# Internet Explorer virus?? Anyone else?



## willp68 (Sep 8, 2008)

Last nite in the middle of something, a screen opened up that said that Internet Explorer has detected 4 viruses on my computer that could destroy my machine.
There was a "click here to fix" button. I look the page over and figure it for total rubbish and try to close it out..
It would not close. Everytime I hit the red x, a small window opened up saying are you sure you want to cancel? 
I finally had to shut down to get that page to go away. I rebooted and did a complete malwares scan. There was no problem... 
The list of viruses it said I had were:

adware.win32.winpd
ADVWare.hotbar
trojan-PSW.win32.I.dpinch.adm
trojan horse IRC/backdoor.sdbot4.FRV

I went to file search and typed in those files and nothing came up...

I imagine that if I had clicked on "FIX" - then I would have gotten the viruses..


----------



## perfume (Sep 13, 2008)

Dear willp68,
Very smart of you not to click on FIX! Yes, IE virus does exist. Just don't try to fix anything! Wait until help comes along!


----------



## Cookiegal (Aug 27, 2003)

I've edited your post for language. Please be more careful in the future as this is a family oriented site.

*Click here* to download *HJTsetup.exe*.

Save HJTsetup.exe to your desktop.
Double click on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\Hijack This. 
Continue to click *Next* in the setup dialogue boxes until you get to the *Select Addition Tasks* dialogue.
Put a check by *Create a desktop icon* then click *Next* again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click *Finish* and it will launch Hijack This.
Click on the *Do a system scan and save a log file* button. It will scan and then ask you to save the log.
Click *Save* to save the log file and then the log will open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.	
*DO NOT* have Hijack This fix anything yet. Most of what it finds will be harmless or even required.


----------



## willp68 (Sep 8, 2008)

Sorry for the language gaffe cookiegal..

Thank you for that link, I will get it going.


----------



## willp68 (Sep 8, 2008)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:01:53 AM, on 8/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\RunDLL32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\sol.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunOnce: [DELDIR0.EXE] "C:\DOCUME~1\Piazza\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Guardian\"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [OfotoNow USB Detection] C:\WINDOWS\System32\RunDLL32.exe C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL,WatchForConnection OfotoNow
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {9239E4EC-C9A6-11D2-A844-00C04F68D538} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: Yahoo! Poker - http://download2.games.yahoo.com/games/clients/y/pt3_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {28F00B0F-DC4E-11D3-ABEC-005004A44EEB} (Register Class) - http://content.hiwirenetworks.net/inbrowser/cabfiles/2.5.26/Hiwire.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {47F59200-8783-11D2-8343-00A0C945A819} (RFXInstMgr Class) - http://greetingcenter.richfx.com/download/twophase.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-24.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/049aabe9754e4fea2e20/netzip/RdxIE6.cab
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.25.152/code/PWActiveXImgCtl.CAB
O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/essentials/ymmapi_0312.dll
O16 - DPF: {A31CCCB0-46A8-11D3-A726-005004B35102} (XView Class) - http://download.actify.com/SpinFire/SFViewerWeb.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://www.sparkpea.net/controls/msnchat45.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
--
End of file - 10472 bytes


----------



## Cookiegal (Aug 27, 2003)

Please download Malwarebytes' Anti-Malware from *Here*.

Double Click *mbam-setup.exe* to install the application.
Make sure a checkmark is placed next to *Update Malwarebytes' Anti-Malware* and *Launch Malwarebytes' Anti-Malware*, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "*Perform Quick Scan*", then click *Scan*.
The scan may take some time to finish, so please be patient.
When the scan is complete, click *OK*, then *Show Results* to view the results.
Make sure that *everything is checked*, and click *Remove Selected*.
When disinfection is completed, a log will open in Notepad and you may be prompted to restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the entire report in your next reply.
Extra Note:

*If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.*


----------



## willp68 (Sep 8, 2008)

Malwarebytes' Anti-Malware 1.40
Database version: 2684
Windows 5.1.2600 Service Pack 3
8/23/2009 5:33:26 PM
mbam-log-2009-08-23 (17-33-26).txt
Scan type: Quick Scan
Objects scanned: 102020
Time elapsed: 16 minute(s), 37 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)


----------



## Cookiegal (Aug 27, 2003)

Please do an online scan with Kaspersky WebScanner

Kaspersky online scanner uses JAVA tecnology to perform the scan. If you do not have Java then you will need to go to the following link and download the latest version:

*JRE 6 Update 15 *

Instructions for Kaspersky scan:


Read through the requirements and privacy statement and click on *Accept* button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click *Run*.
When the downloads have finished, click on *Settings*.
Make sure the following is checked. 
*Spyware, Adware, Dialers, and other potentially dangerous programs 
Archives
Mail databases*

Click on *My Computer* under *Scan*.
Once the scan is complete, it will display the results. Click on *View Scan Report*.
You will see a list of infected items there. Click on *Save Report As...*.
Save this report to a convenient place. Change the *Files of type* to *Text file (.txt)* before clicking on the *Save* button.
Please post this log in your next reply.


----------



## willp68 (Sep 8, 2008)

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, August 26, 2009
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, August 26, 2009 10:44:07
Records in database: 2689303
--------------------------------------------------------------------------------
Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes
Scan area - My Computer:
A:\
C:\
D:\
E:\
Scan statistics:
Objects scanned: 89757
Threats found: 1
Infected objects found: 1
Suspicious objects found: 0
Scan duration: 05:04:07

File name / Threat / Threats count
C:\WINDOWS\Downloaded Program Files\flash.inf Infected: not-a-virus:AdWare.Win32.BetterInternet.be 1
Selected area has been scanned.


----------



## Cookiegal (Aug 27, 2003)

Please delete this file and then post a new HijackThis log.

C:\WINDOWS\Downloaded Program Files\*flash.inf*


----------



## willp68 (Sep 8, 2008)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:43:45 AM, on 8/27/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\RunDLL32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\sol.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [DELDIR0.EXE] "C:\DOCUME~1\Piazza\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Guardian\"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [OfotoNow USB Detection] C:\WINDOWS\System32\RunDLL32.exe C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL,WatchForConnection OfotoNow
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {9239E4EC-C9A6-11D2-A844-00C04F68D538} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: Yahoo! Poker - http://download2.games.yahoo.com/games/clients/y/pt3_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {28F00B0F-DC4E-11D3-ABEC-005004A44EEB} (Register Class) - http://content.hiwirenetworks.net/inbrowser/cabfiles/2.5.26/Hiwire.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {47F59200-8783-11D2-8343-00A0C945A819} (RFXInstMgr Class) - http://greetingcenter.richfx.com/download/twophase.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-24.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/049aabe9754e4fea2e20/netzip/RdxIE6.cab
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.25.152/code/PWActiveXImgCtl.CAB
O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/essentials/ymmapi_0312.dll
O16 - DPF: {A31CCCB0-46A8-11D3-A726-005004B35102} (XView Class) - http://download.actify.com/SpinFire/SFViewerWeb.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://www.sparkpea.net/controls/msnchat45.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
--
End of file - 10514 bytes


----------



## Cookiegal (Aug 27, 2003)

Download *OTS.exe * to your Desktop and double-click on it to extract the files. It will create a folder named *OTS* on your desktop.

Close any open browsers.
If your Real protection or Antivirus interferes with OTS, allow it to run.
Open the *OTS* folder and double-click on *OTS.exe* to start the program.
In *Additional Scans *section put a check in Disabled MS Config Items and EventViewer logs
Now click the *Run Scan *button on the toolbar.
Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Save that notepad file.
Use the *Reply* button, scroll down to the attachments section and attach the notepad file here.


----------



## willp68 (Sep 8, 2008)

code]
OTS logfile created on: 8/30/2009 7:30:11 AM - Run 1
OTS by OldTimer - Version 3.0.10.3 Folder = C:\Documents and Settings\Piazza\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.48 Mb Total Physical Memory | 225.17 Mb Available Physical Memory | 44.02% Memory free
1.22 Gb Paging File | 0.85 Gb Available in Paging File | 69.61% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 16.96 Gb Free Space | 45.50% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: NEXLINK
Current User Name: Piazza
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: Off
File Age = 30 Days

[Processes - Safe List]
adobeupdater.exe -> C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe -> [2008/11/17 18:14:27 | 02,356,088 | ---- | M] (Adobe Systems Incorporated)
explorer.exe -> C:\WINDOWS\Explorer.EXE -> [2008/04/13 20:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation)
googletoolbarnotifier.exe -> C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe -> [2007/06/17 23:28:25 | 00,068,856 | ---- | M] (Google Inc.)
hpzipm12.exe -> C:\WINDOWS\System32\HPZipm12.exe -> [2004/09/29 13:14:36 | 00,069,632 | ---- | M] (HP)
jqs.exe -> C:\Program Files\Java\jre6\bin\jqs.exe -> [2009/07/25 05:23:10 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.)
jusched.exe -> C:\Program Files\Java\jre6\bin\jusched.exe -> [2009/07/25 05:23:12 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.)
mcagent.exe -> c:\Program Files\McAfee.com\Agent\mcagent.exe -> [2009/01/08 21:30:26 | 00,645,328 | ---- | M] (McAfee, Inc.)
mcmscsvc.exe -> C:\Program Files\McAfee\MSC\mcmscsvc.exe -> [2009/01/08 21:30:26 | 00,797,864 | ---- | M] (McAfee, Inc.)
mcnasvc.exe -> c:\program files\common files\mcafee\mna\mcnasvc.exe -> [2009/01/09 12:31:16 | 02,482,848 | ---- | M] (McAfee, Inc.)
mcproxy.exe -> c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe -> [2009/01/09 09:06:52 | 00,359,952 | ---- | M] (McAfee, Inc.)
mcshield.exe -> C:\Program Files\McAfee\VirusScan\Mcshield.exe -> [2009/03/25 11:05:48 | 00,144,704 | ---- | M] (McAfee, Inc.)
mcsysmon.exe -> C:\Program Files\McAfee\VirusScan\mcsysmon.exe -> [2009/03/24 00:03:18 | 00,606,736 | ---- | M] (McAfee, Inc.)
mpfsrv.exe -> C:\Program Files\McAfee\MPF\MPFSrv.exe -> [2009/03/19 11:42:02 | 00,884,360 | ---- | M] (McAfee, Inc.)
ots.exe -> C:\Documents and Settings\Piazza\Desktop\OTS.exe -> [2009/08/30 07:28:17 | 00,514,048 | ---- | M] (OldTimer Tools)
qttask.exe -> C:\Program Files\QuickTime\qttask.exe -> [2004/04/11 17:34:21 | 00,077,824 | ---- | M] (Apple Computer, Inc.)
realsched.exe -> C:\Program Files\Common Files\Real\Update_OB\realsched.exe -> [2009/05/04 12:55:28 | 00,198,160 | ---- | M] (RealNetworks, Inc.)
type32.exe -> C:\Program Files\Microsoft Hardware\Keyboard\type32.exe -> [2001/06/12 04:20:24 | 00,069,632 | ---- | M] (Microsoft Corporation)

[Win32 Services - Safe List]
(aspnet_state) ASP.NET State Service [Win32_Own | On_Demand | Stopped] -> C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe -> [2004/07/15 02:49:26 | 00,032,768 | ---- | M] (Microsoft Corporation)
(gusvc) Google Software Updater [Win32_Own | On_Demand | Stopped] -> C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -> [2009/04/22 21:16:23 | 00,182,768 | ---- | M] (Google)
(helpsvc) Help and Support [Win32_Shared | Auto | Running] -> C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -> [2008/04/13 20:12:02 | 00,038,400 | ---- | M] (Microsoft Corporation)
(mcmscsvc) McAfee Services [Win32_Own | Auto | Running] -> C:\Program Files\McAfee\MSC\mcmscsvc.exe -> [2009/01/08 21:30:26 | 00,797,864 | ---- | M] (McAfee, Inc.)
(McNASvc) McAfee Network Agent [Win32_Own | Auto | Running] -> c:\program files\common files\mcafee\mna\mcnasvc.exe -> [2009/01/09 12:31:16 | 02,482,848 | ---- | M] (McAfee, Inc.)
(McODS) McAfee Scanner [Win32_Own | On_Demand | Stopped] -> C:\Program Files\McAfee\VirusScan\mcods.exe -> [2009/04/01 14:21:30 | 00,365,072 | ---- | M] (McAfee, Inc.)
(McProxy) McAfee Proxy Service [Win32_Own | Auto | Running] -> c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe -> [2009/01/09 09:06:52 | 00,359,952 | ---- | M] (McAfee, Inc.)
(McShield) McAfee Real-time Scanner [Win32_Own | Unknown | Running] -> C:\Program Files\McAfee\VirusScan\Mcshield.exe -> [2009/03/25 11:05:48 | 00,144,704 | ---- | M] (McAfee, Inc.)
(McSysmon) McAfee SystemGuards [Win32_Own | On_Demand | Running] -> C:\Program Files\McAfee\VirusScan\mcsysmon.exe -> [2009/03/24 00:03:18 | 00,606,736 | ---- | M] (McAfee, Inc.)
(MpfService) McAfee Personal Firewall Service [Win32_Own | Auto | Running] -> C:\Program Files\McAfee\MPF\MPFSrv.exe -> [2009/03/19 11:42:02 | 00,884,360 | ---- | M] (McAfee, Inc.)
(NWCWorkstation) Client Service for NetWare [Win32_Shared | Auto | Running] -> C:\WINDOWS\System32\nwwks.dll -> [2008/04/13 20:12:02 | 00,065,536 | ---- | M] (Microsoft Corporation)
(Pml Driver HPZ12) Pml Driver HPZ12 [Win32_Own | Auto | Running] -> C:\WINDOWS\System32\HPZipm12.exe -> [2004/09/29 13:14:36 | 00,069,632 | ---- | M] (HP)
(JavaQuickStarterService) Java Quick Starter [Win32_Own | Auto | Running] -> C:\Program Files\Java\jre6\bin\jqs.exe -> [2009/07/25 05:23:10 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.)

[Driver Services - Safe List]
(ac97intc) Intel(r) 82801 Audio Driver Install Service (WDM) [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\drivers\ac97intc.sys -> [2001/08/17 15:20:04 | 00,096,256 | ---- | M] (Intel Corporation)
(Cdr4_xp) Cdr4_xp [Kernel | System | Running] -> C:\WINDOWS\System32\drivers\cdr4_xp.sys -> [2002/11/27 12:44:27 | 00,057,136 | ---- | M] (Roxio)
(Cdralw2k) Cdralw2k [Kernel | System | Running] -> C:\WINDOWS\System32\drivers\cdralw2k.sys -> [2002/11/27 12:44:27 | 00,023,721 | ---- | M] (Roxio)
(cdudf_xp) cdudf_xp [File_System | System | Running] -> C:\WINDOWS\System32\drivers\cdudf_xp.sys -> [2002/01/23 15:01:04 | 00,233,984 | ---- | M] (Roxio)
(dvd_2K) dvd_2K [Kernel | On_Demand | Stopped] -> C:\WINDOWS\System32\drivers\Dvd_2k.sys -> [2002/01/23 13:19:56 | 00,024,470 | ---- | M] (Roxio)
(gameenum) Game Port Enumerator [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\DRIVERS\gameenum.sys -> [2008/04/13 14:45:29 | 00,010,624 | ---- | M] (Microsoft Corporation)
(HCF_MSFT) HCF_MSFT [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\DRIVERS\HCF_MSFT.sys -> [2001/08/17 16:28:02 | 00,907,456 | ---- | M] (Conexant)
(HPZid412) IEEE-1284.4 Driver HPZid412 [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\DRIVERS\HPZid412.sys -> [2004/09/29 01:11:42 | 00,051,120 | R--- | M] (HP)
(HPZipr12) Print Class Driver for IEEE-1284.4 HPZipr12 [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\DRIVERS\HPZipr12.sys -> [2004/09/29 01:11:46 | 00,016,496 | R--- | M] (HP)
(HPZius12) USB to IEEE-1284.4 Translation Driver HPZius12 [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\DRIVERS\HPZius12.sys -> [2004/09/29 01:10:16 | 00,021,744 | ---- | M] (HP)
(IPFilter) Microsoft IntelliPoint Features driver [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\DRIVERS\IPFilter.sys -> [2001/08/23 03:33:12 | 00,010,192 | ---- | M] (Microsoft Corporation)
(mfeavfk) McAfee Inc. mfeavfk [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\drivers\mfeavfk.sys -> [2009/03/25 11:06:28 | 00,079,880 | ---- | M] (McAfee, Inc.)
(mfebopk) McAfee Inc. mfebopk [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\drivers\mfebopk.sys -> [2009/03/25 11:06:28 | 00,035,272 | ---- | M] (McAfee, Inc.)
(mfehidk) McAfee Inc. mfehidk [Kernel | System | Running] -> C:\WINDOWS\System32\drivers\mfehidk.sys -> [2009/03/25 11:06:28 | 00,214,024 | ---- | M] (McAfee, Inc.)
(mferkdk) McAfee Inc. mferkdk [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\drivers\mferkdk.sys -> [2009/03/25 11:05:54 | 00,034,216 | ---- | M] (McAfee, Inc.)
(mfesmfk) McAfee Inc. mfesmfk [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\drivers\mfesmfk.sys -> [2009/03/25 11:06:30 | 00,040,552 | ---- | M] (McAfee, Inc.)
(mmc_2K) mmc_2K [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\drivers\Mmc_2k.sys -> [2002/01/23 13:19:46 | 00,024,918 | ---- | M] (Roxio)
(MPFP) MPFP [Kernel | System | Running] -> C:\WINDOWS\System32\Drivers\Mpfp.sys -> [2008/10/23 14:08:54 | 00,120,136 | ---- | M] (McAfee, Inc.)
(ms_mpu401) Microsoft MPU-401 MIDI UART Driver [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\drivers\msmpu401.sys -> [2001/08/17 17:00:04 | 00,002,944 | ---- | M] (Microsoft Corporation)
(ndiscm) Motorola SurfBoard USB Cable Modem Windows 2000 Driver [Kernel | On_Demand | Stopped] -> C:\WINDOWS\System32\DRIVERS\NetMotCM.sys -> [2002/05/13 20:43:06 | 00,015,399 | R--- | M] (Motorola Inc.)
(nv) nv [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\DRIVERS\nv4_mini.sys -> [2004/08/04 01:29:54 | 01,897,408 | ---- | M] (NVIDIA Corporation)
(nv4) nv4 [Kernel | On_Demand | Stopped] -> C:\WINDOWS\System32\DRIVERS\nv4.sys -> [2001/08/17 15:50:26 | 00,731,648 | ---- | M] (NVIDIA Corporation)
(NwlnkIpx) NWLink IPX/SPX/NetBIOS Compatible Transport Protocol [Kernel | Auto | Running] -> C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys -> [2008/04/13 14:56:06 | 00,088,320 | ---- | M] (Microsoft Corporation)
(NwlnkNb) NWLink NetBIOS [Kernel | Auto | Running] -> C:\WINDOWS\System32\DRIVERS\nwlnknb.sys -> [2001/08/18 08:00:00 | 00,063,232 | ---- | M] (Microsoft Corporation)
(NwlnkSpx) NWLink SPX/SPXII Protocol [Kernel | Auto | Running] -> C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys -> [2001/08/18 08:00:00 | 00,055,936 | ---- | M] (Microsoft Corporation)
(NWRDR) NetWare Rdr [File_System | On_Demand | Running] -> C:\WINDOWS\System32\DRIVERS\nwrdr.sys -> [2008/04/13 14:34:12 | 00,163,584 | ---- | M] (Microsoft Corporation)
(Ptilink) Direct Parallel Link Driver [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\DRIVERS\ptilink.sys -> [2001/08/18 08:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.)
(pwd_2K) pwd_2K [Kernel | System | Running] -> C:\WINDOWS\System32\drivers\pwd_2K.sys -> [2002/01/23 13:19:34 | 00,107,430 | ---- | M] (Roxio)
(PxHelp20) PxHelp20 [Kernel | Boot | Running] -> C:\WINDOWS\System32\Drivers\PxHelp20.sys -> [2005/01/26 03:03:00 | 00,020,576 | ---- | M] (Sonic Solutions)
(rtl8139) Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver [Kernel | On_Demand | Running] -> C:\WINDOWS\System32\DRIVERS\RTL8139.SYS -> [2004/08/04 01:31:32 | 00,020,992 | ---- | M] (Realtek Semiconductor Corporation)
(Secdrv) Secdrv [Kernel | On_Demand | Stopped] -> C:\WINDOWS\System32\DRIVERS\secdrv.sys -> [2007/11/13 06:25:53 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
(Sentinel) Sentinel [Kernel | Auto | Running] -> C:\WINDOWS\System32\Drivers\SENTINEL.SYS -> [2002/03/22 12:04:54 | 00,073,728 | ---- | M] (Rainbow Technologies, Inc.)
(SONYPVU1) Sony USB Filter Driver (SONYPVU1) [Kernel | On_Demand | Stopped] -> C:\WINDOWS\System32\DRIVERS\SONYPVU1.SYS -> [2001/08/17 13:56:16 | 00,007,552 | ---- | M] (Sony Corporation)
(UdfReadr_xp) UdfReadr_xp [File_System | System | Running] -> C:\WINDOWS\System32\drivers\udfreadr_xp.sys -> [2002/01/23 14:59:24 | 00,206,208 | ---- | M] (Roxio)
(Wdm1) USB Bridge Cable Driver [Kernel | On_Demand | Stopped] -> C:\WINDOWS\System32\Drivers\usbbc.sys -> [2001/11/09 17:48:46 | 00,015,576 | ---- | M] ()


----------



## willp68 (Sep 8, 2008)

[Registry - Safe List]
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Page_URL" -> http://go.microsoft.com/fwlink/?LinkId=69157 -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Search_URL" -> http://go.microsoft.com/fwlink/?LinkId=54896 -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Secondary_Page_URL" -> [binary data] -> 
HKEY_LOCAL_MACHINE\: Main\\"Extensions Off Page" -> about:NoAdd-ons -> 
HKEY_LOCAL_MACHINE\: Main\\"Local Page" -> C:\WINDOWS\system32\blank.htm -> 
HKEY_LOCAL_MACHINE\: Main\\"Search Page" -> http://go.microsoft.com/fwlink/?LinkId=54896 -> 
HKEY_LOCAL_MACHINE\: Main\\"Security Risk Page" -> about:SecurityRisk -> 
HKEY_LOCAL_MACHINE\: Main\\"Start Page" -> http://go.microsoft.com/fwlink/?LinkId=69157 -> 
HKEY_LOCAL_MACHINE\: Search\\"CustomizeSearch" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm -> 
HKEY_LOCAL_MACHINE\: Search\\"CustomSearch" -> http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr7/*http://www.yahoo.com/ext/search/search.html -> 
HKEY_LOCAL_MACHINE\: Search\\"Default_Search_URL" -> http://www.google.com/ie -> 
HKEY_LOCAL_MACHINE\: Search\\"SearchAssistant" -> http://www.google.com/ie -> 
< Internet Explorer Settings [HKEY_CURRENT_USER\] > -> -> 
HKEY_CURRENT_USER\: Main\\"Local Page" -> C:\WINDOWS\system32\blank.htm -> 
HKEY_CURRENT_USER\: Main\\"Page_Transitions" -> 1 -> 
HKEY_CURRENT_USER\: Main\\"Search Page" -> http://www.google.com -> 
HKEY_CURRENT_USER\: Main\\"SearchMigratedDefaultName" -> Google -> 
HKEY_CURRENT_USER\: Main\\"SearchMigratedDefaultURL" -> http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 -> 
HKEY_CURRENT_USER\: Main\\"Start Page" -> http://www.google.com/ig?hl=en -> 
HKEY_CURRENT_USER\: Search\\"AutoSearch" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/saautosearch.aspx -> 
HKEY_CURRENT_USER\: Search\\"CustomizeSearch" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm -> 
HKEY_CURRENT_USER\: Search\\"SearchAssistant" -> http://www.google.com/ie -> 
HKEY_CURRENT_USER\: SearchURL\\"" -> http://www.google.com/search?q=%s -> 
HKEY_CURRENT_USER\: URLSearchHooks\\"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll [Yahoo! Toolbar] -> [2006/10/26 11:28:40 | 00,440,384 | ---- | M] (Yahoo! Inc.)
HKEY_CURRENT_USER\: "ProxyEnable" -> 0 -> 
HKEY_CURRENT_USER\: "ProxyOverride" -> 127.0.0.1 -> 
< FireFox Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla
HKLM\software\mozilla\Firefox\Extensions -> -> 
HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758} -> C:\PROGRAM FILES\REAL\REALPLAYER\BROWSERRECORD [C:\PROGRAM FILES\REAL\REALPLAYER\BROWSERRECORD] -> [2009/05/04 12:56:52 | 00,000,000 | ---D | M]
HKLM\software\mozilla\Firefox\Extensions\\[email protected] -> C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF] -> [2009/06/04 16:18:12 | 00,000,000 | ---D | M]
< FireFox Extensions [User Folders] > -> 
< HOSTS File > (734 bytes and 19 lines) -> C:\WINDOWS\System32\drivers\etc\Hosts -> 
Reset Hosts
127.0.0.1 localhost
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> 
{02478D38-C3F9-4EFB-9B51-7695ECA05670} [HKLM] -> C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll [Yahoo! Toolbar Helper] -> [2006/10/26 11:28:40 | 00,440,384 | ---- | M] (Yahoo! Inc.)
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [Adobe PDF Reader Link Helper] -> [2006/10/22 23:08:42 | 00,062,080 | ---- | M] (Adobe Systems Incorporated)
{3049C3E9-B461-4BC5-8870-4C09146192CA} [HKLM] -> C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [RealPlayer Download and Record Plugin for Internet Explorer] -> [2009/05/04 12:56:49 | 00,312,928 | ---- | M] (RealPlayer)
{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [Spybot-S&D IE Protection] -> [2008/09/15 15:25:44 | 01,562,960 | ---- | M] (Safer Networking Limited)
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} [HKLM] -> C:\Program Files\Yahoo!\Common\yiesrvc.dll [Yahoo! IE Services Button] -> [2006/10/31 16:29:16 | 00,198,136 | ---- | M] (Yahoo! Inc.)
{7DB2D5A0-7241-4E79-B68D-6309F01C5231} [HKLM] -> C:\Program Files\McAfee\VirusScan\scriptsn.dll [scriptproxy] -> [2009/03/25 11:05:56 | 00,062,784 | ---- | M] (McAfee, Inc.)
{9030D464-4C02-4ABF-8ECC-5164760863C6} [HKLM] -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [Windows Live Sign-in Helper] -> [2006/07/07 13:29:52 | 00,324,416 | ---- | M] (Microsoft Corporation)
{AA58ED58-01DD-4d91-8333-CF10577473F7} [HKLM] -> C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [Google Toolbar Helper] -> [2009/06/16 15:24:02 | 00,259,696 | ---- | M] (Google Inc.)
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} [HKLM] -> C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll [Google Toolbar Notifier BHO] -> [2009/06/23 01:14:33 | 00,669,168 | ---- | M] (Google Inc.)
{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} [HKLM] -> C:\Program Files\Windows Live Toolbar\msntb.dll [Windows Live Toolbar Helper] -> [2007/10/19 12:20:48 | 00,546,320 | ---- | M] (Microsoft Corporation)
{C84D72FE-E17D-4195-BB24-76C02E2E7C4E} [HKLM] -> C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll [Google Dictionary Compression sdch] -> [2009/04/22 10:26:21 | 00,470,512 | ---- | M] (Google Inc.)
{DBC80044-A445-435b-BC74-9C25C1C588A9} [HKLM] -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [Java(tm) Plug-In 2 SSV Helper] -> [2009/06/04 16:18:06 | 00,035,840 | ---- | M] (Sun Microsystems, Inc.)
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} [HKLM] -> C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [JQSIEStartDetectorImpl Class] -> [2009/06/04 16:18:12 | 00,073,728 | ---- | M] (Sun Microsystems, Inc.)
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar -> 
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" [HKLM] -> C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [Google Toolbar] -> [2009/06/16 15:24:02 | 00,259,696 | ---- | M] (Google Inc.)
"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" [HKLM] -> C:\Program Files\Windows Live Toolbar\msntb.dll [Windows Live Toolbar] -> [2007/10/19 12:20:48 | 00,546,320 | ---- | M] (Microsoft Corporation)
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll [Yahoo! Toolbar] -> [2006/10/26 11:28:40 | 00,440,384 | ---- | M] (Yahoo! Inc.)
< Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ -> 
WebBrowser\\"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" [HKLM] -> C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [Google Toolbar] -> [2009/06/16 15:24:02 | 00,259,696 | ---- | M] (Google Inc.)
WebBrowser\\"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" [HKLM] -> C:\Program Files\Windows Live Toolbar\msntb.dll [Windows Live Toolbar] -> [2007/10/19 12:20:48 | 00,546,320 | ---- | M] (Microsoft Corporation)
WebBrowser\\"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll [Yahoo! Toolbar] -> [2006/10/26 11:28:40 | 00,440,384 | ---- | M] (Yahoo! Inc.)
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"IntelliType" -> C:\Program Files\Microsoft Hardware\Keyboard\type32.exe ["C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"] -> [2001/06/12 04:20:24 | 00,069,632 | ---- | M] (Microsoft Corporation)
"mcagent_exe" -> C:\Program Files\McAfee.com\Agent\mcagent.exe ["C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey] -> [2009/01/08 21:30:26 | 00,645,328 | ---- | M] (McAfee, Inc.)
"QuickTime Task" -> C:\Program Files\QuickTime\qttask.exe ["C:\Program Files\QuickTime\qttask.exe" -atboottime] -> [2004/04/11 17:34:21 | 00,077,824 | ---- | M] (Apple Computer, Inc.)
"SunJavaUpdateSched" -> C:\Program Files\Java\jre6\bin\jusched.exe ["C:\Program Files\Java\jre6\bin\jusched.exe"] -> [2009/07/25 05:23:12 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.)
"TkBellExe" -> C:\Program Files\Common Files\Real\Update_OB\realsched.exe ["C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot] -> [2009/05/04 12:55:28 | 00,198,160 | ---- | M] (RealNetworks, Inc.)
< RunOnce [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce -> 
"DELDIR0.EXE" -> C:\DOCUME~1\Piazza\LOCALS~1\Temp\DELDIR0.EXE ["C:\DOCUME~1\Piazza\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Guardian\"] -> File not found
"Malwarebytes' Anti-Malware" -> C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent] -> [2009/08/03 13:36:14 | 00,419,088 | ---- | M] (Malwarebytes Corporation)
< Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"OfotoNow USB Detection" -> C:\Program Files\Ofoto\OfotoNow\OFUSBS.dll [C:\WINDOWS\System32\RunDLL32.exe C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL,WatchForConnection OfotoNow] -> [2002/06/20 15:31:08 | 00,077,824 | ---- | M] (Ofoto, Inc.)
"swg" -> C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe] -> [2007/06/17 23:28:25 | 00,068,856 | ---- | M] (Google Inc.)
< All Users Startup Folder > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup -> 
< Piazza Startup Folder > -> C:\Documents and Settings\Piazza\Start Menu\Programs\Startup -> 
< CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"HonorAutoRunSetting" -> [1] -> File not found
< CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
\\"dontdisplaylastusername" -> [0] -> File not found
\\"legalnoticecaption" -> [] -> File not found
\\"legalnoticetext" -> [] -> File not found
\\"shutdownwithoutlogon" -> [1] -> File not found
\\"undockwithoutlogon" -> [1] -> File not found
< CurrentVersion Policy Settings - Explorer [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [145] -> File not found
< CurrentVersion Policy Settings - System [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 
< Internet Explorer Menu Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\ -> 
&Windows Live Search -> C:\Program Files\Windows Live Toolbar\msntb.dll [res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm] -> [2007/10/19 12:20:48 | 00,546,320 | ---- | M] (Microsoft Corporation)
&Yahoo! Search -> C:\Program Files\Yahoo!\Common [file:///C:\Program Files\Yahoo!\Common/ycsrch.htm] -> [2007/10/23 18:08:44 | 00,000,000 | ---D | M]
Yahoo! &Dictionary -> C:\Program Files\Yahoo!\Common [file:///C:\Program Files\Yahoo!\Common/ycdict.htm] -> [2007/10/23 18:08:44 | 00,000,000 | ---D | M]
Yahoo! &Maps -> C:\Program Files\Yahoo!\Common [file:///C:\Program Files\Yahoo!\Common/ycmap.htm] -> [2007/10/23 18:08:44 | 00,000,000 | ---D | M]
Yahoo! &SMS -> C:\Program Files\Yahoo!\Common [file:///C:\Program Files\Yahoo!\Common/ycsms.htm] -> [2007/10/23 18:08:44 | 00,000,000 | ---D | M]
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> 
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}:{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} [HKLM] -> C:\Program Files\Yahoo!\Common\yiesrvc.dll [Button: Yahoo! Services] -> [2006/10/31 16:29:16 | 00,198,136 | ---- | M] (Yahoo! Inc.)
{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}:{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [Menu: Spybot - Search && Destroy Configuration] -> [2008/09/15 15:25:44 | 01,562,960 | ---- | M] (Safer Networking Limited)
{e2e2dd38-d088-4134-82b7-f2ba38496583}:Exec [HKLM] -> C:\WINDOWS\Network Diagnostic\xpnetdiag.exe [Menu: @xpsp3res.dll,-20001] -> [2008/04/13 14:53:32 | 00,558,080 | ---- | M] (Microsoft Corporation)
{FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> C:\Program Files\Messenger\msmsgs.exe [Button: Messenger] -> [2008/04/13 20:12:28 | 01,695,232 | ---- | M] (Microsoft Corporation)
{FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> C:\Program Files\Messenger\msmsgs.exe [Menu: Windows Messenger] -> [2008/04/13 20:12:28 | 01,695,232 | ---- | M] (Microsoft Corporation)
< Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\ -> 
CmdMapping\\"{08B0E5C0-4FCB-11CF-AAA5-00401C608501}" [HKLM] -> C:\WINDOWS\System32\msjava.dll [Web Browser Applet Control] -> [2003/02/28 18:26:26 | 00,947,472 | ---- | M] (Microsoft Corporation)
CmdMapping\\"{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}" [HKLM] -> C:\Program Files\Yahoo!\Common\yiesrvc.dll [Yahoo! IE Services Button] -> [2006/10/31 16:29:16 | 00,198,136 | ---- | M] (Yahoo! Inc.)
CmdMapping\\"{FB5F1910-F110-11d2-BB9E-00C04F795683}" [HKLM] -> C:\Program Files\Messenger\msmsgs.exe [Messenger] -> [2008/04/13 20:12:28 | 01,695,232 | ---- | M] (Microsoft Corporation)
< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> 
PluginsPageFriendlyName -> Microsoft ActiveX Gallery -> 
PluginsPage -> http://activex.microsoft.com/controls/find.asp?ext=%s&mime=%s -> 
< Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
"" -> http://
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 5511 domain(s) found. -> 
50 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 36 range(s) found. -> 
< Trusted Sites Domains [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 1 domain(s) found. -> 
.[msn] -> My Computer -> 
< Trusted Sites Ranges [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> 
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} [HKLM] -> http://www.apple.com/qtactivex/qtplugin.cab [QuickTime Object] -> 
{28F00B0F-DC4E-11D3-ABEC-005004A44EEB} [HKLM] -> http://content.hiwirenetworks.net/inbrowser/cabfiles/2.5.26/Hiwire.cab [Register Class] -> 
{30528230-99F7-4BB4-88D8-FA1D4F56A2AB} [HKLM] -> C:\Program Files\Yahoo!\Common\yinsthelper.dll [YInstStarter Class] -> 
{33564D57-9980-0010-8000-00AA00389B71} [HKLM] -> http://codecs.microsoft.com/codecs/i386/wmv9dmo.cab [Reg Error: Key error.] -> 
{47F59200-8783-11D2-8343-00A0C945A819} [HKLM] -> http://greetingcenter.richfx.com/download/twophase.cab [RFXInstMgr Class] -> 
{4C39376E-FA9D-4349-BACC-D305C1750EF3} [HKLM] -> http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-24.cab [EPUImageControl Class] -> 
{4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} [HKLM] -> http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab [McAfee.com Operating System Class] -> 
{56336BCB-3D8A-11D6-A00B-0050DA18DE71} [HKLM] -> http://207.188.7.150/049aabe9754e4fea2e20/netzip/RdxIE6.cab [Reg Error: Key error.] -> 
{6B4788E2-BAE8-11D2-A1B4-00400512739B} [HKLM] -> http://216.249.25.152/code/PWActiveXImgCtl.CAB [PWMediaSendControl Class] -> 
{89D75D39-5531-47BA-9E4F-B346BA9C362C} [HKLM] -> http://www.callwave.com/include/cab/CWDL_DownLoad.CAB [CWDL_DownLoadControl Class] -> 
{8AD9C840-044E-11D1-B3E9-00805F499D93} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab [Java Plug-in 1.6.0_15] -> 
{9F1C11AA-197B-4942-BA54-47A8489BB47F} [HKLM] -> http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37861.6531597222 [Reg Error: Key error.] -> 
{A17E30C4-A9BA-11D4-8673-60DB54C10000} [HKLM] -> http://us.dl1.yimg.com/download.yahoo.com/dl/installs/essentials/ymmapi_0312.dll [YahooYMailTo Class] -> 
{A31CCCB0-46A8-11D3-A726-005004B35102} [HKLM] -> http://download.actify.com/SpinFire/SFViewerWeb.cab [XView Class] -> 
{BCC0FF27-31D9-4614-A68E-C18E1ADA4389} [HKLM] -> http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab [DwnldGroupMgr Class] -> 
{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab [Reg Error: Key error.] -> 
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab [Reg Error: Key error.] -> 
{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab [Java Plug-in 1.6.0_15] -> 
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab [Java Plug-in 1.6.0_15] -> 
{D27CDB6E-AE6D-11CF-96B8-444553540000} [HKLM] -> http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab [Shockwave Flash Object] -> 
{DE22A7AB-A739-4C58-AD52-21F9CD6306B7} [HKLM] -> http://www.microsoft.com/typography/clearadj.cab [CTAdjust Class] -> 
{E855A2D4-987E-4F3B-A51C-64D10A7E2479} [HKLM] -> http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab [EPSImageControl Class] -> 
{F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} [HKLM] -> http://www.sparkpea.net/controls/msnchat45.cab [MSN Chat Control 4.5] -> 
Microsoft XML Parser for Java [HKLM] -> file://C:\WINDOWS\Java\classes\xmldso.cab [Reg Error: Key error.] -> 
Yahoo! Poker [HKLM] -> http://download2.games.yahoo.com/games/clients/y/pt3_x.cab [Reg Error: Key error.] -> 
Yahoo! Pool 2 [HKLM] -> http://download.games.yahoo.com/games/clients/y/pote_x.cab [Reg Error: Key error.] -> 
< Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ -> 
DhcpNameServer -> 24.92.226.40 24.92.226.41 -> 
< Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ -> 
{0D46357F-D102-4D8B-BAEA-5879577B52A7}\\DhcpNameServer -> 24.92.226.238 24.92.226.98 24.92.226.87 (Motorola SurfBoard 4200 USB Cable Modem) -> 
{170E48DC-AC3B-46D9-975B-4C8B5C53AB0A}\\DhcpNameServer -> 24.92.226.40 24.92.226.41 (Realtek RTL8139 Family PCI Fast Ethernet NIC) -> 
IE Styles -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Styles
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 
Explorer.exe -> C:\WINDOWS\explorer.exe -> [2008/04/13 20:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> -> 
< LSA Authentication Packages [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Authentication Packages -> 
*LSA Authentication Packages* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Authentication Packages -> 
nwprovau -> C:\WINDOWS\System32\nwprovau.dll -> [2008/04/13 20:12:02 | 00,142,336 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> -> 
< Domain Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List -> 
"%windir%\Network Diagnostic\xpnetdiag.exe" -> C:\WINDOWS\Network Diagnostic\xpnetdiag.exe [%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000] -> [2008/04/13 14:53:32 | 00,558,080 | ---- | M] (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" -> C:\WINDOWS\System32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019] -> [2008/04/13 20:12:34 | 00,141,312 | ---- | M] (Microsoft Corporation)
"C:\Program Files\MSN Messenger\msncall.exe" -> C:\Program Files\MSN Messenger\msncall.exe [C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)] -> File not found
"C:\Program Files\MSN Messenger\msnmsgr.exe" -> C:\Program Files\MSN Messenger\msnmsgr.exe [C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0] -> File not found
< Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List -> 
"%windir%\Network Diagnostic\xpnetdiag.exe" -> C:\WINDOWS\Network Diagnostic\xpnetdiag.exe [%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000] -> [2008/04/13 14:53:32 | 00,558,080 | ---- | M] (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" -> C:\WINDOWS\System32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019] -> [2008/04/13 20:12:34 | 00,141,312 | ---- | M] (Microsoft Corporation)
"C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe" -> C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe [C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent] -> [2009/01/09 12:31:16 | 02,482,848 | ---- | M] (McAfee, Inc.)
"C:\Program Files\messenger\msmsgs.exe" -> C:\Program Files\messenger\msmsgs.exe [C:\Program Files\messenger\msmsgs.exe:*:Enabled:Windows Messenger] -> [2008/04/13 20:12:28 | 01,695,232 | ---- | M] (Microsoft Corporation)
"C:\Program Files\MSN Messenger\msncall.exe" -> C:\Program Files\MSN Messenger\msncall.exe [C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)] -> File not found
"C:\Program Files\MSN Messenger\msnmsgr.exe" -> C:\Program Files\MSN Messenger\msnmsgr.exe [C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0] -> File not found
"C:\Program Files\Yahoo!\Messenger\YPager.exe" -> C:\Program Files\Yahoo!\Messenger\YPager.exe [C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Enabled:Yahoo! Messenger] -> File not found
"C:\Program Files\Yahoo!\Messenger\YServer.exe" -> C:\Program Files\Yahoo!\Messenger\YServer.exe [C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server] -> [2006/11/30 22:49:06 | 00,091,640 | ---- | M] (Yahoo! Inc.)
< SafeBoot AlternateShell [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot -> 
"AlternateShell" -> cmd.exe -> 
< CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom ->
"AutoRun" -> 1 -> 
"DisplayName" -> CD-ROM Driver -> 
"ImagePath" -> [System32\DRIVERS\cdrom.sys] -> File not found
< Drives with AutoRun files > -> -> 
C:\AUTOEXEC.BAT [] -> C:\AUTOEXEC.BAT [ NTFS ] -> [2002/04/10 17:19:58 | 00,000,000 | ---- | M] ()
< MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 ->

[Registry - Additional Scans - Safe List]
< Disabled MSConfig Services [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services -> 
"CryptSvc" -> -> 
"gusvc" -> -> 
"WZCSVC" -> -> 
< Disabled MSConfig Folder Items [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\ -> 
C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Event Reminder.lnk -> C:\Program Files\PrintMaster Platinum 18\Remind.exe -> [2007/09/09 16:36:02 | 00,344,064 | ---- | M] (Broderbund Properties LLC)
C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe -> [2005/05/12 00:23:26 | 00,282,624 | ---- | M] (Hewlett-Packard Co.)
C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe -> [2005/05/12 01:49:24 | 00,073,728 | ---- | M] (Hewlett-Packard Co.)
< Disabled MSConfig Registry Items [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ -> 
AdaptecDirectCD hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe -> [2002/01/23 13:09:40 | 00,675,840 | ---- | M] (Roxio)
Adobe Reader Speed Launcher hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe -> [2008/01/11 22:16:38 | 00,039,792 | ---- | M] (Adobe Systems Incorporated)
ctfmon.exe hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> -> File not found
DriverCure hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\ParetoLogic\DriverCure\DriverCure.exe -> File not found
HP Software Update hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\HP\HP Software Update\HPWuSchd2.exe -> [2005/05/12 00:12:54 | 00,049,152 | ---- | M] (Hewlett-Packard Co.)
HPHUPD08 hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe -> [2005/06/01 12:35:55 | 00,049,152 | ---- | M] (Hewlett-Packard)
IndexSearch hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Scansoft\PaperPort\IndexSearch.exe -> [2002/09/23 10:50:26 | 00,036,864 | ---- | M] ()
Microsoft Network Daemon for Win32 hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> -> File not found
MsnMsgr hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\MSN Messenger\MsnMsgr.Exe -> File not found
OneTouch Monitor hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Visioneer OneTouch\OneTouchMon.exe -> [2003/12/11 07:13:14 | 00,110,592 | ---- | M] (Visioneer Inc)
PaperPort PTD hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Scansoft\PaperPort\pptd40nt.exe -> [2002/09/23 10:25:02 | 00,045,108 | ---- | M] (ScanSoft, Inc.)
POINTER hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> -> File not found
Pqs hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> -> File not found
QuickTime Task hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\QuickTime\qttask.exe -> [2004/04/11 17:34:21 | 00,077,824 | ---- | M] (Apple Computer, Inc.)
SpybotSD TeaTimer hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe -> [2009/03/05 16:07:20 | 02,260,480 | RHS- | M] (Safer-Networking Ltd.)
swg hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe -> [2007/06/17 23:28:25 | 00,068,856 | ---- | M] (Google Inc.)
Uniblue RegistryBooster 2009 hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe -> File not found
Utoc hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Documents and Settings\Piazza\Application Data\wtta.exe -> File not found
Yahoo! Pager hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe -> [2006/11/30 22:49:04 | 04,662,776 | ---- | M] (Yahoo! Inc.)
< Disabled MSConfig State [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state -> 
"bootini" -> 0 -> 
"services" -> 2 -> 
"startup" -> 2 -> 
"system.ini" -> 0 -> 
"win.ini" -> 0 ->


----------



## willp68 (Sep 8, 2008)

[Registry - Safe List]
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Page_URL" -> http://go.microsoft.com/fwlink/?LinkId=69157 -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Search_URL" -> http://go.microsoft.com/fwlink/?LinkId=54896 -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Secondary_Page_URL" -> [binary data] -> 
HKEY_LOCAL_MACHINE\: Main\\"Extensions Off Page" -> about:NoAdd-ons -> 
HKEY_LOCAL_MACHINE\: Main\\"Local Page" -> C:\WINDOWS\system32\blank.htm -> 
HKEY_LOCAL_MACHINE\: Main\\"Search Page" -> http://go.microsoft.com/fwlink/?LinkId=54896 -> 
HKEY_LOCAL_MACHINE\: Main\\"Security Risk Page" -> about:SecurityRisk -> 
HKEY_LOCAL_MACHINE\: Main\\"Start Page" -> http://go.microsoft.com/fwlink/?LinkId=69157 -> 
HKEY_LOCAL_MACHINE\: Search\\"CustomizeSearch" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm -> 
HKEY_LOCAL_MACHINE\: Search\\"CustomSearch" -> http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr7/*http://www.yahoo.com/ext/search/search.html -> 
HKEY_LOCAL_MACHINE\: Search\\"Default_Search_URL" -> http://www.google.com/ie -> 
HKEY_LOCAL_MACHINE\: Search\\"SearchAssistant" -> http://www.google.com/ie -> 
< Internet Explorer Settings [HKEY_CURRENT_USER\] > -> -> 
HKEY_CURRENT_USER\: Main\\"Local Page" -> C:\WINDOWS\system32\blank.htm -> 
HKEY_CURRENT_USER\: Main\\"Page_Transitions" -> 1 -> 
HKEY_CURRENT_USER\: Main\\"Search Page" -> http://www.google.com -> 
HKEY_CURRENT_USER\: Main\\"SearchMigratedDefaultName" -> Google -> 
HKEY_CURRENT_USER\: Main\\"SearchMigratedDefaultURL" -> http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 -> 
HKEY_CURRENT_USER\: Main\\"Start Page" -> http://www.google.com/ig?hl=en -> 
HKEY_CURRENT_USER\: Search\\"AutoSearch" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/saautosearch.aspx -> 
HKEY_CURRENT_USER\: Search\\"CustomizeSearch" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm -> 
HKEY_CURRENT_USER\: Search\\"SearchAssistant" -> http://www.google.com/ie -> 
HKEY_CURRENT_USER\: SearchURL\\"" -> http://www.google.com/search?q=%s -> 
HKEY_CURRENT_USER\: URLSearchHooks\\"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll [Yahoo! Toolbar] -> [2006/10/26 11:28:40 | 00,440,384 | ---- | M] (Yahoo! Inc.)
HKEY_CURRENT_USER\: "ProxyEnable" -> 0 -> 
HKEY_CURRENT_USER\: "ProxyOverride" -> 127.0.0.1 -> 
< FireFox Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla
HKLM\software\mozilla\Firefox\Extensions -> -> 
HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758} -> C:\PROGRAM FILES\REAL\REALPLAYER\BROWSERRECORD [C:\PROGRAM FILES\REAL\REALPLAYER\BROWSERRECORD] -> [2009/05/04 12:56:52 | 00,000,000 | ---D | M]
HKLM\software\mozilla\Firefox\Extensions\\[email protected] -> C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF] -> [2009/06/04 16:18:12 | 00,000,000 | ---D | M]
< FireFox Extensions [User Folders] > -> 
< HOSTS File > (734 bytes and 19 lines) -> C:\WINDOWS\System32\drivers\etc\Hosts -> 
Reset Hosts
127.0.0.1 localhost
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> 
{02478D38-C3F9-4EFB-9B51-7695ECA05670} [HKLM] -> C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll [Yahoo! Toolbar Helper] -> [2006/10/26 11:28:40 | 00,440,384 | ---- | M] (Yahoo! Inc.)
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [Adobe PDF Reader Link Helper] -> [2006/10/22 23:08:42 | 00,062,080 | ---- | M] (Adobe Systems Incorporated)
{3049C3E9-B461-4BC5-8870-4C09146192CA} [HKLM] -> C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [RealPlayer Download and Record Plugin for Internet Explorer] -> [2009/05/04 12:56:49 | 00,312,928 | ---- | M] (RealPlayer)
{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [Spybot-S&D IE Protection] -> [2008/09/15 15:25:44 | 01,562,960 | ---- | M] (Safer Networking Limited)
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} [HKLM] -> C:\Program Files\Yahoo!\Common\yiesrvc.dll [Yahoo! IE Services Button] -> [2006/10/31 16:29:16 | 00,198,136 | ---- | M] (Yahoo! Inc.)
{7DB2D5A0-7241-4E79-B68D-6309F01C5231} [HKLM] -> C:\Program Files\McAfee\VirusScan\scriptsn.dll [scriptproxy] -> [2009/03/25 11:05:56 | 00,062,784 | ---- | M] (McAfee, Inc.)
{9030D464-4C02-4ABF-8ECC-5164760863C6} [HKLM] -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [Windows Live Sign-in Helper] -> [2006/07/07 13:29:52 | 00,324,416 | ---- | M] (Microsoft Corporation)
{AA58ED58-01DD-4d91-8333-CF10577473F7} [HKLM] -> C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [Google Toolbar Helper] -> [2009/06/16 15:24:02 | 00,259,696 | ---- | M] (Google Inc.)
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} [HKLM] -> C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll [Google Toolbar Notifier BHO] -> [2009/06/23 01:14:33 | 00,669,168 | ---- | M] (Google Inc.)
{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} [HKLM] -> C:\Program Files\Windows Live Toolbar\msntb.dll [Windows Live Toolbar Helper] -> [2007/10/19 12:20:48 | 00,546,320 | ---- | M] (Microsoft Corporation)
{C84D72FE-E17D-4195-BB24-76C02E2E7C4E} [HKLM] -> C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll [Google Dictionary Compression sdch] -> [2009/04/22 10:26:21 | 00,470,512 | ---- | M] (Google Inc.)
{DBC80044-A445-435b-BC74-9C25C1C588A9} [HKLM] -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [Java(tm) Plug-In 2 SSV Helper] -> [2009/06/04 16:18:06 | 00,035,840 | ---- | M] (Sun Microsystems, Inc.)
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} [HKLM] -> C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [JQSIEStartDetectorImpl Class] -> [2009/06/04 16:18:12 | 00,073,728 | ---- | M] (Sun Microsystems, Inc.)
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar -> 
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" [HKLM] -> C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [Google Toolbar] -> [2009/06/16 15:24:02 | 00,259,696 | ---- | M] (Google Inc.)
"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" [HKLM] -> C:\Program Files\Windows Live Toolbar\msntb.dll [Windows Live Toolbar] -> [2007/10/19 12:20:48 | 00,546,320 | ---- | M] (Microsoft Corporation)
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll [Yahoo! Toolbar] -> [2006/10/26 11:28:40 | 00,440,384 | ---- | M] (Yahoo! Inc.)
< Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ -> 
WebBrowser\\"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" [HKLM] -> C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [Google Toolbar] -> [2009/06/16 15:24:02 | 00,259,696 | ---- | M] (Google Inc.)
WebBrowser\\"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" [HKLM] -> C:\Program Files\Windows Live Toolbar\msntb.dll [Windows Live Toolbar] -> [2007/10/19 12:20:48 | 00,546,320 | ---- | M] (Microsoft Corporation)
WebBrowser\\"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll [Yahoo! Toolbar] -> [2006/10/26 11:28:40 | 00,440,384 | ---- | M] (Yahoo! Inc.)
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"IntelliType" -> C:\Program Files\Microsoft Hardware\Keyboard\type32.exe ["C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"] -> [2001/06/12 04:20:24 | 00,069,632 | ---- | M] (Microsoft Corporation)
"mcagent_exe" -> C:\Program Files\McAfee.com\Agent\mcagent.exe ["C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey] -> [2009/01/08 21:30:26 | 00,645,328 | ---- | M] (McAfee, Inc.)
"QuickTime Task" -> C:\Program Files\QuickTime\qttask.exe ["C:\Program Files\QuickTime\qttask.exe" -atboottime] -> [2004/04/11 17:34:21 | 00,077,824 | ---- | M] (Apple Computer, Inc.)
"SunJavaUpdateSched" -> C:\Program Files\Java\jre6\bin\jusched.exe ["C:\Program Files\Java\jre6\bin\jusched.exe"] -> [2009/07/25 05:23:12 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.)
"TkBellExe" -> C:\Program Files\Common Files\Real\Update_OB\realsched.exe ["C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot] -> [2009/05/04 12:55:28 | 00,198,160 | ---- | M] (RealNetworks, Inc.)
< RunOnce [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce -> 
"DELDIR0.EXE" -> C:\DOCUME~1\Piazza\LOCALS~1\Temp\DELDIR0.EXE ["C:\DOCUME~1\Piazza\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Guardian\"] -> File not found
"Malwarebytes' Anti-Malware" -> C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent] -> [2009/08/03 13:36:14 | 00,419,088 | ---- | M] (Malwarebytes Corporation)
< Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"OfotoNow USB Detection" -> C:\Program Files\Ofoto\OfotoNow\OFUSBS.dll [C:\WINDOWS\System32\RunDLL32.exe C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL,WatchForConnection OfotoNow] -> [2002/06/20 15:31:08 | 00,077,824 | ---- | M] (Ofoto, Inc.)
"swg" -> C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe] -> [2007/06/17 23:28:25 | 00,068,856 | ---- | M] (Google Inc.)
< All Users Startup Folder > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup -> 
< Piazza Startup Folder > -> C:\Documents and Settings\Piazza\Start Menu\Programs\Startup -> 
< CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"HonorAutoRunSetting" -> [1] -> File not found
< CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
\\"dontdisplaylastusername" -> [0] -> File not found
\\"legalnoticecaption" -> [] -> File not found
\\"legalnoticetext" -> [] -> File not found
\\"shutdownwithoutlogon" -> [1] -> File not found
\\"undockwithoutlogon" -> [1] -> File not found
< CurrentVersion Policy Settings - Explorer [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" -> [145] -> File not found
< CurrentVersion Policy Settings - System [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 
< Internet Explorer Menu Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\ -> 
&Windows Live Search -> C:\Program Files\Windows Live Toolbar\msntb.dll [res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm] -> [2007/10/19 12:20:48 | 00,546,320 | ---- | M] (Microsoft Corporation)
&Yahoo! Search -> C:\Program Files\Yahoo!\Common [file:///C:\Program Files\Yahoo!\Common/ycsrch.htm] -> [2007/10/23 18:08:44 | 00,000,000 | ---D | M]
Yahoo! &Dictionary -> C:\Program Files\Yahoo!\Common [file:///C:\Program Files\Yahoo!\Common/ycdict.htm] -> [2007/10/23 18:08:44 | 00,000,000 | ---D | M]
Yahoo! &Maps -> C:\Program Files\Yahoo!\Common [file:///C:\Program Files\Yahoo!\Common/ycmap.htm] -> [2007/10/23 18:08:44 | 00,000,000 | ---D | M]
Yahoo! &SMS -> C:\Program Files\Yahoo!\Common [file:///C:\Program Files\Yahoo!\Common/ycsms.htm] -> [2007/10/23 18:08:44 | 00,000,000 | ---D | M]
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> 
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}:{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} [HKLM] -> C:\Program Files\Yahoo!\Common\yiesrvc.dll [Button: Yahoo! Services] -> [2006/10/31 16:29:16 | 00,198,136 | ---- | M] (Yahoo! Inc.)
{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}:{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [Menu: Spybot - Search && Destroy Configuration] -> [2008/09/15 15:25:44 | 01,562,960 | ---- | M] (Safer Networking Limited)
{e2e2dd38-d088-4134-82b7-f2ba38496583}:Exec [HKLM] -> C:\WINDOWS\Network Diagnostic\xpnetdiag.exe [Menu: @xpsp3res.dll,-20001] -> [2008/04/13 14:53:32 | 00,558,080 | ---- | M] (Microsoft Corporation)
{FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> C:\Program Files\Messenger\msmsgs.exe [Button: Messenger] -> [2008/04/13 20:12:28 | 01,695,232 | ---- | M] (Microsoft Corporation)
{FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> C:\Program Files\Messenger\msmsgs.exe [Menu: Windows Messenger] -> [2008/04/13 20:12:28 | 01,695,232 | ---- | M] (Microsoft Corporation)
< Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\ -> 
CmdMapping\\"{08B0E5C0-4FCB-11CF-AAA5-00401C608501}" [HKLM] -> C:\WINDOWS\System32\msjava.dll [Web Browser Applet Control] -> [2003/02/28 18:26:26 | 00,947,472 | ---- | M] (Microsoft Corporation)
CmdMapping\\"{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}" [HKLM] -> C:\Program Files\Yahoo!\Common\yiesrvc.dll [Yahoo! IE Services Button] -> [2006/10/31 16:29:16 | 00,198,136 | ---- | M] (Yahoo! Inc.)
CmdMapping\\"{FB5F1910-F110-11d2-BB9E-00C04F795683}" [HKLM] -> C:\Program Files\Messenger\msmsgs.exe [Messenger] -> [2008/04/13 20:12:28 | 01,695,232 | ---- | M] (Microsoft Corporation)
< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> 
PluginsPageFriendlyName -> Microsoft ActiveX Gallery -> 
PluginsPage -> http://activex.microsoft.com/controls/find.asp?ext=%s&mime=%s -> 
< Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
"" -> http://
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 5511 domain(s) found. -> 
50 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 36 range(s) found. -> 
< Trusted Sites Domains [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 1 domain(s) found. -> 
.[msn] -> My Computer -> 
< Trusted Sites Ranges [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> 
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} [HKLM] -> http://www.apple.com/qtactivex/qtplugin.cab [QuickTime Object] -> 
{28F00B0F-DC4E-11D3-ABEC-005004A44EEB} [HKLM] -> http://content.hiwirenetworks.net/inbrowser/cabfiles/2.5.26/Hiwire.cab [Register Class] -> 
{30528230-99F7-4BB4-88D8-FA1D4F56A2AB} [HKLM] -> C:\Program Files\Yahoo!\Common\yinsthelper.dll [YInstStarter Class] -> 
{33564D57-9980-0010-8000-00AA00389B71} [HKLM] -> http://codecs.microsoft.com/codecs/i386/wmv9dmo.cab [Reg Error: Key error.] -> 
{47F59200-8783-11D2-8343-00A0C945A819} [HKLM] -> http://greetingcenter.richfx.com/download/twophase.cab [RFXInstMgr Class] -> 
{4C39376E-FA9D-4349-BACC-D305C1750EF3} [HKLM] -> http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-24.cab [EPUImageControl Class] -> 
{4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} [HKLM] -> http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab [McAfee.com Operating System Class] -> 
{56336BCB-3D8A-11D6-A00B-0050DA18DE71} [HKLM] -> http://207.188.7.150/049aabe9754e4fea2e20/netzip/RdxIE6.cab [Reg Error: Key error.] -> 
{6B4788E2-BAE8-11D2-A1B4-00400512739B} [HKLM] -> http://216.249.25.152/code/PWActiveXImgCtl.CAB [PWMediaSendControl Class] -> 
{89D75D39-5531-47BA-9E4F-B346BA9C362C} [HKLM] -> http://www.callwave.com/include/cab/CWDL_DownLoad.CAB [CWDL_DownLoadControl Class] -> 
{8AD9C840-044E-11D1-B3E9-00805F499D93} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab [Java Plug-in 1.6.0_15] -> 
{9F1C11AA-197B-4942-BA54-47A8489BB47F} [HKLM] -> http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37861.6531597222 [Reg Error: Key error.] -> 
{A17E30C4-A9BA-11D4-8673-60DB54C10000} [HKLM] -> http://us.dl1.yimg.com/download.yahoo.com/dl/installs/essentials/ymmapi_0312.dll [YahooYMailTo Class] -> 
{A31CCCB0-46A8-11D3-A726-005004B35102} [HKLM] -> http://download.actify.com/SpinFire/SFViewerWeb.cab [XView Class] -> 
{BCC0FF27-31D9-4614-A68E-C18E1ADA4389} [HKLM] -> http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab [DwnldGroupMgr Class] -> 
{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab [Reg Error: Key error.] -> 
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab [Reg Error: Key error.] -> 
{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab [Java Plug-in 1.6.0_15] -> 
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab [Java Plug-in 1.6.0_15] -> 
{D27CDB6E-AE6D-11CF-96B8-444553540000} [HKLM] -> http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab [Shockwave Flash Object] -> 
{DE22A7AB-A739-4C58-AD52-21F9CD6306B7} [HKLM] -> http://www.microsoft.com/typography/clearadj.cab [CTAdjust Class] -> 
{E855A2D4-987E-4F3B-A51C-64D10A7E2479} [HKLM] -> http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab [EPSImageControl Class] -> 
{F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} [HKLM] -> http://www.sparkpea.net/controls/msnchat45.cab [MSN Chat Control 4.5] -> 
Microsoft XML Parser for Java [HKLM] -> file://C:\WINDOWS\Java\classes\xmldso.cab [Reg Error: Key error.] -> 
Yahoo! Poker [HKLM] -> http://download2.games.yahoo.com/games/clients/y/pt3_x.cab [Reg Error: Key error.] -> 
Yahoo! Pool 2 [HKLM] -> http://download.games.yahoo.com/games/clients/y/pote_x.cab [Reg Error: Key error.] -> 
< Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ -> 
DhcpNameServer -> 24.92.226.40 24.92.226.41 -> 
< Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ -> 
{0D46357F-D102-4D8B-BAEA-5879577B52A7}\\DhcpNameServer -> 24.92.226.238 24.92.226.98 24.92.226.87 (Motorola SurfBoard 4200 USB Cable Modem) -> 
{170E48DC-AC3B-46D9-975B-4C8B5C53AB0A}\\DhcpNameServer -> 24.92.226.40 24.92.226.41 (Realtek RTL8139 Family PCI Fast Ethernet NIC) -> 
IE Styles -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Styles
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 
Explorer.exe -> C:\WINDOWS\explorer.exe -> [2008/04/13 20:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> -> 
< LSA Authentication Packages [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Authentication Packages -> 
*LSA Authentication Packages* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Authentication Packages -> 
nwprovau -> C:\WINDOWS\System32\nwprovau.dll -> [2008/04/13 20:12:02 | 00,142,336 | ---- | M] (Microsoft Corporation)
*MultiFile Done* -> -> 
< Domain Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List -> 
"%windir%\Network Diagnostic\xpnetdiag.exe" -> C:\WINDOWS\Network Diagnostic\xpnetdiag.exe [%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000] -> [2008/04/13 14:53:32 | 00,558,080 | ---- | M] (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" -> C:\WINDOWS\System32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019] -> [2008/04/13 20:12:34 | 00,141,312 | ---- | M] (Microsoft Corporation)
"C:\Program Files\MSN Messenger\msncall.exe" -> C:\Program Files\MSN Messenger\msncall.exe [C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)] -> File not found
"C:\Program Files\MSN Messenger\msnmsgr.exe" -> C:\Program Files\MSN Messenger\msnmsgr.exe [C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0] -> File not found
< Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List -> 
"%windir%\Network Diagnostic\xpnetdiag.exe" -> C:\WINDOWS\Network Diagnostic\xpnetdiag.exe [%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000] -> [2008/04/13 14:53:32 | 00,558,080 | ---- | M] (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" -> C:\WINDOWS\System32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019] -> [2008/04/13 20:12:34 | 00,141,312 | ---- | M] (Microsoft Corporation)
"C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe" -> C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe [C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent] -> [2009/01/09 12:31:16 | 02,482,848 | ---- | M] (McAfee, Inc.)
"C:\Program Files\messenger\msmsgs.exe" -> C:\Program Files\messenger\msmsgs.exe [C:\Program Files\messenger\msmsgs.exe:*:Enabled:Windows Messenger] -> [2008/04/13 20:12:28 | 01,695,232 | ---- | M] (Microsoft Corporation)
"C:\Program Files\MSN Messenger\msncall.exe" -> C:\Program Files\MSN Messenger\msncall.exe [C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)] -> File not found
"C:\Program Files\MSN Messenger\msnmsgr.exe" -> C:\Program Files\MSN Messenger\msnmsgr.exe [C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0] -> File not found
"C:\Program Files\Yahoo!\Messenger\YPager.exe" -> C:\Program Files\Yahoo!\Messenger\YPager.exe [C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Enabled:Yahoo! Messenger] -> File not found
"C:\Program Files\Yahoo!\Messenger\YServer.exe" -> C:\Program Files\Yahoo!\Messenger\YServer.exe [C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server] -> [2006/11/30 22:49:06 | 00,091,640 | ---- | M] (Yahoo! Inc.)
< SafeBoot AlternateShell [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot -> 
"AlternateShell" -> cmd.exe -> 
< CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom ->
"AutoRun" -> 1 -> 
"DisplayName" -> CD-ROM Driver -> 
"ImagePath" -> [System32\DRIVERS\cdrom.sys] -> File not found
< Drives with AutoRun files > -> -> 
C:\AUTOEXEC.BAT [] -> C:\AUTOEXEC.BAT [ NTFS ] -> [2002/04/10 17:19:58 | 00,000,000 | ---- | M] ()
< MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 ->

[Registry - Additional Scans - Safe List]
< Disabled MSConfig Services [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services -> 
"CryptSvc" -> -> 
"gusvc" -> -> 
"WZCSVC" -> -> 
< Disabled MSConfig Folder Items [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\ -> 
C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Event Reminder.lnk -> C:\Program Files\PrintMaster Platinum 18\Remind.exe -> [2007/09/09 16:36:02 | 00,344,064 | ---- | M] (Broderbund Properties LLC)
C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe -> [2005/05/12 00:23:26 | 00,282,624 | ---- | M] (Hewlett-Packard Co.)
C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe -> [2005/05/12 01:49:24 | 00,073,728 | ---- | M] (Hewlett-Packard Co.)
< Disabled MSConfig Registry Items [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ -> 
AdaptecDirectCD hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe -> [2002/01/23 13:09:40 | 00,675,840 | ---- | M] (Roxio)
Adobe Reader Speed Launcher hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe -> [2008/01/11 22:16:38 | 00,039,792 | ---- | M] (Adobe Systems Incorporated)
ctfmon.exe hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> -> File not found
DriverCure hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\ParetoLogic\DriverCure\DriverCure.exe -> File not found
HP Software Update hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\HP\HP Software Update\HPWuSchd2.exe -> [2005/05/12 00:12:54 | 00,049,152 | ---- | M] (Hewlett-Packard Co.)
HPHUPD08 hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe -> [2005/06/01 12:35:55 | 00,049,152 | ---- | M] (Hewlett-Packard)
IndexSearch hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Scansoft\PaperPort\IndexSearch.exe -> [2002/09/23 10:50:26 | 00,036,864 | ---- | M] ()
Microsoft Network Daemon for Win32 hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> -> File not found
MsnMsgr hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\MSN Messenger\MsnMsgr.Exe -> File not found
OneTouch Monitor hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Visioneer OneTouch\OneTouchMon.exe -> [2003/12/11 07:13:14 | 00,110,592 | ---- | M] (Visioneer Inc)
PaperPort PTD hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Scansoft\PaperPort\pptd40nt.exe -> [2002/09/23 10:25:02 | 00,045,108 | ---- | M] (ScanSoft, Inc.)
POINTER hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> -> File not found
Pqs hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> -> File not found
QuickTime Task hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\QuickTime\qttask.exe -> [2004/04/11 17:34:21 | 00,077,824 | ---- | M] (Apple Computer, Inc.)
SpybotSD TeaTimer hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe -> [2009/03/05 16:07:20 | 02,260,480 | RHS- | M] (Safer-Networking Ltd.)
swg hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe -> [2007/06/17 23:28:25 | 00,068,856 | ---- | M] (Google Inc.)
Uniblue RegistryBooster 2009 hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe -> File not found
Utoc hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Documents and Settings\Piazza\Application Data\wtta.exe -> File not found
Yahoo! Pager hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe -> [2006/11/30 22:49:04 | 04,662,776 | ---- | M] (Yahoo! Inc.)
< Disabled MSConfig State [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state -> 
"bootini" -> 0 -> 
"services" -> 2 -> 
"startup" -> 2 -> 
"system.ini" -> 0 -> 
"win.ini" -> 0 ->


----------



## willp68 (Sep 8, 2008)

< EventViewer Logs - Last 10 Errors > -> Event Information -> Description
Application [ Error ] 8/10/2009 8:15:46 AM Computer Name = NEXLINK | Source = crypt32 | ID = 131080 -> Description = Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist. 
Application [ Error ] 8/10/2009 8:16:56 AM Computer Name = NEXLINK | Source = crypt32 | ID = 131080 -> Description = Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist. 
Application [ Error ] 8/10/2009 8:16:56 AM Computer Name = NEXLINK | Source = crypt32 | ID = 131080 -> Description = Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist. 
Application [ Error ] 8/10/2009 4:16:08 PM Computer Name = NEXLINK | Source = Application Error | ID = 1000 -> Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting module jvm.dll, version 11.3.0.2, fault address 0x000a96e6.
Application [ Error ] 8/11/2009 1:40:37 AM Computer Name = NEXLINK | Source = Application Hang | ID = 1002 -> Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Application [ Error ] 8/12/2009 6:14:11 AM Computer Name = NEXLINK | Source = Application Hang | ID = 1002 -> Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Application [ Error ] 8/14/2009 5:45:54 AM Computer Name = NEXLINK | Source = Application Hang | ID = 1002 -> Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Application [ Error ] 8/22/2009 5:56:34 AM Computer Name = NEXLINK | Source = Application Hang | ID = 1002 -> Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Application [ Error ] 8/26/2009 5:16:12 AM Computer Name = NEXLINK | Source = Application Hang | ID = 1002 -> Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
Application [ Error ] 8/27/2009 5:58:31 AM Computer Name = NEXLINK | Source = Application Hang | ID = 1002 -> Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
System [ Error ] 8/14/2009 5:41:22 AM Computer Name = NEXLINK | Source = DCOM | ID = 10010 -> Description = The server {0002DF01-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.
System [ Error ] 8/15/2009 5:50:11 AM Computer Name = NEXLINK | Source = DCOM | ID = 10010 -> Description = The server {0002DF01-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.
System [ Error ] 8/15/2009 5:58:29 AM Computer Name = NEXLINK | Source = DCOM | ID = 10010 -> Description = The server {0002DF01-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.
System [ Error ] 8/21/2009 5:23:10 AM Computer Name = NEXLINK | Source = DCOM | ID = 10010 -> Description = The server {0002DF01-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.
System [ Error ] 8/22/2009 5:52:45 AM Computer Name = NEXLINK | Source = DCOM | ID = 10010 -> Description = The server {0002DF01-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.
System [ Error ] 8/23/2009 5:41:47 PM Computer Name = NEXLINK | Source = DCOM | ID = 10010 -> Description = The server {0002DF01-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.
System [ Error ] 8/24/2009 7:58:47 AM Computer Name = NEXLINK | Source = DCOM | ID = 10010 -> Description = The server {0002DF01-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.
System [ Error ] 8/25/2009 10:14:07 AM Computer Name = NEXLINK | Source = DCOM | ID = 10010 -> Description = The server {0002DF01-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.
System [ Error ] 8/27/2009 5:36:53 AM Computer Name = NEXLINK | Source = DCOM | ID = 10010 -> Description = The server {0002DF01-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.
System [ Error ] 8/27/2009 5:52:06 AM Computer Name = NEXLINK | Source = DCOM | ID = 10010 -> Description = The server {0002DF01-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.

[Files/Folders - Created Within 30 Days]
4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> 
7 C:\Documents and Settings\Piazza\My Documents\*.tmp files -> C:\Documents and Settings\Piazza\My Documents\*.tmp -> 
OTS.exe -> C:\Documents and Settings\Piazza\Desktop\OTS.exe -> [2009/08/30 07:27:37 | 00,514,048 | ---- | C] (OldTimer Tools)
Welcome to Tuna Fever - Oregon Inlet, North Carolina.url -> C:\Documents and Settings\Piazza\Desktop\Welcome to Tuna Fever - Oregon Inlet, North Carolina.url -> [2009/08/29 16:44:56 | 00,000,180 | ---- | C] ()
LastGood -> C:\WINDOWS\LastGood -> [2009/08/26 03:00:37 | 00,000,000 | ---D | C]
Internet Explorer virus Anyone else - Tech Support Guy Forums.url -> C:\Documents and Settings\Piazza\Desktop\Internet Explorer virus Anyone else - Tech Support Guy Forums.url -> [2009/08/25 12:26:14 | 00,000,533 | ---- | C] ()
HijackThis.lnk -> C:\Documents and Settings\Piazza\Desktop\HijackThis.lnk -> [2009/08/23 11:00:31 | 00,001,734 | ---- | C] ()
Trend Micro -> C:\Program Files\Trend Micro -> [2009/08/23 11:00:31 | 00,000,000 | ---D | C]
HJTsetup.exe -> C:\Documents and Settings\Piazza\Desktop\HJTsetup.exe -> [2009/08/23 10:59:33 | 00,812,344 | ---- | C] (Trend Micro Inc.)
Kathy's new Hyundai 8-12-09 -> C:\Documents and Settings\Piazza\My Documents\Kathy's new Hyundai 8-12-09 -> [2009/08/21 10:49:09 | 00,000,000 | ---D | C]
dhtmled.ocx -> C:\WINDOWS\System32\dllcache\dhtmled.ocx -> [2009/08/12 09:05:48 | 00,128,512 | ---- | C] (Microsoft Corporation)
msoe.dll -> C:\WINDOWS\System32\dllcache\msoe.dll -> [2009/08/12 09:05:36 | 01,315,328 | ---- | C] (Microsoft Corporation)
resign letters -> C:\Documents and Settings\Piazza\My Documents\resign letters -> [2009/08/06 06:34:33 | 00,000,000 | ---D | C]
mswebdvd.dll -> C:\WINDOWS\System32\dllcache\mswebdvd.dll -> [2009/08/05 05:01:48 | 00,204,800 | ---- | C] (Microsoft Corporation)
All the kings men and all the kings horses.doc -> C:\Documents and Settings\Piazza\My Documents\All the kings men and all the kings horses.doc -> [2009/08/01 03:27:23 | 00,019,456 | ---- | C] ()
BBW_INFO.INI -> C:\WINDOWS\BBW_INFO.INI -> [2006/09/30 09:51:56 | 00,000,066 | ---- | C] ()
hpzids01.dll -> C:\WINDOWS\System32\hpzids01.dll -> [2005/12/28 20:29:12 | 00,077,824 | R--- | C] ()
maxlink.ini -> C:\WINDOWS\maxlink.ini -> [2005/11/05 21:03:07 | 00,000,767 | ---- | C] ()
thxcfg.ini -> C:\WINDOWS\thxcfg.ini -> [2005/03/18 21:18:52 | 00,000,032 | ---- | C] ()
psisdecd.dll -> C:\WINDOWS\System32\psisdecd.dll -> [2004/08/13 14:11:19 | 00,363,520 | ---- | C] ()
CADRA.INI -> C:\WINDOWS\CADRA.INI -> [2004/02/19 11:52:00 | 00,005,362 | ---- | C] ()
wininit.ini -> C:\WINDOWS\wininit.ini -> [2004/01/01 12:16:23 | 00,000,120 | ---- | C] ()
BBPDFPortMon.dll -> C:\WINDOWS\System32\BBPDFPortMon.dll -> [2003/09/29 19:01:24 | 00,639,052 | ---- | C] ()
InstallPrinter.dll -> C:\WINDOWS\System32\InstallPrinter.dll -> [2003/07/15 10:43:38 | 00,577,635 | ---- | C] ()
Bbgspdf.dll -> C:\WINDOWS\System32\Bbgspdf.dll -> [2003/02/26 11:59:18 | 03,907,655 | ---- | C] ()
stlpmt45.dll -> C:\WINDOWS\System32\stlpmt45.dll -> [2003/01/30 06:04:00 | 00,618,496 | ---- | C] ()
Hposcv07.INI -> C:\WINDOWS\Hposcv07.INI -> [2003/01/27 12:35:24 | 00,000,020 | ---- | C] ()
acdbres.dll -> C:\WINDOWS\System32\acdbres.dll -> [2003/01/17 21:12:46 | 00,079,360 | ---- | C] ()
streamhlp.dll -> C:\WINDOWS\streamhlp.dll -> [2002/12/05 18:51:00 | 00,059,392 | R--- | C] ()
kodakPS.Piazza.ini -> C:\WINDOWS\kodakPS.Piazza.ini -> [2002/10/27 19:55:34 | 00,000,346 | ---- | C] ()
kodakpcd.Piazza.ini -> C:\WINDOWS\kodakpcd.Piazza.ini -> [2002/08/15 05:38:13 | 00,000,298 | ---- | C] ()
Welsof32.dll -> C:\WINDOWS\System32\Welsof32.dll -> [2002/08/09 14:15:16 | 00,101,376 | ---- | C] ()
psuite.ini -> C:\WINDOWS\psuite.ini -> [2002/06/28 13:27:15 | 00,000,078 | ---- | C] ()
ODBC.INI -> C:\WINDOWS\ODBC.INI -> [2002/06/13 20:19:35 | 00,000,376 | ---- | C] ()
cdplayer.ini -> C:\WINDOWS\cdplayer.ini -> [2002/04/30 16:04:47 | 00,010,640 | ---- | C] ()
designgateway.ini -> C:\WINDOWS\designgateway.ini -> [2002/04/17 13:12:40 | 00,000,042 | ---- | C] ()
USBBC.ini -> C:\WINDOWS\USBBC.ini -> [2002/04/12 13:51:04 | 00,000,075 | ---- | C] ()
DettoMe.INI -> C:\WINDOWS\DettoMe.INI -> [2002/04/12 13:51:04 | 00,000,000 | ---- | C] ()
usbbc.sys -> C:\WINDOWS\System32\drivers\usbbc.sys -> [2002/04/12 13:41:28 | 00,015,576 | ---- | C] ()
smscfg.ini -> C:\WINDOWS\smscfg.ini -> [2002/04/11 13:06:21 | 00,000,061 | ---- | C] ()
vidx16.dll -> C:\WINDOWS\System32\vidx16.dll -> [2002/04/10 18:04:06 | 00,010,240 | ---- | C] ()
Jpeg32.dll -> C:\WINDOWS\System32\Jpeg32.dll -> [2002/01/08 17:57:34 | 00,110,592 | ---- | C] ()
oeminfo.ini -> C:\WINDOWS\System32\oeminfo.ini -> [2001/12/11 01:19:56 | 00,000,270 | ---- | C] ()
win.ini -> C:\WINDOWS\win.ini -> [2001/12/11 01:19:23 | 00,000,899 | ---- | C] ()
system.ini -> C:\WINDOWS\system.ini -> [2001/12/11 01:19:14 | 00,000,246 | ---- | C] ()
MSRTEDIT.DLL -> C:\WINDOWS\System32\MSRTEDIT.DLL -> [1999/01/22 14:46:58 | 00,065,536 | ---- | C] ()

[Files/Folders - Modified Within 30 Days]
1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> 
1 C:\Documents and Settings\Piazza\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\Piazza\Local Settings\Temp\*.tmp -> 
310 C:\WINDOWS\Temp\*.tmp files -> C:\WINDOWS\Temp\*.tmp -> 
OTS.exe -> C:\Documents and Settings\Piazza\Desktop\OTS.exe -> [2009/08/30 07:28:17 | 00,514,048 | ---- | M] (OldTimer Tools)
Internet Explorer virus Anyone else - Tech Support Guy Forums.url -> C:\Documents and Settings\Piazza\Desktop\Internet Explorer virus Anyone else - Tech Support Guy Forums.url -> [2009/08/30 07:23:57 | 00,000,533 | ---- | M] ()
Check Updates for Windows Live Toolbar.job -> C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job -> [2009/08/30 07:21:01 | 00,000,256 | ---- | M] ()
little-brown-jug.com - HOME PAGE.url -> C:\Documents and Settings\Piazza\Desktop\little-brown-jug.com - HOME PAGE.url -> [2009/08/29 20:03:00 | 00,000,262 | ---- | M] ()
Welcome to Tuna Fever - Oregon Inlet, North Carolina.url -> C:\Documents and Settings\Piazza\Desktop\Welcome to Tuna Fever - Oregon Inlet, North Carolina.url -> [2009/08/29 16:44:56 | 00,000,180 | ---- | M] ()
Jamestown Forum - Topix.com.url -> C:\Documents and Settings\Piazza\Desktop\Jamestown Forum - Topix.com.url -> [2009/08/28 19:08:21 | 00,203,439 | ---- | M] ()
Log On.url -> C:\Documents and Settings\Piazza\Desktop\Log On.url -> [2009/08/28 19:01:54 | 00,000,344 | ---- | M] ()
Louie-the-laig-breaker - Photobucket - Video and Image Hosting.url -> C:\Documents and Settings\Piazza\Desktop\Louie-the-laig-breaker - Photobucket - Video and Image Hosting.url -> [2009/08/28 14:55:16 | 00,059,097 | ---- | M] ()
Config.MPF -> C:\WINDOWS\System32\Config.MPF -> [2009/08/26 05:55:02 | 00,023,117 | ---- | M] ()
sfdb.dat -> C:\Documents and Settings\Piazza\Local Settings\Temp\jkos-Piazza\engine\bases\sfdb.dat -> [2009/08/26 05:20:32 | 00,000,084 | ---- | M] ()
kosglue-7.0.26.0.dll -> C:\Documents and Settings\Piazza\Local Settings\Temp\jkos-Piazza\binaries\kosglue-7.0.26.0.dll -> [2009/08/26 05:00:07 | 00,729,152 | ---- | M] (Kaspersky Lab)
prLoader.dll -> C:\Documents and Settings\Piazza\Local Settings\Temp\jkos-Piazza\binaries\prLoader.dll -> [2009/08/26 05:00:06 | 00,184,320 | ---- | M] (Kaspersky Lab)
prremote.dll -> C:\Documents and Settings\Piazza\Local Settings\Temp\jkos-Piazza\binaries\prremote.dll -> [2009/08/26 05:00:06 | 00,090,112 | ---- | M] (Kaspersky Lab)
msvcr80.dll -> C:\Documents and Settings\Piazza\Local Settings\Temp\jkos-Piazza\binaries\msvcr80.dll -> [2009/08/26 05:00:05 | 00,626,688 | ---- | M] (Microsoft Corporation)
msvcp80.dll -> C:\Documents and Settings\Piazza\Local Settings\Temp\jkos-Piazza\binaries\msvcp80.dll -> [2009/08/26 05:00:05 | 00,548,864 | ---- | M] (Microsoft Corporation)
kave.dll -> C:\Documents and Settings\Piazza\Local Settings\Temp\jkos-Piazza\binaries\kave.dll -> [2009/08/26 05:00:04 | 00,282,624 | ---- | M] (Kaspersky Lab.)
ikave.dll -> C:\Documents and Settings\Piazza\Local Settings\Temp\jkos-Piazza\binaries\ikave.dll -> [2009/08/26 05:00:04 | 00,065,536 | ---- | M] ()
ScanningProcess.exe -> C:\Documents and Settings\Piazza\Local Settings\Temp\jkos-Piazza\binaries\ScanningProcess.exe -> [2009/08/26 05:00:02 | 00,139,264 | ---- | M] (Kaspersky Lab.)
FSSync.dll -> C:\Documents and Settings\Piazza\Local Settings\Temp\jkos-Piazza\binaries\FSSync.dll -> [2009/08/26 05:00:01 | 00,038,400 | ---- | M] (Kaspersky Lab)
msvcm80.dll -> C:\Documents and Settings\Piazza\Local Settings\Temp\jkos-Piazza\binaries\msvcm80.dll -> [2009/08/26 05:00:00 | 00,479,232 | ---- | M] (Microsoft Corporation)
qmgr1.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat -> [2009/08/26 00:35:19 | 00,004,646 | ---- | M] ()
qmgr0.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat -> [2009/08/26 00:35:19 | 00,004,232 | ---- | M] ()
Perflib_Perfdata_594.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_594.dat -> [2009/08/25 10:31:34 | 00,016,384 | ---- | M] ()
Software & Hardware - Tech Support Guy Forums.url -> C:\Documents and Settings\Piazza\Desktop\Software & Hardware - Tech Support Guy Forums.url -> [2009/08/25 10:19:18 | 00,001,124 | ---- | M] ()
HijackThis.lnk -> C:\Documents and Settings\Piazza\Desktop\HijackThis.lnk -> [2009/08/23 11:00:31 | 00,001,734 | ---- | M] ()
HJTsetup.exe -> C:\Documents and Settings\Piazza\Desktop\HJTsetup.exe -> [2009/08/23 10:59:35 | 00,812,344 | ---- | M] (Trend Micro Inc.)
wpa.dbl -> C:\WINDOWS\System32\wpa.dbl -> [2009/08/22 19:45:43 | 00,001,158 | ---- | M] ()
WGASetup.job -> C:\WINDOWS\tasks\WGASetup.job -> [2009/08/22 19:45:41 | 00,000,260 | ---- | M] ()
SA.DAT -> C:\WINDOWS\tasks\SA.DAT -> [2009/08/22 19:45:02 | 00,000,006 | -H-- | M] ()
bootstat.dat -> C:\WINDOWS\bootstat.dat -> [2009/08/22 19:45:00 | 00,002,048 | --S- | M] ()
ntuser.dat -> C:\Documents and Settings\Piazza\ntuser.dat -> [2009/08/22 19:43:31 | 06,815,744 | ---- | M] ()
ntuser.ini -> C:\Documents and Settings\Piazza\ntuser.ini -> [2009/08/22 19:43:31 | 00,000,178 | -HS- | M] ()
I Save You.com - Free Local Coupons serving Chautauqua County - Home.url -> C:\Documents and Settings\Piazza\Desktop\I Save You.com - Free Local Coupons serving Chautauqua County - Home.url -> [2009/08/16 18:53:54 | 00,000,224 | ---- | M] ()
McDefragTask.job -> C:\WINDOWS\tasks\McDefragTask.job -> [2009/08/15 01:08:29 | 00,000,266 | -H-- | M] ()
imsins.BAK -> C:\WINDOWS\imsins.BAK -> [2009/08/13 03:08:18 | 00,001,374 | ---- | M] ()
Animals Quiz, KBC Quiz, KBC Questions, Multiple Choice Question Answers.url -> C:\Documents and Settings\Piazza\Desktop\Animals Quiz, KBC Quiz, KBC Questions, Multiple Choice Question Answers.url -> [2009/08/09 19:07:15 | 00,000,261 | ---- | M] ()
mswebdvd.dll -> C:\WINDOWS\System32\mswebdvd.dll -> [2009/08/05 05:01:48 | 00,204,800 | ---- | M] (Microsoft Corporation)
mswebdvd.dll -> C:\WINDOWS\System32\dllcache\mswebdvd.dll -> [2009/08/05 05:01:48 | 00,204,800 | ---- | M] (Microsoft Corporation)
mbamswissarmy.sys -> C:\WINDOWS\System32\drivers\mbamswissarmy.sys -> [2009/08/03 13:36:28 | 00,038,160 | ---- | M] (Malwarebytes Corporation)
mbam.sys -> C:\WINDOWS\System32\drivers\mbam.sys -> [2009/08/03 13:36:06 | 00,019,096 | ---- | M] (Malwarebytes Corporation)
jre-6u15-windows-i586-iftw.exe -> C:\Documents and Settings\Piazza\Local Settings\Temp\jre-6u15-windows-i586-iftw.exe -> [2009/08/01 13:29:47 | 00,714,528 | ---- | M] (Sun Microsystems, Inc.)
All the kings men and all the kings horses.doc -> C:\Documents and Settings\Piazza\My Documents\All the kings men and all the kings horses.doc -> [2009/08/01 06:05:55 | 00,019,456 | ---- | M] ()
McQcTask.job -> C:\WINDOWS\tasks\McQcTask.job -> [2009/08/01 01:00:12 | 00,000,354 | -H-- | M] ()
index.dat -> C:\WINDOWS\Temp\History\History.IE5\index.dat -> [2006/11/15 06:53:51 | 00,098,304 | ---- | M] ()
index.dat -> C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\index.dat -> [2006/11/15 06:53:51 | 00,065,536 | ---- | M] ()
index.dat -> C:\WINDOWS\Temp\Cookies\index.dat -> [2006/11/15 06:53:51 | 00,032,768 | ---- | M] ()
< End of report >
[/code]


----------



## Cookiegal (Aug 27, 2003)

I'm sorry but I can't use the log in that format. The instructions were to attach it. Please upload the log as an attachment.


----------



## willp68 (Sep 8, 2008)

Hope this works.


----------



## Cookiegal (Aug 27, 2003)

Start *OTS*. Copy/Paste the information in the code box below into the pane where it says *"Paste fix here"* and then click the "Run Fix" button.

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. CLick the OK button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new HijackThis log please.


```
[Kill All Processes]
[Unregister Dlls]
[Registry - Safe List]
< RunOnce [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
YN -> "DELDIR0.EXE" -> C:\DOCUME~1\Piazza\LOCALS~1\Temp\DELDIR0.EXE ["C:\DOCUME~1\Piazza\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Guardian\"]
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\
YN -> {28F00B0F-DC4E-11D3-ABEC-005004A44EEB} [HKLM] -> http://content.hiwirenetworks.net/inbrowser/cabfiles/2.5.26/Hiwire.cab [Register Class]
YN -> {56336BCB-3D8A-11D6-A00B-0050DA18DE71} [HKLM] -> http://207.188.7.150/049aabe9754e4fea2e20/netzip/RdxIE6.cab [Reg Error: Key error.]
< Domain Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List
YN -> "C:\Program Files\MSN Messenger\msncall.exe" -> C:\Program Files\MSN Messenger\msncall.exe [C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)]
YN -> "C:\Program Files\MSN Messenger\msnmsgr.exe" -> C:\Program Files\MSN Messenger\msnmsgr.exe [C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0]
< Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
YN -> "C:\Program Files\MSN Messenger\msncall.exe" -> C:\Program Files\MSN Messenger\msncall.exe [C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)]
YN -> "C:\Program Files\MSN Messenger\msnmsgr.exe" -> C:\Program Files\MSN Messenger\msnmsgr.exe [C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0]
YN -> "C:\Program Files\Yahoo!\Messenger\YPager.exe" -> C:\Program Files\Yahoo!\Messenger\YPager.exe [C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Enabled:Yahoo! Messenger]
[Registry - Additional Scans - Safe List]
< Disabled MSConfig Registry Items [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\
YN -> ctfmon.exe hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
YN -> DriverCure hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\ParetoLogic\DriverCure\DriverCure.exe
YN -> Microsoft Network Daemon for Win32 hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
YN -> MsnMsgr hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\MSN Messenger\MsnMsgr.Exe
YN -> POINTER hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
YN -> Pqs hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
YN -> Uniblue RegistryBooster 2009 hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe
YN -> Utoc hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> C:\Documents and Settings\Piazza\Application Data\wtta.exe
[Files/Folders - Created Within 30 Days]
NY -> 4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp
NY -> 7 C:\Documents and Settings\Piazza\My Documents\*.tmp files -> C:\Documents and Settings\Piazza\My Documents\*.tmp
[Files/Folders - Modified Within 30 Days]
NY -> 1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp
NY -> 1 C:\Documents and Settings\Piazza\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\Piazza\Local Settings\Temp\*.tmp
NY -> 310 C:\WINDOWS\Temp\*.tmp files -> C:\WINDOWS\Temp\*.tmp
[Purity]
[Empty Temp Folders]
[Start Explorer]
[Reboot]
```


----------



## willp68 (Sep 8, 2008)

All Processes Killed
[Registry - Safe List]
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\\DELDIR0.EXE deleted successfully.
Starting removal of ActiveX control {28F00B0F-DC4E-11D3-ABEC-005004A44EEB}
C:\WINDOWS\Downloaded Program Files\Hiwire.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{28F00B0F-DC4E-11D3-ABEC-005004A44EEB}\ deleted successfully.
Starting removal of ActiveX control {56336BCB-3D8A-11D6-A00B-0050DA18DE71}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{56336BCB-3D8A-11D6-A00B-0050DA18DE71}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56336BCB-3D8A-11D6-A00B-0050DA18DE71}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\msncall.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\msnmsgr.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\msncall.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\MSN Messenger\msnmsgr.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Yahoo!\Messenger\YPager.exe deleted successfully.
[Registry - Additional Scans - Safe List]
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ctfmon.exe hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ not found.
File not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DriverCure hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ not found.
File not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Microsoft Network Daemon for Win32 hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ not found.
File not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MsnMsgr hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ not found.
File not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\POINTER hkey=HKLM key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ not found.
File not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Pqs hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ not found.
File not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Uniblue RegistryBooster 2009 hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ not found.
File not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Utoc hkey=HKCU key=SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ not found.


----------



## willp68 (Sep 8, 2008)

[Files/Folders - Created Within 30 Days]
C:\WINDOWS\msdownld.tmp folder deleted successfully.
[Files/Folders - Modified Within 30 Days]
C:\WINDOWS\Temp\mcu101F.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu101F.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1038.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1038.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu105C.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu105C.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1098.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1098.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu10D6.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu10D6.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu10F4.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu10F4.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1120.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1120.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1131.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1131.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1138.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1138.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1165.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1165.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu12E8.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu12E8.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu134.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu134.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu13F5.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu13F5.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu142.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu142.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu149.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu149.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu14B.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu14B.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu14DB.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu14DB.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu158F.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu158F.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1596.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1596.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu15A0.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu15A0.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu15AF.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu15AF.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu15B4.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu15B4.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1606.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1606.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1629.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1629.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu16B6.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu16B6.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu16BF.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu16BF.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu16C7.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu16C7.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu16E9.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu16E9.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu17.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu17.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu170C.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu170C.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1717.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1717.tmp folder deleted successfully.


----------



## willp68 (Sep 8, 2008)

C:\WINDOWS\Temp\mcu172A.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu172A.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu174D.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu174D.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1764.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1764.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu176A.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu176A.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1787.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1787.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu17CA.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu17CA.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu17D.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu17D.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu17D3.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu17D3.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu18.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu18.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu181C.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu181C.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu183F.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu183F.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu185.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu185.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1855.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1855.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1856.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1856.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1899.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1899.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu189E.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu189E.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu18A9.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu18A9.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu18DF.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu18DF.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu18E2.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu18E2.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1915.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1915.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu193D.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu193D.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1998.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1998.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu19F2.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu19F2.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1A4.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1A4.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1A50.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1A50.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1A84.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1A84.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1BDE.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1BDE.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1BF3.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1BF3.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1C01.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1C01.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1C3D.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1C3D.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1C84.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1C84.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1CAC.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1CAC.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1CCE.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1CCE.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1D.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1D.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1D29.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1D29.tmp folder deleted successfully


----------



## willp68 (Sep 8, 2008)

C:\WINDOWS\Temp\mcu1DE1.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1DE1.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1E.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1E.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1EF.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1EF.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu1F33.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu1F33.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu20.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu20.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu20CD.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu20CD.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu20DE.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu20DE.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2150.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2150.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2164.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2164.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2169.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2169.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu21C8.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu21C8.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu21CB.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu21CB.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2204.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2204.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2256.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2256.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2284.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2284.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu22A8.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu22A8.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu22F.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu22F.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2353.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2353.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu235A.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu235A.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2389.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2389.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu23DC.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu23DC.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu23F1.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu23F1.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu243.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu243.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2471.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2471.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2483.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2483.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu249.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu249.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu24B8.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu24B8.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu24D0.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu24D0.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu253E.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu253E.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu25A9.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu25A9.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu26.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu26.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu260.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu260.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu268.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu268.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2684.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2684.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu269.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu269.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu26E.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu26E.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu272.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu272.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2731.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2731.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2789.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2789.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu279.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu279.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2848.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2848.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu28AB.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu28AB.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu28F.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu28F.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2916.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2916.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu29EE.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu29EE.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2A0D.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2A0D.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2AE.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2AE.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2BD9.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2BD9.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2C61.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2C61.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2CBD.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2CBD.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2D0B.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2D0B.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2D5D.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2D5D.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2DEF.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2DEF.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2E0.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2E0.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2E20.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2E20.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2E3B.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2E3B.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2E42.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2E42.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2E4B.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2E4B.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2E70.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2E70.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2E93.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2E93.tmp folder deleted successfully.


----------



## willp68 (Sep 8, 2008)

C:\WINDOWS\Temp\mcu2EB9.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2EB9.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2EE6.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2EE6.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2EEB.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2EEB.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2F0B.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2F0B.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2F24.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2F24.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu2F83.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu2F83.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu30.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu30.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu303B.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu303B.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu313E.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu313E.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu3181.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu3181.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu3197.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu3197.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu31B6.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu31B6.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu323.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu323.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu326.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu326.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu32A.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu32A.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu3314.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu3314.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu33AC.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu33AC.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu35.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu35.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu368.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu368.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu36D2.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu36D2.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu36E1.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu36E1.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu37CA.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu37CA.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu3809.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu3809.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu38A5.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu38A5.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu3919.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu3919.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu39B7.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu39B7.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu39C6.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu39C6.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu3A07.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu3A07.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu3A2B.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu3A2B.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu3A3E.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu3A3E.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu3B76.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu3B76.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu3BC9.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu3BC9.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu3C6D.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu3C6D.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu3C9D.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu3C9D.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu3E74.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu3E74.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu3F4D.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu3F4D.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu3FDF.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu3FDF.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu41E4.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu41E4.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu422.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu422.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu4260.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu4260.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu441F.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu441F.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu4461.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu4461.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu448E.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu448E.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu44AA.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu44AA.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu45E0.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu45E0.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu45F8.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu45F8.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu465E.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu465E.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu46B0.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu46B0.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu470F.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu470F.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu4739.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu4739.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu4910.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu4910.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu4941.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu4941.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu496.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu496.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu4AB0.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu4AB0.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu4C2A.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu4C2A.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu4C8.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu4C8.tmp folder deleted successfully.


----------



## willp68 (Sep 8, 2008)

C:\WINDOWS\Temp\mcu4D3.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu4D3.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu4D8.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu4D8.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu4EDC.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu4EDC.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu4F.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu4F.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu4F15.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu4F15.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu4F5.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu4F5.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu4FB3.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu4FB3.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu50.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu50.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu507.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu507.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu50F6.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu50F6.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu5138.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu5138.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu515F.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu515F.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu5244.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu5244.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu5273.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu5273.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu5355.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu5355.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu53EB.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu53EB.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu5471.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu5471.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu55.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu55.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu556.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu556.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu55CC.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu55CC.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu572.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu572.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu594D.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu594D.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu5BE.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu5BE.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu5CA8.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu5CA8.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu5EE1.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu5EE1.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu5EF3.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu5EF3.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu62.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu62.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu64B.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu64B.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu664B.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu664B.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu67DF.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu67DF.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu69B3.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu69B3.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu6A.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu6A.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu6A30.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu6A30.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu6AF.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu6AF.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu6BD.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu6BD.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu6BE9.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu6BE9.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu70E4.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu70E4.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu72CF.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu72CF.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu7408.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu7408.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu748D.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu748D.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu765D.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu765D.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu774.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu774.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu7AC.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu7AC.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu7BC.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu7BC.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu7C.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu7C.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu8127.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu8127.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu8141.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu8141.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu8151.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu8151.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu896.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu896.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu89F.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu89F.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu8B.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu8B.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu8C1.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu8C1.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu8C6.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu8C6.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu8CF.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu8CF.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu8D.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu8D.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu8D9.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu8D9.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu8FBA.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu8FBA.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu8FD.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu8FD.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu9.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu9.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu905.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu905.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu91.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu91.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu91F.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu91F.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu928.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu928.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu9893.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu9893.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu99C5.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu99C5.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcu99F.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcu99F.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuA23.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuA23.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuA236.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuA236.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuA25F.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuA25F.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuA3.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuA3.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuA3D.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuA3D.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuA4BC.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuA4BC.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuA68C.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuA68C.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuA8C.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuA8C.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuAA1.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuAA1.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuAA8.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuAA8.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuAC4.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuAC4.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuAD0.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuAD0.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuAD45.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuAD45.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuAE1.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuAE1.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuAEBB.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuAEBB.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuAEE.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuAEE.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuAFA.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuAFA.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuB19.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuB19.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuB41.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuB41.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuB4A.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuB4A.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuBAF.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuBAF.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuBB9.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuBB9.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuBC2.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuBC2.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuBC2B.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuBC2B.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuBCD8.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuBCD8.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuBE0.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuBE0.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuC05.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuC05.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuC06.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuC06.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuC0A.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuC0A.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuC1.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuC1.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuC2C.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuC2C.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuC45.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuC45.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuC4B.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuC4B.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuC6BE.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuC6BE.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuC6E7.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuC6E7.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuC74.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuC74.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuC7B.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuC7B.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuC7C.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuC7C.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuCBD.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuCBD.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuCE7.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuCE7.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuCE9.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuCE9.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuD10.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuD10.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuD1DE.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuD1DE.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuD38.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuD38.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuD74.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuD74.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuD95.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuD95.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuDA4.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuDA4.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuDD5.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuDD5.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuE1A.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuE1A.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuE3F.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuE3F.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuE4C.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuE4C.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuEC5.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuEC5.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuEF7.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuEF7.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuF1.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuF1.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuF85.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuF85.tmp folder deleted successfully.
C:\WINDOWS\Temp\mcuF90.tmp\vso folder deleted successfully.
C:\WINDOWS\Temp\mcuF90.tmp folder deleted successfully.
C:\WINDOWS\Temp\UPD1381.tmp folder deleted successfully.
C:\WINDOWS\Temp\UPD1F6B.tmp folder deleted successfully.
C:\WINDOWS\Temp\UPD24C.tmp folder deleted successfully.
C:\WINDOWS\Temp\UPD3E63.tmp folder deleted successfully.
C:\WINDOWS\Temp\UPD7CC.tmp folder deleted successfully.
C:\WINDOWS\Temp\UPDE53.tmp folder deleted successfully.
[Purity]
Purity scan complete.
[Empty Temp Folders]

User: Administrator
->Temp folder emptied: 340866 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: All Users

User: Default User
->Temp folder emptied: 340866 bytes
->Temporary Internet Files folder emptied: 4538861 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 49554 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Piazza
->Temp folder emptied: 258625 bytes
File delete failed. C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\XZFJ9PKE\bbs[1]. scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\WHEBS9M3\news[1]. scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\S5IROP2F\bbs[1]. scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\Q0P3BE5Z\bbs[1]. scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\OTEFSPER\bbs[1]. scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\OPQV8523\bbs[1]. scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\NIKRNDSP\bbs[1]. scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\KX6BG16J\bbs[1]. scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\K32785Y5\bbs[1]. scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\JJHVF5WO\bbs[1]. scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\85QZ4TQ3\bbs[1]. scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\6X4ZA9A5\bbs[1]. scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\2PQ56B8V\bbs[1]. scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\01ANGTEB\news[1]. scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 17820074 bytes
->Java cache emptied: 49087814 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
File delete failed. C:\WINDOWS\temp\mcafee_V7BJ4JiYqiDsBtQ scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_A4SWq7vj1dAkFcz scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_bL3NS50VaGjimaU scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_NRAVsXXJ28oQthC scheduled to be deleted on reboot.
Windows Temp folder emptied: 542070 bytes
RecycleBin emptied: 117172960 bytes

Total Files Cleaned = 181.41 mb

< End of fix log >
OTS by OldTimer - Version 3.0.10.3 fix logfile created on 09062009_054110
Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\XZFJ9PKE\bbs[1]. not found!
File\Folder C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\WHEBS9M3\news[1]. not found!
File\Folder C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\S5IROP2F\bbs[1]. not found!
File\Folder C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\Q0P3BE5Z\bbs[1]. not found!
File\Folder C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\OTEFSPER\bbs[1]. not found!
File\Folder C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\OPQV8523\bbs[1]. not found!
File\Folder C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\NIKRNDSP\bbs[1]. not found!
File\Folder C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\KX6BG16J\bbs[1]. not found!
File\Folder C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\K32785Y5\bbs[1]. not found!
File\Folder C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\JJHVF5WO\bbs[1]. not found!
File\Folder C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\85QZ4TQ3\bbs[1]. not found!
File\Folder C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\6X4ZA9A5\bbs[1]. not found!
File\Folder C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\2PQ56B8V\bbs[1]. not found!
File\Folder C:\Documents and Settings\Piazza\Local Settings\Temporary Internet Files\Content.IE5\01ANGTEB\news[1]. not found!
File\Folder C:\WINDOWS\temp\mcafee_V7BJ4JiYqiDsBtQ not found!
File\Folder C:\WINDOWS\temp\mcmsc_A4SWq7vj1dAkFcz not found!
File\Folder C:\WINDOWS\temp\mcmsc_bL3NS50VaGjimaU not found!
File\Folder C:\WINDOWS\temp\mcmsc_NRAVsXXJ28oQthC not found!
Registry entries deleted on Reboot...


----------



## willp68 (Sep 8, 2008)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:10:12 AM, on 9/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\RunDLL32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\sol.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [OfotoNow USB Detection] C:\WINDOWS\System32\RunDLL32.exe C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL,WatchForConnection OfotoNow
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {9239E4EC-C9A6-11D2-A844-00C04F68D538} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: Yahoo! Poker - http://download2.games.yahoo.com/games/clients/y/pt3_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {47F59200-8783-11D2-8343-00A0C945A819} (RFXInstMgr Class) - http://greetingcenter.richfx.com/download/twophase.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-24.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.25.152/code/PWActiveXImgCtl.CAB
O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/essentials/ymmapi_0312.dll
O16 - DPF: {A31CCCB0-46A8-11D3-A726-005004B35102} (XView Class) - http://download.actify.com/SpinFire/SFViewerWeb.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://www.sparkpea.net/controls/msnchat45.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
--
End of file - 9926 bytes


----------



## Cookiegal (Aug 27, 2003)

Please visit *Combofix Guide & Instructions * for instructions for installing the recovery console and downloading and running ComboFix.

The only thing different from the instructions there is that when downloading and saving the ComboFix.exe I would like you to rename it to Combo-Fix.exe please.

Post the log from ComboFix when you've accomplished that along with a new HijackThis log.

Important notes regarding ComboFix:

ComboFix may reset a number of Internet Explorer's settings, including making it the default browser. This can easily be changed once we're finished.

ComboFix also prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you, please let me know. This can be undone manually when we're finished. Read  *HERE * for an article written by dvk01 on why we disable autoruns.


----------



## willp68 (Sep 8, 2008)

After going to the Combo-fix site and reading the instructions, I don't feel competent enough to go thru this step. 
My computer is now running much faster than it was so I think I will leave well enough alone for now.

Thank you for the excellent help you have given me and to show my appreciation, I will now donate to this site.


----------



## Cookiegal (Aug 27, 2003)

OK, I understand and thank you for the donation. 

Here are some final instructions for you.

*Follow these steps to uninstall Combofix and all of its files and components.*

 Click *START* then *RUN*
 Now type *ComboFix /u* in the runbox and click *OK*. Note the *space* between the *X* and the *U*, it needs to be there.









Now you should turn system restore off to flush out all previous system restore points, then turn it back on and create a new restore point:

To turn off system restore, on the Desktop, right click on *My Computer* and click on *Properties.*
Click the *System Restore* tab.
Check *Turn off System Restore.*
Click Apply and then click OK.

Restart your computer, turn System Restore back on and create a restore point.

To create a new restore point, click on *Start*  *All Programs*  *Accessories*  *System Tools* and then select *System Restore*.

In the System Restore wizard, select *Create a restore point* and click the Next button.

Type a name for your new restore point then click on Create.

I also recommend downloading  *SPYWAREBLASTER* for added protection.

*Read here* for info on how to tighten your security.


----------



## willp68 (Sep 8, 2008)

Thank you!


----------



## Cookiegal (Aug 27, 2003)

It's my pleasure.


----------

