:\sqmdata08.sqm
[2009/10/08 04:47:07 | 000,000,232 | -H-- | M] () -- C:\sqmdata09.sqm
[2009/10/08 04:47:17 | 000,000,232 | -H-- | M] () -- C:\sqmdata10.sqm
[2009/10/08 04:47:21 | 000,000,232 | -H-- | M] () -- C:\sqmdata11.sqm
[2009/10/08 11:53:19 | 000,000,232 | -H-- | M] () -- C:\sqmdata12.sqm
[2009/10/08 14:01:34 | 000,000,232 | -H-- | M] () -- C:\sqmdata13.sqm
[2009/10/08 19:44:30 | 000,000,232 | -H-- | M] () -- C:\sqmdata14.sqm
[2009/10/09 12:30:40 | 000,000,232 | -H-- | M] () -- C:\sqmdata15.sqm
[2009/10/10 00:05:28 | 000,000,232 | -H-- | M] () -- C:\sqmdata16.sqm
[2009/08/21 23:38:17 | 000,000,268 | -H-- | M] () -- C:\sqmdata17.sqm
[2009/08/24 02:21:33 | 000,000,268 | -H-- | M] () -- C:\sqmdata18.sqm
[2009/08/26 23:33:02 | 000,000,268 | -H-- | M] () -- C:\sqmdata19.sqm
[2009/08/28 00:07:35 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
[2009/08/28 20:05:37 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
[2009/08/29 23:45:26 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt02.sqm
[2009/08/30 22:08:36 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt03.sqm
[2009/08/31 12:43:45 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt04.sqm
[2009/08/31 15:00:07 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt05.sqm
[2009/08/31 23:45:25 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt06.sqm
[2009/10/08 04:46:34 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt07.sqm
[2009/10/08 04:46:44 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt08.sqm
[2009/10/08 04:47:06 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt09.sqm
[2009/10/08 04:47:17 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt10.sqm
[2009/10/08 04:47:21 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt11.sqm
[2009/10/08 11:53:19 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt12.sqm
[2009/10/08 14:01:34 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt13.sqm
[2009/10/08 19:44:30 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt14.sqm
[2009/10/09 12:30:40 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt15.sqm
[2009/10/10 00:05:28 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt16.sqm
[2009/08/21 23:38:17 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt17.sqm
[2009/08/24 02:21:32 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt18.sqm
[2009/08/26 23:33:02 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt19.sqm
[2010/10/10 02:03:25 | 000,000,137 | ---- | M] () -- C:\VundoFix.txt
[2010/04/07 00:47:33 | 000,097,577 | ---- | M] () -- C:\YServer.txt

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2005/03/25 11:21:41 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2003/02/17 17:00:42 | 000,077,824 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\DLBAPP5C.DLL
[2008/07/06 05:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 03:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2005/03/25 03:12:22 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2005/03/25 03:12:21 | 000,602,112 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2005/03/25 03:12:21 | 000,413,696 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2009/04/11 04:58:19 | 000,000,272 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2005/09/15 10:11:53 | 000,000,177 | ---- | M] () -- C:\Documents and Settings\Daylene Croy\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2005/04/30 17:29:51 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Daylene Croy\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/10/24 18:02:25 | 003,883,109 | R--- | M] () -- C:\Documents and Settings\Daylene Croy\Desktop\ComboFix.exe
[2010/10/24 17:44:41 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Daylene Croy\Desktop\MBRCheck.exe
[2010/10/24 19:30:48 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Daylene Croy\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >
[2007/07/15 19:46:06 | 000,023,350 | ---- | M] () -- C:\WINDOWS\java\javalog.txt

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2005/09/15 10:11:53 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Daylene Croy\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2009/04/14 10:34:50 | 000,000,067 | -HS- | M] () -- C:\Documents and Settings\Daylene Croy\Cookies\desktop.ini
[2010/10/24 19:33:04 | 000,131,072 | -HS- | M] () -- C:\Documents and Settings\Daylene Croy\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 22:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/13 17:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2002/09/03 09:39:47 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2002/08/20 13:32:18 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2002/08/20 13:32:22 | 000,000,807 | ---- | M] () -- C:\Program Files\Messenger\mailtmpl.txt
[2008/05/02 07:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 10:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/13 17:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2002/08/20 16:08:38 | 000,069,663 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgsin.exe
[2002/09/03 09:49:05 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2002/09/03 09:49:07 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2002/09/03 09:51:10 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2002/08/20 13:32:20 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2004/07/17 11:41:06 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


< End of report >
 
OTL Extras logfile created on: 10/24/2010 7:33:08 PM - Run 1
OTL by OldTimer - Version 3.2.17.1 Folder = C:\Documents and Settings\Daylene Croy\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

255.00 Mb Total Physical Memory | 77.00 Mb Available Physical Memory | 30.00% Memory free
618.00 Mb Paging File | 240.00 Mb Available in Paging File | 39.00% Paging File free
Paging file location(s): C:\pagefile.sys 384 768 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.84 Gb Total Space | 36.36 Gb Free Space | 65.12% Space Free | Partition Type: NTFS

Computer Name: ELDA-PZICIO1813 | User Name: Daylene Croy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
"5985:TCP" = 5985:TCP:*:Disabled:Windows Remote Management
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\PROGRA~1\Yahoo!\MESSEN~1\yserver.exe" = C:\PROGRA~1\Yahoo!\MESSEN~1\yserver.exe:*:Enabled:Yahoo! FT Server -- (Yahoo! Inc.)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire -- (Lime Wire, LLC)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\WINDOWS\system32\mmc.exe" = C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console -- (Microsoft Corporation)
"C:\Program Files\Google\Google Earth\client\googleearth.exe" = C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 22
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36C3A0DA-07E0-4173-A406-D9308C1CBDAB}" = ArcSoft VideoImpression 2
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E8C2BA2-F4CA-4A1D-A690-6B9A411DAF8B}" = ArcSoft PhotoImpression 5
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8BBF6DFD-0AD9-43A7-9FBD-BF065E3866AF}" = URGE
"{8C13BEE4-E7CE-4E46-BD13-8F41DAD00FEF}" = SweetIM Toolbar for Internet Explorer 3.4
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{96E16100-A77F-4B31-B9AD-FFBA040EE1BD}" = Sound Blaster Live!
"{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}" = iTunes
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.4
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{E848C9C0-E6FF-4A3F-9D67-AE53AC3628FE}" = SweetIM for Messenger 2.7
"{ECA1A3B6-898F-4DCE-9F04-714CF3BA126B}" = Adobe Flash Player 10 Plugin
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Dell AIO Printer A940" = Dell AIO Printer A940
"Glary Utilities_is1" = Glary Utilities 2.28.0.1011
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"LimeWire" = LimeWire 5.5.16
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PROSet" = Intel(R) PRO Ethernet Adapter and Software
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Applications" = AT&T Yahoo! Applications
"Yahoo! Software Update" = Yahoo! Software Update

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 10/24/2010 7:47:20 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.LQT>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 10/24/2010 7:47:20 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.M4A>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 10/24/2010 7:47:20 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.M4P>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 10/24/2010 7:47:21 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.MED>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 10/24/2010 7:47:21 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.MID>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 10/24/2010 7:47:21 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.MIDI>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 10/24/2010 7:47:22 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.MKA>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 10/24/2010 7:47:24 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.MOD>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 10/24/2010 7:47:24 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.MP1>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

Error - 10/24/2010 7:47:24 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.MP2>
in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
A
device attached to the system is not functioning. (0x8007001f)

[ System Events ]
Error - 10/24/2010 3:34:23 PM | Computer Name = ELDA-PZICIO1813 | Source = Service Control Manager | ID = 7024
Description = The Distributed Transaction Coordinator service terminated with service-specific
error 3221229584 (0xC0001010).

Error - 10/24/2010 7:39:18 PM | Computer Name = ELDA-PZICIO1813 | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Net.Tcp Port Sharing
Service service to connect.

Error - 10/24/2010 7:39:19 PM | Computer Name = ELDA-PZICIO1813 | Source = Service Control Manager | ID = 7000
Description = The Net.Tcp Port Sharing Service service failed to start due to the
following error: %%1053

Error - 10/24/2010 7:45:30 PM | Computer Name = ELDA-PZICIO1813 | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM
Service service to connect.

Error - 10/24/2010 7:45:30 PM | Computer Name = ELDA-PZICIO1813 | Source = Service Control Manager | ID = 7000
Description = The IMAPI CD-Burning COM Service service failed to start due to the
following error: %%1053

Error - 10/24/2010 9:22:15 PM | Computer Name = ELDA-PZICIO1813 | Source = Service Control Manager | ID = 7031
Description = The Windows Media Player Network Sharing Service service terminated
unexpectedly. It has done this 1 time(s). The following corrective action will
be taken in 30000 milliseconds: Restart the service.

Error - 10/24/2010 9:23:01 PM | Computer Name = ELDA-PZICIO1813 | Source = WMPNetworkSvc | ID = 866312
Description = A new media server was not initialized because WMCreateDeviceRegistration()
encountered error '0xc00d2711'. The Windows Media DRM components on your computer
might be corrupted. Verify that protected files play correctly in Windows Media
Player, and then restart the WMPNetworkSvc service.

Error - 10/24/2010 9:23:02 PM | Computer Name = ELDA-PZICIO1813 | Source = WMPNetworkSvc | ID = 866312
Description = A new media server was not initialized because WMCreateDeviceRegistration()
encountered error '0xc00d2711'. The Windows Media DRM components on your computer
might be corrupted. Verify that protected files play correctly in Windows Media
Player, and then restart the WMPNetworkSvc service.

Error - 10/24/2010 9:43:34 PM | Computer Name = ELDA-PZICIO1813 | Source = Service Control Manager | ID = 7031
Description = The Windows Media Player Network Sharing Service service terminated
unexpectedly. It has done this 1 time(s). The following corrective action will
be taken in 30000 milliseconds: Restart the service.

Error - 10/24/2010 9:49:59 PM | Computer Name = ELDA-PZICIO1813 | Source = Service Control Manager | ID = 7031
Description = The Windows Media Player Network Sharing Service service terminated
unexpectedly. It has done this 1 time(s). The following corrective action will
be taken in 30000 milliseconds: Restart the service.


< End of report >
 
255.00 Mb Total Physical Memory
You have very little of RAM. XP needs at least 512MB of RAM to run OK (1GB preferably).

===========================================================================

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    Code:
    :OTL
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
    O2 - BHO: (Accelerator Plugin) - {656EC4B7-072B-4698-B504-2A414C1F0037} - Reg Error: Value error. File not found
    O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
    O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jin...ndows-i586.cab (Reg Error: Key error.)
    O16 - DPF: Bingo Luau by pogo http://game3.pogo.com/v/9.1.7.20/app...ingo-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Blackjack Carnival by pogo http://game3.pogo.com/v/9.1.7.20/app...ack2-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Bowling by pogo http://game3.pogo.com/v/9.1.7.20/app...ling-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Cribbage by pogo http://game3.pogo.com/v/9.1.6.34/app...bage-en_US.cab (Reg Error: Key error.)
    O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
    O16 - DPF: First Class Solitaire by pogo http://game3.pogo.com/v/9.1.7.20/app...ass2-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Greenback Bayou by pogo http://game3.pogo.com/v/9.1.6.34/app...back-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Hog Heaven Slots by pogo http://game3.pogo.com/v/9.1.7.20/app...ancy-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Lottso by pogo http://game3.pogo.com/v/9.1.7.20/app...ttso-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
    O16 - DPF: Payday Freecell Solitaire by pogo http://game3.pogo.com/v/9.1.7.20/app...ell2-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Phlinx by pogo http://game3.pogo.com/v/9.1.7.20/app...nger-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Pinochle by pogo http://game3.pogo.com/v/9.1.7.22/app...chle-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Poppit by pogo http://game3.pogo.com/v/9.1.7.20/app...pit2-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Scrabble by pogo http://game3.pogo.com/v/9.1.7.22/app...bble-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Showbiz Slots 2 by pogo http://game3.pogo.com/v/9.1.6.34/app...biz2-en_US.cab (Reg Error: Key error.)
    O16 - DPF: SockHop Slots by pogo http://game3.pogo.com/v/9.1.7.20/app...biz3-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Spades 2 by pogo http://game3.pogo.com/v/9.1.7.20/app...des2-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Spider Solitaire by pogo http://game3.pogo.com/v/9.1.7.20/app...ider-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Team Bingo by Pogo http://game3.pogo.com/v/9.1.7.20/app...ingo-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Thousand Island Solitaire by pogo http://game3.pogo.com/v/9.1.7.20/app...brae-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Turbo 21 v2 by pogo http://game3.pogo.com/v/9.1.7.20/app...bo22-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Word Whomp Whackdown by pogo http://game3.pogo.com/v/9.1.7.20/app...down-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Yahtzee Party by pogo http://game3.pogo.com/v/9.1.7.20/app...tzee-en_US.cab (Reg Error: Key error.)
    [2010/10/18 14:41:57 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Essentials(2)
    [2010/10/15 09:57:30 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Essentials
    
    
    :Services
    
    :Reg
    
    :Files
    
    :Commands
    [purity]
    [emptytemp]
    [emptyflash]
    [Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • You will get a log that shows the results of the fix. Please post it.

====================================================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.
  • Double-click SecurityCheck.exe
  • Follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.


2. Download Temp File Cleaner (TFC)
  • Double click on TFC.exe to run the program.
  • Click on Start button to begin cleaning process.
  • TFC will close all running programs, and it may ask you to restart computer.


3. Please run a free online scan with the ESET Online Scanner

  • Disable your antivirus program
  • Tick the box next to YES, I accept the Terms of Use
  • Click Start
  • IMPORTANT! UN-check Remove found threats
  • Accept any security warnings from your browser.
  • Check Scan archives
  • Click Start
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push List of found threats
  • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • NOTE. If Eset won't find any threats, it won't produce any log.
 
All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{656EC4B7-072B-4698-B504-2A414C1F0037}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{656EC4B7-072B-4698-B504-2A414C1F0037}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\UpdReg deleted successfully.
C:\WINDOWS\Updreg.EXE moved successfully.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control Bingo Luau by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Bingo Luau by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Bingo Luau by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Bingo Luau by pogo\ not found.
Starting removal of ActiveX control Blackjack Carnival by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Blackjack Carnival by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Blackjack Carnival by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Blackjack Carnival by pogo\ not found.
Starting removal of ActiveX control Bowling by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Bowling by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Bowling by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Bowling by pogo\ not found.
Starting removal of ActiveX control Cribbage by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Cribbage by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Cribbage by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Cribbage by pogo\ not found.
File Animation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab not found.
Starting removal of ActiveX control DirectAnimation Java Classes
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\DirectAnimation Java Classes\ not found.
Starting removal of ActiveX control First Class Solitaire by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\First Class Solitaire by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\First Class Solitaire by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\First Class Solitaire by pogo\ not found.
Starting removal of ActiveX control Greenback Bayou by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Greenback Bayou by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Greenback Bayou by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Greenback Bayou by pogo\ not found.
Starting removal of ActiveX control Hog Heaven Slots by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Hog Heaven Slots by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Hog Heaven Slots by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Hog Heaven Slots by pogo\ not found.
Starting removal of ActiveX control Lottso by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Lottso by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Lottso by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Lottso by pogo\ not found.
File oft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab not found.
Starting removal of ActiveX control Microsoft XML Parser for Java
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Microsoft XML Parser for Java\ not found.
Starting removal of ActiveX control Payday Freecell Solitaire by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Payday Freecell Solitaire by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Payday Freecell Solitaire by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Payday Freecell Solitaire by pogo\ not found.
Starting removal of ActiveX control Phlinx by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Phlinx by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Phlinx by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Phlinx by pogo\ not found.
Starting removal of ActiveX control Pinochle by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Pinochle by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Pinochle by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Pinochle by pogo\ not found.
Starting removal of ActiveX control Poppit by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Poppit by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Poppit by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Poppit by pogo\ not found.
Starting removal of ActiveX control Scrabble by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Scrabble by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Scrabble by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Scrabble by pogo\ not found.
Starting removal of ActiveX control Showbiz Slots 2 by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Showbiz Slots 2 by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Showbiz Slots 2 by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Showbiz Slots 2 by pogo\ not found.
Starting removal of ActiveX control SockHop Slots by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\SockHop Slots by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\SockHop Slots by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\SockHop Slots by pogo\ not found.
Starting removal of ActiveX control Spades 2 by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Spades 2 by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Spades 2 by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Spades 2 by pogo\ not found.
Starting removal of ActiveX control Spider Solitaire by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Spider Solitaire by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Spider Solitaire by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Spider Solitaire by pogo\ not found.
Starting removal of ActiveX control Team Bingo by Pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Team Bingo by Pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Team Bingo by Pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Team Bingo by Pogo\ not found.
Starting removal of ActiveX control Thousand Island Solitaire by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Thousand Island Solitaire by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Thousand Island Solitaire by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Thousand Island Solitaire by pogo\ not found.
Starting removal of ActiveX control Turbo 21 v2 by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Turbo 21 v2 by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Turbo 21 v2 by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Turbo 21 v2 by pogo\ not found.
Starting removal of ActiveX control Word Whomp Whackdown by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Word Whomp Whackdown by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Word Whomp Whackdown by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Word Whomp Whackdown by pogo\ not found.
Starting removal of ActiveX control Yahtzee Party by pogo
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Yahtzee Party by pogo\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Yahtzee Party by pogo\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Yahtzee Party by pogo\ not found.
C:\Program Files\Microsoft Security Essentials(2)\en-us(2) folder moved successfully.
C:\Program Files\Microsoft Security Essentials(2)\Backup(2)\en-us(2) folder moved successfully.
C:\Program Files\Microsoft Security Essentials(2)\Backup(2) folder moved successfully.
C:\Program Files\Microsoft Security Essentials(2) folder moved successfully.
C:\Program Files\Microsoft Security Essentials\en-us folder moved successfully.
C:\Program Files\Microsoft Security Essentials\Backup\en-us folder moved successfully.
C:\Program Files\Microsoft Security Essentials\Backup folder moved successfully.
C:\Program Files\Microsoft Security Essentials folder moved successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Daylene Croy
->Temp folder emptied: 32768 bytes
->Temporary Internet Files folder emptied: 2748702 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 456 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Elda Reynolds
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 65536 bytes
->Temporary Internet Files folder emptied: 32835 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 3.00 mb


[EMPTYFLASH]

User: Administrator

User: All Users

User: Daylene Croy
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Elda Reynolds

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.17.1 log created on 10242010_201507

Files\Folders moved on Reboot...
C:\Documents and Settings\Daylene Croy\Local Settings\Temp\~DFD86E.tmp moved successfully.
C:\Documents and Settings\Daylene Croy\Local Settings\Temporary Internet Files\Content.IE5\UBUKSYBM\sh25[1].html moved successfully.
C:\Documents and Settings\Daylene Croy\Local Settings\Temporary Internet Files\Content.IE5\QMSAIMES\topic155303-2[1].html moved successfully.

Registry entries deleted on Reboot...
 
Status
Not open for further replies.
Back