Internet Taking Approx 2 Mins To Open +two probs

sarasara · April 14, 2011

Hi Techs,

Three problems. I find my XP takes 2 mins aprox to load the internet at startup. I have Comodo AV. This is a recent problem and I cant think what the cause could be.

The other thing is that the taskbox seems to have been corrupted so that when I bring it up ctrl-alt-del I just get a blank pane with only a list of wondows open but no menus and I can only switch it off by right-clicking its green icon in the bottom right-hand corner by the clock, it still works to shut-down progs but tells me nothing.

Thirdly, 'msconfig' cannot be located in 'run.'

PC is in very healthy state, CC Cleaner, Malaware Bytes, registery error fix, de-frag etc carried out most days before shutdown.

Grateful for your advice on this.

sara :)

Starbuck · April 14, 2011

Hi Sara,

PC is in very healthy state, CC Cleaner, Malaware Bytes, registery error fix, de-frag etc carried out most days before shutdown.

Please stop using Registry fixing software.... you'll cause yourself more problems than the software will cure.

Defrag doesn't need to be run on such a regular basis.

Once a month at most will do.

taskbox seems to have been corrupted so that when I bring it up ctrl-alt-del I just get a blank pane with only a list of wondows open but no menus and I can only switch it off by right-clicking its green icon in the bottom right-hand corner by the clock, it still works to shut-down progs but tells me nothing.

Is it just the menu bar and page tabs missing?

Are you sure you haven't turned on 'Tiny Footprint' mode by mistake:

Task Manager can run in a small footprint mode, which removes the menu bar and the page tabs.

To enable tiny footprint mode, double-click in the border around the tabs. To switch back, double-click the border area again.

Thirdly, 'msconfig' cannot be located in 'run.'

If you type msconfig into the run box and click OK.... do you get any message come up? exactly what does it say?

PC is in very healthy state

Sorry, but it doesn't seem that way.

sarasara · April 15, 2011

Firstly Starbuck thank you very much for your kind asistance.

Hi Sara,

Please stop using Registry fixing software.... you'll cause yourself more problems than the software will cure.
Defrag doesn't need to be run on such a regular basis.
Once a month at most will do.

It was running fine Starbuck until I ticked a box I should not have ticked and now I am not sure which one it was. If I give up the software what would be the consequences as registry errors build up?

Is it just the menu bar and page tabs missing?
Are you sure you haven't turned on 'Tiny Footprint' mode by mistake:
To enable tiny footprint mode, double-click in the border around the tabs. To switch back, double-click the border area again.

Now before I do that I must correct my question. When I said taskbar I should have said Task Manager, it is task manager I am having the problem with, all I have is a blank pane with the current webpages listed but no menus and no ability to click it closed. . So I will wait for you to come back on that.

If you type msconfig into the run box and click OK.... do you get any message come up? exactly what does it say?

It says windows cannot find MSCONFIG.

Sorry, but it doesn't seem that way.

Then i'm glad I asked you,
thanks,
sara :)

Starbuck · April 15, 2011

Hi Sara

If I give up the software what would be the consequences as registry errors build up?

Windows is quite resilient to registry errors.

Most will cause no problems at all.

A lot of problems are caused by software writers not writing coding correctly.

Sometimes an entry will be placed in an incorrect position within the registry.... everything will still work correctly, but some registry software may think something is wrong and remove the entry..... resulting in the program then not working correctly.

all I have is a blank pane with the current webpages listed but no menus and no ability to click it closed. . So I will wait for you to come back on that.

Give my suggestion a try, you'll soon know if that is the answer.

It won't cause any problems with your system.

It says windows cannot find MSCONFIG.

Maybe something is either missing or corrupt within the registry.

Do you have the XP installation disc?

This may help............

You don't always need the installation disc

Try running the System File Checker (SFC) to scan all protected files to verify their versions. If SFC discovers that a critical system file has been damaged, altered or missing, it restores the correct version of the file from the cache folder.

You must be logged on as an administrator or as a member of the Administrators group to run sfc and it may ask you to insert your XP Installation CD ..so have it available.

Use Task Manager ... New Task... and type: sfc /scannow

or

Click Start >> Run >> and type: sfc /scannow then click OK

Make sure that you include a space between the c and /.

This command will initiate the Windows File Protection service to scan all protected files, verify their integrity, and replace any problem files.

Note:

Running the System File Checker won't interfere with any of your saved documents.

sarasara · April 15, 2011

Hi Starbuck,

Maybe something is either missing or corrupt within the registry.
Do you have the XP installation disc?

No, XP was pre-installed without a disc. To complicate matters a pc engineer who is no-longer contactable upgraded it to XP professional from a disc he had so I suppose I would would have to buy the software? I tried to run the program but it asked for the disc.

Starbuck · April 15, 2011

Hi Sara

To complicate matters a pc engineer who is no-longer contactable upgraded it to XP professional from a disc he had so I suppose I would would have to buy the software?

So we're not actually sure that the OS is legal then?

Maybe we should find out?

Please download this tool from Microsoft.

1. Double click on MGADiag.exe to run it.

2. Click Continue.

3. The program will run. It takes a while to finish the diagnosis, please be patient.

4. Once done, click on Copy.

5. Open Notepad and paste the contents in. Save this file and post it in your next reply.

sarasara · April 16, 2011

Hi Starbuck,

I ran the tool and glad to say I got 'genuine.' Now as to 'Tiny Footprint' I'm not sure what the taskbar is so dont know where to click,

thanks,

sara.

Starbuck · April 16, 2011

Hi Sara,

I ran the tool and glad to say I got 'genuine.'

http://fc07.deviantart.net/images3/i/2004/146/9/1/Two_thumbs_up.gif

Now as to 'Tiny Footprint' I'm not sure what the taskbar is so dont know where to click,

If Taskmanager looks like this:

http://img.photobucket.com/albums/v708/starbuck50/taskm.png

Double click where the arrow is pointing.... in the outer area.

it should now look like this:

http://img.photobucket.com/albums/v708/starbuck50/taskm2.png

sarasara · April 16, 2011

Hi Starbuck,

Although the PC seems to be functioning perfectly there must be a developing problem. When I pressed Ctrl-alt-delete only the bottom of the task manager appeared, i.e. the end program etc menu. Now yesterday the whole box appeared but that menu was blank. I tried a restart and I have the same problem again. btw, it did not show the info at the bottom about CPU usage/commit charge, just end task-switch-to-new task.

Very strange,

sara:confused:

Starbuck · April 16, 2011

Let's see if we can get a better look at what's going on.

Download OTL to your desktop.
right click on the link and select 'Save Link/Target As'.

if you have problems, try this download link:
OTL
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check

.

http://img.photobucket.com/albums/v708/starbuck50/new/Otllatest.png

netsvcs

msconfig

%SYSTEMDRIVE%\*.*

%systemroot%\system32\Spool\prtprocs\w32x86\*.dll

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\system32\*.exe /lockedfiles

%systemroot%\System32\config\*.sav

%PROGRAMFILES%\*

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

hklm\software\clients\startmenuinternet|command /rs

hklm\software\clients\startmenuinternet|command /64 /rs

CREATERESTOREPOINT

right click in the Custom Scans/Fixes window (under the blue bar) and choose Paste.

http://img.photobucket.com/albums/v708/starbuck50/new%20forum/scan-fix.png
.
Click the Run Scan button.

http://img.photobucket.com/albums/v708/starbuck50/runscan.png
Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them with your next reply.

sarasara · April 16, 2011

Thanks Starbuck,

Here goes:

OTL logfile created on: 16/04/2011 16:16:12 - Run 1

OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\User\My Documents

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 83.00% Memory free

5.00 Gb Paging File | 4.00 Gb Available in Paging File | 90.00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 244.14 Gb Total Space | 203.56 Gb Free Space | 83.38% Space Free | Partition Type: NTFS

Drive D: | 221.61 Gb Total Space | 196.80 Gb Free Space | 88.81% Space Free | Partition Type: NTFS

Drive G: | 699.57 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Drive H: | 2.67 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: MARIA-PC3000 | User Name: User | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\User\My Documents\OTL.scr (OldTimer Tools)

PRC - C:\Program Files\DAP\DAP.exe (SpeedBit Ltd.)

PRC - C:\Program Files\Nero\Update\NASvc.exe (Nero AG)

PRC - C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)

PRC - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)

PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)

PRC - C:\Program Files\COMODO\COMODO BackUp\SynchronizationService.exe ()

PRC - C:\Program Files\COMODO\COMODO BackUp\COSService.exe ()

PRC - C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe (BillP Studios)

PRC - C:\Program Files\COMODO\COMODO Programs Manager\CPMservice.exe ()

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

PRC - C:\WINDOWS\system32\Ctxfihlp.exe (Creative Technology Ltd)

PRC - C:\WINDOWS\system32\CtHelper.exe (Creative Technology Ltd)

PRC - C:\WINDOWS\system32\CTxfispi.exe (Creative Technology Ltd)

PRC - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()

PRC - C:\Program Files\Microsoft Office\Office\OSA.EXE ()

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\User\My Documents\OTL.scr (OldTimer Tools)

MOD - C:\WINDOWS\system32\guard32.dll (COMODO)

MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

MOD - C:\Program Files\BillP Studios\WinPatrol\patrolpro.dll (BillP Studios)

MOD - C:\WINDOWS\system32\CTAGENT.DLL (Creative Technology Ltd)

========== Win32 Services (SafeList) ==========

SRV - (wscsvc) -- File not found

SRV - (HidServ) -- File not found

SRV - (Cleaner_Validator) -- File not found

SRV - (NAUpdate) -- C:\Program Files\Nero\Update\NASvc.exe (Nero AG)

SRV - (cmdAgent) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)

SRV - (SynchronizationService.exe) -- C:\Program Files\COMODO\COMODO BackUp\SynchronizationService.exe ()

SRV - (COSService.exe) -- C:\Program Files\COMODO\COMODO BackUp\COSService.exe ()

SRV - (CPMService) -- C:\Program Files\COMODO\COMODO Programs Manager\CPMservice.exe ()

========== Driver Services (SafeList) ==========

DRV - (Inspect) -- C:\WINDOWS\System32\DRIVERS\inspect.sys (COMODO)

DRV - (cmdHlp) -- C:\WINDOWS\system32\drivers\cmdhlp.sys (COMODO)

DRV - (cmderd) -- C:\WINDOWS\system32\drivers\cmderd.sys (COMODO)

DRV - (cmdGuard) -- C:\WINDOWS\system32\drivers\cmdGuard.sys (COMODO)

DRV - (bdisk) -- C:\WINDOWS\system32\drivers\bdisk.sys ()

DRV - (CBUfs) -- C:\WINDOWS\system32\drivers\CBUFS.sys (COMODO Security Solutions Inc.)

DRV - (cbvd) -- C:\WINDOWS\system32\DRIVERS\cbvd.sys ()

DRV - (vdbus) -- C:\WINDOWS\system32\drivers\vdbus.sys ()

DRV - (reparse) -- C:\WINDOWS\system32\drivers\cbreparse.sys (Windows ® Win 7 DDK provider)

DRV - (cumon) -- C:\WINDOWS\system32\drivers\cumon.sys (Windows ® Win 7 DDK provider)

DRV - (Evdd) -- C:\WINDOWS\system32\drivers\evdd.sys ()

DRV - (SCREAMINGBDRIVER) -- C:\WINDOWS\system32\drivers\ScreamingBAudio.sys (Screaming Bee LLC)

DRV - (acedrv11) -- C:\WINDOWS\system32\drivers\acedrv11.sys (Protect Software GmbH)

DRV - (nvnetbus) -- C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)

DRV - (NVENETFD) -- C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)

DRV - (VCSVADHWSer) Avnex Virtual Audio Device (WDM) -- C:\WINDOWS\system32\drivers\vcsvad.sys (Avnex)

DRV - (WDC_SAM) -- C:\WINDOWS\system32\drivers\wdcsam.sys (Western Digital Technologies)

DRV - (RTLWUSB) -- C:\WINDOWS\system32\drivers\wg111v2.sys (NETGEAR Inc.)

DRV - (ctaud2k) Creative Audio Driver (WDM) -- C:\WINDOWS\system32\drivers\ctaud2k.sys (Creative Technology Ltd)

DRV - (ha20x2k) -- C:\WINDOWS\system32\drivers\ha20x2k.sys (Creative Technology Ltd)

DRV - (emupia) -- C:\WINDOWS\system32\drivers\emupia2k.sys (Creative Technology Ltd)

DRV - (ctsfm2k) -- C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)

DRV - (ctprxy2k) -- C:\WINDOWS\system32\drivers\ctprxy2k.sys (Creative Technology Ltd)

DRV - (ossrv) -- C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)

DRV - (ctac32k) -- C:\WINDOWS\system32\drivers\ctac32k.sys (Creative Technology Ltd)

DRV - (sfsync03) StarForce Protection Synchronization Driver (version 3.x) -- C:\WINDOWS\System32\drivers\sfsync03.sys (Protection Technology)

DRV - (sfvfs02) StarForce Protection VFS Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfvfs02.sys (Protection Technology)

DRV - (UsbFltr) -- C:\WINDOWS\system32\drivers\copperhd.sys (Razer (Asia-Pacific) Pte Ltd)

DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\WINDOWS\System32\drivers\sfdrv01.sys (Protection Technology)

DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfhlp02.sys (Protection Technology)

DRV - (Vcs) -- C:\WINDOWS\system32\drivers\Vcs.sys ()

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C2 EC 86 52 3D 5E CB 01 [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.co.uk/

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.hamsterstart.com/?cfg=2-475-0-0&engine_id=3&provider_id=3&product_id=475&country=GB"

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3

FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:9.0.0.736

FF - prefs.js..extensions.enabledItems: {99a0337c-6303-4879-b72e-500fd9aaca8c}:1.0.8

FF - prefs.js..extensions.enabledItems: {F17C1572-C9EC-4e5c-A542-D05CBB5C5A08}:9.4.0.1

FF - prefs.js..browser.search.selectedEngine: "Yahoo"

FF - prefs.js..keyword.URL: "http://www.hamsterstart.com/s/?src=FF-Address&site=Yahoo!&cfg=2-475-0-0&q="

FF - HKLM\software\mozilla\Firefox\extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/01/16 15:01:37 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/01/16 15:01:30 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/08 23:52:15 | 000,000,000 | ---D | M]

[2010/04/12 02:45:41 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\User\Application Data\Mozilla\Extensions

[2010/04/13 17:30:56 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\uh1w18zb.default\extensions

[2010/04/12 02:47:25 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\uh1w18zb.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

[2011/01/16 14:14:35 | 000,001,061 | ---- | M] () -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\uh1w18zb.default\searchplugins\yahoo-zugo.xml

[2011/02/21 18:46:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2010/05/28 17:53:47 | 000,000,000 | ---D | M] (TextAloud Firefox Plugin) -- C:\Program Files\Mozilla Firefox\extensions\{99a0337c-6303-4879-b72e-500fd9aaca8c}

[2010/09/27 13:21:08 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2010/10/19 20:08:17 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

[2010/12/16 10:23:11 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

[2011/02/21 18:46:24 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

[2011/02/13 21:26:22 | 000,000,000 | ---D | M] (Download Accelerator Plus (DAP) extension) -- C:\PROGRAM FILES\DAP\DAPFIREFOX

[2010/09/27 13:20:49 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF

File not found (No name found) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}

File not found (No name found) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\LINKFILTER@KASPERSKY.RU

[2011/02/02 22:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

[2010/04/13 17:15:58 | 000,075,208 | ---- | M] (Foxit Software Company) -- C:\Program Files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll

[2010/04/01 17:56:49 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml

[2010/04/01 17:56:50 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml

[2010/04/01 17:56:50 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml

[2010/04/01 17:56:50 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/12/21 20:39:38 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)

O2 - BHO: (Download Accelerator Plus Integration) - {FF6C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\DAP\dapieloader.dll (SpeedBit Ltd.)

O3 - HKLM\..\Toolbar: (TextAloud) - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\Program Files\TextAloud\TAForIE.dll ()

O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)

O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\System32\CtHelper.exe (Creative Technology Ltd)

O4 - HKLM..\Run: [CTxfiHlp] C:\WINDOWS\System32\Ctxfihlp.exe (Creative Technology Ltd)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()

O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)

O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)

O4 - HKCU..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe (IGN Entertainment)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE ()

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm ()

O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm ()

O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm ()

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab (CDownloadCtrl Object)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1271176277750 (WUWebControl Class)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O20 - AppInit_DLLs: (C:\WINDOWS\system32\guard32.dll) - C:\WINDOWS\system32\guard32.dll (COMODO)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2010/04/13 17:00:44 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2001/06/27 11:26:18 | 000,000,050 | R--- | M] () - G:\autorun.inf -- [ CDFS ]

O32 - AutoRun File - [2008/07/31 17:26:36 | 000,000,027 | R--- | M] () - H:\autorun.inf -- [ CDFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found

NetSvcs: HidServ - File not found

NetSvcs: Ias - File not found

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT

Error starting restore point: System Restore is disabled.

Error closing restore point: System Restore is disabled.

========== Files/Folders - Created Within 30 Days ==========

[2011/04/16 16:07:29 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\User\My Documents\OTL.scr

[2011/04/16 11:26:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage

[2011/04/16 11:25:30 | 002,031,992 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\User\My Documents\MGADiag.exe

[2011/04/14 20:15:49 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\User\Recent

[2011/03/30 18:24:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Chernobyl Demo

[2011/03/30 18:20:44 | 000,000,000 | ---D | C] -- C:\Program Files\Chernobyl Demo

[2011/03/27 00:34:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Local Settings\Application Data\Help

[2011/03/26 00:39:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Free FLV Converter

[2011/03/26 00:39:45 | 000,000,000 | ---D | C] -- C:\Program Files\Free FLV Converter

[2006/12/12 10:47:24 | 000,034,816 | ---- | C] ( ) -- C:\WINDOWS\System32\a3d.dll

[2006/12/12 10:34:02 | 000,010,240 | ---- | C] ( ) -- C:\WINDOWS\System32\KILLAPPS.EXE

[5 C:\Documents and Settings\User\My Documents\*.tmp files -> C:\Documents and Settings\User\My Documents\*.tmp -> ]

[49 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/16 16:10:30 | 001,474,832 | ---- | M] () -- C:\WINDOWS\System32\drivers\sfi.dat

[2011/04/16 16:08:30 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-527237240-1614895754-1801674531-1001.job

[2011/04/16 16:08:30 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-527237240-1614895754-1801674531-1001.job

[2011/04/16 16:07:45 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\My Documents\OTL.scr

[2011/04/16 14:52:12 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011/04/16 14:50:42 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011/04/16 14:49:43 | 000,064,756 | ---- | M] () -- C:\WINDOWS\System32\DVCState-{00000007-00000000-00000006-00001102-00000005-00291102}.rfx

[2011/04/16 14:49:43 | 000,053,800 | ---- | M] () -- C:\WINDOWS\System32\BMXStateBkp-{00000007-00000000-00000006-00001102-00000005-00291102}.rfx

[2011/04/16 14:49:43 | 000,053,800 | ---- | M] () -- C:\WINDOWS\System32\BMXState-{00000007-00000000-00000006-00001102-00000005-00291102}.rfx

[2011/04/16 14:49:43 | 000,001,080 | ---- | M] () -- C:\WINDOWS\System32\settingsbkup.sfm

[2011/04/16 14:49:43 | 000,001,080 | ---- | M] () -- C:\WINDOWS\System32\settings.sfm

[2011/04/16 14:16:14 | 003,842,048 | -H-- | M] () -- C:\ffastun0.ffx

[2011/04/16 14:16:14 | 000,516,096 | -H-- | M] () -- C:\ffastun.ffl

[2011/04/16 14:16:14 | 000,159,744 | -H-- | M] () -- C:\ffastun.ffo

[2011/04/16 14:16:14 | 000,004,460 | -H-- | M] () -- C:\ffastun.ffa

[2011/04/16 11:26:24 | 002,031,992 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\User\My Documents\MGADiag.exe

[2011/04/16 10:09:09 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{3866EC9F-E3F4-48A5-8B98-F29D52B3E338}.job

[2011/04/15 21:45:06 | 000,000,301 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Presidential Job Approval Center.url

[2011/04/15 20:04:49 | 000,000,217 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Microphone Flags Mic Flag Mic Windshields world's leading manufacturer..url

[2011/04/15 18:46:39 | 000,000,315 | ---- | M] () -- C:\Documents and Settings\User\Desktop\YouTube - Fifties - Petticoat Girl SYLVIA in Wettenberg 2010 - movie027.url

[2011/04/14 20:15:40 | 000,000,131 | ---- | M] () -- C:\WINDOWS\CRC.INI

[2011/04/14 19:40:47 | 000,330,688 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2011/04/14 19:05:47 | 000,432,356 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2011/04/14 19:05:47 | 000,067,312 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2011/04/14 18:38:26 | 000,000,393 | ---- | M] () -- C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Computer Support Forums - FreePCHelp.co.uk.url

[2011/04/14 18:37:43 | 000,000,541 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Internet 2 Mins.url

[2011/04/14 17:53:51 | 000,000,315 | ---- | M] () -- C:\Documents and Settings\User\Desktop\YouTube - petticoat musical.url

[2011/04/14 13:54:37 | 000,002,663 | ---- | M] () -- C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero Vision 10.lnk

[2011/04/14 13:42:00 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

[2011/04/14 00:09:32 | 000,000,289 | ---- | M] () -- C:\Documents and Settings\User\Desktop\YouTube - Day Of Silence 2011.url

[2011/04/12 22:26:27 | 000,000,223 | ---- | M] () -- C:\Documents and Settings\User\Desktop\The British Freedom Party.url

[2011/04/12 22:11:13 | 013,612,043 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Trump America Has Never Been So Low.flv

[2011/04/12 18:40:57 | 000,000,178 | ---- | M] () -- C:\Documents and Settings\User\Desktop\birther issue.url

[2011/04/12 17:08:37 | 000,000,265 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Matt Parrish Waynesboro, VA Country - Americana - Folk Music, Lyrics, Songs, and Videos ReverbNation.url

[2011/04/12 10:29:48 | 000,000,412 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Tech PC Forums.url

[2011/04/10 23:33:30 | 001,662,744 | ---- | M] () -- C:\Documents and Settings\User\My Documents\GADDAFI SIGNS PEACE PLAN Sky News.avi

[2011/04/10 23:30:40 | 001,437,010 | ---- | M] () -- C:\Documents and Settings\User\My Documents\GADDAFI SIGNS PEACE PLAN Sky News.flv

[2011/04/10 20:04:48 | 000,000,293 | ---- | M] () -- C:\Documents and Settings\User\Desktop\YouTube - From Arizona Western Fashion 1950's (2).url

[2011/04/10 17:27:18 | 000,076,800 | ---- | M] () -- C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011/04/10 17:17:29 | 028,063,197 | ---- | M] () -- C:\Documents and Settings\User\My Documents\THE VIRGINIAN_0001.wmv

[2011/04/10 17:17:29 | 028,063,197 | ---- | M] () -- C:\Documents and Settings\User\My Documents\THE VIRGINIAN.wmv

[2011/04/09 21:11:04 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[2011/04/09 20:50:41 | 007,812,812 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Boehner Funds Planned Parenthood And Obamacare.avi

[2011/04/09 20:48:56 | 009,526,465 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Boehner Funds Planned Parenthood And Obamacare.flv

[2011/04/09 18:57:49 | 862,688,736 | ---- | M] () -- C:\Documents and Settings\User\My Documents\BlackMirrorIII-DEMO_en.exe.dap

[2011/04/09 12:59:38 | 000,000,560 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Buy Natures Best Vitamin B3 (Niacin) 250mg from Natures Best.url

[2011/04/08 23:49:18 | 013,179,592 | ---- | M] () -- C:\Documents and Settings\User\My Documents\dap96upg.exe

[2011/04/08 15:46:40 | 036,317,780 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Trump Suzanne Malvaux On The Ropes.avi

[2011/04/08 13:13:34 | 026,107,199 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Trump Suzanne Malvaux On The Ropes.flv

[2011/04/07 21:33:26 | 034,395,498 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Donald Trump Obama Under Investigation.avi

[2011/04/07 21:17:20 | 024,011,538 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Donald Trump Obama Under Investigation.flv

[2011/04/07 13:24:55 | 098,232,028 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Labour25 Pedo Alert..avi

[2011/04/07 13:19:15 | 094,871,351 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Labour25 Pedo Alert..flv

[2011/04/06 22:19:31 | 002,796,296 | ---- | M] () -- C:\Documents and Settings\User\My Documents\OBAMA HATES AMERICA_xvid.avi

[2011/04/06 22:14:19 | 005,771,142 | ---- | M] () -- C:\Documents and Settings\User\My Documents\OBAMA HATES AMERICA.flv

[2011/04/05 23:17:26 | 050,597,560 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Donald Trump Frank Gaffney Martha Zoeller.avi

[2011/04/05 22:58:37 | 077,343,310 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Donald Trump I'll Save The Economy.avi

[2011/04/05 21:12:14 | 024,853,090 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Donald Trump Frank Gaffney Martha Zoeller.flv

[2011/04/05 18:11:02 | 112,503,224 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Obama Birth Pastor Manning Backs Trump.avi

[2011/04/03 21:01:37 | 006,201,531 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Obama Training Al Qaeda In Libya.flv

[2011/04/02 14:08:10 | 000,000,226 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Conservative News, Views & Books - HUMAN EVENTS.url

[2011/04/01 20:57:09 | 004,254,288 | ---- | M] () -- C:\Documents and Settings\User\My Documents\American Songspace SoulSpeak Publishing LLC..mp3

[2011/04/01 20:00:21 | 141,598,029 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Obama Birth Pastor Manning Backs Trump.flv

[2011/04/01 15:05:47 | 027,691,266 | ---- | M] () -- C:\Documents and Settings\User\My Documents\LIBYAN REBEL LEADER STORMS OFF SHOW.avi

[2011/04/01 15:02:26 | 025,972,649 | ---- | M] () -- C:\Documents and Settings\User\My Documents\LIBYAN REBEL LEADER STORMS OFF SHOW.flv

[2011/04/01 14:14:56 | 006,331,196 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Obama 2012 Change We Are Thriving On.flv

[2011/03/30 21:29:56 | 000,000,266 | ---- | M] () -- C:\Documents and Settings\User\Desktop\American Songspace SoulSpeak Publishing LLC..url

[2011/03/30 19:17:28 | 058,406,226 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Donald Trump dirverts from the script - Libya, Birther and Presidential Bid.avi

[2011/03/30 18:24:21 | 000,000,739 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Chernobyl Demo.lnk

[2011/03/30 11:35:07 | 1902,021,466 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Crysis_SP_Demo.zip.dap

[2011/03/30 10:53:01 | 012,788,954 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Obama's Fake Family Photo_xvid.avi

[2011/03/29 22:02:42 | 002,137,762 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Cameron Syria No Fly Zone.avi

[2011/03/29 22:01:07 | 003,263,220 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Prime Minister David Cameron 'This Is Not About Libyan Oil'.flv

[2011/03/29 18:39:53 | 006,298,356 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Cameron 'Better days ahead for Libya'_xvid.avi

[2011/03/29 18:30:26 | 009,997,336 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Cameron 'Ivory Coast Needs Our Help'.flv

[2011/03/29 16:23:08 | 020,603,566 | ---- | M] () -- C:\Documents and Settings\User\My Documents\The Antifa Fad - Radicals for The Establishment_xvid.avi

[2011/03/29 15:43:32 | 000,002,347 | ---- | M] () -- C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2007.lnk

[2011/03/29 14:58:42 | 020,678,028 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Michael Savage Shouts Over Obama's Libya Speech_xvid.avi

[2011/03/29 14:22:27 | 016,289,269 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Cameron Syria, Turkey, Iran Are Innocent.flv

[2011/03/28 18:55:55 | 061,445,106 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Next Us President. DONALD TRUMP_xvid.avi

[2011/03/28 17:17:58 | 000,000,273 | ---- | M] () -- C:\Documents and Settings\User\Desktop\America Radio News.url

[2011/03/28 13:14:54 | 008,835,898 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Obama Lied Libyans Died.avi

[2011/03/26 19:51:07 | 026,568,950 | ---- | M] () -- C:\Documents and Settings\User\My Documents\The Clash - White Riot Live (1978 Victoria Park London)_xvid.avi

[2011/03/26 19:47:25 | 019,486,349 | ---- | M] () -- C:\Documents and Settings\User\My Documents\The Clash - White Riot Live (1978 Victoria Park London).flv

[2011/03/26 15:28:37 | 008,992,928 | ---- | M] () -- C:\Documents and Settings\User\My Documents\2012 Enter The Donald.flv

[2011/03/26 00:39:47 | 000,000,802 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Free FLV Converter.lnk

[2011/03/25 00:09:56 | 000,000,315 | ---- | M] () -- C:\Documents and Settings\User\Desktop\YouTube - ONCE UPON A HONEYMOON 1956 BELL SYSTEM.url

[2011/03/24 23:37:38 | 008,524,519 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Libya Should Attack UK And US.flv

[2011/03/23 22:46:13 | 019,800,764 | ---- | M] () -- C:\Documents and Settings\User\My Documents\LIBYA ~ FULL VERSION OF GADDAFI's LATEST SPEACH ON LIBIAN TV_xvid.avi

[2011/03/22 19:17:23 | 000,001,630 | ---- | M] () -- C:\Documents and Settings\User\My Documents\GadaffiAdmitsPoliticalAsylumisaHoax.html

[2011/03/22 18:58:43 | 001,478,110 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Gadaffi Admits Political Asylum is a Hoax.flv

[2011/03/22 13:34:30 | 000,000,692 | ---- | M] () -- C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\CCleaner.lnk

[2011/03/21 19:26:55 | 1902,019,901 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Crysis_SP_Demo.exe.dap

[2011/03/20 20:01:52 | 000,289,434 | ---- | M] () -- C:\Documents and Settings\User\My Documents\trump.bmp

[2011/03/19 21:41:08 | 012,337,092 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Donald Trump Running For President.avi

[2011/03/19 21:00:25 | 011,261,808 | ---- | M] () -- C:\Documents and Settings\User\My Documents\The_Virginian_1.mp3.dap

[2011/03/19 20:43:15 | 011,261,808 | ---- | M] () -- C:\Documents and Settings\User\My Documents\The_Virginian.mp3

[2011/03/19 20:08:37 | 000,000,501 | ---- | M] () -- C:\Documents and Settings\User\Desktop\printsandthings.url

[2011/03/18 23:59:25 | 003,070,827 | ---- | M] () -- C:\Documents and Settings\User\My Documents\She_Was_Waiting_v1.wma.dap

[2011/03/18 14:20:28 | 043,062,712 | ---- | M] () -- C:\Documents and Settings\User\My Documents\The Donald for President.avi

[2011/03/17 22:09:38 | 006,343,810 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Donald Trump Goes Birther - 3 17 2011.avi

[2011/03/17 20:23:48 | 029,435,580 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Trump on Top in GOP Popularity Poll.avi

[2011/03/17 19:08:04 | 003,178,642 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Trump Ready to Spend $600 Million on Run - ABC News_xvid.avi

[5 C:\Documents and Settings\User\My Documents\*.tmp files -> C:\Documents and Settings\User\My Documents\*.tmp -> ]

[49 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/15 21:45:06 | 000,000,301 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Presidential Job Approval Center.url

[2011/04/15 20:04:48 | 000,000,217 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Microphone Flags Mic Flag Mic Windshields world's leading manufacturer..url

[2011/04/15 18:46:39 | 000,000,315 | ---- | C] () -- C:\Documents and Settings\User\Desktop\YouTube - Fifties - Petticoat Girl SYLVIA in Wettenberg 2010 - movie027.url

[2011/04/14 18:38:26 | 000,000,393 | ---- | C] () -- C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Computer Support Forums - FreePCHelp.co.uk.url

[2011/04/14 18:37:43 | 000,000,541 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Internet 2 Mins.url

[2011/04/14 17:53:51 | 000,000,315 | ---- | C] () -- C:\Documents and Settings\User\Desktop\YouTube - petticoat musical.url

[2011/04/14 00:09:32 | 000,000,289 | ---- | C] () -- C:\Documents and Settings\User\Desktop\YouTube - Day Of Silence 2011.url

[2011/04/12 22:26:27 | 000,000,223 | ---- | C] () -- C:\Documents and Settings\User\Desktop\The British Freedom Party.url

[2011/04/12 22:06:51 | 013,612,043 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Trump America Has Never Been So Low.flv

[2011/04/12 18:40:57 | 000,000,178 | ---- | C] () -- C:\Documents and Settings\User\Desktop\birther issue.url

[2011/04/12 17:08:36 | 000,000,265 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Matt Parrish Waynesboro, VA Country - Americana - Folk Music, Lyrics, Songs, and Videos ReverbNation.url

[2011/04/12 10:29:48 | 000,000,412 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Tech PC Forums.url

[2011/04/10 23:33:41 | 001,662,744 | ---- | C] () -- C:\Documents and Settings\User\My Documents\GADDAFI SIGNS PEACE PLAN Sky News.avi

[2011/04/10 23:30:39 | 001,437,010 | ---- | C] () -- C:\Documents and Settings\User\My Documents\GADDAFI SIGNS PEACE PLAN Sky News.flv

[2011/04/10 20:04:47 | 000,000,293 | ---- | C] () -- C:\Documents and Settings\User\Desktop\YouTube - From Arizona Western Fashion 1950's (2).url

[2011/04/10 17:26:49 | 028,063,197 | ---- | C] () -- C:\Documents and Settings\User\My Documents\THE VIRGINIAN_0001.wmv

[2011/04/10 17:23:28 | 028,063,197 | ---- | C] () -- C:\Documents and Settings\User\My Documents\THE VIRGINIAN.wmv

[2011/04/09 20:51:11 | 007,812,812 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Boehner Funds Planned Parenthood And Obamacare.avi

[2011/04/09 20:43:37 | 009,526,465 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Boehner Funds Planned Parenthood And Obamacare.flv

[2011/04/09 12:59:38 | 000,000,560 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Buy Natures Best Vitamin B3 (Niacin) 250mg from Natures Best.url

[2011/04/08 23:39:37 | 013,179,592 | ---- | C] () -- C:\Documents and Settings\User\My Documents\dap96upg.exe

[2011/04/08 22:34:33 | 862,688,736 | ---- | C] () -- C:\Documents and Settings\User\My Documents\BlackMirrorIII-DEMO_en.exe.dap

[2011/04/08 15:46:53 | 036,317,780 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Trump Suzanne Malvaux On The Ropes.avi

[2011/04/08 12:48:11 | 026,107,199 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Trump Suzanne Malvaux On The Ropes.flv

[2011/04/07 21:33:44 | 034,395,498 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Donald Trump Obama Under Investigation.avi

[2011/04/07 20:58:38 | 024,011,538 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Donald Trump Obama Under Investigation.flv

[2011/04/07 13:25:11 | 098,232,028 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Labour25 Pedo Alert..avi

[2011/04/07 13:19:10 | 094,871,351 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Labour25 Pedo Alert..flv

[2011/04/06 22:19:42 | 002,796,296 | ---- | C] () -- C:\Documents and Settings\User\My Documents\OBAMA HATES AMERICA_xvid.avi

[2011/04/06 22:16:01 | 005,771,142 | ---- | C] () -- C:\Documents and Settings\User\My Documents\OBAMA HATES AMERICA.flv

[2011/04/05 23:17:52 | 050,597,560 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Donald Trump Frank Gaffney Martha Zoeller.avi

[2011/04/05 22:59:46 | 077,343,310 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Donald Trump I'll Save The Economy.avi

[2011/04/05 21:12:12 | 024,853,090 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Donald Trump Frank Gaffney Martha Zoeller.flv

[2011/04/05 18:11:17 | 112,503,224 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Obama Birth Pastor Manning Backs Trump.avi

[2011/04/03 20:58:58 | 006,201,531 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Obama Training Al Qaeda In Libya.flv

[2011/04/02 14:08:07 | 000,000,226 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Conservative News, Views & Books - HUMAN EVENTS.url

[2011/04/01 20:54:31 | 004,254,288 | ---- | C] () -- C:\Documents and Settings\User\My Documents\American Songspace SoulSpeak Publishing LLC..mp3

[2011/04/01 20:00:17 | 141,598,029 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Obama Birth Pastor Manning Backs Trump.flv

[2011/04/01 15:06:20 | 027,691,266 | ---- | C] () -- C:\Documents and Settings\User\My Documents\LIBYAN REBEL LEADER STORMS OFF SHOW.avi

[2011/04/01 15:02:24 | 025,972,649 | ---- | C] () -- C:\Documents and Settings\User\My Documents\LIBYAN REBEL LEADER STORMS OFF SHOW.flv

[2011/04/01 14:11:24 | 006,331,196 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Obama 2012 Change We Are Thriving On.flv

[2011/03/30 21:29:56 | 000,000,266 | ---- | C] () -- C:\Documents and Settings\User\Desktop\American Songspace SoulSpeak Publishing LLC..url

[2011/03/30 19:17:46 | 058,406,226 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Donald Trump dirverts from the script - Libya, Birther and Presidential Bid.avi

[2011/03/30 18:24:21 | 000,000,739 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Chernobyl Demo.lnk

[2011/03/30 10:53:10 | 012,788,954 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Obama's Fake Family Photo_xvid.avi

[2011/03/29 22:03:07 | 002,137,762 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Cameron Syria No Fly Zone.avi

[2011/03/29 21:59:21 | 003,263,220 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Prime Minister David Cameron 'This Is Not About Libyan Oil'.flv

[2011/03/29 18:40:09 | 006,298,356 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Cameron 'Better days ahead for Libya'_xvid.avi

[2011/03/29 18:21:40 | 009,997,336 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Cameron 'Ivory Coast Needs Our Help'.flv

[2011/03/29 16:23:22 | 020,603,566 | ---- | C] () -- C:\Documents and Settings\User\My Documents\The Antifa Fad - Radicals for The Establishment_xvid.avi

[2011/03/29 14:59:06 | 020,678,028 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Michael Savage Shouts Over Obama's Libya Speech_xvid.avi

[2011/03/29 13:57:29 | 016,289,269 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Cameron Syria, Turkey, Iran Are Innocent.flv

[2011/03/28 18:56:15 | 061,445,106 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Next Us President. DONALD TRUMP_xvid.avi

[2011/03/28 17:17:13 | 000,000,273 | ---- | C] () -- C:\Documents and Settings\User\Desktop\America Radio News.url

[2011/03/28 13:15:05 | 008,835,898 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Obama Lied Libyans Died.avi

[2011/03/26 19:51:30 | 026,568,950 | ---- | C] () -- C:\Documents and Settings\User\My Documents\The Clash - White Riot Live (1978 Victoria Park London)_xvid.avi

[2011/03/26 19:34:49 | 019,486,349 | ---- | C] () -- C:\Documents and Settings\User\My Documents\The Clash - White Riot Live (1978 Victoria Park London).flv

[2011/03/26 15:28:37 | 008,992,928 | ---- | C] () -- C:\Documents and Settings\User\My Documents\2012 Enter The Donald.flv

[2011/03/26 00:39:47 | 000,000,802 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Free FLV Converter.lnk

[2011/03/25 22:52:00 | 1902,021,466 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Crysis_SP_Demo.zip.dap

[2011/03/25 00:09:56 | 000,000,315 | ---- | C] () -- C:\Documents and Settings\User\Desktop\YouTube - ONCE UPON A HONEYMOON 1956 BELL SYSTEM.url

[2011/03/24 23:34:41 | 008,524,519 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Libya Should Attack UK And US.flv

[2011/03/23 22:47:30 | 019,800,764 | ---- | C] () -- C:\Documents and Settings\User\My Documents\LIBYA ~ FULL VERSION OF GADDAFI's LATEST SPEACH ON LIBIAN TV_xvid.avi

[2011/03/22 19:17:57 | 000,001,630 | ---- | C] () -- C:\Documents and Settings\User\My Documents\GadaffiAdmitsPoliticalAsylumisaHoax.html

[2011/03/22 18:58:42 | 001,478,110 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Gadaffi Admits Political Asylum is a Hoax.flv

[2011/03/22 13:34:30 | 000,000,692 | ---- | C] () -- C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\CCleaner.lnk

[2011/03/21 13:39:15 | 1902,019,901 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Crysis_SP_Demo.exe.dap

[2011/03/20 20:01:52 | 000,289,434 | ---- | C] () -- C:\Documents and Settings\User\My Documents\trump.bmp

[2011/03/19 21:41:40 | 012,337,092 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Donald Trump Running For President.avi

[2011/03/19 21:00:06 | 011,261,808 | ---- | C] () -- C:\Documents and Settings\User\My Documents\The_Virginian_1.mp3.dap

[2011/03/19 20:38:36 | 011,261,808 | ---- | C] () -- C:\Documents and Settings\User\My Documents\The_Virginian.mp3

[2011/03/19 20:08:37 | 000,000,501 | ---- | C] () -- C:\Documents and Settings\User\Desktop\printsandthings.url

[2011/03/18 23:59:17 | 003,070,827 | ---- | C] () -- C:\Documents and Settings\User\My Documents\She_Was_Waiting_v1.wma.dap

[2011/03/18 14:20:57 | 043,062,712 | ---- | C] () -- C:\Documents and Settings\User\My Documents\The Donald for President.avi

[2011/03/17 22:10:02 | 006,343,810 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Donald Trump Goes Birther - 3 17 2011.avi

[2011/03/17 20:25:48 | 000,000,951 | ---- | C] () -- C:\Documents and Settings\User\My Documents\YouTube - blenkarni's YouTube (2).url

[2011/03/17 20:24:59 | 029,435,580 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Trump on Top in GOP Popularity Poll.avi

[2011/03/17 19:08:49 | 003,178,642 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Trump Ready to Spend $600 Million on Run - ABC News_xvid.avi

[2011/03/06 14:47:18 | 000,067,276 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat

[2011/03/03 01:21:51 | 000,306,008 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

[2011/02/18 14:15:59 | 000,000,047 | ---- | C] () -- C:\WINDOWS\wininit.ini

[2011/01/31 21:43:55 | 000,000,004 | ---- | C] () -- C:\WINDOWS\Pix11.dat

[2011/01/18 19:23:18 | 000,000,131 | ---- | C] () -- C:\WINDOWS\CRC.INI

[2010/12/30 13:50:59 | 000,018,920 | ---- | C] () -- C:\WINDOWS\System32\drivers\evdd.sys

[2010/12/30 00:40:50 | 001,474,832 | ---- | C] () -- C:\WINDOWS\System32\drivers\sfi.dat

[2010/12/02 13:59:52 | 000,073,416 | ---- | C] () -- C:\WINDOWS\System32\drivers\bdisk.sys

[2010/12/02 13:59:38 | 000,428,248 | ---- | C] () -- C:\WINDOWS\System32\drivers\CBVD.sys

[2010/12/02 13:59:32 | 000,573,856 | ---- | C] () -- C:\WINDOWS\System32\drivers\vdbus.sys

[2010/09/27 14:29:42 | 000,232,968 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin

[2010/09/27 14:29:39 | 000,232,968 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin

[2010/09/27 14:29:39 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin

[2010/09/20 16:30:30 | 000,000,061 | ---- | C] () -- C:\WINDOWS\System32\SYSVCPDRV.SYS

[2010/09/20 16:28:50 | 000,006,852 | ---- | C] () -- C:\WINDOWS\System32\drivers\Vcs.sys

[2010/06/04 18:54:02 | 000,000,324 | ---- | C] () -- C:\WINDOWS\game.ini

[2010/05/24 19:54:01 | 000,000,088 | ---- | C] () -- C:\WINDOWS\cdplayer.ini

[2010/05/16 19:18:58 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll

[2010/04/29 20:27:14 | 000,076,800 | ---- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010/04/29 12:34:51 | 000,000,213 | ---- | C] () -- C:\WINDOWS\LEXSTAT.INI

[2010/04/24 12:03:48 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2010/04/16 17:39:11 | 000,006,136 | ---- | C] () -- C:\WINDOWS\System32\drivers\nvphy.bin

[2010/04/13 18:10:36 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll

[2010/04/13 17:52:43 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2010/04/13 17:50:08 | 000,330,688 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010/04/13 17:25:40 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2010/04/13 17:25:12 | 002,195,030 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin

[2010/04/13 17:10:47 | 000,966,765 | ---- | C] () -- C:\WINDOWS\System32\acAuth.dll

[2010/04/13 17:10:47 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\SCMLib.dll

[2010/04/13 17:10:47 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\RtlGina2.dll

[2010/04/13 17:01:52 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2010/04/13 16:58:42 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2008/04/14 06:55:28 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin

[2008/04/14 06:41:56 | 000,755,200 | ---- | C] () -- C:\WINDOWS\System32\ir50_32.dll

[2008/04/14 06:41:56 | 000,338,432 | ---- | C] () -- C:\WINDOWS\System32\ir41_qcx.dll

[2008/04/14 06:41:56 | 000,200,192 | ---- | C] () -- C:\WINDOWS\System32\ir50_qc.dll

[2008/04/14 06:41:56 | 000,183,808 | ---- | C] () -- C:\WINDOWS\System32\ir50_qcx.dll

[2008/04/14 06:41:56 | 000,120,320 | ---- | C] () -- C:\WINDOWS\System32\ir41_qc.dll

[2006/12/31 08:57:08 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2006/12/19 07:15:20 | 000,065,154 | ---- | C] () -- C:\WINDOWS\System32\instwdm.ini

[2006/12/12 10:48:22 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CTBurst.dll

[2006/12/12 10:46:52 | 000,037,888 | ---- | C] () -- C:\WINDOWS\PSCONV.EXE

[2006/12/12 10:39:02 | 000,325,821 | ---- | C] () -- C:\WINDOWS\System32\ctdlang.dat

[2006/12/12 10:39:02 | 000,046,273 | ---- | C] () -- C:\WINDOWS\System32\ctdnlstr.dat

[2006/12/12 10:36:32 | 000,035,328 | ---- | C] () -- C:\WINDOWS\System32\regplib.exe

[2006/12/12 10:36:14 | 000,149,838 | ---- | C] () -- C:\WINDOWS\System32\CTBAS2W.DAT

[2006/12/12 10:34:30 | 000,274,587 | ---- | C] () -- C:\WINDOWS\System32\CTSBAS2W.DAT

[2006/12/12 10:34:22 | 000,240,568 | ---- | C] () -- C:\WINDOWS\System32\CTSBASW.DAT

[2006/12/12 10:34:22 | 000,114,908 | ---- | C] () -- C:\WINDOWS\System32\CTBASICW.DAT

[2006/12/12 10:34:06 | 000,313,207 | ---- | C] () -- C:\WINDOWS\System32\ctstatic.dat

[2006/12/12 10:34:06 | 000,053,932 | ---- | C] () -- C:\WINDOWS\System32\ctdaught.dat

[2006/12/12 10:34:04 | 000,005,120 | ---- | C] () -- C:\WINDOWS\System32\ENLOCSTR.EXE

[2006/11/30 08:01:26 | 000,000,054 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini

[2006/05/18 07:03:24 | 000,000,269 | ---- | C] () -- C:\WINDOWS\System32\KILL.INI

[2001/08/23 13:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2001/08/23 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2001/08/23 13:00:00 | 000,432,356 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2001/08/23 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2001/08/23 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2001/08/23 13:00:00 | 000,067,312 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2001/08/23 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2001/08/23 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2001/08/23 13:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2001/08/23 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

[1997/08/19 00:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL

[1997/08/19 00:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL

========== LOP Check ==========

[2010/12/30 00:08:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software

[2010/12/23 21:15:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\InstallMate

[2010/11/02 21:33:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\muvee Technologies

[2010/12/02 12:36:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Optimizer Pro

[2010/05/15 17:09:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Pinnacle

[2010/10/06 12:47:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Screaming Bee

[2010/11/03 18:47:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sony

[2011/02/13 21:26:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SpeedBit

[2011/04/16 16:07:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP

[2010/12/02 12:35:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\W3i

[2010/10/23 23:25:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

[2010/12/11 17:31:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{E961CE1B-C3EA-4882-9F67-F859B555D097}

[2010/04/13 18:09:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\AnvSoft

[2010/09/17 21:36:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Avnex

[2010/12/25 22:06:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\EurekaLog

[2011/03/16 21:05:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\FreeFLVConverter

[2011/01/16 14:15:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\HamsterSoft

[2010/11/02 21:36:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\muvee Technologies

[2010/09/30 09:40:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\ProtectDISC

[2010/09/03 21:34:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Screaming Bee

[2010/05/23 22:07:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Serif

[2011/02/13 21:18:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Sony

[2010/12/23 21:15:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\WinPatrol

[2011/02/24 01:27:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Xilisoft

[2011/04/14 13:42:00 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job

[2011/04/16 10:09:09 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{3866EC9F-E3F4-48A5-8B98-F29D52B3E338}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >

[2010/12/23 10:35:46 | 000,011,284 | ---- | M] () -- C:\aaw7boot.log

[2010/04/13 17:00:44 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT

[2010/04/17 00:35:43 | 000,000,355 | ---- | M] () -- C:\Boot.bak

[2010/12/21 20:33:59 | 000,000,471 | RHS- | M] () -- C:\boot.ini

[2009/07/14 02:38:58 | 000,383,562 | RHS- | M] () -- C:\bootmgr

[2010/04/17 00:35:44 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK

[2004/08/04 00:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr

[2010/04/13 17:00:44 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS

[2011/04/16 14:16:14 | 000,004,460 | -H-- | M] () -- C:\ffastun.ffa

[2011/04/16 14:16:14 | 000,516,096 | -H-- | M] () -- C:\ffastun.ffl

[2011/04/16 14:16:14 | 000,159,744 | -H-- | M] () -- C:\ffastun.ffo

[2011/04/16 14:16:14 | 003,842,048 | -H-- | M] () -- C:\ffastun0.ffx

[2010/12/30 13:51:18 | 629,145,600 | -H-- | M] () -- C:\fileimage.dat

[2010/12/25 22:12:39 | 000,009,443 | ---- | M] () -- C:\holy rosary 1.TXT

[2010/04/13 17:00:44 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

[2010/08/22 13:09:25 | 000,003,163 | ---- | M] () -- C:\marian prayers.TXT

[2010/09/26 21:58:50 | 000,031,848 | ---- | M] () -- C:\Moira Rosary.txt

[2010/07/21 09:05:24 | 000,028,844 | ---- | M] () -- C:\moiras rosary file.txt

[2010/07/20 22:35:41 | 000,005,563 | ---- | M] () -- C:\moiras rosary.txt

[2010/04/13 17:00:44 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS

[2008/04/13 23:13:04 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM

[2008/04/14 01:01:44 | 000,250,048 | RHS- | M] () -- C:\ntldr

[2011/04/16 14:50:35 | 2145,386,496 | -HS- | M] () -- C:\pagefile.sys

[2011/01/16 17:58:23 | 000,015,707 | ---- | M] () -- C:\the holy rosary full.TXT

[2011/02/27 22:43:46 | 000,015,984 | ---- | M] () -- C:\the holy rosary.txt

[2010/04/16 15:48:24 | 000,000,020 | RHS- | M] () -- C:\winx.ld

[2010/04/16 15:48:24 | 000,340,044 | RHS- | M] () -- C:\YTJBZ

[49 C:\*.tmp files -> C:\*.tmp -> ]

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >

[2008/07/06 13:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll

[2006/05/11 05:46:58 | 000,080,896 | ---- | M] (Lexmark International) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\LXDAPP5C.DLL

[2006/10/26 19:58:12 | 000,030,512 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

[2009/03/08 04:31:44 | 000,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll

[2009/03/08 04:31:38 | 000,216,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtrans.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\system32\*.exe /lockedfiles >

< %systemroot%\System32\config\*.sav >

[2010/04/13 17:48:53 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav

[2010/04/13 17:48:53 | 001,073,152 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav

[2010/04/13 17:48:52 | 000,892,928 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate\AU >

< hklm\software\clients\startmenuinternet|command /rs >

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2010/04/01 19:00:32 | 000,552,136 | ---- | M] (Mozilla Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2010/04/01 19:00:32 | 000,552,136 | ---- | M] (Mozilla Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2010/04/01 19:00:32 | 000,552,136 | ---- | M] (Mozilla Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2010/04/01 19:00:32 | 000,910,296 | ---- | M] (Mozilla Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2010/04/01 19:00:32 | 000,910,296 | ---- | M] (Mozilla Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2010/04/01 19:00:32 | 000,910,296 | ---- | M] (Mozilla Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2011/02/18 12:49:53 | 000,173,568 | ---- | M] (Microsoft Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2011/02/18 12:49:53 | 000,173,568 | ---- | M] (Microsoft Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2011/02/18 12:49:53 | 000,173,568 | ---- | M] (Microsoft Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)

HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)

< hklm\software\clients\startmenuinternet|command /64 /rs >