# Slow computer,shuts down by itself??



## ivory1982 (Mar 14, 2009)

My computer is running quite slow and for no reason shuts down occassionally by itself. I'm running AVG as my main defence and run the following programs 2 to 3 times a week or more, and other then a few tracking cookies my computer seems clean.
Malwarbytes Anti Malware
Super Anti Spyware
SpyBot
XoftSpy SE
RootkitRevealer.exe

I downloaded HiJack this from your site and I'm enclosing same. It would be great if you could review the file and let me know if I"ve got anything to worry about. 
Thanks Ivory 
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:10:05 AM, on 8/29/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\mswinext.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\IncrediMail\bin\IncMail.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\BitComet\BitComet.exe
C:\Documents and Settings\Terry\Desktop\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.alot.com/web?q=&pr=au..._id=11176&camp_id=-6&tb_version=2.5.12000.509
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: ALOT Toolbar Helper - {14CEEAFF-96DD-4101-AE37-D5ECDC23C3F6} - C:\Program Files\alot\bin\BHO\alotBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.4.6.22.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - C:\Program Files\alot\bin\alot.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: @C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [Bing Bar] "C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\mswinext.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Cookienator] C:\Program Files\Cookienator\cookienator.exe /auto
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\Program Files\IncrediMail\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.4.6.22.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Inkjet Printer/Scanner Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PCPitstop Scheduling - VSO Software - (no file)
O23 - Service: PH - Unknown owner - C:\DOCUME~1\TERRY~1.TER\LOCALS~1\Temp\PH.exe (file missing)
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: U - Unknown owner - C:\DOCUME~1\TERRY~1.TER\LOCALS~1\Temp\U.exe (file missing)
O23 - Service: WZKQTSHUIQ - Unknown owner - C:\DOCUME~1\TERRY~1.TER\LOCALS~1\Temp\WZKQTSHUIQ.exe (file missing)
O23 - Service: XoftSpyService - ParetoLogic Inc. - C:\Program Files\Common Files\XoftSpySE\6\xoftspyservice.exe
--
End of file - 12515 bytes

515 bytes


----------



## Megabite (Apr 5, 2008)

Howdy,

When it shuts down does it restart by itself or do you have to restart it?

You have Peer to Peer programs running and they are unsafe, they will leave you open to viruses.


----------



## Megabite (Apr 5, 2008)

You have some suspicious entries in you log but usually would not shut the PC down......first thing is to see if the PC is overheating. Check all the fans are spinning OK.....try HWmonitor to see what the CPU temperature is.

http://download.cnet.com/HWMonitor/3000-2094_4-10793486.html


----------



## ivory1982 (Mar 14, 2009)

Good morning and thank you.
Windows will all of a sudden shut down and restart to the point where I have to re-enter my password for windows. I know that by using peer to peer programs that I'm leaving myself vulnerable. Is there a safer way to download files?


----------



## flavallee (May 12, 2002)

Your HiJackThis log is a mess. Let's see what's installed in that computer. I can pretty much tell already that some uninstalling, updating, and replacing of programs is in order.

Start HiJackThis, but don't run a scan.

Click on the "Open The Misc Tools Section" button. 

Click on the "Open Uninstall Manager" button. 

Click on the "Save List" button. 

Save the "uninstall_list.txt" file somewhere. 

It'll then open in Notepad.

Return here to your thread, then copy-and-paste the entire file here. 

-----------------------------------------------------------------

What's the brand name, model name, and model of that computer?

How much RAM does it currently have?

------------------------------------------------------------------


----------



## Phantom010 (Mar 9, 2009)

You do have remnants of malware in your registry, pointing to missing files in your Temp folder. Your computer might still be infected.

I would click on *Report* and kindly ask to be moved to the *Virus & Other Malware Removal *forum. Be sure to provide the appropriate reports in that forum after reading *THIS*. From there, be patient. You should get an answer within the next 48 hours. These guys are really busy!


----------



## ivory1982 (Mar 14, 2009)

Hello again.
First of all, I would like to thank you all for offering your help. I'm a novice user and I'm not to sure how and to who I should be replying back to first. Megabite:
I downloaded that HWmounter to my desktop and when I tried to open it up twice and my windows shut down each time??? I had tried a similiar program awhile ago and the same thing happened. I also checked to see how dusty the tower is and its not bad at all.


----------



## ivory1982 (Mar 14, 2009)

flavallee said:


> Your HiJackThis log is a mess. Let's see what's installed in that computer. I can pretty much tell already that some uninstalling, updating, and replacing of programs is in order.
> 
> Start HiJackThis, but don't run a scan.
> 
> ...


----------



## ivory1982 (Mar 14, 2009)

Hello Flavallee
Here are the files from hijack this:

µTorrent
123 Free Solitaire 2009 v7.1
Adobe AIR
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.3.3
Advanced SystemCare 3
ALOT Toolbar
Any DVD Converter Professional 3.7.9
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft PhotoStudio 5.5
AVG Free 9.0
Belarc Advisor 8.1
Bing Bar
Bing Bar Platform
BitComet 1.22
Bonjour
CA Yahoo! Anti-Spy (remove only)
Canon CanoScan Toolbox 5.0
Canon IJ Network Scan Utility
Canon IJ Network Tool
Canon MP Drivers 7.0
Canon MP Navigator 1.1
Canon MP Navigator EX 2.0
Canon MP620 series MP Drivers
Canon ScanGear Starter
Canon Utilities Easy-PhotoPrint
Canon Utilities Easy-PhotoPrint EX
Canon Utilities My Printer
Canon Utilities Solution Menu
CanoScan 4400F
CCleaner
Cdcovers Toolbar
Cheetah DVD Burner
Compatibility Pack for the 2007 Office system
ConvertXtoDVD 3.8.0.193f
Cookienator
Defraggler
DVD Decoder Pak for Windows XP
DVD Flick 1.3.0.7
DVD43 v4.3.1
Easy MPEG/AVI/DIVX/WMV/RM to DVD 2.0.17
Easy-WebPrint
FastStone Capture 6.5
FastStone Image Viewer 4.2
FastStone MaxView 2.3
FastStone Photo Resizer 2.8
FileHippo.com Update Checker
Google Earth
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
ImgBurn
IncrediMail
IncrediMail 2.0
Inkjet Printer/Scanner Extended Survey Program
IrfanView (remove only)
iTunes
Java(TM) 6 Update 21
Junk Mail filter update
K-Lite Codec Pack 5.1.0 (Standard)
Logitech Harmony Remote Software 7
Magic ISO Maker v5.5 (build 0274)
Magic ISO Maker v5.5 (build 0276)
Magic ISO Maker v5.5 (build 0281)
Malwarebytes' Anti-Malware
MediaMonkey 3.2
Memorex exPressit Label Design Studio
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Choice Guard
Microsoft Default Manager
Microsoft LifeCam
Microsoft Office Live Add-in 1.3
Microsoft Office Professional Edition 2003
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.6.8)
MP3 Rocket
MSN
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
muvee autoProducer 6.1 Seagate Edition
Nero 7 Ultra Edition
neroxml
NVIDIA Drivers
PandoraRecovery (Remove Only)
PC Pitstop Driver Alert2 2.0.0.0
PC Pitstop Optimize3 3.0
PhotoMail Maker
PhotoMail Maker
PhotoScape
Picasa 3
Presto! PageManager 7.15.14
QuickTime
Recuva
Remote Control USB Driver
Revo Uninstaller 1.83
ScanSoft OmniPage SE 4.0
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB978695)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Segoe UI
Similarity 1.3.6
Skype Toolbars
Skype™ 4.2
Software Informer 1.0 BETA
Spelling Dictionaries Support For Adobe Reader 9
Spybot - Search & Destroy
SUPERAntiSpyware
The KMPlayer (remove only)
Tunatic
Tweak UI
Unlocker 1.9.0
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 1.1.2
Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Live Writer
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinPatrol
WinRAR archiver
XoftSpySE
Yahoo! Toolbar
ZwankySearch 1.0 build 142

My operating system: 
*Operating System*
Windows XP Home Edition Service Pack 3 (build 2600)
Install Language: English (United States)
System Locale: English (United States
*Processor a*
1.33 gigahertz AMD Athlon
128 kilobyte primary memory cache
256 kilobyte secondary memory cache
Not hyper-threaded
*Drives*
200.09 Gigabytes Usable Hard Drive Capacity
115.90 Gigabytes Hard Drive Free Space

HL-DT-ST DVDRAM GSA-4163B [CD-ROM drive]
3.5" format removeable media [Floppy drive]

SAMSUNG SP0411N [Hard drive] (40.06 GB) -- drive 1, s/n S01JJ40Y752442, rev TW100-13, SMART Status: Healthy
WDC WD1600AAJB-22PVA0 [Hard drive] (160.04 GB) -- drive 0, s/n WD-WMAP94903615, rev 00.07H00, SMART Status: Healthy
*Main Circuit Board b*
Board: ASUSTeK Computer INC. A7N266VM REV 1.xx
Bus Clock: 133 megahertz
BIOS: Award Software, Inc. ASUS A7N266-VM ACPI BIOS Rev 1004/AA 08/23/2002
*Memory Modules c,d*
1024 Megabytes Usable Installed Memory

Slot 'DIMM 1' has 512 MB
Slot 'DIMM 2' has 512 MB
*Local Drive Volumes*
(NTFS on drive 0)160.03 GB78.58 GB freed: (NTFS on drive 1)40.06 GB37.31 GB free


I also ran a rootkitReveil scan
HKLM\SECURITY\Policy\Secrets\SAC* 5/5/2009 11:08 AM 0 bytes Key name contains embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAI* 5/5/2009 11:08 AM 0 bytes Key name contains embedded nulls (*)
HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed 8/29/2010 8:22 PM 80 bytes Data mismatch between Windows API and raw hive data.
C:\Documents and Settings\All Users.WINDOWS\Application Data\avg9\Chjw\c86ce0b96ce0a382\0b63e99b-e458-4e39-b1be-286b500958ea 8/29/2010 8:27 PM 1.42 MB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\All Users.WINDOWS\Application Data\avg9\Chjw\c86ce0b96ce0a382\e26067be-a3a3-475f-bbad-fa1bd0d601b7 8/29/2010 8:27 PM 1.47 MB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Application Data\Macromedia\Flash Player\#SharedObjects\V2MFC6CS\media.alot.com\widgets\radiotime\RadioPlayer3.swf\COLLAPSED.sol 8/29/2010 9:14 PM 97 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Application Data\Macromedia\Flash Player\#SharedObjects\V2MFC6CS\media.alot.com\widgets\radiotime\RadioPlayer3.swf\UID.sol 8/29/2010 8:44 PM 111 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Application Data\Macromedia\Flash Player\#SharedObjects\V2MFC6CS\www.youtube.com 8/29/2010 9:13 PM 0 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Application Data\Macromedia\Flash Player\#SharedObjects\V2MFC6CS\www.youtube.com\videostats.sol 8/29/2010 9:09 PM 85 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#media.alot.com\settings.sol 8/29/2010 8:44 PM 84 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.youtube.com\settings.sol 8/29/2010 9:09 PM 85 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol 8/29/2010 9:09 PM 507 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Cookies\[email protected][1].txt 8/29/2010 8:44 PM 136 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Cookies\[email protected][2].txt 8/29/2010 9:04 AM 323 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Cookies\[email protected][3].txt 8/29/2010 8:44 PM 347 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Cookies\[email protected][1].txt 8/29/2010 9:09 PM 133 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Cookies\[email protected][1].txt 8/29/2010 3:27 PM 111 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Cookies\[email protected][2].txt 8/29/2010 8:45 PM 112 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Cookies\[email protected][2].txt 8/29/2010 8:34 PM 353 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Cookies\[email protected][3].txt 8/29/2010 8:30 PM 355 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Cookies\[email protected][2].txt 8/29/2010 9:08 PM 166 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\Google\Toolbar\metrics_118221315889.xml 8/29/2010 8:27 PM 5.20 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\Google\Toolbar\metrics_121321948740.xml 8/29/2010 8:41 PM 10.00 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\Google\Toolbar\metrics_128108136123.xml 8/29/2010 9:13 PM 5.31 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Identities\{CED66870-B513-4808-9AE5-7A8D8FFE60B9}\Message Store\IndexB\index_i_460.ix 8/29/2010 9:35 AM 2.55 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Identities\{CED66870-B513-4808-9AE5-7A8D8FFE60B9}\Message Store\IndexB\index_i_462.ix 8/29/2010 9:13 PM 2.56 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Identities\{CED66870-B513-4808-9AE5-7A8D8FFE60B9}\Message Store\IndexB\index_k_460.ix 8/29/2010 9:35 AM 64.00 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Identities\{CED66870-B513-4808-9AE5-7A8D8FFE60B9}\Message Store\IndexB\index_k_462.ix 8/29/2010 9:13 PM 64.00 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Identities\{CED66870-B513-4808-9AE5-7A8D8FFE60B9}\Message Store\IndexB\index_klh_460.ix 8/29/2010 9:35 AM 2.30 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Identities\{CED66870-B513-4808-9AE5-7A8D8FFE60B9}\Message Store\IndexB\index_klh_462.ix 8/29/2010 9:13 PM 2.30 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Identities\{CED66870-B513-4808-9AE5-7A8D8FFE60B9}\Message Store\IndexH\index_i_2160.ix 8/29/2010 9:25 AM 9.24 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Identities\{CED66870-B513-4808-9AE5-7A8D8FFE60B9}\Message Store\IndexH\index_i_2165.ix 8/29/2010 9:14 PM 9.26 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Identities\{CED66870-B513-4808-9AE5-7A8D8FFE60B9}\Message Store\IndexH\index_k_2160.ix 8/29/2010 9:25 AM 64.00 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Identities\{CED66870-B513-4808-9AE5-7A8D8FFE60B9}\Message Store\IndexH\index_k_2165.ix 8/29/2010 9:14 PM 64.00 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Identities\{CED66870-B513-4808-9AE5-7A8D8FFE60B9}\Message Store\IndexH\index_klh_2160.ix 8/29/2010 9:25 AM 730 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Identities\{CED66870-B513-4808-9AE5-7A8D8FFE60B9}\Message Store\IndexH\index_klh_2165.ix 8/29/2010 9:14 PM 730 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Runtime\Message\{3E3B3734-9D77-42E2-8010-12622FD17AFC} 8/29/2010 9:08 PM 0 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Runtime\Message\{3E3B3734-9D77-42E2-8010-12622FD17AFC}\Show 8/29/2010 9:08 PM 0 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Runtime\Message\{3E3B3734-9D77-42E2-8010-12622FD17AFC}\Show\ATT1.txt 8/29/2010 9:08 PM 157 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Runtime\Message\{3E3B3734-9D77-42E2-8010-12622FD17AFC}\Show\noScriptHtmlStrWithoutSource_7.htm 8/29/2010 9:08 PM 33.68 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Runtime\Message\{76793D70-666A-4C8C-A98E-B7BA6D74E265} 8/29/2010 9:05 PM 0 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Runtime\Message\{76793D70-666A-4C8C-A98E-B7BA6D74E265}\Show 8/29/2010 9:06 PM 0 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Runtime\Message\{76793D70-666A-4C8C-A98E-B7BA6D74E265}\Show\ATT2.txt 8/29/2010 9:05 PM 157 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Runtime\Message\{76793D70-666A-4C8C-A98E-B7BA6D74E265}\Show\image0011.gif 8/29/2010 9:05 PM 37.65 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Runtime\Message\{76793D70-666A-4C8C-A98E-B7BA6D74E265}\Show\noScriptHtmlStrWithoutSource_7.htm 8/29/2010 9:06 PM 53.96 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Runtime\Message\{76793D70-666A-4C8C-A98E-B7BA6D74E265}\Show\noScriptHtmlStrWithoutSource_Prev_7.htm 8/29/2010 9:05 PM 47.44 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Runtime\Message\{A4C6ED19-964A-45B0-874B-08E1BCA5AEB2} 8/29/2010 9:13 PM 0 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Runtime\Message\{A4C6ED19-964A-45B0-874B-08E1BCA5AEB2}\Show 8/29/2010 9:14 PM 0 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Runtime\Message\{A4C6ED19-964A-45B0-874B-08E1BCA5AEB2}\Show\ATT1.txt 8/29/2010 9:13 PM 157 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Runtime\Message\{A4C6ED19-964A-45B0-874B-08E1BCA5AEB2}\Show\noScriptHtmlStrWithoutSource_7.htm 8/29/2010 9:13 PM 27.37 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\IM\Runtime\Message\{A4C6ED19-964A-45B0-874B-08E1BCA5AEB2}\Show\noScriptHtmlStrWithoutSource_Prev_7.htm 8/29/2010 9:14 PM 20.83 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{A1A46B67-B3E8-11DF-85D2-00E018D8DBC6}.dat 8/29/2010 9:14 PM 4.00 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{AB202F83-B3B0-11DF-85D2-00E018D8DBC6}.dat 8/29/2010 8:27 PM 5.00 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{15CB98BA-B3ED-11DF-85D2-00E018D8DBC6}.dat 8/29/2010 9:14 PM 4.50 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{4612B77A-B3EC-11DF-85D2-00E018D8DBC6}.dat 8/29/2010 9:09 PM 4.50 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{89179830-B3B8-11DF-85D2-00E018D8DBC6}.dat 8/29/2010 8:27 PM 31.50 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B1245E9C-B3B0-11DF-85D2-00E018D8DBC6}.dat 8/29/2010 8:34 PM 57.00 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{B34CD5F4-B3E8-11DF-85D2-00E018D8DBC6}.dat 8/29/2010 8:46 PM 23.50 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{EFA968A6-B3B0-11DF-85D2-00E018D8DBC6}.dat 8/29/2010 8:26 PM 19.50 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Last Active\{862188E0-B3E8-11DF-85D2-00E018D8DBC6}.dat 8/29/2010 8:41 PM 23.50 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Last Active\{8F3FE7DE-B349-11DF-85CF-00E018D8DBC6}.dat 8/29/2010 1:43 AM 6.00 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temp\5FOFKP0J.htm 8/29/2010 8:35 PM 1.29 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temp\FZ7DGY21.htm 8/29/2010 8:35 PM 19.62 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temp\IM\img9F.htm 8/29/2010 9:09 PM 293 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temp\~DF26CB.tmp 8/29/2010 8:45 PM 16.00 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temp\~DF380A.tmp 8/29/2010 9:14 PM 0 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temp\~DF5C09.tmp 8/29/2010 2:58 PM 16.00 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temp\~DF6B4.tmp 8/29/2010 8:28 PM 16.00 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temp\~DFA6C2.tmp 8/29/2010 8:42 PM 0 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temp\~DFB254.tmp 8/29/2010 2:02 PM 16.00 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temp\~DFBC01.tmp 8/29/2010 2:03 PM 24.00 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\04[1].png 8/29/2010 8:44 PM 4.12 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\07[1].png 8/29/2010 8:44 PM 8.76 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\14[1].png 8/29/2010 8:44 PM 4.21 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\60548_r_msn_com[1] 8/29/2010 8:34 PM 0 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\;tile=1;sz=728x90;ord=5848960209795517[1] 8/29/2010 8:44 PM 5.34 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\;tile=2;sz=300x250;ord=7354873219366833[1] 8/29/2010 8:45 PM 5.17 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\av-137467[1].gif 8/29/2010 8:44 PM 18.65 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\aw-logo[1].png 8/29/2010 8:44 PM 968 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\AWdata[1] 8/29/2010 9:14 PM 5.62 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\beacon[1].js 8/29/2010 8:44 PM 1.06 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\bg-fade-bot[1].png 8/29/2010 8:44 PM 727 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\bg-hr[1].gif 8/29/2010 8:44 PM 310 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\block[1].png 8/29/2010 8:44 PM 1.21 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\collapse_generic[1].gif 8/29/2010 8:45 PM 334 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\comment[1].png 8/29/2010 8:44 PM 618 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\divider[1] 8/29/2010 8:35 PM 2.83 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\favicon[1].ico 8/28/2010 9:54 AM 1.37 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\Frank_Neriah(2)_04102010[1].jpg 8/29/2010 8:44 PM 1.47 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\Frank_Neriah(2)_04102010[2].jpg 8/29/2010 8:45 PM 1.47 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\ga[1].js 8/29/2010 8:44 PM 24.55 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\gradient_tcat[1].gif 8/29/2010 8:44 PM 155 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\head2-selected[1].png 8/29/2010 8:44 PM 381 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\headerimg[1] 8/29/2010 8:35 PM 2.96 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\i_safe[1].gif 8/29/2010 9:08 PM 54 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\infobar_translate_auto_offer[1] 8/29/2010 9:14 PM 1.29 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\left_disabled[1] 8/29/2010 8:35 PM 3.58 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\logo_glow_transparent[1] 8/29/2010 9:14 PM 1.36 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\MbrNmbr_Card[1].gif 8/29/2010 8:28 PM 7.32 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\ME AND[1].jpg 8/29/2010 8:45 PM 1.11 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\mootools-1.2.4-core-yc[2].js 8/29/2010 8:44 PM 65.30 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\mootools-1.2.4.4-more[1].js 8/29/2010 8:44 PM 131.15 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\msn_com[1].htm 8/29/2010 2:02 PM 68.44 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\myvideoplayer[1].swf 8/29/2010 9:14 PM 60.20 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\portrait_disabled[1] 8/29/2010 8:35 PM 4.15 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\preview[1] 8/29/2010 8:35 PM 9.81 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\RadioPlayer3[1].swf 8/29/2010 8:44 PM 846.80 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\resize_1[1].gif 8/29/2010 8:44 PM 61 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\resize_horizontal[1] 8/29/2010 8:35 PM 2.97 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\rightmost[1] 8/29/2010 8:35 PM 3.55 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\rss[5].rss 8/29/2010 9:13 PM 790 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\search_user[1].png 8/29/2010 8:44 PM 3.89 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\searchlight_box[1].png 8/29/2010 8:44 PM 10.89 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\searchlight_bubble[1].png 8/29/2010 8:44 PM 1.67 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\spacer1[1].htm 8/29/2010 8:28 PM 1.60 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\subscribe[1].gif 8/29/2010 8:44 PM 1.08 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\vbulletin_quick_comment[1].js 8/29/2010 8:45 PM 5.50 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\videosflash[1].htm 8/29/2010 9:14 PM 1.04 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\ysmcc[1].gif 8/29/2010 8:28 PM 43 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\9V7FBEH3\ysmcc[2].gif 8/29/2010 8:29 PM 43 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\addthis_widget[1].js 8/29/2010 8:44 PM 38.60 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\animation-min[1].js 8/29/2010 8:44 PM 13.45 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\Athlon XP[1].JPG 8/29/2010 8:45 PM 1.77 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\bd[1].jpg 8/29/2010 9:14 PM 107.30 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\bold[1].gif 8/29/2010 8:44 PM 77 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\calendar-setup[1].js 8/29/2010 8:28 PM 8.11 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\collapse_thead[1].gif 8/29/2010 8:44 PM 334 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\connection-min[1].js 8/29/2010 8:44 PM 11.33 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\crossdomain[1].xml 8/29/2010 9:09 PM 298 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\crossdomain[2].xml 8/29/2010 9:09 PM 298 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\crossdomain[3].xml 8/29/2010 9:13 PM 102 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\crossdomain[4].xml 8/29/2010 9:13 PM 102 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\crossdomain[5].xml 8/29/2010 9:13 PM 102 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\default[1].jpg 8/29/2010 9:13 PM 3.55 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\default[2].jpg 8/29/2010 9:13 PM 3.04 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\endscreen-vfl186120[1].swf 8/29/2010 9:12 PM 24.11 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\favicon[1].ico 8/27/2010 8:39 PM 1.12 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\gradient_message[1].gif 8/29/2010 8:45 PM 826 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\Image1[1].jpg 8/29/2010 8:45 PM 9.24 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\italic[1].gif 8/29/2010 8:44 PM 79 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\landscape[1] 8/29/2010 8:35 PM 3.39 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\left[1] 8/29/2010 8:35 PM 3.59 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\microsoft_adcenterconversion[1].js 8/29/2010 8:34 PM 1.46 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\multiquote_off[1].png 8/29/2010 8:44 PM 348 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\new[1].png 8/29/2010 8:44 PM 4.06 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\photo[1].png 8/29/2010 8:44 PM 220 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\pl[2].jpg 8/29/2010 9:14 PM 1.35 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\play[2].jpg 8/29/2010 9:14 PM 954 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\preview[1] 8/29/2010 8:35 PM 67.18 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\prince_of_persia_the_two_thrones_3wallpaper91-2[1].jpg 8/29/2010 8:45 PM 1.50 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\printimg_down[1] 8/29/2010 8:35 PM 4.00 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\quicksearch[1].css 8/29/2010 8:44 PM 4.31 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\removeformat[1].gif 8/29/2010 8:44 PM 114 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\renew[1].htm 8/29/2010 8:28 PM 334 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\rightmost_disabled[1] 8/29/2010 8:35 PM 3.53 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\rr[1].jpg 8/29/2010 9:14 PM 822 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\rss[6].rss 8/29/2010 8:53 PM 790 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\searchlight_quicksearch[1].js 8/29/2010 8:44 PM 3.53 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\tb_back[1] 8/29/2010 8:35 PM 2.82 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\techguy.full[1].js 8/29/2010 8:44 PM 8.95 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\TmnAdsense-min[1].js 8/29/2010 8:44 PM 4.19 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\tourada1[1].flv 8/29/2010 9:16 PM 14.47 MB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\touros4[1].jpg 8/29/2010 9:14 PM 341.18 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\trusted-advisor[1].png 8/29/2010 8:44 PM 729 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\TSG-Logo[1].png 8/29/2010 8:44 PM 4.45 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\underline[1].gif 8/29/2010 8:44 PM 88 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\unknown[1].gif 8/29/2010 8:45 PM 129 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\urchin[1].js 8/29/2010 8:28 PM 22.15 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\vbulletin_ajax_tagsugg[1].js 8/29/2010 8:44 PM 5.21 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\vbulletin_global[1].js 8/29/2010 8:44 PM 25.42 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\vbulletin_important[1].css 8/29/2010 8:44 PM 1.65 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\vbulletin_menu.MJC[1].js 8/29/2010 8:44 PM 13.07 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\vbulletin_quick_reply[1].js 8/29/2010 8:44 PM 5.34 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\vbulletin_tabctrl[1].js 8/29/2010 8:45 PM 8.14 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\videoplayback[1] 8/29/2010 9:11 PM 26.28 MB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\watch_as3-vfl186120[1].swf 8/29/2010 9:09 PM 135.28 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\widget42[1].css 8/29/2010 8:44 PM 51.75 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\yahoo-dom-event[1].js 8/29/2010 8:44 PM 35.77 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\ysmcc[1].gif 8/29/2010 8:29 PM 43 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\ysmcc[2].gif 8/29/2010 8:30 PM 43 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\Q4L5E2ZP\zoompage[1] 8/29/2010 8:35 PM 3.19 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\11x11progress[1].gif 8/29/2010 8:44 PM 537 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\3[1].htm 8/29/2010 9:14 PM 3 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\946470-slow-computer-shuts-down-itself[1].html 8/29/2010 8:45 PM 114.37 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\;tile=1;sz=728x90;ord=3243758179737104[1].5 8/29/2010 8:45 PM 5.29 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\;tile=1;sz=728x90;ord=4474990338084120[1] 8/29/2010 8:45 PM 5.67 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\AWdata[1] 8/29/2010 6:04 PM 5.64 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\back[1].png 8/29/2010 8:44 PM 708 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\Battle_Of_The_Planets_-_Emblem[1].gif 8/29/2010 8:45 PM 254 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\bl-out[1].png 8/29/2010 8:44 PM 275 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\br-out[1].png 8/29/2010 8:44 PM 263 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\calendar-en[1].js 8/29/2010 8:28 PM 3.37 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\cermaktech[1].gif 8/29/2010 8:44 PM 895 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\clear[1].gif 8/29/2010 8:44 PM 43 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\color[1].gif 8/29/2010 8:44 PM 89 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\container-min[1].js 8/29/2010 8:44 PM 73.19 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\conversion[1].js 8/29/2010 8:34 PM 4.53 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\createlink[1].gif 8/29/2010 8:44 PM 195 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\favicon[1].ico 8/28/2010 12:04 AM 1.12 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\gradient_thead[1].gif 8/29/2010 8:44 PM 144 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\helpimg[1] 8/29/2010 8:35 PM 3.78 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\index2[1].html 8/29/2010 3:27 PM 99.41 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\infobar_gradient[1] 8/29/2010 9:14 PM 837 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\insertimage[1].gif 8/29/2010 8:44 PM 149 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\menu_open[1].gif 8/29/2010 8:44 PM 279 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\menu_open_usercss[1].gif 8/29/2010 8:45 PM 82 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\menupop[1].gif 8/29/2010 8:44 PM 56 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\myvideoplayer[1].xml 8/29/2010 9:14 PM 2.70 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\ncode_imageresizer[1].js 8/29/2010 8:44 PM 6.19 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\Phantom[1].gif 8/29/2010 8:44 PM 19.43 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\pixel-vfl73[1].gif 8/29/2010 9:09 PM 43 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\printimg[1] 8/29/2010 8:35 PM 3.25 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\printimg_hover[2] 8/29/2010 8:35 PM 3.98 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\reply[1].gif 8/29/2010 8:44 PM 1.04 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\resize_0[1].gif 8/29/2010 8:44 PM 61 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\right[1] 8/29/2010 8:35 PM 3.60 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\rss[3].rss 8/29/2010 8:33 PM 790 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\rss[4].rss 8/29/2010 9:03 PM 790 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\ScriptServlet[1] 8/29/2010 8:28 PM 1.54 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\searchlight_close[1].png 8/29/2010 8:44 PM 2.10 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\searchlight_progress[1].gif 8/29/2010 8:44 PM 10.57 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\separator[1].gif 8/29/2010 8:44 PM 59 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\server[1].gif 8/29/2010 8:44 PM 351 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\server[2].gif 8/29/2010 8:45 PM 409 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\settings[1] 8/29/2010 8:35 PM 3.78 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\smile[1].gif 8/29/2010 8:44 PM 1.04 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\style[1].css 8/29/2010 8:28 PM 2.33 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\switchmode[1].gif 8/29/2010 8:44 PM 127 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\tb_centre[1] 8/29/2010 8:35 PM 3.03 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\user_offline[1].gif 8/29/2010 8:44 PM 348 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\user_online[1].gif 8/29/2010 8:44 PM 346 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\validate-functions[1].js 8/29/2010 8:28 PM 2.62 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\validate-generic[1].js 8/29/2010 8:28 PM 31.83 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\vbulletin_post_loader[1].js 8/29/2010 8:44 PM 1.99 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\widget22[1].png 8/29/2010 8:44 PM 39.32 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\WMLRJ2V1\wpad[1].dat 8/29/2010 8:43 PM 64 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\1065812885[1].htm 8/29/2010 8:34 PM 64 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\3[1].htm 8/29/2010 8:34 PM 3 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\946470-slow-computer-shuts-down-itself[2].html 8/29/2010 2:04 PM 110.20 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\;tile=2;sz=300x250;ord=8772985275269278[1] 8/29/2010 8:44 PM 5.17 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\addpoll[1].gif 8/29/2010 8:44 PM 1.08 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\Animaniacs_-_Hello_Nurse[1].gif 8/29/2010 8:45 PM 321 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\calendar[1].js 8/29/2010 8:28 PM 46.13 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\carp_med[1].gif 8/29/2010 8:28 PM 9.70 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\collapse_tcat[1].gif 8/29/2010 8:44 PM 246 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\computer[1].gif 8/29/2010 8:44 PM 202 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\crossdomain[1].xml 8/29/2010 9:09 PM 102 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\default[1].jpg 8/29/2010 9:13 PM 3.57 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\default[2].jpg 8/29/2010 9:13 PM 2.29 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\default[3].jpg 8/29/2010 9:13 PM 3.60 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\exclamation[1].gif 8/29/2010 8:45 PM 3.27 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\favicon[1].ico 8/28/2010 9:11 AM 2.19 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\ff[1].jpg 8/29/2010 9:14 PM 834 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\firstnew[1].gif 8/29/2010 8:44 PM 85 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\ga[1].js 8/29/2010 8:28 PM 24.55 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\header1-bg[1].png 8/29/2010 8:44 PM 208 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\hippo_ajax_form[1].js 8/29/2010 8:28 PM 4.17 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\infobar[1] 8/29/2010 9:14 PM 2.06 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\infobar_close[1] 8/29/2010 9:14 PM 291 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\leftmost[1] 8/29/2010 8:35 PM 3.55 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\leftmost_disabled[1] 8/29/2010 8:35 PM 3.52 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\MbrNmbr_Mail[1].gif 8/29/2010 8:28 PM 3.65 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\minimize_icon[1].gif 8/29/2010 8:44 PM 61 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\portrait[1] 8/29/2010 8:35 PM 3.34 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\printer[1].gif 8/29/2010 8:44 PM 1.05 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\progress[1].gif 8/29/2010 8:44 PM 701 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\quote[1].gif 8/29/2010 8:44 PM 122 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\resize_vertical[1] 8/29/2010 8:35 PM 2.95 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\right_disabled[1] 8/29/2010 8:35 PM 3.58 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\rounded[1].css 8/29/2010 8:44 PM 578 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\rss[6].rss 8/29/2010 8:43 PM 790 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\sendtofriend[1].gif 8/29/2010 8:44 PM 1.10 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\server[1].gif 8/29/2010 8:45 PM 351 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\spacer[1].gif 8/29/2010 8:28 PM 43 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\spelling[1].gif 8/29/2010 8:44 PM 99 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\Star_Trek_-_Troi[1].gif 8/29/2010 8:45 PM 445 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\style[1].css 8/29/2010 8:44 PM 7.26 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\TechSupportGuy[1].png 8/29/2010 8:44 PM 10.51 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\tl-out[1].png 8/29/2010 8:44 PM 272 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\tr-out[1].png 8/29/2010 8:44 PM 270 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\twitter_small[1].png 8/29/2010 8:44 PM 758 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\vbulletin_ajax_taglist[1].js 8/29/2010 8:44 PM 4.51 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\vbulletin_editor[1].css 8/29/2010 8:44 PM 3.15 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\vbulletin_multi_quote[1].js 8/29/2010 8:44 PM 1.76 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\vbulletin_quick_edit[1].js 8/29/2010 8:44 PM 10.18 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\vbulletin_quick_edit_generic[1].js 8/29/2010 8:45 PM 12.45 KB Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\vbulletin_quick_edit_visitormessage[1].js 8/29/2010 8:45 PM 423 bytes Hidden from Windows API.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Local Settings\Temporary Internet Files\Content.IE5\XEZEU9RS\vbulletin_tabctrl[1].css 8/29/2010 8:45 PM 1.34 KB Hidden fr


----------



## flavallee (May 12, 2002)

Uninstall these programs because they're either not needed or are outdated or are dangerous to use.

*uTorrent

Adobe AIR

Advanced SystemCare 3

Apple Software Update

BitComet 1.22

CA Yahoo Anti-Spy

Cookienator

Defraggler

FileHippo.com Update Checker

Google Update Helper

Google Updater

K-Lite Codec Pack 5.1.0 Standard* - The current version is 6.3.0

*PC Pitstop Driver Alert2 2.0.0.0

PC Pitstop Optimize3 3.0

Revo Uninstaller 1.83* - The current version is 1.89

*Spybot - Search & Destroy

XoftSpySE*

You've got over-kill with toolbars. You decide which ones you don't really need or use, then get rid of them.

----------------------------------------------------------------

Install this program to replace Spybot - Search & Destroy and CA Yahoo Anti-Spy and XoftSpySE.

*Malwarebytes Anti-Malware 1.46*

It works well with SUPERAntiSpyware for combating malware and spyware.

After you first update the definition files, run a quick scan with each one, then select and remove everything each one finds.

In your case, I recommend doing this at least once a week.

----------------------------------------------------------------


----------



## ivory1982 (Mar 14, 2009)

Hello flavallee.
Thank you for your help, I've got rid of most of the items on the list, except 
Advanced System Care , PC Pitstop Optimize and XoftSpySE. I actually paid for these programs!! Do you think that they are causing me more trouble then their worth? I could let the programs expire when they come up for renewel.
Ivory


----------



## ivory1982 (Mar 14, 2009)

Phantom 010.
Thank you, I have requested to have my post moved as you suggested.
Ivory


----------



## flavallee (May 12, 2002)

ivory1982 said:


> Hello flavallee.
> Thank you for your help, I've got rid of most of the items on the list, except
> Advanced System Care , PC Pitstop Optimize and XoftSpySE. I actually paid for these programs!! Do you think that they are causing me more trouble then their worth? I could let the programs expire when they come up for renewel.
> Ivory


*IObit Advanced SystemCare* and *PC PitStop Optimize* are a waste a money and are generally useless for improving speed or performance in a computer. Stay away from cleaner/booster/optimizer/tuneup type programs, especially the ones that fix "errors" in the registry. You're risking having broken programs and a damaged operating system.

I have no idea how reliable or efficient *ParetoLogic XoftSpySE* is for detecting and removing malware/spyware, so I'll let someone else comment on it.

--------------------------------------------------------------

Your thread is now in the "Virus & Other Malware Removal" section. Be patient and wait for a gold shield malware expert to reply and assist you.

-------------------------------------------------------------


----------



## ivory1982 (Mar 14, 2009)

Good morning Flavallee.
Thank you for your honest opinion. I will get rid of those programs also. Last night I was reading other threads and I decided to run ComboFix. Today when I started up my computer is running a lot better?
Should I post those results here or wait and post in the Virus& Other Malware Removal section??


----------



## flavallee (May 12, 2002)

Running *ComboFix* without the guidance of a gold shield malware expert or a qualified person is asking for trouble. You're lucky that you didn't crash your computer. 

Wait for a gold shield malware expert to reply to you. If that person wants to see the ComboFix results, you'll be advised.

----------------------------------------------------------------


----------



## ivory1982 (Mar 14, 2009)

Hello Florallee.
Thank you, I guess I lucked out this time. Will take your advise.


----------



## flavallee (May 12, 2002)

ivory1982 said:


> Hello Florallee.
> Thank you, I guess I lucked out this time. Will take your advise.


You definitely lucked out. 

I'll still be monitoring your thread while it's in this section. :up:

----------------------------------------------------------------


----------



## ivory1982 (Mar 14, 2009)

Hello Flavallee.
Thank you for your help, my wife doesn't agree that the computer is any faster at all. Would it be okay to post the ComboFix report on this site?


----------



## SweetTech (Jan 1, 1970)

Please post the ComboFix log.


----------



## ivory1982 (Mar 14, 2009)

Here's the ComboFix report
ComboFix 10-08-30.02 - Terry 08/30/2010 23:30:24.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.568 [GMT -7:00]
Running from: c:\documents and settings\Terry.TERRY-B534F8A5F\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Webroot AntiVirus with Spy Sweeper *On-access scanning disabled* (Updated) {77E10C7F-2CCA-4187-9394-BDBC267AD597}
.
((((((((((((((((((((((((( Files Created from 2010-07-28 to 2010-08-31 )))))))))))))))))))))))))))))))
.
2010-08-31 04:49 . 2010-08-31 04:49 -------- d-----w- c:\program files\Trend Micro
2010-08-31 01:50 . 2010-08-31 01:50 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\AnvSoft
2010-08-31 01:50 . 2010-08-31 01:50 -------- d-----w- c:\program files\AnvSoft
2010-08-30 16:01 . 2010-01-27 07:08 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-08-27 02:10 . 2010-08-27 02:10 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Seagate
2010-08-27 02:08 . 2010-08-27 15:34 -------- d-----w- c:\program files\Carbonite
2010-08-27 02:08 . 2010-08-27 02:08 -------- d-sh--w- c:\windows\ftpcache
2010-08-27 02:05 . 2010-08-30 23:30 -------- d-----w- c:\program files\Seagate
2010-08-27 01:55 . 2010-08-27 01:55 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Leadertech
2010-08-15 06:13 . 2010-08-28 07:24 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\vlc
2010-08-12 04:56 . 2010-08-12 04:56 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-08-12 04:52 . 2010-08-12 04:52 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\Sunbelt Software
2010-08-12 04:49 . 2010-08-12 04:56 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft
2010-08-11 17:45 . 2010-08-11 17:45 -------- d-----w- c:\program files\IObit
2010-08-11 06:23 . 2010-08-11 06:29 -------- d-----w- C:\a474ec38c02ee7b8b30816e6c7
2010-08-11 06:01 . 2010-08-11 06:01 -------- d-----w- c:\program files\CCleaner
2010-08-09 15:06 . 2010-08-09 15:06 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2010-08-08 15:01 . 2010-08-08 15:01 503808 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-530930eb-n\msvcp71.dll
2010-08-08 15:01 . 2010-08-08 15:01 61440 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-25cd66fb-n\decora-sse.dll
2010-08-08 15:01 . 2010-08-08 15:01 499712 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-530930eb-n\jmc.dll
2010-08-08 15:01 . 2010-08-08 15:01 348160 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-530930eb-n\msvcr71.dll
2010-08-08 15:01 . 2010-08-08 15:01 12800 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-25cd66fb-n\decora-d3d.dll
2010-08-08 05:16 . 2010-08-08 05:16 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\TreeCardGames
2010-08-08 05:14 . 2010-08-08 05:14 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\TreeCardGames
2010-08-08 05:13 . 2010-08-08 05:13 -------- d-----w- c:\program files\123 Free Solitaire
2010-08-04 03:25 . 2010-08-04 03:27 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Similarity
2010-08-04 03:25 . 2010-08-04 03:25 3310080 ----a-r- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Microsoft\Installer\{0990B0DC-C629-4330-A7A5-1F1777D9A7A0}\Similarity.exe
2010-08-04 03:25 . 2010-08-04 03:25 -------- d-----w- c:\program files\Similarity
2010-08-02 04:48 . 2010-08-02 04:48 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\AVS4YOU
2010-08-02 04:10 . 2010-08-02 04:10 -------- d-----w- c:\program files\Common Files\Java
2010-08-02 04:09 . 2010-08-02 04:09 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-08-02 04:04 . 2010-08-02 05:01 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-08-02 04:04 . 2010-08-02 05:01 -------- d-----w- c:\program files\AVS4YOU
2010-08-02 04:04 . 2010-08-02 04:48 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\AVS4YOU
2010-08-02 04:04 . 2008-08-13 18:22 24576 ----a-w- c:\windows\system32\msxml3a.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-31 06:22 . 2010-04-05 05:41 0 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\prvlcl.dat
2010-08-31 06:08 . 2009-03-14 04:42 -------- d-----w- c:\program files\BitComet
2010-08-31 06:07 . 2009-11-13 07:43 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\uTorrent
2010-08-31 05:44 . 2009-05-07 06:25 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Skype
2010-08-31 05:22 . 2010-07-09 05:32 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\BitComet
2010-08-31 04:02 . 2009-07-18 12:59 1632 ----a-w- c:\windows\system32\d3d8caps.dat
2010-08-31 03:52 . 2010-07-02 06:12 63488 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-08-31 03:52 . 2010-07-02 06:12 117760 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-08-31 01:54 . 2010-05-24 08:13 -------- d---a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2010-08-31 00:12 . 2009-12-25 04:22 1744 ----a-w- c:\windows\system32\d3d9caps.dat
2010-08-30 23:41 . 2009-08-15 05:30 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Any DVD Converter Professional
2010-08-30 23:35 . 2009-05-05 20:55 85960 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-08-30 23:28 . 2009-03-05 23:57 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-08-30 23:17 . 2009-09-07 05:51 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Vso
2010-08-30 23:17 . 2009-09-07 05:51 47360 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\pcouffin.sys
2010-08-30 23:17 . 2009-09-07 05:51 47360 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\pcouffin.sys
2010-08-30 23:12 . 2009-11-24 18:27 -------- d-----w- c:\program files\Cheetah Burner
2010-08-30 23:03 . 2009-05-07 06:27 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\skypePM
2010-08-30 15:57 . 2009-10-01 06:54 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-08-30 15:46 . 2010-04-02 06:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-30 15:41 . 2009-11-07 01:00 -------- d-----w- c:\program files\PCPitstop
2010-08-30 15:40 . 2009-03-07 02:27 -------- d-----w- c:\program files\Google
2010-08-30 15:37 . 2009-05-10 07:22 -------- d-----w- c:\program files\Apple Software Update
2010-08-30 05:06 . 2009-05-22 05:26 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\PCPitstop
2010-08-29 04:55 . 2010-05-24 08:15 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\dvdcss
2010-08-28 15:09 . 2009-11-04 03:33 -------- d-----w- c:\program files\uTorrent
2010-08-28 03:25 . 2009-03-11 02:30 -------- d-----w- c:\program files\QuickTime
2010-08-27 05:05 . 2010-05-24 06:45 -------- d-----w- c:\program files\Movavi Video Converter 9
2010-08-27 02:07 . 2009-10-02 15:55 50 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\WinPatrol\Autoexec.bat
2010-08-24 15:56 . 2009-05-05 22:54 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2010-08-22 17:52 . 2009-10-23 02:07 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\CanonIJPLM
2010-08-13 03:42 . 2009-05-01 16:20 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-08-11 05:55 . 2010-03-10 06:25 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\avg9
2010-08-09 16:43 . 2010-07-25 03:33 -------- d-----w- c:\program files\ZwankySearch
2010-08-07 18:59 . 2010-05-21 18:43 -------- d-----w- c:\program files\Microsoft LifeCam
2010-08-02 03:54 . 2009-05-10 07:35 -------- d-----w- c:\program files\Recuva
2010-07-31 05:12 . 2010-07-31 05:11 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-07-31 05:12 . 2009-10-31 01:47 -------- d-----w- c:\program files\iTunes
2010-07-31 05:11 . 2009-10-31 01:47 -------- d-----w- c:\program files\iPod
2010-07-31 05:04 . 2009-05-10 07:23 -------- d-----w- c:\program files\Bonjour
2010-07-31 05:01 . 2010-07-31 05:01 73000 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe
2010-07-30 23:36 . 2010-06-01 04:37 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\PhotoScape
2010-07-29 23:34 . 2009-10-23 02:11 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\CanonIJ
2010-07-29 04:01 . 2010-07-29 04:00 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-07-27 14:26 . 2009-03-06 18:08 -------- d-----w- c:\program files\IncrediMail
2010-07-27 07:59 . 2009-09-24 07:00 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Media Player Classic
2010-07-25 06:25 . 2009-08-29 18:53 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\MP3Rocket
2010-07-25 06:06 . 2009-08-29 18:52 -------- d-----w- c:\program files\MP3 Rocket
2010-07-25 03:33 . 2010-07-25 03:33 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\ZwankySearch
2010-07-25 03:33 . 2010-07-25 03:33 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Mp3Rocket Toolbar
2010-07-23 20:20 . 2010-07-25 03:33 57624 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\ZwankySearch\zwankysearch142.exe
2010-07-18 01:59 . 2010-02-23 00:53 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Smilebox
2010-07-17 06:39 . 2010-05-24 08:00 -------- d-----w- c:\program files\MyVideoConverter
2010-07-15 16:11 . 2009-05-05 20:36 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-15 16:11 . 2010-07-15 16:11 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-07-15 16:10 . 2009-05-05 20:36 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-07-05 10:34 . 2010-07-05 05:46 -------- d-----w- c:\program files\Incomplete
2010-07-02 06:12 . 2010-07-02 06:12 52224 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-06-30 12:31 . 2004-08-04 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-29 09:47 . 2010-01-19 12:34 304448 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Smilebox\SmileboxTray.exe
2010-06-29 09:47 . 2010-01-19 12:34 230720 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Smilebox\SmileboxDvd.exe
2010-06-29 09:47 . 2010-01-19 12:23 410944 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Smilebox\SmileboxStarter.exe
2010-06-29 09:47 . 2010-01-19 11:45 169280 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Smilebox\SmileboxBrowserEngine.dll
2010-06-29 09:31 . 2010-06-29 09:31 1635648 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Smilebox\SmileboxClient.exe
2010-06-29 08:38 . 2010-06-29 08:38 365888 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Smilebox\SmileboxDvdEngine.dll
2010-06-29 08:38 . 2010-06-29 08:38 140608 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Smilebox\SmileboxUpdater.exe
2010-06-24 12:22 . 2004-08-04 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 19:28 . 2010-06-23 19:28 501936 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Google\Google Toolbar\Update\gtbE.tmp.exe
2010-06-23 13:44 . 2004-08-04 12:00 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-04 12:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2004-08-04 12:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2009-05-05 17:50 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2004-08-04 12:00 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-06-03 02:41 . 2010-06-03 02:41 3600384 ----a-w- c:\windows\system32\GPhotos.scr
2010-06-02 18:23 . 2009-05-05 20:36 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{13E0B548-6FC9-47E9-9874-470915F46548}"= "c:\program files\Cdcovers\tbCdc0.dll" [2010-05-24 2515552]
[HKEY_CLASSES_ROOT\clsid\{13e0b548-6fc9-47e9-9874-470915f46548}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2010-05-31 323976]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-15 2065760]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-07-15 16:11 12536 ----a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 3]
2010-08-10 22:10 2349776 ----a-w- c:\program files\IObit\Advanced SystemCare 3\AWC.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dvd43]
2008-04-09 17:00 826880 ----a-w- c:\program files\dvd43\DVD43_Tray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-07-21 22:53 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2008-05-28 15:27 570664 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2006-10-11 20:45 75304 ----a-w- c:\program files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-05-13 23:12 26192168 ----a-r- c:\program files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2010-07-19 17:50 2403568 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WrtMon.exe]
2006-09-20 15:35 20480 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XoftSpySE]
2009-10-23 21:58 4854040 ----a-w- c:\program files\XoftSpySE6\XoftSpySE.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\MP3 Rocket\\MP3Rocket.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"61567:TCP"= 61567:TCP:utorrent
"61567:UDP"= 61567:UDP:utorrent
"14329:TCP"= 14329:TCP:BitComet 14329 TCP
"14329:UDP"= 14329:UDP:BitComet 14329 UDP
"18185:TCP"= 18185:TCP:BitComet 18185 TCP
"18185:UDP"= 18185:UDP:BitComet 18185 UDP
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/5/2009 1:36 PM 216400]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/5/2009 1:36 PM 243024]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 11:41 AM 67656]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [7/15/2010 9:10 AM 921952]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/15/2010 9:11 AM 308136]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/30/2010 10:51 PM 135664]
S2 PCPitstop Scheduling;PCPitstop Scheduling; [x]
S3 FWAKZZZEGJO;FWAKZZZEGJO;c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\FWAKZZZEGJO.exe --> c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\FWAKZZZEGJO.exe [?]
S3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys --> c:\windows\system32\DRIVERS\ivusb.sys [?]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
S3 PH;PH;c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\PH.exe --> c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\PH.exe [?]
S3 SUTB;SUTB;c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\SUTB.exe --> c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\SUTB.exe [?]
S3 U;U;c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\U.exe --> c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\U.exe [?]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys --> c:\windows\system32\DRIVERS\wdcsam.sys [?]
S3 WZKQTSHUIQ;WZKQTSHUIQ;c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\WZKQTSHUIQ.exe --> c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\WZKQTSHUIQ.exe [?]
S3 XoftSpyService;XoftSpyService;c:\program files\Common Files\XoftSpySE\6\xoftspyservice.exe [10/23/2009 2:58 PM 582424]
S4 Mp3Rocket Toolbar Helper;Mp3Rocket Toolbar Helper;c:\program files\MP3 Rocket Toolbar\Mp3RocketSvc.exe --> c:\program files\MP3 Rocket Toolbar\Mp3RocketSvc.exe [?]
S4 ZTQESA;ZTQESA;c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\ZTQESA.exe --> c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\ZTQESA.exe [?]
.
Contents of the 'Scheduled Tasks' folder
2010-08-31 c:\windows\Tasks\AWC AutoSweep.job
- c:\program files\IObit\Advanced SystemCare 3\AutoSweep.exe [2010-08-11 21:11]
2010-08-30 c:\windows\Tasks\AWC Update.job
- c:\program files\IObit\Advanced SystemCare 3\IObitUpdate.exe [2010-08-11 18:08]
2010-08-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 05:51]
2010-08-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 05:51]
2010-08-31 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2009-08-28 21:15]
2010-08-26 c:\windows\Tasks\ParetoLogic Update Version3.job
- c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2009-08-28 21:15]
2010-08-31 c:\windows\Tasks\User_Feed_Synchronization-{169DA464-CD97-4C76-956B-A938F5CB7193}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 12:31]
2010-07-28 c:\windows\Tasks\XoftSpySE_sch_D1AFD6A2-B10F-11DE-9623-00E018D8DBC6.job
- c:\program files\XoftSpySE6\XoftSpySELauncher.exe [2009-10-23 21:58]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.msn.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://search.alot.com/web?q=&pr=auto&client_id=A53F631001CB134F01B7556B&src_id=11176&camp_id=-6&tb_version=2.5.12000.509
IE: &Add animation to IncrediMail Style Box - c:\program files\IncrediMail\bin\resources\WebMenuImg.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Mozilla\Firefox\Profiles\h92eyza4.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\components\SEPsearchhelperff.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); 
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-30 23:36
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ... 
scanning hidden autostart entries ... 
scanning hidden files ... 
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d6,c0,55,c7,25,0c,e0,4e,ac,a1,e4,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d6,c0,55,c7,25,0c,e0,4e,ac,a1,e4,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(672)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
- - - - - - - > 'explorer.exe'(3072)
c:\windows\system32\WININET.dll
c:\program files\MediaMonkey\DeskPlayer.dll
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-08-30 23:39:07
ComboFix-quarantined-files.txt 2010-08-31 06:39
ComboFix2.txt 2010-08-31 06:14
Pre-Run: 81,179,688,960 bytes free
Post-Run: 81,165,959,168 bytes free
- - End Of File - - 0CB643D4A0F781593DBF4FED23F10DDC


----------



## SweetTech (Jan 1, 1970)

Hello,

I would also like to see a list of files quarantined by ComboFix, so please do this:
Click *Start > Run* then copy/paste the following single-line command into the Run box and click *OK*:

*C:\Qoobox\ComboFix-quarantined-files.txt*

A text file should open. Post the contents of that file in your next reply.

*NEXT:*

*ComboFix Script*

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. 
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

*Copy/paste the text inside the Codebox below into notepad:*

Here's how to do that:
Click* Start > Run* type *Notepad* click *OK.*
This will open an empty notepad file:

*Copy* all the text *inside of the code box* - *Press Ctrl+C* (or right click on the highlighted section and choose 'copy')


```
KillAll::
Driver::
PCPitstop Scheduling
FWAKZZZEGJO
Lavasoft Kernexplorer
PH
SUTB
U
WZKQTSHUIQ
Mp3Rocket Toolbar Helper
ZTQESA

File::
c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\FWAKZZZEGJO.exe
c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys
c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\PH.exe
c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\SUTB.exe
c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\U.exe
c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\WZKQTSHUIQ.exe
c:\program files\MP3 Rocket Toolbar\Mp3RocketSvc.exe
c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\ZTQESA.exe
```
Now *paste* the copied text into the open notepad - press *CTRL+V* (or right click and choose 'paste')
*
Save this file to your desktop, Save this as "CFScript"*

Here's how to do that:

1.Click *File*;
2.Click *Save As*... Change the directory to your *desktop*;
3.Change the* Save as type* to *"All Files";*
4.Type in the file name: *CFScript*
5.Click *Save ...*










Referring to the *screenshot* above, *drag CFScript.txt* into *ComboFix.exe.*
ComboFix will now run a scan on your system. If ComboFix prompts you to update to the newest version, please allow it to do so. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. 
*Copy and paste the contents of the log in your next reply.*

CAUTION: *Do not* mouse-click ComboFix's window while it is running. That may cause it to stall.

*NEXT:*

*Malwarebytes' Anti-Malware*

I see that you have *Malwarebytes' Anti-Malware* installed on your computer could you please do a scan using these settings:


Open Malwarebytes' Anti-Malware
Select the *Update* tab
Click *Check for Updates*
After the update have been completed, Select the *Scanner* tab.
Select *Perform quick scan*, then click on *Scan*
Leave the default options as it is and click on *Start Scan*
When done, you will be prompted. Click *OK*, then click on *Show Results*
Checked (ticked) all items and click on *Remove Selected*
After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the *Logs* tab. The bottom most log is the latest
*Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.*

*NEXT:*

*ESET Online Scanner*
*I'd like us to scan your machine with ESET Online Scan*

*Note:* *It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.*



Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the







button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
Click on







to download the ESET Smart Installer. *Save* it to your desktop.
Double click on the







icon on your desktop.

Check








Click the







button.
Accept any security warnings from your browser.
Check








Make sure that the option "Remove found threats" is Unchecked
Push the *Start* button.
ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
When the scan completes, push








Push







, and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply.
Push the







button.
Push








*NEXT:*

*Security Check*
Download *Security Check* by screen317 from *here* or *here*.
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called *checkup.txt*; please post the contents of that document.


----------



## ivory1982 (Mar 14, 2009)

Hello SweetTech.
I'm really a beginner with computers and especially using this forum.The CombFix file your requesting is the following one. The other items you mentioned I'll give that a go also.
Thank you

ComboFix 10-08-30.02 - Terry 08/30/2010 23:00:00.1.1 - x86
Running from: c:\documents and settings\Terry.TERRY-B534F8A5F\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Webroot AntiVirus with Spy Sweeper *On-access scanning disabled* (Updated) {77E10C7F-2CCA-4187-9394-BDBC267AD597}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\BrowserSearch\BrowserSearch.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\BrowserSearch\BrowserSearch.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_0\Button_0.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_0\Button_0.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_1\Button_1.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_1\Button_1.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_2\Button_2.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_2\Button_2.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_208\Button_208.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_208\Button_208.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_209\Button_209.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_209\Button_209.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_210\Button_210.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_210\Button_210.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_211\Button_211.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_211\Button_211.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_212\Button_212.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_212\Button_212.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_213\Button_213.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_213\Button_213.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_214\Button_214.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_214\Button_214.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_3\Button_3.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Button_3\Button_3.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\configurator\configurator.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\configurator\configurator.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\contextMenu\contextMenu.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\contextMenu\contextMenu.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\ErrorSearch\ErrorSearch.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\ErrorSearch\ErrorSearch.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\postInstallLayout\postInstallLayout.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\postInstallLayout\postInstallLayout.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\products\products.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\products\products.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\BrowserSearch\alot_search_defend.html
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\BrowserSearch\images\favicon.ico
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_0\images\alot_logo_button.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_0\images\alot_logo_button.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_1\images\alot_image_search.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_1\images\alot_image_search.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_1\images\alot_news_search.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_1\images\alot_news_search.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_1\images\alot_search_button.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_1\images\alot_search_button.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_1\images\alot_shop_search.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_1\images\alot_shop_search.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_1\images\alot_videos_search.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_1\images\alot_videos_search.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_1\images\alot_web_search.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_1\images\alot_web_search.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_10\images\default_1667_www.youtube.com_button.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_10\images\default_1667_www.youtube.com_button.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_2\images\alot_configure.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_2\images\alot_configure.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_201\images\default_1008_alot_map_widget_default.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_201\images\default_1008_alot_map_widget_default.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_202\images\default_1008_alot_map_widget_default.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_202\images\default_1008_alot_map_widget_default.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_203\images\default_1008_alot_map_widget_default.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_203\images\default_1008_alot_map_widget_default.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_204\images\default_1008_alot_map_widget_default.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_204\images\default_1008_alot_map_widget_default.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_205\images\cloudy.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_205\images\default_1007_alot_weather_widget.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_205\images\default_1007_alot_weather_widget.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_205\images\mcloud.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_205\images\nclear.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_205\images\nmcloud.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_205\images\pcloud.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_205\images\rain.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_206\images\4252_icon.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_206\images\4252_icon.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_207\images\4305_icon.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_207\images\4305_icon.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_208\images\3895_icon.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_208\images\3895_icon.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_209\images\3875_icon.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_209\images\3875_icon.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_210\images\3882_icon.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_210\images\3882_icon.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_211\images\4252_icon.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_211\images\4252_icon.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_212\images\2377_icon.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_212\images\2377_icon.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_213\images\clear.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_213\images\cloudy.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_213\images\default_1007_alot_weather_widget.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_213\images\default_1007_alot_weather_widget.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_213\images\mcloud.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_213\images\nclear.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_213\images\nmcloud.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_213\images\nshower.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_213\images\pcloud.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_213\images\rain.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_213\images\shower.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_214\images\3898_icon.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_214\images\3898_icon.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_3\images\3562_icon.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_3\images\3562_icon.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_4\images\cloudy.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_4\images\default_1007_alot_weather_widget.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_4\images\default_1007_alot_weather_widget.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_4\images\mcloud.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_4\images\nclear.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_4\images\nmcloud.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_4\images\pcloud.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_4\images\rain.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_5\images\default_1151_alot_mrkt_starpulse.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_5\images\default_1151_alot_mrkt_starpulse.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_6\images\3950_icon.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_7\images\4263_icon.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_8\images\2806_icon.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Button_9\images\2252_icon.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\contextMenu\images\alot_icon.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\contextMenu\images\alot_icon.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\contextMenu\images\alot_logo_button.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\contextMenu\images\alot_logo_button.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Shared\domains.dat
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Shared\images\alot_brand.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Shared\images\alot_splitter.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Shared\images\discover.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Shared\images\intro_popup.png
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Shared\images\spinner.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Shared\images\widget_bottom.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Shared\images\widget_btnclose0.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Shared\images\widget_btnclose1.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Shared\images\widget_btnconfig0.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Shared\images\widget_btnconfig1.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Shared\images\widget_btnrefresh0.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Shared\images\widget_btnrefresh1.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Shared\images\widget_caption.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Shared\images\widget_error_bg.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Shared\images\widget_error_close.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Resources\Shared\images\widget_error_icon.bmp
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\SiteMetrics\SiteMetrics.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\SiteMetrics\SiteMetrics.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\TimerManager\TimerManager.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\TimerManager\TimerManager.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\toolbar.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\toolbar.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\toolbarContextMenu\toolbarContextMenu.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\toolbarContextMenu\toolbarContextMenu.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\ToolbarSearch\ToolbarSearch.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\ToolbarSearch\ToolbarSearch.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Updater\Updater.xml
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\alot\Updater\Updater.xml.backup
c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\inst.exe
C:\Documents
c:\windows\system32\sstray.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_ZwankySearch_Service
-------\Service_ZwankySearch Service

((((((((((((((((((((((((( Files Created from 2010-07-28 to 2010-08-31 )))))))))))))))))))))))))))))))
.
2010-08-31 04:49 . 2010-08-31 04:49 -------- d-----w- c:\program files\Trend Micro
2010-08-31 01:50 . 2010-08-31 01:50 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\AnvSoft
2010-08-31 01:50 . 2010-08-31 01:50 -------- d-----w- c:\program files\AnvSoft
2010-08-30 16:01 . 2010-01-27 07:08 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-08-27 02:10 . 2010-08-27 02:10 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Seagate
2010-08-27 02:08 . 2010-08-27 15:34 -------- d-----w- c:\program files\Carbonite
2010-08-27 02:08 . 2010-08-27 02:08 -------- d-sh--w- c:\windows\ftpcache
2010-08-27 02:05 . 2010-08-30 23:30 -------- d-----w- c:\program files\Seagate
2010-08-27 01:55 . 2010-08-27 01:55 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Leadertech
2010-08-15 06:13 . 2010-08-28 07:24 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\vlc
2010-08-12 04:56 . 2010-08-12 04:56 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-08-12 04:52 . 2010-08-12 04:52 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\Sunbelt Software
2010-08-12 04:49 . 2010-08-12 04:56 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft
2010-08-11 17:45 . 2010-08-11 17:45 -------- d-----w- c:\program files\IObit
2010-08-11 06:23 . 2010-08-11 06:29 -------- d-----w- C:\a474ec38c02ee7b8b30816e6c7
2010-08-11 06:01 . 2010-08-11 06:01 -------- d-----w- c:\program files\CCleaner
2010-08-09 15:06 . 2010-08-09 15:06 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2010-08-08 15:01 . 2010-08-08 15:01 503808 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-530930eb-n\msvcp71.dll
2010-08-08 15:01 . 2010-08-08 15:01 61440 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-25cd66fb-n\decora-sse.dll
2010-08-08 15:01 . 2010-08-08 15:01 499712 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-530930eb-n\jmc.dll
2010-08-08 15:01 . 2010-08-08 15:01 348160 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-530930eb-n\msvcr71.dll
2010-08-08 15:01 . 2010-08-08 15:01 12800 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-25cd66fb-n\decora-d3d.dll
2010-08-08 05:16 . 2010-08-08 05:16 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\TreeCardGames
2010-08-08 05:14 . 2010-08-08 05:14 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\TreeCardGames
2010-08-08 05:13 . 2010-08-08 05:13 -------- d-----w- c:\program files\123 Free Solitaire
2010-08-04 03:25 . 2010-08-04 03:27 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Similarity
2010-08-04 03:25 . 2010-08-04 03:25 3310080 ----a-r- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Microsoft\Installer\{0990B0DC-C629-4330-A7A5-1F1777D9A7A0}\Similarity.exe
2010-08-04 03:25 . 2010-08-04 03:25 -------- d-----w- c:\program files\Similarity
2010-08-02 04:48 . 2010-08-02 04:48 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\AVS4YOU
2010-08-02 04:10 . 2010-08-02 04:10 -------- d-----w- c:\program files\Common Files\Java
2010-08-02 04:09 . 2010-08-02 04:09 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-08-02 04:04 . 2010-08-02 05:01 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-08-02 04:04 . 2010-08-02 05:01 -------- d-----w- c:\program files\AVS4YOU
2010-08-02 04:04 . 2010-08-02 04:48 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\AVS4YOU
2010-08-02 04:04 . 2008-08-13 18:22 24576 ----a-w- c:\windows\system32\msxml3a.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-31 06:08 . 2009-03-14 04:42 -------- d-----w- c:\program files\BitComet
2010-08-31 06:07 . 2009-11-13 07:43 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\uTorrent
2010-08-31 05:44 . 2009-05-07 06:25 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Skype
2010-08-31 05:22 . 2010-07-09 05:32 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\BitComet
2010-08-31 04:52 . 2010-04-05 05:41 0 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\prvlcl.dat
2010-08-31 04:02 . 2009-07-18 12:59 1632 ----a-w- c:\windows\system32\d3d8caps.dat
2010-08-31 03:52 . 2010-07-02 06:12 63488 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-08-31 03:52 . 2010-07-02 06:12 117760 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-08-31 01:54 . 2010-05-24 08:13 -------- d---a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2010-08-31 00:12 . 2009-12-25 04:22 1744 ----a-w- c:\windows\system32\d3d9caps.dat
2010-08-30 23:41 . 2009-08-15 05:30 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Any DVD Converter Professional
2010-08-30 23:35 . 2009-05-05 20:55 85960 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-08-30 23:28 . 2009-03-05 23:57 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-08-30 23:17 . 2009-09-07 05:51 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Vso
2010-08-30 23:17 . 2009-09-07 05:51 47360 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\pcouffin.sys
2010-08-30 23:17 . 2009-09-07 05:51 47360 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\pcouffin.sys
2010-08-30 23:12 . 2009-11-24 18:27 -------- d-----w- c:\program files\Cheetah Burner
2010-08-30 23:03 . 2009-05-07 06:27 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\skypePM
2010-08-30 15:57 . 2009-10-01 06:54 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-08-30 15:46 . 2010-04-02 06:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-30 15:41 . 2009-11-07 01:00 -------- d-----w- c:\program files\PCPitstop
2010-08-30 15:40 . 2009-03-07 02:27 -------- d-----w- c:\program files\Google
2010-08-30 15:37 . 2009-05-10 07:22 -------- d-----w- c:\program files\Apple Software Update
2010-08-30 05:06 . 2009-05-22 05:26 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\PCPitstop
2010-08-29 04:55 . 2010-05-24 08:15 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\dvdcss
2010-08-28 15:09 . 2009-11-04 03:33 -------- d-----w- c:\program files\uTorrent
2010-08-28 03:25 . 2009-03-11 02:30 -------- d-----w- c:\program files\QuickTime
2010-08-27 05:05 . 2010-05-24 06:45 -------- d-----w- c:\program files\Movavi Video Converter 9
2010-08-27 02:07 . 2009-10-02 15:55 50 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\WinPatrol\Autoexec.bat
2010-08-24 15:56 . 2009-05-05 22:54 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2010-08-22 17:52 . 2009-10-23 02:07 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\CanonIJPLM
2010-08-13 03:42 . 2009-05-01 16:20 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-08-11 05:55 . 2010-03-10 06:25 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\avg9
2010-08-09 16:43 . 2010-07-25 03:33 -------- d-----w- c:\program files\ZwankySearch
2010-08-07 18:59 . 2010-05-21 18:43 -------- d-----w- c:\program files\Microsoft LifeCam
2010-08-02 03:54 . 2009-05-10 07:35 -------- d-----w- c:\program files\Recuva
2010-07-31 05:12 . 2010-07-31 05:11 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-07-31 05:12 . 2009-10-31 01:47 -------- d-----w- c:\program files\iTunes
2010-07-31 05:11 . 2009-10-31 01:47 -------- d-----w- c:\program files\iPod
2010-07-31 05:04 . 2009-05-10 07:23 -------- d-----w- c:\program files\Bonjour
2010-07-31 05:01 . 2010-07-31 05:01 73000 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe
2010-07-30 23:36 . 2010-06-01 04:37 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\PhotoScape
2010-07-29 23:34 . 2009-10-23 02:11 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\CanonIJ
2010-07-29 04:01 . 2010-07-29 04:00 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-07-27 14:26 . 2009-03-06 18:08 -------- d-----w- c:\program files\IncrediMail
2010-07-27 07:59 . 2009-09-24 07:00 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Media Player Classic
2010-07-25 06:25 . 2009-08-29 18:53 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\MP3Rocket
2010-07-25 06:06 . 2009-08-29 18:52 -------- d-----w- c:\program files\MP3 Rocket
2010-07-25 03:33 . 2010-07-25 03:33 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\ZwankySearch
2010-07-25 03:33 . 2010-07-25 03:33 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Mp3Rocket Toolbar
2010-07-23 20:20 . 2010-07-25 03:33 57624 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\ZwankySearch\zwankysearch142.exe
2010-07-18 01:59 . 2010-02-23 00:53 -------- d-----w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Smilebox
2010-07-17 06:39 . 2010-05-24 08:00 -------- d-----w- c:\program files\MyVideoConverter
2010-07-15 16:11 . 2009-05-05 20:36 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-15 16:11 . 2010-07-15 16:11 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-07-15 16:10 . 2009-05-05 20:36 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-07-05 10:34 . 2010-07-05 05:46 -------- d-----w- c:\program files\Incomplete
2010-07-02 06:12 . 2010-07-02 06:12 52224 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-06-30 12:31 . 2004-08-04 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-29 09:47 . 2010-01-19 12:34 304448 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Smilebox\SmileboxTray.exe
2010-06-29 09:47 . 2010-01-19 12:34 230720 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Smilebox\SmileboxDvd.exe
2010-06-29 09:47 . 2010-01-19 12:23 410944 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Smilebox\SmileboxStarter.exe
2010-06-29 09:47 . 2010-01-19 11:45 169280 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Smilebox\SmileboxBrowserEngine.dll
2010-06-29 09:31 . 2010-06-29 09:31 1635648 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Smilebox\SmileboxClient.exe
2010-06-29 08:38 . 2010-06-29 08:38 365888 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Smilebox\SmileboxDvdEngine.dll
2010-06-29 08:38 . 2010-06-29 08:38 140608 ----a-w- c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Smilebox\SmileboxUpdater.exe
2010-06-24 12:22 . 2004-08-04 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 19:28 . 2010-06-23 19:28 501936 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Google\Google Toolbar\Update\gtbE.tmp.exe
2010-06-23 13:44 . 2004-08-04 12:00 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-04 12:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2004-08-04 12:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2009-05-05 17:50 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2004-08-04 12:00 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-06-03 02:41 . 2010-06-03 02:41 3600384 ----a-w- c:\windows\system32\GPhotos.scr
2010-06-02 18:23 . 2009-05-05 20:36 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{13E0B548-6FC9-47E9-9874-470915F46548}"= "c:\program files\Cdcovers\tbCdc0.dll" [2010-05-24 2515552]
[HKEY_CLASSES_ROOT\clsid\{13e0b548-6fc9-47e9-9874-470915f46548}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2010-05-31 323976]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-15 2065760]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-07-15 16:11 12536 ----a-w- c:\windows\system32\avgrsstx.dll
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IObit Security 360
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 3]
2010-08-10 22:10 2349776 ----a-w- c:\program files\IObit\Advanced SystemCare 3\AWC.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dvd43]
2008-04-09 17:00 826880 ----a-w- c:\program files\dvd43\DVD43_Tray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-07-21 22:53 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2008-05-28 15:27 570664 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2006-10-11 20:45 75304 ----a-w- c:\program files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-05-13 23:12 26192168 ----a-r- c:\program files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2010-07-19 17:50 2403568 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WrtMon.exe]
2006-09-20 15:35 20480 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XoftSpySE]
2009-10-23 21:58 4854040 ----a-w- c:\program files\XoftSpySE6\XoftSpySE.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\MP3 Rocket\\MP3Rocket.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"61567:TCP"= 61567:TCP:utorrent
"61567:UDP"= 61567:UDP:utorrent
"14329:TCP"= 14329:TCP:BitComet 14329 TCP
"14329:UDP"= 14329:UDP:BitComet 14329 UDP
"18185:TCP"= 18185:TCP:BitComet 18185 TCP
"18185:UDP"= 18185:UDP:BitComet 18185 UDP
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/5/2009 1:36 PM 216400]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/5/2009 1:36 PM 243024]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 11:41 AM 67656]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [7/15/2010 9:10 AM 921952]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/15/2010 9:11 AM 308136]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/30/2010 10:51 PM 135664]
S2 PCPitstop Scheduling;PCPitstop Scheduling; [x]
S3 FWAKZZZEGJO;FWAKZZZEGJO;c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\FWAKZZZEGJO.exe --> c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\FWAKZZZEGJO.exe [?]
S3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys --> c:\windows\system32\DRIVERS\ivusb.sys [?]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
S3 PH;PH;c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\PH.exe --> c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\PH.exe [?]
S3 SUTB;SUTB;c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\SUTB.exe --> c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\SUTB.exe [?]
S3 U;U;c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\U.exe --> c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\U.exe [?]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys --> c:\windows\system32\DRIVERS\wdcsam.sys [?]
S3 WZKQTSHUIQ;WZKQTSHUIQ;c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\WZKQTSHUIQ.exe --> c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\WZKQTSHUIQ.exe [?]
S3 XoftSpyService;XoftSpyService;c:\program files\Common Files\XoftSpySE\6\xoftspyservice.exe [10/23/2009 2:58 PM 582424]
S4 Mp3Rocket Toolbar Helper;Mp3Rocket Toolbar Helper;c:\program files\MP3 Rocket Toolbar\Mp3RocketSvc.exe --> c:\program files\MP3 Rocket Toolbar\Mp3RocketSvc.exe [?]
S4 ZTQESA;ZTQESA;c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\ZTQESA.exe --> c:\docume~1\TERRY~1.TER\LOCALS~1\Temp\ZTQESA.exe [?]
.
Contents of the 'Scheduled Tasks' folder
2010-08-31 c:\windows\Tasks\AWC AutoSweep.job
- c:\program files\IObit\Advanced SystemCare 3\AutoSweep.exe [2010-08-11 21:11]
2010-08-30 c:\windows\Tasks\AWC Update.job
- c:\program files\IObit\Advanced SystemCare 3\IObitUpdate.exe [2010-08-11 18:08]
c:\windows\Tasks\AWC Update.job
2010-08-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 05:51]
2010-08-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 05:51]
2010-08-31 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2009-08-28 21:15]
2010-08-26 c:\windows\Tasks\ParetoLogic Update Version3.job
- c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2009-08-28 21:15]
2010-08-31 c:\windows\Tasks\User_Feed_Synchronization-{169DA464-CD97-4C76-956B-A938F5CB7193}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 12:31]
2010-07-28 c:\windows\Tasks\XoftSpySE_sch_D1AFD6A2-B10F-11DE-9623-00E018D8DBC6.job
- c:\program files\XoftSpySE6\XoftSpySELauncher.exe [2009-10-23 21:58]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.msn.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://search.alot.com/web?q=&pr=auto&client_id=A53F631001CB134F01B7556B&src_id=11176&camp_id=-6&tb_version=2.5.12000.509
IE: &Add animation to IncrediMail Style Box - c:\program files\IncrediMail\bin\resources\WebMenuImg.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\Terry.TERRY-B534F8A5F\Application Data\Mozilla\Firefox\Profiles\h92eyza4.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\components\SEPsearchhelperff.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); 
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{4C350B19-6CA1-4569-B14C-296D8D65300B} - (no file)
SafeBoot-WRConsumerService

**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-30 23:09
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ... 
scanning hidden autostart entries ... 
scanning hidden files ... 
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d6,c0,55,c7,25,0c,e0,4e,ac,a1,e4,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d6,c0,55,c7,25,0c,e0,4e,ac,a1,e4,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(672)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
- - - - - - - > 'explorer.exe'(3312)
c:\windows\system32\WININET.dll
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\program files\MediaMonkey\DeskPlayer.dll
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\windows\system32\IoctlSvc.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\wscntfy.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
.
**************************************************************************
.
Completion time: 2010-08-30 23:14:16 - machine was rebooted
ComboFix-quarantined-files.txt 2010-08-31 06:14
Pre-Run: 80,800,784,384 bytes free
Post-Run: 81,173,405,696 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
- - End Of File - - 75B74E7A1DE9BF533560641140EC33CD


----------



## SweetTech (Jan 1, 1970)

Okay. If you run into any issues and/or your unsure of something feel free to post back from clarification.


----------



## ivory1982 (Mar 14, 2009)

Hello SweetTech.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4518
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
8/31/2010 5:47:53 PM
mbam-log-2010-08-31 (17-47-53).txt
Scan type: Quick scan
Objects scanned: 162760
Time elapsed: 10 minute(s), 51 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)


----------



## SweetTech (Jan 1, 1970)

Okay.


----------



## ivory1982 (Mar 14, 2009)

Hi SweetTech.
I'm running your esetsmartin virus scan and its taking quite awhile but so far its found 3 threats
Win32/Adware.ADON application x 3 and it's only half way through the scan. Will post the full results when its finished. Then I'll start that other scan you mentioned.
Thank you
.


----------



## ivory1982 (Mar 14, 2009)

Hello SweetTech.
Results of the Estesmartininstaller:

C:\Documents and Settings\Terry.TERRY-B534F8A5F\Application Data\Microsoft\Internet Explorer\Quick Launch\eBay.lnk Win32/Adware.ADON application
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Desktop\Programs moved from Laptop\eBay.lnk Win32/Adware.ADON application
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Start Menu\eBay.lnk Win32/Adware.ADON application

Results of screen317's Security Check version 0.99.5 
Windows XP Service Pack 3 
Internet Explorer 8 
*`````````````````````````````` 
Antivirus/Firewall Check:* 
Windows Firewall Enabled! 
AVG Free 9.0 
ESET Online Scanner v3 
*``````````````````````````````` 
Anti-malware/Other Utilities Check:* 
Malwarebytes' Anti-Malware 
HijackThis 2.0.2 
CCleaner 
Java(TM) 6 Update 21 
Adobe Flash Player 10.1.82.76 
Adobe Reader 9.3.4 
Mozilla Firefox (3.6.8) 
*```````````````````````````````` 
Process Check: 
objlist.exe by Laurent* 
*WinPatrol winpatrol.exe is disabled!* 
AVG avgwdsvc.exe 
AVG avgtray.exe 
AVG avgrsx.exe 
AVG avgnsx.exe 
AVG avgemc.exe 
*````````````````````````````````
DNS Vulnerability Check:*
GREAT! (Not vulnerable to DNS cache poisoning)

*``````````End of Log````````````*

Thank you SweetTech


----------



## SweetTech (Jan 1, 1970)

Hello,

Your logs are looking good. How are things running?

*OTL Fix*

*We need to run an OTL Fix*

Please reopen







on your desktop.
*Copy* and *Paste* the following code into the







textbox. Do not include the word "*Code*"


```
:Services
:OTL

:Reg

:Files
ipconfig /flushdns /c
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Application Data\Microsoft\Internet Explorer\Quick Launch\eBay.lnk
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Desktop\Programs moved from Laptop\eBay.lnk
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Start Menu\eBay.lnk
:Commands
[purity]
[resethosts]
[CreateRestorePoint]
[emptytemp]
[EMPTYFLASH]
```

*Push*








*OTL may ask to reboot the machine. Please do so if asked.*
*Click*







.
A report will open. *Copy* and *Paste* that report in your next reply.
If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.


----------



## ivory1982 (Mar 14, 2009)

Good morning SweetTech.
I haven't downloaded that program yet, should I get it from the internet?
I goggled it and found out some info but I thought I'd better check with you first.
Thank you Ivory


----------



## SweetTech (Jan 1, 1970)

Hello,

I guess it would be helpful if I provided you with a link to download it.

Sorry about that.

Here is the link:

Download *OTL* to your desktop.


----------



## ivory1982 (Mar 14, 2009)

Hello SweetTech.
Thank you for the link for OLT. Here's the results:

All processes killed
Error: Unable to interpret <Services> in the current context!
========== OTL ==========
========== REGISTRY ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\My Documents\Downloads\cmd.bat deleted successfully.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\My Documents\Downloads\cmd.txt deleted successfully.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Application Data\Microsoft\Internet Explorer\Quick Launch\eBay.lnk moved successfully.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Desktop\Programs moved from Laptop\eBay.lnk moved successfully.
C:\Documents and Settings\Terry.TERRY-B534F8A5F\Start Menu\eBay.lnk moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Unable to start service SrService!

[EMPTYTEMP]

User: All Users

User: All Users.WINDOWS

User: Default User
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User.WINDOWS
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 56504 bytes

User: LocalService
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 16954953 bytes

User: NetworkService
->Temporary Internet Files folder emptied: 402 bytes

User: NetworkService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Terry
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 5907417 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 84351621 bytes
->Flash cache emptied: 0 bytes

User: Terry.TERRY-B534F8A5F
->Temp folder emptied: 109712092 bytes
->Temporary Internet Files folder emptied: 114591289 bytes
->Java cache emptied: 118545 bytes
->FireFox cache emptied: 43581791 bytes
->Flash cache emptied: 456 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2142714 bytes
%systemroot%\System32 .tmp files removed: 555520 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 90 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 535779989 bytes

Total Files Cleaned = 872.00 mb

[EMPTYFLASH]

User: All Users

User: All Users.WINDOWS

User: Default User

User: Default User.WINDOWS
->Flash cache emptied: 0 bytes

User: LocalService

User: LocalService.NT AUTHORITY

User: NetworkService

User: NetworkService.NT AUTHORITY

User: Terry
->Flash cache emptied: 0 bytes

User: Terry.TERRY-B534F8A5F
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.11.0 log created on 09012010_100553

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...


----------



## SweetTech (Jan 1, 1970)

How are things running?


----------



## ivory1982 (Mar 14, 2009)

Hi SweetTech.
Our computer seems to be running better now, I have no issues at the present time. Thank you for your help.
Just noticed that your address is the Antartica! wow whats it likethere?


----------



## SweetTech (Jan 1, 1970)

Hello,

It's always very cold here.

*Your logs appear to be clean, so if you have no further issues with your computer, then please proceed with the following housekeeping procedures outlined below.*

*Clean-Up Time*

*Time for some housekeeping*
The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following bolded text into the Run box and click OK: *ComboFix /Uninstall *

*NEXT:*

*OTL Clean-Up*

*We Need to Clean Up our Mess*
Our work on your machine has left considerable leftovers on your box. Let's clean those up real quick:

Reopen







on your desktop.
Click on








You will be prompted to reboot your system. Please do so.
*If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.*

*NEXT:*

*All Clean Speech*

*===> Make sure you've re-enabled any Security Programs that we may have disabled during the malware removal process. <===*​Below I have included a number of recommendations for how to protect your computer against malware infections.

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article*
Strong passwords: How to create and use them* then consider a *password keeper,* to keep all your passwords safe.

Keep Windows updated by regularly checking their website at: http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

*FileHippo Update Checker* is an extremely helpful program that will tell you which of your programs need to be updated. Its important to keep programs up to date so that malware doesn't exploit any old security flaws.

*SpywareBlaster* protects against bad ActiveX, it immunizes your PC against them.

*SpywareGuard* offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.

*Make Internet Explorer more secure*
Click *Start* > *Run*
Type *Inetcpl.cpl* & click *OK*
Click on the *Security* tab
Click *Reset all zones to default level*
Make sure the *Internet Zone* is selected & Click *Custom level*
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click *OK*, then *Apply* button and then *OK* to exit the Internet Properties page.

*ATF Cleaner* - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

*WOT*, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
*Green* to go
*Yellow* for caution
*Red* to stop
WOT has an addon available for both Firefox and IE
Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from *Here*
If you choose to use Firefox, I highly recommend this add-on to keep your PC even more secure.
*NoScript* - for blocking ads and other potential website attacks


*Keep a backup of your important files* - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

*ERUNT* (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.

In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
*Think Prevention.*
*PC Safety and Security--What Do I Need?.*

***Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. *

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

Cheers,
SweetTech.


----------



## ivory1982 (Mar 14, 2009)

Hello SweetTech.
Thank you for your help, much appreciated. Ivory


----------

